dineway 0.1.9 → 0.1.12

package/dist/astro/routes/api/taxonomies/index.mjs

@@ -0,0 +1,104 @@
+import "../../../../dialect-helpers-DhTzaUxP.mjs";
+import "../../../../content-CyLkb-qH.mjs";
+import "../../../../base64-Cz-aU0X1.mjs";
+import "../../../../types-Bs6lTBBW.mjs";
+import "../../../../media-_7Fxdu45.mjs";
+import "../../../../taxonomy-D5cbhc8u.mjs";
+import "../../../../options-z8VVg1Ll.mjs";
+import "../../../../site-activity-B8FjLIVh.mjs";
+import "../../../../review-requests-C2DIHwlJ.mjs";
+import "../../../../entity-aliases-C0v-yNET.mjs";
+import "../../../../briefing-MVYe_Uyf.mjs";
+import "../../../../context-types-C-LwdAxx.mjs";
+import "../../../../fts-manager-B1pTNEG_.mjs";
+import "../../../../registry-C-_hxLqa.mjs";
+import "../../../../loader-PZnPxFLc.mjs";
+import "../../../../settings-DGtLLSaz.mjs";
+import "../../../../request-cache-DHMRr2Lf.mjs";
+import "../../../../query-CsbOywSY.mjs";
+import "../../../../zod-generator-DBVP8D0P.mjs";
+import "../../../../schema-BECjUhP8.mjs";
+import "../../../../taxonomies-D2aZGuns.mjs";
+import { n as handleTaxonomyList, t as handleTaxonomyCreate } from "../../../../taxonomies-z6Lz91BC.mjs";
+import { a as unwrapResult, i as requireDb, r as handleError } from "../../../../error-BMUPwxgx.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-C9106ehs.mjs";
+import { V as createTaxonomyDefBody } from "../../../../redirects-lrlmYXVE.mjs";
+import "../../../../import-CNcKWTbp.mjs";
+import "../../../../api/schemas/index.mjs";
+import "../../../../utils-C0ONdBul.mjs";
+import "../../../../search-DqTHQqtV.mjs";
+import { n as requirePerm } from "../../../../authorize-BAdbMCwC.mjs";
+import { _ as RiskPolicyEvaluator, l as TaxonomyHitlPayloadBuilder } from "../../../../site-context-WBxoD99D.mjs";
+import { C as taxonomyApiRouteSource, m as logTaxonomyActivity } from "../../../../activity-events-B4wp7CrU.mjs";
+import { i as resolveHitlRouteActor, n as hitlRequiredRouteError, t as ensureWorkflowHitlRouteRequest } from "../../../../hitl-route-helpers-CSit54Ru.mjs";
+import { z } from "zod";
+
+//#region src/astro/routes/api/taxonomies/index.ts
+const prerender = false;
+const createTaxonomyHitlBody = createTaxonomyDefBody.extend({ hitlRequestId: z.string().min(1).optional() });
+/**
+* List taxonomy definitions
+*/
+const GET = async ({ locals }) => {
+	const { dineway, user } = locals;
+	const dbErr = requireDb(dineway?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(user, "taxonomies:read");
+	if (denied) return denied;
+	try {
+		return unwrapResult(await handleTaxonomyList(dineway.db));
+	} catch (error) {
+		return handleError(error, "Failed to list taxonomies", "TAXONOMY_LIST_ERROR");
+	}
+};
+/**
+* Create a custom taxonomy definition
+*/
+const POST = async ({ request, locals }) => {
+	const { dineway, user } = locals;
+	const dbErr = requireDb(dineway?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(user, "taxonomies:manage");
+	if (denied) return denied;
+	try {
+		const body = await parseBody(request, createTaxonomyHitlBody);
+		if (isParseError(body)) return body;
+		const { hitlRequestId, ...taxonomyInput } = body;
+		const actor = resolveHitlRouteActor(locals);
+		const evaluator = new RiskPolicyEvaluator({
+			db: dineway.db,
+			handlers: dineway
+		});
+		let approvedHitlRequestId = null;
+		if (evaluator.requiresWorkflowHitl(actor.identity)) {
+			const action = await new TaxonomyHitlPayloadBuilder(dineway.db).buildCreateTaxonomyRequest(taxonomyInput);
+			const decision = await evaluator.evaluateWorkflowHitl({
+				actor: actor.identity,
+				hitlRequestId,
+				action
+			});
+			if (!decision.allowed) return hitlRequiredRouteError(decision, await ensureWorkflowHitlRouteRequest(dineway.db, locals, decision.action));
+			approvedHitlRequestId = decision.hitlRequest.id;
+		}
+		const result = await handleTaxonomyCreate(dineway.db, taxonomyInput);
+		if (result.success) dineway.invalidateManifest();
+		if (result.success) await logTaxonomyActivity(dineway.db, locals, {
+			action: "created",
+			taxonomyId: result.data.taxonomy.id,
+			taxonomyName: result.data.taxonomy.name,
+			...taxonomyApiRouteSource("created"),
+			detail: {
+				label: result.data.taxonomy.label,
+				hierarchical: result.data.taxonomy.hierarchical,
+				collections: result.data.taxonomy.collections,
+				hitlRequestId: approvedHitlRequestId
+			}
+		});
+		return unwrapResult(result, 201);
+	} catch (error) {
+		return handleError(error, "Failed to create taxonomy", "TAXONOMY_CREATE_ERROR");
+	}
+};
+
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/themes/preview.d.mts

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/themes/preview.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/themes/preview.mjs

@@ -0,0 +1,47 @@
+import "../../../../base64-Cz-aU0X1.mjs";
+import "../../../../options-z8VVg1Ll.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../error-BMUPwxgx.mjs";
+import { n as getPublicOrigin } from "../../../../public-url-Cun8N3NU.mjs";
+import { i as resolveSecretsCached } from "../../../../secrets-CkoJ9zN0.mjs";
+import { n as requirePerm } from "../../../../authorize-BAdbMCwC.mjs";
+
+//#region src/astro/routes/api/themes/preview.ts
+const prerender = false;
+const POST = async ({ request, url, locals }) => {
+	const { dineway, user } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	const denied = requirePerm(user, "plugins:read");
+	if (denied) return denied;
+	const { previewSecret: secret } = await resolveSecretsCached(dineway.db);
+	let body;
+	try {
+		body = await request.json();
+	} catch {
+		return apiError("INVALID_REQUEST", "Invalid JSON body", 400);
+	}
+	if (!body.previewUrl || typeof body.previewUrl !== "string") return apiError("INVALID_REQUEST", "previewUrl is required", 400);
+	let parsedPreviewUrl;
+	try {
+		parsedPreviewUrl = new URL(body.previewUrl);
+	} catch {
+		return apiError("INVALID_REQUEST", "previewUrl must be a valid URL", 400);
+	}
+	if (parsedPreviewUrl.protocol !== "https:") return apiError("INVALID_REQUEST", "previewUrl must use HTTPS", 400);
+	const source = getPublicOrigin(url, dineway?.config);
+	const exp = Math.floor(Date.now() / 1e3) + 3600;
+	const encoder = new TextEncoder();
+	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const buffer = await crypto.subtle.sign("HMAC", key, encoder.encode(`${source}:${exp}`));
+	const sig = Array.from(new Uint8Array(buffer), (b) => b.toString(16).padStart(2, "0")).join("");
+	const previewUrl = new URL(body.previewUrl);
+	previewUrl.searchParams.set("source", source);
+	previewUrl.searchParams.set("exp", String(exp));
+	previewUrl.searchParams.set("sig", sig);
+	return apiSuccess({ url: previewUrl.toString() });
+};
+
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/typegen.d.mts

@@ -0,0 +1,17 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/typegen.d.ts
+declare const prerender = false;
+/**
+ * GET - Return types as plain text (for preview/debugging)
+ */
+declare const GET: APIRoute;
+/**
+ * POST - Generate types and return as JSON
+ *
+ * The caller writes the file to disk. Response shape:
+ * { types: string, hash: string, collections: number }
+ */
+declare const POST: APIRoute;
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/typegen.mjs

@@ -0,0 +1,75 @@
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../error-BMUPwxgx.mjs";
+
+//#region src/astro/routes/api/typegen.ts
+const prerender = false;
+/**
+* Safely list collections, returning empty array if tables don't exist yet
+*/
+async function safeListCollections(registry) {
+	try {
+		return await registry.listCollections();
+	} catch (error) {
+		if (error instanceof Error && error.message.includes("no such table")) return [];
+		throw error;
+	}
+}
+/**
+* Generate types content and metadata from the current schema.
+*/
+async function generateTypes(registry) {
+	const { generateTypesFile, generateSchemaHash } = await import("../../../zod-generator-DBVP8D0P.mjs").then((n) => n.n);
+	const collections = await safeListCollections(registry);
+	const collectionsWithFields = await Promise.all(collections.map(async (c) => {
+		const fields = await registry.listFields(c.id);
+		return {
+			...c,
+			fields
+		};
+	}));
+	return {
+		types: generateTypesFile(collectionsWithFields),
+		hash: await generateSchemaHash(collectionsWithFields),
+		collections: collections.length
+	};
+}
+/**
+* GET - Return types as plain text (for preview/debugging)
+*/
+const GET = async ({ locals }) => {
+	if (!import.meta.env.DEV) return apiError("FORBIDDEN", "Typegen is only available in development", 403);
+	const { dineway } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not configured", 500);
+	try {
+		const { SchemaRegistry } = await import("../../../registry-C-_hxLqa.mjs").then((n) => n.r);
+		const { types } = await generateTypes(new SchemaRegistry(dineway.db));
+		return new Response(types, {
+			status: 200,
+			headers: {
+				"Content-Type": "text/typescript",
+				"Cache-Control": "private, no-store"
+			}
+		});
+	} catch (error) {
+		return handleError(error, "Typegen failed", "TYPEGEN_ERROR");
+	}
+};
+/**
+* POST - Generate types and return as JSON
+*
+* The caller writes the file to disk. Response shape:
+* { types: string, hash: string, collections: number }
+*/
+const POST = async ({ locals }) => {
+	if (!import.meta.env.DEV) return apiError("FORBIDDEN", "Typegen is only available in development", 403);
+	const { dineway } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not configured", 500);
+	try {
+		const { SchemaRegistry } = await import("../../../registry-C-_hxLqa.mjs").then((n) => n.r);
+		return apiSuccess(await generateTypes(new SchemaRegistry(dineway.db)));
+	} catch (error) {
+		return handleError(error, "Typegen failed", "TYPEGEN_ERROR");
+	}
+};
+
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/well-known/auth.d.mts

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/well-known/auth.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };

package/dist/astro/routes/api/well-known/auth.mjs

@@ -0,0 +1,42 @@
+import { t as OptionsRepository } from "../../../../options-z8VVg1Ll.mjs";
+import { n as VERSION } from "../../../../version-D3vDb22n.mjs";
+import { t as getAuthMode } from "../../../../mode-DUhxwUhv.mjs";
+
+//#region src/astro/routes/api/well-known/auth.ts
+const prerender = false;
+const GET = async ({ locals }) => {
+	const { dineway } = locals;
+	const config = dineway?.config;
+	const authMode = config ? getAuthMode(config) : null;
+	const isExternal = authMode?.type === "external";
+	let siteName = "Dineway";
+	if (dineway?.db) try {
+		siteName = await new OptionsRepository(dineway.db).get("dineway:site_title") || "Dineway";
+	} catch {}
+	const response = {
+		instance: {
+			name: siteName,
+			version: VERSION
+		},
+		auth: {
+			mode: isExternal ? "external" : "passkey",
+			...isExternal && authMode.type === "external" ? { external_provider: authMode.entrypoint } : {},
+			methods: {
+				device_flow: !isExternal ? {
+					client_id: "dineway-cli",
+					device_authorization_endpoint: "/_dineway/api/oauth/device/code",
+					token_endpoint: "/_dineway/api/oauth/device/token"
+				} : void 0,
+				authorization_code: !isExternal ? {
+					authorization_endpoint: "/_dineway/oauth/authorize",
+					token_endpoint: "/_dineway/api/oauth/token"
+				} : void 0,
+				api_tokens: true
+			}
+		}
+	};
+	return Response.json(response, { headers: { "Cache-Control": "no-store" } });
+};
+
+//#endregion
+export { GET, prerender };

package/dist/astro/routes/api/well-known/oauth-authorization-server.d.mts

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/well-known/oauth-authorization-server.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };

package/dist/astro/routes/api/well-known/oauth-authorization-server.mjs

@@ -0,0 +1,33 @@
+import { n as getPublicOrigin } from "../../../../public-url-Cun8N3NU.mjs";
+import { a as filterExperimentalSiteContextWorkflowScopes } from "../../../../experimental-workflows-C9X7yblQ.mjs";
+import { t as ALL_VALID_SCOPES } from "../../../../api-tokens-CPjC3zf8.mjs";
+
+//#region src/astro/routes/api/well-known/oauth-authorization-server.ts
+const prerender = false;
+const GET = async ({ url, locals }) => {
+	const origin = getPublicOrigin(url, locals.dineway?.config);
+	const issuer = `${origin}/_dineway`;
+	return Response.json({
+		issuer,
+		authorization_endpoint: `${origin}/_dineway/oauth/authorize`,
+		token_endpoint: `${origin}/_dineway/api/oauth/token`,
+		scopes_supported: filterExperimentalSiteContextWorkflowScopes(ALL_VALID_SCOPES),
+		response_types_supported: ["code"],
+		grant_types_supported: [
+			"authorization_code",
+			"refresh_token",
+			"urn:ietf:params:oauth:grant-type:device_code"
+		],
+		code_challenge_methods_supported: ["S256"],
+		registration_endpoint: `${origin}/_dineway/api/oauth/register`,
+		token_endpoint_auth_methods_supported: ["none"],
+		client_id_metadata_document_supported: true,
+		device_authorization_endpoint: `${origin}/_dineway/api/oauth/device/code`
+	}, { headers: {
+		"Cache-Control": "public, max-age=3600",
+		"Access-Control-Allow-Origin": "*"
+	} });
+};
+
+//#endregion
+export { GET, prerender };

package/dist/astro/routes/api/well-known/oauth-protected-resource.d.mts

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/well-known/oauth-protected-resource.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };

package/dist/astro/routes/api/well-known/oauth-protected-resource.mjs

@@ -0,0 +1,21 @@
+import { n as getPublicOrigin } from "../../../../public-url-Cun8N3NU.mjs";
+import { a as filterExperimentalSiteContextWorkflowScopes } from "../../../../experimental-workflows-C9X7yblQ.mjs";
+import { t as ALL_VALID_SCOPES } from "../../../../api-tokens-CPjC3zf8.mjs";
+
+//#region src/astro/routes/api/well-known/oauth-protected-resource.ts
+const prerender = false;
+const GET = async ({ url, locals }) => {
+	const origin = getPublicOrigin(url, locals.dineway?.config);
+	return Response.json({
+		resource: `${origin}/_dineway/api/mcp`,
+		authorization_servers: [`${origin}/_dineway`],
+		scopes_supported: filterExperimentalSiteContextWorkflowScopes(ALL_VALID_SCOPES),
+		bearer_methods_supported: ["header"]
+	}, { headers: {
+		"Cache-Control": "public, max-age=3600",
+		"Access-Control-Allow-Origin": "*"
+	} });
+};
+
+//#endregion
+export { GET, prerender };

package/dist/astro/routes/api/widget-areas/_name_/reorder.d.mts

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/widget-areas/[name]/reorder.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/widget-areas/_name_/reorder.mjs

@@ -0,0 +1,89 @@
+import "../../../../../dialect-helpers-DhTzaUxP.mjs";
+import "../../../../../content-CyLkb-qH.mjs";
+import "../../../../../base64-Cz-aU0X1.mjs";
+import "../../../../../types-Bs6lTBBW.mjs";
+import "../../../../../media-_7Fxdu45.mjs";
+import "../../../../../options-z8VVg1Ll.mjs";
+import "../../../../../site-activity-B8FjLIVh.mjs";
+import "../../../../../review-requests-C2DIHwlJ.mjs";
+import "../../../../../entity-aliases-C0v-yNET.mjs";
+import "../../../../../briefing-MVYe_Uyf.mjs";
+import "../../../../../context-types-C-LwdAxx.mjs";
+import "../../../../../fts-manager-B1pTNEG_.mjs";
+import "../../../../../registry-C-_hxLqa.mjs";
+import "../../../../../loader-PZnPxFLc.mjs";
+import "../../../../../settings-DGtLLSaz.mjs";
+import "../../../../../request-cache-DHMRr2Lf.mjs";
+import "../../../../../query-CsbOywSY.mjs";
+import "../../../../../zod-generator-DBVP8D0P.mjs";
+import "../../../../../schema-BECjUhP8.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-BMUPwxgx.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-C9106ehs.mjs";
+import { h as reorderWidgetsBody } from "../../../../../redirects-lrlmYXVE.mjs";
+import "../../../../../import-CNcKWTbp.mjs";
+import "../../../../../api/schemas/index.mjs";
+import "../../../../../utils-C0ONdBul.mjs";
+import "../../../../../search-DqTHQqtV.mjs";
+import { n as requirePerm } from "../../../../../authorize-BAdbMCwC.mjs";
+import { _ as RiskPolicyEvaluator, s as WidgetHitlPayloadBuilder } from "../../../../../site-context-WBxoD99D.mjs";
+import { h as logWidgetActivity, w as widgetApiRouteSource } from "../../../../../activity-events-B4wp7CrU.mjs";
+import { i as resolveHitlRouteActor, n as hitlRequiredRouteError, t as ensureWorkflowHitlRouteRequest } from "../../../../../hitl-route-helpers-CSit54Ru.mjs";
+import { z } from "zod";
+
+//#region src/astro/routes/api/widget-areas/[name]/reorder.ts
+const prerender = false;
+const reorderWidgetsHitlBody = reorderWidgetsBody.extend({ hitlRequestId: z.string().min(1).optional() });
+const POST = async ({ params, request, locals }) => {
+	const { dineway, user } = locals;
+	const db = dineway.db;
+	const { name } = params;
+	const denied = requirePerm(user, "widgets:manage");
+	if (denied) return denied;
+	if (!name) return apiError("VALIDATION_ERROR", "name is required", 400);
+	try {
+		const payloadBuilder = new WidgetHitlPayloadBuilder(db);
+		const area = await payloadBuilder.loadWidgetAreaSnapshot(name);
+		if (!area) return apiError("NOT_FOUND", `Widget area "${name}" not found`, 404);
+		const body = await parseBody(request, reorderWidgetsHitlBody);
+		if (isParseError(body)) return body;
+		const { hitlRequestId, widgetIds } = body;
+		const existingIds = new Set(area.widgets.map((widget) => widget.id));
+		for (const id of widgetIds) if (!existingIds.has(id)) return apiError("VALIDATION_ERROR", `Widget "${id}" not found in area "${name}"`, 400);
+		const actor = resolveHitlRouteActor(locals);
+		const evaluator = new RiskPolicyEvaluator({
+			db,
+			handlers: dineway
+		});
+		let approvedHitlRequestId = null;
+		if (evaluator.requiresWorkflowHitl(actor.identity)) {
+			const action = await payloadBuilder.buildReorderWidgetsRequest({
+				area,
+				widgetIds
+			});
+			const decision = await evaluator.evaluateWorkflowHitl({
+				actor: actor.identity,
+				hitlRequestId,
+				action
+			});
+			if (!decision.allowed) return hitlRequiredRouteError(decision, await ensureWorkflowHitlRouteRequest(db, locals, decision.action));
+			approvedHitlRequestId = decision.hitlRequest.id;
+		}
+		await Promise.all(widgetIds.map((id, index) => db.updateTable("_dineway_widgets").set({ sort_order: index }).where("id", "=", id).execute()));
+		await logWidgetActivity(db, locals, {
+			action: "reordered",
+			areaId: area.id,
+			areaName: area.name,
+			...widgetApiRouteSource("reordered"),
+			detail: {
+				widgetIds,
+				hitlRequestId: approvedHitlRequestId
+			}
+		});
+		return apiSuccess({ success: true });
+	} catch (error) {
+		return handleError(error, "Failed to reorder widgets", "WIDGET_REORDER_ERROR");
+	}
+};
+
+//#endregion
+export { POST, prerender };

package/dist/astro/routes/api/widget-areas/_name_/widgets/_id_.d.mts

@@ -0,0 +1,8 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/widget-areas/[name]/widgets/[id].d.ts
+declare const prerender = false;
+declare const PUT: APIRoute;
+declare const DELETE: APIRoute;
+//#endregion
+export { DELETE, PUT, prerender };

package/dist/astro/routes/api/widget-areas/_name_/widgets/_id_.mjs

@@ -0,0 +1,159 @@
+import "../../../../../../dialect-helpers-DhTzaUxP.mjs";
+import "../../../../../../content-CyLkb-qH.mjs";
+import "../../../../../../base64-Cz-aU0X1.mjs";
+import "../../../../../../types-Bs6lTBBW.mjs";
+import "../../../../../../media-_7Fxdu45.mjs";
+import "../../../../../../options-z8VVg1Ll.mjs";
+import "../../../../../../site-activity-B8FjLIVh.mjs";
+import "../../../../../../review-requests-C2DIHwlJ.mjs";
+import "../../../../../../entity-aliases-C0v-yNET.mjs";
+import "../../../../../../briefing-MVYe_Uyf.mjs";
+import "../../../../../../context-types-C-LwdAxx.mjs";
+import "../../../../../../fts-manager-B1pTNEG_.mjs";
+import "../../../../../../registry-C-_hxLqa.mjs";
+import "../../../../../../loader-PZnPxFLc.mjs";
+import "../../../../../../settings-DGtLLSaz.mjs";
+import "../../../../../../request-cache-DHMRr2Lf.mjs";
+import "../../../../../../query-CsbOywSY.mjs";
+import "../../../../../../zod-generator-DBVP8D0P.mjs";
+import "../../../../../../schema-BECjUhP8.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-BMUPwxgx.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../../parse-C9106ehs.mjs";
+import { g as updateWidgetBody } from "../../../../../../redirects-lrlmYXVE.mjs";
+import "../../../../../../import-CNcKWTbp.mjs";
+import "../../../../../../api/schemas/index.mjs";
+import "../../../../../../utils-C0ONdBul.mjs";
+import { i as rowToWidget } from "../../../../../../widgets-B7DRpZvy.mjs";
+import "../../../../../../search-DqTHQqtV.mjs";
+import { n as requirePerm } from "../../../../../../authorize-BAdbMCwC.mjs";
+import { _ as RiskPolicyEvaluator, s as WidgetHitlPayloadBuilder } from "../../../../../../site-context-WBxoD99D.mjs";
+import { h as logWidgetActivity, t as activityChangedKeys, w as widgetApiRouteSource } from "../../../../../../activity-events-B4wp7CrU.mjs";
+import { i as resolveHitlRouteActor, n as hitlRequiredRouteError, t as ensureWorkflowHitlRouteRequest } from "../../../../../../hitl-route-helpers-CSit54Ru.mjs";
+import { z } from "zod";
+
+//#region src/astro/routes/api/widget-areas/[name]/widgets/[id].ts
+const prerender = false;
+const updateWidgetHitlBody = updateWidgetBody.extend({ hitlRequestId: z.string().min(1).optional() });
+const deleteWidgetQuery = z.object({ hitlRequestId: z.string().min(1).optional() });
+const PUT = async ({ params, request, locals }) => {
+	const { dineway, user } = locals;
+	const db = dineway.db;
+	const { name, id } = params;
+	const denied = requirePerm(user, "widgets:manage");
+	if (denied) return denied;
+	if (!name || !id) return apiError("VALIDATION_ERROR", "name and id are required", 400);
+	try {
+		const payloadBuilder = new WidgetHitlPayloadBuilder(db);
+		const area = await payloadBuilder.loadWidgetAreaSnapshot(name);
+		if (!area) return apiError("NOT_FOUND", `Widget area "${name}" not found`, 404);
+		const existingWidget = area.widgets.find((widget) => widget.id === id);
+		if (!existingWidget) return apiError("NOT_FOUND", `Widget "${id}" not found in area "${name}"`, 404);
+		const body = await parseBody(request, updateWidgetHitlBody);
+		if (isParseError(body)) return body;
+		const { hitlRequestId, ...widgetInput } = body;
+		const actor = resolveHitlRouteActor(locals);
+		const evaluator = new RiskPolicyEvaluator({
+			db,
+			handlers: dineway
+		});
+		let approvedHitlRequestId = null;
+		if (evaluator.requiresWorkflowHitl(actor.identity)) {
+			const action = await payloadBuilder.buildUpdateWidgetRequest({
+				area,
+				currentWidget: existingWidget,
+				...widgetInput
+			});
+			const decision = await evaluator.evaluateWorkflowHitl({
+				actor: actor.identity,
+				hitlRequestId,
+				action
+			});
+			if (!decision.allowed) return hitlRequiredRouteError(decision, await ensureWorkflowHitlRouteRequest(db, locals, decision.action));
+			approvedHitlRequestId = decision.hitlRequest.id;
+		}
+		const updates = buildWidgetUpdates(widgetInput);
+		if (Object.keys(updates).length === 0) return apiError("VALIDATION_ERROR", "No fields to update", 400);
+		await db.updateTable("_dineway_widgets").set(updates).where("id", "=", id).execute();
+		const widget = await db.selectFrom("_dineway_widgets").selectAll().$castTo().where("id", "=", id).executeTakeFirstOrThrow();
+		await logWidgetActivity(db, locals, {
+			action: "updated",
+			areaId: area.id,
+			areaName: area.name,
+			widgetId: widget.id,
+			...widgetApiRouteSource("updated"),
+			detail: {
+				changedKeys: activityChangedKeys(widgetInput),
+				type: widget.type,
+				hitlRequestId: approvedHitlRequestId
+			}
+		});
+		return apiSuccess(rowToWidget(widget));
+	} catch (error) {
+		return handleError(error, "Failed to update widget", "WIDGET_UPDATE_ERROR");
+	}
+};
+const DELETE = async ({ params, request, locals }) => {
+	const { dineway, user } = locals;
+	const db = dineway.db;
+	const { name, id } = params;
+	const denied = requirePerm(user, "widgets:manage");
+	if (denied) return denied;
+	if (!name || !id) return apiError("VALIDATION_ERROR", "name and id are required", 400);
+	const query = parseQuery(new URL(request.url), deleteWidgetQuery);
+	if (isParseError(query)) return query;
+	try {
+		const payloadBuilder = new WidgetHitlPayloadBuilder(db);
+		const area = await payloadBuilder.loadWidgetAreaSnapshot(name);
+		if (!area) return apiError("NOT_FOUND", `Widget area "${name}" not found`, 404);
+		const existingWidget = area.widgets.find((widget) => widget.id === id);
+		if (!existingWidget) return apiError("NOT_FOUND", `Widget "${id}" not found in area "${name}"`, 404);
+		const actor = resolveHitlRouteActor(locals);
+		const evaluator = new RiskPolicyEvaluator({
+			db,
+			handlers: dineway
+		});
+		let approvedHitlRequestId = null;
+		if (evaluator.requiresWorkflowHitl(actor.identity)) {
+			const action = await payloadBuilder.buildDeleteWidgetRequest({
+				area,
+				currentWidget: existingWidget
+			});
+			const decision = await evaluator.evaluateWorkflowHitl({
+				actor: actor.identity,
+				hitlRequestId: query.hitlRequestId,
+				action
+			});
+			if (!decision.allowed) return hitlRequiredRouteError(decision, await ensureWorkflowHitlRouteRequest(db, locals, decision.action));
+			approvedHitlRequestId = decision.hitlRequest.id;
+		}
+		await db.deleteFrom("_dineway_widgets").where("id", "=", id).execute();
+		await logWidgetActivity(db, locals, {
+			action: "deleted",
+			areaId: area.id,
+			areaName: area.name,
+			widgetId: existingWidget.id,
+			...widgetApiRouteSource("deleted"),
+			detail: {
+				type: existingWidget.type,
+				sortOrder: existingWidget.sortOrder,
+				hitlRequestId: approvedHitlRequestId
+			}
+		});
+		return apiSuccess({ deleted: true });
+	} catch (error) {
+		return handleError(error, "Failed to delete widget", "WIDGET_DELETE_ERROR");
+	}
+};
+function buildWidgetUpdates(body) {
+	const updates = {};
+	if (body.title !== void 0) updates.title = body.title || null;
+	if (body.type !== void 0) updates.type = body.type;
+	if (body.content !== void 0) updates.content = body.content ? JSON.stringify(body.content) : null;
+	if (body.menuName !== void 0) updates.menu_name = body.menuName || null;
+	if (body.componentId !== void 0) updates.component_id = body.componentId || null;
+	if (body.componentProps !== void 0) updates.component_props = body.componentProps ? JSON.stringify(body.componentProps) : null;
+	return updates;
+}
+
+//#endregion
+export { DELETE, PUT, prerender };

package/dist/astro/routes/api/widget-areas/_name_/widgets.d.mts

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/widget-areas/[name]/widgets.d.ts
+declare const prerender = false;
+declare const POST: APIRoute;
+//#endregion
+export { POST, prerender };