dineway 0.1.9 → 0.1.12

package/dist/{cache-BdSY-gQN.mjs → cache-DEbQ13c9.mjs}

@@ -1,20 +1,20 @@
 import { t as __exportAll } from "./chunk-ClPoSABd.mjs";
-import { i as matchPattern, n as interpolateDestination, t as compilePattern } from "./patterns-CrCYkMBb.mjs";
+import { i as matchPattern, n as interpolateDestination, t as compilePattern } from "./patterns-K0DLqWir.mjs";
 
 //#region src/redirects/cache.ts
 var cache_exports = /* @__PURE__ */ __exportAll({
 	compileRedirectRules: () => compileRedirectRules,
-	getCachedPatternRules: () => getCachedPatternRules,
+	getCachedRedirects: () => getCachedRedirects,
 	invalidateRedirectCache: () => invalidateRedirectCache,
 	matchCachedPatterns: () => matchCachedPatterns,
-	setCachedPatternRules: () => setCachedPatternRules
+	setCachedRedirects: () => setCachedRedirects
 });
-let cachedPatternRules = null;
+let cachedRedirects = null;
 function invalidateRedirectCache() {
-	cachedPatternRules = null;
+	cachedRedirects = null;
 }
-function getCachedPatternRules() {
-	return cachedPatternRules;
+function getCachedRedirects() {
+	return cachedRedirects;
 }
 function compileRedirectRules(redirects) {
 	return redirects.map((redirect) => ({
@@ -22,9 +22,19 @@ function compileRedirectRules(redirects) {
 		compiled: compilePattern(redirect.source)
 	}));
 }
-function setCachedPatternRules(redirects) {
-	cachedPatternRules = compileRedirectRules(redirects);
-	return cachedPatternRules;
+function setCachedRedirects(redirects) {
+	const exact = /* @__PURE__ */ new Map();
+	const patterns = [];
+	for (const redirect of redirects) if (redirect.isPattern) patterns.push({
+		redirect,
+		compiled: compilePattern(redirect.source)
+	});
+	else exact.set(redirect.source, redirect);
+	cachedRedirects = {
+		exact,
+		patterns
+	};
+	return cachedRedirects;
 }
 function matchCachedPatterns(rules, pathname) {
 	for (const { redirect, compiled } of rules) {
@@ -39,4 +49,4 @@ function matchCachedPatterns(rules, pathname) {
 }
 
 //#endregion
-export { matchCachedPatterns as a, invalidateRedirectCache as i, compileRedirectRules as n, setCachedPatternRules as o, getCachedPatternRules as r, cache_exports as t };
+export { matchCachedPatterns as a, invalidateRedirectCache as i, compileRedirectRules as n, setCachedRedirects as o, getCachedRedirects as r, cache_exports as t };

package/dist/challenge-store-DDTbisbf.mjs

@@ -0,0 +1,48 @@
+//#region src/auth/challenge-store.ts
+function createChallengeStore(db) {
+	return {
+		async set(challenge, data) {
+			const expiresAt = new Date(data.expiresAt).toISOString();
+			await db.insertInto("auth_challenges").values({
+				challenge,
+				type: data.type,
+				user_id: data.userId ?? null,
+				data: null,
+				expires_at: expiresAt
+			}).onConflict((oc) => oc.column("challenge").doUpdateSet({
+				type: data.type,
+				user_id: data.userId ?? null,
+				expires_at: expiresAt
+			})).execute();
+		},
+		async get(challenge) {
+			const row = await db.selectFrom("auth_challenges").selectAll().where("challenge", "=", challenge).executeTakeFirst();
+			if (!row) return null;
+			const expiresAt = new Date(row.expires_at).getTime();
+			if (expiresAt < Date.now()) {
+				await this.delete(challenge);
+				return null;
+			}
+			return {
+				type: row.type === "registration" ? "registration" : "authentication",
+				userId: row.user_id ?? void 0,
+				expiresAt
+			};
+		},
+		async delete(challenge) {
+			await db.deleteFrom("auth_challenges").where("challenge", "=", challenge).execute();
+		}
+	};
+}
+/**
+* Clean up expired challenges.
+* Should be called periodically (e.g., on startup, or via cron).
+*/
+async function cleanupExpiredChallenges(db) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const result = await db.deleteFrom("auth_challenges").where("expires_at", "<", now).executeTakeFirst();
+	return Number(result.numDeletedRows ?? 0);
+}
+
+//#endregion
+export { createChallengeStore as n, cleanupExpiredChallenges as t };

package/dist/cli/index.mjs

@@ -3,31 +3,38 @@ import { t as __exportAll } from "../chunk-ClPoSABd.mjs";
 import { n as createDatabase } from "../connection-BCNICDWN.mjs";
 import { s as listTablesLike } from "../dialect-helpers-DhTzaUxP.mjs";
 import { r as runMigrations, t as getMigrationStatus } from "../runner-DWZm2KQm.mjs";
-import { t as ContentRepository } from "../content-DWi4d0rT.mjs";
-import { i as encodeBase64url } from "../base64-F8-DUraK.mjs";
-import "../types-BawVha09.mjs";
-import { t as MediaRepository } from "../media-DMTr80Gv.mjs";
-import { m as TaxonomyRepository, p as OptionsRepository, t as applySeed } from "../apply-iVSqz2qs.mjs";
-import "../redirect-DnEWAkVg.mjs";
-import "../byline-OhH2dlRu.mjs";
-import { r as isI18nEnabled } from "../config-BXwuX8Bx.mjs";
-import { n as SchemaRegistry } from "../registry-C0zjeB9P.mjs";
-import "../loader-sMG4TZ-u.mjs";
-import "../request-cache-Dk5qPSOx.mjs";
-import { i as pluginManifestSchema } from "../manifest-schema-D1MSVnoI.mjs";
-import { t as validateSeed } from "../validate-BZ5wnLLp.mjs";
-import { LocalStorage } from "../storage/local.mjs";
+import { t as ContentRepository } from "../content-CyLkb-qH.mjs";
+import { i as encodeBase64url } from "../base64-Cz-aU0X1.mjs";
+import "../types-Bs6lTBBW.mjs";
+import { t as MediaRepository } from "../media-_7Fxdu45.mjs";
+import { t as TaxonomyRepository } from "../taxonomy-D5cbhc8u.mjs";
+import { t as OptionsRepository } from "../options-z8VVg1Ll.mjs";
+import "../redirect-CGl64yOX.mjs";
+import "../byline-naZxOPSa.mjs";
+import { r as isI18nEnabled } from "../config-CAMFxGaV.mjs";
+import "../fts-manager-B1pTNEG_.mjs";
+import { n as SchemaRegistry } from "../registry-C-_hxLqa.mjs";
+import "../loader-PZnPxFLc.mjs";
+import "../settings-DGtLLSaz.mjs";
+import "../request-cache-DHMRr2Lf.mjs";
+import { i as pluginManifestSchema } from "../manifest-schema-CgFJAp0H.mjs";
+import "../ssrf-DDwRxF6B.mjs";
+import { t as validateSeed } from "../validate-C7TzfamJ.mjs";
+import { t as applySeed } from "../apply-Bm5QgdrE.mjs";
+import { n as fingerprintKey, r as generateEncryptionKey, t as DinewaySecretsError } from "../secrets-CkoJ9zN0.mjs";
+import { o as convertDataForRead } from "../transport-D3i4yWRE.mjs";
 import { createHeaderAwareFetch, customHeadersInterceptor, isRedirectResponse, resolveCustomHeaders } from "../client/external-auth-headers.mjs";
 import { DinewayClient } from "../client/index.mjs";
+import { LocalStorage } from "../storage/local.mjs";
 import { imageSize } from "image-size";
 import { createGzipDecoder, unpackTar } from "modern-tar";
 import { createHash } from "node:crypto";
 import { createWriteStream, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, dirname, extname, isAbsolute, join, resolve } from "node:path";
-import { access, copyFile, mkdir, readFile, readdir, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { defineCommand, runCommand, runMain } from "citty";
 import consola, { consola as consola$1 } from "consola";
 import pc from "picocolors";
+import { access, copyFile, mkdir, readFile, readdir, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { createInterface } from "node:readline/promises";
 import { spawn } from "node:child_process";
@@ -135,7 +142,10 @@ function readStore() {
 	return {};
 }
 function writeStore(store) {
-	mkdirSync(getConfigDir(), { recursive: true });
+	mkdirSync(getConfigDir(), {
+		recursive: true,
+		mode: 448
+	});
 	writeFileSync(getCredentialPath(), JSON.stringify(store, null, "	"), {
 		encoding: "utf-8",
 		mode: 384
@@ -484,7 +494,16 @@ const getCommand$3 = defineCommand({
 			});
 			if (!args.published && item.draftRevisionId) {
 				const comparison = await client.compare(args.collection, args.id);
-				if (comparison.hasChanges && comparison.draft) item.data = comparison.draft;
+				if (comparison.hasChanges && comparison.draft) {
+					item.data = comparison.draft;
+					if (!args.raw && item.data) {
+						const fields = (await client.collection(args.collection)).fields.map((field) => ({
+							slug: field.slug,
+							type: field.type
+						}));
+						item.data = convertDataForRead(item.data, fields, false);
+					}
+				}
 			}
 			output(item, args);
 		} catch (error) {
@@ -627,6 +646,7 @@ const deleteCommand$2 = defineCommand({
 		configureOutputMode(args);
 		try {
 			await createClientFromArgs(args).delete(args.collection, args.id);
+			output({ success: true }, args);
 			consola$1.success(`Deleted ${args.collection}/${args.id}`);
 		} catch (error) {
 			consola$1.error(error instanceof Error ? error.message : "Unknown error");
@@ -660,6 +680,7 @@ const publishCommand$1 = defineCommand({
 		configureOutputMode(args);
 		try {
 			await createClientFromArgs(args).publish(args.collection, args.id, { reviewRequestId: args["review-request-id"] });
+			output({ success: true }, args);
 			consola$1.success(`Published ${args.collection}/${args.id}`);
 		} catch (error) {
 			consola$1.error(error instanceof Error ? error.message : "Unknown error");
@@ -689,6 +710,7 @@ const unpublishCommand = defineCommand({
 		configureOutputMode(args);
 		try {
 			await createClientFromArgs(args).unpublish(args.collection, args.id);
+			output({ success: true }, args);
 			consola$1.success(`Unpublished ${args.collection}/${args.id}`);
 		} catch (error) {
 			consola$1.error(error instanceof Error ? error.message : "Unknown error");
@@ -723,6 +745,7 @@ const scheduleCommand = defineCommand({
 		configureOutputMode(args);
 		try {
 			await createClientFromArgs(args).schedule(args.collection, args.id, { at: args.at });
+			output({ success: true }, args);
 			consola$1.success(`Scheduled ${args.collection}/${args.id} for ${args.at}`);
 		} catch (error) {
 			consola$1.error(error instanceof Error ? error.message : "Unknown error");
@@ -752,6 +775,7 @@ const restoreCommand = defineCommand({
 		configureOutputMode(args);
 		try {
 			await createClientFromArgs(args).restore(args.collection, args.id);
+			output({ success: true }, args);
 			consola$1.success(`Restored ${args.collection}/${args.id}`);
 		} catch (error) {
 			consola$1.error(error instanceof Error ? error.message : "Unknown error");
@@ -2773,7 +2797,8 @@ const whoamiCommand = defineCommand({
 							})
 						});
 						if (refreshRes.ok) {
-							const refreshed = await refreshRes.json();
+							const json = await refreshRes.json();
+							const refreshed = json.data && typeof json.data === "object" && "access_token" in json.data ? json.data : json;
 							token = refreshed.access_token;
 							saveCredentials(baseUrl, {
 								...cred,
@@ -3057,8 +3082,8 @@ const MAX_SCREENSHOTS = 5;
 const MAX_SCREENSHOT_WIDTH = 1920;
 const MAX_SCREENSHOT_HEIGHT = 1080;
 const ICON_SIZE = 256;
-/** Matches require("node:xxx") / require("xxx") / import("node:xxx") in bundled output */
-const NODE_BUILTIN_IMPORT_RE = /(?:import|require)\s*\(?["'](?:node:)?([a-z_]+)["']\)?/g;
+/** Matches Node.js built-in imports in bundled output. */
+const NODE_BUILTIN_IMPORT_RE = /(?:import|export|require)\s*(?:\(|[^(]*?\bfrom\s+)["'](?:node:)?([a-z_]+)(?:\/[^"']*)?\s*["']\)?/g;
 const LEADING_DOT_SLASH_RE = /^\.\//;
 const DIST_PREFIX_RE = /^dist\//;
 const MJS_EXT_RE = /\.m?js$/;
@@ -3549,8 +3574,8 @@ const bundleCommand = defineCommand({
 					hasErrors = true;
 				}
 			}
-			if (manifest.capabilities.includes("network:fetch:any")) consola.warn("Plugin declares unrestricted network access (network:fetch:any) — it can make requests to any host");
-			else if (manifest.capabilities.includes("network:fetch") && manifest.allowedHosts.length === 0) consola.warn("Plugin declares network:fetch capability but no allowedHosts — all fetch requests will be blocked");
+			if (manifest.capabilities.includes("network:request:unrestricted")) consola.warn("Plugin declares unrestricted network access (network:request:unrestricted) — it can make requests to any host");
+			else if (manifest.capabilities.includes("network:request") && manifest.allowedHosts.length === 0) consola.warn("Plugin declares network:request capability but no allowedHosts — all fetch requests will be blocked");
 			if (resolvedPlugin.admin?.portableTextBlocks && resolvedPlugin.admin.portableTextBlocks.length > 0) consola.warn("Plugin declares portableTextBlocks — these require trusted mode and will be ignored in sandboxed plugins");
 			if (resolvedPlugin.admin?.entry) consola.warn("Plugin declares admin.entry — custom React components require trusted mode. Use Block Kit for sandboxed admin pages");
 			if (resolvedPlugin.hooks["page:fragments"]) consola.warn("Plugin declares page:fragments hook — this is trusted-only and will not work in sandboxed mode");
@@ -4502,6 +4527,99 @@ const searchCommand = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/cli/commands/secrets.ts
+/**
+* Secrets CLI commands.
+*/
+const KEY_VAR_NAME = "DINEWAY_ENCRYPTION_KEY";
+const POPULATED_KEY_LINE_PATTERN = /^DINEWAY_ENCRYPTION_KEY=.+$/m;
+const ANY_KEY_LINE_PATTERN = /^DINEWAY_ENCRYPTION_KEY=.*$/m;
+function writeEncryptionKeyToFile(targetPath, value, force) {
+	const existing = existsSync(targetPath) ? readFileSync(targetPath, "utf-8") : "";
+	if (POPULATED_KEY_LINE_PATTERN.test(existing) && !force) return "skipped";
+	const newLine = `${KEY_VAR_NAME}=${value}`;
+	let next;
+	if (ANY_KEY_LINE_PATTERN.test(existing)) {
+		next = existing.replace(ANY_KEY_LINE_PATTERN, newLine);
+		if (!next.endsWith("\n")) next += "\n";
+	} else next = `${existing}${existing.length === 0 || existing.endsWith("\n") ? "" : "\n"}${newLine}\n`;
+	writeFileSync(targetPath, next);
+	return "wrote";
+}
+const generateCommand = defineCommand({
+	meta: {
+		name: "generate",
+		description: "Generate a new Dineway encryption key"
+	},
+	args: {
+		write: {
+			type: "string",
+			description: "Optional dotenv file path to write the key to"
+		},
+		force: {
+			type: "boolean",
+			description: "When used with --write, overwrite an existing entry",
+			default: false
+		}
+	},
+	run({ args }) {
+		const value = generateEncryptionKey();
+		if (args.write) {
+			if (writeEncryptionKeyToFile(resolve(process.cwd(), args.write), value, args.force) === "skipped") {
+				consola$1.info(`${KEY_VAR_NAME} already set in ${pc.cyan(args.write)}; leaving it alone. Pass ${pc.bold("--force")} to replace it.`);
+				return;
+			}
+			consola$1.log("");
+			consola$1.log(`${pc.bold("Wrote")} ${pc.cyan(KEY_VAR_NAME)} to ${pc.cyan(args.write)}`);
+			consola$1.log("");
+			consola$1.log(pc.yellow("Keep this file out of version control."));
+			consola$1.log("");
+			return;
+		}
+		process.stdout.write(`${value}\n`);
+		process.stderr.write([
+			"",
+			pc.bold("Dineway encryption key generated."),
+			"",
+			`Set ${pc.cyan(KEY_VAR_NAME)} in your environment.`,
+			"",
+			pc.yellow("Keep this value secret. Losing it means encrypted secrets are unreadable."),
+			""
+		].join("\n"));
+	}
+});
+const fingerprintCommand = defineCommand({
+	meta: {
+		name: "fingerprint",
+		description: "Print the kid (8-char fingerprint) for an encryption key"
+	},
+	args: { key: {
+		type: "positional",
+		description: "The full key value with the dineway_enc_v1_ prefix",
+		required: true
+	} },
+	async run({ args }) {
+		try {
+			const kid = await fingerprintKey(args.key);
+			process.stdout.write(`${kid}\n`);
+		} catch (error) {
+			consola$1.error(error instanceof DinewaySecretsError ? error.message : "Failed to fingerprint key");
+			process.exit(1);
+		}
+	}
+});
+const secretsCommand = defineCommand({
+	meta: {
+		name: "secrets",
+		description: "Manage Dineway secrets"
+	},
+	subCommands: {
+		generate: generateCommand,
+		fingerprint: fingerprintCommand
+	}
+});
+
 //#endregion
 //#region src/cli/commands/seed.ts
 /**
@@ -4864,6 +4982,7 @@ const typesCommand = defineCommand({
 * - dev: Run dev server with a local or remote database
 * - seed: Apply a seed file to the database
 * - export-seed: Export database schema and content as a seed file
+* - secrets: Generate and inspect Dineway secrets
 * - auth: Authentication utilities (secret generation)
 * - login/logout/whoami: Session management
 * - content: Create, read, update, delete content
@@ -4889,6 +5008,7 @@ runMain(defineCommand({
 		doctor: doctorCommand,
 		seed: seedCommand,
 		"export-seed": exportSeedCommand,
+		secrets: secretsCommand,
 		auth: authCommand,
 		login: loginCommand,
 		logout: logoutCommand,

package/dist/client/external-auth-headers.d.mts

@@ -1,4 +1,4 @@
-import { t as Interceptor } from "../transport-Wge_IzKl.mjs";
+import { t as Interceptor } from "../transport-BXe1AM79.mjs";
 
 //#region src/client/external-auth-headers.d.ts
 /**

package/dist/client/index.d.mts

@@ -1,4 +1,4 @@
-import { a as tokenInterceptor, i as devBypassInterceptor, n as createTransport, r as csrfInterceptor, t as Interceptor } from "../transport-Wge_IzKl.mjs";
+import { a as tokenInterceptor, i as devBypassInterceptor, n as createTransport, r as csrfInterceptor, t as Interceptor } from "../transport-BXe1AM79.mjs";
 
 //#region src/client/portable-text.d.ts
 /**

package/dist/client/index.mjs

@@ -1,4 +1,4 @@
-import { a as tokenInterceptor, c as markdownToPortableText, i as refreshInterceptor, l as portableTextToMarkdown, n as csrfInterceptor, o as convertDataForRead, r as devBypassInterceptor, s as convertDataForWrite, t as createTransport } from "../transport-DB5eDN4x.mjs";
+import { a as tokenInterceptor, c as markdownToPortableText, i as refreshInterceptor, l as portableTextToMarkdown, n as csrfInterceptor, o as convertDataForRead, r as devBypassInterceptor, s as convertDataForWrite, t as createTransport } from "../transport-D3i4yWRE.mjs";
 import mime from "mime/lite";
 
 //#region src/client/index.ts
@@ -263,7 +263,7 @@ var DinewayClient = class {
 	}
 	/** List taxonomies */
 	async taxonomies() {
-		return (await this.request("GET", "/taxonomies")).items;
+		return (await this.request("GET", "/taxonomies")).taxonomies;
 	}
 	/** List terms in a taxonomy */
 	async terms(taxonomy, options) {
@@ -279,7 +279,7 @@ var DinewayClient = class {
 	}
 	/** List menus */
 	async menus() {
-		return (await this.request("GET", "/menus")).items;
+		return this.request("GET", "/menus");
 	}
 	/** Get a menu with its items */
 	async menu(name) {

package/dist/comment-DFO-gWDH.mjs

@@ -0,0 +1,246 @@
+import { n as decodeCursor, r as encodeCursor } from "./types-Bs6lTBBW.mjs";
+import { sql } from "kysely";
+import { ulid } from "ulidx";
+
+//#region src/database/repositories/comment.ts
+/** Matches LIKE wildcard characters and the escape character itself */
+const LIKE_ESCAPE_RE = /[%_\\]/g;
+var CommentRepository = class CommentRepository {
+	constructor(db) {
+		this.db = db;
+	}
+	/**
+	* Create a new comment
+	*/
+	async create(input) {
+		const id = ulid();
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		await this.db.insertInto("_dineway_comments").values({
+			id,
+			collection: input.collection,
+			content_id: input.contentId,
+			parent_id: input.parentId ?? null,
+			author_name: input.authorName,
+			author_email: input.authorEmail,
+			author_user_id: input.authorUserId ?? null,
+			body: input.body,
+			status: input.status ?? "pending",
+			ip_hash: input.ipHash ?? null,
+			user_agent: input.userAgent ?? null,
+			moderation_metadata: input.moderationMetadata ? JSON.stringify(input.moderationMetadata) : null,
+			created_at: now,
+			updated_at: now
+		}).execute();
+		const comment = await this.findById(id);
+		if (!comment) throw new Error("Failed to create comment");
+		return comment;
+	}
+	/**
+	* Find comment by ID
+	*/
+	async findById(id) {
+		const row = await this.db.selectFrom("_dineway_comments").selectAll().where("id", "=", id).executeTakeFirst();
+		return row ? this.rowToComment(row) : null;
+	}
+	/**
+	* Find comments for a content item with optional status filter.
+	* Results are ordered by created_at ASC (oldest first) for display.
+	*/
+	async findByContent(collection, contentId, options = {}) {
+		const limit = Math.min(options.limit || 50, 100);
+		let query = this.db.selectFrom("_dineway_comments").selectAll().where("collection", "=", collection).where("content_id", "=", contentId);
+		if (options.status) query = query.where("status", "=", options.status);
+		if (options.cursor) {
+			const decoded = decodeCursor(options.cursor);
+			if (decoded) query = query.where((eb) => eb.or([eb("created_at", ">", decoded.orderValue), eb.and([eb("created_at", "=", decoded.orderValue), eb("id", ">", decoded.id)])]));
+		}
+		query = query.orderBy("created_at", "asc").orderBy("id", "asc").limit(limit + 1);
+		const rows = await query.execute();
+		const hasMore = rows.length > limit;
+		const items = rows.slice(0, limit).map((r) => this.rowToComment(r));
+		const result = { items };
+		if (hasMore && items.length > 0) {
+			const last = items.at(-1);
+			result.nextCursor = encodeCursor(last.createdAt, last.id);
+		}
+		return result;
+	}
+	/**
+	* Find comments by status (moderation inbox).
+	* Results are ordered by created_at DESC (newest first).
+	*/
+	async findByStatus(status, options = {}) {
+		const limit = Math.min(options.limit || 50, 100);
+		let query = this.db.selectFrom("_dineway_comments").selectAll().where("status", "=", status);
+		if (options.collection) query = query.where("collection", "=", options.collection);
+		if (options.search) {
+			const term = `%${options.search.replace(LIKE_ESCAPE_RE, (ch) => `\\${ch}`)}%`;
+			query = query.where((eb) => eb.or([
+				sql`author_name LIKE ${term} ESCAPE '\\'`,
+				sql`author_email LIKE ${term} ESCAPE '\\'`,
+				sql`body LIKE ${term} ESCAPE '\\'`
+			]));
+		}
+		if (options.cursor) {
+			const decoded = decodeCursor(options.cursor);
+			if (decoded) query = query.where((eb) => eb.or([eb("created_at", "<", decoded.orderValue), eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)])]));
+		}
+		query = query.orderBy("created_at", "desc").orderBy("id", "desc").limit(limit + 1);
+		const rows = await query.execute();
+		const hasMore = rows.length > limit;
+		const items = rows.slice(0, limit).map((r) => this.rowToComment(r));
+		const result = { items };
+		if (hasMore && items.length > 0) {
+			const last = items.at(-1);
+			result.nextCursor = encodeCursor(last.createdAt, last.id);
+		}
+		return result;
+	}
+	/**
+	* Update comment status
+	*/
+	async updateStatus(id, status) {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		await this.db.updateTable("_dineway_comments").set({
+			status,
+			updated_at: now
+		}).where("id", "=", id).execute();
+		return this.findById(id);
+	}
+	/**
+	* Bulk update comment statuses
+	*/
+	async bulkUpdateStatus(ids, status) {
+		if (ids.length === 0) return 0;
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const result = await this.db.updateTable("_dineway_comments").set({
+			status,
+			updated_at: now
+		}).where("id", "in", ids).executeTakeFirst();
+		return Number(result.numUpdatedRows ?? 0);
+	}
+	/**
+	* Hard-delete a single comment. Replies cascade via FK.
+	*/
+	async delete(id) {
+		return ((await this.db.deleteFrom("_dineway_comments").where("id", "=", id).executeTakeFirst()).numDeletedRows ?? 0) > 0;
+	}
+	/**
+	* Bulk hard-delete comments
+	*/
+	async bulkDelete(ids) {
+		if (ids.length === 0) return 0;
+		const result = await this.db.deleteFrom("_dineway_comments").where("id", "in", ids).executeTakeFirst();
+		return Number(result.numDeletedRows ?? 0);
+	}
+	/**
+	* Delete all comments for a content item (cascade on content deletion)
+	*/
+	async deleteByContent(collection, contentId) {
+		const result = await this.db.deleteFrom("_dineway_comments").where("collection", "=", collection).where("content_id", "=", contentId).executeTakeFirst();
+		return Number(result.numDeletedRows ?? 0);
+	}
+	/**
+	* Count comments for a content item, optionally filtered by status
+	*/
+	async countByContent(collection, contentId, status) {
+		let query = this.db.selectFrom("_dineway_comments").select((eb) => eb.fn.count("id").as("count")).where("collection", "=", collection).where("content_id", "=", contentId);
+		if (status) query = query.where("status", "=", status);
+		const result = await query.executeTakeFirst();
+		return Number(result?.count ?? 0);
+	}
+	/**
+	* Count comments grouped by status (for inbox badges)
+	*
+	* Uses four parallel COUNT queries with WHERE filters to leverage partial indexes
+	* (idx_comments_pending, idx_comments_approved, idx_comments_spam, idx_comments_trash)
+	* instead of a full table GROUP BY scan.
+	*/
+	async countByStatus() {
+		const [pending, approved, spam, trash] = await Promise.all([
+			this.db.selectFrom("_dineway_comments").select((eb) => eb.fn.count("id").as("count")).where("status", "=", "pending").executeTakeFirst(),
+			this.db.selectFrom("_dineway_comments").select((eb) => eb.fn.count("id").as("count")).where("status", "=", "approved").executeTakeFirst(),
+			this.db.selectFrom("_dineway_comments").select((eb) => eb.fn.count("id").as("count")).where("status", "=", "spam").executeTakeFirst(),
+			this.db.selectFrom("_dineway_comments").select((eb) => eb.fn.count("id").as("count")).where("status", "=", "trash").executeTakeFirst()
+		]);
+		return {
+			pending: Number(pending?.count ?? 0),
+			approved: Number(approved?.count ?? 0),
+			spam: Number(spam?.count ?? 0),
+			trash: Number(trash?.count ?? 0)
+		};
+	}
+	/**
+	* Count approved comments from a given email address.
+	* Used for "first time commenter" moderation logic.
+	*/
+	async countApprovedByEmail(email) {
+		const result = await this.db.selectFrom("_dineway_comments").select((eb) => eb.fn.count("id").as("count")).where("author_email", "=", email).where("status", "=", "approved").executeTakeFirst();
+		return Number(result?.count ?? 0);
+	}
+	/**
+	* Update the moderation metadata JSON on a comment
+	*/
+	async updateModerationMetadata(id, metadata) {
+		await this.db.updateTable("_dineway_comments").set({ moderation_metadata: JSON.stringify(metadata) }).where("id", "=", id).execute();
+	}
+	/**
+	* Assemble a flat list of comments into a threaded structure (1-level nesting)
+	*/
+	static assembleThreads(comments) {
+		const roots = [];
+		const childrenMap = /* @__PURE__ */ new Map();
+		for (const comment of comments) if (comment.parentId) {
+			const siblings = childrenMap.get(comment.parentId) ?? [];
+			siblings.push(comment);
+			childrenMap.set(comment.parentId, siblings);
+		} else roots.push(comment);
+		return roots.map((root) => ({
+			...root,
+			_replies: childrenMap.get(root.id) ?? []
+		}));
+	}
+	/**
+	* Convert a Comment to its public-facing shape
+	*/
+	static toPublicComment(comment) {
+		const pub = {
+			id: comment.id,
+			parentId: comment.parentId,
+			authorName: comment.authorName,
+			isRegisteredUser: comment.authorUserId !== null,
+			body: comment.body,
+			createdAt: comment.createdAt
+		};
+		if (comment._replies && comment._replies.length > 0) pub.replies = comment._replies.map((r) => CommentRepository.toPublicComment(r));
+		return pub;
+	}
+	rowToComment(row) {
+		return {
+			id: row.id,
+			collection: row.collection,
+			contentId: row.content_id,
+			parentId: row.parent_id,
+			authorName: row.author_name,
+			authorEmail: row.author_email,
+			authorUserId: row.author_user_id,
+			body: row.body,
+			status: row.status,
+			ipHash: row.ip_hash,
+			userAgent: row.user_agent,
+			moderationMetadata: row.moderation_metadata ? safeJsonParse(row.moderation_metadata) : null,
+			createdAt: row.created_at,
+			updatedAt: row.updated_at
+		};
+	}
+};
+function safeJsonParse(value) {
+	try {
+		return JSON.parse(value);
+	} catch {
+		return null;
+	}
+}
+
+//#endregion
+export { CommentRepository as t };