dineway 0.1.9 → 0.1.12

package/dist/astro/middleware.mjs

@@ -4,28 +4,72 @@ import "../connection-BCNICDWN.mjs";
 import { t as validateIdentifier } from "../validate-VPnKoIzW.mjs";
 import { a as isSqlite } from "../dialect-helpers-DhTzaUxP.mjs";
 import { r as runMigrations } from "../runner-DWZm2KQm.mjs";
-import { $t as validateRev, B as DEV_CONSOLE_EMAIL_PLUGIN_ID, Bt as handleContentDuplicate, Ct as handleMediaDelete, Dt as handleRevisionGet, Et as handleMediaUpdate, Ft as handleContentCountScheduled, G as resolveExclusiveHooks, Gt as handleContentPermanentDelete, H as EmailPipeline, Ht as handleContentGetIncludingTrashed, It as handleContentCountTrashed, J as sanitizeHeadersForSandbox, Jt as handleContentSchedule, K as CronExecutor, Kt as handleContentPublish, Lt as handleContentCreate, Mt as hashString, Nt as PluginStateRepository, Ot as handleRevisionList, Pt as handleContentCompare, Qt as handleContentUpdate, Rt as handleContentDelete, St as handleMediaCreate, Tt as handleMediaList, Ut as handleContentList, V as devConsoleEmailDeliver, Vt as handleContentGet, W as createHookPipeline, Wt as handleContentListTrashed, X as definePlugin, Xt as handleContentUnpublish, Y as getTrustedProxyHeaders, Yt as handleContentTranslations, Zt as handleContentUnschedule, kt as handleRevisionRestore, pt as after, q as extractRequestMeta, qt as handleContentRestore, vt as createPluginBundleStore, wt as handleMediaGet, z as PluginRouteRegistry, zt as handleContentDiscardDraft } from "../search-DxopAWxs.mjs";
-import { r as RevisionRepository } from "../content-DWi4d0rT.mjs";
-import "../base64-F8-DUraK.mjs";
-import "../types-BawVha09.mjs";
-import { t as MediaRepository } from "../media-DMTr80Gv.mjs";
-import { p as OptionsRepository } from "../apply-iVSqz2qs.mjs";
-import "../redirect-DnEWAkVg.mjs";
-import "../byline-OhH2dlRu.mjs";
-import { n as normalizeMediaValue } from "../placeholder-Cp8g5Emj.mjs";
-import { i as setI18nConfig } from "../config-BXwuX8Bx.mjs";
-import { i as FTSManager, n as SchemaRegistry } from "../registry-C0zjeB9P.mjs";
-import { n as getDb } from "../loader-sMG4TZ-u.mjs";
-import "../request-cache-Dk5qPSOx.mjs";
-import { n as VERSION, t as COMMIT } from "../version-BPz1imu2.mjs";
-import "../taxonomies-1s5PaS_8.mjs";
-import { r as normalizeManifestRoute } from "../manifest-schema-D1MSVnoI.mjs";
-import { a as invalidateUrlPatternCache } from "../query-kDmwCsHh.mjs";
-import "../tokens-CJz9ubV6.mjs";
-import "../bylines-BGpD9_hy.mjs";
-import "../load-Coc9HpHH.mjs";
+import { d as EmailPipeline, g as after, h as definePlugin, m as resolveExclusiveHooks, p as createHookPipeline, u as PluginRouteRegistry } from "../plugins-D7-ILNib.mjs";
+import { r as RevisionRepository } from "../content-CyLkb-qH.mjs";
+import "../base64-Cz-aU0X1.mjs";
+import "../types-Bs6lTBBW.mjs";
+import { t as MediaRepository } from "../media-_7Fxdu45.mjs";
+import "../user-CcXq-zoL.mjs";
+import "../taxonomy-D5cbhc8u.mjs";
+import "../comment-DFO-gWDH.mjs";
+import { t as OptionsRepository } from "../options-z8VVg1Ll.mjs";
+import "../site-activity-B8FjLIVh.mjs";
+import "../review-requests-C2DIHwlJ.mjs";
+import "../entity-aliases-C0v-yNET.mjs";
+import "../context-CNIkMzot.mjs";
+import "../redirect-CGl64yOX.mjs";
+import "../byline-naZxOPSa.mjs";
+import { t as normalizeMediaValue } from "../normalize-C49G_o1k.mjs";
+import "../placeholder-C2P5fKa4.mjs";
+import "../seo-CUQctrog.mjs";
+import { i as setI18nConfig } from "../config-CAMFxGaV.mjs";
+import { $ as validateRev, A as handleRevisionGet, B as handleContentDuplicate, D as handleMediaGet, E as handleMediaDelete, F as handleContentCountScheduled, G as handleContentPermanentDelete, H as handleContentGetIncludingTrashed, I as handleContentCountTrashed, J as handleContentSchedule, K as handleContentPublish, L as handleContentCreate, M as handleRevisionRestore, O as handleMediaList, P as handleContentCompare, Q as handleContentUpdate, R as handleContentDelete, T as handleMediaCreate, U as handleContentList, V as handleContentGet, W as handleContentListTrashed, X as handleContentUnpublish, Y as handleContentTranslations, Z as handleContentUnschedule, d as createPluginBundleStore, j as handleRevisionList, k as handleMediaUpdate, q as handleContentRestore, z as handleContentDiscardDraft } from "../api-BR7Y0GBo.mjs";
+import "../dashboard-DqnYU8EU.mjs";
+import { u as PluginStateRepository } from "../briefing-MVYe_Uyf.mjs";
+import "../context-types-C-LwdAxx.mjs";
+import { t as FTSManager } from "../fts-manager-B1pTNEG_.mjs";
+import { n as SchemaRegistry } from "../registry-C-_hxLqa.mjs";
+import { r as getDb } from "../loader-PZnPxFLc.mjs";
+import { c as createPublicMediaUrlResolver } from "../settings-DGtLLSaz.mjs";
+import { n as requestCached } from "../request-cache-DHMRr2Lf.mjs";
+import "../briefing-rty4O-wa.mjs";
+import "../review-requests-DIyjw-K_.mjs";
+import { n as hashString } from "../hash-CDX7M0ze.mjs";
+import { n as VERSION, t as COMMIT } from "../version-D3vDb22n.mjs";
+import "../query-CsbOywSY.mjs";
+import "../zod-generator-DBVP8D0P.mjs";
+import "../schema-BECjUhP8.mjs";
+import "../seo-C007Luwn.mjs";
+import "../menus-DS3_5nWY.mjs";
+import "../sections-B61OxnfB.mjs";
+import "../settings-Dzgswvg4.mjs";
+import "../taxonomies-D2aZGuns.mjs";
+import "../taxonomies-z6Lz91BC.mjs";
+import { r as normalizeManifestRoute } from "../manifest-schema-CgFJAp0H.mjs";
+import "../parse-C9106ehs.mjs";
+import "../redirects-lrlmYXVE.mjs";
+import "../import-CNcKWTbp.mjs";
+import { a as invalidateUrlPatternCache } from "../query-B9BO5goQ.mjs";
+import "../preview-DvYRU-Oy.mjs";
+import "../import-BHRLhXAn.mjs";
+import { t as getTrustedProxyHeaders } from "../trusted-proxy-BbaZfkT9.mjs";
+import { n as sanitizeHeadersForSandbox, t as extractRequestMeta } from "../request-meta-DixlNKKa.mjs";
+import "../ssrf-DDwRxF6B.mjs";
+import { n as CronExecutor } from "../cron-CKxvBrRT.mjs";
+import { r as devConsoleEmailDeliver, t as DEV_CONSOLE_EMAIL_PLUGIN_ID } from "../email-console-CuefUXfX.mjs";
+import "../utils-C0ONdBul.mjs";
+import "../tokens-BOJw-D9F.mjs";
+import "../menus-DYW_UHjv.mjs";
+import "../bylines-C4LIBOOO.mjs";
+import "../widgets-B7DRpZvy.mjs";
+import "../apply-Bm5QgdrE.mjs";
+import "../load-B2XtDw__.mjs";
+import "../search-DqTHQqtV.mjs";
 import "../index.mjs";
-import { t as getAuthMode } from "../mode-47goXBBK.mjs";
+import { t as getAuthMode } from "../mode-DUhxwUhv.mjs";
+import { i as experimentalSiteContextWorkflowsEnabled } from "../experimental-workflows-C9X7yblQ.mjs";
+import { t as cleanupExpiredChallenges } from "../challenge-store-DDTbisbf.mjs";
+import { a as validateEncryptionKeyAtStartup } from "../secrets-CkoJ9zN0.mjs";
 import { Kysely, sql } from "kysely";
 import { defineMiddleware } from "astro:middleware";
 import virtualConfig from "virtual:dineway/config";
@@ -37,26 +81,6 @@ import { sandboxedPlugins } from "virtual:dineway/sandboxed-plugins";
 import { createStorage } from "virtual:dineway/storage";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 
-//#region src/site-context/experimental-workflows.ts
-const EXPERIMENTAL_SITE_CONTEXT_WORKFLOWS_ENV = "DINEWAY_EXPERIMENTAL_SITE_CONTEXT_WORKFLOWS";
-function experimentalSiteContextWorkflowsEnabled() {
-	const value = process.env[EXPERIMENTAL_SITE_CONTEXT_WORKFLOWS_ENV];
-	return value === "1" || value === "true";
-}
-
-//#endregion
-//#region src/auth/challenge-store.ts
-/**
-* Clean up expired challenges.
-* Should be called periodically (e.g., on startup, or via cron).
-*/
-async function cleanupExpiredChallenges(db) {
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	const result = await db.deleteFrom("auth_challenges").where("expires_at", "<", now).executeTakeFirst();
-	return Number(result.numDeletedRows ?? 0);
-}
-
-//#endregion
 //#region src/cleanup.ts
 /**
 * System cleanup
@@ -314,8 +338,6 @@ function shouldUsePiggybackScheduler(createTimer = () => globalThis.setTimeout((
 
 //#endregion
 //#region src/dineway-runtime.ts
-const MANIFEST_CACHE_OPTION = "dineway:manifest_cache";
-const MANIFEST_CACHE_SCHEMA_VERSION = "dineway-manifest-cache-v1";
 const LEADING_SLASH_PATTERN = /^\//;
 const VALID_METADATA_KINDS = new Set([
 	"meta",
@@ -365,16 +387,6 @@ function parseStringArray(value) {
 		return [];
 	}
 }
-function isRecord(value) {
-	return !!value && typeof value === "object";
-}
-function isPersistedManifestCache(value) {
-	if (!isRecord(value)) return false;
-	if (typeof value.key !== "string") return false;
-	if (!isRecord(value.manifest)) return false;
-	const manifest = value.manifest;
-	return typeof manifest.version === "string" && (typeof manifest.commit === "undefined" || typeof manifest.commit === "string") && typeof manifest.hash === "string" && !!manifest.collections && typeof manifest.collections === "object" && !!manifest.plugins && typeof manifest.plugins === "object" && isRecord(manifest.features) && typeof manifest.features.siteContextWorkflows === "boolean";
-}
 function serializeAdminBranding(config) {
 	const admin = config.admin;
 	if (!admin) return "";
@@ -384,22 +396,6 @@ function serializeAdminBranding(config) {
 		favicon: admin.favicon ?? ""
 	});
 }
-async function createManifestCacheKey(deps) {
-	const pluginKeys = deps.plugins.map((plugin) => `${plugin.id}@${plugin.version ?? ""}`).toSorted();
-	const sandboxedPluginKeys = deps.sandboxedPluginEntries.map((entry) => `${entry.id}@${entry.version}`).toSorted();
-	const i18nConfig = virtualConfig?.i18n;
-	const locales = (i18nConfig?.locales ?? []).toSorted();
-	return hashString([
-		MANIFEST_CACHE_SCHEMA_VERSION,
-		`version:${VERSION}:${COMMIT}`,
-		deps.config.marketplace ? "marketplace:1" : "marketplace:0",
-		`site-context-workflows:${experimentalSiteContextWorkflowsEnabled() ? "1" : "0"}`,
-		`admin:${serializeAdminBranding(deps.config)}`,
-		`plugins:${pluginKeys.join(",")}`,
-		`sandboxed:${sandboxedPluginKeys.join(",")}`,
-		`i18n:${i18nConfig?.defaultLocale ?? ""}:${locales.join(",")}`
-	].join("|"));
-}
 /**
 * Map schema field types to editor field kinds
 */
@@ -480,9 +476,6 @@ var DinewayRuntime = class DinewayRuntime {
 	_searchHealthChecked = false;
 	/** Shared in-flight FTS health verification promise. */
 	_searchHealthPromise = null;
-	_cachedManifest = null;
-	_manifestPromise = null;
-	_manifestCacheKey;
 	/**
 	* Get the database instance for the current request.
 	*
@@ -496,7 +489,7 @@ var DinewayRuntime = class DinewayRuntime {
 		if (requestDb) return requestDb;
 		return this._db;
 	}
-	constructor(db, storage, configuredPlugins, sandboxedPlugins, sandboxedPluginEntries, hooks, enabledPlugins, pluginStates, config, mediaProviders, mediaProviderEntries, cronExecutor, cronScheduler, emailPipeline, allPipelinePlugins, pipelineFactoryOptions, runtimeDeps, pipelineRef, manifestCacheKey = MANIFEST_CACHE_SCHEMA_VERSION) {
+	constructor(db, storage, configuredPlugins, sandboxedPlugins, sandboxedPluginEntries, hooks, enabledPlugins, pluginStates, config, mediaProviders, mediaProviderEntries, cronExecutor, cronScheduler, emailPipeline, allPipelinePlugins, pipelineFactoryOptions, runtimeDeps, pipelineRef) {
 		this._db = db;
 		this.storage = storage;
 		this.configuredPlugins = configuredPlugins;
@@ -516,7 +509,6 @@ var DinewayRuntime = class DinewayRuntime {
 		this.pipelineFactoryOptions = pipelineFactoryOptions;
 		this.runtimeDeps = runtimeDeps;
 		this.pipelineRef = pipelineRef;
-		this._manifestCacheKey = manifestCacheKey;
 	}
 	/**
 	* Get the sandbox runner instance (for marketplace install/update)
@@ -695,6 +687,7 @@ var DinewayRuntime = class DinewayRuntime {
 	*/
 	static async create(deps) {
 		const db = await DinewayRuntime.getDatabase(deps);
+		await validateEncryptionKeyAtStartup();
 		const storage = DinewayRuntime.getStorage(deps);
 		let pluginStates = /* @__PURE__ */ new Map();
 		try {
@@ -724,7 +717,7 @@ var DinewayRuntime = class DinewayRuntime {
 			const devConsolePlugin = definePlugin({
 				id: DEV_CONSOLE_EMAIL_PLUGIN_ID,
 				version: "0.0.0",
-				capabilities: ["email:provide"],
+				capabilities: ["hooks.email-transport:register"],
 				hooks: { "email:deliver": {
 					exclusive: true,
 					handler: devConsoleEmailDeliver
@@ -739,7 +732,7 @@ var DinewayRuntime = class DinewayRuntime {
 			const defaultModeratorPlugin = definePlugin({
 				id: DEFAULT_COMMENT_MODERATOR_PLUGIN_ID,
 				version: "0.0.0",
-				capabilities: ["read:users"],
+				capabilities: ["users:read"],
 				hooks: { "comment:moderate": {
 					exclusive: true,
 					handler: defaultCommentModerate
@@ -818,8 +811,7 @@ var DinewayRuntime = class DinewayRuntime {
 		} catch (error) {
 			console.warn("[cron] Failed to initialize cron system:", error);
 		}
-		const manifestCacheKey = await createManifestCacheKey(deps);
-		return new DinewayRuntime(db, storage, deps.plugins, sandboxedPlugins, deps.sandboxedPluginEntries, pipeline, enabledPlugins, pluginStates, deps.config, mediaProviders, mediaProviderEntries, cronExecutor, cronScheduler, emailPipeline, allPipelinePlugins, pipelineFactoryOptions, deps, pipelineRef, manifestCacheKey);
+		return new DinewayRuntime(db, storage, deps.plugins, sandboxedPlugins, deps.sandboxedPluginEntries, pipeline, enabledPlugins, pluginStates, deps.config, mediaProviders, mediaProviderEntries, cronExecutor, cronScheduler, emailPipeline, allPipelinePlugins, pipelineFactoryOptions, deps, pipelineRef);
 	}
 	/**
 	* Get a media provider by ID
@@ -859,10 +851,7 @@ var DinewayRuntime = class DinewayRuntime {
 				dialect: deps.createDialect(dbConfig.config),
 				log: kyselyLogOption()
 			});
-			const { applied } = await runMigrations(db);
-			if (applied.length > 0) try {
-				await new OptionsRepository(db).delete(MANIFEST_CACHE_OPTION);
-			} catch {}
+			await runMigrations(db);
 			try {
 				const [collectionCount, setupOption] = await Promise.all([db.selectFrom("_dineway_collections").select((eb) => eb.fn.countAll().as("count")).executeTakeFirstOrThrow(), db.selectFrom("options").select("value").where("name", "=", "dineway:setup_complete").executeTakeFirst()]);
 				const setupDone = (() => {
@@ -873,9 +862,9 @@ var DinewayRuntime = class DinewayRuntime {
 					}
 				})();
 				if (collectionCount.count === 0 && !setupDone) {
-					const { applySeed } = await import("../apply-iVSqz2qs.mjs").then((n) => n.n);
-					const { loadSeed } = await import("../load-Coc9HpHH.mjs").then((n) => n.r);
-					const { validateSeed } = await import("../validate-BZ5wnLLp.mjs").then((n) => n.n);
+					const { applySeed } = await import("../apply-Bm5QgdrE.mjs").then((n) => n.n);
+					const { loadSeed } = await import("../load-B2XtDw__.mjs").then((n) => n.r);
+					const { validateSeed } = await import("../validate-C7TzfamJ.mjs").then((n) => n.n);
 					const seed = await loadSeed();
 					if (validateSeed(seed).valid) {
 						await applySeed(db, seed, { onConflict: "skip" });
@@ -1014,55 +1003,16 @@ var DinewayRuntime = class DinewayRuntime {
 			preferredHints
 		});
 	}
-	/**
-	* Return the admin manifest, reusing the runtime/persisted cache when
-	* singleton DB state is active. Request-scoped database overrides bypass
-	* the cache so sidecar/playground sessions see their own schema.
-	*/
 	async getManifest() {
-		if (getRequestContextDatabase()) return this._buildManifest();
-		if (this._cachedManifest) return this._cachedManifest;
-		try {
-			const cached = await new OptionsRepository(this._db).get(MANIFEST_CACHE_OPTION);
-			if (isPersistedManifestCache(cached) && cached.key === this._manifestCacheKey) {
-				this._cachedManifest = cached.manifest;
-				return cached.manifest;
-			}
-		} catch {}
-		if (!this._manifestPromise) {
-			let manifestPromise;
-			const isCurrentLoad = () => this._manifestPromise === manifestPromise;
-			manifestPromise = this._loadManifest(isCurrentLoad);
-			this._manifestPromise = manifestPromise;
-		}
-		return this._manifestPromise;
-	}
-	async _loadManifest(isCurrentLoad) {
-		try {
-			const manifest = await this._buildManifest();
-			if (isCurrentLoad()) {
-				this._cachedManifest = manifest;
-				try {
-					await new OptionsRepository(this._db).set(MANIFEST_CACHE_OPTION, {
-						key: this._manifestCacheKey,
-						manifest
-					});
-				} catch {}
-			}
-			return manifest;
-		} finally {
-			if (isCurrentLoad()) this._manifestPromise = null;
-		}
+		return requestCached("dineway:manifest", () => this._buildManifest());
 	}
 	async _buildManifest() {
 		const manifestCollections = {};
 		try {
-			const registry = new SchemaRegistry(this.db);
-			const dbCollections = await registry.listCollections();
+			const dbCollections = await new SchemaRegistry(this.db).listCollectionsWithFields();
 			for (const collection of dbCollections) {
-				const collectionWithFields = await registry.getCollectionWithFields(collection.slug);
 				const fields = {};
-				if (collectionWithFields?.fields) for (const field of collectionWithFields.fields) {
+				for (const field of collection.fields) {
 					const entry = {
 						kind: FIELD_TYPE_TO_KIND[field.type] ?? "string",
 						label: field.label,
@@ -1174,16 +1124,8 @@ var DinewayRuntime = class DinewayRuntime {
 			admin: this.config.admin
 		};
 	}
-	/**
-	* Invalidate cached manifest state after schema, taxonomy, or plugin changes.
-	*/
 	invalidateManifest() {
-		this._cachedManifest = null;
-		this._manifestPromise = null;
 		invalidateUrlPatternCache();
-		new OptionsRepository(this._db).delete(MANIFEST_CACHE_OPTION).catch((error) => {
-			console.debug("Dineway: Could not clear manifest cache:", error);
-		});
 	}
 	async handleContentList(collection, params) {
 		return handleContentList(this.db, collection, params);
@@ -1209,7 +1151,7 @@ var DinewayRuntime = class DinewayRuntime {
 		return result;
 	}
 	async handleContentUpdate(collection, id, body) {
-		const { ContentRepository } = await import("../content-DWi4d0rT.mjs").then((n) => n.n);
+		const { ContentRepository } = await import("../content-CyLkb-qH.mjs").then((n) => n.n);
 		const repo = new ContentRepository(this.db);
 		const resolvedItem = await repo.findByIdOrSlug(collection, id);
 		const resolvedId = resolvedItem?.id ?? id;
@@ -1322,8 +1264,8 @@ var DinewayRuntime = class DinewayRuntime {
 	async handleContentDuplicate(collection, id, authorId) {
 		return handleContentDuplicate(this.db, collection, id, authorId);
 	}
-	async handleContentPublish(collection, id) {
-		const result = await handleContentPublish(this.db, collection, id);
+	async handleContentPublish(collection, id, options = {}) {
+		const result = await handleContentPublish(this.db, collection, id, options);
 		if (result.success && result.data) this.runAfterPublishHooks(contentItemToRecord(result.data.item), collection);
 		return result;
 	}
@@ -1826,11 +1768,12 @@ const onRequest = defineMiddleware(async (context, next) => {
 		const hasPreviewToken = url.searchParams.has("_preview");
 		const requestDb = locals.__dinewayRequestDb;
 		if (!isDinewayRoute && !isPublicRuntimeRoute && !hasEditCookie && !hasPreviewToken) {
-			if (!(context.isPrerendered ? null : await context.session?.get("user")) && !requestDb) {
+			const hasSessionCookie = cookies.get("astro-session") !== void 0;
+			if (!(context.isPrerendered || !hasSessionCookie ? null : await context.session?.get("user")) && !requestDb) {
 				if (!setupVerified) {
 					const setupStart = startServerTiming(serverTimings);
 					try {
-						const { getDb } = await import("../loader-sMG4TZ-u.mjs").then((n) => n.r);
+						const { getDb } = await import("../loader-PZnPxFLc.mjs").then((n) => n.i);
 						await (await getDb()).selectFrom("_dineway_migrations").selectAll().limit(1).execute();
 						setupVerified = true;
 					} catch {
@@ -1847,7 +1790,9 @@ const onRequest = defineMiddleware(async (context, next) => {
 						locals.dineway = {
 							collectPageMetadata: runtime.collectPageMetadata.bind(runtime),
 							collectPageFragments: runtime.collectPageFragments.bind(runtime),
-							ensureSearchHealthy: runtime.ensureSearchHealthy.bind(runtime)
+							ensureSearchHealthy: runtime.ensureSearchHealthy.bind(runtime),
+							getPublicMediaUrl: createPublicMediaUrlResolver(runtime.storage),
+							config
 						};
 					} catch {}
 					addServerTiming(serverTimings, "rt", runtimeStart, "Runtime init");
@@ -1870,10 +1815,6 @@ const onRequest = defineMiddleware(async (context, next) => {
 				const runtime = await getRuntime(config);
 				addServerTiming(serverTimings, "rt", timingStart, "Runtime init");
 				setupVerified = true;
-				timingStart = startServerTiming(serverTimings);
-				const manifest = await runtime.getManifest();
-				addServerTiming(serverTimings, "manifest", timingStart, "Manifest");
-				locals.dinewayManifest = manifest;
 				locals.dineway = {
 					handleContentList: runtime.handleContentList.bind(runtime),
 					handleContentGet: runtime.handleContentGet.bind(runtime),
@@ -1911,10 +1852,12 @@ const onRequest = defineMiddleware(async (context, next) => {
 					ensureSearchHealthy: runtime.ensureSearchHealthy.bind(runtime),
 					storage: runtime.storage,
 					db: runtime.db,
+					getPublicMediaUrl: createPublicMediaUrlResolver(runtime.storage),
 					hooks: runtime.hooks,
 					email: runtime.email,
 					configuredPlugins: runtime.configuredPlugins,
 					config,
+					getManifest: runtime.getManifest.bind(runtime),
 					invalidateManifest: runtime.invalidateManifest.bind(runtime),
 					getSandboxRunner: runtime.getSandboxRunner.bind(runtime),
 					syncMarketplacePlugins: runtime.syncMarketplacePlugins.bind(runtime),

package/dist/astro/routes/PluginRegistry.d.mts

@@ -0,0 +1,14 @@
+import * as react_jsx_runtime0 from "react/jsx-runtime";
+import { Messages } from "@lingui/core";
+
+//#region src/astro/routes/PluginRegistry.d.ts
+interface AdminWrapperProps {
+  locale: string;
+  messages: Messages;
+}
+declare function AdminWrapper({
+  locale,
+  messages
+}: AdminWrapperProps): react_jsx_runtime0.JSX.Element;
+//#endregion
+export { AdminWrapper as default };

package/dist/astro/routes/PluginRegistry.mjs

@@ -0,0 +1,24 @@
+import { AdminApp } from "@dineway-ai/admin";
+import { pluginAdmins } from "virtual:dineway/admin-registry";
+import { authProviders } from "virtual:dineway/auth-providers";
+import { jsx } from "react/jsx-runtime";
+
+//#region src/astro/routes/PluginRegistry.tsx
+/**
+* Admin Wrapper
+*
+* Imports plugin admin modules from the virtual module and passes them
+* to AdminApp via props. This ensures plugin components are bundled
+* together with the admin app and available via React context.
+*/
+function AdminWrapper({ locale, messages }) {
+	return /* @__PURE__ */ jsx(AdminApp, {
+		pluginAdmins,
+		authProviders,
+		locale,
+		messages
+	});
+}
+
+//#endregion
+export { AdminWrapper as default };

package/dist/astro/routes/api/admin/allowed-domains/_domain_.d.mts

@@ -0,0 +1,14 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/admin/allowed-domains/[domain].d.ts
+declare const prerender = false;
+/**
+ * PATCH - Update domain settings
+ */
+declare const PATCH: APIRoute;
+/**
+ * DELETE - Remove an allowed domain
+ */
+declare const DELETE: APIRoute;
+//#endregion
+export { DELETE, PATCH, prerender };

package/dist/astro/routes/api/admin/allowed-domains/_domain_.mjs

@@ -0,0 +1,65 @@
+import "../../../../../context-types-C-LwdAxx.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-BMUPwxgx.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-C9106ehs.mjs";
+import { S as allowedDomainUpdateBody } from "../../../../../redirects-lrlmYXVE.mjs";
+import "../../../../../import-CNcKWTbp.mjs";
+import "../../../../../api/schemas/index.mjs";
+import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
+import { Role, roleFromLevel } from "@dineway-ai/auth";
+
+//#region src/astro/routes/api/admin/allowed-domains/[domain].ts
+const prerender = false;
+/**
+* PATCH - Update domain settings
+*/
+const PATCH = async ({ params, request, locals }) => {
+	const { dineway, user } = locals;
+	const { domain } = params;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Database not configured", 500);
+	if (!domain) return apiError("VALIDATION_ERROR", "Domain is required", 400);
+	if (!user || user.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
+	const adapter = createKyselyAdapter(dineway.db);
+	try {
+		const body = await parseBody(request, allowedDomainUpdateBody);
+		if (isParseError(body)) return body;
+		const existing = await adapter.getAllowedDomain(domain);
+		if (!existing) return apiError("NOT_FOUND", "Domain not found", 404);
+		const defaultRole = body.defaultRole;
+		const enabled = body.enabled ?? existing.enabled;
+		await adapter.updateAllowedDomain(domain, enabled, defaultRole);
+		const updated = await adapter.getAllowedDomain(domain);
+		return apiSuccess({
+			success: true,
+			domain: updated ? {
+				domain: updated.domain,
+				defaultRole: updated.defaultRole,
+				roleName: roleFromLevel(updated.defaultRole),
+				enabled: updated.enabled,
+				createdAt: updated.createdAt.toISOString()
+			} : null
+		});
+	} catch (error) {
+		return handleError(error, "Failed to update allowed domain", "DOMAIN_UPDATE_ERROR");
+	}
+};
+/**
+* DELETE - Remove an allowed domain
+*/
+const DELETE = async ({ params, locals }) => {
+	const { dineway, user } = locals;
+	const { domain } = params;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Database not configured", 500);
+	if (!domain) return apiError("VALIDATION_ERROR", "Domain is required", 400);
+	if (!user || user.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
+	const adapter = createKyselyAdapter(dineway.db);
+	try {
+		if (!await adapter.getAllowedDomain(domain)) return apiError("NOT_FOUND", "Domain not found", 404);
+		await adapter.deleteAllowedDomain(domain);
+		return apiSuccess({ success: true });
+	} catch (error) {
+		return handleError(error, "Failed to delete allowed domain", "DOMAIN_DELETE_ERROR");
+	}
+};
+
+//#endregion
+export { DELETE, PATCH, prerender };

package/dist/astro/routes/api/admin/allowed-domains/index.d.mts

@@ -0,0 +1,14 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/admin/allowed-domains/index.d.ts
+declare const prerender = false;
+/**
+ * GET - List all allowed domains
+ */
+declare const GET: APIRoute;
+/**
+ * POST - Add a new allowed domain
+ */
+declare const POST: APIRoute;
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/admin/allowed-domains/index.mjs

@@ -0,0 +1,65 @@
+import "../../../../../context-types-C-LwdAxx.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-BMUPwxgx.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-C9106ehs.mjs";
+import { x as allowedDomainCreateBody } from "../../../../../redirects-lrlmYXVE.mjs";
+import "../../../../../import-CNcKWTbp.mjs";
+import "../../../../../api/schemas/index.mjs";
+import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
+import { Role, roleFromLevel } from "@dineway-ai/auth";
+
+//#region src/astro/routes/api/admin/allowed-domains/index.ts
+const prerender = false;
+const DOMAIN_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9-]*(\.[a-zA-Z0-9-]+)+$/;
+/**
+* GET - List all allowed domains
+*/
+const GET = async ({ locals }) => {
+	const { dineway, user } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Database not configured", 500);
+	if (!user || user.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
+	const adapter = createKyselyAdapter(dineway.db);
+	try {
+		return apiSuccess({ domains: (await adapter.getAllowedDomains()).map((d) => ({
+			domain: d.domain,
+			defaultRole: d.defaultRole,
+			roleName: roleFromLevel(d.defaultRole),
+			enabled: d.enabled,
+			createdAt: d.createdAt.toISOString()
+		})) });
+	} catch (error) {
+		return handleError(error, "Failed to list allowed domains", "DOMAIN_LIST_ERROR");
+	}
+};
+/**
+* POST - Add a new allowed domain
+*/
+const POST = async ({ request, locals }) => {
+	const { dineway, user } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Database not configured", 500);
+	if (!user || user.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
+	const adapter = createKyselyAdapter(dineway.db);
+	try {
+		const body = await parseBody(request, allowedDomainCreateBody);
+		if (isParseError(body)) return body;
+		const defaultRole = body.defaultRole;
+		const cleanDomain = body.domain.toLowerCase().trim();
+		if (!DOMAIN_REGEX.test(cleanDomain)) return apiError("VALIDATION_ERROR", "Invalid domain format", 400);
+		if (await adapter.getAllowedDomain(cleanDomain)) return apiError("CONFLICT", "Domain already exists", 409);
+		const domain = await adapter.createAllowedDomain(cleanDomain, defaultRole);
+		return apiSuccess({
+			success: true,
+			domain: {
+				domain: domain.domain,
+				defaultRole: domain.defaultRole,
+				roleName: roleFromLevel(domain.defaultRole),
+				enabled: domain.enabled,
+				createdAt: domain.createdAt.toISOString()
+			}
+		}, 201);
+	} catch (error) {
+		return handleError(error, "Failed to create allowed domain", "DOMAIN_CREATE_ERROR");
+	}
+};
+
+//#endregion
+export { GET, POST, prerender };

package/dist/astro/routes/api/admin/api-tokens/_id_.d.mts

@@ -0,0 +1,10 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/admin/api-tokens/[id].d.ts
+declare const prerender = false;
+/**
+ * Revoke (delete) an API token.
+ */
+declare const DELETE: APIRoute;
+//#endregion
+export { DELETE, prerender };

package/dist/astro/routes/api/admin/api-tokens/_id_.mjs

@@ -0,0 +1,33 @@
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-BMUPwxgx.mjs";
+import "../../../../../api-tokens-CPjC3zf8.mjs";
+import { r as handleApiTokenRevoke } from "../../../../../api-tokens-D7UjLbdt.mjs";
+import { t as rejectApiTokenAuthControlWrite } from "../../../../../auth-control-guard-DOZ3UCsP.mjs";
+import { Role } from "@dineway-ai/auth";
+
+//#region src/astro/routes/api/admin/api-tokens/[id].ts
+/**
+* Single API token endpoint
+*
+* DELETE /_dineway/api/admin/api-tokens/:id — Revoke a token
+*/
+const prerender = false;
+/**
+* Revoke (delete) an API token.
+*/
+const DELETE = async ({ params, locals }) => {
+	const { dineway, user } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	if (!user || user.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
+	const credentialGuard = rejectApiTokenAuthControlWrite(locals, "api_tokens");
+	if (credentialGuard) return credentialGuard;
+	const tokenId = params.id;
+	if (!tokenId) return apiError("VALIDATION_ERROR", "Token ID is required", 400);
+	try {
+		return unwrapResult(await handleApiTokenRevoke(dineway.db, tokenId, user.id));
+	} catch (error) {
+		return handleError(error, "Failed to revoke API token", "TOKEN_REVOKE_ERROR");
+	}
+};
+
+//#endregion
+export { DELETE, prerender };