dineway 0.2.0 → 0.2.1

package/dist/astro/middleware/auth.mjs

@@ -1,9 +1,9 @@
-import { t as apiError } from "../../error-CytFlgcd.mjs";
-import { i as hasScope } from "../../api-tokens-2r7OWi_I.mjs";
-import { n as getPublicOrigin } from "../../public-url-BEz_sM9n.mjs";
-import { t as getAuthMode } from "../../mode-C4CIyjtR.mjs";
-import { t as resolveSessionUser } from "../../session-user-CAKImna3.mjs";
-import { a as resolveApiToken, o as resolveOAuthToken } from "../../api-tokens-CjVMQT-X.mjs";
+import { t as apiError } from "../../error-CSVaQNZy.mjs";
+import { i as hasScope } from "../../api-tokens-Ypaly90d.mjs";
+import { n as getPublicOrigin } from "../../public-url-Cp6hyjVR.mjs";
+import { t as getAuthMode } from "../../mode-C8yZnIlR.mjs";
+import { t as resolveSessionUser } from "../../session-user-Ct6GBLvn.mjs";
+import { a as resolveApiToken, o as resolveOAuthToken } from "../../api-tokens-tbK_sORH.mjs";
 import { ulid } from "ulidx";
 import { defineMiddleware } from "astro:middleware";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";

package/dist/astro/middleware/redirect.mjs

@@ -1,11 +1,11 @@
 import "../../dialect-helpers-fk43GbDb.mjs";
 import { getRequestContext } from "../../request-context.mjs";
 import "../../base64-F8-DUraK.mjs";
-import "../../types-Dq1qT19x.mjs";
-import { r as getDb } from "../../loader-CjWqjweO.mjs";
-import { n as alternateTrailingSlashPath, t as RedirectRepository } from "../../redirect-BAjt4Z6b.mjs";
-import { a as matchCachedPatterns, n as compileRedirectRules, o as setCachedRedirects, r as getCachedRedirects } from "../../cache-C-FNTFYK.mjs";
-import { n as isTerminalStatus } from "../../status-DANd8ERo.mjs";
+import "../../types-ChxYDRvx.mjs";
+import { r as getDb } from "../../loader-aWkkc1_o.mjs";
+import { n as alternateTrailingSlashPath, t as RedirectRepository } from "../../redirect-ubhEqQCQ.mjs";
+import { a as matchCachedPatterns, n as compileRedirectRules, o as setCachedRedirects, r as getCachedRedirects } from "../../cache-DkVCKGio.mjs";
+import { n as isTerminalStatus } from "../../status-NqWOSFAD.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/astro/middleware/redirect.ts

package/dist/astro/middleware/request-context.mjs

@@ -1,8 +1,8 @@
 import { runWithContext } from "../../request-context.mjs";
 import "../../base64-F8-DUraK.mjs";
 import "../../options-DQPTH5n0.mjs";
-import { a as resolveSecretsCached } from "../../secrets-CDZo2k8L.mjs";
-import { n as parseContentId, r as verifyPreviewToken } from "../../tokens-1RK1n6ED.mjs";
+import { a as resolveSecretsCached } from "../../secrets-ZV5rd8yV.mjs";
+import { n as parseContentId, r as verifyPreviewToken } from "../../tokens-BDQU29Vd.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/visual-editing/toolbar.ts

package/dist/astro/middleware/seed.d.mts

@@ -1,4 +1,4 @@
-import { t as Database } from "../../types-DU0bU2Wu.mjs";
+import { t as Database } from "../../types-DuQn1G7-.mjs";
 import { Kysely } from "kysely";
 import * as astro from "astro";
 

package/dist/astro/middleware/seed.mjs

@@ -1,4 +1,4 @@
-import { i as runMigrations } from "../../runner-DB7CRfOF.mjs";
+import { i as runMigrations } from "../../runner-BgmttQmD.mjs";
 import "../../dialect-helpers-fk43GbDb.mjs";
 import { t as OptionsRepository } from "../../options-DQPTH5n0.mjs";
 import { ulid } from "ulidx";

package/dist/astro/middleware/setup.mjs

@@ -1,4 +1,4 @@
-import { t as getAuthMode } from "../../mode-C4CIyjtR.mjs";
+import { t as getAuthMode } from "../../mode-C8yZnIlR.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/astro/middleware/setup.ts

package/dist/astro/middleware.mjs

@@ -1,94 +1,96 @@
-import { i as runMigrations } from "../runner-DB7CRfOF.mjs";
+import { i as runMigrations } from "../runner-BgmttQmD.mjs";
 import "../connection-CiJWiWya.mjs";
 import { t as validateIdentifier } from "../validate-VPnKoIzW.mjs";
 import { s as isSqlite } from "../dialect-helpers-fk43GbDb.mjs";
 import { i as setI18nConfig } from "../config-CVssduLe.mjs";
-import { _ as readBoundedPluginRouteBody, d as EmailPipeline, g as DEFAULT_PLUGIN_RAW_BODY_LIMIT_BYTES, h as definePlugin, m as resolveExclusiveHooks, p as createHookPipeline, u as PluginRouteRegistry } from "../plugins-BolVa-tl.mjs";
+import { _ as DEFAULT_PLUGIN_RAW_BODY_LIMIT_BYTES, d as EmailPipeline, g as definePlugin, h as runPluginMigrations, m as resolveExclusiveHooks, p as createHookPipeline, u as PluginRouteRegistry, v as readBoundedPluginRouteBody } from "../plugins-CPA2PtfY.mjs";
 import { createRequestMetrics, getRequestContext, runWithContext } from "../request-context.mjs";
 import { createRecorder, flushRecorder, formatServerTimingHeader, isInstrumentationEnabled, isServerTimingEnabled, kyselyLogOption } from "../database/instrumentation.mjs";
 import "../base64-F8-DUraK.mjs";
-import "../types-Dq1qT19x.mjs";
-import { o as isMissingTableError, r as getDb } from "../loader-CjWqjweO.mjs";
+import "../types-ChxYDRvx.mjs";
+import { o as isMissingTableError, r as getDb } from "../loader-aWkkc1_o.mjs";
 import { t as after } from "../after-BfniwgIf.mjs";
 import "../object-cache-D51qOseS.mjs";
-import { r as RevisionRepository, t as ContentRepository } from "../content-Bh4BDjv8.mjs";
-import { t as MediaRepository } from "../media-DMj0grzC.mjs";
-import "../user-BIZPzCb9.mjs";
-import "../taxonomy-Dvsw6BOs.mjs";
-import "../comment-DlA4iChg.mjs";
+import { r as RevisionRepository, t as ContentRepository } from "../content-DJcAYFhz.mjs";
+import { t as MediaRepository } from "../media-CVMOoywq.mjs";
+import "../user-BH-n01y3.mjs";
+import "../taxonomy-0k_vRVsD.mjs";
+import "../comment-DFALgsJD.mjs";
 import { t as OptionsRepository } from "../options-DQPTH5n0.mjs";
-import "../audit-ByVKIwWF.mjs";
-import "../site-activity-Dy3FROs0.mjs";
-import "../review-requests-DUyEmtmG.mjs";
-import "../hitl-Hw1RmWOq.mjs";
-import { t as PluginContextFactory } from "../context-C5W3G18y.mjs";
-import "../menus-TaW1gKnk.mjs";
-import "../redirect-BAjt4Z6b.mjs";
-import { r as requestCached } from "../request-cache-D9GQBxMP.mjs";
-import "../byline-registry-87nNnYl4.mjs";
-import { a as initWithLock, i as createInitLock, r as processCachedAsync, t as createProcessCache } from "../process-cache-7xgAO9JY.mjs";
-import "../field-defs-cache-DRNdhBJv.mjs";
-import "../byline-e51-fWRs.mjs";
-import { n as normalizeMediaValue } from "../normalize-5ek_z7de.mjs";
-import "../enrich-DIFIFA8O.mjs";
-import "../seo-CQG3GCHQ.mjs";
-import { $ as handleContentUpdate, A as handleRevisionGet, B as handleContentDiscardDraft, D as handleMediaGet, E as handleMediaDelete, F as handleContentCompare, G as handleContentListTrashed, H as handleContentGet, I as handleContentCountScheduled, J as handleContentRestore, K as handleContentPermanentDelete, L as handleContentCountTrashed, M as handleRevisionRestore, O as handleMediaList, P as handleContentAuthors, Q as handleContentUnschedule, R as handleContentCreate, T as handleMediaCreate, U as handleContentGetIncludingTrashed, V as handleContentDuplicate, W as handleContentList, X as handleContentTranslations, Y as handleContentSchedule, Z as handleContentUnpublish, d as createPluginBundleStore, et as validateRev, j as handleRevisionList, k as handleMediaUpdate, q as handleContentPublish, z as handleContentDelete } from "../api-ByrU2q-Z.mjs";
-import "../dashboard-DQkVT7Ei.mjs";
-import { u as PluginStateRepository } from "../briefing-CawZ59CY.mjs";
-import "../context-types-DqTo6C79.mjs";
-import { i as markContentMediaUsageCollectionStale, o as refreshContentMediaUsageAfterWrite, r as findNonTranslatableSiblingContentIds, t as deleteContentMediaUsage } from "../content-refresh-CgutSUfO.mjs";
-import { n as hashString } from "../hash-BPmX6P8I.mjs";
-import { t as FTSManager } from "../fts-manager-Crzypjqu.mjs";
-import { n as SchemaRegistry } from "../registry-CtyVedcN.mjs";
-import { r as createPublicMediaUrlResolver } from "../url-Cac7a9QZ.mjs";
-import "../settings-BbqgHWpU.mjs";
-import "../briefing-BJaJI8dm.mjs";
-import "../review-requests-C9Ff11Vq.mjs";
-import { n as VERSION, t as COMMIT } from "../version-BTvfRGc6.mjs";
-import "../query-jaAmw8E1.mjs";
-import "../zod-generator-B7TMjyFJ.mjs";
-import "../schema-DXdYj4R3.mjs";
-import "../seo-qa7Dn0jK.mjs";
-import "../bylines-CMQNCNFh.mjs";
-import "../byline-fields-D-N5qVIG.mjs";
-import "../sections-PVVXHGfp.mjs";
-import "../settings-i4VPP8bT.mjs";
-import "../resolve-Cb6Dbz-C.mjs";
-import "../taxonomies-DRiixp_E.mjs";
-import "../taxonomies-9s-v03H-.mjs";
-import { r as normalizeManifestRoute } from "../manifest-schema-BxVPYMJR.mjs";
-import "../parse-CbymENaR.mjs";
-import "../redirects-CA-xylPG.mjs";
-import "../byline-fields-DOJO16Gm.mjs";
-import "../status-DANd8ERo.mjs";
-import { t as getTrustedProxyHeaders } from "../trusted-proxy-DTXQ2IMv.mjs";
-import "../rate-limit-ZLdyWoZF.mjs";
-import { a as invalidateUrlPatternCache } from "../query-CfRCdaL3.mjs";
-import "../preview-vSVg6fwG.mjs";
-import "../parser-C1nYd-81.mjs";
-import { n as sanitizeHeadersForSandbox, t as extractRequestMeta } from "../request-meta-CUypToDJ.mjs";
-import "../ssrf-DWe8jwAp.mjs";
-import { n as CronExecutor } from "../cron-cKcNTix_.mjs";
-import { r as devConsoleEmailDeliver, t as DEV_CONSOLE_EMAIL_PLUGIN_ID } from "../email-console-ChgKFO8-.mjs";
-import { o as validateEncryptionKeyAtStartup } from "../secrets-CDZo2k8L.mjs";
-import "../api-tokens-2r7OWi_I.mjs";
-import { n as createActivePluginMcpRegistry } from "../mcp-reviewed-executor-TwVbMzG6.mjs";
-import "../activity-events-y6eT8UW6.mjs";
-import "../import-Bh9biJfx.mjs";
-import "../utils-CMDhr5Xd.mjs";
-import "../tokens-1RK1n6ED.mjs";
-import "../comment-reaction-DfFao1ST.mjs";
-import "../menus-xvsnVZXw.mjs";
-import "../bylines-y4LO-dTj.mjs";
-import "../widgets-f0ibZUIq.mjs";
-import "../apply-bZswmZPm.mjs";
-import "../load-DmYeniXl.mjs";
-import "../search-DSaLgEFI.mjs";
+import "../audit-B2pRxZ20.mjs";
+import "../site-activity-h8smOlYI.mjs";
+import "../review-requests-CTWGnWUt.mjs";
+import { n as PublicationAuthorizationService, t as PublicationAuthorizationError } from "../publication-authorization-RKiHXKtq.mjs";
+import "../site-context-B8T1kpUP.mjs";
+import { t as PluginContextFactory } from "../context-fSCYLL3c.mjs";
+import "../menus-CmyIkRG5.mjs";
+import "../redirect-ubhEqQCQ.mjs";
+import { r as requestCached } from "../request-cache-CBFjCwSt.mjs";
+import "../byline-registry-Ba54M74c.mjs";
+import { a as initWithLock, i as createInitLock, r as processCachedAsync, t as createProcessCache } from "../process-cache-CCDgti7j.mjs";
+import "../field-defs-cache-DL-T2XVS.mjs";
+import "../byline-7xR185Ly.mjs";
+import { n as normalizeMediaValue } from "../normalize-Cyt7JdF7.mjs";
+import "../enrich-Ck9tfMqe.mjs";
+import "../seo-BU8MLCS9.mjs";
+import { $ as handleContentUpdate, A as handleRevisionGet, B as handleContentDiscardDraft, D as handleMediaGet, E as handleMediaDelete, F as handleContentCompare, G as handleContentListTrashed, H as handleContentGet, I as handleContentCountScheduled, J as handleContentRestore, K as handleContentPermanentDelete, L as handleContentCountTrashed, M as handleRevisionRestore, O as handleMediaList, P as handleContentAuthors, Q as handleContentUnschedule, R as handleContentCreate, T as handleMediaCreate, U as handleContentGetIncludingTrashed, V as handleContentDuplicate, W as handleContentList, X as handleContentTranslations, Y as handleContentSchedule, Z as handleContentUnpublish, d as createPluginBundleStore, et as validateRev, j as handleRevisionList, k as handleMediaUpdate, q as handleContentPublish, z as handleContentDelete } from "../api-B4PHIF4V.mjs";
+import "../dashboard-D0nj5oWg.mjs";
+import { u as PluginStateRepository } from "../briefing-0rf-su3-.mjs";
+import "../context-types-eBuMDAg-.mjs";
+import { i as markContentMediaUsageCollectionStale, o as refreshContentMediaUsageAfterWrite, r as findNonTranslatableSiblingContentIds, t as deleteContentMediaUsage } from "../content-refresh-B4ZCmxgd.mjs";
+import { n as hashString } from "../hash-mxxx2oPW.mjs";
+import { t as FTSManager } from "../fts-manager-ewTGohf4.mjs";
+import { n as SchemaRegistry } from "../registry-BYYyb2tF.mjs";
+import { r as createPublicMediaUrlResolver } from "../url-guoXQQcV.mjs";
+import "../settings-BECcAIRH.mjs";
+import "../briefing-kRhegBoF.mjs";
+import "../review-requests-D42VEP1l.mjs";
+import { n as VERSION, t as COMMIT } from "../version-C3iVRuaF.mjs";
+import "../query-C2U5u5_p.mjs";
+import "../zod-generator-C7AsLpSB.mjs";
+import "../schema-DUtnZxjZ.mjs";
+import "../seo-BLszyJxd.mjs";
+import "../bylines-C-EL6dh3.mjs";
+import "../byline-fields-BKzA0fJU.mjs";
+import "../sections-DvFgsnda.mjs";
+import "../settings-EzADu-dd.mjs";
+import "../resolve-DE71WcL9.mjs";
+import "../taxonomies-DSnY5nOa.mjs";
+import "../taxonomies-BiM9NtgW.mjs";
+import { r as normalizeManifestRoute } from "../manifest-schema-uA6pRFXi.mjs";
+import "../parse-i15EFSAE.mjs";
+import "../redirects-Bhpm8bRe.mjs";
+import "../byline-fields-WN7RQT4q.mjs";
+import "../status-NqWOSFAD.mjs";
+import { t as getTrustedProxyHeaders } from "../trusted-proxy-Dm7Mxvt6.mjs";
+import "../rate-limit-DglsAJSw.mjs";
+import { a as invalidateUrlPatternCache } from "../query-DEv5x6yB.mjs";
+import "../preview-BjedZm8G.mjs";
+import "../parser-06LLLL4E.mjs";
+import { n as sanitizeHeadersForSandbox, t as extractRequestMeta } from "../request-meta-CFe1tW2M.mjs";
+import "../ssrf-FJqwQzj4.mjs";
+import { n as CronExecutor } from "../cron-B1SL_lsb.mjs";
+import { r as devConsoleEmailDeliver, t as DEV_CONSOLE_EMAIL_PLUGIN_ID } from "../email-console-Bp0r68iF.mjs";
+import { o as validateEncryptionKeyAtStartup } from "../secrets-ZV5rd8yV.mjs";
+import "../api-tokens-Ypaly90d.mjs";
+import { n as createActivePluginMcpRegistry } from "../mcp-reviewed-executor-Dn52L_yY.mjs";
+import "../activity-DUaz_w7p.mjs";
+import "../activity-events-CJDvE2uc.mjs";
+import { i as experimentalSiteContextWorkflowsEnabled } from "../experimental-workflows-GVhUgzEs.mjs";
+import "../utils-D1SrKGtP.mjs";
+import "../search-DUKgZUlm.mjs";
+import "../import-CXXL5pip.mjs";
+import "../tokens-BDQU29Vd.mjs";
+import "../comment-reaction-C37bf99u.mjs";
+import "../menus-CCG2z5um.mjs";
+import "../bylines-CmZFCMr0.mjs";
+import "../widgets-BZrLrNgS.mjs";
+import "../apply-DjTqq6Ae.mjs";
+import "../load-CFtJRT3c.mjs";
 import "../index.mjs";
-import { t as getAuthMode } from "../mode-C4CIyjtR.mjs";
-import { i as experimentalSiteContextWorkflowsEnabled } from "../experimental-workflows-BMsUnIAw.mjs";
-import { t as cleanupExpiredChallenges } from "../challenge-store-Bjlepa2E.mjs";
-import { t as resolveSessionUser } from "../session-user-CAKImna3.mjs";
+import { t as getAuthMode } from "../mode-C8yZnIlR.mjs";
+import { t as cleanupExpiredChallenges } from "../challenge-store-D5pSY2S1.mjs";
+import { t as resolveSessionUser } from "../session-user-Ct6GBLvn.mjs";
 import { Kysely, sql } from "kysely";
 import { defineMiddleware } from "astro:middleware";
 import virtualConfig from "virtual:dineway/config";
@@ -361,6 +363,10 @@ const SCHEDULED_PUBLISH_BATCH_LIMIT = 100;
 async function publishDueContent(db, options = {}) {
 	const { publish, onPublished, limit = SCHEDULED_PUBLISH_BATCH_LIMIT } = options;
 	const published = [];
+	if (!publish) {
+		console.error("[scheduled-publish] Authorized publication callback is required");
+		return published;
+	}
 	let collections;
 	try {
 		collections = await new SchemaRegistry(db).listCollections();
@@ -369,22 +375,27 @@ async function publishDueContent(db, options = {}) {
 		return published;
 	}
 	const repo = new ContentRepository(db);
-	const doPublish = publish ?? ((collection, id, opts) => handleContentPublish(db, collection, id, opts));
 	const batchLimit = limit > 0 ? limit : void 0;
 	for (const collection of collections) try {
 		const due = await repo.findReadyToPublish(collection.slug, batchLimit);
 		const batch = [];
 		for (const item of due) {
+			if (!item.scheduledAt) continue;
 			const publishedAt = item.publishedAt == null ? item.scheduledAt ?? void 0 : void 0;
-			const result = await doPublish(collection.slug, item.id, {
-				publishedAt,
-				requireScheduledDue: true
-			});
-			if (result.success) batch.push({
-				collection: collection.slug,
-				id: item.id
-			});
-			else if (result.error?.code !== "NOT_DUE") console.error(`[scheduled-publish] Failed to publish ${collection.slug}/${item.id}:`, result.error);
+			try {
+				const result = await publish(collection.slug, item.id, {
+					publishedAt,
+					requireScheduledDue: true,
+					scheduledAt: item.scheduledAt
+				});
+				if (result.success) batch.push({
+					collection: collection.slug,
+					id: item.id
+				});
+				else if (result.error?.code !== "NOT_DUE") console.error(`[scheduled-publish] Failed to publish ${collection.slug}/${item.id}:`, result.error);
+			} catch (error) {
+				console.error(`[scheduled-publish] Failed to publish ${collection.slug}/${item.id}:`, error);
+			}
 		}
 		if (batch.length > 0) {
 			published.push(...batch);
@@ -619,7 +630,22 @@ var DinewayRuntime = class DinewayRuntime {
 	* Routes through the runtime wrapper so after-publish hooks still fire.
 	*/
 	async publishScheduled() {
-		return publishDueContent(this.db, { publish: (collection, id, options) => this.handleContentPublish(collection, id, options) });
+		return publishDueContent(this.db, { publish: this.publishAuthorizedDueContent.bind(this) });
+	}
+	async publishAuthorizedDueContent(collection, id, options) {
+		try {
+			return (await this.createPublicationAuthorizationService().publishAuthorizedDueContent({
+				collection,
+				id,
+				scheduledAt: options.scheduledAt,
+				publishedAt: options.publishedAt
+			})).result;
+		} catch (error) {
+			return {
+				success: false,
+				error: { code: error instanceof PublicationAuthorizationError ? error.code : "SCHEDULED_PUBLISH_ERROR" }
+			};
+		}
 	}
 	/**
 	* Run all scheduled maintenance work from a heartbeat driver.
@@ -640,7 +666,7 @@ var DinewayRuntime = class DinewayRuntime {
 		let published = [];
 		try {
 			published = await publishDueContent(this.db, {
-				publish: (collection, id, opts) => this.handleContentPublish(collection, id, opts),
+				publish: this.publishAuthorizedDueContent.bind(this),
 				onPublished: options.onPublished
 			});
 		} catch (error) {
@@ -841,6 +867,7 @@ var DinewayRuntime = class DinewayRuntime {
 		};
 		const db = await phase("rt.db", "DB init + migrations", () => DinewayRuntime.getDatabase(deps));
 		const resolveDb = () => getRequestContextDatabase() ?? db;
+		await phase("rt.plugin-migrations", "Trusted plugin migrations", () => runPluginMigrations(db, deps.plugins));
 		await phase("rt.secrets", "Validate encryption key", () => validateEncryptionKeyAtStartup());
 		const storage = DinewayRuntime.getStorage(deps);
 		let pluginStates = /* @__PURE__ */ new Map();
@@ -960,7 +987,7 @@ var DinewayRuntime = class DinewayRuntime {
 				cronScheduler.setSystemCleanup(async () => {
 					try {
 						const runtime = runtimeRef.current;
-						await publishDueContent(db, { publish: runtime ? (collection, id, options) => runtime.handleContentPublish(collection, id, options) : void 0 });
+						await publishDueContent(db, { publish: runtime ? runtime.publishAuthorizedDueContent.bind(runtime) : void 0 });
 					} catch (error) {
 						console.error("[scheduled-publish] Sweep failed:", error);
 					}
@@ -1039,9 +1066,9 @@ var DinewayRuntime = class DinewayRuntime {
 					}
 				})();
 				if (collectionCount.count === 0 && !setupDone) {
-					const { applySeed } = await import("../apply-bZswmZPm.mjs").then((n) => n.n);
-					const { loadSeed } = await import("../load-DmYeniXl.mjs").then((n) => n.r);
-					const { validateSeed } = await import("../validate-DNs0pTSc.mjs").then((n) => n.n);
+					const { applySeed } = await import("../apply-DjTqq6Ae.mjs").then((n) => n.n);
+					const { loadSeed } = await import("../load-CFtJRT3c.mjs").then((n) => n.r);
+					const { validateSeed } = await import("../validate-D1HL-oLR.mjs").then((n) => n.n);
 					const seed = await loadSeed();
 					if (validateSeed(seed).valid) {
 						await applySeed(db, seed, { onConflict: "skip" });
@@ -1480,6 +1507,20 @@ var DinewayRuntime = class DinewayRuntime {
 		if (result.success && result.data) await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
 		return result;
 	}
+	createPublicationAuthorizationService() {
+		const policies = this.configuredPlugins.filter((plugin) => this.enabledPlugins.has(plugin.id)).flatMap((plugin) => plugin.publicationReleasePolicies ?? []);
+		return new PublicationAuthorizationService({
+			db: this.db,
+			policies,
+			handlers: {
+				handleContentGet: this.handleContentGet.bind(this),
+				handleContentCompare: this.handleContentCompare.bind(this),
+				handleContentPublish: this.handleContentPublish.bind(this),
+				handleContentSchedule: this.handleContentSchedule.bind(this),
+				handleContentUnschedule: this.handleContentUnschedule.bind(this)
+			}
+		});
+	}
 	async handleContentPublish(collection, id, options = {}) {
 		const result = await handleContentPublish(this.db, collection, id, options);
 		if (result.success && result.data) {
@@ -1612,7 +1653,8 @@ var DinewayRuntime = class DinewayRuntime {
 				public: route.public === true,
 				body: route.body ?? "json",
 				...route.body === "raw" ? { maxBodyBytes: route.maxBodyBytes ?? DEFAULT_PLUGIN_RAW_BODY_LIMIT_BYTES } : {},
-				authorization: route.authorization
+				authorization: route.authorization,
+				apiTokenPolicy: route.apiTokenPolicy
 			};
 		}
 		const meta = sandboxedRouteMetaCache.get(pluginId);
@@ -2199,7 +2241,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 				if (!isSetupVerified() && !context.isPrerendered) {
 					const setupStart = startServerTiming(serverTimings);
 					try {
-						const { getDb } = await import("../loader-CjWqjweO.mjs").then((n) => n.i);
+						const { getDb } = await import("../loader-aWkkc1_o.mjs").then((n) => n.i);
 						await (await getDb()).selectFrom("_dineway_migrations").selectAll().limit(1).execute();
 						markSetupVerified();
 					} catch (error) {

package/dist/astro/routes/api/admin/allowed-domains/_domain_.mjs

@@ -1,9 +1,9 @@
-import "../../../../../context-types-DqTo6C79.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CytFlgcd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-CbymENaR.mjs";
-import { S as allowedDomainUpdateBody } from "../../../../../redirects-CA-xylPG.mjs";
-import "../../../../../byline-fields-DOJO16Gm.mjs";
-import "../../../../../status-DANd8ERo.mjs";
+import "../../../../../context-types-eBuMDAg-.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CSVaQNZy.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-i15EFSAE.mjs";
+import { S as allowedDomainUpdateBody } from "../../../../../redirects-Bhpm8bRe.mjs";
+import "../../../../../byline-fields-WN7RQT4q.mjs";
+import "../../../../../status-NqWOSFAD.mjs";
 import "../../../../../api/schemas/index.mjs";
 import { Role, roleFromLevel } from "@dineway-ai/auth";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";

package/dist/astro/routes/api/admin/allowed-domains/index.mjs

@@ -1,9 +1,9 @@
-import "../../../../../context-types-DqTo6C79.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CytFlgcd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-CbymENaR.mjs";
-import { x as allowedDomainCreateBody } from "../../../../../redirects-CA-xylPG.mjs";
-import "../../../../../byline-fields-DOJO16Gm.mjs";
-import "../../../../../status-DANd8ERo.mjs";
+import "../../../../../context-types-eBuMDAg-.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-CSVaQNZy.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-i15EFSAE.mjs";
+import { x as allowedDomainCreateBody } from "../../../../../redirects-Bhpm8bRe.mjs";
+import "../../../../../byline-fields-WN7RQT4q.mjs";
+import "../../../../../status-NqWOSFAD.mjs";
 import "../../../../../api/schemas/index.mjs";
 import { Role, roleFromLevel } from "@dineway-ai/auth";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";

package/dist/astro/routes/api/admin/api-tokens/_id_.mjs

@@ -1,7 +1,7 @@
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CytFlgcd.mjs";
-import "../../../../../api-tokens-2r7OWi_I.mjs";
-import { i as handleApiTokenRevoke } from "../../../../../api-tokens-CjVMQT-X.mjs";
-import { t as rejectApiTokenAuthControlWrite } from "../../../../../auth-control-guard-CqeUmQsv.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CSVaQNZy.mjs";
+import "../../../../../api-tokens-Ypaly90d.mjs";
+import { i as handleApiTokenRevoke } from "../../../../../api-tokens-tbK_sORH.mjs";
+import { t as rejectApiTokenAuthControlWrite } from "../../../../../auth-control-guard-D71jourk.mjs";
 import { Role } from "@dineway-ai/auth";
 
 //#region src/astro/routes/api/admin/api-tokens/[id].ts

package/dist/astro/routes/api/admin/api-tokens/index.mjs

@@ -1,9 +1,9 @@
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CytFlgcd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-CbymENaR.mjs";
-import { t as ALL_VALID_SCOPES } from "../../../../../api-tokens-2r7OWi_I.mjs";
-import { c as requestedExperimentalSiteContextWorkflowScopes, i as experimentalSiteContextWorkflowsEnabled, s as getExperimentalSiteContextWorkflowsDisabledMessage } from "../../../../../experimental-workflows-BMsUnIAw.mjs";
-import { n as handleApiTokenCreate, r as handleApiTokenList } from "../../../../../api-tokens-CjVMQT-X.mjs";
-import { t as rejectApiTokenAuthControlWrite } from "../../../../../auth-control-guard-CqeUmQsv.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../error-CSVaQNZy.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-i15EFSAE.mjs";
+import { t as ALL_VALID_SCOPES } from "../../../../../api-tokens-Ypaly90d.mjs";
+import { c as requestedExperimentalSiteContextWorkflowScopes, i as experimentalSiteContextWorkflowsEnabled, s as getExperimentalSiteContextWorkflowsDisabledMessage } from "../../../../../experimental-workflows-GVhUgzEs.mjs";
+import { n as handleApiTokenCreate, r as handleApiTokenList } from "../../../../../api-tokens-tbK_sORH.mjs";
+import { t as rejectApiTokenAuthControlWrite } from "../../../../../auth-control-guard-D71jourk.mjs";
 import { z } from "zod";
 import { Role } from "@dineway-ai/auth";
 

package/dist/astro/routes/api/admin/briefing.mjs

@@ -1,25 +1,25 @@
 import "../../../../dialect-helpers-fk43GbDb.mjs";
 import "../../../../base64-F8-DUraK.mjs";
-import "../../../../types-Dq1qT19x.mjs";
-import "../../../../loader-CjWqjweO.mjs";
+import "../../../../types-ChxYDRvx.mjs";
+import "../../../../loader-aWkkc1_o.mjs";
 import "../../../../object-cache-D51qOseS.mjs";
-import "../../../../media-DMj0grzC.mjs";
+import "../../../../media-CVMOoywq.mjs";
 import "../../../../options-DQPTH5n0.mjs";
-import "../../../../site-activity-Dy3FROs0.mjs";
-import "../../../../review-requests-DUyEmtmG.mjs";
-import "../../../../request-cache-D9GQBxMP.mjs";
-import "../../../../briefing-CawZ59CY.mjs";
-import "../../../../context-types-DqTo6C79.mjs";
-import "../../../../content-refresh-CgutSUfO.mjs";
-import "../../../../fts-manager-Crzypjqu.mjs";
-import "../../../../registry-CtyVedcN.mjs";
-import "../../../../settings-BbqgHWpU.mjs";
-import { t as handleSiteBriefingGet } from "../../../../briefing-BJaJI8dm.mjs";
-import { a as unwrapResult, i as requireDb, r as handleError, t as apiError } from "../../../../error-CytFlgcd.mjs";
-import { i as parseQuery, t as isParseError } from "../../../../parse-CbymENaR.mjs";
-import "../../../../redirects-CA-xylPG.mjs";
-import { k as siteBriefingQuery } from "../../../../byline-fields-DOJO16Gm.mjs";
-import "../../../../status-DANd8ERo.mjs";
+import "../../../../site-activity-h8smOlYI.mjs";
+import "../../../../review-requests-CTWGnWUt.mjs";
+import "../../../../request-cache-CBFjCwSt.mjs";
+import "../../../../briefing-0rf-su3-.mjs";
+import "../../../../context-types-eBuMDAg-.mjs";
+import "../../../../content-refresh-B4ZCmxgd.mjs";
+import "../../../../fts-manager-ewTGohf4.mjs";
+import "../../../../registry-BYYyb2tF.mjs";
+import "../../../../settings-BECcAIRH.mjs";
+import { t as handleSiteBriefingGet } from "../../../../briefing-kRhegBoF.mjs";
+import { a as unwrapResult, i as requireDb, r as handleError, t as apiError } from "../../../../error-CSVaQNZy.mjs";
+import { i as parseQuery, t as isParseError } from "../../../../parse-i15EFSAE.mjs";
+import "../../../../redirects-Bhpm8bRe.mjs";
+import { A as siteBriefingQuery } from "../../../../byline-fields-WN7RQT4q.mjs";
+import "../../../../status-NqWOSFAD.mjs";
 import "../../../../api/schemas/index.mjs";
 import { hasPermission } from "@dineway-ai/auth";
 

package/dist/astro/routes/api/admin/byline-fields/_slug_/usage.mjs

@@ -1,7 +1,7 @@
-import "../../../../../../byline-registry-87nNnYl4.mjs";
-import { s as handleBylineFieldUsage } from "../../../../../../byline-fields-D-N5qVIG.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../../error-CytFlgcd.mjs";
-import { n as requirePerm } from "../../../../../../authorize-CcBxcHtz.mjs";
+import "../../../../../../byline-registry-Ba54M74c.mjs";
+import { s as handleBylineFieldUsage } from "../../../../../../byline-fields-BKzA0fJU.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../../error-CSVaQNZy.mjs";
+import { n as requirePerm } from "../../../../../../authorize-ZXPGPwKn.mjs";
 
 //#region src/astro/routes/api/admin/byline-fields/[slug]/usage.ts
 const prerender = false;

package/dist/astro/routes/api/admin/byline-fields/_slug_.mjs

@@ -1,13 +1,13 @@
-import "../../../../../byline-registry-87nNnYl4.mjs";
-import "../../../../../context-types-DqTo6C79.mjs";
-import { n as handleBylineFieldDelete, o as handleBylineFieldUpdate, r as handleBylineFieldGet } from "../../../../../byline-fields-D-N5qVIG.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../error-CytFlgcd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-CbymENaR.mjs";
-import "../../../../../redirects-CA-xylPG.mjs";
-import { a as bylineFieldUpdateBody } from "../../../../../byline-fields-DOJO16Gm.mjs";
-import "../../../../../status-DANd8ERo.mjs";
+import "../../../../../byline-registry-Ba54M74c.mjs";
+import "../../../../../context-types-eBuMDAg-.mjs";
+import { n as handleBylineFieldDelete, o as handleBylineFieldUpdate, r as handleBylineFieldGet } from "../../../../../byline-fields-BKzA0fJU.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../error-CSVaQNZy.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-i15EFSAE.mjs";
+import "../../../../../redirects-Bhpm8bRe.mjs";
+import { a as bylineFieldUpdateBody } from "../../../../../byline-fields-WN7RQT4q.mjs";
+import "../../../../../status-NqWOSFAD.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as requirePerm } from "../../../../../authorize-CcBxcHtz.mjs";
+import { n as requirePerm } from "../../../../../authorize-ZXPGPwKn.mjs";
 
 //#region src/astro/routes/api/admin/byline-fields/[slug].ts
 const prerender = false;

package/dist/astro/routes/api/admin/byline-fields/index.mjs

@@ -1,13 +1,13 @@
-import "../../../../../byline-registry-87nNnYl4.mjs";
-import "../../../../../context-types-DqTo6C79.mjs";
-import { i as handleBylineFieldList, t as handleBylineFieldCreate } from "../../../../../byline-fields-D-N5qVIG.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../error-CytFlgcd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-CbymENaR.mjs";
-import "../../../../../redirects-CA-xylPG.mjs";
-import { t as bylineFieldCreateBody } from "../../../../../byline-fields-DOJO16Gm.mjs";
-import "../../../../../status-DANd8ERo.mjs";
+import "../../../../../byline-registry-Ba54M74c.mjs";
+import "../../../../../context-types-eBuMDAg-.mjs";
+import { i as handleBylineFieldList, t as handleBylineFieldCreate } from "../../../../../byline-fields-BKzA0fJU.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../error-CSVaQNZy.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-i15EFSAE.mjs";
+import "../../../../../redirects-Bhpm8bRe.mjs";
+import { t as bylineFieldCreateBody } from "../../../../../byline-fields-WN7RQT4q.mjs";
+import "../../../../../status-NqWOSFAD.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as requirePerm } from "../../../../../authorize-CcBxcHtz.mjs";
+import { n as requirePerm } from "../../../../../authorize-ZXPGPwKn.mjs";
 
 //#region src/astro/routes/api/admin/byline-fields/index.ts
 const prerender = false;

package/dist/astro/routes/api/admin/byline-fields/reorder.mjs

@@ -1,13 +1,13 @@
-import "../../../../../byline-registry-87nNnYl4.mjs";
-import "../../../../../context-types-DqTo6C79.mjs";
-import { a as handleBylineFieldReorder } from "../../../../../byline-fields-D-N5qVIG.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../error-CytFlgcd.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-CbymENaR.mjs";
-import "../../../../../redirects-CA-xylPG.mjs";
-import { i as bylineFieldReorderBody } from "../../../../../byline-fields-DOJO16Gm.mjs";
-import "../../../../../status-DANd8ERo.mjs";
+import "../../../../../byline-registry-Ba54M74c.mjs";
+import "../../../../../context-types-eBuMDAg-.mjs";
+import { a as handleBylineFieldReorder } from "../../../../../byline-fields-BKzA0fJU.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../error-CSVaQNZy.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-i15EFSAE.mjs";
+import "../../../../../redirects-Bhpm8bRe.mjs";
+import { i as bylineFieldReorderBody } from "../../../../../byline-fields-WN7RQT4q.mjs";
+import "../../../../../status-NqWOSFAD.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as requirePerm } from "../../../../../authorize-CcBxcHtz.mjs";
+import { n as requirePerm } from "../../../../../authorize-ZXPGPwKn.mjs";
 
 //#region src/astro/routes/api/admin/byline-fields/reorder.ts
 const prerender = false;