dineway 0.2.0 → 0.2.1

package/dist/cli/plugin-kit.d.mts

@@ -0,0 +1,75 @@
+import { DinewayClient, PluginRequestOptions } from "../client/index.mjs";
+import { SubCommandsDef } from "citty";
+
+//#region src/cli/contributions.d.ts
+interface DinewayCliContribution {
+  commands: SubCommandsDef;
+}
+//#endregion
+//#region src/cli/client-factory.d.ts
+interface ClientArgs {
+  url?: string;
+  token?: string;
+}
+/**
+ * Shared connection args for all CLI commands that talk to a Dineway instance.
+ * Spread into each command's `args` definition.
+ */
+declare const connectionArgs: {
+  url: {
+    type: "string";
+    alias: string;
+    description: string;
+    default: string;
+  };
+  token: {
+    type: "string";
+    alias: string;
+    description: string;
+  };
+  header: {
+    type: "string";
+    alias: string;
+    description: string;
+  };
+  json: {
+    type: "boolean";
+    description: string;
+  };
+};
+/**
+ * Create a DinewayClient from CLI args, env vars, and stored credentials.
+ *
+ * Auth resolution order:
+ * 1. --token flag
+ * 2. DINEWAY_TOKEN env var
+ * 3. Stored credentials (~/.config/dineway/auth.json)
+ * 4. Dev bypass (if URL is localhost)
+ *
+ * Custom headers are merged from (in priority order):
+ * 1. Stored credentials (persisted during `dineway login --header`)
+ * 2. DINEWAY_HEADERS env var
+ * 3. --header CLI flags
+ */
+declare function createClientFromArgs(args: ClientArgs): DinewayClient;
+//#endregion
+//#region src/cli/output.d.ts
+interface OutputArgs {
+  json?: boolean;
+}
+/**
+ * Redirect consola output to stderr so it doesn't pollute JSON on stdout.
+ *
+ * Call this early in any command that uses `output()` with `--json`.
+ * Safe to call multiple times — only applies the redirect once.
+ */
+declare function configureOutputMode(args: OutputArgs): void;
+/**
+ * Output data as JSON or pretty-printed.
+ *
+ * If stdout is not a TTY or --json is set, outputs JSON.
+ * Otherwise, outputs a formatted representation.
+ */
+declare function output(data: unknown, args: OutputArgs): void;
+//#endregion
+export { type DinewayCliContribution, type PluginRequestOptions, configureOutputMode, connectionArgs, createClientFromArgs, output };

package/dist/cli/plugin-kit.mjs

@@ -0,0 +1,4 @@
+import { n as output, t as configureOutputMode } from "../output-DhBe5_Pi.mjs";
+import { n as connectionArgs, r as createClientFromArgs } from "../client-factory-BDD9azPJ.mjs";
+
+export { configureOutputMode, connectionArgs, createClientFromArgs, output };

package/dist/client/external-auth-headers.d.mts

@@ -1,4 +1,4 @@
-import { t as Interceptor } from "../transport-CcJu3Co8.mjs";
+import { t as Interceptor } from "../transport-D9pKAzFP.mjs";
 
 //#region src/client/external-auth-headers.d.ts
 /**

package/dist/client/index.d.mts

@@ -1,49 +1,6 @@
-import { a as tokenInterceptor, i as devBypassInterceptor, n as createTransport, r as csrfInterceptor, t as Interceptor } from "../transport-CcJu3Co8.mjs";
+import { a as tokenInterceptor, i as devBypassInterceptor, n as createTransport, r as csrfInterceptor, t as Interceptor } from "../transport-D9pKAzFP.mjs";
+import { n as markdownToPortableText, r as portableTextToMarkdown, t as PortableTextBlock } from "../portable-text-E79LyjGo.mjs";
 
-//#region src/client/portable-text.d.ts
-/**
- * Portable Text <-> Markdown conversion layer.
- *
- * Three tiers of block handling:
- *   Tier 1: Standard PT blocks <-> standard Markdown (headings, paragraphs, lists, etc.)
- *   Tier 2: Dineway custom blocks <-> Markdown directives (future)
- *   Tier 3: Unknown blocks <-> opaque HTML comment fences (preserved, not editable)
- */
-/** Minimal Portable Text block shape */
-interface PortableTextBlock {
-  _type: string;
-  _key?: string;
-  style?: string;
-  level?: number;
-  listItem?: string;
-  markDefs?: MarkDef[];
-  children?: PortableTextSpan[];
-  [key: string]: unknown;
-}
-interface PortableTextSpan {
-  _type: string;
-  _key?: string;
-  text?: string;
-  marks?: string[];
-  [key: string]: unknown;
-}
-interface MarkDef {
-  _key: string;
-  _type: string;
-  href?: string;
-  [key: string]: unknown;
-}
-/**
- * Convert Portable Text blocks to Markdown.
- * Unknown block types are serialized as opaque fences.
- */
-declare function portableTextToMarkdown(blocks: PortableTextBlock[]): string;
-/**
- * Convert Markdown to Portable Text blocks.
- * Opaque fences (<!--ec:block ... -->) are deserialized and spliced back in.
- */
-declare function markdownToPortableText(markdown: string): PortableTextBlock[];
-//#endregion
 //#region src/client/index.d.ts
 interface DinewayClientOptions {
   /** Base URL of the Dineway instance */
@@ -59,6 +16,11 @@ interface DinewayClientOptions {
   /** Additional request interceptors */
   interceptors?: Interceptor[];
 }
+interface PluginRequestOptions {
+  method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+  query?: Record<string, string | number | boolean | null | undefined>;
+  body?: unknown;
+}
 /** Standard API error shape */
 interface ApiError {
   code: string;
@@ -93,6 +55,18 @@ interface ContentItem {
   translationGroup: string | null;
   _rev?: string;
 }
+interface ContentPublishOptions {
+  reviewRequestId: string;
+  releaseAuthorizationId?: string;
+  publishedAt?: string;
+  locale?: string;
+}
+interface ContentScheduleOptions {
+  at: string;
+  reviewRequestId: string;
+  releaseAuthorizationId?: string;
+  locale?: string;
+}
 /** Collection metadata */
 interface Collection {
   slug: string;
@@ -105,6 +79,7 @@ interface Collection {
 /** Collection with fields */
 interface CollectionWithFields extends Collection {
   fields: Field[];
+  schemaFingerprint: string;
 }
 /** Field metadata */
 interface Field {
@@ -320,14 +295,12 @@ declare class DinewayClient {
   }): Promise<ContentItem>;
   /** Delete (soft) a content item */
   delete(collection: string, id: string): Promise<void>;
-  /** Publish a content item */
-  publish(collection: string, id: string): Promise<void>;
+  /** Publish an exact, editorially approved Draft Revision */
+  publish(collection: string, id: string, options: ContentPublishOptions): Promise<void>;
   /** Unpublish a content item */
   unpublish(collection: string, id: string): Promise<void>;
-  /** Schedule publishing */
-  schedule(collection: string, id: string, options: {
-    at: string;
-  }): Promise<void>;
+  /** Schedule an exact, editorially approved Draft Revision */
+  schedule(collection: string, id: string, options: ContentScheduleOptions): Promise<void>;
   /** Restore a trashed content item */
   restore(collection: string, id: string): Promise<void>;
   /** Compare live and draft revisions */
@@ -394,6 +367,8 @@ declare class DinewayClient {
   menu(name: string): Promise<MenuWithItems>;
   /** Create a one-time browser setup link for the current admin user. */
   createSetupLink(): Promise<SetupLinkResult>;
+  /** Invoke a deterministic application-service route contributed by an active plugin. */
+  pluginRequest<T>(pluginId: string, routePath: string, options?: PluginRequestOptions): Promise<T>;
   /** Make a typed JSON request to the API */
   private request;
   /** Make a raw request — caller handles response */
@@ -404,4 +379,4 @@ declare class DinewayClient {
   private getFieldSchemas;
 }
 //#endregion
-export { ApiError, ClientResponse, Collection, CollectionWithFields, ContentItem, DinewayApiError, DinewayClient, DinewayClientError, DinewayClientOptions, Field, type Interceptor, ListResult, Manifest, MediaItem, Menu, MenuItem, MenuWithItems, type PortableTextBlock, SchemaExport, SearchResult, SetupLinkResult, Taxonomy, Term, createTransport, csrfInterceptor, devBypassInterceptor, markdownToPortableText, portableTextToMarkdown, tokenInterceptor };
+export { ApiError, ClientResponse, Collection, CollectionWithFields, ContentItem, ContentPublishOptions, ContentScheduleOptions, DinewayApiError, DinewayClient, DinewayClientError, DinewayClientOptions, Field, type Interceptor, ListResult, Manifest, MediaItem, Menu, MenuItem, MenuWithItems, PluginRequestOptions, type PortableTextBlock, SchemaExport, SearchResult, SetupLinkResult, Taxonomy, Term, createTransport, csrfInterceptor, devBypassInterceptor, markdownToPortableText, portableTextToMarkdown, tokenInterceptor };

package/dist/client/index.mjs

@@ -1,5 +1,5 @@
-import { i as portableTextToMarkdown, n as convertDataForWrite, r as markdownToPortableText, t as convertDataForRead } from "../portable-text-dA_UlJwW.mjs";
-import { a as tokenInterceptor, i as refreshInterceptor, n as csrfInterceptor, r as devBypassInterceptor, t as createTransport } from "../transport-BNmCqLu7.mjs";
+import { i as portableTextToMarkdown, n as convertDataForWrite, r as markdownToPortableText, t as convertDataForRead } from "../portable-text-BASHceim.mjs";
+import { a as tokenInterceptor, i as refreshInterceptor, n as csrfInterceptor, r as devBypassInterceptor, t as createTransport } from "../transport-C46KHLMP.mjs";
 import mime from "mime/lite";
 
 //#region src/client/index.ts
@@ -22,6 +22,8 @@ import mime from "mime/lite";
 * ```
 */
 const TRAILING_SLASH_PATTERN = /\/$/;
+const LEADING_TRAILING_SLASH_PATTERN = /^\/+|\/+$/g;
+const PLUGIN_ID_PATTERN = /^[a-z][a-z0-9-]*$/;
 function mimeFromFilename(filename) {
 	return mime.getType(filename) ?? "application/octet-stream";
 }
@@ -189,17 +191,31 @@ var DinewayClient = class {
 	async delete(collection, id) {
 		await this.request("DELETE", `/content/${encodeURIComponent(collection)}/${encodeURIComponent(id)}`);
 	}
-	/** Publish a content item */
-	async publish(collection, id) {
-		await this.request("POST", `/content/${encodeURIComponent(collection)}/${encodeURIComponent(id)}/publish`);
+	/** Publish an exact, editorially approved Draft Revision */
+	async publish(collection, id, options) {
+		const params = new URLSearchParams();
+		if (options.locale) params.set("locale", options.locale);
+		const qs = params.toString();
+		await this.request("POST", `/content/${encodeURIComponent(collection)}/${encodeURIComponent(id)}/publish${qs ? `?${qs}` : ""}`, {
+			reviewRequestId: options.reviewRequestId,
+			releaseAuthorizationId: options.releaseAuthorizationId,
+			publishedAt: options.publishedAt
+		});
 	}
 	/** Unpublish a content item */
 	async unpublish(collection, id) {
 		await this.request("POST", `/content/${encodeURIComponent(collection)}/${encodeURIComponent(id)}/unpublish`);
 	}
-	/** Schedule publishing */
+	/** Schedule an exact, editorially approved Draft Revision */
 	async schedule(collection, id, options) {
-		await this.request("POST", `/content/${encodeURIComponent(collection)}/${encodeURIComponent(id)}/schedule`, { scheduledAt: options.at });
+		const params = new URLSearchParams();
+		if (options.locale) params.set("locale", options.locale);
+		const qs = params.toString();
+		await this.request("POST", `/content/${encodeURIComponent(collection)}/${encodeURIComponent(id)}/schedule${qs ? `?${qs}` : ""}`, {
+			scheduledAt: options.at,
+			reviewRequestId: options.reviewRequestId,
+			releaseAuthorizationId: options.releaseAuthorizationId
+		});
 	}
 	/** Restore a trashed content item */
 	async restore(collection, id) {
@@ -292,6 +308,17 @@ var DinewayClient = class {
 	async createSetupLink() {
 		return this.request("POST", "/auth/setup-token");
 	}
+	/** Invoke a deterministic application-service route contributed by an active plugin. */
+	async pluginRequest(pluginId, routePath, options = {}) {
+		if (!PLUGIN_ID_PATTERN.test(pluginId)) throw new Error("Invalid plugin ID");
+		const segments = routePath.replace(LEADING_TRAILING_SLASH_PATTERN, "").split("/");
+		if (segments.length === 0 || segments.some((segment) => !segment || segment === "." || segment === "..")) throw new Error("Invalid plugin route path");
+		const encodedPath = segments.map((segment) => encodeURIComponent(segment)).join("/");
+		const query = new URLSearchParams();
+		for (const [key, value] of Object.entries(options.query ?? {})) if (value !== void 0 && value !== null) query.set(key, String(value));
+		const suffix = query.size > 0 ? `?${query.toString()}` : "";
+		return this.request(options.method ?? "GET", `/plugins/${encodeURIComponent(pluginId)}/${encodedPath}${suffix}`, options.body);
+	}
 	/** Make a typed JSON request to the API */
 	async request(method, path, body) {
 		const response = await this.requestRaw(method, path, body);

package/dist/client-factory-BDD9azPJ.mjs

@@ -0,0 +1,233 @@
+import { a as __exportAll } from "./runner-BgmttQmD.mjs";
+import { customHeadersInterceptor, resolveCustomHeaders } from "./client/external-auth-headers.mjs";
+import { DinewayClient } from "./client/index.mjs";
+import { a as resolveDinewayBaseUrl, o as resolveDinewayToken, t as DEFAULT_DINEWAY_URL } from "./project-env-DKibmuP8.mjs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { homedir } from "node:os";
+
+//#region src/cli/credentials.ts
+/**
+* Credential storage for CLI auth tokens.
+*
+* Stores OAuth tokens in ~/.config/dineway/auth.json.
+* Remote URLs are keyed by origin, local dev by project path.
+*/
+function getConfigDir() {
+	const xdg = process.env["XDG_CONFIG_HOME"];
+	if (xdg) return join(xdg, "dineway");
+	return join(homedir(), ".config", "dineway");
+}
+function getCredentialPath() {
+	return join(getConfigDir(), "auth.json");
+}
+/**
+* Resolve the credential key for a given URL.
+*
+* Remote URLs are keyed by origin (e.g. "https://my-site.pages.dev").
+* Local dev instances are keyed by project path (e.g. "path:/Users/matt/sites/blog").
+*/
+function resolveCredentialKey(baseUrl) {
+	try {
+		const url = new URL(baseUrl);
+		if (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]") {
+			const projectPath = findProjectRoot(process.cwd());
+			if (projectPath) return `path:${projectPath}`;
+			return url.origin;
+		}
+		return url.origin;
+	} catch {
+		return baseUrl;
+	}
+}
+/**
+* Walk up from cwd to find the project root (directory containing astro.config.*).
+*/
+function findProjectRoot(from) {
+	let dir = resolve(from);
+	const root = resolve("/");
+	while (dir !== root) {
+		for (const name of [
+			"astro.config.ts",
+			"astro.config.mts",
+			"astro.config.js",
+			"astro.config.mjs"
+		]) if (existsSync(join(dir, name))) return dir;
+		const parent = resolve(dir, "..");
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return null;
+}
+function readStore() {
+	const path = getCredentialPath();
+	try {
+		if (existsSync(path)) {
+			const content = readFileSync(path, "utf-8");
+			return JSON.parse(content);
+		}
+	} catch {}
+	return {};
+}
+function writeStore(store) {
+	mkdirSync(getConfigDir(), {
+		recursive: true,
+		mode: 448
+	});
+	writeFileSync(getCredentialPath(), JSON.stringify(store, null, "	"), {
+		encoding: "utf-8",
+		mode: 384
+	});
+}
+/**
+* Get stored credentials for a URL.
+*/
+function getCredentials(baseUrl) {
+	const key = resolveCredentialKey(baseUrl);
+	const cred = readStore()[key];
+	if (!cred || !("accessToken" in cred)) return null;
+	return cred;
+}
+/**
+* Save credentials for a URL.
+*/
+function saveCredentials(baseUrl, cred) {
+	const key = resolveCredentialKey(baseUrl);
+	const store = readStore();
+	store[key] = cred;
+	writeStore(store);
+}
+/**
+* Remove credentials for a URL.
+*/
+function removeCredentials(baseUrl) {
+	const key = resolveCredentialKey(baseUrl);
+	const store = readStore();
+	if (key in store) {
+		delete store[key];
+		writeStore(store);
+		return true;
+	}
+	return false;
+}
+function marketplaceKey(registryUrl) {
+	try {
+		return `marketplace:${new URL(registryUrl).origin}`;
+	} catch {
+		return `marketplace:${registryUrl}`;
+	}
+}
+/**
+* Get stored marketplace credential for a registry URL.
+*/
+function getMarketplaceCredential(registryUrl) {
+	const key = marketplaceKey(registryUrl);
+	const cred = readStore()[key];
+	if (!cred || !("token" in cred)) return null;
+	if (new Date(cred.expiresAt) < /* @__PURE__ */ new Date()) return null;
+	return cred;
+}
+/**
+* Save marketplace credential for a registry URL.
+*/
+function saveMarketplaceCredential(registryUrl, cred) {
+	const key = marketplaceKey(registryUrl);
+	const store = readStore();
+	store[key] = cred;
+	writeStore(store);
+}
+/**
+* Remove marketplace credential for a registry URL.
+*/
+function removeMarketplaceCredential(registryUrl) {
+	const key = marketplaceKey(registryUrl);
+	const store = readStore();
+	if (key in store) {
+		delete store[key];
+		writeStore(store);
+		return true;
+	}
+	return false;
+}
+
+//#endregion
+//#region src/cli/client-factory.ts
+var client_factory_exports = /* @__PURE__ */ __exportAll({
+	connectionArgs: () => connectionArgs,
+	createClientFromArgs: () => createClientFromArgs
+});
+/**
+* Shared connection args for all CLI commands that talk to a Dineway instance.
+* Spread into each command's `args` definition.
+*/
+const connectionArgs = {
+	url: {
+		type: "string",
+		alias: "u",
+		description: "Dineway instance URL",
+		default: DEFAULT_DINEWAY_URL
+	},
+	token: {
+		type: "string",
+		alias: "t",
+		description: "Auth token"
+	},
+	header: {
+		type: "string",
+		alias: "H",
+		description: "Custom header \"Name: Value\" (repeatable, or use DINEWAY_HEADERS env)"
+	},
+	json: {
+		type: "boolean",
+		description: "Output as JSON"
+	}
+};
+/**
+* Create a DinewayClient from CLI args, env vars, and stored credentials.
+*
+* Auth resolution order:
+* 1. --token flag
+* 2. DINEWAY_TOKEN env var
+* 3. Stored credentials (~/.config/dineway/auth.json)
+* 4. Dev bypass (if URL is localhost)
+*
+* Custom headers are merged from (in priority order):
+* 1. Stored credentials (persisted during `dineway login --header`)
+* 2. DINEWAY_HEADERS env var
+* 3. --header CLI flags
+*/
+function createClientFromArgs(args) {
+	const baseUrl = resolveDinewayBaseUrl(args.url);
+	let token = resolveDinewayToken(args.token);
+	const isLocal = baseUrl.includes("localhost") || baseUrl.includes("127.0.0.1");
+	const cred = !token ? getCredentials(baseUrl) : null;
+	const customHeaders = {
+		...cred?.customHeaders,
+		...resolveCustomHeaders()
+	};
+	const extraInterceptors = [];
+	if (Object.keys(customHeaders).length > 0) extraInterceptors.push(customHeadersInterceptor(customHeaders));
+	if (!token && cred) if (new Date(cred.expiresAt) > /* @__PURE__ */ new Date()) token = cred.accessToken;
+	else return new DinewayClient({
+		baseUrl,
+		token: cred.accessToken,
+		refreshToken: cred.refreshToken,
+		onTokenRefresh: (newAccessToken, expiresIn) => {
+			saveCredentials(baseUrl, {
+				...cred,
+				accessToken: newAccessToken,
+				expiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString()
+			});
+		},
+		interceptors: extraInterceptors
+	});
+	return new DinewayClient({
+		baseUrl,
+		token,
+		devBypass: !token && isLocal,
+		interceptors: extraInterceptors
+	});
+}
+
+//#endregion
+export { getMarketplaceCredential as a, resolveCredentialKey as c, getCredentials as i, saveCredentials as l, connectionArgs as n, removeCredentials as o, createClientFromArgs as r, removeMarketplaceCredential as s, client_factory_exports as t, saveMarketplaceCredential as u };

package/dist/{comment-DlA4iChg.mjs → comment-DFALgsJD.mjs}

@@ -1,4 +1,4 @@
-import { i as encodeCursor, r as decodeCursor } from "./types-Dq1qT19x.mjs";
+import { i as encodeCursor, r as decodeCursor } from "./types-ChxYDRvx.mjs";
 import { s as invalidateCommentObjectCache } from "./object-cache-D51qOseS.mjs";
 import { sql } from "kysely";
 import { ulid } from "ulidx";

package/dist/{comment-reaction-DfFao1ST.mjs → comment-reaction-C37bf99u.mjs}

@@ -1,4 +1,4 @@
-import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-CxBt-GxR.mjs";
+import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-ChGNDY8r.mjs";
 import { ulid } from "ulidx";
 
 //#region src/database/repositories/comment-reaction.ts

package/dist/{comments-DApFGMsP.mjs → comments-B3NwDBxl.mjs}

@@ -1,4 +1,4 @@
-import { t as CommentRepository } from "./comment-DlA4iChg.mjs";
+import { t as CommentRepository } from "./comment-DFALgsJD.mjs";
 
 //#region src/api/handlers/comments.ts
 async function handleCommentList(db, collection, contentId, options = {}) {

package/dist/{content-Bh4BDjv8.mjs → content-DJcAYFhz.mjs}

@@ -1,6 +1,6 @@
-import { a as __exportAll } from "./runner-DB7CRfOF.mjs";
+import { a as __exportAll } from "./runner-BgmttQmD.mjs";
 import { t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
-import { i as encodeCursor, n as ScheduledNotDueError, r as decodeCursor, t as DinewayValidationError } from "./types-Dq1qT19x.mjs";
+import { i as encodeCursor, n as ScheduledNotDueError, r as decodeCursor, t as DinewayValidationError } from "./types-ChxYDRvx.mjs";
 import { o as invalidateCollectionCache } from "./object-cache-D51qOseS.mjs";
 import { n as slugify } from "./slugify-KSsVD_D3.mjs";
 import { sql } from "kysely";

package/dist/{content-refresh-CgutSUfO.mjs → content-refresh-B4ZCmxgd.mjs}

@@ -1,10 +1,10 @@
 import { t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
 import { r as isI18nEnabled } from "./config-CVssduLe.mjs";
-import { i as encodeCursor, r as decodeCursor } from "./types-Dq1qT19x.mjs";
-import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-CxBt-GxR.mjs";
-import { t as withTransaction } from "./transaction-C2EOMTJA.mjs";
-import { n as normalizeMime } from "./mime-CA7Lgovc.mjs";
-import { n as hashString } from "./hash-BPmX6P8I.mjs";
+import { i as encodeCursor, r as decodeCursor } from "./types-ChxYDRvx.mjs";
+import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-ChGNDY8r.mjs";
+import { t as withTransaction } from "./transaction-0LEAAy8R.mjs";
+import { n as normalizeMime } from "./mime-C0vOHFm7.mjs";
+import { n as hashString } from "./hash-mxxx2oPW.mjs";
 import { sql } from "kysely";
 import { ulid } from "ulidx";
 

package/dist/{context-CK4ym2Sf.mjs → context-DnpXcp6Y.mjs}

@@ -1,5 +1,5 @@
-import { a as ContextRepository, i as parseSiteBriefingScope, n as SiteBriefingError } from "./briefing-CawZ59CY.mjs";
-import { b as toPublicContextEntryPage, v as toPublicContextDiff, y as toPublicContextEntry } from "./site-context-DQiL8Fl5.mjs";
+import { _ as toPublicContextDiff, v as toPublicContextEntry, y as toPublicContextEntryPage } from "./site-context-B8T1kpUP.mjs";
+import { a as ContextRepository, i as parseSiteBriefingScope, n as SiteBriefingError } from "./briefing-0rf-su3-.mjs";
 
 //#region src/api/handlers/context.ts
 async function handleContextEntryList(db, input = {}) {

package/dist/{context-C5W3G18y.mjs → context-fSCYLL3c.mjs}

@@ -1,16 +1,16 @@
 import { n as validateJsonFieldName } from "./validate-VPnKoIzW.mjs";
 import { c as jsonExtractExpr } from "./dialect-helpers-fk43GbDb.mjs";
-import { i as encodeCursor, r as decodeCursor } from "./types-Dq1qT19x.mjs";
-import { t as ContentRepository } from "./content-Bh4BDjv8.mjs";
-import { t as MediaRepository } from "./media-DMj0grzC.mjs";
-import { t as UserRepository } from "./user-BIZPzCb9.mjs";
+import { i as encodeCursor, r as decodeCursor } from "./types-ChxYDRvx.mjs";
+import { t as ContentRepository } from "./content-DJcAYFhz.mjs";
+import { t as MediaRepository } from "./media-CVMOoywq.mjs";
+import { t as UserRepository } from "./user-BH-n01y3.mjs";
 import { t as OptionsRepository } from "./options-DQPTH5n0.mjs";
-import { t as withTransaction } from "./transaction-C2EOMTJA.mjs";
-import { t as enrichImageMetadata } from "./enrich-DIFIFA8O.mjs";
-import { t as SeoRepository } from "./seo-CQG3GCHQ.mjs";
-import { a as markContentMediaUsageCollectionStaleSafely } from "./content-refresh-CgutSUfO.mjs";
-import { a as validateExternalUrl, i as stripCredentialHeaders, t as SsrfError } from "./ssrf-DWe8jwAp.mjs";
-import { t as CronAccessImpl } from "./cron-cKcNTix_.mjs";
+import { t as withTransaction } from "./transaction-0LEAAy8R.mjs";
+import { t as enrichImageMetadata } from "./enrich-Ck9tfMqe.mjs";
+import { t as SeoRepository } from "./seo-BU8MLCS9.mjs";
+import { a as markContentMediaUsageCollectionStaleSafely } from "./content-refresh-B4ZCmxgd.mjs";
+import { a as validateExternalUrl, i as stripCredentialHeaders, t as SsrfError } from "./ssrf-FJqwQzj4.mjs";
+import { t as CronAccessImpl } from "./cron-B1SL_lsb.mjs";
 import { sql } from "kysely";
 import { ulid } from "ulidx";
 
@@ -703,13 +703,13 @@ function createHttpAccess(pluginId, allowedHosts) {
 * No host validation, but applies SSRF protection on redirect targets to
 * prevent plugins from being tricked into reaching internal services.
 */
-function createUnrestrictedHttpAccess(pluginId) {
+function createUnrestrictedHttpAccess(pluginId, options = {}) {
 	return { async fetch(url, init) {
 		let currentUrl = url;
 		let currentInit = init;
 		for (let i = 0; i <= MAX_PLUGIN_REDIRECTS; i++) {
 			try {
-				validateExternalUrl(currentUrl);
+				if (!isAllowedDevelopmentLoopback(currentUrl, options.allowDevelopmentLoopback)) validateExternalUrl(currentUrl);
 			} catch (e) {
 				const msg = e instanceof SsrfError ? e.message : "SSRF validation failed";
 				throw new Error(`Plugin "${pluginId}": blocked fetch to "${new URL(currentUrl).hostname}": ${msg}`, { cause: e });
@@ -728,6 +728,17 @@ function createUnrestrictedHttpAccess(pluginId) {
 		throw new Error(`Plugin "${pluginId}": too many redirects (max ${MAX_PLUGIN_REDIRECTS})`);
 	} };
 }
+function isAllowedDevelopmentLoopback(url, capability = false) {
+	if (!capability || process.env.NODE_ENV !== "development") return false;
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return false;
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+	return parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]";
+}
 /**
 * Create logger for a plugin
 */
@@ -868,7 +879,7 @@ var PluginContextFactory = class {
 		}
 		else if (capabilities.has("media:read")) media = createMediaAccess(db);
 		let http;
-		if (capabilities.has("network:request:unrestricted")) http = createUnrestrictedHttpAccess(plugin.id);
+		if (capabilities.has("network:request:unrestricted")) http = createUnrestrictedHttpAccess(plugin.id, { allowDevelopmentLoopback: capabilities.has("network:request:development-loopback") });
 		else if (capabilities.has("network:request")) http = createHttpAccess(plugin.id, plugin.allowedHosts);
 		let users;
 		if (capabilities.has("users:read")) users = createUserAccess(db);

package/dist/{context-route-helpers-MASyGgWf.mjs → context-route-helpers-CI8XzcsK.mjs}

@@ -1,5 +1,5 @@
-import { t as resolveActorIdentity } from "./actor-CrObAPV0.mjs";
-import { p as logSiteActivitySafely } from "./activity-events-y6eT8UW6.mjs";
+import { n as resolveActorIdentity } from "./actor-0QJ1Gbtf.mjs";
+import { p as logSiteActivitySafely } from "./activity-events-CJDvE2uc.mjs";
 
 //#region src/api/context-route-helpers.ts
 function resolveContextRouteActor(locals) {

package/dist/{dashboard-DQkVT7Ei.mjs → dashboard-D0nj5oWg.mjs}

@@ -1,8 +1,8 @@
 import { t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
-import { t as ContentRepository } from "./content-Bh4BDjv8.mjs";
-import { t as MediaRepository } from "./media-DMj0grzC.mjs";
-import { t as UserRepository } from "./user-BIZPzCb9.mjs";
-import { t as ReviewRequestRepository } from "./review-requests-DUyEmtmG.mjs";
+import { t as ContentRepository } from "./content-DJcAYFhz.mjs";
+import { t as MediaRepository } from "./media-CVMOoywq.mjs";
+import { t as UserRepository } from "./user-BH-n01y3.mjs";
+import { t as ReviewRequestRepository } from "./review-requests-CTWGnWUt.mjs";
 import { sql } from "kysely";
 
 //#region src/api/handlers/dashboard.ts