dineway 0.1.9 → 0.1.12

package/dist/astro/index.d.mts

@@ -1,9 +1,14 @@
-import "../types-DOrVigru.mjs";
-import { Cn as DinewayConfig, Dn as S3StorageConfig, En as LocalStorageConfig, On as StorageDescriptor, Tn as getStoredConfig, fa as MediaItem } from "../index-yvc6E_17.mjs";
-import "../runner-CFI6B6J2.mjs";
-import { r as ContentItem } from "../types-BzcUjoqg.mjs";
-import { X as ResolvedPlugin } from "../types-Cj0KMIZV.mjs";
-import "../validate-IPf8n4Fj.mjs";
+import { r as ContentItem } from "../types-DJlpx5Ay.mjs";
+import { Kn as MediaItem, a as S3StorageConfig, i as LocalStorageConfig, o as StorageDescriptor, r as getStoredConfig, t as DinewayConfig } from "../runtime-Db4LbNVZ.mjs";
+import "../types-DZPw8Rru.mjs";
+import { X as ResolvedPlugin } from "../types-Q616b2Hn.mjs";
+import "../types-BFmjniC2.mjs";
+import "../runner-BU6Lo1ZS.mjs";
+import "../index-EUAWaIxW.mjs";
+import "../index-CYfhYgXd.mjs";
+import "../bylines-eVVCuOe4.mjs";
+import "../types-0Vr68fc2.mjs";
+import "../validate-BwmQEbu8.mjs";
 import { DinewayHandlers, DinewayManifest, ManifestCollection } from "./types.mjs";
 import { AstroIntegration } from "astro";
 

package/dist/astro/index.mjs

@@ -1,8 +1,9 @@
-import { n as VERSION, t as COMMIT } from "../version-BPz1imu2.mjs";
-import { t as defaultSeed } from "../default-VjJyuuG9.mjs";
+import { n as VERSION, t as COMMIT } from "../version-D3vDb22n.mjs";
+import { t as defaultSeed } from "../default-D4ngTpW8.mjs";
+import { n as validateAllowedOrigins, r as validateOriginShape } from "../allowed-origins-C1AKK9AT.mjs";
 import { createRequire } from "node:module";
 import { existsSync, readFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { fontProviders } from "astro/config";
 import { fileURLToPath } from "node:url";
 
@@ -178,6 +179,8 @@ function notoSans(options) {
 *
 * Defines and injects all Dineway routes into the Astro application.
 */
+const TS_ROUTE_EXTENSION = /\.ts$/;
+const ROUTE_PARAM_SEGMENT = /\[([^\]]+)\]/g;
 /**
 * Resolve path to a route file in the package
 * Uses Node.js APIs - only call at build time
@@ -185,8 +188,9 @@ function notoSans(options) {
 function resolveRoute(route) {
 	const require = createRequire(import.meta.url);
 	const __dirname = dirname(fileURLToPath(import.meta.url));
+	const publishedRoute = route.endsWith(".ts") ? route.replace(ROUTE_PARAM_SEGMENT, "_$1_").replace(TS_ROUTE_EXTENSION, ".mjs") : route;
 	try {
-		return require.resolve(`dineway/routes/${route}`);
+		return require.resolve(`dineway/routes/${publishedRoute}`);
 	} catch {
 		return resolve(__dirname, "../routes", route);
 	}
@@ -771,6 +775,10 @@ function injectCoreRoutes(injectRoute) {
 		pattern: "/_dineway/api/auth/me",
 		entrypoint: resolveRoute("api/auth/me.ts")
 	});
+	injectRoute({
+		pattern: "/_dineway/api/auth/mode",
+		entrypoint: resolveRoute("api/auth/mode.ts")
+	});
 	injectRoute({
 		pattern: "/_dineway/api/auth/logout",
 		entrypoint: resolveRoute("api/auth/logout.ts")
@@ -787,6 +795,15 @@ function injectMcpRoute(injectRoute) {
 	});
 }
 /**
+* Injects routes from interactive auth providers.
+*/
+function injectAuthProviderRoutes(injectRoute, providers) {
+	for (const provider of providers) for (const route of provider.routes ?? []) injectRoute({
+		pattern: route.pattern,
+		entrypoint: route.entrypoint
+	});
+}
+/**
 * Injects passkey/oauth/magic-link auth routes.
 * Only used when NOT using external auth.
 */
@@ -903,6 +920,8 @@ const VIRTUAL_SANDBOXED_PLUGINS_ID = "virtual:dineway/sandboxed-plugins";
 const RESOLVED_VIRTUAL_SANDBOXED_PLUGINS_ID = "\0" + VIRTUAL_SANDBOXED_PLUGINS_ID;
 const VIRTUAL_AUTH_ID = "virtual:dineway/auth";
 const RESOLVED_VIRTUAL_AUTH_ID = "\0" + VIRTUAL_AUTH_ID;
+const VIRTUAL_AUTH_PROVIDERS_ID = "virtual:dineway/auth-providers";
+const RESOLVED_VIRTUAL_AUTH_PROVIDERS_ID = "\0" + VIRTUAL_AUTH_PROVIDERS_ID;
 const VIRTUAL_MEDIA_PROVIDERS_ID = "virtual:dineway/media-providers";
 const RESOLVED_VIRTUAL_MEDIA_PROVIDERS_ID = "\0" + VIRTUAL_MEDIA_PROVIDERS_ID;
 const VIRTUAL_BLOCK_COMPONENTS_ID = "virtual:dineway/block-components";
@@ -951,6 +970,28 @@ export const authenticate = _authenticate;
 `;
 }
 /**
+* Generates the interactive auth provider registry module.
+*/
+function generateAuthProvidersModule(descriptors) {
+	const withAdmin = descriptors.filter((descriptor) => descriptor.adminEntry);
+	if (withAdmin.length === 0) return `export const authProviders = {};`;
+	const imports = [];
+	const entries = [];
+	withAdmin.forEach((descriptor, index) => {
+		const varName = `authProvider${index}`;
+		imports.push(`import * as ${varName} from ${JSON.stringify(descriptor.adminEntry)};`);
+		entries.push(`  ${JSON.stringify(descriptor.id)}: { ...${varName}, id: ${JSON.stringify(descriptor.id)}, label: ${JSON.stringify(descriptor.label)} },`);
+	});
+	return `
+// Auto-generated auth provider registry
+${imports.join("\n")}
+
+export const authProviders = {
+${entries.join("\n")}
+};
+`;
+}
+/**
 * Generates the plugins module.
 * Imports and instantiates all plugins at runtime.
 *
@@ -1105,9 +1146,14 @@ function generateBlockComponentsModule(descriptors) {
 * Reads the user's seed file at build time (in Node context) and embeds it,
 * so the runtime doesn't need filesystem access during request handling.
 *
+* Search order:
+*   1. `.dineway/seed.json`
+*   2. `package.json` -> `dineway.seed` reference
+*   3. `seed/seed.json` conventional template path
+*
 * Exports `userSeed` (user's seed or null) and `seed` (user's seed or default).
 */
-function generateSeedModule(projectRoot) {
+function generateSeedModule(projectRoot, warnOnFallback = false) {
 	let userSeedJson = null;
 	try {
 		const content = readFileSync(resolve(projectRoot, ".dineway", "seed.json"), "utf-8");
@@ -1123,7 +1169,13 @@ function generateSeedModule(projectRoot) {
 			userSeedJson = content;
 		}
 	} catch {}
+	if (!userSeedJson) try {
+		const content = readFileSync(resolve(projectRoot, "seed", "seed.json"), "utf-8");
+		JSON.parse(content);
+		userSeedJson = content;
+	} catch {}
 	if (userSeedJson) return [`export const userSeed = ${userSeedJson};`, `export const seed = userSeed;`].join("\n");
+	if (warnOnFallback) console.warn("[dineway] No user seed found at .dineway/seed.json, package.json#dineway.seed, or seed/seed.json. Falling back to the built-in default seed; the setup wizard will not offer demo content for this site.");
 	return [`export const userSeed = null;`, `export const seed = ${JSON.stringify(defaultSeed)};`].join("\n");
 }
 /**
@@ -1227,16 +1279,22 @@ function linguiMacroPlugin(adminSourcePath, adminDistPath) {
 function resolveAdminDist() {
 	return dirname(createRequire(import.meta.url).resolve("@dineway-ai/admin"));
 }
+function isInside(parent, child) {
+	const relativePath = relative(parent, child);
+	return relativePath === "" || !relativePath.startsWith("..") && !isAbsolute(relativePath);
+}
 /**
 * Resolve path to the admin package source directory.
-* In dev mode, we alias @dineway-ai/admin to the source so Vite processes it
-* directly — giving instant HMR instead of requiring a rebuild + restart.
+* In dev mode inside this repo, we alias @dineway-ai/admin to the source so
+* Vite processes it directly — giving instant HMR instead of requiring a
+* rebuild + restart. External apps should use the built package surface.
 */
-function resolveAdminSource() {
+function resolveAdminSource(projectRoot) {
 	const packageRoot = resolve(dirname(createRequire(import.meta.url).resolve("@dineway-ai/admin")), "..");
+	const repoRoot = resolve(packageRoot, "..", "..");
 	const srcEntry = resolve(packageRoot, "src", "index.ts");
 	try {
-		if (existsSync(srcEntry)) return resolve(packageRoot, "src");
+		if (existsSync(srcEntry) && isInside(repoRoot, projectRoot)) return resolve(packageRoot, "src");
 	} catch {}
 }
 /**
@@ -1244,8 +1302,12 @@ function resolveAdminSource() {
 */
 function createVirtualModulesPlugin(options) {
 	const { serializableConfig, resolvedConfig, pluginDescriptors, astroConfig } = options;
+	let viteCommand;
 	return {
 		name: "dineway-virtual-modules",
+		configResolved(config) {
+			viteCommand = config.command;
+		},
 		resolveId(id) {
 			if (id === VIRTUAL_CONFIG_ID) return RESOLVED_VIRTUAL_CONFIG_ID;
 			if (id === VIRTUAL_DIALECT_ID) return RESOLVED_VIRTUAL_DIALECT_ID;
@@ -1255,6 +1317,7 @@ function createVirtualModulesPlugin(options) {
 			if (id === VIRTUAL_SANDBOX_RUNNER_ID) return RESOLVED_VIRTUAL_SANDBOX_RUNNER_ID;
 			if (id === VIRTUAL_SANDBOXED_PLUGINS_ID) return RESOLVED_VIRTUAL_SANDBOXED_PLUGINS_ID;
 			if (id === VIRTUAL_AUTH_ID) return RESOLVED_VIRTUAL_AUTH_ID;
+			if (id === VIRTUAL_AUTH_PROVIDERS_ID) return RESOLVED_VIRTUAL_AUTH_PROVIDERS_ID;
 			if (id === VIRTUAL_MEDIA_PROVIDERS_ID) return RESOLVED_VIRTUAL_MEDIA_PROVIDERS_ID;
 			if (id === VIRTUAL_BLOCK_COMPONENTS_ID) return RESOLVED_VIRTUAL_BLOCK_COMPONENTS_ID;
 			if (id === VIRTUAL_SEED_ID) return RESOLVED_VIRTUAL_SEED_ID;
@@ -1275,9 +1338,10 @@ function createVirtualModulesPlugin(options) {
 				if (!authDescriptor || !("entrypoint" in authDescriptor)) return generateAuthModule(void 0);
 				return generateAuthModule(authDescriptor.entrypoint);
 			}
+			if (id === RESOLVED_VIRTUAL_AUTH_PROVIDERS_ID) return generateAuthProvidersModule(resolvedConfig.authProviders ?? []);
 			if (id === RESOLVED_VIRTUAL_MEDIA_PROVIDERS_ID) return generateMediaProvidersModule(resolvedConfig.mediaProviders ?? []);
 			if (id === RESOLVED_VIRTUAL_BLOCK_COMPONENTS_ID) return generateBlockComponentsModule(pluginDescriptors);
-			if (id === RESOLVED_VIRTUAL_SEED_ID) return generateSeedModule(fileURLToPath(astroConfig.root));
+			if (id === RESOLVED_VIRTUAL_SEED_ID) return generateSeedModule(fileURLToPath(astroConfig.root), viteCommand === "serve");
 		}
 	};
 }
@@ -1298,7 +1362,8 @@ const NODE_NATIVE_EXTERNALS = [
 function createViteConfig(options, command) {
 	const adminDistPath = resolveAdminDist();
 	const isDev = command === "dev";
-	const adminSourcePath = isDev ? resolveAdminSource() : void 0;
+	const projectRoot = fileURLToPath(options.astroConfig.root);
+	const adminSourcePath = isDev ? resolveAdminSource(projectRoot) : void 0;
 	const useSource = adminSourcePath !== void 0;
 	const devPlugins = adminSourcePath ? [linguiMacroPlugin(adminSourcePath, adminDistPath)] : [];
 	return {
@@ -1404,6 +1469,13 @@ function dineway(config = {}) {
 			throw e;
 		}
 	}
+	if (resolvedConfig.allowedOrigins?.length) {
+		const tagged = resolvedConfig.allowedOrigins.map((origin) => ({
+			origin,
+			source: "config.allowedOrigins"
+		}));
+		resolvedConfig.allowedOrigins = resolvedConfig.siteUrl ? validateAllowedOrigins(resolvedConfig.siteUrl, tagged) : validateOriginShape(tagged);
+	}
 	const pluginDescriptors = resolvedConfig.plugins ?? [];
 	const sandboxedDescriptors = resolvedConfig.sandboxed ?? [];
 	for (const descriptor of [...pluginDescriptors, ...sandboxedDescriptors]) if (descriptor.format === "standard") {
@@ -1415,10 +1487,12 @@ function dineway(config = {}) {
 		database: resolvedConfig.database,
 		storage: resolvedConfig.storage,
 		auth: resolvedConfig.auth,
+		authProviders: resolvedConfig.authProviders,
 		marketplace: resolvedConfig.marketplace,
 		maxUploadSize: resolvedConfig.maxUploadSize,
 		admin: resolvedConfig.admin,
 		siteUrl: resolvedConfig.siteUrl,
+		allowedOrigins: resolvedConfig.allowedOrigins,
 		trustedProxyHeaders: resolvedConfig.trustedProxyHeaders
 	};
 	const useExternalAuth = !!(resolvedConfig.auth && "entrypoint" in resolvedConfig.auth);
@@ -1474,6 +1548,7 @@ function dineway(config = {}) {
 					}, command)
 				});
 				injectCoreRoutes(injectRoute);
+				if (resolvedConfig.authProviders?.length) injectAuthProviderRoutes(injectRoute, resolvedConfig.authProviders);
 				if (!useExternalAuth) injectBuiltinAuthRoutes(injectRoute);
 				if (resolvedConfig.mcp !== false) injectMcpRoute(injectRoute);
 				if (resolvedConfig.playground) addMiddleware({

package/dist/astro/middleware/auth.d.mts

@@ -1,9 +1,14 @@
-import "../../types-DOrVigru.mjs";
-import "../../index-yvc6E_17.mjs";
-import "../../runner-CFI6B6J2.mjs";
-import "../../types-Cj0KMIZV.mjs";
-import "../../validate-IPf8n4Fj.mjs";
-import { DinewayHandlers, DinewayManifest } from "../types.mjs";
+import "../../runtime-Db4LbNVZ.mjs";
+import "../../types-DZPw8Rru.mjs";
+import "../../types-Q616b2Hn.mjs";
+import "../../types-BFmjniC2.mjs";
+import "../../runner-BU6Lo1ZS.mjs";
+import "../../index-EUAWaIxW.mjs";
+import "../../index-CYfhYgXd.mjs";
+import "../../bylines-eVVCuOe4.mjs";
+import "../../types-0Vr68fc2.mjs";
+import "../../validate-BwmQEbu8.mjs";
+import { DinewayHandlers } from "../types.mjs";
 import { Kysely } from "kysely";
 import { User } from "@dineway-ai/auth";
 import * as astro from "astro";
@@ -26,7 +31,6 @@ declare global {
       /** Non-secret bearer token metadata for activity attribution. Undefined for session auth. */
       authToken?: SiteAuthTokenContext;
       dineway?: DinewayHandlers;
-      dinewayManifest?: DinewayManifest;
     }
     interface SessionData {
       user: {

package/dist/astro/middleware/auth.mjs

@@ -1,10 +1,12 @@
-import { t as apiError } from "../../error-BmL6QipT.mjs";
-import { t as getAuthMode } from "../../mode-47goXBBK.mjs";
+import { t as apiError } from "../../error-BMUPwxgx.mjs";
+import { n as getPublicOrigin } from "../../public-url-Cun8N3NU.mjs";
+import { t as getAuthMode } from "../../mode-DUhxwUhv.mjs";
+import { i as hasScope } from "../../api-tokens-CPjC3zf8.mjs";
+import { a as resolveOAuthToken, i as resolveApiToken } from "../../api-tokens-D7UjLbdt.mjs";
 import { ulid } from "ulidx";
 import { defineMiddleware } from "astro:middleware";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 import { authenticate } from "virtual:dineway/auth";
-import { hasScope, hashPrefixedToken as hashApiToken } from "@dineway-ai/auth";
 
 //#region src/api/csrf.ts
 /**
@@ -48,99 +50,6 @@ function checkPublicCsrf(request, url, publicOrigin) {
 	return null;
 }
 
-//#endregion
-//#region src/api/public-url.ts
-/**
-* Resolve siteUrl from runtime environment variables.
-*
-* Uses process.env (not import.meta.env) because Vite statically replaces
-* import.meta.env at build time, baking out any env vars not present during
-* the build. Container deployments set env vars at runtime, so we must read
-* process.env which Vite leaves untouched.
-*
-* On runtimes without `process.env`, the fallback chain
-* continues to url.origin.
-*
-* Caches after first call.
-*/
-let _envSiteUrl = null;
-function getEnvSiteUrl() {
-	if (_envSiteUrl !== null) return _envSiteUrl || void 0;
-	try {
-		const value = typeof process !== "undefined" && process.env?.DINEWAY_SITE_URL || typeof process !== "undefined" && process.env?.SITE_URL || "";
-		if (value) {
-			const parsed = new URL(value);
-			if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-				_envSiteUrl = "";
-				return;
-			}
-			_envSiteUrl = parsed.origin;
-		} else _envSiteUrl = "";
-	} catch {
-		_envSiteUrl = "";
-	}
-	return _envSiteUrl || void 0;
-}
-/**
-* Return the public-facing origin for the site.
-*
-* Resolution order:
-*   1. `config.siteUrl` (set in astro.config.mjs, origin-normalized at startup)
-*   2. `DINEWAY_SITE_URL` or `SITE_URL` env var (resolved at runtime for containers)
-*   3. `url.origin` (internal request URL — correct when no proxy)
-*
-* @param url  The request URL (`new URL(request.url)` or `Astro.url`)
-* @param config  The Dineway config (from `locals.dineway?.config`)
-* @returns Origin string, e.g. `"https://mysite.example.com"`
-*/
-function getPublicOrigin(url, config) {
-	return config?.siteUrl || getEnvSiteUrl() || url.origin;
-}
-
-//#endregion
-//#region src/api/handlers/api-tokens.ts
-/**
-* Resolve a raw API token (ec_pat_...) to a user ID and scopes.
-* Updates last_used_at on successful lookup.
-* Returns null if the token is invalid or expired.
-*/
-async function resolveApiToken(db, rawToken) {
-	const hash = hashApiToken(rawToken);
-	const row = await db.selectFrom("_dineway_api_tokens").select([
-		"id",
-		"user_id",
-		"scopes",
-		"expires_at"
-	]).where("token_hash", "=", hash).executeTakeFirst();
-	if (!row) return null;
-	if (row.expires_at && new Date(row.expires_at) < /* @__PURE__ */ new Date()) return null;
-	db.updateTable("_dineway_api_tokens").set({ last_used_at: (/* @__PURE__ */ new Date()).toISOString() }).where("id", "=", row.id).execute().catch(() => {});
-	return {
-		userId: row.user_id,
-		scopes: JSON.parse(row.scopes),
-		tokenId: row.id
-	};
-}
-/**
-* Resolve an OAuth access token (ec_oat_...) to a user ID and scopes.
-* Returns null if the token is invalid or expired.
-*/
-async function resolveOAuthToken(db, rawToken) {
-	const hash = hashApiToken(rawToken);
-	const row = await db.selectFrom("_dineway_oauth_tokens").select([
-		"user_id",
-		"scopes",
-		"expires_at",
-		"token_type"
-	]).where("token_hash", "=", hash).where("token_type", "=", "access").executeTakeFirst();
-	if (!row) return null;
-	if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) return null;
-	return {
-		userId: row.user_id,
-		scopes: JSON.parse(row.scopes)
-	};
-}
-
 //#endregion
 //#region src/astro/middleware/csp.ts
 /**
@@ -241,9 +150,10 @@ const CSRF_EXEMPT_PUBLIC_ROUTES = new Set([
 	"/_dineway/api/oauth/device/code",
 	"/_dineway/api/oauth/device/token"
 ]);
-function isPublicDinewayRoute(pathname) {
+function isPublicDinewayRoute(pathname, authProviders = []) {
 	if (PUBLIC_API_EXACT.has(pathname)) return true;
 	if (PUBLIC_API_PREFIXES.some((p) => pathname.startsWith(p))) return true;
+	for (const provider of authProviders) for (const route of provider.publicRoutes ?? []) if (pathname.startsWith(route)) return true;
 	if (import.meta.env.DEV && pathname === "/_dineway/api/typegen") return true;
 	return false;
 }
@@ -255,7 +165,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 	const isAdminRoute = url.pathname.startsWith("/_dineway/admin");
 	const isSetupRoute = url.pathname.startsWith("/_dineway/admin/setup");
 	const isApiRoute = url.pathname.startsWith("/_dineway/api");
-	const isPublicApiRoute = isPublicDinewayRoute(url.pathname);
+	const isPublicApiRoute = isPublicDinewayRoute(url.pathname, context.locals.dineway?.config?.authProviders);
 	const isPublicRoute = !isAdminRoute && !isApiRoute;
 	if (isPublicApiRoute) {
 		if (isUnsafeMethod(context.request.method.toUpperCase()) && !isCsrfExemptPublicRoute(url.pathname)) {
@@ -619,7 +529,7 @@ const SCOPE_RULES = [
 	[
 		"/_dineway/api/taxonomies",
 		"WRITE",
-		"content:write"
+		"taxonomies:manage"
 	],
 	[
 		"/_dineway/api/menus",
@@ -629,7 +539,7 @@ const SCOPE_RULES = [
 	[
 		"/_dineway/api/menus",
 		"WRITE",
-		"content:write"
+		"menus:manage"
 	],
 	[
 		"/_dineway/api/sections",
@@ -682,14 +592,19 @@ const SCOPE_RULES = [
 		"admin"
 	],
 	[
-		"/_dineway/api/settings",
+		"/_dineway/api/plugins",
 		"*",
 		"admin"
 	],
 	[
-		"/_dineway/api/plugins",
-		"*",
-		"admin"
+		"/_dineway/api/settings",
+		"GET",
+		"settings:read"
+	],
+	[
+		"/_dineway/api/settings",
+		"WRITE",
+		"settings:manage"
 	],
 	[
 		"/_dineway/api/mcp",

package/dist/astro/middleware/redirect.mjs

@@ -1,9 +1,10 @@
 import { getRequestContext } from "../../request-context.mjs";
 import "../../dialect-helpers-DhTzaUxP.mjs";
-import "../../base64-F8-DUraK.mjs";
-import "../../types-BawVha09.mjs";
-import { t as RedirectRepository } from "../../redirect-DnEWAkVg.mjs";
-import { a as matchCachedPatterns, n as compileRedirectRules, o as setCachedPatternRules, r as getCachedPatternRules } from "../../cache-BdSY-gQN.mjs";
+import "../../base64-Cz-aU0X1.mjs";
+import "../../types-Bs6lTBBW.mjs";
+import { t as RedirectRepository } from "../../redirect-CGl64yOX.mjs";
+import { a as matchCachedPatterns, n as compileRedirectRules, o as setCachedRedirects, r as getCachedRedirects } from "../../cache-DEbQ13c9.mjs";
+import { r as getDb } from "../../loader-PZnPxFLc.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/astro/middleware/redirect.ts
@@ -33,23 +34,32 @@ const onRequest = defineMiddleware(async (context, next) => {
 	const { pathname } = context.url;
 	if (SKIP_PREFIXES.some((prefix) => pathname.startsWith(prefix))) return next();
 	if (ASSET_EXTENSION.test(pathname)) return next();
-	const { dineway } = context.locals;
-	if (!dineway?.db) return next();
+	let db = context.locals.dineway?.db;
+	if (!db) try {
+		db = await getDb();
+	} catch {
+		return next();
+	}
 	try {
-		const repo = new RedirectRepository(dineway.db);
-		const exact = await repo.findExactMatch(pathname);
+		const repo = new RedirectRepository(db);
+		const hasDbOverride = !!getRequestContext()?.db;
+		let exact = null;
+		let rules;
+		if (hasDbOverride) {
+			exact = await repo.findExactMatch(pathname);
+			rules = compileRedirectRules(await repo.findEnabledPatternRules());
+		} else {
+			let cached = getCachedRedirects();
+			if (!cached) cached = setCachedRedirects(await repo.findAllEnabled());
+			exact = cached.exact.get(pathname) ?? null;
+			rules = cached.patterns;
+		}
 		if (exact) {
 			if (exact.destination.startsWith("//") || exact.destination.startsWith("/\\")) return next();
 			repo.recordHit(exact.id).catch(() => {});
 			const code = isRedirectCode(exact.type) ? exact.type : 301;
 			return context.redirect(exact.destination, code);
 		}
-		const hasDbOverride = !!getRequestContext()?.db;
-		let rules = !hasDbOverride ? getCachedPatternRules() : null;
-		if (!rules) {
-			const patternRedirects = await repo.findEnabledPatternRules();
-			rules = hasDbOverride ? compileRedirectRules(patternRedirects) : setCachedPatternRules(patternRedirects);
-		}
 		const patternMatch = matchCachedPatterns(rules, pathname);
 		if (patternMatch) {
 			const { redirect, destination } = patternMatch;

package/dist/astro/middleware/request-context.mjs

@@ -1,6 +1,8 @@
 import { runWithContext } from "../../request-context.mjs";
-import "../../base64-F8-DUraK.mjs";
-import { n as parseContentId, r as verifyPreviewToken } from "../../tokens-CJz9ubV6.mjs";
+import "../../base64-Cz-aU0X1.mjs";
+import "../../options-z8VVg1Ll.mjs";
+import { n as parseContentId, r as verifyPreviewToken } from "../../tokens-BOJw-D9F.mjs";
+import { i as resolveSecretsCached } from "../../secrets-CkoJ9zN0.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/visual-editing/toolbar.ts
@@ -1339,11 +1341,12 @@ const onRequest = defineMiddleware(async (context, next) => {
 	const locale = context.currentLocale;
 	let preview;
 	if (hasPreviewToken) {
-		const secret = import.meta.env.DINEWAY_PREVIEW_SECRET || import.meta.env.PREVIEW_SECRET || "";
-		if (secret) {
+		const db = context.locals.dineway?.db;
+		if (db) {
+			const { previewSecret } = await resolveSecretsCached(db);
 			const result = await verifyPreviewToken({
 				url,
-				secret
+				secret: previewSecret
 			});
 			if (result.valid) {
 				const { collection, id } = parseContentId(result.payload.cid);
@@ -1352,7 +1355,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 					id
 				};
 			}
-		}
+		} else console.warn("[dineway] Preview token present but Dineway runtime not initialized; preview disabled.");
 	}
 	if (hasEditCookie || hasPreviewToken) return runWithContext({
 		editMode,

package/dist/astro/middleware/setup.mjs

@@ -1,4 +1,4 @@
-import { t as getAuthMode } from "../../mode-47goXBBK.mjs";
+import { t as getAuthMode } from "../../mode-DUhxwUhv.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/astro/middleware/setup.ts