npm - dineway - Versions diffs - 0.1.9 → 0.1.12 - Mend

dineway 0.1.9 → 0.1.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (720) hide show

package/dist/astro/routes/api/settings/email.mjs ADDED Viewed

@@ -0,0 +1,102 @@
+import { t as OptionsRepository } from "../../../../options-z8VVg1Ll.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-BMUPwxgx.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-C9106ehs.mjs";
+import { n as requirePerm } from "../../../../authorize-BAdbMCwC.mjs";
+import { z } from "zod";
+import { escapeHtml } from "@dineway-ai/auth";
+//#region src/astro/routes/api/settings/email.ts
+/**
+* Email Settings API endpoint
+*
+* GET  /_dineway/api/settings/email      — current provider, available providers, middleware
+* POST /_dineway/api/settings/email/test — send a test email through the full pipeline
+*/
+const prerender = false;
+const EMAIL_DELIVER_HOOK = "email:deliver";
+const EMAIL_BEFORE_SEND_HOOK = "email:beforeSend";
+const EMAIL_AFTER_SEND_HOOK = "email:afterSend";
+/**
+* GET /_dineway/api/settings/email
+*
+* Returns the email configuration state:
+* - Current provider selection
+* - Available providers (plugins with email:deliver)
+* - Active middleware (email:beforeSend / email:afterSend plugins)
+* - Whether email is available
+*/
+const GET = async ({ locals }) => {
+	const { dineway, user } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	const denied = requirePerm(user, "settings:manage");
+	if (denied) return denied;
+	try {
+		const pipeline = dineway.hooks;
+		const optionsRepo = new OptionsRepository(dineway.db);
+		const providers = pipeline.getExclusiveHookProviders(EMAIL_DELIVER_HOOK);
+		const selectedProviderId = await optionsRepo.get(`dineway:exclusive_hook:${EMAIL_DELIVER_HOOK}`);
+		const beforeSendPlugins = pipeline.getHookProviders(EMAIL_BEFORE_SEND_HOOK).map((p) => p.pluginId);
+		const afterSendPlugins = pipeline.getHookProviders(EMAIL_AFTER_SEND_HOOK).map((p) => p.pluginId);
+		return apiSuccess({
+			available: dineway.email?.isAvailable() ?? false,
+			providers: providers.map((p) => ({ pluginId: p.pluginId })),
+			selectedProviderId: selectedProviderId ?? null,
+			middleware: {
+				beforeSend: beforeSendPlugins,
+				afterSend: afterSendPlugins
+			}
+		});
+	} catch (error) {
+		return handleError(error, "Failed to get email settings", "EMAIL_SETTINGS_READ_ERROR");
+	}
+};
+/**
+* POST /_dineway/api/settings/email/test
+*
+* Send a test email through the full pipeline.
+* Validates the pipeline is configured and the provider works.
+*/
+const testEmailBody = z.object({ to: z.string().email() });
+const POST = async ({ request, locals }) => {
+	const { dineway, user } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	const denied = requirePerm(user, "settings:manage");
+	if (denied) return denied;
+	if (!dineway.email?.isAvailable()) return apiError("EMAIL_NOT_CONFIGURED", "No email provider is configured. Install and activate an email provider plugin.", 503);
+	try {
+		const body = await parseBody(request, testEmailBody);
+		if (isParseError(body)) return body;
+		const siteName = await new OptionsRepository(dineway.db).get("dineway:site_title") ?? "Dineway";
+		const safeName = escapeHtml(siteName);
+		await dineway.email.send({
+			to: body.to,
+			subject: `Test email from ${siteName}`,
+			text: `This is a test email from ${siteName}.\n\nIf you received this, your email provider is working correctly.`,
+			html: `
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+</head>
+<body style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.5; color: #333; max-width: 600px; margin: 0 auto; padding: 20px;">
+  <h1 style="font-size: 24px; margin-bottom: 20px;">Test Email</h1>
+  <p>This is a test email from <strong>${safeName}</strong>.</p>
+  <p>If you received this, your email provider is working correctly.</p>
+  <p style="color: #666; font-size: 14px; margin-top: 30px;">
+    Sent via the Dineway email pipeline.
+  </p>
+</body>
+</html>`
+		}, "admin");
+		return apiSuccess({
+			success: true,
+			message: `Test email sent to ${body.to}`
+		});
+	} catch (error) {
+		return handleError(error, "Failed to send test email", "EMAIL_TEST_ERROR");
+	}
+};
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/settings.d.mts ADDED Viewed

@@ -0,0 +1,20 @@
+import { APIRoute } from "astro";
+//#region src/astro/routes/api/settings.d.ts
+declare const prerender = false;
+/**
+ * GET /_dineway/api/settings
+ *
+ * Returns all site settings as a JSON object.
+ * Unset values are undefined. Media references include resolved URLs.
+ */
+declare const GET: APIRoute;
+/**
+ * POST /_dineway/api/settings
+ *
+ * Updates site settings. Accepts a partial settings object.
+ * Merges with existing settings and returns the updated settings.
+ */
+declare const POST: APIRoute;
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/settings.mjs ADDED Viewed

@@ -0,0 +1,102 @@
+import "../../../dialect-helpers-DhTzaUxP.mjs";
+import "../../../content-CyLkb-qH.mjs";
+import "../../../base64-Cz-aU0X1.mjs";
+import "../../../types-Bs6lTBBW.mjs";
+import "../../../media-_7Fxdu45.mjs";
+import "../../../options-z8VVg1Ll.mjs";
+import "../../../site-activity-B8FjLIVh.mjs";
+import "../../../review-requests-C2DIHwlJ.mjs";
+import "../../../entity-aliases-C0v-yNET.mjs";
+import "../../../briefing-MVYe_Uyf.mjs";
+import "../../../context-types-C-LwdAxx.mjs";
+import "../../../fts-manager-B1pTNEG_.mjs";
+import "../../../registry-C-_hxLqa.mjs";
+import "../../../loader-PZnPxFLc.mjs";
+import "../../../settings-DGtLLSaz.mjs";
+import "../../../request-cache-DHMRr2Lf.mjs";
+import "../../../query-CsbOywSY.mjs";
+import "../../../zod-generator-DBVP8D0P.mjs";
+import "../../../schema-BECjUhP8.mjs";
+import { n as handleSettingsUpdate, t as handleSettingsGet } from "../../../settings-Dzgswvg4.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../error-BMUPwxgx.mjs";
+import { n as parseBody, t as isParseError } from "../../../parse-C9106ehs.mjs";
+import { P as settingsUpdateBody } from "../../../redirects-lrlmYXVE.mjs";
+import "../../../import-CNcKWTbp.mjs";
+import "../../../api/schemas/index.mjs";
+import "../../../utils-C0ONdBul.mjs";
+import "../../../search-DqTHQqtV.mjs";
+import { n as requirePerm } from "../../../authorize-BAdbMCwC.mjs";
+import { _ as RiskPolicyEvaluator, f as SettingsHitlPayloadBuilder } from "../../../site-context-WBxoD99D.mjs";
+import { S as settingsApiRouteSource, p as logSiteActivitySafely } from "../../../activity-events-B4wp7CrU.mjs";
+import { i as resolveHitlRouteActor, n as hitlRequiredRouteError, t as ensureWorkflowHitlRouteRequest } from "../../../hitl-route-helpers-CSit54Ru.mjs";
+import { z } from "zod";
+//#region src/astro/routes/api/settings.ts
+const prerender = false;
+const settingsHitlBody = settingsUpdateBody.extend({ hitlRequestId: z.string().min(1).optional() });
+/**
+* GET /_dineway/api/settings
+*
+* Returns all site settings as a JSON object.
+* Unset values are undefined. Media references include resolved URLs.
+*/
+const GET = async ({ locals }) => {
+	const { dineway, user } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	const denied = requirePerm(user, "settings:read");
+	if (denied) return denied;
+	try {
+		return unwrapResult(await handleSettingsGet(dineway.db, dineway.storage));
+	} catch (error) {
+		return handleError(error, "Failed to get settings", "SETTINGS_READ_ERROR");
+	}
+};
+/**
+* POST /_dineway/api/settings
+*
+* Updates site settings. Accepts a partial settings object.
+* Merges with existing settings and returns the updated settings.
+*/
+const POST = async ({ request, locals }) => {
+	const { dineway, user } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	const denied = requirePerm(user, "settings:manage");
+	if (denied) return denied;
+	try {
+		const body = await parseBody(request, settingsHitlBody);
+		if (isParseError(body)) return body;
+		const { hitlRequestId, ...settingsInput } = body;
+		const actor = resolveHitlRouteActor(locals);
+		const action = await new SettingsHitlPayloadBuilder(dineway.db).buildUpdateSettingsRequest(settingsInput);
+		const decision = await new RiskPolicyEvaluator({
+			db: dineway.db,
+			handlers: dineway
+		}).evaluateWorkflowHitl({
+			actor: actor.identity,
+			hitlRequestId,
+			action
+		});
+		if (!decision.allowed) return hitlRequiredRouteError(decision, await ensureWorkflowHitlRouteRequest(dineway.db, locals, decision.action));
+		const result = await handleSettingsUpdate(dineway.db, dineway.storage, settingsInput);
+		if (!result.success) return unwrapResult(result);
+		await logSiteActivitySafely(dineway.db, locals, {
+			actionType: "settings.updated",
+			subjectType: "site_settings",
+			subjectId: "site",
+			scope: "site",
+			...settingsApiRouteSource("updated"),
+			summary: action.summary ?? "Updated site settings",
+			detail: {
+				changedKeys: Object.keys(settingsInput).toSorted(),
+				touchesSeo: Object.hasOwn(settingsInput, "seo"),
+				hitlRequestId: decision.required ? decision.hitlRequest.id : null
+			}
+		});
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to update settings", "SETTINGS_UPDATE_ERROR");
+	}
+};
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/setup/admin-verify.d.mts ADDED Viewed

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+//#region src/astro/routes/api/setup/admin-verify.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/setup/admin-verify.mjs ADDED Viewed

@@ -0,0 +1,67 @@
+import { t as OptionsRepository } from "../../../../options-z8VVg1Ll.mjs";
+import "../../../../context-types-C-LwdAxx.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-BMUPwxgx.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-C9106ehs.mjs";
+import "../../../../redirects-lrlmYXVE.mjs";
+import "../../../../import-CNcKWTbp.mjs";
+import { setupAdminVerifyBody } from "../../../../api/schemas/setup.mjs";
+import "../../../../api/schemas/index.mjs";
+import { n as getPublicOrigin } from "../../../../public-url-Cun8N3NU.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../allowed-origins-C1AKK9AT.mjs";
+import { n as createChallengeStore } from "../../../../challenge-store-DDTbisbf.mjs";
+import { t as finalizeSetup } from "../../../../setup-complete-ChilE-da.mjs";
+import { t as getPasskeyConfig } from "../../../../passkey-config-BRSZx4pW.mjs";
+import { t as SETUP_NONCE_COOKIE } from "../../../../setup-nonce-BpmLXAuu.mjs";
+import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
+import { Role, secureCompare } from "@dineway-ai/auth";
+import { registerPasskey, verifyRegistrationResponse } from "@dineway-ai/auth/passkey";
+//#region src/astro/routes/api/setup/admin-verify.ts
+const prerender = false;
+const POST = async ({ cookies, request, locals }) => {
+	const { dineway } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	try {
+		const options = new OptionsRepository(dineway.db);
+		const setupComplete = await options.get("dineway:setup_complete");
+		if (setupComplete === true || setupComplete === "true") return apiError("SETUP_COMPLETE", "Setup already complete", 400);
+		const adapter = createKyselyAdapter(dineway.db);
+		if (await adapter.countUsers() > 0) return apiError("ADMIN_EXISTS", "Admin user already exists", 400);
+		const setupState = await options.get("dineway:setup_state");
+		if (!setupState || setupState.step !== "admin") return apiError("INVALID_STATE", "Invalid setup state. Please restart setup.", 400);
+		const cookieNonce = cookies.get(SETUP_NONCE_COOKIE)?.value;
+		if (!setupState.nonce || !cookieNonce || !secureCompare(cookieNonce, setupState.nonce)) return apiError("INVALID_STATE", "Setup session expired or tampered with. Please restart the admin step.", 400);
+		if (!setupState.email) return apiError("INVALID_STATE", "Invalid setup state. Please restart setup.", 400);
+		const body = await parseBody(request, setupAdminVerifyBody);
+		if (isParseError(body)) return body;
+		const url = new URL(request.url);
+		const siteName = await options.get("dineway:site_title") ?? void 0;
+		const siteUrl = getPublicOrigin(url, dineway?.config);
+		const passkeyConfig = getPasskeyConfig(url, siteName, siteUrl, validateAllowedOrigins(siteUrl, getConfiguredAllowedOrigins(dineway?.config)));
+		const challengeStore = createChallengeStore(dineway.db);
+		const verified = await verifyRegistrationResponse(passkeyConfig, body.credential, challengeStore);
+		const user = await adapter.createUser({
+			email: setupState.email,
+			name: setupState.name ?? null,
+			role: Role.ADMIN,
+			emailVerified: false
+		});
+		await registerPasskey(adapter, user.id, verified, "Setup passkey");
+		await finalizeSetup(dineway.db);
+		cookies.delete(SETUP_NONCE_COOKIE, { path: "/_dineway/" });
+		return apiSuccess({
+			success: true,
+			user: {
+				id: user.id,
+				email: user.email,
+				name: user.name,
+				role: user.role
+			}
+		});
+	} catch (error) {
+		return handleError(error, "Failed to verify admin setup", "SETUP_VERIFY_ERROR");
+	}
+};
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/setup/admin.d.mts ADDED Viewed

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+//#region src/astro/routes/api/setup/admin.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/setup/admin.mjs ADDED Viewed

@@ -0,0 +1,68 @@
+import { t as OptionsRepository } from "../../../../options-z8VVg1Ll.mjs";
+import "../../../../context-types-C-LwdAxx.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-BMUPwxgx.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-C9106ehs.mjs";
+import "../../../../redirects-lrlmYXVE.mjs";
+import "../../../../import-CNcKWTbp.mjs";
+import { setupAdminBody } from "../../../../api/schemas/setup.mjs";
+import "../../../../api/schemas/index.mjs";
+import { n as getPublicOrigin } from "../../../../public-url-Cun8N3NU.mjs";
+import { n as createChallengeStore } from "../../../../challenge-store-DDTbisbf.mjs";
+import { t as getPasskeyConfig } from "../../../../passkey-config-BRSZx4pW.mjs";
+import { n as SETUP_NONCE_MAX_AGE_SECONDS, t as SETUP_NONCE_COOKIE } from "../../../../setup-nonce-BpmLXAuu.mjs";
+import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
+import { generateToken } from "@dineway-ai/auth";
+import { generateRegistrationOptions } from "@dineway-ai/auth/passkey";
+//#region src/astro/routes/api/setup/admin.ts
+const prerender = false;
+const POST = async ({ cookies, request, locals }) => {
+	const { dineway } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	try {
+		const options = new OptionsRepository(dineway.db);
+		const setupComplete = await options.get("dineway:setup_complete");
+		if (setupComplete === true || setupComplete === "true") return apiError("SETUP_COMPLETE", "Setup already complete", 400);
+		if (await createKyselyAdapter(dineway.db).countUsers() > 0) return apiError("ADMIN_EXISTS", "Admin user already exists", 400);
+		const body = await parseBody(request, setupAdminBody);
+		if (isParseError(body)) return body;
+		const existingState = await options.get("dineway:setup_state");
+		const nonce = generateToken();
+		const url = new URL(request.url);
+		const siteName = await options.get("dineway:site_title") ?? void 0;
+		const siteUrl = getPublicOrigin(url, dineway?.config);
+		const passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);
+		const challengeStore = createChallengeStore(dineway.db);
+		const tempUser = {
+			id: `setup-${Date.now()}`,
+			email: body.email.toLowerCase(),
+			name: body.name || null
+		};
+		const registrationOptions = await generateRegistrationOptions(passkeyConfig, tempUser, [], challengeStore);
+		await options.set("dineway:setup_state", {
+			...existingState,
+			step: "admin",
+			email: body.email.toLowerCase(),
+			name: body.name || null,
+			tempUserId: tempUser.id,
+			nonce
+		});
+		const publicOrigin = new URL(siteUrl);
+		cookies.set(SETUP_NONCE_COOKIE, nonce, {
+			path: "/_dineway/",
+			httpOnly: true,
+			sameSite: "strict",
+			secure: publicOrigin.protocol === "https:",
+			maxAge: SETUP_NONCE_MAX_AGE_SECONDS
+		});
+		return apiSuccess({
+			success: true,
+			options: registrationOptions
+		});
+	} catch (error) {
+		return handleError(error, "Failed to create admin", "SETUP_ADMIN_ERROR");
+	}
+};
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/setup/dev-bypass.d.mts ADDED Viewed

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+//#region src/astro/routes/api/setup/dev-bypass.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+declare const POST: APIRoute;
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/setup/dev-bypass.mjs ADDED Viewed

@@ -0,0 +1,137 @@
+import "../../../../dialect-helpers-DhTzaUxP.mjs";
+import { r as runMigrations } from "../../../../runner-DWZm2KQm.mjs";
+import "../../../../content-CyLkb-qH.mjs";
+import "../../../../base64-Cz-aU0X1.mjs";
+import "../../../../types-Bs6lTBBW.mjs";
+import "../../../../media-_7Fxdu45.mjs";
+import "../../../../taxonomy-D5cbhc8u.mjs";
+import { t as OptionsRepository } from "../../../../options-z8VVg1Ll.mjs";
+import "../../../../redirect-CGl64yOX.mjs";
+import "../../../../byline-naZxOPSa.mjs";
+import "../../../../fts-manager-B1pTNEG_.mjs";
+import "../../../../registry-C-_hxLqa.mjs";
+import "../../../../loader-PZnPxFLc.mjs";
+import "../../../../settings-DGtLLSaz.mjs";
+import "../../../../request-cache-DHMRr2Lf.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-BMUPwxgx.mjs";
+import "../../../../ssrf-DDwRxF6B.mjs";
+import { t as validateSeed } from "../../../../validate-C7TzfamJ.mjs";
+import { t as applySeed } from "../../../../apply-Bm5QgdrE.mjs";
+import { t as loadSeed } from "../../../../load-B2XtDw__.mjs";
+import { n as getPublicOrigin } from "../../../../public-url-Cun8N3NU.mjs";
+import "../../../../api-tokens-CPjC3zf8.mjs";
+import { t as handleApiTokenCreate } from "../../../../api-tokens-D7UjLbdt.mjs";
+import { t as escapeHtml } from "../../../../escape-BRVaw1Ai.mjs";
+import { t as isSafeRedirect } from "../../../../redirect-COZy-3iY.mjs";
+import { ulid } from "ulidx";
+//#region src/astro/routes/api/setup/dev-bypass.ts
+const prerender = false;
+const ROLE_ADMIN = 50;
+const DEV_USER_EMAIL = "dev@dineway.local";
+const DEV_USER_NAME = "Dev Admin";
+const DEV_SITE_TITLE = "Dineway Dev Site";
+async function handleDevBypass(context) {
+	if (!import.meta.env.DEV) return apiError("FORBIDDEN", "Dev bypass is only available in development mode", 403);
+	const { locals, url, session } = context;
+	const { dineway } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	try {
+		const migrations = await runMigrations(dineway.db);
+		console.log("[setup-dev-bypass] Migrations applied:", migrations.applied);
+		const seed = await loadSeed();
+		if (validateSeed(seed).valid) {
+			const seedResult = await applySeed(dineway.db, seed, {
+				includeContent: true,
+				onConflict: "skip",
+				storage: dineway.storage ?? void 0
+			});
+			console.log(`[setup-dev-bypass] Seed applied: ${seedResult.collections.created} collections, ${seedResult.fields.created} fields`);
+		}
+		const options = new OptionsRepository(dineway.db);
+		const existingUser = await dineway.db.selectFrom("users").selectAll().where("email", "=", DEV_USER_EMAIL).executeTakeFirst();
+		let user;
+		let userCreated = false;
+		if (!existingUser) {
+			const now = (/* @__PURE__ */ new Date()).toISOString();
+			const newUser = {
+				id: ulid(),
+				email: DEV_USER_EMAIL,
+				name: DEV_USER_NAME,
+				role: ROLE_ADMIN,
+				email_verified: 1,
+				created_at: now,
+				updated_at: now
+			};
+			await dineway.db.insertInto("users").values(newUser).execute();
+			user = {
+				id: newUser.id,
+				email: newUser.email,
+				name: newUser.name,
+				role: newUser.role
+			};
+			userCreated = true;
+			console.log("[setup-dev-bypass] Created dev admin user:", user.email);
+		} else user = {
+			id: existingUser.id,
+			email: existingUser.email,
+			name: existingUser.name || DEV_USER_NAME,
+			role: existingUser.role
+		};
+		if (!await options.get("dineway:site_title")) await options.set("dineway:site_title", DEV_SITE_TITLE);
+		await options.set("dineway:site_url", getPublicOrigin(url, dineway?.config));
+		await options.set("dineway:setup_complete", true);
+		if (session) session.set("user", { id: user.id });
+		let token;
+		if (url.searchParams.has("token")) {
+			const result = await handleApiTokenCreate(dineway.db, user.id, {
+				name: "dev-bypass-token",
+				scopes: [
+					"content:read",
+					"content:write",
+					"media:read",
+					"media:write",
+					"schema:read",
+					"schema:write",
+					"admin"
+				]
+			});
+			if (result.success) token = result.data.token;
+		}
+		const redirect = url.searchParams.get("redirect");
+		if (redirect) {
+			if (!isSafeRedirect(redirect)) return apiError("INVALID_REDIRECT", "Redirect must be a local path", 400);
+			const html = `<!DOCTYPE html>
+<html>
+<head>
+	<meta http-equiv="refresh" content="0;url=${escapeHtml(redirect)}">
+</head>
+<body>Redirecting...</body>
+</html>`;
+			return new Response(html, {
+				status: 200,
+				headers: { "Content-Type": "text/html" }
+			});
+		}
+		return apiSuccess({
+			success: true,
+			message: "Dev setup complete",
+			migrations: migrations.applied,
+			userCreated,
+			user: {
+				id: user.id,
+				email: user.email,
+				name: user.name,
+				role: user.role
+			},
+			...token ? { token } : {}
+		});
+	} catch (error) {
+		return handleError(error, "Dev bypass failed", "DEV_BYPASS_ERROR");
+	}
+}
+const GET = handleDevBypass;
+const POST = handleDevBypass;
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/setup/dev-reset.d.mts ADDED Viewed

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+//#region src/astro/routes/api/setup/dev-reset.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/setup/dev-reset.mjs ADDED Viewed

@@ -0,0 +1,22 @@
+import { t as OptionsRepository } from "../../../../options-z8VVg1Ll.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-BMUPwxgx.mjs";
+//#region src/astro/routes/api/setup/dev-reset.ts
+const prerender = false;
+const POST = async ({ locals }) => {
+	if (!import.meta.env.DEV) return apiError("FORBIDDEN", "Dev reset is only available in development mode", 403);
+	const { dineway } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	try {
+		const options = new OptionsRepository(dineway.db);
+		await options.delete("dineway:setup_complete");
+		await options.delete("dineway:setup_state");
+		await dineway.db.deleteFrom("users").execute();
+		return apiSuccess({ success: true });
+	} catch (error) {
+		return handleError(error, "Dev reset failed", "DEV_RESET_ERROR");
+	}
+};
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/setup/index.d.mts ADDED Viewed

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+//#region src/astro/routes/api/setup/index.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/setup/index.mjs ADDED Viewed

@@ -0,0 +1,93 @@
+import "../../../../dialect-helpers-DhTzaUxP.mjs";
+import { r as runMigrations } from "../../../../runner-DWZm2KQm.mjs";
+import "../../../../content-CyLkb-qH.mjs";
+import "../../../../base64-Cz-aU0X1.mjs";
+import "../../../../types-Bs6lTBBW.mjs";
+import "../../../../media-_7Fxdu45.mjs";
+import "../../../../taxonomy-D5cbhc8u.mjs";
+import { t as OptionsRepository } from "../../../../options-z8VVg1Ll.mjs";
+import "../../../../redirect-CGl64yOX.mjs";
+import "../../../../byline-naZxOPSa.mjs";
+import "../../../../context-types-C-LwdAxx.mjs";
+import "../../../../fts-manager-B1pTNEG_.mjs";
+import "../../../../registry-C-_hxLqa.mjs";
+import "../../../../loader-PZnPxFLc.mjs";
+import "../../../../settings-DGtLLSaz.mjs";
+import "../../../../request-cache-DHMRr2Lf.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-BMUPwxgx.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-C9106ehs.mjs";
+import "../../../../redirects-lrlmYXVE.mjs";
+import "../../../../import-CNcKWTbp.mjs";
+import { setupBody } from "../../../../api/schemas/setup.mjs";
+import "../../../../api/schemas/index.mjs";
+import "../../../../ssrf-DDwRxF6B.mjs";
+import { t as validateSeed } from "../../../../validate-C7TzfamJ.mjs";
+import { t as applySeed } from "../../../../apply-Bm5QgdrE.mjs";
+import { t as loadSeed } from "../../../../load-B2XtDw__.mjs";
+import { n as getPublicOrigin } from "../../../../public-url-Cun8N3NU.mjs";
+import { t as getAuthMode } from "../../../../mode-DUhxwUhv.mjs";
+//#region src/astro/routes/api/setup/index.ts
+const prerender = false;
+const POST = async ({ request, url, locals }) => {
+	const { dineway } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	try {
+		try {
+			const setupComplete = await new OptionsRepository(dineway.db).get("dineway:setup_complete");
+			if (setupComplete === true || setupComplete === "true") return apiError("ALREADY_CONFIGURED", "Setup has already been completed", 409);
+		} catch {}
+		const body = await parseBody(request, setupBody);
+		if (isParseError(body)) return body;
+		try {
+			await runMigrations(dineway.db);
+		} catch (error) {
+			return handleError(error, "Failed to run database migrations", "MIGRATION_ERROR");
+		}
+		const seed = await loadSeed();
+		seed.settings = {
+			...seed.settings,
+			title: body.title,
+			tagline: body.tagline
+		};
+		const validation = validateSeed(seed);
+		if (!validation.valid) return apiError("INVALID_SEED", `Invalid seed file: ${validation.errors.join(", ")}`, 400);
+		let result;
+		try {
+			result = await applySeed(dineway.db, seed, {
+				includeContent: body.includeContent,
+				onConflict: "skip",
+				storage: dineway.storage ?? void 0
+			});
+		} catch (error) {
+			return handleError(error, "Failed to apply seed", "SEED_ERROR");
+		}
+		const useExternalAuth = getAuthMode(dineway.config).type === "external";
+		try {
+			const options = new OptionsRepository(dineway.db);
+			const siteUrl = getPublicOrigin(url, dineway.config);
+			await options.setIfAbsent("dineway:site_url", siteUrl);
+			if (useExternalAuth) {
+				await options.set("dineway:setup_complete", true);
+				await options.set("dineway:site_title", body.title);
+				if (body.tagline) await options.set("dineway:site_tagline", body.tagline);
+			} else await options.set("dineway:setup_state", {
+				step: "site_complete",
+				title: body.title,
+				tagline: body.tagline
+			});
+		} catch (error) {
+			console.error("Failed to save setup state:", error);
+		}
+		return apiSuccess({
+			success: true,
+			setupComplete: useExternalAuth,
+			result
+		});
+	} catch (error) {
+		return handleError(error, "Setup failed", "SETUP_ERROR");
+	}
+};
+//#endregion
+export { POST, prerender };