dineway 0.1.9 → 0.1.12

package/dist/settings-DGtLLSaz.mjs

@@ -0,0 +1,237 @@
+import { t as MediaRepository } from "./media-_7Fxdu45.mjs";
+import { t as OptionsRepository } from "./options-z8VVg1Ll.mjs";
+import { r as getDb } from "./loader-PZnPxFLc.mjs";
+import { n as requestCached, t as peekRequestCache } from "./request-cache-DHMRr2Lf.mjs";
+
+//#region src/media/url.ts
+const INTERNAL_MEDIA_PREFIX = "/_dineway/api/media/file/";
+const SAFE_STORAGE_KEY = /^[A-Za-z0-9._-]+$/;
+function resolvePublicMediaUrl(storage, storageKey) {
+	if (!storageKey) return "";
+	if (storage) return storage.getPublicUrl(storageKey);
+	return `${INTERNAL_MEDIA_PREFIX}${storageKey}`;
+}
+function createPublicMediaUrlResolver(storage) {
+	return (key) => resolvePublicMediaUrl(storage, key);
+}
+function buildRenderMediaUrl(resolve, ref) {
+	const { storageKey, url, id } = ref;
+	if (storageKey) return resolve ? resolve(storageKey) : `${INTERNAL_MEDIA_PREFIX}${storageKey}`;
+	if (url) {
+		if (resolve && url.startsWith(INTERNAL_MEDIA_PREFIX)) {
+			const key = url.slice(25);
+			if (SAFE_STORAGE_KEY.test(key)) return resolve(key);
+		}
+		return url;
+	}
+	if (id) return `${INTERNAL_MEDIA_PREFIX}${id}`;
+	return "";
+}
+
+//#endregion
+//#region src/settings/index.ts
+/** Prefix for site settings in the options table */
+const SETTINGS_PREFIX = "site:";
+const SITE_SETTINGS_CACHE_KEY = Symbol.for("dineway:site-settings");
+const globalCache = globalThis;
+const siteSettingsCache = globalCache[SITE_SETTINGS_CACHE_KEY] ?? (() => {
+	const holder = {
+		version: 0,
+		cached: null,
+		cachedVersion: -1
+	};
+	globalCache[SITE_SETTINGS_CACHE_KEY] = holder;
+	return holder;
+})();
+function invalidateSiteSettingsCache() {
+	siteSettingsCache.version++;
+	siteSettingsCache.cached = null;
+	siteSettingsCache.cachedVersion = -1;
+}
+/**
+* Type guard for MediaReference values
+*/
+function isMediaReference(value) {
+	return typeof value === "object" && value !== null && "mediaId" in value;
+}
+/**
+* Resolve a media reference to include the full URL and content metadata.
+*/
+async function resolveMediaReference(mediaRef, db, storage) {
+	if (!mediaRef?.mediaId) return mediaRef;
+	try {
+		const media = await new MediaRepository(db).findById(mediaRef.mediaId);
+		if (media) return {
+			...mediaRef,
+			url: resolvePublicMediaUrl(storage, media.storageKey),
+			contentType: media.mimeType,
+			...media.width !== null ? { width: media.width } : {},
+			...media.height !== null ? { height: media.height } : {}
+		};
+	} catch {}
+	return mediaRef;
+}
+/**
+* Get a single site setting by key
+*
+* Returns `undefined` if the setting has not been configured.
+* For media settings (logo, favicon), the URL is resolved automatically.
+*
+* @param key - The setting key (e.g., "title", "logo", "social")
+* @returns The setting value, or undefined if not set
+*
+* @example
+* ```ts
+* import { getSiteSetting } from "dineway";
+*
+* const title = await getSiteSetting("title");
+* const logo = await getSiteSetting("logo");
+* console.log(logo?.url); // Resolved URL
+* ```
+*/
+async function getSiteSetting(key) {
+	const primed = peekRequestCache("siteSettings");
+	if (primed) return (await primed)[key];
+	return requestCached(`siteSetting:${key}`, async () => {
+		return getSiteSettingWithDb(key, await getDb());
+	});
+}
+/**
+* Get a single site setting by key (with explicit db)
+*
+* @internal Use `getSiteSetting()` in templates. This variant is for admin routes
+* that already have a database handle.
+*/
+async function getSiteSettingWithDb(key, db, storage = null) {
+	const value = await new OptionsRepository(db).get(`${SETTINGS_PREFIX}${key}`);
+	if (!value) return;
+	if ((key === "logo" || key === "favicon") && isMediaReference(value)) return await resolveMediaReference(value, db, storage);
+	return value;
+}
+/**
+* Get all site settings
+*
+* Returns all configured settings. Unset values are undefined.
+* Media references (logo/favicon) are resolved to include URLs.
+*
+* @example
+* ```ts
+* import { getSiteSettings } from "dineway";
+*
+* const settings = await getSiteSettings();
+* console.log(settings.title); // "My Site"
+* console.log(settings.logo?.url); // "/_dineway/api/media/file/abc123"
+* ```
+*/
+async function getSiteSettings() {
+	return requestCached("siteSettings", () => {
+		const versionAtCall = siteSettingsCache.version;
+		if (siteSettingsCache.cached && siteSettingsCache.cachedVersion === versionAtCall) return siteSettingsCache.cached;
+		const fetchPromise = (async () => {
+			return getSiteSettingsWithDb(await getDb());
+		})().catch((error) => {
+			if (siteSettingsCache.cached === fetchPromise) {
+				siteSettingsCache.cached = null;
+				siteSettingsCache.cachedVersion = -1;
+			}
+			throw error;
+		});
+		siteSettingsCache.cached = fetchPromise;
+		siteSettingsCache.cachedVersion = versionAtCall;
+		return fetchPromise;
+	});
+}
+/**
+* Get all site settings (with explicit db)
+*
+* @internal Use `getSiteSettings()` in templates. This variant is for admin routes
+* that already have a database handle.
+*/
+async function getSiteSettingsWithDb(db, storage = null) {
+	const allOptions = await new OptionsRepository(db).getByPrefix(SETTINGS_PREFIX);
+	const settings = {};
+	for (const [key, value] of allOptions) {
+		const settingKey = key.replace(SETTINGS_PREFIX, "");
+		settings[settingKey] = value;
+	}
+	const typedSettings = settings;
+	if (typedSettings.logo) typedSettings.logo = await resolveMediaReference(typedSettings.logo, db, storage);
+	if (typedSettings.favicon) typedSettings.favicon = await resolveMediaReference(typedSettings.favicon, db, storage);
+	return typedSettings;
+}
+/**
+* Set site settings (internal function used by admin API)
+*
+* Merges provided settings with existing ones. Only provided fields are updated.
+* Media references should include just the mediaId; URLs are resolved on read.
+*
+* @param settings - Partial settings object with values to update
+* @param db - Kysely database instance
+* @returns Promise that resolves when settings are saved
+*
+* @internal
+*
+* @example
+* ```ts
+* // Update multiple settings at once
+* await setSiteSettings({
+*   title: "My Site",
+*   tagline: "Welcome",
+*   logo: { mediaId: "med_123", alt: "Logo" }
+* }, db);
+* ```
+*/
+async function setSiteSettings(settings, db) {
+	const options = new OptionsRepository(db);
+	const updates = {};
+	for (const [key, value] of Object.entries(settings)) if (value !== void 0) updates[`${SETTINGS_PREFIX}${key}`] = value;
+	try {
+		await options.setMany(updates);
+	} finally {
+		invalidateSiteSettingsCache();
+	}
+}
+/**
+* Get a single plugin setting by key.
+*
+* Plugin settings are stored in the options table under
+* `plugin:<pluginId>:settings:<key>`.
+*/
+async function getPluginSetting(pluginId, key) {
+	return getPluginSettingWithDb(pluginId, key, await getDb());
+}
+/**
+* Get a single plugin setting by key (with explicit db).
+*
+* @internal Use `getPluginSetting()` in templates and plugin rendering code.
+*/
+async function getPluginSettingWithDb(pluginId, key, db) {
+	return await new OptionsRepository(db).get(`plugin:${pluginId}:settings:${key}`) ?? void 0;
+}
+/**
+* Get all persisted plugin settings for a plugin.
+*
+* Defaults declared in `admin.settingsSchema` are not materialized
+* automatically; callers should apply their own fallback defaults.
+*/
+async function getPluginSettings(pluginId) {
+	return getPluginSettingsWithDb(pluginId, await getDb());
+}
+/**
+* Get all persisted plugin settings for a plugin (with explicit db).
+*
+* @internal Use `getPluginSettings()` in templates and plugin rendering code.
+*/
+async function getPluginSettingsWithDb(pluginId, db) {
+	const prefix = `plugin:${pluginId}:settings:`;
+	const allOptions = await new OptionsRepository(db).getByPrefix(prefix);
+	const settings = {};
+	for (const [key, value] of allOptions) {
+		if (!key.startsWith(prefix)) continue;
+		settings[key.slice(prefix.length)] = value;
+	}
+	return settings;
+}
+
+//#endregion
+export { getSiteSettingsWithDb as a, createPublicMediaUrlResolver as c, getSiteSettings as i, getPluginSettings as n, setSiteSettings as o, getSiteSetting as r, buildRenderMediaUrl as s, getPluginSetting as t };

package/dist/settings-Dzgswvg4.mjs

@@ -0,0 +1,50 @@
+import { t as __exportAll } from "./chunk-ClPoSABd.mjs";
+import { a as getSiteSettingsWithDb, o as setSiteSettings } from "./settings-DGtLLSaz.mjs";
+
+//#region src/api/handlers/settings.ts
+var settings_exports = /* @__PURE__ */ __exportAll({
+	handleSettingsGet: () => handleSettingsGet,
+	handleSettingsUpdate: () => handleSettingsUpdate
+});
+/**
+* Get all site settings
+*/
+async function handleSettingsGet(db, storage) {
+	try {
+		return {
+			success: true,
+			data: await getSiteSettingsWithDb(db, storage)
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "SETTINGS_READ_ERROR",
+				message: "Failed to get settings"
+			}
+		};
+	}
+}
+/**
+* Update site settings
+*/
+async function handleSettingsUpdate(db, storage, input) {
+	try {
+		await setSiteSettings(input, db);
+		return {
+			success: true,
+			data: await getSiteSettingsWithDb(db, storage)
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "SETTINGS_UPDATE_ERROR",
+				message: "Failed to update settings"
+			}
+		};
+	}
+}
+
+//#endregion
+export { handleSettingsUpdate as n, settings_exports as r, handleSettingsGet as t };

package/dist/setup-complete-ChilE-da.mjs

@@ -0,0 +1,21 @@
+import { t as OptionsRepository } from "./options-z8VVg1Ll.mjs";
+
+//#region src/api/setup-complete.ts
+/**
+* Finalize setup after the first admin user is created.
+*
+* Safe to call multiple times: if setup is already complete, this no-ops.
+*/
+async function finalizeSetup(db) {
+	const options = new OptionsRepository(db);
+	const setupComplete = await options.get("dineway:setup_complete");
+	if (setupComplete === true || setupComplete === "true") return;
+	const setupState = await options.get("dineway:setup_state");
+	if (typeof setupState?.title === "string") await options.set("dineway:site_title", setupState.title);
+	if (typeof setupState?.tagline === "string") await options.set("dineway:site_tagline", setupState.tagline);
+	await options.set("dineway:setup_complete", true);
+	await options.delete("dineway:setup_state");
+}
+
+//#endregion
+export { finalizeSetup as t };

package/dist/setup-nonce-BpmLXAuu.mjs

@@ -0,0 +1,17 @@
+//#region src/auth/setup-nonce.ts
+/**
+* Session binding for the first-setup admin-creation flow.
+*
+* Shared constants for the nonce cookie that ties /_dineway/api/setup/admin
+* and /_dineway/api/setup/admin/verify to the same browser.
+*/
+/** Cookie name carrying the setup-admin session nonce. */
+const SETUP_NONCE_COOKIE = "dineway_setup_nonce";
+/**
+* Cookie max-age in seconds. One hour is enough time to complete a passkey
+* registration; if the user lingers longer the admin step can be retried.
+*/
+const SETUP_NONCE_MAX_AGE_SECONDS = 3600;
+
+//#endregion
+export { SETUP_NONCE_MAX_AGE_SECONDS as n, SETUP_NONCE_COOKIE as t };

package/dist/sidecar-client-B1C6Cf80.mjs

@@ -0,0 +1,66 @@
+//#region src/preview/sidecar-client.ts
+/**
+* Preview sidecar protocol helpers.
+*
+* These utilities define the signed URL and snapshot-auth contract shared
+* by preview sidecars and the source site serving snapshot exports.
+*/
+/** Matches a lowercase hex string */
+const HEX_PATTERN = /^[0-9a-f]+$/;
+async function hmacSign(message, secret) {
+	const encoder = new TextEncoder();
+	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const buffer = await crypto.subtle.sign("HMAC", key, encoder.encode(message));
+	return Array.from(new Uint8Array(buffer), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function signPreviewUrl(previewBase, source, secret, ttl = 3600) {
+	const exp = Math.floor(Date.now() / 1e3) + ttl;
+	const sig = await hmacSign(`${source}:${exp}`, secret);
+	const url = new URL(previewBase);
+	url.searchParams.set("source", source);
+	url.searchParams.set("exp", String(exp));
+	url.searchParams.set("sig", sig);
+	return url.toString();
+}
+function buildPreviewSignatureHeader(signature) {
+	return `${signature.source}:${signature.exp}:${signature.sig}`;
+}
+function parsePreviewSignatureHeader(header) {
+	const lastColon = header.lastIndexOf(":");
+	if (lastColon <= 0) return null;
+	const sig = header.substring(lastColon + 1);
+	if (sig.length !== 64 || !HEX_PATTERN.test(sig)) return null;
+	const rest = header.substring(0, lastColon);
+	const secondLastColon = rest.lastIndexOf(":");
+	if (secondLastColon <= 0) return null;
+	const source = rest.substring(0, secondLastColon);
+	const exp = parseInt(rest.substring(secondLastColon + 1), 10);
+	if (isNaN(exp) || source.length === 0) return null;
+	return {
+		source,
+		exp,
+		sig
+	};
+}
+async function verifyPreviewSignature(source, exp, sig, secret) {
+	if (exp < Date.now() / 1e3) return false;
+	if (sig.length !== 64 || !HEX_PATTERN.test(sig)) return false;
+	const sigBytes = new Uint8Array(32);
+	for (let i = 0; i < 64; i += 2) sigBytes[i / 2] = parseInt(sig.substring(i, i + 2), 16);
+	const encoder = new TextEncoder();
+	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["verify"]);
+	return crypto.subtle.verify("HMAC", key, sigBytes, encoder.encode(`${source}:${exp}`));
+}
+const defaultPreviewSidecarClient = {
+	signPreviewUrl,
+	buildSnapshotSignatureHeader: buildPreviewSignatureHeader
+};
+
+//#endregion
+export { verifyPreviewSignature as a, signPreviewUrl as i, defaultPreviewSidecarClient as n, parsePreviewSignatureHeader as r, buildPreviewSignatureHeader as t };

package/dist/site-activity-B8FjLIVh.mjs

@@ -0,0 +1,104 @@
+import { n as decodeCursor, r as encodeCursor } from "./types-Bs6lTBBW.mjs";
+import { ulid } from "ulidx";
+
+//#region src/database/repositories/site-activity.ts
+var SiteActivityRepository = class {
+	constructor(db) {
+		this.db = db;
+	}
+	async create(input) {
+		const id = ulid();
+		const values = {
+			id,
+			actor_type: input.actorType,
+			actor_id: input.actorId,
+			auth_metadata: input.authMetadata ? JSON.stringify(input.authMetadata) : null,
+			action_type: input.actionType,
+			subject_type: input.subjectType,
+			subject_id: input.subjectId ?? null,
+			related_subject_type: input.relatedSubjectType ?? null,
+			related_subject_id: input.relatedSubjectId ?? null,
+			source_type: input.sourceType ?? null,
+			source_name: input.sourceName ?? null,
+			result_status: input.resultStatus ?? "succeeded",
+			scope: input.scope,
+			summary: input.summary,
+			detail: input.detail ? JSON.stringify(input.detail) : null,
+			created_at: input.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await this.db.insertInto("_dineway_activity_log").values(values).execute();
+		const activity = await this.findById(id);
+		if (!activity) throw new Error("Failed to create site activity");
+		return activity;
+	}
+	async findById(id) {
+		const row = await this.db.selectFrom("_dineway_activity_log").selectAll().where("id", "=", id).executeTakeFirst();
+		return row ? rowToSiteActivity(row) : null;
+	}
+	async findTimeline(query = {}) {
+		if (query.scopes && query.scopes.length === 0) return { items: [] };
+		const limit = Math.min(Math.max(1, query.limit ?? 50), 100);
+		let q = this.db.selectFrom("_dineway_activity_log").selectAll().orderBy("created_at", "desc").orderBy("id", "desc").limit(limit + 1);
+		if (query.scopes) q = q.where("scope", "in", query.scopes);
+		if (query.actorType) q = q.where("actor_type", "=", query.actorType);
+		if (query.actorId) q = q.where("actor_id", "=", query.actorId);
+		if (query.actionType) q = q.where("action_type", "=", query.actionType);
+		if (query.subjectType) q = q.where("subject_type", "=", query.subjectType);
+		if (query.subjectId) q = q.where("subject_id", "=", query.subjectId);
+		if (query.relatedSubjectType) q = q.where("related_subject_type", "=", query.relatedSubjectType);
+		if (query.relatedSubjectId) q = q.where("related_subject_id", "=", query.relatedSubjectId);
+		if (query.sourceType) q = q.where("source_type", "=", query.sourceType);
+		if (query.sourceName) q = q.where("source_name", "=", query.sourceName);
+		if (query.resultStatus) q = q.where("result_status", "=", query.resultStatus);
+		if (query.since) q = q.where("created_at", ">=", query.since);
+		if (query.until) q = q.where("created_at", "<=", query.until);
+		if (query.cursor) {
+			const decoded = decodeCursor(query.cursor);
+			if (decoded) q = q.where((eb) => eb.or([eb("created_at", "<", decoded.orderValue), eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)])]));
+		}
+		const rows = await q.execute();
+		const items = rows.slice(0, limit).map((row) => rowToSiteActivity(row));
+		const result = { items };
+		if (rows.length > limit && items.length > 0) {
+			const last = items.at(-1);
+			result.nextCursor = encodeCursor(last.createdAt, last.id);
+		}
+		return result;
+	}
+};
+function rowToSiteActivity(row) {
+	return {
+		id: row.id,
+		actorType: row.actor_type,
+		actorId: row.actor_id,
+		authMetadata: parseRecord(row.auth_metadata),
+		actionType: row.action_type,
+		subjectType: row.subject_type,
+		subjectId: row.subject_id,
+		relatedSubjectType: row.related_subject_type,
+		relatedSubjectId: row.related_subject_id,
+		sourceType: row.source_type,
+		sourceName: row.source_name,
+		resultStatus: row.result_status,
+		scope: row.scope,
+		summary: row.summary,
+		detail: parseRecord(row.detail),
+		createdAt: row.created_at
+	};
+}
+function parseRecord(value) {
+	if (!value) return null;
+	try {
+		const parsed = JSON.parse(value);
+		if (isRecord(parsed)) return parsed;
+		return null;
+	} catch {
+		return null;
+	}
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+//#endregion
+export { SiteActivityRepository as t };