dineway 0.1.9 → 0.1.11

package/dist/astro/routes/api/settings.mjs

@@ -0,0 +1,101 @@
+import "../../../dialect-helpers-DhTzaUxP.mjs";
+import "../../../content-CyLkb-qH.mjs";
+import "../../../base64-Cz-aU0X1.mjs";
+import "../../../types-Bs6lTBBW.mjs";
+import "../../../media-_7Fxdu45.mjs";
+import "../../../options-z8VVg1Ll.mjs";
+import "../../../site-activity-B8FjLIVh.mjs";
+import "../../../review-requests-C2DIHwlJ.mjs";
+import "../../../entity-aliases-C0v-yNET.mjs";
+import "../../../briefing-BrXCuMEE.mjs";
+import "../../../context-types-C-LwdAxx.mjs";
+import "../../../fts-manager-B1pTNEG_.mjs";
+import "../../../registry-C-_hxLqa.mjs";
+import "../../../loader-PZnPxFLc.mjs";
+import "../../../settings-4XnpVMOS.mjs";
+import "../../../request-cache-DHMRr2Lf.mjs";
+import "../../../schema-BNpI53of.mjs";
+import "../../../zod-generator-DBVP8D0P.mjs";
+import { n as handleSettingsUpdate, t as handleSettingsGet } from "../../../settings-Bw93cLfe.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../error-DEGjx2Xw.mjs";
+import { n as parseBody, t as isParseError } from "../../../parse-BeQXIt1U.mjs";
+import { P as settingsUpdateBody } from "../../../redirects-CqaxraTO.mjs";
+import "../../../import-DD3f2jkc.mjs";
+import "../../../api/schemas/index.mjs";
+import "../../../utils-D2in-zwy.mjs";
+import "../../../search-DM6CVti3.mjs";
+import { n as requirePerm } from "../../../authorize-BBj8C6Y8.mjs";
+import { _ as RiskPolicyEvaluator, f as SettingsHitlPayloadBuilder } from "../../../site-context-Bpu_Paur.mjs";
+import { S as settingsApiRouteSource, p as logSiteActivitySafely } from "../../../activity-events-BsMaXdJa.mjs";
+import { i as resolveHitlRouteActor, n as hitlRequiredRouteError, t as ensureWorkflowHitlRouteRequest } from "../../../hitl-route-helpers-DMmJRS7B.mjs";
+import { z } from "zod";
+
+//#region src/astro/routes/api/settings.ts
+const prerender = false;
+const settingsHitlBody = settingsUpdateBody.extend({ hitlRequestId: z.string().min(1).optional() });
+/**
+* GET /_dineway/api/settings
+*
+* Returns all site settings as a JSON object.
+* Unset values are undefined. Media references include resolved URLs.
+*/
+const GET = async ({ locals }) => {
+	const { dineway, user } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	const denied = requirePerm(user, "settings:read");
+	if (denied) return denied;
+	try {
+		return unwrapResult(await handleSettingsGet(dineway.db, dineway.storage));
+	} catch (error) {
+		return handleError(error, "Failed to get settings", "SETTINGS_READ_ERROR");
+	}
+};
+/**
+* POST /_dineway/api/settings
+*
+* Updates site settings. Accepts a partial settings object.
+* Merges with existing settings and returns the updated settings.
+*/
+const POST = async ({ request, locals }) => {
+	const { dineway, user } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	const denied = requirePerm(user, "settings:manage");
+	if (denied) return denied;
+	try {
+		const body = await parseBody(request, settingsHitlBody);
+		if (isParseError(body)) return body;
+		const { hitlRequestId, ...settingsInput } = body;
+		const actor = resolveHitlRouteActor(locals);
+		const action = await new SettingsHitlPayloadBuilder(dineway.db).buildUpdateSettingsRequest(settingsInput);
+		const decision = await new RiskPolicyEvaluator({
+			db: dineway.db,
+			handlers: dineway
+		}).evaluateWorkflowHitl({
+			actor: actor.identity,
+			hitlRequestId,
+			action
+		});
+		if (!decision.allowed) return hitlRequiredRouteError(decision, await ensureWorkflowHitlRouteRequest(dineway.db, locals, decision.action));
+		const result = await handleSettingsUpdate(dineway.db, dineway.storage, settingsInput);
+		if (!result.success) return unwrapResult(result);
+		await logSiteActivitySafely(dineway.db, locals, {
+			actionType: "settings.updated",
+			subjectType: "site_settings",
+			subjectId: "site",
+			scope: "site",
+			...settingsApiRouteSource("updated"),
+			summary: action.summary ?? "Updated site settings",
+			detail: {
+				changedKeys: Object.keys(settingsInput).toSorted(),
+				touchesSeo: Object.hasOwn(settingsInput, "seo"),
+				hitlRequestId: decision.required ? decision.hitlRequest.id : null
+			}
+		});
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to update settings", "SETTINGS_UPDATE_ERROR");
+	}
+};
+
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/setup/admin-verify.d.mts

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/setup/admin-verify.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/setup/admin-verify.mjs

@@ -0,0 +1,67 @@
+import { t as OptionsRepository } from "../../../../options-z8VVg1Ll.mjs";
+import "../../../../context-types-C-LwdAxx.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DEGjx2Xw.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-BeQXIt1U.mjs";
+import "../../../../redirects-CqaxraTO.mjs";
+import "../../../../import-DD3f2jkc.mjs";
+import { setupAdminVerifyBody } from "../../../../api/schemas/setup.mjs";
+import "../../../../api/schemas/index.mjs";
+import { n as getPublicOrigin } from "../../../../public-url-BB_umF5G.mjs";
+import { t as finalizeSetup } from "../../../../setup-complete-DidsDQ1e.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../allowed-origins-DG86sH8U.mjs";
+import { n as createChallengeStore } from "../../../../challenge-store-DHMgBGOq.mjs";
+import { t as getPasskeyConfig } from "../../../../passkey-config-Daqs5fjq.mjs";
+import { t as SETUP_NONCE_COOKIE } from "../../../../setup-nonce-pml1PMKo.mjs";
+import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
+import { Role, secureCompare } from "@dineway-ai/auth";
+import { registerPasskey, verifyRegistrationResponse } from "@dineway-ai/auth/passkey";
+
+//#region src/astro/routes/api/setup/admin-verify.ts
+const prerender = false;
+const POST = async ({ cookies, request, locals }) => {
+	const { dineway } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	try {
+		const options = new OptionsRepository(dineway.db);
+		const setupComplete = await options.get("dineway:setup_complete");
+		if (setupComplete === true || setupComplete === "true") return apiError("SETUP_COMPLETE", "Setup already complete", 400);
+		const adapter = createKyselyAdapter(dineway.db);
+		if (await adapter.countUsers() > 0) return apiError("ADMIN_EXISTS", "Admin user already exists", 400);
+		const setupState = await options.get("dineway:setup_state");
+		if (!setupState || setupState.step !== "admin") return apiError("INVALID_STATE", "Invalid setup state. Please restart setup.", 400);
+		const cookieNonce = cookies.get(SETUP_NONCE_COOKIE)?.value;
+		if (!setupState.nonce || !cookieNonce || !secureCompare(cookieNonce, setupState.nonce)) return apiError("INVALID_STATE", "Setup session expired or tampered with. Please restart the admin step.", 400);
+		if (!setupState.email) return apiError("INVALID_STATE", "Invalid setup state. Please restart setup.", 400);
+		const body = await parseBody(request, setupAdminVerifyBody);
+		if (isParseError(body)) return body;
+		const url = new URL(request.url);
+		const siteName = await options.get("dineway:site_title") ?? void 0;
+		const siteUrl = getPublicOrigin(url, dineway?.config);
+		const passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, validateAllowedOrigins(siteUrl, getConfiguredAllowedOrigins(dineway?.config)));
+		const challengeStore = createChallengeStore(dineway.db);
+		const verified = await verifyRegistrationResponse(passkeyConfig, body.credential, challengeStore);
+		const user = await adapter.createUser({
+			email: setupState.email,
+			name: setupState.name ?? null,
+			role: Role.ADMIN,
+			emailVerified: false
+		});
+		await registerPasskey(adapter, user.id, verified, "Setup passkey");
+		await finalizeSetup(dineway.db);
+		cookies.delete(SETUP_NONCE_COOKIE, { path: "/_dineway/" });
+		return apiSuccess({
+			success: true,
+			user: {
+				id: user.id,
+				email: user.email,
+				name: user.name,
+				role: user.role
+			}
+		});
+	} catch (error) {
+		return handleError(error, "Failed to verify admin setup", "SETUP_VERIFY_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/setup/admin.d.mts

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/setup/admin.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/setup/admin.mjs

@@ -0,0 +1,68 @@
+import { t as OptionsRepository } from "../../../../options-z8VVg1Ll.mjs";
+import "../../../../context-types-C-LwdAxx.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DEGjx2Xw.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-BeQXIt1U.mjs";
+import "../../../../redirects-CqaxraTO.mjs";
+import "../../../../import-DD3f2jkc.mjs";
+import { setupAdminBody } from "../../../../api/schemas/setup.mjs";
+import "../../../../api/schemas/index.mjs";
+import { n as getPublicOrigin } from "../../../../public-url-BB_umF5G.mjs";
+import { n as createChallengeStore } from "../../../../challenge-store-DHMgBGOq.mjs";
+import { t as getPasskeyConfig } from "../../../../passkey-config-Daqs5fjq.mjs";
+import { n as SETUP_NONCE_MAX_AGE_SECONDS, t as SETUP_NONCE_COOKIE } from "../../../../setup-nonce-pml1PMKo.mjs";
+import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
+import { generateToken } from "@dineway-ai/auth";
+import { generateRegistrationOptions } from "@dineway-ai/auth/passkey";
+
+//#region src/astro/routes/api/setup/admin.ts
+const prerender = false;
+const POST = async ({ cookies, request, locals }) => {
+	const { dineway } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	try {
+		const options = new OptionsRepository(dineway.db);
+		const setupComplete = await options.get("dineway:setup_complete");
+		if (setupComplete === true || setupComplete === "true") return apiError("SETUP_COMPLETE", "Setup already complete", 400);
+		if (await createKyselyAdapter(dineway.db).countUsers() > 0) return apiError("ADMIN_EXISTS", "Admin user already exists", 400);
+		const body = await parseBody(request, setupAdminBody);
+		if (isParseError(body)) return body;
+		const existingState = await options.get("dineway:setup_state");
+		const nonce = generateToken();
+		const url = new URL(request.url);
+		const siteName = await options.get("dineway:site_title") ?? void 0;
+		const siteUrl = getPublicOrigin(url, dineway?.config);
+		const passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);
+		const challengeStore = createChallengeStore(dineway.db);
+		const tempUser = {
+			id: `setup-${Date.now()}`,
+			email: body.email.toLowerCase(),
+			name: body.name || null
+		};
+		const registrationOptions = await generateRegistrationOptions(passkeyConfig, tempUser, [], challengeStore);
+		await options.set("dineway:setup_state", {
+			...existingState,
+			step: "admin",
+			email: body.email.toLowerCase(),
+			name: body.name || null,
+			tempUserId: tempUser.id,
+			nonce
+		});
+		const publicOrigin = new URL(siteUrl);
+		cookies.set(SETUP_NONCE_COOKIE, nonce, {
+			path: "/_dineway/",
+			httpOnly: true,
+			sameSite: "strict",
+			secure: publicOrigin.protocol === "https:",
+			maxAge: SETUP_NONCE_MAX_AGE_SECONDS
+		});
+		return apiSuccess({
+			success: true,
+			options: registrationOptions
+		});
+	} catch (error) {
+		return handleError(error, "Failed to create admin", "SETUP_ADMIN_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/setup/dev-bypass.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/setup/dev-bypass.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+declare const POST: APIRoute;
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/setup/dev-bypass.mjs

@@ -0,0 +1,137 @@
+import "../../../../dialect-helpers-DhTzaUxP.mjs";
+import { r as runMigrations } from "../../../../runner-DWZm2KQm.mjs";
+import "../../../../content-CyLkb-qH.mjs";
+import "../../../../base64-Cz-aU0X1.mjs";
+import "../../../../types-Bs6lTBBW.mjs";
+import "../../../../media-_7Fxdu45.mjs";
+import "../../../../taxonomy-D5cbhc8u.mjs";
+import { t as OptionsRepository } from "../../../../options-z8VVg1Ll.mjs";
+import "../../../../redirect-CGl64yOX.mjs";
+import "../../../../byline-naZxOPSa.mjs";
+import "../../../../fts-manager-B1pTNEG_.mjs";
+import "../../../../registry-C-_hxLqa.mjs";
+import "../../../../loader-PZnPxFLc.mjs";
+import "../../../../settings-4XnpVMOS.mjs";
+import "../../../../request-cache-DHMRr2Lf.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DEGjx2Xw.mjs";
+import "../../../../ssrf-CmM76lLV.mjs";
+import { t as validateSeed } from "../../../../validate-BJgA6TW_.mjs";
+import { t as applySeed } from "../../../../apply-Co5imxxT.mjs";
+import { t as loadSeed } from "../../../../load-D-9NhLmF.mjs";
+import { n as getPublicOrigin } from "../../../../public-url-BB_umF5G.mjs";
+import "../../../../api-tokens-DzloJxuh.mjs";
+import { t as handleApiTokenCreate } from "../../../../api-tokens-Bu3ez1MO.mjs";
+import { t as escapeHtml } from "../../../../escape-mNZr4t2A.mjs";
+import { t as isSafeRedirect } from "../../../../redirect-ClSmMOtC.mjs";
+import { ulid } from "ulidx";
+
+//#region src/astro/routes/api/setup/dev-bypass.ts
+const prerender = false;
+const ROLE_ADMIN = 50;
+const DEV_USER_EMAIL = "dev@dineway.local";
+const DEV_USER_NAME = "Dev Admin";
+const DEV_SITE_TITLE = "Dineway Dev Site";
+async function handleDevBypass(context) {
+	if (!import.meta.env.DEV) return apiError("FORBIDDEN", "Dev bypass is only available in development mode", 403);
+	const { locals, url, session } = context;
+	const { dineway } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	try {
+		const migrations = await runMigrations(dineway.db);
+		console.log("[setup-dev-bypass] Migrations applied:", migrations.applied);
+		const seed = await loadSeed();
+		if (validateSeed(seed).valid) {
+			const seedResult = await applySeed(dineway.db, seed, {
+				includeContent: true,
+				onConflict: "skip",
+				storage: dineway.storage ?? void 0
+			});
+			console.log(`[setup-dev-bypass] Seed applied: ${seedResult.collections.created} collections, ${seedResult.fields.created} fields`);
+		}
+		const options = new OptionsRepository(dineway.db);
+		const existingUser = await dineway.db.selectFrom("users").selectAll().where("email", "=", DEV_USER_EMAIL).executeTakeFirst();
+		let user;
+		let userCreated = false;
+		if (!existingUser) {
+			const now = (/* @__PURE__ */ new Date()).toISOString();
+			const newUser = {
+				id: ulid(),
+				email: DEV_USER_EMAIL,
+				name: DEV_USER_NAME,
+				role: ROLE_ADMIN,
+				email_verified: 1,
+				created_at: now,
+				updated_at: now
+			};
+			await dineway.db.insertInto("users").values(newUser).execute();
+			user = {
+				id: newUser.id,
+				email: newUser.email,
+				name: newUser.name,
+				role: newUser.role
+			};
+			userCreated = true;
+			console.log("[setup-dev-bypass] Created dev admin user:", user.email);
+		} else user = {
+			id: existingUser.id,
+			email: existingUser.email,
+			name: existingUser.name || DEV_USER_NAME,
+			role: existingUser.role
+		};
+		if (!await options.get("dineway:site_title")) await options.set("dineway:site_title", DEV_SITE_TITLE);
+		await options.set("dineway:site_url", getPublicOrigin(url, dineway?.config));
+		await options.set("dineway:setup_complete", true);
+		if (session) session.set("user", { id: user.id });
+		let token;
+		if (url.searchParams.has("token")) {
+			const result = await handleApiTokenCreate(dineway.db, user.id, {
+				name: "dev-bypass-token",
+				scopes: [
+					"content:read",
+					"content:write",
+					"media:read",
+					"media:write",
+					"schema:read",
+					"schema:write",
+					"admin"
+				]
+			});
+			if (result.success) token = result.data.token;
+		}
+		const redirect = url.searchParams.get("redirect");
+		if (redirect) {
+			if (!isSafeRedirect(redirect)) return apiError("INVALID_REDIRECT", "Redirect must be a local path", 400);
+			const html = `<!DOCTYPE html>
+<html>
+<head>
+	<meta http-equiv="refresh" content="0;url=${escapeHtml(redirect)}">
+</head>
+<body>Redirecting...</body>
+</html>`;
+			return new Response(html, {
+				status: 200,
+				headers: { "Content-Type": "text/html" }
+			});
+		}
+		return apiSuccess({
+			success: true,
+			message: "Dev setup complete",
+			migrations: migrations.applied,
+			userCreated,
+			user: {
+				id: user.id,
+				email: user.email,
+				name: user.name,
+				role: user.role
+			},
+			...token ? { token } : {}
+		});
+	} catch (error) {
+		return handleError(error, "Dev bypass failed", "DEV_BYPASS_ERROR");
+	}
+}
+const GET = handleDevBypass;
+const POST = handleDevBypass;
+
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/setup/dev-reset.d.mts

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/setup/dev-reset.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/setup/dev-reset.mjs

@@ -0,0 +1,22 @@
+import { t as OptionsRepository } from "../../../../options-z8VVg1Ll.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DEGjx2Xw.mjs";
+
+//#region src/astro/routes/api/setup/dev-reset.ts
+const prerender = false;
+const POST = async ({ locals }) => {
+	if (!import.meta.env.DEV) return apiError("FORBIDDEN", "Dev reset is only available in development mode", 403);
+	const { dineway } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	try {
+		const options = new OptionsRepository(dineway.db);
+		await options.delete("dineway:setup_complete");
+		await options.delete("dineway:setup_state");
+		await dineway.db.deleteFrom("users").execute();
+		return apiSuccess({ success: true });
+	} catch (error) {
+		return handleError(error, "Dev reset failed", "DEV_RESET_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/setup/index.d.mts

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/setup/index.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/setup/index.mjs

@@ -0,0 +1,93 @@
+import "../../../../dialect-helpers-DhTzaUxP.mjs";
+import { r as runMigrations } from "../../../../runner-DWZm2KQm.mjs";
+import "../../../../content-CyLkb-qH.mjs";
+import "../../../../base64-Cz-aU0X1.mjs";
+import "../../../../types-Bs6lTBBW.mjs";
+import "../../../../media-_7Fxdu45.mjs";
+import "../../../../taxonomy-D5cbhc8u.mjs";
+import { t as OptionsRepository } from "../../../../options-z8VVg1Ll.mjs";
+import "../../../../redirect-CGl64yOX.mjs";
+import "../../../../byline-naZxOPSa.mjs";
+import "../../../../context-types-C-LwdAxx.mjs";
+import "../../../../fts-manager-B1pTNEG_.mjs";
+import "../../../../registry-C-_hxLqa.mjs";
+import "../../../../loader-PZnPxFLc.mjs";
+import "../../../../settings-4XnpVMOS.mjs";
+import "../../../../request-cache-DHMRr2Lf.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DEGjx2Xw.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-BeQXIt1U.mjs";
+import "../../../../redirects-CqaxraTO.mjs";
+import "../../../../import-DD3f2jkc.mjs";
+import { setupBody } from "../../../../api/schemas/setup.mjs";
+import "../../../../api/schemas/index.mjs";
+import "../../../../ssrf-CmM76lLV.mjs";
+import { t as validateSeed } from "../../../../validate-BJgA6TW_.mjs";
+import { t as applySeed } from "../../../../apply-Co5imxxT.mjs";
+import { t as loadSeed } from "../../../../load-D-9NhLmF.mjs";
+import { n as getPublicOrigin } from "../../../../public-url-BB_umF5G.mjs";
+import { t as getAuthMode } from "../../../../mode-C80mAZQv.mjs";
+
+//#region src/astro/routes/api/setup/index.ts
+const prerender = false;
+const POST = async ({ request, url, locals }) => {
+	const { dineway } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	try {
+		try {
+			const setupComplete = await new OptionsRepository(dineway.db).get("dineway:setup_complete");
+			if (setupComplete === true || setupComplete === "true") return apiError("ALREADY_CONFIGURED", "Setup has already been completed", 409);
+		} catch {}
+		const body = await parseBody(request, setupBody);
+		if (isParseError(body)) return body;
+		try {
+			await runMigrations(dineway.db);
+		} catch (error) {
+			return handleError(error, "Failed to run database migrations", "MIGRATION_ERROR");
+		}
+		const seed = await loadSeed();
+		seed.settings = {
+			...seed.settings,
+			title: body.title,
+			tagline: body.tagline
+		};
+		const validation = validateSeed(seed);
+		if (!validation.valid) return apiError("INVALID_SEED", `Invalid seed file: ${validation.errors.join(", ")}`, 400);
+		let result;
+		try {
+			result = await applySeed(dineway.db, seed, {
+				includeContent: body.includeContent,
+				onConflict: "skip",
+				storage: dineway.storage ?? void 0
+			});
+		} catch (error) {
+			return handleError(error, "Failed to apply seed", "SEED_ERROR");
+		}
+		const useExternalAuth = getAuthMode(dineway.config).type === "external";
+		try {
+			const options = new OptionsRepository(dineway.db);
+			const siteUrl = getPublicOrigin(url, dineway.config);
+			await options.setIfAbsent("dineway:site_url", siteUrl);
+			if (useExternalAuth) {
+				await options.set("dineway:setup_complete", true);
+				await options.set("dineway:site_title", body.title);
+				if (body.tagline) await options.set("dineway:site_tagline", body.tagline);
+			} else await options.set("dineway:setup_state", {
+				step: "site_complete",
+				title: body.title,
+				tagline: body.tagline
+			});
+		} catch (error) {
+			console.error("Failed to save setup state:", error);
+		}
+		return apiSuccess({
+			success: true,
+			setupComplete: useExternalAuth,
+			result
+		});
+	} catch (error) {
+		return handleError(error, "Setup failed", "SETUP_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/setup/status.d.mts

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/setup/status.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };

package/dist/astro/routes/api/setup/status.mjs

@@ -0,0 +1,57 @@
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DEGjx2Xw.mjs";
+import { n as loadUserSeed } from "../../../../load-D-9NhLmF.mjs";
+import { t as getAuthMode } from "../../../../mode-C80mAZQv.mjs";
+
+//#region src/astro/routes/api/setup/status.ts
+const prerender = false;
+const GET = async ({ locals }) => {
+	const { dineway } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	try {
+		const setupComplete = await dineway.db.selectFrom("options").select("value").where("name", "=", "dineway:setup_complete").executeTakeFirst();
+		const isComplete = setupComplete && (() => {
+			try {
+				const parsed = JSON.parse(setupComplete.value);
+				return parsed === true || parsed === "true";
+			} catch {
+				return false;
+			}
+		})();
+		let hasUsers = false;
+		try {
+			hasUsers = (await dineway.db.selectFrom("users").select((eb) => eb.fn.countAll().as("count")).executeTakeFirstOrThrow()).count > 0;
+		} catch {}
+		if (isComplete && hasUsers) return apiSuccess({ needsSetup: false });
+		let step = "start";
+		const setupState = await dineway.db.selectFrom("options").select("value").where("name", "=", "dineway:setup_state").executeTakeFirst();
+		if (setupState) try {
+			const state = JSON.parse(setupState.value);
+			if (state.step === "admin") step = "admin";
+			else if (state.step === "site") step = "site";
+		} catch {}
+		if (isComplete && !hasUsers) step = "admin";
+		const authMode = getAuthMode(dineway.config);
+		const useExternalAuth = authMode.type === "external";
+		if (useExternalAuth && isComplete) return apiSuccess({ needsSetup: false });
+		const seed = await loadUserSeed();
+		const seedInfo = seed ? {
+			name: seed.meta?.name || "Unknown Template",
+			description: seed.meta?.description || "",
+			collections: seed.collections?.length || 0,
+			hasContent: !!(seed.content && Object.keys(seed.content).length > 0),
+			title: seed.settings?.title,
+			tagline: seed.settings?.tagline
+		} : null;
+		return apiSuccess({
+			needsSetup: true,
+			step,
+			seedInfo,
+			authMode: useExternalAuth ? authMode.providerType : "passkey"
+		});
+	} catch (error) {
+		return handleError(error, "Failed to check setup status", "SETUP_STATUS_ERROR");
+	}
+};
+
+//#endregion
+export { GET, prerender };

package/dist/astro/routes/api/snapshot.d.mts

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/snapshot.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };