dineway 0.1.8 → 0.1.11

package/dist/astro/routes/api/snapshot.mjs

@@ -0,0 +1,227 @@
+import "../../../base64-Cz-aU0X1.mjs";
+import "../../../options-z8VVg1Ll.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../error-DEGjx2Xw.mjs";
+import { a as verifyPreviewSignature, r as parsePreviewSignatureHeader } from "../../../sidecar-client-vzwV98K4.mjs";
+import { n as getPublicOrigin } from "../../../public-url-BB_umF5G.mjs";
+import { i as resolveSecretsCached } from "../../../secrets-dI8zzTV7.mjs";
+import { n as requirePerm } from "../../../authorize-BBj8C6Y8.mjs";
+import { sql } from "kysely";
+import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
+
+//#region src/api/handlers/snapshot.ts
+const MEDIA_FILE_PREFIX = "/_dineway/api/media/file/";
+/**
+* Parse a JSON string value and inject `src` for local media objects.
+* Returns the original string if it's not a local media value.
+*/
+function injectMediaSrc(jsonStr, origin) {
+	try {
+		const obj = JSON.parse(jsonStr);
+		if (typeof obj !== "object" || obj === null || Array.isArray(obj)) return jsonStr;
+		if (injectMediaSrcInto(obj, origin)) return JSON.stringify(obj);
+		return jsonStr;
+	} catch {
+		return jsonStr;
+	}
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Recursively walk an object and inject `src` into local media values.
+* Returns true if any modifications were made.
+*/
+function injectMediaSrcInto(obj, origin) {
+	let modified = false;
+	if ((obj.provider === "local" || !obj.provider && obj.id && obj.meta) && !obj.src) {
+		const storageKey = (isRecord(obj.meta) ? obj.meta : void 0)?.storageKey ?? obj.id;
+		if (typeof storageKey === "string" && storageKey) {
+			obj.src = `${origin}${MEDIA_FILE_PREFIX}${storageKey}`;
+			modified = true;
+		}
+	}
+	for (const value of Object.values(obj)) if (Array.isArray(value)) {
+		for (const item of value) if (isRecord(item)) {
+			if (injectMediaSrcInto(item, origin)) modified = true;
+		}
+	} else if (isRecord(value)) {
+		if (injectMediaSrcInto(value, origin)) modified = true;
+	}
+	return modified;
+}
+/**
+* Safe identifier pattern for snapshot table names.
+* More permissive than validateIdentifier() — allows leading underscores
+* (needed for system tables like _dineway_collections).
+*/
+const SAFE_TABLE_NAME = /^[a-z_][a-z0-9_]*$/;
+/**
+* System tables included in snapshots.
+* Content tables (ec_*) are discovered dynamically.
+*/
+const SYSTEM_TABLES = [
+	"_dineway_collections",
+	"_dineway_fields",
+	"_dineway_taxonomy_defs",
+	"_dineway_menus",
+	"_dineway_menu_items",
+	"_dineway_sections",
+	"_dineway_widget_areas",
+	"_dineway_widgets",
+	"_dineway_seo",
+	"_dineway_migrations",
+	"taxonomies",
+	"content_taxonomies",
+	"media",
+	"options",
+	"revisions"
+];
+/**
+* Table name prefixes excluded from snapshots (auth/security data).
+*/
+const EXCLUDED_PREFIXES = [
+	"_dineway_api_tokens",
+	"_dineway_oauth_tokens",
+	"_dineway_authorization_codes",
+	"_dineway_device_codes",
+	"_dineway_migrations_lock",
+	"_plugin_",
+	"users",
+	"sessions",
+	"credentials",
+	"challenges"
+];
+/**
+* Options key prefixes safe for inclusion in snapshots.
+*
+* The options table contains plugin secrets (plugin:*), passkey challenges
+* (dineway:passkey_pending:*), and setup state that must not leak to
+* preview databases. Only site-level rendering settings are needed.
+*/
+const SAFE_OPTIONS_PREFIXES = ["site:"];
+function isExcluded(tableName) {
+	return EXCLUDED_PREFIXES.some((prefix) => tableName.startsWith(prefix));
+}
+/**
+* Generate a portable database snapshot.
+*
+* Discovers ec_* content tables dynamically, exports system tables
+* needed for rendering, and includes schema info for table recreation.
+*/
+async function generateSnapshot(db, options) {
+	const includeDrafts = options?.includeDrafts ?? false;
+	const allTables = [...(await sql`
+		SELECT name FROM sqlite_master
+		WHERE type = 'table'
+		AND name LIKE 'ec_%'
+		ORDER BY name
+	`.execute(db)).rows.map((r) => r.name), ...SYSTEM_TABLES];
+	const tables = {};
+	const schema = {};
+	for (const tableName of allTables) {
+		if (isExcluded(tableName)) continue;
+		if (!SAFE_TABLE_NAME.test(tableName)) continue;
+		try {
+			const pragmaResult = await sql`
+				PRAGMA table_info(${sql.raw(`"${tableName}"`)})
+			`.execute(db);
+			if (pragmaResult.rows.length === 0) continue;
+			const columns = pragmaResult.rows.map((r) => r.name);
+			const types = {};
+			for (const row of pragmaResult.rows) types[row.name] = row.type || "TEXT";
+			schema[tableName] = {
+				columns,
+				types
+			};
+			let rows;
+			if (tableName.startsWith("ec_")) if (includeDrafts) rows = (await sql`
+						SELECT * FROM ${sql.raw(`"${tableName}"`)}
+						WHERE deleted_at IS NULL
+					`.execute(db)).rows;
+			else rows = (await sql`
+						SELECT * FROM ${sql.raw(`"${tableName}"`)}
+						WHERE deleted_at IS NULL
+						AND (status = 'published' OR (status = 'scheduled' AND scheduled_at <= datetime('now')))
+					`.execute(db)).rows;
+			else if (tableName === "options") rows = (await sql`
+					SELECT * FROM ${sql.raw(`"${tableName}"`)}
+				`.execute(db)).rows.filter((row) => {
+				const name = typeof row.name === "string" ? row.name : "";
+				return SAFE_OPTIONS_PREFIXES.some((prefix) => name.startsWith(prefix));
+			});
+			else rows = (await sql`
+					SELECT * FROM ${sql.raw(`"${tableName}"`)}
+				`.execute(db)).rows;
+			if (rows.length > 0) tables[tableName] = rows;
+		} catch {}
+	}
+	if (options?.origin) {
+		const origin = options.origin;
+		for (const [tableName, rows] of Object.entries(tables)) {
+			if (!tableName.startsWith("ec_")) continue;
+			for (const row of rows) for (const [col, value] of Object.entries(row)) {
+				if (typeof value !== "string" || !value.startsWith("{")) continue;
+				row[col] = injectMediaSrc(value, origin);
+			}
+		}
+	}
+	return {
+		tables,
+		schema,
+		generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+
+//#endregion
+//#region src/astro/routes/api/snapshot.ts
+const prerender = false;
+const GET = async ({ request, locals, url, session }) => {
+	const { dineway } = locals;
+	let user = locals.user;
+	if (!user && session && dineway?.db) try {
+		const sessionUser = await session.get("user");
+		if (sessionUser?.id) {
+			const resolved = await createKyselyAdapter(dineway.db).getUserById(sessionUser.id);
+			if (resolved && !resolved.disabled) user = resolved;
+		}
+	} catch {}
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	const previewSig = request.headers.get("X-Preview-Signature");
+	let authorized = false;
+	if (previewSig) {
+		const { previewSecret: secret, previewSecretSource } = await resolveSecretsCached(dineway.db);
+		const parsed = parsePreviewSignatureHeader(previewSig);
+		if (!parsed) console.warn("[snapshot] Failed to parse X-Preview-Signature header");
+		else {
+			authorized = await verifyPreviewSignature(parsed.source, parsed.exp, parsed.sig, secret);
+			if (!authorized) {
+				const fields = {
+					source: parsed.source,
+					exp: parsed.exp,
+					expired: parsed.exp < Date.now() / 1e3,
+					secretSource: previewSecretSource
+				};
+				if (previewSecretSource === "db") fields.hint = "Set DINEWAY_PREVIEW_SECRET in both this process and the signing process to share secrets across deployments";
+				console.warn("[snapshot] Preview signature verification failed", fields);
+			}
+		}
+	}
+	if (!authorized) {
+		const contentDenied = requirePerm(user, "content:read");
+		if (contentDenied) return contentDenied;
+		const schemaDenied = requirePerm(user, "schema:read");
+		if (schemaDenied) return schemaDenied;
+	}
+	try {
+		const includeDrafts = url.searchParams.get("drafts") === "true";
+		return apiSuccess(await generateSnapshot(dineway.db, {
+			includeDrafts,
+			origin: getPublicOrigin(url, dineway.config)
+		}));
+	} catch (error) {
+		return handleError(error, "Failed to generate snapshot", "SNAPSHOT_ERROR");
+	}
+};
+
+//#endregion
+export { GET, prerender };

package/dist/astro/routes/api/taxonomies/_name_/terms/_slug_.d.mts

@@ -0,0 +1,18 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/taxonomies/[name]/terms/[slug].d.ts
+declare const prerender = false;
+/**
+ * Get a single term
+ */
+declare const GET: APIRoute;
+/**
+ * Update a term
+ */
+declare const PUT: APIRoute;
+/**
+ * Delete a term
+ */
+declare const DELETE: APIRoute;
+//#endregion
+export { DELETE, GET, PUT, prerender };

package/dist/astro/routes/api/taxonomies/_name_/terms/_slug_.mjs

@@ -0,0 +1,189 @@
+import "../../../../../../dialect-helpers-DhTzaUxP.mjs";
+import "../../../../../../content-CyLkb-qH.mjs";
+import "../../../../../../base64-Cz-aU0X1.mjs";
+import "../../../../../../types-Bs6lTBBW.mjs";
+import "../../../../../../media-_7Fxdu45.mjs";
+import "../../../../../../taxonomy-D5cbhc8u.mjs";
+import "../../../../../../options-z8VVg1Ll.mjs";
+import "../../../../../../site-activity-B8FjLIVh.mjs";
+import "../../../../../../review-requests-C2DIHwlJ.mjs";
+import "../../../../../../entity-aliases-C0v-yNET.mjs";
+import "../../../../../../briefing-BrXCuMEE.mjs";
+import "../../../../../../context-types-C-LwdAxx.mjs";
+import "../../../../../../fts-manager-B1pTNEG_.mjs";
+import "../../../../../../registry-C-_hxLqa.mjs";
+import "../../../../../../loader-PZnPxFLc.mjs";
+import "../../../../../../settings-4XnpVMOS.mjs";
+import "../../../../../../request-cache-DHMRr2Lf.mjs";
+import "../../../../../../schema-BNpI53of.mjs";
+import "../../../../../../zod-generator-DBVP8D0P.mjs";
+import "../../../../../../taxonomies-BvBgfzn3.mjs";
+import { a as handleTermGet, i as handleTermDelete, s as handleTermUpdate } from "../../../../../../taxonomies-CpqGcIJD.mjs";
+import { a as unwrapResult, i as requireDb, r as handleError, t as apiError } from "../../../../../../error-DEGjx2Xw.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../../parse-BeQXIt1U.mjs";
+import { X as updateTermBody } from "../../../../../../redirects-CqaxraTO.mjs";
+import "../../../../../../import-DD3f2jkc.mjs";
+import "../../../../../../api/schemas/index.mjs";
+import "../../../../../../utils-D2in-zwy.mjs";
+import "../../../../../../search-DM6CVti3.mjs";
+import { n as requirePerm } from "../../../../../../authorize-BBj8C6Y8.mjs";
+import { _ as RiskPolicyEvaluator, l as TaxonomyHitlPayloadBuilder } from "../../../../../../site-context-Bpu_Paur.mjs";
+import { C as taxonomyApiRouteSource, m as logTaxonomyActivity, t as activityChangedKeys } from "../../../../../../activity-events-BsMaXdJa.mjs";
+import { i as resolveHitlRouteActor, n as hitlRequiredRouteError, t as ensureWorkflowHitlRouteRequest } from "../../../../../../hitl-route-helpers-DMmJRS7B.mjs";
+import { z } from "zod";
+
+//#region src/astro/routes/api/taxonomies/[name]/terms/[slug].ts
+const prerender = false;
+const updateTermHitlBody = updateTermBody.extend({ hitlRequestId: z.string().min(1).optional() });
+const deleteTermQuery = z.object({ hitlRequestId: z.string().min(1).optional() });
+/**
+* Get a single term
+*/
+const GET = async ({ params, locals }) => {
+	const { dineway, user } = locals;
+	const { name, slug } = params;
+	if (!name || !slug) return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
+	const dbErr = requireDb(dineway?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(user, "taxonomies:read");
+	if (denied) return denied;
+	try {
+		return unwrapResult(await handleTermGet(dineway.db, name, slug));
+	} catch (error) {
+		return handleError(error, "Failed to get term", "TERM_GET_ERROR");
+	}
+};
+/**
+* Update a term
+*/
+const PUT = async ({ params, request, locals }) => {
+	const { dineway, user } = locals;
+	const { name, slug } = params;
+	if (!name || !slug) return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
+	const dbErr = requireDb(dineway?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(user, "taxonomies:manage");
+	if (denied) return denied;
+	try {
+		const body = await parseBody(request, updateTermHitlBody);
+		if (isParseError(body)) return body;
+		const current = await handleTermGet(dineway.db, name, slug);
+		if (!current.success) return unwrapResult(current);
+		const { hitlRequestId, ...termInput } = body;
+		const actor = resolveHitlRouteActor(locals);
+		const evaluator = new RiskPolicyEvaluator({
+			db: dineway.db,
+			handlers: dineway
+		});
+		let approvedHitlRequestId = null;
+		if (evaluator.requiresWorkflowHitl(actor.identity)) {
+			const payloadBuilder = new TaxonomyHitlPayloadBuilder(dineway.db);
+			const taxonomy = await payloadBuilder.loadTaxonomyDefinition(name);
+			if (!taxonomy) return apiError("NOT_FOUND", `Taxonomy '${name}' not found`, 404);
+			const action = await payloadBuilder.buildUpdateTermRequest({
+				taxonomy,
+				currentTerm: {
+					id: current.data.term.id,
+					name: current.data.term.name,
+					slug: current.data.term.slug,
+					label: current.data.term.label,
+					parentId: current.data.term.parentId,
+					description: current.data.term.description ?? null
+				},
+				...termInput
+			});
+			const decision = await evaluator.evaluateWorkflowHitl({
+				actor: actor.identity,
+				hitlRequestId,
+				action
+			});
+			if (!decision.allowed) return hitlRequiredRouteError(decision, await ensureWorkflowHitlRouteRequest(dineway.db, locals, decision.action));
+			approvedHitlRequestId = decision.hitlRequest.id;
+		}
+		const result = await handleTermUpdate(dineway.db, name, slug, termInput);
+		if (result.success) await logTaxonomyActivity(dineway.db, locals, {
+			action: "term_updated",
+			taxonomyName: name,
+			termId: result.data.term.id,
+			termSlug: result.data.term.slug,
+			...taxonomyApiRouteSource("term_updated"),
+			detail: {
+				changedKeys: activityChangedKeys(termInput),
+				label: result.data.term.label,
+				parentId: result.data.term.parentId,
+				description: result.data.term.description ?? null,
+				hitlRequestId: approvedHitlRequestId
+			}
+		});
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to update term", "TERM_UPDATE_ERROR");
+	}
+};
+/**
+* Delete a term
+*/
+const DELETE = async ({ params, request, locals }) => {
+	const { dineway, user } = locals;
+	const { name, slug } = params;
+	if (!name || !slug) return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
+	const dbErr = requireDb(dineway?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(user, "taxonomies:manage");
+	if (denied) return denied;
+	const query = parseQuery(new URL(request.url), deleteTermQuery);
+	if (isParseError(query)) return query;
+	try {
+		const current = await handleTermGet(dineway.db, name, slug);
+		if (!current.success) return unwrapResult(current);
+		const actor = resolveHitlRouteActor(locals);
+		const evaluator = new RiskPolicyEvaluator({
+			db: dineway.db,
+			handlers: dineway
+		});
+		let approvedHitlRequestId = null;
+		if (evaluator.requiresWorkflowHitl(actor.identity)) {
+			const payloadBuilder = new TaxonomyHitlPayloadBuilder(dineway.db);
+			const taxonomy = await payloadBuilder.loadTaxonomyDefinition(name);
+			if (!taxonomy) return apiError("NOT_FOUND", `Taxonomy '${name}' not found`, 404);
+			const action = await payloadBuilder.buildDeleteTermRequest({
+				taxonomy,
+				currentTerm: {
+					id: current.data.term.id,
+					name: current.data.term.name,
+					slug: current.data.term.slug,
+					label: current.data.term.label,
+					parentId: current.data.term.parentId,
+					description: current.data.term.description ?? null
+				}
+			});
+			const decision = await evaluator.evaluateWorkflowHitl({
+				actor: actor.identity,
+				hitlRequestId: query.hitlRequestId,
+				action
+			});
+			if (!decision.allowed) return hitlRequiredRouteError(decision, await ensureWorkflowHitlRouteRequest(dineway.db, locals, decision.action));
+			approvedHitlRequestId = decision.hitlRequest.id;
+		}
+		const result = await handleTermDelete(dineway.db, name, slug);
+		if (result.success) await logTaxonomyActivity(dineway.db, locals, {
+			action: "term_deleted",
+			taxonomyName: name,
+			termId: current.data.term.id,
+			termSlug: current.data.term.slug,
+			...taxonomyApiRouteSource("term_deleted"),
+			detail: {
+				label: current.data.term.label,
+				parentId: current.data.term.parentId,
+				description: current.data.term.description ?? null,
+				hitlRequestId: approvedHitlRequestId
+			}
+		});
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to delete term", "TERM_DELETE_ERROR");
+	}
+};
+
+//#endregion
+export { DELETE, GET, PUT, prerender };

package/dist/astro/routes/api/taxonomies/_name_/terms/index.d.mts

@@ -0,0 +1,14 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/taxonomies/[name]/terms/index.d.ts
+declare const prerender = false;
+/**
+ * List all terms for a taxonomy
+ */
+declare const GET: APIRoute;
+/**
+ * Create a new term
+ */
+declare const POST: APIRoute;
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/taxonomies/_name_/terms/index.mjs

@@ -0,0 +1,113 @@
+import "../../../../../../dialect-helpers-DhTzaUxP.mjs";
+import "../../../../../../content-CyLkb-qH.mjs";
+import "../../../../../../base64-Cz-aU0X1.mjs";
+import "../../../../../../types-Bs6lTBBW.mjs";
+import "../../../../../../media-_7Fxdu45.mjs";
+import "../../../../../../taxonomy-D5cbhc8u.mjs";
+import "../../../../../../options-z8VVg1Ll.mjs";
+import "../../../../../../site-activity-B8FjLIVh.mjs";
+import "../../../../../../review-requests-C2DIHwlJ.mjs";
+import "../../../../../../entity-aliases-C0v-yNET.mjs";
+import "../../../../../../briefing-BrXCuMEE.mjs";
+import "../../../../../../context-types-C-LwdAxx.mjs";
+import "../../../../../../fts-manager-B1pTNEG_.mjs";
+import "../../../../../../registry-C-_hxLqa.mjs";
+import "../../../../../../loader-PZnPxFLc.mjs";
+import "../../../../../../settings-4XnpVMOS.mjs";
+import "../../../../../../request-cache-DHMRr2Lf.mjs";
+import "../../../../../../schema-BNpI53of.mjs";
+import "../../../../../../zod-generator-DBVP8D0P.mjs";
+import "../../../../../../taxonomies-BvBgfzn3.mjs";
+import { o as handleTermList, r as handleTermCreate } from "../../../../../../taxonomies-CpqGcIJD.mjs";
+import { a as unwrapResult, i as requireDb, r as handleError, t as apiError } from "../../../../../../error-DEGjx2Xw.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../parse-BeQXIt1U.mjs";
+import { H as createTermBody } from "../../../../../../redirects-CqaxraTO.mjs";
+import "../../../../../../import-DD3f2jkc.mjs";
+import "../../../../../../api/schemas/index.mjs";
+import "../../../../../../utils-D2in-zwy.mjs";
+import "../../../../../../search-DM6CVti3.mjs";
+import { n as requirePerm } from "../../../../../../authorize-BBj8C6Y8.mjs";
+import { _ as RiskPolicyEvaluator, l as TaxonomyHitlPayloadBuilder } from "../../../../../../site-context-Bpu_Paur.mjs";
+import { C as taxonomyApiRouteSource, m as logTaxonomyActivity } from "../../../../../../activity-events-BsMaXdJa.mjs";
+import { i as resolveHitlRouteActor, n as hitlRequiredRouteError, t as ensureWorkflowHitlRouteRequest } from "../../../../../../hitl-route-helpers-DMmJRS7B.mjs";
+import { z } from "zod";
+
+//#region src/astro/routes/api/taxonomies/[name]/terms/index.ts
+const prerender = false;
+const createTermHitlBody = createTermBody.extend({ hitlRequestId: z.string().min(1).optional() });
+/**
+* List all terms for a taxonomy
+*/
+const GET = async ({ params, locals }) => {
+	const { dineway, user } = locals;
+	const { name } = params;
+	if (!name) return apiError("VALIDATION_ERROR", "Taxonomy name required", 400);
+	const dbErr = requireDb(dineway?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(user, "taxonomies:read");
+	if (denied) return denied;
+	try {
+		return unwrapResult(await handleTermList(dineway.db, name));
+	} catch (error) {
+		return handleError(error, "Failed to list terms", "TERM_LIST_ERROR");
+	}
+};
+/**
+* Create a new term
+*/
+const POST = async ({ params, request, locals }) => {
+	const { dineway, user } = locals;
+	const { name } = params;
+	if (!name) return apiError("VALIDATION_ERROR", "Taxonomy name required", 400);
+	const dbErr = requireDb(dineway?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(user, "taxonomies:manage");
+	if (denied) return denied;
+	try {
+		const body = await parseBody(request, createTermHitlBody);
+		if (isParseError(body)) return body;
+		const { hitlRequestId, ...termInput } = body;
+		const actor = resolveHitlRouteActor(locals);
+		const evaluator = new RiskPolicyEvaluator({
+			db: dineway.db,
+			handlers: dineway
+		});
+		let approvedHitlRequestId = null;
+		if (evaluator.requiresWorkflowHitl(actor.identity)) {
+			const payloadBuilder = new TaxonomyHitlPayloadBuilder(dineway.db);
+			const taxonomy = await payloadBuilder.loadTaxonomyDefinition(name);
+			if (!taxonomy) return apiError("NOT_FOUND", `Taxonomy '${name}' not found`, 404);
+			const action = await payloadBuilder.buildCreateTermRequest({
+				taxonomy,
+				...termInput
+			});
+			const decision = await evaluator.evaluateWorkflowHitl({
+				actor: actor.identity,
+				hitlRequestId,
+				action
+			});
+			if (!decision.allowed) return hitlRequiredRouteError(decision, await ensureWorkflowHitlRouteRequest(dineway.db, locals, decision.action));
+			approvedHitlRequestId = decision.hitlRequest.id;
+		}
+		const result = await handleTermCreate(dineway.db, name, termInput);
+		if (result.success) await logTaxonomyActivity(dineway.db, locals, {
+			action: "term_created",
+			taxonomyName: name,
+			termId: result.data.term.id,
+			termSlug: result.data.term.slug,
+			...taxonomyApiRouteSource("term_created"),
+			detail: {
+				label: result.data.term.label,
+				parentId: result.data.term.parentId,
+				description: result.data.term.description ?? null,
+				hitlRequestId: approvedHitlRequestId
+			}
+		});
+		return unwrapResult(result, 201);
+	} catch (error) {
+		return handleError(error, "Failed to create term", "TERM_CREATE_ERROR");
+	}
+};
+
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/taxonomies/index.d.mts

@@ -0,0 +1,14 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/taxonomies/index.d.ts
+declare const prerender = false;
+/**
+ * List taxonomy definitions
+ */
+declare const GET: APIRoute;
+/**
+ * Create a custom taxonomy definition
+ */
+declare const POST: APIRoute;
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/taxonomies/index.mjs

@@ -0,0 +1,103 @@
+import "../../../../dialect-helpers-DhTzaUxP.mjs";
+import "../../../../content-CyLkb-qH.mjs";
+import "../../../../base64-Cz-aU0X1.mjs";
+import "../../../../types-Bs6lTBBW.mjs";
+import "../../../../media-_7Fxdu45.mjs";
+import "../../../../taxonomy-D5cbhc8u.mjs";
+import "../../../../options-z8VVg1Ll.mjs";
+import "../../../../site-activity-B8FjLIVh.mjs";
+import "../../../../review-requests-C2DIHwlJ.mjs";
+import "../../../../entity-aliases-C0v-yNET.mjs";
+import "../../../../briefing-BrXCuMEE.mjs";
+import "../../../../context-types-C-LwdAxx.mjs";
+import "../../../../fts-manager-B1pTNEG_.mjs";
+import "../../../../registry-C-_hxLqa.mjs";
+import "../../../../loader-PZnPxFLc.mjs";
+import "../../../../settings-4XnpVMOS.mjs";
+import "../../../../request-cache-DHMRr2Lf.mjs";
+import "../../../../schema-BNpI53of.mjs";
+import "../../../../zod-generator-DBVP8D0P.mjs";
+import "../../../../taxonomies-BvBgfzn3.mjs";
+import { n as handleTaxonomyList, t as handleTaxonomyCreate } from "../../../../taxonomies-CpqGcIJD.mjs";
+import { a as unwrapResult, i as requireDb, r as handleError } from "../../../../error-DEGjx2Xw.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-BeQXIt1U.mjs";
+import { V as createTaxonomyDefBody } from "../../../../redirects-CqaxraTO.mjs";
+import "../../../../import-DD3f2jkc.mjs";
+import "../../../../api/schemas/index.mjs";
+import "../../../../utils-D2in-zwy.mjs";
+import "../../../../search-DM6CVti3.mjs";
+import { n as requirePerm } from "../../../../authorize-BBj8C6Y8.mjs";
+import { _ as RiskPolicyEvaluator, l as TaxonomyHitlPayloadBuilder } from "../../../../site-context-Bpu_Paur.mjs";
+import { C as taxonomyApiRouteSource, m as logTaxonomyActivity } from "../../../../activity-events-BsMaXdJa.mjs";
+import { i as resolveHitlRouteActor, n as hitlRequiredRouteError, t as ensureWorkflowHitlRouteRequest } from "../../../../hitl-route-helpers-DMmJRS7B.mjs";
+import { z } from "zod";
+
+//#region src/astro/routes/api/taxonomies/index.ts
+const prerender = false;
+const createTaxonomyHitlBody = createTaxonomyDefBody.extend({ hitlRequestId: z.string().min(1).optional() });
+/**
+* List taxonomy definitions
+*/
+const GET = async ({ locals }) => {
+	const { dineway, user } = locals;
+	const dbErr = requireDb(dineway?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(user, "taxonomies:read");
+	if (denied) return denied;
+	try {
+		return unwrapResult(await handleTaxonomyList(dineway.db));
+	} catch (error) {
+		return handleError(error, "Failed to list taxonomies", "TAXONOMY_LIST_ERROR");
+	}
+};
+/**
+* Create a custom taxonomy definition
+*/
+const POST = async ({ request, locals }) => {
+	const { dineway, user } = locals;
+	const dbErr = requireDb(dineway?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(user, "taxonomies:manage");
+	if (denied) return denied;
+	try {
+		const body = await parseBody(request, createTaxonomyHitlBody);
+		if (isParseError(body)) return body;
+		const { hitlRequestId, ...taxonomyInput } = body;
+		const actor = resolveHitlRouteActor(locals);
+		const evaluator = new RiskPolicyEvaluator({
+			db: dineway.db,
+			handlers: dineway
+		});
+		let approvedHitlRequestId = null;
+		if (evaluator.requiresWorkflowHitl(actor.identity)) {
+			const action = await new TaxonomyHitlPayloadBuilder(dineway.db).buildCreateTaxonomyRequest(taxonomyInput);
+			const decision = await evaluator.evaluateWorkflowHitl({
+				actor: actor.identity,
+				hitlRequestId,
+				action
+			});
+			if (!decision.allowed) return hitlRequiredRouteError(decision, await ensureWorkflowHitlRouteRequest(dineway.db, locals, decision.action));
+			approvedHitlRequestId = decision.hitlRequest.id;
+		}
+		const result = await handleTaxonomyCreate(dineway.db, taxonomyInput);
+		if (result.success) dineway.invalidateManifest();
+		if (result.success) await logTaxonomyActivity(dineway.db, locals, {
+			action: "created",
+			taxonomyId: result.data.taxonomy.id,
+			taxonomyName: result.data.taxonomy.name,
+			...taxonomyApiRouteSource("created"),
+			detail: {
+				label: result.data.taxonomy.label,
+				hierarchical: result.data.taxonomy.hierarchical,
+				collections: result.data.taxonomy.collections,
+				hitlRequestId: approvedHitlRequestId
+			}
+		});
+		return unwrapResult(result, 201);
+	} catch (error) {
+		return handleError(error, "Failed to create taxonomy", "TAXONOMY_CREATE_ERROR");
+	}
+};
+
+//#endregion
+export { GET, POST, prerender };