dineway 0.2.32 → 0.2.34

package/dist/{device-flow-eOcL5m0Q.mjs → device-flow-DhpCzMo0.mjs}

@@ -1,9 +1,10 @@
-import { t as withTransaction } from "./transaction-BGQgnwUi.mjs";
-import { a as hashApiToken, n as TOKEN_PREFIXES, r as generatePrefixedToken, t as ALL_VALID_SCOPES } from "./api-tokens-CmT83Bgj.mjs";
-import { a as filterExperimentalSiteContextWorkflowScopes, i as experimentalSiteContextWorkflowsEnabled, o as getExperimentalSiteContextWorkflowScopesDisabledMessage, r as disabledExperimentalSiteContextWorkflowScopes } from "./experimental-workflows-B9x8delL.mjs";
-import { o as lookupOAuthClient } from "./oauth-clients-tovQ4D4h.mjs";
-import { t as lookupUserRoleAndStatus } from "./oauth-user-lookup-B451pZmd.mjs";
-import { clampScopes } from "@dineway-ai/auth";
+import { AtomicWriteConflict, atomicBatch, rowUnchanged } from "./database/batch.mjs";
+import { r as currentIsoTimestampValue } from "./dialect-helpers-C6xtO-Ui.mjs";
+import { a as hashApiToken, n as TOKEN_PREFIXES, r as generatePrefixedToken, t as ALL_VALID_SCOPES } from "./api-tokens-D5K_Csub.mjs";
+import { a as filterExperimentalSiteContextWorkflowScopes, i as experimentalSiteContextWorkflowsEnabled, o as getExperimentalSiteContextWorkflowScopesDisabledMessage, r as disabledExperimentalSiteContextWorkflowScopes } from "./experimental-workflows-M5D3RTFo.mjs";
+import { t as readTokenAuthority } from "./oauth-authority-CCqo4eBm.mjs";
+import { sql } from "kysely";
+import { clampScopes, toRoleLevel } from "@dineway-ai/auth";
 import { generateCodeVerifier } from "arctic";
 
 //#region src/api/handlers/device-flow.ts
@@ -200,57 +201,72 @@ async function handleDeviceTokenExchange(db, input) {
 				message: "Invalid device code state"
 			}
 		};
-		return await withTransaction(db, async (trx) => {
-			const consumed = await trx.deleteFrom("_dineway_device_codes").where("device_code", "=", input.device_code).where("status", "=", "authorized").where("user_id", "is not", null).returningAll().executeTakeFirst();
-			if (!consumed?.user_id) return {
-				success: false,
-				error: {
-					code: "INVALID_GRANT",
-					message: "Invalid device code"
-				}
-			};
-			const scopes = filterExperimentalSiteContextWorkflowScopes(JSON.parse(consumed.scopes));
-			if (scopes.length === 0) return {
-				success: false,
-				error: {
-					code: "INVALID_GRANT",
-					message: "Device code no longer supports any permitted scopes"
-				}
-			};
-			const accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);
-			const accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);
-			const refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);
-			const refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);
-			await trx.insertInto("_dineway_oauth_tokens").values({
-				token_hash: accessToken.hash,
-				token_type: "access",
-				user_id: consumed.user_id,
-				scopes: JSON.stringify(scopes),
-				client_type: "cli",
-				expires_at: accessExpires,
-				refresh_token_hash: refreshToken.hash
-			}).execute();
-			await trx.insertInto("_dineway_oauth_tokens").values({
-				token_hash: refreshToken.hash,
-				token_type: "refresh",
-				user_id: consumed.user_id,
-				scopes: JSON.stringify(scopes),
-				client_type: "cli",
-				expires_at: refreshExpires,
-				refresh_token_hash: null
-			}).execute();
-			return {
-				success: true,
-				data: {
-					access_token: accessToken.raw,
-					refresh_token: refreshToken.raw,
-					token_type: "Bearer",
-					expires_in: ACCESS_TOKEN_TTL_SECONDS,
-					scope: scopes.join(" ")
-				}
-			};
+		const authority = await readTokenAuthority(db, row.user_id);
+		if (!authority.user || authority.user.disabled) return {
+			success: false,
+			error: {
+				code: "INVALID_GRANT",
+				message: "User account is unavailable"
+			}
+		};
+		const scopes = clampScopes(filterExperimentalSiteContextWorkflowScopes(JSON.parse(row.scopes)), authority.user.role, { includeExperimental: experimentalSiteContextWorkflowsEnabled() });
+		if (scopes.length === 0) return {
+			success: false,
+			error: {
+				code: "INVALID_GRANT",
+				message: "Device code no longer supports any permitted scopes"
+			}
+		};
+		const accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);
+		const accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);
+		const refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);
+		const refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);
+		await atomicBatch(db, {
+			checks: [
+				rowUnchanged("_dineway_device_codes", row),
+				...authority.checks,
+				sql`EXISTS (SELECT 1 FROM _dineway_device_codes WHERE device_code = ${input.device_code} AND expires_at > ${currentIsoTimestampValue(db)})`
+			],
+			statements: [
+				db.deleteFrom("_dineway_device_codes").where("device_code", "=", input.device_code).compile(),
+				db.insertInto("_dineway_oauth_tokens").values({
+					token_hash: accessToken.hash,
+					token_type: "access",
+					user_id: row.user_id,
+					scopes: JSON.stringify(scopes),
+					client_type: "cli",
+					expires_at: accessExpires,
+					refresh_token_hash: refreshToken.hash
+				}).compile(),
+				db.insertInto("_dineway_oauth_tokens").values({
+					token_hash: refreshToken.hash,
+					token_type: "refresh",
+					user_id: row.user_id,
+					scopes: JSON.stringify(scopes),
+					client_type: "cli",
+					expires_at: refreshExpires,
+					refresh_token_hash: null
+				}).compile()
+			]
 		});
-	} catch {
+		return {
+			success: true,
+			data: {
+				access_token: accessToken.raw,
+				refresh_token: refreshToken.raw,
+				token_type: "Bearer",
+				expires_in: ACCESS_TOKEN_TTL_SECONDS,
+				scope: scopes.join(" ")
+			}
+		};
+	} catch (error) {
+		if (error instanceof AtomicWriteConflict) return {
+			success: false,
+			error: {
+				code: "INVALID_GRANT",
+				message: "Device code or account authorization changed"
+			}
+		};
 		return {
 			success: false,
 			error: {
@@ -291,8 +307,24 @@ async function handleDeviceAuthorize(db, userId, userRole, input) {
 				}
 			};
 		}
+		const authority = await readTokenAuthority(db, userId);
+		if (!authority.user || authority.user.disabled) return {
+			success: false,
+			error: {
+				code: "FORBIDDEN",
+				message: "User account is unavailable"
+			}
+		};
+		const checks = [
+			rowUnchanged("_dineway_device_codes", match),
+			...authority.checks,
+			sql`EXISTS (SELECT 1 FROM _dineway_device_codes WHERE device_code = ${match.device_code} AND expires_at > ${currentIsoTimestampValue(db)})`
+		];
 		if ((input.action ?? "approve") === "deny") {
-			await db.updateTable("_dineway_device_codes").set({ status: "denied" }).where("device_code", "=", match.device_code).execute();
+			await atomicBatch(db, {
+				checks,
+				statements: [db.updateTable("_dineway_device_codes").set({ status: "denied" }).where("device_code", "=", match.device_code).compile()]
+			});
 			return {
 				success: true,
 				data: { authorized: false }
@@ -306,7 +338,7 @@ async function handleDeviceAuthorize(db, userId, userRole, input) {
 				message: getExperimentalSiteContextWorkflowScopesDisabledMessage()
 			}
 		};
-		const effectiveScopes = clampScopes(requestedScopes, userRole, { includeExperimental: experimentalSiteContextWorkflowsEnabled() });
+		const effectiveScopes = clampScopes(requestedScopes, toRoleLevel(Math.min(userRole, authority.user.role)), { includeExperimental: experimentalSiteContextWorkflowsEnabled() });
 		if (effectiveScopes.length === 0) return {
 			success: false,
 			error: {
@@ -314,16 +346,26 @@ async function handleDeviceAuthorize(db, userId, userRole, input) {
 				message: "Your role does not permit any of the requested scopes"
 			}
 		};
-		await db.updateTable("_dineway_device_codes").set({
-			status: "authorized",
-			user_id: userId,
-			scopes: JSON.stringify(effectiveScopes)
-		}).where("device_code", "=", match.device_code).execute();
+		await atomicBatch(db, {
+			checks,
+			statements: [db.updateTable("_dineway_device_codes").set({
+				status: "authorized",
+				user_id: userId,
+				scopes: JSON.stringify(effectiveScopes)
+			}).where("device_code", "=", match.device_code).compile()]
+		});
 		return {
 			success: true,
 			data: { authorized: true }
 		};
-	} catch {
+	} catch (error) {
+		if (error instanceof AtomicWriteConflict) return {
+			success: false,
+			error: {
+				code: "INVALID_CODE",
+				message: "Device code or account authorization changed"
+			}
+		};
 		return {
 			success: false,
 			error: {
@@ -365,8 +407,7 @@ async function handleTokenRefresh(db, input) {
 			}
 		};
 		if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) {
-			await db.deleteFrom("_dineway_oauth_tokens").where("token_hash", "=", refreshHash).execute();
-			await db.deleteFrom("_dineway_oauth_tokens").where("refresh_token_hash", "=", refreshHash).execute();
+			await db.deleteFrom("_dineway_oauth_tokens").where((eb) => eb.or([eb("token_hash", "=", refreshHash), eb("refresh_token_hash", "=", refreshHash)])).execute();
 			return {
 				success: false,
 				error: {
@@ -375,7 +416,8 @@ async function handleTokenRefresh(db, input) {
 				}
 			};
 		}
-		const userInfo = await lookupUserRoleAndStatus(db, row.user_id);
+		const authority = await readTokenAuthority(db, row.user_id, row.client_id);
+		const userInfo = authority.user;
 		if (!userInfo) {
 			await db.deleteFrom("_dineway_oauth_tokens").where("user_id", "=", row.user_id).execute();
 			return {
@@ -398,12 +440,11 @@ async function handleTokenRefresh(db, input) {
 		}
 		let scopes = clampScopes(filterExperimentalSiteContextWorkflowScopes(JSON.parse(row.scopes)), userInfo.role, { includeExperimental: experimentalSiteContextWorkflowsEnabled() });
 		if (row.client_id) {
-			const client = await lookupOAuthClient(db, row.client_id);
+			const client = authority.client;
 			if (client?.scopes?.length) scopes = scopes.filter((s) => client.scopes.includes(s));
 		}
-		if (scopes.length === 0) {
-			await db.deleteFrom("_dineway_oauth_tokens").where("token_hash", "=", refreshHash).execute();
-			await db.deleteFrom("_dineway_oauth_tokens").where("refresh_token_hash", "=", refreshHash).execute();
+		if (scopes.length === 0 || row.client_id && !authority.client) {
+			await db.deleteFrom("_dineway_oauth_tokens").where((eb) => eb.or([eb("token_hash", "=", refreshHash), eb("refresh_token_hash", "=", refreshHash)])).execute();
 			return {
 				success: false,
 				error: {
@@ -412,18 +453,25 @@ async function handleTokenRefresh(db, input) {
 				}
 			};
 		}
-		await db.deleteFrom("_dineway_oauth_tokens").where("refresh_token_hash", "=", refreshHash).where("token_type", "=", "access").execute();
 		const accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);
 		const accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);
-		await db.insertInto("_dineway_oauth_tokens").values({
-			token_hash: accessToken.hash,
-			token_type: "access",
-			user_id: row.user_id,
-			scopes: JSON.stringify(scopes),
-			client_type: row.client_type,
-			expires_at: accessExpires,
-			refresh_token_hash: refreshHash
-		}).execute();
+		await atomicBatch(db, {
+			checks: [
+				rowUnchanged("_dineway_oauth_tokens", row),
+				...authority.checks,
+				sql`EXISTS (SELECT 1 FROM _dineway_oauth_tokens WHERE token_hash = ${refreshHash} AND expires_at > ${currentIsoTimestampValue(db)})`
+			],
+			statements: [db.deleteFrom("_dineway_oauth_tokens").where("refresh_token_hash", "=", refreshHash).where("token_type", "=", "access").compile(), db.insertInto("_dineway_oauth_tokens").values({
+				token_hash: accessToken.hash,
+				token_type: "access",
+				user_id: row.user_id,
+				scopes: JSON.stringify(scopes),
+				client_type: row.client_type,
+				expires_at: accessExpires,
+				refresh_token_hash: refreshHash,
+				client_id: row.client_id
+			}).compile()]
+		});
 		return {
 			success: true,
 			data: {
@@ -455,19 +503,7 @@ async function handleTokenRefresh(db, input) {
 async function handleTokenRevoke(db, input) {
 	try {
 		const hash = hashApiToken(input.token);
-		const row = await db.selectFrom("_dineway_oauth_tokens").select([
-			"token_hash",
-			"token_type",
-			"refresh_token_hash"
-		]).where("token_hash", "=", hash).executeTakeFirst();
-		if (!row) return {
-			success: true,
-			data: { revoked: true }
-		};
-		if (row.token_type === "refresh") {
-			await db.deleteFrom("_dineway_oauth_tokens").where("refresh_token_hash", "=", hash).execute();
-			await db.deleteFrom("_dineway_oauth_tokens").where("token_hash", "=", hash).execute();
-		} else await db.deleteFrom("_dineway_oauth_tokens").where("token_hash", "=", hash).execute();
+		await db.deleteFrom("_dineway_oauth_tokens").where((eb) => eb.or([eb("token_hash", "=", hash), eb("refresh_token_hash", "=", hash)])).execute();
 		return {
 			success: true,
 			data: { revoked: true }

package/dist/{dialect-helpers-fk43GbDb.mjs → dialect-helpers-C6xtO-Ui.mjs}

@@ -1,4 +1,4 @@
-import { n as validateJsonFieldName, t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
+import { n as validateJsonFieldName, t as validateIdentifier } from "./validate-Co3j6T_K.mjs";
 import { sql } from "kysely";
 
 //#region src/database/dialect-helpers.ts

package/dist/{discovery-CJkuHGhZ.mjs → discovery-CqXbN0WZ.mjs}

@@ -1,8 +1,8 @@
-import { t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
-import { i as encodeCursor, r as decodeCursor } from "./types-BpSTdH1H.mjs";
-import { n as publicDiscoveryExclusions } from "./public-discovery-CyDzK1-S.mjs";
-import { n as SchemaRegistry } from "./registry-D-IV_h50.mjs";
-import { t as resolveContentUrl } from "./public-url-oudwI7K0.mjs";
+import { t as validateIdentifier } from "./validate-Co3j6T_K.mjs";
+import { i as encodeCursor, r as decodeCursor } from "./types-BqxIv8Il.mjs";
+import { n as publicDiscoveryExclusions } from "./public-discovery-BAbOvKiR.mjs";
+import { n as SchemaRegistry } from "./registry-RD9qTnYL.mjs";
+import { t as resolveContentUrl } from "./public-url-C7pbmS_7.mjs";
 import { sql } from "kysely";
 
 //#region src/seo/canonical-url.ts

package/dist/{enrich-KErvJOuI.mjs → enrich-BjF-J4sF.mjs}

@@ -1,4 +1,4 @@
-import { n as normalizeMime } from "./mime-CDTtL7jE.mjs";
+import { n as normalizeMime } from "./mime-D_ae-u_U.mjs";
 import { encode } from "blurhash";
 import { imageSize } from "image-size";
 

package/dist/{evidence-6IUv9ML3.mjs → evidence-xJf8hQgH.mjs}

@@ -1,10 +1,10 @@
-import { i as encodeBase64url } from "./base64-F8-DUraK.mjs";
-import { t as MediaRepository } from "./media-dvRjj4po.mjs";
-import { t as buildStableHash } from "./stable-hash-DF7R5eN8.mjs";
-import { a as selectActiveBriefingContextEntries, i as parseSiteBriefingScope, o as ContextRepository } from "./briefing-BgQTljQt.mjs";
-import { s as loadContentMediaUsageFields } from "./content-refresh-QvBIyb_g.mjs";
-import { n as sha256, s as readBoundedBytes } from "./runs-DEujUDOj.mjs";
-import { r as ssrfSafeFetch } from "./ssrf-C7tTSD1r.mjs";
+import { i as encodeBase64url } from "./base64-Cz-aU0X1.mjs";
+import { t as MediaRepository } from "./media-3fK0u-bo.mjs";
+import { t as buildStableHash } from "./stable-hash-DEtJgcp7.mjs";
+import { a as selectActiveBriefingContextEntries, d as ContextRepository, i as parseSiteBriefingScope } from "./briefing-CkCi6S-W.mjs";
+import { n as sha256, s as readBoundedBytes } from "./runs-B5BExdKO.mjs";
+import { c as loadContentMediaUsageFields } from "./content-refresh-l4mPoGeX.mjs";
+import { r as ssrfSafeFetch } from "./ssrf-LN16WMip.mjs";
 import { imageSize } from "image-size";
 
 //#region src/review-automation/evidence.ts

package/dist/{field-defs-cache-CwrIyZFT.mjs → field-defs-cache-BKKFFf_V.mjs}

@@ -1,9 +1,9 @@
-import { a as __exportAll } from "./runner-DJiRFyLI.mjs";
+import { c as __exportAll } from "./runner-CVeq0266.mjs";
 import { getRequestContext } from "./request-context.mjs";
-import { t as after } from "./after-BfniwgIf.mjs";
-import { r as requestCached } from "./request-cache-BruBnFAR.mjs";
-import { n as BylineSchemaRegistry } from "./byline-registry-rkr73qSE.mjs";
-import { n as invalidateProcessCache, r as processCachedAsync, t as createProcessCache } from "./process-cache-B-L-A9zg.mjs";
+import { t as after } from "./after-BVaUn7bK.mjs";
+import { r as requestCached } from "./request-cache-DPmV5nk4.mjs";
+import { n as BylineSchemaRegistry } from "./byline-registry-CkuVVeJJ.mjs";
+import { n as invalidateProcessCache, r as processCachedAsync, t as createProcessCache } from "./process-cache-MHM4Sqzs.mjs";
 
 //#region src/bylines/field-defs-cache.ts
 var field_defs_cache_exports = /* @__PURE__ */ __exportAll({ getBylineFieldDefs: () => getBylineFieldDefs });

package/dist/{forgeway-account-lYJ8iX3G.mjs → forgeway-account-BeKJlKh1.mjs}

@@ -1,6 +1,6 @@
 import { join } from "node:path";
-import { ForgewayClient } from "@forgeway/sdk";
 import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { ForgewayClient } from "@forgeway/sdk";
 import { homedir } from "node:os";
 
 //#region src/cli/commands/deploy/utils/forgeway-secrets.ts

package/dist/{fts-manager-DX7ZkrCa.mjs → fts-manager-BeWtB7ZD.mjs}

@@ -1,10 +1,14 @@
-import { a as __exportAll } from "./runner-DJiRFyLI.mjs";
-import { t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
-import { s as isSqlite, u as tableExists } from "./dialect-helpers-fk43GbDb.mjs";
+import { c as __exportAll } from "./runner-CVeq0266.mjs";
+import { atomicBatch } from "./database/batch.mjs";
+import { t as validateIdentifier } from "./validate-Co3j6T_K.mjs";
+import { s as isSqlite, u as tableExists } from "./dialect-helpers-C6xtO-Ui.mjs";
 import { sql } from "kysely";
 
 //#region src/search/fts-manager.ts
-var fts_manager_exports = /* @__PURE__ */ __exportAll({ FTSManager: () => FTSManager });
+var fts_manager_exports = /* @__PURE__ */ __exportAll({
+	FTSManager: () => FTSManager,
+	parseSearchConfig: () => parseSearchConfig
+});
 /**
 * FTS5 Manager
 *
@@ -53,8 +57,11 @@ var FTSManager = class {
 	* @param searchableFields - Array of field names to index
 	* @param weights - Optional field weights for ranking
 	*/
-	async createFtsTable(collectionSlug, searchableFields, _weights) {
-		if (!isSqlite(this.db)) return;
+	async createFtsTable(collectionSlug, searchableFields, weights) {
+		await atomicBatch(this.db, { statements: this.createStatements(collectionSlug, searchableFields, weights) });
+	}
+	createStatements(collectionSlug, searchableFields, _weights) {
+		if (!isSqlite(this.db)) return [];
 		this.validateInputs(collectionSlug, searchableFields);
 		const ftsTable = this.getFtsTableName(collectionSlug);
 		const contentTable = this.getContentTableName(collectionSlug);
@@ -63,15 +70,14 @@ var FTSManager = class {
 			"locale UNINDEXED",
 			...searchableFields
 		].join(", ");
-		await sql.raw(`
+		return [sql.raw(`
 			CREATE VIRTUAL TABLE IF NOT EXISTS "${ftsTable}" USING fts5(
 				${columns},
 				content='${contentTable}',
 				content_rowid='rowid',
 				tokenize='porter unicode61'
 			)
-		`).execute(this.db);
-		await this.createTriggers(collectionSlug, searchableFields);
+		`).compile(this.db), ...this.triggerStatements(collectionSlug, searchableFields)];
 	}
 	/**
 	* Create triggers to keep FTS table in sync with content table.
@@ -80,14 +86,15 @@ var FTSManager = class {
 	* `deleted_at IS NULL`. This keeps soft-deleted content out of the
 	* index and keeps repair counts aligned with searchable content.
 	*/
-	async createTriggers(collectionSlug, searchableFields) {
+	triggerStatements(collectionSlug, searchableFields) {
+		const statements = [];
 		this.validateInputs(collectionSlug, searchableFields);
 		const ftsTable = this.getFtsTableName(collectionSlug);
 		const contentTable = this.getContentTableName(collectionSlug);
 		const fieldList = searchableFields.join(", ");
 		const newFieldList = searchableFields.map((f) => `NEW.${f}`).join(", ");
 		const oldFieldList = searchableFields.map((f) => `OLD.${f}`).join(", ");
-		await sql.raw(`
+		statements.push(sql.raw(`
 			CREATE TRIGGER IF NOT EXISTS "${ftsTable}_insert" 
 			AFTER INSERT ON "${contentTable}" 
 			WHEN NEW.deleted_at IS NULL
@@ -95,8 +102,8 @@ var FTSManager = class {
 				INSERT INTO "${ftsTable}"(rowid, id, locale, ${fieldList})
 				VALUES (NEW.rowid, NEW.id, NEW.locale, ${newFieldList});
 			END
-		`).execute(this.db);
-		await sql.raw(`
+		`).compile(this.db));
+		statements.push(sql.raw(`
 			CREATE TRIGGER IF NOT EXISTS "${ftsTable}_update" 
 			AFTER UPDATE ON "${contentTable}" 
 			BEGIN
@@ -107,8 +114,8 @@ var FTSManager = class {
 				SELECT NEW.rowid, NEW.id, NEW.locale, ${newFieldList}
 				WHERE NEW.deleted_at IS NULL;
 			END
-		`).execute(this.db);
-		await sql.raw(`
+		`).compile(this.db));
+		statements.push(sql.raw(`
 			CREATE TRIGGER IF NOT EXISTS "${ftsTable}_delete" 
 			AFTER DELETE ON "${contentTable}"
 			WHEN OLD.deleted_at IS NULL
@@ -116,79 +123,73 @@ var FTSManager = class {
 				INSERT INTO "${ftsTable}"("${ftsTable}", rowid, id, locale, ${fieldList})
 				VALUES ('delete', OLD.rowid, OLD.id, OLD.locale, ${oldFieldList});
 			END
-		`).execute(this.db);
+		`).compile(this.db));
+		return statements;
 	}
 	/**
 	* Drop triggers for a collection
 	*/
-	async dropTriggers(collectionSlug) {
+	dropStatements(collectionSlug) {
+		if (!isSqlite(this.db)) return [];
 		this.validateInputs(collectionSlug);
 		const ftsTable = this.getFtsTableName(collectionSlug);
-		await sql.raw(`DROP TRIGGER IF EXISTS "${ftsTable}_insert"`).execute(this.db);
-		await sql.raw(`DROP TRIGGER IF EXISTS "${ftsTable}_update"`).execute(this.db);
-		await sql.raw(`DROP TRIGGER IF EXISTS "${ftsTable}_delete"`).execute(this.db);
+		return [...[
+			"insert",
+			"update",
+			"delete"
+		].map((suffix) => sql`DROP TRIGGER IF EXISTS ${sql.ref(`${ftsTable}_${suffix}`)}`.compile(this.db)), sql`DROP TABLE IF EXISTS ${sql.ref(ftsTable)}`.compile(this.db)];
 	}
-	/**
-	* Drop the FTS table and triggers for a collection
-	*/
 	async dropFtsTable(collectionSlug) {
-		if (!isSqlite(this.db)) return;
-		this.validateInputs(collectionSlug);
-		const ftsTable = this.getFtsTableName(collectionSlug);
-		await this.dropTriggers(collectionSlug);
-		await sql.raw(`DROP TABLE IF EXISTS "${ftsTable}"`).execute(this.db);
+		await atomicBatch(this.db, { statements: this.dropStatements(collectionSlug) });
 	}
 	/**
 	* Rebuild the FTS index for a collection
 	*
 	* This is useful after bulk imports or if the index gets out of sync.
 	*/
+	rebuildStatements(collectionSlug, searchableFields, weights) {
+		if (!isSqlite(this.db)) return [];
+		return [
+			...this.dropStatements(collectionSlug),
+			...this.createStatements(collectionSlug, searchableFields, weights),
+			this.populateStatement(collectionSlug, searchableFields)
+		];
+	}
 	async rebuildIndex(collectionSlug, searchableFields, weights) {
-		if (!isSqlite(this.db)) return;
-		await this.dropFtsTable(collectionSlug);
-		await this.createFtsTable(collectionSlug, searchableFields, weights);
-		await this.populateFromContent(collectionSlug, searchableFields);
+		await atomicBatch(this.db, { statements: this.rebuildStatements(collectionSlug, searchableFields, weights) });
 	}
 	/**
 	* Populate the FTS table from existing content
 	*/
 	async populateFromContent(collectionSlug, searchableFields) {
 		if (!isSqlite(this.db)) return;
+		await this.db.executeQuery(this.populateStatement(collectionSlug, searchableFields));
+	}
+	populateStatement(collectionSlug, searchableFields) {
 		this.validateInputs(collectionSlug, searchableFields);
 		const ftsTable = this.getFtsTableName(collectionSlug);
 		const contentTable = this.getContentTableName(collectionSlug);
 		const fieldList = searchableFields.join(", ");
-		await sql.raw(`
+		return sql.raw(`
 			INSERT INTO "${ftsTable}"(rowid, id, locale, ${fieldList})
 			SELECT rowid, id, locale, ${fieldList} FROM "${contentTable}"
 			WHERE deleted_at IS NULL
-		`).execute(this.db);
+		`).compile(this.db);
 	}
 	/**
 	* Get the search configuration for a collection
 	*/
 	async getSearchConfig(collectionSlug) {
-		const result = await this.db.selectFrom("_dineway_collections").select("search_config").where("slug", "=", collectionSlug).executeTakeFirst();
-		if (!result?.search_config) return null;
-		try {
-			const parsed = JSON.parse(result.search_config);
-			if (typeof parsed !== "object" || parsed === null || !("enabled" in parsed) || typeof parsed.enabled !== "boolean") return null;
-			const config = { enabled: parsed.enabled };
-			if ("weights" in parsed && typeof parsed.weights === "object" && parsed.weights !== null) {
-				const weights = {};
-				for (const [k, v] of Object.entries(parsed.weights)) if (typeof v === "number") weights[k] = v;
-				config.weights = weights;
-			}
-			return config;
-		} catch {
-			return null;
-		}
+		return parseSearchConfig((await this.db.selectFrom("_dineway_collections").select("search_config").where("slug", "=", collectionSlug).executeTakeFirst())?.search_config ?? null);
 	}
 	/**
 	* Update the search configuration for a collection
 	*/
+	configStatement(collectionSlug, config) {
+		return this.db.updateTable("_dineway_collections").set({ search_config: JSON.stringify(config) }).where("slug", "=", collectionSlug).compile();
+	}
 	async setSearchConfig(collectionSlug, config) {
-		await this.db.updateTable("_dineway_collections").set({ search_config: JSON.stringify(config) }).where("slug", "=", collectionSlug).execute();
+		await this.db.executeQuery(this.configStatement(collectionSlug, config));
 	}
 	/**
 	* Get searchable fields for a collection
@@ -208,11 +209,10 @@ var FTSManager = class {
 		if (!isSqlite(this.db)) throw new Error("Full-text search is only available with SQLite databases");
 		const searchableFields = await this.getSearchableFields(collectionSlug);
 		if (searchableFields.length === 0) throw new Error(`No searchable fields defined for collection "${collectionSlug}". Mark at least one field as searchable before enabling search.`);
-		await this.rebuildIndex(collectionSlug, searchableFields, options?.weights);
-		await this.setSearchConfig(collectionSlug, {
+		await atomicBatch(this.db, { statements: [...this.rebuildStatements(collectionSlug, searchableFields, options?.weights), this.configStatement(collectionSlug, {
 			enabled: true,
 			weights: options?.weights
-		});
+		})] });
 	}
 	/**
 	* Disable search for a collection
@@ -222,11 +222,10 @@ var FTSManager = class {
 	async disableSearch(collectionSlug) {
 		if (!isSqlite(this.db)) return;
 		const existing = await this.getSearchConfig(collectionSlug);
-		await this.dropFtsTable(collectionSlug);
-		await this.setSearchConfig(collectionSlug, {
+		await atomicBatch(this.db, { statements: [...this.dropStatements(collectionSlug), this.configStatement(collectionSlug, {
 			enabled: false,
 			weights: existing?.weights
-		});
+		})] });
 	}
 	/**
 	* Get index statistics for a collection
@@ -297,6 +296,22 @@ var FTSManager = class {
 		return repaired;
 	}
 };
+function parseSearchConfig(value) {
+	if (!value) return null;
+	try {
+		const parsed = JSON.parse(value);
+		if (typeof parsed !== "object" || parsed === null || !("enabled" in parsed) || typeof parsed.enabled !== "boolean") return null;
+		const config = { enabled: parsed.enabled };
+		if ("weights" in parsed && typeof parsed.weights === "object" && parsed.weights !== null) {
+			const weights = {};
+			for (const [k, v] of Object.entries(parsed.weights)) if (typeof v === "number") weights[k] = v;
+			config.weights = weights;
+		}
+		return config;
+	} catch {
+		return null;
+	}
+}
 
 //#endregion
-export { fts_manager_exports as n, FTSManager as t };
+export { fts_manager_exports as n, parseSearchConfig as r, FTSManager as t };

package/dist/{hitl-requests-CmYVunm-.mjs → hitl-requests-evSsel48.mjs}

@@ -1,5 +1,5 @@
-import { b as HitlRequestService } from "./site-context-CA7rbxux.mjs";
-import { t as ExperimentalSiteContextWorkflowDisabledError } from "./experimental-workflows-B9x8delL.mjs";
+import { b as HitlRequestService } from "./site-context-vCiDRr4H.mjs";
+import { t as ExperimentalSiteContextWorkflowDisabledError } from "./experimental-workflows-M5D3RTFo.mjs";
 
 //#region src/api/handlers/hitl-requests.ts
 const HITL_NOT_FOUND_RE = /not found/i;

package/dist/{hitl-route-helpers-CRm537zS.mjs → hitl-route-helpers-D2kJSOFX.mjs}

@@ -1,8 +1,8 @@
-import { t as WorkflowHitlCoordinator } from "./site-context-CA7rbxux.mjs";
-import { t as apiError } from "./error-DLg1H2LT.mjs";
-import { n as resolveActorIdentity } from "./actor-DrJJsvy6.mjs";
-import { p as logSiteActivitySafely } from "./activity-events-BVo9rMUz.mjs";
-import { t as ExperimentalSiteContextWorkflowDisabledError } from "./experimental-workflows-B9x8delL.mjs";
+import { i as resolveActorIdentity } from "./actor-DxUAJgQX.mjs";
+import { t as WorkflowHitlCoordinator } from "./site-context-vCiDRr4H.mjs";
+import { t as apiError } from "./error-Dd8LtpG5.mjs";
+import { p as logSiteActivitySafely } from "./activity-events-D-yGV7cW.mjs";
+import { t as ExperimentalSiteContextWorkflowDisabledError } from "./experimental-workflows-M5D3RTFo.mjs";
 import { Role } from "@dineway-ai/auth";
 
 //#region src/api/hitl-route-helpers.ts