dineway 0.1.49 → 0.2.0

package/dist/astro/index.mjs

@@ -1,7 +1,7 @@
-import { t as INTERNAL_MEDIA_PREFIX } from "../normalize-ByemhhfW.mjs";
-import { n as VERSION, t as COMMIT } from "../version-C4gfn0PJ.mjs";
-import { t as defaultSeed } from "../default-B6iaLvP7.mjs";
-import { n as validateAllowedOrigins, r as validateOriginShape } from "../allowed-origins-CyGnbgBd.mjs";
+import { t as INTERNAL_MEDIA_PREFIX } from "../normalize-5ek_z7de.mjs";
+import { n as VERSION, t as COMMIT } from "../version-BTvfRGc6.mjs";
+import { t as defaultSeed } from "../default--K40jqm0.mjs";
+import { n as validateAllowedOrigins, r as validateOriginShape } from "../allowed-origins-_oeyP6x-.mjs";
 import { createRequire } from "node:module";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
@@ -61,6 +61,27 @@ function local(config) {
 	};
 }
 
+//#endregion
+//#region src/astro/object-cache/adapters.ts
+/**
+* In-isolate memory object cache.
+*
+* Caches query results across requests within a single process. On Node this
+* is a genuine cross-request cache; on multi-process deployments each process
+* keeps its own cache. Useful for local development regardless of target.
+*
+* @example
+* ```ts
+* dineway({ objectCache: memoryCache({ defaultTtl: 600 }) })
+* ```
+*/
+function memoryCache(options = {}) {
+	return {
+		entrypoint: "dineway/object-cache/memory",
+		config: { ...options }
+	};
+}
+
 //#endregion
 //#region src/astro/integration/font-provider.ts
 /**
@@ -196,10 +217,28 @@ function resolveRoute(route) {
 		return resolve(__dirname, "../routes", route);
 	}
 }
+const PUBLIC_ROUTE_OVERRIDE_EXTENSIONS = [
+	".astro",
+	".js",
+	".ts",
+	".jsx",
+	".tsx",
+	".mjs",
+	".mts",
+	".md",
+	".mdx",
+	".html"
+];
+function hasUserDefinedPublicRoute(srcDir, basename) {
+	const srcDirPath = fileURLToPath(srcDir);
+	return PUBLIC_ROUTE_OVERRIDE_EXTENSIONS.some((extension) => {
+		return existsSync(resolve(srcDirPath, "pages", `${basename}${extension}`)) || existsSync(resolve(srcDirPath, "pages", basename, `index${extension}`));
+	});
+}
 /**
 * Injects all core Dineway routes.
 */
-function injectCoreRoutes(injectRoute) {
+function injectCoreRoutes(injectRoute, options = {}) {
 	injectRoute({
 		pattern: "/_dineway/admin/[...path]",
 		entrypoint: resolveRoute("admin.astro")
@@ -744,6 +783,10 @@ function injectCoreRoutes(injectRoute) {
 		pattern: "/_dineway/api/comments/[collection]/[contentId]",
 		entrypoint: resolveRoute("api/comments/[collection]/[contentId]/index.ts")
 	});
+	injectRoute({
+		pattern: "/_dineway/api/comments/[collection]/[contentId]/reactions",
+		entrypoint: resolveRoute("api/comments/[collection]/[contentId]/reactions.ts")
+	});
 	injectRoute({
 		pattern: "/_dineway/api/admin/comments",
 		entrypoint: resolveRoute("api/admin/comments/index.ts")
@@ -764,7 +807,7 @@ function injectCoreRoutes(injectRoute) {
 		pattern: "/_dineway/api/admin/comments/[id]",
 		entrypoint: resolveRoute("api/admin/comments/[id].ts")
 	});
-	injectRoute({
+	if (!options.srcDir || !hasUserDefinedPublicRoute(options.srcDir, "sitemap.xml")) injectRoute({
 		pattern: "/sitemap.xml",
 		entrypoint: resolveRoute("sitemap.xml.ts")
 	});
@@ -772,7 +815,7 @@ function injectCoreRoutes(injectRoute) {
 		pattern: "/sitemap-[collection].xml",
 		entrypoint: resolveRoute("sitemap-[collection].xml.ts")
 	});
-	injectRoute({
+	if (!options.srcDir || !hasUserDefinedPublicRoute(options.srcDir, "robots.txt")) injectRoute({
 		pattern: "/robots.txt",
 		entrypoint: resolveRoute("robots.txt.ts")
 	});
@@ -947,6 +990,8 @@ const VIRTUAL_DIALECT_ID = "virtual:dineway/dialect";
 const RESOLVED_VIRTUAL_DIALECT_ID = "\0" + VIRTUAL_DIALECT_ID;
 const VIRTUAL_STORAGE_ID = "virtual:dineway/storage";
 const RESOLVED_VIRTUAL_STORAGE_ID = "\0" + VIRTUAL_STORAGE_ID;
+const VIRTUAL_OBJECT_CACHE_ID = "virtual:dineway/object-cache";
+const RESOLVED_VIRTUAL_OBJECT_CACHE_ID = "\0" + VIRTUAL_OBJECT_CACHE_ID;
 const VIRTUAL_ADMIN_REGISTRY_ID = "virtual:dineway/admin-registry";
 const RESOLVED_VIRTUAL_ADMIN_REGISTRY_ID = "\0" + VIRTUAL_ADMIN_REGISTRY_ID;
 const VIRTUAL_PLUGINS_ID = "virtual:dineway/plugins";
@@ -993,7 +1038,19 @@ function generateStorageModule(storageEntrypoint) {
 	return `
 import { createStorage as _createStorage } from "${storageEntrypoint}";
 export const createStorage = _createStorage;
-`;
+	`;
+}
+/**
+* Generates the object-cache virtual module.
+* Statically imports the configured backend factory.
+*/
+function generateObjectCacheModule(objectCacheEntrypoint, config) {
+	if (!objectCacheEntrypoint) return [`export const createObjectCache = undefined;`, `export const objectCacheConfig = {};`].join("\n");
+	return `
+	import { createObjectCache as _createObjectCache } from "${objectCacheEntrypoint}";
+	export const createObjectCache = _createObjectCache;
+	export const objectCacheConfig = ${JSON.stringify(config ?? {})};
+	`;
 }
 /**
 * Generates the auth virtual module.
@@ -1049,6 +1106,7 @@ function generatePluginsModule(descriptors) {
 	const instantiations = [];
 	let needsAdapter = false;
 	descriptors.forEach((descriptor, index) => {
+		if (!descriptor.entrypoint) throw new Error(`[dineway] Plugin "${descriptor.id}" has no \`entrypoint\`. The Astro integration's \`plugins: []\` option requires plugins that resolve to a file or package entrypoint so they can be bundled at build time. Inline \`definePlugin({...})\` results are not supported; move the plugin into its own module and reference a factory descriptor with an \`entrypoint\`.`);
 		if (descriptor.format === "standard") {
 			needsAdapter = true;
 			const varName = `pluginDef${index}`;
@@ -1060,7 +1118,9 @@ function generatePluginsModule(descriptors) {
 				allowedHosts: descriptor.allowedHosts,
 				storage: descriptor.storage,
 				adminPages: descriptor.adminPages,
-				adminWidgets: descriptor.adminWidgets
+				adminWidgets: descriptor.adminWidgets,
+				portableTextBlocks: descriptor.portableTextBlocks,
+				fieldWidgets: descriptor.fieldWidgets
 			})})`);
 		} else {
 			const varName = `createPlugin${index}`;
@@ -1249,6 +1309,8 @@ export const sandboxedPlugins = [];
     storage: ${JSON.stringify(descriptor.storage ?? {})},
     adminPages: ${JSON.stringify(descriptor.adminPages ?? [])},
     adminWidgets: ${JSON.stringify(descriptor.adminWidgets ?? [])},
+    portableTextBlocks: ${JSON.stringify(descriptor.portableTextBlocks ?? [])},
+    fieldWidgets: ${JSON.stringify(descriptor.fieldWidgets ?? [])},
     adminEntry: ${JSON.stringify(descriptor.adminEntry)},
     // Code read from: ${filePath}
     code: ${JSON.stringify(code)},
@@ -1334,6 +1396,12 @@ function resolveAdminSource(projectRoot) {
 		if (existsSync(srcEntry) && isInside(repoRoot, projectRoot)) return resolve(packageRoot, "src");
 	} catch {}
 }
+function resolveIntegrationShim(fileName) {
+	const currentDir = dirname(fileURLToPath(import.meta.url));
+	const sourceShimPath = resolve(currentDir, "shims", fileName);
+	if (existsSync(sourceShimPath)) return sourceShimPath;
+	return resolve(currentDir, "..", "..", "src", "astro", "integration", "shims", fileName);
+}
 /**
 * Creates the Dineway virtual modules Vite plugin.
 */
@@ -1349,6 +1417,7 @@ function createVirtualModulesPlugin(options) {
 			if (id === VIRTUAL_CONFIG_ID) return RESOLVED_VIRTUAL_CONFIG_ID;
 			if (id === VIRTUAL_DIALECT_ID) return RESOLVED_VIRTUAL_DIALECT_ID;
 			if (id === VIRTUAL_STORAGE_ID) return RESOLVED_VIRTUAL_STORAGE_ID;
+			if (id === VIRTUAL_OBJECT_CACHE_ID) return RESOLVED_VIRTUAL_OBJECT_CACHE_ID;
 			if (id === VIRTUAL_ADMIN_REGISTRY_ID) return RESOLVED_VIRTUAL_ADMIN_REGISTRY_ID;
 			if (id === VIRTUAL_PLUGINS_ID) return RESOLVED_VIRTUAL_PLUGINS_ID;
 			if (id === VIRTUAL_SANDBOX_RUNNER_ID) return RESOLVED_VIRTUAL_SANDBOX_RUNNER_ID;
@@ -1363,6 +1432,7 @@ function createVirtualModulesPlugin(options) {
 			if (id === RESOLVED_VIRTUAL_CONFIG_ID) return generateConfigModule(serializableConfig);
 			if (id === RESOLVED_VIRTUAL_DIALECT_ID) return generateDialectModule(resolvedConfig.database?.entrypoint, resolvedConfig.database?.type, resolvedConfig.database?.config);
 			if (id === RESOLVED_VIRTUAL_STORAGE_ID) return generateStorageModule(resolvedConfig.storage?.entrypoint);
+			if (id === RESOLVED_VIRTUAL_OBJECT_CACHE_ID) return generateObjectCacheModule(resolvedConfig.objectCache?.entrypoint, resolvedConfig.objectCache?.config);
 			if (id === RESOLVED_VIRTUAL_PLUGINS_ID) return generatePluginsModule(pluginDescriptors);
 			if (id === RESOLVED_VIRTUAL_ADMIN_REGISTRY_ID) return generateAdminRegistryModule([...pluginDescriptors, ...resolvedConfig.sandboxed ?? []]);
 			if (id === RESOLVED_VIRTUAL_SANDBOX_RUNNER_ID) return generateSandboxRunnerModule(resolvedConfig.sandboxRunner);
@@ -1386,6 +1456,7 @@ function createVirtualModulesPlugin(options) {
 * Modules that contain native Node.js addons or Node-only code.
 * These must be external in SSR to avoid bundling failures on Node.
 */
+const ADMIN_STYLES_ALIAS = /^@dineway-ai\/admin\/styles\.css/;
 const NODE_NATIVE_EXTERNALS = [
 	"better-sqlite3",
 	"bindings",
@@ -1403,6 +1474,8 @@ function createViteConfig(options, command) {
 	const adminSourcePath = isDev ? resolveAdminSource(projectRoot) : void 0;
 	const useSource = adminSourcePath !== void 0;
 	const devPlugins = adminSourcePath ? [linguiMacroPlugin(adminSourcePath, adminDistPath)] : [];
+	const useSyncExternalStoreShimPath = resolveIntegrationShim("use-sync-external-store.js");
+	const useSyncExternalStoreWithSelectorShimPath = resolveIntegrationShim("use-sync-external-store-with-selector.js");
 	return {
 		define: {
 			__DINEWAY_VERSION__: JSON.stringify(VERSION),
@@ -1417,7 +1490,7 @@ function createViteConfig(options, command) {
 			],
 			alias: [
 				{
-					find: "@dineway-ai/admin/styles.css",
+					find: ADMIN_STYLES_ALIAS,
 					replacement: resolve(adminDistPath, "styles.css")
 				},
 				{
@@ -1427,12 +1500,28 @@ function createViteConfig(options, command) {
 				{
 					find: "@dineway-ai/admin",
 					replacement: useSource ? adminSourcePath : adminDistPath
+				},
+				{
+					find: "use-sync-external-store/shim/with-selector.js",
+					replacement: useSyncExternalStoreWithSelectorShimPath
+				},
+				{
+					find: "use-sync-external-store/shim/with-selector",
+					replacement: useSyncExternalStoreWithSelectorShimPath
+				},
+				{
+					find: "use-sync-external-store/shim/index.js",
+					replacement: useSyncExternalStoreShimPath
+				},
+				{
+					find: "use-sync-external-store/shim",
+					replacement: useSyncExternalStoreShimPath
 				}
 			]
 		},
 		plugins: [createVirtualModulesPlugin(options), ...useSource ? devPlugins : []],
 		ssr: {
-			external: NODE_NATIVE_EXTERNALS,
+			external: [...NODE_NATIVE_EXTERNALS, "dineway > zod"],
 			noExternal: ["dineway", "@dineway-ai/admin"]
 		},
 		optimizeDeps: {
@@ -1463,9 +1552,10 @@ const DINEWAY_SESSION_DRIVER = { entrypoint: "dineway/astro/session-driver" };
 /**
 * Build `image.remotePatterns` entries so Astro will optimize Dineway media.
 *
-* Astro's image services only transform absolute URLs whose host is authorized.
-* We authorize the storage public URL host, the configured site origin scoped
-* to the media proxy route, and a dev-only host-agnostic media route pattern.
+* Astro's image services only build transform URLs for sources allowed via
+* `image.domains` / `image.remotePatterns`. Dineway authorizes storage public
+* URL hosts, the configured site origin scoped to the media proxy route, and a
+* dev-only host-agnostic media route pattern.
 *
 * @internal Exported for unit testing.
 */
@@ -1494,6 +1584,19 @@ function buildImageRemotePatterns(storage, siteUrl, command) {
 	if (command === "dev") patterns.push({ pathname: `${INTERNAL_MEDIA_PREFIX}**` });
 	return patterns;
 }
+const OVERRIDABLE_IMAGE_ENDPOINTS = new Set([
+	"astro/assets/endpoint/generic",
+	"astro/assets/endpoint/node",
+	"astro/assets/endpoint/dev"
+]);
+const PASSTHROUGH_IMAGE_ENDPOINTS = new Set(["@astrojs/cloudflare/image-passthrough-endpoint"]);
+function resolveImageEndpoint(opts) {
+	if (opts.imagesDisabled) return {};
+	const current = opts.currentEntrypoint;
+	if (current === void 0 || OVERRIDABLE_IMAGE_ENDPOINTS.has(current)) return { entrypoint: "dineway/image-endpoint" };
+	if (PASSTHROUGH_IMAGE_ENDPOINTS.has(current)) return {};
+	return { warn: `A custom image.endpoint (${current}) is configured; Dineway will not wrap it, so storage-backed media may render unoptimized.` };
+}
 const dim = (s) => `\x1b[2m${s}\x1b[22m`;
 const bold = (s) => `\x1b[1m${s}\x1b[22m`;
 const cyan = (s) => `\x1b[36m${s}\x1b[39m`;
@@ -1501,14 +1604,31 @@ const cyan = (s) => `\x1b[36m${s}\x1b[39m`;
 function printBanner(_logger) {
 	const banner = `
 
-  ${bold(cyan("— D I N E W A Y —"))}
+  ${bold(cyan("— D I N E W A Y —"))}  ${dim(`v${VERSION}`)}
    `;
 	console.log(banner);
 }
-/** Print route injection summary */
-function printRoutesSummary(_logger) {
-	console.log(`\n  ${dim("›")} Admin UI    ${cyan("/_dineway/admin")}`);
-	console.log(`  ${dim("›")} API         ${cyan("/_dineway/api/*")}`);
+function buildDevServerInfo(baseUrl, mcpEnabled) {
+	return {
+		adminUrl: `${baseUrl}/_dineway/admin`,
+		...mcpEnabled ? { mcpUrl: `${baseUrl}/_dineway/api/mcp` } : {},
+		devBypassUrl: `${baseUrl}/_dineway/api/setup/dev-bypass?redirect=/_dineway/admin`,
+		devBypassDescription: "Skips passkey setup/auth and signs you in as a dev admin"
+	};
+}
+function getDevServerBaseUrl(address) {
+	if (!address || typeof address === "string") return null;
+	let host = address.address;
+	if (host === "::1" || host === "::" || host === "0.0.0.0") host = "localhost";
+	else if (address.family === "IPv6") host = `[${host}]`;
+	return `http://${host}:${address.port}`;
+}
+function printDevServerInfo(baseUrl, mcpEnabled) {
+	const info = buildDevServerInfo(baseUrl, mcpEnabled);
+	console.log(`\n  ${dim("›")} Admin UI    ${cyan(info.adminUrl)}`);
+	if (info.mcpUrl) console.log(`  ${dim("›")} MCP server  ${cyan(info.mcpUrl)}`);
+	console.log(`  ${dim("›")} Dev bypass  ${cyan(info.devBypassUrl)}`);
+	console.log(`    ${dim(info.devBypassDescription)}`);
 	console.log("");
 }
 /**
@@ -1568,10 +1688,12 @@ function dineway(config = {}) {
 		trustedProxyHeaders: resolvedConfig.trustedProxyHeaders
 	};
 	const useExternalAuth = !!(resolvedConfig.auth && "entrypoint" in resolvedConfig.auth);
+	let astroCommand;
 	return {
 		name: "dineway",
 		hooks: {
 			"astro:config:setup": ({ injectRoute, addMiddleware, logger, updateConfig, config: astroConfig, command }) => {
+				astroCommand = command;
 				printBanner(logger);
 				if (astroConfig.i18n) {
 					const routing = astroConfig.i18n.routing;
@@ -1615,10 +1737,18 @@ function dineway(config = {}) {
 					]
 				}];
 				const imageRemotePatterns = buildImageRemotePatterns(resolvedConfig.storage, resolvedConfig.siteUrl, command);
+				const { entrypoint: imageEndpoint, warn: imageEndpointWarning } = resolveImageEndpoint({
+					imagesDisabled: resolvedConfig.images === false,
+					currentEntrypoint: astroConfig.image?.endpoint?.entrypoint
+				});
+				if (imageEndpointWarning) logger.warn(imageEndpointWarning);
+				const imageConfig = {};
+				if (imageRemotePatterns.length) imageConfig.remotePatterns = imageRemotePatterns;
+				if (imageEndpoint) imageConfig.endpoint = { entrypoint: imageEndpoint };
 				updateConfig({
 					security: securityConfig,
 					session: sessionConfig,
-					...imageRemotePatterns.length ? { image: { remotePatterns: imageRemotePatterns } } : {},
+					...Object.keys(imageConfig).length ? { image: imageConfig } : {},
 					fonts: dinewayFonts,
 					vite: createViteConfig({
 						serializableConfig,
@@ -1627,7 +1757,7 @@ function dineway(config = {}) {
 						astroConfig
 					}, command)
 				});
-				injectCoreRoutes(injectRoute);
+				injectCoreRoutes(injectRoute, { srcDir: astroConfig.srcDir });
 				if (resolvedConfig.authProviders?.length) injectAuthProviderRoutes(injectRoute, resolvedConfig.authProviders);
 				if (!useExternalAuth) injectBuiltinAuthRoutes(injectRoute);
 				if (resolvedConfig.mcp !== false) injectMcpRoute(injectRoute);
@@ -1661,9 +1791,13 @@ function dineway(config = {}) {
 					entrypoint: "dineway/middleware/request-context",
 					order: "pre"
 				});
-				printRoutesSummary(logger);
 			},
 			"astro:server:setup": ({ server, logger }) => {
+				if (astroCommand === "dev") server.httpServer?.once("listening", () => {
+					const baseUrl = getDevServerBaseUrl(server.httpServer?.address() ?? null);
+					if (!baseUrl) return;
+					printDevServerInfo(baseUrl, resolvedConfig.mcp !== false);
+				});
 				server.httpServer?.once("listening", async () => {
 					const { writeFile, readFile } = await import("node:fs/promises");
 					const { resolve } = await import("node:path");
@@ -1704,4 +1838,4 @@ function dineway(config = {}) {
 }
 
 //#endregion
-export { dineway as default, getStoredConfig, local, s3 };
+export { dineway as default, getStoredConfig, local, memoryCache, s3 };

package/dist/astro/integration/shims/use-sync-external-store-with-selector.js

@@ -0,0 +1,71 @@
+import * as React from "react";
+
+const objectIs =
+	typeof Object.is === "function"
+		? Object.is
+		: (x, y) => (x === y && (x !== 0 || 1 / x === 1 / y)) || (x !== x && y !== y);
+
+export function useSyncExternalStoreWithSelector(
+	subscribe,
+	getSnapshot,
+	getServerSnapshot,
+	selector,
+	isEqual,
+) {
+	const instRef = React.useRef(null);
+	if (instRef.current === null) {
+		instRef.current = { hasValue: false, value: null };
+	}
+	const inst = instRef.current;
+
+	const [getSelection, getServerSelection] = React.useMemo(() => {
+		let hasMemo = false;
+		let memoizedSnapshot;
+		let memoizedSelection;
+
+		const memoizedSelector = (nextSnapshot) => {
+			if (!hasMemo) {
+				hasMemo = true;
+				memoizedSnapshot = nextSnapshot;
+				const nextSelection = selector(nextSnapshot);
+				if (isEqual !== undefined && inst.hasValue) {
+					const currentSelection = inst.value;
+					if (isEqual(currentSelection, nextSelection)) {
+						memoizedSelection = currentSelection;
+						return currentSelection;
+					}
+				}
+				memoizedSelection = nextSelection;
+				return nextSelection;
+			}
+
+			const previousSelection = memoizedSelection;
+			if (objectIs(memoizedSnapshot, nextSnapshot)) {
+				return previousSelection;
+			}
+
+			const nextSelection = selector(nextSnapshot);
+			if (isEqual !== undefined && isEqual(previousSelection, nextSelection)) {
+				memoizedSnapshot = nextSnapshot;
+				return previousSelection;
+			}
+
+			memoizedSnapshot = nextSnapshot;
+			memoizedSelection = nextSelection;
+			return nextSelection;
+		};
+
+		return [
+			() => memoizedSelector(getSnapshot()),
+			getServerSnapshot === undefined ? undefined : () => memoizedSelector(getServerSnapshot()),
+		];
+	}, [getSnapshot, getServerSnapshot, selector, isEqual]);
+
+	const value = React.useSyncExternalStore(subscribe, getSelection, getServerSelection);
+	React.useEffect(() => {
+		inst.hasValue = true;
+		inst.value = value;
+	}, [inst, value]);
+	React.useDebugValue(value);
+	return value;
+}

package/dist/astro/integration/shims/use-sync-external-store.js

@@ -0,0 +1 @@
+export { useSyncExternalStore } from "react";

package/dist/astro/middleware/auth.d.mts

@@ -1,15 +1,15 @@
-import "../../runtime-C4-2lSFg.mjs";
-import "../../types-CuJOqHfM.mjs";
-import "../../types-DSPGWjxO.mjs";
-import "../../types-Dryvv7LH.mjs";
-import "../../runner-09sTqtv0.mjs";
-import "../../index-CZiWCQDp.mjs";
-import "../../byline-fields-uJlygdzM.mjs";
-import "../../types-GaCtZ1k9.mjs";
-import "../../validate-DzjCdy6v.mjs";
+import "../../runtime-BOeiQsCv.mjs";
+import "../../types-DU0bU2Wu.mjs";
+import "../../types-C8XW6L19.mjs";
+import "../../types-Rc3gQqqw.mjs";
+import "../../runner-1tC2tIRV.mjs";
+import "../../index-D4y6NGiy.mjs";
 import { DinewayHandlers } from "../types.mjs";
+import "../../byline-fields-CUvbslGc.mjs";
+import "../../types-CDpH6MA4.mjs";
+import "../../validate-CZvb-BKB.mjs";
 import { Kysely } from "kysely";
-import { User } from "@dineway-ai/auth";
+import { RoleLevel, User } from "@dineway-ai/auth";
 import * as astro from "astro";
 
 //#region src/site-context/actor.d.ts

package/dist/astro/middleware/auth.mjs

@@ -1,8 +1,9 @@
-import { t as apiError } from "../../error-DCSuUAZW.mjs";
-import { n as getPublicOrigin } from "../../public-url-B_m9IwdV.mjs";
-import { t as getAuthMode } from "../../mode-CZqCF9dZ.mjs";
-import { i as hasScope } from "../../api-tokens-CYUoFGo7.mjs";
-import { a as resolveOAuthToken, i as resolveApiToken } from "../../api-tokens-DtvdtIkm.mjs";
+import { t as apiError } from "../../error-CytFlgcd.mjs";
+import { i as hasScope } from "../../api-tokens-2r7OWi_I.mjs";
+import { n as getPublicOrigin } from "../../public-url-BEz_sM9n.mjs";
+import { t as getAuthMode } from "../../mode-C4CIyjtR.mjs";
+import { t as resolveSessionUser } from "../../session-user-CAKImna3.mjs";
+import { a as resolveApiToken, o as resolveOAuthToken } from "../../api-tokens-CjVMQT-X.mjs";
 import { ulid } from "ulidx";
 import { defineMiddleware } from "astro:middleware";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
@@ -52,25 +53,41 @@ function checkPublicCsrf(request, url, publicOrigin) {
 
 //#endregion
 //#region src/astro/middleware/csp.ts
+const S3_ADAPTER_ENTRYPOINT = "dineway/storage/s3";
 /**
-* Strict Content-Security-Policy for /_dineway routes (admin + API).
-*
-* Applied via middleware header rather than Astro's built-in CSP because
-* Astro's auto-hashing defeats 'unsafe-inline' (CSP3 ignores 'unsafe-inline'
-* when hashes are present), which would break user-facing pages.
-*
-* img-src allows any HTTPS origin because the admin renders user content that
-* may reference external images (migrations, external hosting, embeds).
-* Plugin security does not rely on img-src -- sandboxed plugins run behind the
-* host-mediated `SandboxRunner` boundary with no DOM access, and connect-src
-* 'self' blocks fetch-based exfiltration from the admin itself.
+* S3-compatible adapters resolve omitted fields from matching S3_* env vars at
+* runtime, so the CSP helper must mirror that endpoint lookup.
 */
-function buildDinewayCsp() {
+function getConfiguredStorageEndpoint(storage) {
+	const config = storage?.config;
+	if (typeof config === "object" && config !== null && "endpoint" in config) {
+		const endpoint = config.endpoint;
+		if (typeof endpoint === "string") return endpoint;
+	}
+	if (storage?.entrypoint === S3_ADAPTER_ENTRYPOINT) {
+		const envEndpoint = typeof process !== "undefined" && process.env ? process.env.S3_ENDPOINT : void 0;
+		if (envEndpoint) return envEndpoint;
+	}
+}
+function getHttpOrigin(rawUrl) {
+	if (!rawUrl) return void 0;
+	try {
+		const url = new URL(rawUrl);
+		if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
+		return url.origin;
+	} catch {
+		return;
+	}
+}
+function buildDinewayCsp(storageEndpoint) {
+	const connectSrc = ["connect-src 'self'"];
+	const storageOrigin = getHttpOrigin(storageEndpoint);
+	if (storageOrigin) connectSrc.push(storageOrigin);
 	return [
 		"default-src 'self'",
 		"script-src 'self' 'unsafe-inline'",
 		"style-src 'self' 'unsafe-inline'",
-		"connect-src 'self'",
+		connectSrc.join(" "),
 		"form-action 'self'",
 		"frame-ancestors 'none'",
 		"img-src 'self' https: data: blob:",
@@ -143,7 +160,8 @@ const PUBLIC_API_EXACT = new Set([
 	"/_dineway/api/auth/setup-token/verify",
 	"/_dineway/api/oauth/token",
 	"/_dineway/api/snapshot",
-	"/_dineway/api/search"
+	"/_dineway/api/search",
+	"/_dineway/api/search/suggest"
 ]);
 const CSRF_EXEMPT_PUBLIC_ROUTES = new Set([
 	"/_dineway/api/auth/setup-token/verify",
@@ -229,11 +247,11 @@ const onRequest = defineMiddleware(async (context, next) => {
 		const scopeError = enforceTokenScope(url.pathname, method, context.locals.tokenScopes);
 		if (scopeError) return scopeError;
 		const response = await next();
-		if (!import.meta.env.DEV) response.headers.set("Content-Security-Policy", buildDinewayCsp());
+		if (!import.meta.env.DEV) response.headers.set("Content-Security-Policy", buildDinewayCsp(getConfiguredStorageEndpoint(context.locals.dineway?.config.storage)));
 		return response;
 	}
 	const response = await handleDinewayAuth(context, next);
-	if (!import.meta.env.DEV) response.headers.set("Content-Security-Policy", buildDinewayCsp());
+	if (!import.meta.env.DEV) response.headers.set("Content-Security-Policy", buildDinewayCsp(getConfiguredStorageEndpoint(context.locals.dineway?.config.storage)));
 	return response;
 });
 /**
@@ -283,7 +301,7 @@ async function handlePluginRouteAuth(context, next) {
 	}
 	try {
 		const { session } = context;
-		const sessionUser = await session?.get("user");
+		const sessionUser = await resolveSessionUser(session);
 		if (sessionUser?.id && dineway?.db) {
 			const user = await createKyselyAdapter(dineway.db).getUserById(sessionUser.id);
 			if (user && !user.disabled) locals.user = user;
@@ -301,7 +319,7 @@ async function handlePublicRouteAuth(context, next) {
 	const { locals, session } = context;
 	const { dineway } = locals;
 	try {
-		const sessionUser = await session?.get("user");
+		const sessionUser = await resolveSessionUser(session);
 		if (sessionUser?.id && dineway?.db) {
 			const user = await createKyselyAdapter(dineway.db).getUserById(sessionUser.id);
 			if (user && !user.disabled) locals.user = user;
@@ -441,7 +459,7 @@ async function handlePasskeyAuth(context, next, isApiRoute) {
 	const { url, locals, session } = context;
 	const { dineway } = locals;
 	try {
-		const sessionUser = await session?.get("user");
+		const sessionUser = await resolveSessionUser(session);
 		if (!sessionUser?.id) {
 			if (isApiRoute) return Response.json({ error: {
 				code: "NOT_AUTHENTICATED",

package/dist/astro/middleware/redirect.mjs

@@ -1,10 +1,11 @@
 import "../../dialect-helpers-fk43GbDb.mjs";
 import { getRequestContext } from "../../request-context.mjs";
 import "../../base64-F8-DUraK.mjs";
-import "../../types-CSgR9nQB.mjs";
-import { r as getDb } from "../../loader--GOYux8M.mjs";
-import { n as alternateTrailingSlashPath, t as RedirectRepository } from "../../redirect-CEACczxo.mjs";
-import { a as matchCachedPatterns, n as compileRedirectRules, o as setCachedRedirects, r as getCachedRedirects } from "../../cache-Bac05gBd.mjs";
+import "../../types-Dq1qT19x.mjs";
+import { r as getDb } from "../../loader-CjWqjweO.mjs";
+import { n as alternateTrailingSlashPath, t as RedirectRepository } from "../../redirect-BAjt4Z6b.mjs";
+import { a as matchCachedPatterns, n as compileRedirectRules, o as setCachedRedirects, r as getCachedRedirects } from "../../cache-C-FNTFYK.mjs";
+import { n as isTerminalStatus } from "../../status-DANd8ERo.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/astro/middleware/redirect.ts
@@ -61,6 +62,10 @@ const onRequest = defineMiddleware(async (context, next) => {
 			rules = cached.patterns;
 		}
 		if (exact) {
+			if (isTerminalStatus(exact.type)) {
+				repo.recordHit(exact.id).catch(() => {});
+				return new Response(null, { status: exact.type });
+			}
 			if (exact.destination.startsWith("//") || exact.destination.startsWith("/\\")) return next();
 			repo.recordHit(exact.id).catch(() => {});
 			const code = isRedirectCode(exact.type) ? exact.type : 301;
@@ -69,6 +74,10 @@ const onRequest = defineMiddleware(async (context, next) => {
 		const patternMatch = matchCachedPatterns(rules, pathname);
 		if (patternMatch) {
 			const { redirect, destination } = patternMatch;
+			if (isTerminalStatus(redirect.type)) {
+				repo.recordHit(redirect.id).catch(() => {});
+				return new Response(null, { status: redirect.type });
+			}
 			if (destination.startsWith("//") || destination.startsWith("/\\")) return next();
 			repo.recordHit(redirect.id).catch(() => {});
 			const code = isRedirectCode(redirect.type) ? redirect.type : 301;

package/dist/astro/middleware/request-context.mjs

@@ -1,8 +1,8 @@
 import { runWithContext } from "../../request-context.mjs";
 import "../../base64-F8-DUraK.mjs";
-import "../../options-LsPjZlqD.mjs";
-import { n as parseContentId, r as verifyPreviewToken } from "../../tokens-SLmgowfd.mjs";
-import { i as resolveSecretsCached } from "../../secrets-CeGpBFV2.mjs";
+import "../../options-DQPTH5n0.mjs";
+import { a as resolveSecretsCached } from "../../secrets-CDZo2k8L.mjs";
+import { n as parseContentId, r as verifyPreviewToken } from "../../tokens-1RK1n6ED.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/visual-editing/toolbar.ts
@@ -1319,10 +1319,12 @@ async function injectToolbar(response, toolbarHtml) {
 	const html = await response.text();
 	if (!html.includes("</body>")) return new Response(html, response);
 	const injected = html.replace("</body>", `${toolbarHtml}</body>`);
-	return new Response(injected, {
+	const result = new Response(injected, {
 		status: response.status,
 		headers: response.headers
 	});
+	result.headers.set("Cache-Control", "private, no-store");
+	return result;
 }
 const onRequest = defineMiddleware(async (context, next) => {
 	const { cookies, url } = context;
@@ -1332,7 +1334,8 @@ const onRequest = defineMiddleware(async (context, next) => {
 	const requestDb = context.locals.__dinewayRequestDb;
 	if (requestDb) return runWithContext({
 		editMode: cookies.get("dineway-edit-mode")?.value === "true",
-		db: requestDb
+		db: requestDb,
+		dbIsIsolated: true
 	}, () => next());
 	const hasEditCookie = cookies.get("dineway-edit-mode")?.value === "true";
 	const hasPreviewToken = url.searchParams.has("_preview");

package/dist/astro/middleware/seed.d.mts

@@ -1,4 +1,4 @@
-import { t as Database } from "../../types-CuJOqHfM.mjs";
+import { t as Database } from "../../types-DU0bU2Wu.mjs";
 import { Kysely } from "kysely";
 import * as astro from "astro";