dineway 0.1.9 → 0.1.12

package/dist/parse-C9106ehs.mjs

@@ -0,0 +1,88 @@
+import { t as apiError } from "./error-BMUPwxgx.mjs";
+import { z } from "zod";
+
+//#region src/api/parse.ts
+/** Maximum allowed JSON request body size (10 MB). */
+const MAX_BODY_SIZE = 10 * 1024 * 1024;
+/**
+* Parse and validate a JSON request body against a Zod schema.
+*
+* Returns the validated data on success, or a 400 Response on failure.
+* Replaces all `(await request.json()) as T` casts.
+*/
+async function parseBody(request, schema) {
+	const contentLength = request.headers.get("Content-Length");
+	if (contentLength && parseInt(contentLength, 10) > MAX_BODY_SIZE) return apiError("PAYLOAD_TOO_LARGE", "Request body too large", 413);
+	let raw;
+	try {
+		raw = await request.json();
+	} catch {
+		return apiError("INVALID_JSON", "Request body must be valid JSON", 400);
+	}
+	return validate(schema, raw);
+}
+/**
+* Parse and validate an optional JSON request body.
+*
+* Returns `defaultValue` if the body is empty, or the validated data if present.
+* For endpoints where the body is optional (e.g., preview-url, confirm).
+*/
+async function parseOptionalBody(request, schema, defaultValue) {
+	const contentLength = request.headers.get("Content-Length");
+	if (contentLength && parseInt(contentLength, 10) > MAX_BODY_SIZE) return apiError("PAYLOAD_TOO_LARGE", "Request body too large", 413);
+	let text;
+	try {
+		text = await request.text();
+	} catch {
+		return defaultValue;
+	}
+	if (!text.trim()) return defaultValue;
+	let raw;
+	try {
+		raw = JSON.parse(text);
+	} catch {
+		return apiError("INVALID_JSON", "Request body must be valid JSON", 400);
+	}
+	return validate(schema, raw);
+}
+/**
+* Parse and validate URL search params against a Zod schema.
+*
+* Converts searchParams to a plain object before validation.
+* Zod coercion handles string -> number/boolean conversion.
+* Replaces manual `url.searchParams.get()` + `parseInt()` patterns.
+*/
+function parseQuery(url, schema) {
+	const raw = {};
+	for (const [key, value] of url.searchParams) raw[key] = value;
+	return validate(schema, raw);
+}
+/**
+* Validate raw data against a schema. Returns data or error Response.
+*/
+function validate(schema, data) {
+	const result = schema.safeParse(data);
+	if (result.success) return result.data;
+	const issues = result.error.issues.map((issue) => ({
+		path: issue.path.join("."),
+		message: issue.message
+	}));
+	return Response.json({ error: {
+		code: "VALIDATION_ERROR",
+		message: "Invalid request data",
+		details: { issues }
+	} }, {
+		status: 400,
+		headers: { "Cache-Control": "private, no-store" }
+	});
+}
+/**
+* Type guard to check if a ParseResult is an error Response.
+* Usage: `if (isParseError(result)) return result;`
+*/
+function isParseError(result) {
+	return result instanceof Response;
+}
+
+//#endregion
+export { parseQuery as i, parseBody as n, parseOptionalBody as r, isParseError as t };

package/dist/passkey-config-BRSZx4pW.mjs

@@ -0,0 +1,42 @@
+//#region src/auth/passkey-config.ts
+/**
+* Get passkey configuration from request URL
+*
+* @param url The request URL (typically `new URL(Astro.request.url)` or `new URL(request.url)`)
+* @param siteName Optional site name for rpName (defaults to hostname from `url` or public origin)
+* @param siteUrl Optional browser-facing origin (see `DinewayConfig.siteUrl`).
+*        When set, **origin** and **rpId** are taken from this URL so they match WebAuthn `clientData.origin`.
+* @throws If `siteUrl` is non-empty but not parseable by `new URL()`.
+*/
+function getPasskeyConfig(url, siteName, siteUrl, allowedOrigins) {
+	let rpName;
+	let rpId;
+	let canonicalOrigin;
+	if (siteUrl) {
+		let publicUrl;
+		try {
+			publicUrl = new URL(siteUrl);
+		} catch (e) {
+			throw new Error(`Invalid siteUrl: "${siteUrl}"`, { cause: e });
+		}
+		rpName = siteName || publicUrl.hostname;
+		rpId = publicUrl.hostname;
+		canonicalOrigin = publicUrl.origin;
+	} else {
+		rpName = siteName || url.hostname;
+		rpId = url.hostname;
+		canonicalOrigin = url.origin;
+	}
+	const origins = [canonicalOrigin];
+	if (allowedOrigins) {
+		for (const origin of allowedOrigins) if (origin && !origins.includes(origin)) origins.push(origin);
+	}
+	return {
+		rpName,
+		rpId,
+		origins
+	};
+}
+
+//#endregion
+export { getPasskeyConfig as t };

package/dist/{patterns-CrCYkMBb.mjs → patterns-K0DLqWir.mjs}

@@ -21,6 +21,14 @@ const PARAM_PATTERN = /\[(\w+)\]/g;
 const SPLAT_PATTERN = /\[\.\.\.(\w+)\]/g;
 /** Combined pattern for validation: matches both [param] and [...splat] */
 const ANY_PLACEHOLDER = /\[(?:\.\.\.)?(\w+)\]/g;
+/** Nested brackets check: [foo[ */
+const NESTED_BRACKETS = /\[[^\]]*\[/;
+/** Empty brackets: [] */
+const EMPTY_BRACKETS = /\[\]/;
+/** Count open brackets */
+const OPEN_BRACKET = /\[/g;
+/** Count close brackets */
+const CLOSE_BRACKET = /\]/g;
 /** Split on capture groups in compiled regex string */
 const CAPTURE_GROUP_SPLIT = /(\([^)]+\))/;
 /** Escape regex-special characters in literal parts */
@@ -32,6 +40,50 @@ function isPattern(source) {
 	return source.match(ANY_PLACEHOLDER) !== null;
 }
 /**
+* Validate that a pattern string is well-formed.
+* Returns null if valid, or an error message if invalid.
+*/
+function validatePattern(source) {
+	if (!source.startsWith("/")) return "Pattern must start with /";
+	if (NESTED_BRACKETS.test(source)) return "Nested brackets are not allowed";
+	if (EMPTY_BRACKETS.test(source)) return "Empty brackets are not allowed";
+	if ((source.match(OPEN_BRACKET) ?? []).length !== (source.match(CLOSE_BRACKET) ?? []).length) return "Unmatched brackets";
+	const segments = source.split("/").filter(Boolean);
+	for (let i = 0; i < segments.length; i++) {
+		const segment = segments[i];
+		if (SPLAT_PATTERN.test(segment) && i !== segments.length - 1) {
+			SPLAT_PATTERN.lastIndex = 0;
+			return "Catch-all [...param] must be in the last segment";
+		}
+		SPLAT_PATTERN.lastIndex = 0;
+	}
+	for (const segment of segments) {
+		const placeholders = segment.match(ANY_PLACEHOLDER);
+		if (placeholders && placeholders.length > 1) return "Each segment can contain at most one placeholder";
+		if (placeholders && placeholders[0] !== segment) return "A placeholder must be the entire segment, not mixed with literal text";
+	}
+	const names = [];
+	for (const m of source.matchAll(ANY_PLACEHOLDER)) {
+		const name = m[1];
+		if (names.includes(name)) return `Duplicate parameter name: ${name}`;
+		names.push(name);
+	}
+	return null;
+}
+/**
+* Validate that all placeholders in a destination exist in the source.
+* Returns null if valid, or an error message if invalid.
+*/
+function validateDestinationParams(source, destination) {
+	const sourceNames = /* @__PURE__ */ new Set();
+	for (const m of source.matchAll(ANY_PLACEHOLDER)) sourceNames.add(m[1]);
+	for (const m of destination.matchAll(ANY_PLACEHOLDER)) {
+		const name = m[1];
+		if (!sourceNames.has(name)) return `Destination references [${name}] which is not captured in the source pattern`;
+	}
+	return null;
+}
+/**
 * Compile a URL pattern into a regex for matching.
 *
 * - `[param]` matches a single path segment (`[^/]+`)
@@ -89,4 +141,4 @@ function interpolateDestination(destination, params) {
 }
 
 //#endregion
-export { matchPattern as i, interpolateDestination as n, isPattern as r, compilePattern as t };
+export { validateDestinationParams as a, matchPattern as i, interpolateDestination as n, validatePattern as o, isPattern as r, compilePattern as t };

package/dist/placeholder-Bh1dfUOd.d.mts

@@ -0,0 +1,40 @@
+import { l as MediaProvider, m as MediaValue } from "./types-OPs5Q_sX.mjs";
+
+//#region src/media/normalize.d.ts
+/**
+ * Normalize a media field value into a consistent MediaValue shape.
+ *
+ * - `null`/`undefined` → `null`
+ * - Bare URL string → `{ provider: "external", id: "", src: url }`
+ * - Bare internal media URL → resolved via local provider's `get()`
+ * - Object with `provider` + `id` → enriched with missing fields from provider
+ */
+declare function normalizeMediaValue(value: unknown, getProvider: (id: string) => MediaProvider | undefined): Promise<MediaValue | null>;
+//#endregion
+//#region src/media/placeholder.d.ts
+/**
+ * Image Placeholder Generation
+ *
+ * Generates blurhash and dominant color from image buffers for LQIP support.
+ * Decodes images via jpeg-js (pure JS) and upng-js (pure JS, uses pako for
+ * deflate). No native image bindings required, so it works in server runtimes.
+ */
+interface PlaceholderData {
+  blurhash: string;
+  dominantColor: string;
+}
+/**
+ * Generate blurhash and dominant color from an image buffer.
+ * Returns null for non-image MIME types or on failure.
+ *
+ * @param dimensions - Optional pre-known dimensions. Used as a fallback when
+ *   image-size cannot parse the buffer (e.g. truncated headers). When the
+ *   decoded size (width * height * 4) exceeds MAX_DECODED_BYTES, placeholder
+ *   generation is skipped to avoid OOM on memory-constrained runtimes.
+ */
+declare function generatePlaceholder(buffer: Uint8Array, mimeType: string, dimensions?: {
+  width: number;
+  height: number;
+}): Promise<PlaceholderData | null>;
+//#endregion
+export { generatePlaceholder as n, normalizeMediaValue as r, PlaceholderData as t };

package/dist/{placeholder-Cp8g5Emj.mjs → placeholder-C2P5fKa4.mjs}

@@ -1,131 +1,6 @@
 import { encode } from "blurhash";
 import { imageSize } from "image-size";
 
-//#region src/media/normalize.ts
-const INTERNAL_MEDIA_PREFIX = "/_dineway/api/media/file/";
-const URL_PATTERN = /^https?:\/\//;
-/**
-* Normalize a media field value into a consistent MediaValue shape.
-*
-* - `null`/`undefined` → `null`
-* - Bare URL string → `{ provider: "external", id: "", src: url }`
-* - Bare internal media URL → resolved via local provider's `get()`
-* - Object with `provider` + `id` → enriched with missing fields from provider
-*/
-async function normalizeMediaValue(value, getProvider) {
-	if (value == null) return null;
-	if (typeof value === "string") return normalizeStringUrl(value, getProvider);
-	if (!isRecord(value)) return null;
-	if (!("id" in value) && !("src" in value)) return null;
-	const provider = (typeof value.provider === "string" ? value.provider : void 0) || "local";
-	const id = typeof value.id === "string" ? value.id : "";
-	if (provider === "external") return recordToMediaValue(value);
-	const result = {
-		...recordToMediaValue(value),
-		provider
-	};
-	if (provider === "local") delete result.src;
-	const needsDimensions = result.width == null || result.height == null;
-	const needsStorageKey = provider === "local" && !result.meta?.storageKey;
-	const needsFileInfo = !result.mimeType || !result.filename;
-	if (!(needsDimensions || needsStorageKey || needsFileInfo) || !id) return result;
-	const mediaProvider = getProvider(provider);
-	if (!mediaProvider?.get) return result;
-	let providerItem;
-	try {
-		providerItem = await mediaProvider.get(id);
-	} catch {
-		return result;
-	}
-	if (!providerItem) return result;
-	return mergeProviderData(result, providerItem);
-}
-function normalizeStringUrl(url, getProvider) {
-	if (url.startsWith(INTERNAL_MEDIA_PREFIX)) return resolveInternalUrl(url, getProvider);
-	if (URL_PATTERN.test(url)) return Promise.resolve({
-		provider: "external",
-		id: "",
-		src: url
-	});
-	return Promise.resolve({
-		provider: "external",
-		id: "",
-		src: url
-	});
-}
-async function resolveInternalUrl(url, getProvider) {
-	const storageKey = url.slice(25);
-	const localProvider = getProvider("local");
-	if (!localProvider?.get) return {
-		provider: "external",
-		id: "",
-		src: url
-	};
-	let item;
-	try {
-		item = await localProvider.get(storageKey);
-	} catch {
-		return {
-			provider: "external",
-			id: "",
-			src: url
-		};
-	}
-	if (!item) return {
-		provider: "external",
-		id: "",
-		src: url
-	};
-	return {
-		provider: "local",
-		id: item.id,
-		filename: item.filename,
-		mimeType: item.mimeType,
-		width: item.width,
-		height: item.height,
-		alt: item.alt,
-		meta: item.meta
-	};
-}
-/**
-* Merge provider data into an existing MediaValue, preserving caller-supplied fields.
-* Caller `alt` takes priority over provider `alt` (per-usage, not per-image).
-*/
-function mergeProviderData(existing, item) {
-	const result = { ...existing };
-	if (result.width == null && item.width != null) result.width = item.width;
-	if (result.height == null && item.height != null) result.height = item.height;
-	if (!result.filename && item.filename) result.filename = item.filename;
-	if (!result.mimeType && item.mimeType) result.mimeType = item.mimeType;
-	if (!result.alt && item.alt) result.alt = item.alt;
-	if (item.meta) result.meta = {
-		...item.meta,
-		...result.meta
-	};
-	return result;
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/**
-* Extract known MediaValue fields from a runtime-checked record.
-* Avoids unsafe `as MediaValue` cast by reading each property explicitly.
-*/
-function recordToMediaValue(obj) {
-	const result = { id: typeof obj.id === "string" ? obj.id : "" };
-	if (typeof obj.provider === "string") result.provider = obj.provider;
-	if (typeof obj.src === "string") result.src = obj.src;
-	if (typeof obj.previewUrl === "string") result.previewUrl = obj.previewUrl;
-	if (typeof obj.filename === "string") result.filename = obj.filename;
-	if (typeof obj.mimeType === "string") result.mimeType = obj.mimeType;
-	if (typeof obj.width === "number") result.width = obj.width;
-	if (typeof obj.height === "number") result.height = obj.height;
-	if (typeof obj.alt === "string") result.alt = obj.alt;
-	if (isRecord(obj.meta)) result.meta = obj.meta;
-	return result;
-}
-
-//#endregion
 //#region src/media/placeholder.ts
 /**
 * Image Placeholder Generation
@@ -264,4 +139,4 @@ function downsample(src, srcW, srcH, dstW, dstH) {
 }
 
 //#endregion
-export { normalizeMediaValue as n, generatePlaceholder as t };
+export { generatePlaceholder as t };

package/dist/plugins/adapt-sandbox-entry.d.mts

@@ -1,8 +1,13 @@
-import "../types-DOrVigru.mjs";
-import { wn as PluginDescriptor } from "../index-yvc6E_17.mjs";
-import "../runner-CFI6B6J2.mjs";
-import { X as ResolvedPlugin, tt as StandardPluginDefinition } from "../types-Cj0KMIZV.mjs";
-import "../validate-IPf8n4Fj.mjs";
+import { n as PluginDescriptor } from "../runtime-Db4LbNVZ.mjs";
+import "../types-DZPw8Rru.mjs";
+import { X as ResolvedPlugin, tt as StandardPluginDefinition } from "../types-Q616b2Hn.mjs";
+import "../types-BFmjniC2.mjs";
+import "../runner-BU6Lo1ZS.mjs";
+import "../index-EUAWaIxW.mjs";
+import "../index-CYfhYgXd.mjs";
+import "../bylines-eVVCuOe4.mjs";
+import "../types-0Vr68fc2.mjs";
+import "../validate-BwmQEbu8.mjs";
 
 //#region src/plugins/adapt-sandbox-entry.d.ts
 /**

package/dist/plugins/adapt-sandbox-entry.mjs

@@ -1,4 +1,4 @@
-import { n as PLUGIN_CAPABILITIES, t as HOOK_NAMES } from "../manifest-schema-D1MSVnoI.mjs";
+import { n as PLUGIN_CAPABILITIES, t as HOOK_NAMES } from "../manifest-schema-CgFJAp0H.mjs";
 
 //#region src/plugins/adapt-sandbox-entry.ts
 /**
@@ -84,9 +84,9 @@ function adaptSandboxEntry(definition, descriptor) {
 	for (const cap of rawCapabilities) if (!VALID_CAPABILITIES_SET.has(cap)) throw new Error(`Invalid capability "${cap}" in plugin "${pluginId}". Valid capabilities: ${[...VALID_CAPABILITIES_SET].join(", ")}`);
 	const capabilities = [...rawCapabilities];
 	const allowedHosts = descriptor.allowedHosts ?? [];
-	if (capabilities.includes("write:content") && !capabilities.includes("read:content")) capabilities.push("read:content");
-	if (capabilities.includes("write:media") && !capabilities.includes("read:media")) capabilities.push("read:media");
-	if (capabilities.includes("network:fetch:any") && !capabilities.includes("network:fetch")) capabilities.push("network:fetch");
+	if (capabilities.includes("content:write") && !capabilities.includes("content:read")) capabilities.push("content:read");
+	if (capabilities.includes("media:write") && !capabilities.includes("media:read")) capabilities.push("media:read");
+	if (capabilities.includes("network:request:unrestricted") && !capabilities.includes("network:request")) capabilities.push("network:request");
 	const rawStorage = descriptor.storage ?? {};
 	const storage = {};
 	for (const [name, config] of Object.entries(rawStorage)) storage[name] = {