dineway 0.1.49 → 0.2.1

package/dist/{taxonomy-B169Nm6B.mjs → taxonomy-0k_vRVsD.mjs}

@@ -1,4 +1,5 @@
-import { a as __exportAll } from "./runner-DzIpHGND.mjs";
+import { a as __exportAll } from "./runner-BgmttQmD.mjs";
+import { d as invalidateTaxonomyObjectCache } from "./object-cache-D51qOseS.mjs";
 import { ulid } from "ulidx";
 
 //#region src/database/repositories/taxonomy.ts
@@ -25,7 +26,8 @@ var TaxonomyRepository = class {
 	*/
 	async create(input) {
 		const id = ulid();
-		const parentId = input.parentId === void 0 || input.parentId === "" ? null : input.parentId;
+		const parentInput = input.parentId === void 0 || input.parentId === "" ? null : input.parentId;
+		const parentId = parentInput ? await this.resolveParentRef(parentInput) : null;
 		let translationGroup = id;
 		if (input.translationOf) {
 			const source = await this.findById(input.translationOf);
@@ -41,6 +43,7 @@ var TaxonomyRepository = class {
 			...input.locale !== void 0 ? { locale: input.locale } : {},
 			translation_group: translationGroup
 		}).execute();
+		invalidateTaxonomyObjectCache();
 		const taxonomy = await this.findById(id);
 		if (!taxonomy) throw new Error("Failed to create taxonomy");
 		return taxonomy;
@@ -74,8 +77,18 @@ var TaxonomyRepository = class {
 		else query = query.where("parent_id", "=", options.parentId);
 		return (await query.execute()).map((row) => this.rowToTaxonomy(row));
 	}
-	async findChildren(parentId) {
-		return (await this.db.selectFrom("taxonomies").selectAll().where("parent_id", "=", parentId).orderBy("label", "asc").orderBy("id", "asc").execute()).map((row) => this.rowToTaxonomy(row));
+	/**
+	* Children of a term. Accepts a term id OR a translation_group and resolves
+	* to the group, since `parent_id` stores the parent's translation_group.
+	* Pass `locale` to scope to one locale's tree; omit it to find children in
+	* every locale, which is used to block deletes that would orphan a subtree.
+	*/
+	async findChildren(parentIdOrGroup, locale) {
+		const group = await this.resolveTranslationGroup(parentIdOrGroup);
+		if (!group) return [];
+		let query = this.db.selectFrom("taxonomies").selectAll().where("parent_id", "=", group).orderBy("label", "asc").orderBy("id", "asc");
+		if (locale !== void 0) query = query.where("locale", "=", locale);
+		return (await query.execute()).map((row) => this.rowToTaxonomy(row));
 	}
 	/**
 	* Every translation sibling of a term (including itself), identified by
@@ -89,9 +102,12 @@ var TaxonomyRepository = class {
 		const updates = {};
 		if (input.slug !== void 0) updates.slug = input.slug;
 		if (input.label !== void 0) updates.label = input.label;
-		if (input.parentId !== void 0) updates.parent_id = input.parentId === "" ? null : input.parentId;
+		if (input.parentId !== void 0) updates.parent_id = input.parentId === "" || input.parentId === null ? null : await this.resolveParentRef(input.parentId);
 		if (input.data !== void 0) updates.data = JSON.stringify(input.data);
-		if (Object.keys(updates).length > 0) await this.db.updateTable("taxonomies").set(updates).where("id", "=", id).execute();
+		if (Object.keys(updates).length > 0) {
+			await this.db.updateTable("taxonomies").set(updates).where("id", "=", id).execute();
+			invalidateTaxonomyObjectCache();
+		}
 		return this.findById(id);
 	}
 	async delete(id) {
@@ -100,7 +116,9 @@ var TaxonomyRepository = class {
 		if (term.translationGroup) {
 			if ((await this.db.selectFrom("taxonomies").select("id").where("translation_group", "=", term.translationGroup).where("id", "!=", id).execute()).length === 0) await this.db.deleteFrom("content_taxonomies").where("taxonomy_id", "=", term.translationGroup).execute();
 		}
-		return ((await this.db.deleteFrom("taxonomies").where("id", "=", id).executeTakeFirst()).numDeletedRows ?? 0n) > 0n;
+		const deleted = ((await this.db.deleteFrom("taxonomies").where("id", "=", id).executeTakeFirst()).numDeletedRows ?? 0n) > 0n;
+		if (deleted) invalidateTaxonomyObjectCache();
+		return deleted;
 	}
 	async attachToEntry(collection, entryId, taxonomyId) {
 		const group = await this.resolveTranslationGroup(taxonomyId);
@@ -111,11 +129,13 @@ var TaxonomyRepository = class {
 			taxonomy_id: group
 		};
 		await this.db.insertInto("content_taxonomies").values(row).onConflict((oc) => oc.doNothing()).execute();
+		invalidateTaxonomyObjectCache();
 	}
 	async detachFromEntry(collection, entryId, taxonomyId) {
 		const group = await this.resolveTranslationGroup(taxonomyId);
 		if (!group) return;
 		await this.db.deleteFrom("content_taxonomies").where("collection", "=", collection).where("entry_id", "=", entryId).where("taxonomy_id", "=", group).execute();
+		invalidateTaxonomyObjectCache();
 	}
 	/**
 	* Taxonomy terms assigned to a content entry, resolved into a specific locale.
@@ -149,10 +169,13 @@ var TaxonomyRepository = class {
 			entry_id: entryId,
 			taxonomy_id
 		}))).onConflict((oc) => oc.doNothing()).execute();
+		if (toRemove.length > 0 || toAdd.length > 0) invalidateTaxonomyObjectCache();
 	}
 	async clearEntryTerms(collection, entryId) {
 		const result = await this.db.deleteFrom("content_taxonomies").where("collection", "=", collection).where("entry_id", "=", entryId).executeTakeFirst();
-		return Number(result.numDeletedRows ?? 0);
+		const removed = Number(result.numDeletedRows ?? 0);
+		if (removed > 0) invalidateTaxonomyObjectCache();
+		return removed;
 	}
 	/**
 	* Copy every term assignment from one content entry to another. Used when
@@ -167,6 +190,7 @@ var TaxonomyRepository = class {
 			entry_id: targetEntryId,
 			taxonomy_id: r.taxonomy_id
 		}))).onConflict((oc) => oc.doNothing()).execute();
+		invalidateTaxonomyObjectCache();
 	}
 	/**
 	* Count content entries that use any translation of this term. Accepts
@@ -178,6 +202,17 @@ var TaxonomyRepository = class {
 		const result = await this.db.selectFrom("content_taxonomies").select((eb) => eb.fn.count("entry_id").as("count")).where("taxonomy_id", "=", group).executeTakeFirst();
 		return Number(result?.count ?? 0);
 	}
+	/**
+	* Resolve a parent reference to the value stored in `parent_id`: the parent's
+	* translation_group. A translation_group normally equals its anchor row's id,
+	* which satisfies the self-FK on parent_id. If the anchor row is missing,
+	* fall back to the input so we never write a dangling FK value.
+	*/
+	async resolveParentRef(idOrGroup) {
+		const group = await this.resolveTranslationGroup(idOrGroup);
+		if (!group) return idOrGroup;
+		return await this.db.selectFrom("taxonomies").select("id").where("id", "=", group).executeTakeFirst() ? group : idOrGroup;
+	}
 	async resolveTranslationGroup(idOrGroup) {
 		return (await this.db.selectFrom("taxonomies").select(["translation_group"]).where((eb) => eb.or([eb("id", "=", idOrGroup), eb("translation_group", "=", idOrGroup)])).executeTakeFirst())?.translation_group ?? null;
 	}
@@ -191,7 +226,7 @@ var TaxonomyRepository = class {
 	*/
 	async countEntriesForTerms(translationGroups) {
 		if (translationGroups.length === 0) return /* @__PURE__ */ new Map();
-		const { chunks, SQL_BATCH_SIZE } = await import("./chunks-CuUt7K50.mjs").then((n) => n.r);
+		const { chunks, SQL_BATCH_SIZE } = await import("./chunks-ChGNDY8r.mjs").then((n) => n.r);
 		const counts = /* @__PURE__ */ new Map();
 		for (const chunk of chunks(translationGroups, SQL_BATCH_SIZE)) {
 			const rows = await this.db.selectFrom("content_taxonomies").select(["taxonomy_id", (eb) => eb.fn.count("entry_id").as("count")]).where("taxonomy_id", "in", chunk).groupBy("taxonomy_id").execute();

package/dist/transport-C46KHLMP.mjs

@@ -0,0 +1,134 @@
+//#region src/client/transport.ts
+/**
+* Transport layer for the Dineway client.
+*
+* Implements a composable interceptor pipeline that modifies requests
+* and responses. The client calls `transport.fetch(request)` — everything
+* else (auth, CSRF, retry) is handled by interceptors.
+*/
+const COOKIE_NAME_VALUE_PATTERN = /^([^;]+)/;
+function baseFetch(request) {
+	return globalThis.fetch(request);
+}
+/**
+* Creates a fetch function that runs requests through an interceptor pipeline.
+*/
+function createTransport(options = {}) {
+	const interceptors = options.interceptors ?? [];
+	let chain = baseFetch;
+	for (let i = interceptors.length - 1; i >= 0; i--) {
+		const interceptor = interceptors[i];
+		const next = chain;
+		chain = (req) => interceptor(req, next);
+	}
+	return { fetch: chain };
+}
+/**
+* Adds X-Dineway-Request: 1 and Origin headers to mutation requests
+* (POST, PUT, DELETE). The custom header satisfies Dineway's CSRF check;
+* the Origin header satisfies Astro's built-in origin verification which
+* rejects server-side POST requests that lack a matching Origin.
+*/
+function csrfInterceptor() {
+	const MUTATION_METHODS = new Set([
+		"POST",
+		"PUT",
+		"DELETE",
+		"PATCH"
+	]);
+	return (request, next) => {
+		if (MUTATION_METHODS.has(request.method)) {
+			const headers = new Headers(request.headers);
+			headers.set("X-Dineway-Request", "1");
+			if (!headers.has("Origin")) {
+				const url = new URL(request.url);
+				headers.set("Origin", url.origin);
+			}
+			return next(new Request(request, { headers }));
+		}
+		return next(request);
+	};
+}
+/**
+* Adds Authorization: Bearer header from a static token.
+*/
+function tokenInterceptor(token) {
+	return (request, next) => {
+		const headers = new Headers(request.headers);
+		headers.set("Authorization", `Bearer ${token}`);
+		return next(new Request(request, { headers }));
+	};
+}
+/**
+* Dev bypass interceptor. Calls the dev-bypass endpoint on first request
+* to establish a session, then forwards the session cookie on subsequent
+* requests.
+*/
+function devBypassInterceptor(baseUrl) {
+	let sessionCookie = null;
+	let initializing = null;
+	async function init() {
+		const bypassUrl = new URL("/_dineway/api/auth/dev-bypass", baseUrl);
+		const res = await globalThis.fetch(bypassUrl, { redirect: "manual" });
+		const setCookie = res.headers.get("set-cookie");
+		if (setCookie) {
+			const match = setCookie.match(COOKIE_NAME_VALUE_PATTERN);
+			if (match) sessionCookie = match[1];
+		}
+		if (res.body) await res.text().catch(() => {});
+	}
+	return async (request, next) => {
+		if (!sessionCookie) {
+			if (!initializing) initializing = init();
+			await initializing;
+		}
+		if (sessionCookie) {
+			const headers = new Headers(request.headers);
+			const existing = headers.get("cookie");
+			headers.set("cookie", existing ? `${existing}; ${sessionCookie}` : sessionCookie);
+			return next(new Request(request, { headers }));
+		}
+		return next(request);
+	};
+}
+/**
+* Auto-refreshes expired OAuth tokens on 401 responses.
+* Requires a refresh token and the token endpoint URL.
+*/
+function refreshInterceptor(options) {
+	let refreshing = null;
+	async function refresh() {
+		const res = await globalThis.fetch(options.tokenEndpoint, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				grant_type: "refresh_token",
+				refresh_token: options.refreshToken
+			})
+		});
+		if (!res.ok) return null;
+		const json = await res.json();
+		const tokenData = json.data && typeof json.data === "object" && "access_token" in json.data ? json.data : json;
+		const expiresAt = tokenData.expires_in ? new Date(Date.now() + tokenData.expires_in * 1e3).toISOString() : new Date(Date.now() + 36e5).toISOString();
+		if (options.onTokenRefreshed) options.onTokenRefreshed(tokenData.access_token, tokenData.refresh_token ?? options.refreshToken, expiresAt);
+		return tokenData.access_token;
+	}
+	return async (request, next) => {
+		const response = await next(request);
+		if (response.status === 401) {
+			if (!refreshing) refreshing = refresh().finally(() => {
+				refreshing = null;
+			});
+			const newToken = await refreshing;
+			if (newToken) {
+				const headers = new Headers(request.headers);
+				headers.set("Authorization", `Bearer ${newToken}`);
+				return next(new Request(request, { headers }));
+			}
+		}
+		return response;
+	};
+}
+
+//#endregion
+export { tokenInterceptor as a, refreshInterceptor as i, csrfInterceptor as n, devBypassInterceptor as r, createTransport as t };

package/dist/types-A8fPOJnl.mjs

@@ -0,0 +1,69 @@
+//#region src/plugins/types.ts
+function capabilitiesToDeclaredAccess(capabilities, allowedHosts) {
+	const caps = new Set(capabilities);
+	const out = {};
+	if (caps.has("content:read") || caps.has("content:write")) {
+		out.content = { read: {} };
+		if (caps.has("content:write")) out.content.write = {};
+	}
+	if (caps.has("media:read") || caps.has("media:write")) {
+		out.media = { read: {} };
+		if (caps.has("media:write")) out.media.write = {};
+	}
+	if (caps.has("network:request:unrestricted")) {
+		out.network = { request: {} };
+		if (caps.has("network:request:development-loopback")) out.network.request.developmentLoopback = true;
+	} else if (caps.has("network:request")) out.network = { request: { allowedHosts: [...allowedHosts] } };
+	if (caps.has("email:send")) (out.email ??= {}).send = {};
+	if (caps.has("hooks.email-events:register")) (out.email ??= {}).events = {};
+	if (caps.has("hooks.email-transport:register")) (out.email ??= {}).transport = {};
+	if (caps.has("hooks.page-fragments:register")) out.page = { fragments: {} };
+	if (caps.has("users:read")) out.users = { read: {} };
+	return out;
+}
+function declaredAccessToCapabilities(declaredAccess) {
+	const caps = /* @__PURE__ */ new Set();
+	let allowedHosts = [];
+	if (declaredAccess.content?.read) caps.add("content:read");
+	if (declaredAccess.content?.write) {
+		caps.add("content:write");
+		caps.add("content:read");
+	}
+	if (declaredAccess.media?.read) caps.add("media:read");
+	if (declaredAccess.media?.write) {
+		caps.add("media:write");
+		caps.add("media:read");
+	}
+	if (declaredAccess.network?.request) {
+		const hosts = declaredAccess.network.request.allowedHosts;
+		if (hosts === void 0) {
+			caps.add("network:request:unrestricted");
+			caps.add("network:request");
+		} else {
+			caps.add("network:request");
+			allowedHosts = [...hosts];
+		}
+		if (declaredAccess.network.request.developmentLoopback) caps.add("network:request:development-loopback");
+	}
+	if (declaredAccess.email?.send) caps.add("email:send");
+	if (declaredAccess.email?.events) caps.add("hooks.email-events:register");
+	if (declaredAccess.email?.transport) caps.add("hooks.email-transport:register");
+	if (declaredAccess.page?.fragments) caps.add("hooks.page-fragments:register");
+	if (declaredAccess.users?.read) caps.add("users:read");
+	return {
+		capabilities: [...caps],
+		allowedHosts
+	};
+}
+/**
+* Check if a value is a StandardPluginDefinition (has hooks/routes but no id/version).
+*/
+function isStandardPluginDefinition(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const hasPluginShape = "hooks" in value || "routes" in value;
+	const hasNativeShape = "id" in value && "version" in value;
+	return hasPluginShape && !hasNativeShape;
+}
+
+//#endregion
+export { declaredAccessToCapabilities as n, isStandardPluginDefinition as r, capabilitiesToDeclaredAccess as t };

package/dist/types-BLQCz46p.d.mts

@@ -0,0 +1,118 @@
+//#region src/object-cache/types.d.ts
+/**
+ * Object cache types
+ *
+ * The object cache is an optional, distributed read-through cache that sits
+ * *beneath* the per-request cache (`requestCached`) and *above* the database.
+ * Query results (content entries, settings, menus, taxonomies) are stored in a
+ * fast key/value store (an in-process memory store on Node, or another
+ * compatible backend supplied by an extension package) so repeat reads across
+ * requests skip the database entirely.
+ *
+ * Backends only ever deal in strings — serialization (including `Date`
+ * preservation) is handled by the core read-through layer in `./codec.ts`, so
+ * every backend behaves identically.
+ */
+/**
+ * A pluggable object-cache backend.
+ *
+ * Implementations must be safe to call concurrently and should never throw on
+ * cache misses — `get` returns `null` for a miss. A backend that throws (e.g.
+ * a transient backend error) degrades gracefully: the read-through layer
+ * treats a thrown `get` as a miss and a thrown `set` as a no-op, so the
+ * database remains the source of truth.
+ */
+interface ObjectCacheBackend {
+  /** Return the stored string for `key`, or `null` on a miss. */
+  get(key: string): Promise<string | null>;
+  /**
+   * Store `value` under `key`.
+   *
+   * @param ttlSeconds Optional time-to-live in seconds. Backends that don't
+   *   support TTLs may ignore it, but shared backends should honor it so
+   *   orphaned, epoch-busted keys are eventually reclaimed.
+   */
+  set(key: string, value: string, ttlSeconds?: number): Promise<void>;
+  /** Remove `key`. Idempotent — deleting a missing key is not an error. */
+  delete(key: string): Promise<void>;
+}
+/**
+ * Serializable descriptor for an object-cache backend.
+ *
+ * Mirrors {@link import("../storage/types.js").StorageDescriptor}: `entrypoint`
+ * is a module specifier resolved at build time that exports a
+ * {@link CreateObjectCacheBackendFn} named `createObjectCache`; `config` is the
+ * plain, serializable runtime config passed to it.
+ */
+interface ObjectCacheDescriptor {
+  /** Module path exporting a `createObjectCache` function. */
+  entrypoint: string;
+  /** Serializable config passed to `createObjectCache` at runtime. */
+  config: ObjectCacheRuntimeConfig;
+}
+/**
+ * Runtime config shared by every backend, plus backend-specific keys.
+ *
+ * The read-through layer reads `defaultTtl`, `revalidate`, and `keyPrefix`;
+ * individual backends read their own keys (e.g. the memory backend reads
+ * `maxEntries`).
+ */
+interface ObjectCacheRuntimeConfig {
+  /**
+   * Default time-to-live for cached entries, in seconds.
+   *
+   * Invalidation works by epoch comparison, not key deletion: a stale value
+   * is detected on read (its stored epoch no longer matches) and overwritten
+   * in place under the same key. The TTL is just a backstop that reclaims
+   * keys that are never read again.
+   *
+   * @default 3600 (1 hour)
+   */
+  defaultTtl?: number;
+  /**
+   * How long (milliseconds) an isolate may reuse a cached namespace epoch
+   * before re-reading it from the backend.
+   *
+   * After a write bumps a namespace's epoch, an isolate keeps serving the
+   * previous epoch's keys until its cached epoch expires after this window.
+   * Shared backends may add their own propagation delay. Only anonymous
+   * visitors are affected — preview and edit requests bypass the cache.
+   *
+   * Set to `0` to re-read the epoch on every query (strongest freshness, more
+   * backend reads).
+   *
+   * @default 1000
+   */
+  revalidate?: number;
+  /**
+   * Prefix applied to every cache key. Lets multiple Dineway sites share one
+   * backend without colliding.
+   *
+   * @default "dineway"
+   */
+  keyPrefix?: string;
+  /**
+   * Maximum time (milliseconds) to wait for a single backend read before
+   * treating it as a cache miss and falling back to the database.
+   *
+   * Guards against a backend operation that stalls without resolving or
+   * rejecting, which would otherwise hang the request. A timed-out read
+   * degrades to a miss; the database remains the source of truth.
+   *
+   * Set to `0` to disable the timeout.
+   *
+   * @default 2000
+   */
+  timeout?: number;
+  /** Backend-specific keys. */
+  [key: string]: unknown;
+}
+/**
+ * Factory signature exported as `createObjectCache` from a backend entrypoint.
+ *
+ * Each backend accesses its own resources directly; the bundled memory backend
+ * uses an in-process map.
+ */
+type CreateObjectCacheBackendFn = (config: ObjectCacheRuntimeConfig) => ObjectCacheBackend;
+//#endregion
+export { ObjectCacheRuntimeConfig as i, ObjectCacheBackend as n, ObjectCacheDescriptor as r, CreateObjectCacheBackendFn as t };

package/dist/{types-CwawBUTa.d.mts → types-B_FlxIIl.d.mts}

@@ -163,10 +163,11 @@ interface CreateFieldInput {
  */
 interface UpdateFieldInput {
   label?: string;
+  type?: FieldType;
   required?: boolean;
   unique?: boolean;
   defaultValue?: unknown;
-  validation?: FieldValidation;
+  validation?: FieldValidation | null;
   widget?: string;
   options?: FieldWidgetOptions;
   sortOrder?: number;
@@ -180,6 +181,8 @@ interface UpdateFieldInput {
  */
 interface CollectionWithFields extends Collection {
   fields: Field[];
+  /** Stable hash of the complete native collection and field contract. */
+  schemaFingerprint: string;
 }
 /**
  * Reserved field slugs that cannot be used

package/dist/{types-CSgR9nQB.mjs → types-ChxYDRvx.mjs}

@@ -1,4 +1,4 @@
-import { a as __exportAll } from "./runner-DzIpHGND.mjs";
+import { a as __exportAll } from "./runner-BgmttQmD.mjs";
 import { r as encodeBase64, t as decodeBase64 } from "./base64-F8-DUraK.mjs";
 
 //#region src/database/repositories/types.ts

package/dist/{types-GaCtZ1k9.d.mts → types-Cw0PeCT_.d.mts}

@@ -289,6 +289,24 @@ interface ImportResult {
     error: string;
   }>;
   byCollection: Record<string, number>;
+  /** Number of taxonomy term assignments written during plugin import */
+  taxonomyAssignments?: number;
+  /** Source taxonomies skipped because no matching Dineway taxonomy def exists */
+  missingTaxonomies?: string[];
+  /** Custom taxonomy defs auto-created during plugin import */
+  taxonomiesCreated?: string[];
+  /** Navigation menu import summary */
+  menus?: {
+    created: number;
+    items: number;
+  };
+  /** Comment import summary */
+  comments?: {
+    imported: number;
+    skipped: number;
+  };
+  /** Site settings applied from the source */
+  siteSettings?: string[];
 }
 /**
  * An import source provides content from an external system.