dineway 0.2.32 → 0.2.34

package/dist/media/local-runtime.d.mts

@@ -1,14 +1,14 @@
-import "../types-TpXK8km5.mjs";
-import { t as Database } from "../types-BRCUO8NR.mjs";
-import { h as MediaProviderItem, o as CreateMediaProviderFn } from "../placeholder-D03pGvqM.mjs";
-import "../runner-Dye73myO.mjs";
-import "../index-Co7xtjkd.mjs";
-import "../types-CPaVj_GC.mjs";
-import { d as Storage } from "../types-CLMOusxP.mjs";
-import "../public-url-BQ9vf0AS.mjs";
-import "../validate-CDWVODvc.mjs";
-import "../byline-fields-DNXKWUW9.mjs";
-import "../types--3oJQ0hs.mjs";
+import "../types-QjOcidFc.mjs";
+import { t as Database } from "../types-7Th6Mwz3.mjs";
+import { h as MediaProviderItem, o as CreateMediaProviderFn } from "../placeholder-BHTaoCYx.mjs";
+import "../runner-JnJSGXEB.mjs";
+import "../index-CSUSBfdD.mjs";
+import "../types-DkXuBo8k.mjs";
+import { d as Storage } from "../types-CwkJp6zr.mjs";
+import "../public-url-BV-YQ_LF.mjs";
+import "../validate-A27peRc4.mjs";
+import "../byline-fields-BmkhEDFF.mjs";
+import "../types-DTjrkhKU.mjs";
 import "../index.mjs";
 import { Kysely } from "kysely";
 

package/dist/media/local-runtime.mjs

@@ -1,6 +1,6 @@
-import "../base64-F8-DUraK.mjs";
-import "../types-BpSTdH1H.mjs";
-import { t as MediaRepository } from "../media-dvRjj4po.mjs";
+import "../base64-Cz-aU0X1.mjs";
+import "../types-BqxIv8Il.mjs";
+import { t as MediaRepository } from "../media-3fK0u-bo.mjs";
 
 //#region src/media/local-runtime.ts
 /**

package/dist/{media-dvRjj4po.mjs → media-3fK0u-bo.mjs}

@@ -1,4 +1,4 @@
-import { i as encodeCursor, r as decodeCursor } from "./types-BpSTdH1H.mjs";
+import { i as encodeCursor, r as decodeCursor } from "./types-BqxIv8Il.mjs";
 import { sql } from "kysely";
 import { ulid } from "ulidx";
 

package/dist/{media-allowlist-DaG6lNoy.mjs → media-allowlist-rN4qIF6W.mjs}

@@ -1,4 +1,4 @@
-import { r as parseAllowedMimeTypes } from "./mime-CDTtL7jE.mjs";
+import { r as parseAllowedMimeTypes } from "./mime-D_ae-u_U.mjs";
 
 //#region src/api/handlers/media-allowlist.ts
 /**

package/dist/{menus-CpuR4Qkm.mjs → menus-5liJusbp.mjs}

@@ -1,17 +1,26 @@
-import { a as __exportAll } from "./runner-DJiRFyLI.mjs";
-import { n as getI18nConfig } from "./config-CVssduLe.mjs";
-import { c as invalidateMenuObjectCache } from "./object-cache-D51qOseS.mjs";
-import { t as withTransaction } from "./transaction-BGQgnwUi.mjs";
+import { c as __exportAll } from "./runner-CVeq0266.mjs";
+import { AtomicWriteConflict, atomicBatch, rowUnchanged } from "./database/batch.mjs";
+import { n as getI18nConfig } from "./config-XW5tMrH8.mjs";
+import { c as invalidateMenuObjectCache } from "./object-cache-BGjIlY9s.mjs";
+import { sql } from "kysely";
 import { ulid } from "ulidx";
 
 //#region src/database/repositories/menu.ts
 /**
-* Thrown from inside a repository transaction when the menu the caller
-* resolved earlier has since been deleted. Handlers translate this to a
-* `NOT_FOUND` API response. Necessary because D1 disables FK enforcement
-* (so `ON DELETE CASCADE` won't fire), and an unchecked `setItems` would
-* happily insert items whose `menu_id` no longer exists, leaving orphans.
+* Menu repository
+*
+* Owns every SQL touch for `_dineway_menus` and `_dineway_menu_items`, plus the
+* row→entity mapping. Matches the architecture used by every other resource
+* (content, taxonomies, redirects, comments, media): handlers stay thin and
+* orchestrate; the repository is the single place where snake_case DB columns
+* become camelCase entities (and vice versa).
+*
+* i18n: menus are per-locale. `(name, locale)` is unique. Translations of the
+* same menu share a `translation_group` ULID. Menu item `reference_id` stores
+* the referenced content's translation_group (not a specific row id) so a
+* single menu item survives content translations.
 */
+/** The resolved menu disappeared before its atomic mutation could commit. */
 var MenuGoneError = class extends Error {
 	constructor(menuId) {
 		super(`Menu ${menuId} was deleted while being modified`);
@@ -136,45 +145,40 @@ var MenuRepository = class {
 	*/
 	async create(input) {
 		const id = ulid();
-		let translationGroup = id;
-		let sourceMenuId = null;
-		if (input.translationOf) {
-			const source = await this.findById(input.translationOf);
-			if (!source) throw new Error("Source menu for translation not found");
-			translationGroup = source.translationGroup ?? source.id;
-			sourceMenuId = source.id;
-		}
-		await withTransaction(this.db, async (trx) => {
-			await trx.insertInto("_dineway_menus").values({
-				id,
-				name: input.name,
-				label: input.label,
+		const source = input.translationOf ? await this.db.selectFrom("_dineway_menus").selectAll().where("id", "=", input.translationOf).executeTakeFirst() : null;
+		if (input.translationOf && !source) throw new Error("Source menu for translation not found");
+		const checks = source ? [rowUnchanged("_dineway_menus", source)] : [];
+		const statements = [this.db.insertInto("_dineway_menus").values({
+			id,
+			name: input.name,
+			label: input.label,
+			...input.locale !== void 0 ? { locale: input.locale } : {},
+			translation_group: source?.translation_group ?? source?.id ?? id
+		}).compile()];
+		if (source) {
+			const items = await this.snapshotItems(source.id);
+			checks.push(...items.checks);
+			const idMap = new Map(items.rows.map((item) => [item.id, ulid()]));
+			for (const item of orderParentsFirst(items.rows)) statements.push(this.db.insertInto("_dineway_menu_items").values({
+				id: idMap.get(item.id),
+				menu_id: id,
+				parent_id: item.parent_id ? idMap.get(item.parent_id) : null,
+				sort_order: item.sort_order,
+				type: item.type,
+				reference_collection: item.reference_collection,
+				reference_id: item.reference_id,
+				custom_url: item.custom_url,
+				label: item.label,
+				title_attr: item.title_attr,
+				target: item.target,
+				css_classes: item.css_classes,
 				...input.locale !== void 0 ? { locale: input.locale } : {},
-				translation_group: translationGroup
-			}).execute();
-			if (sourceMenuId) {
-				const sourceItems = await trx.selectFrom("_dineway_menu_items").selectAll().where("menu_id", "=", sourceMenuId).orderBy("sort_order", "asc").execute();
-				if (sourceItems.length > 0) {
-					const idMap = /* @__PURE__ */ new Map();
-					for (const item of sourceItems) idMap.set(item.id, ulid());
-					await trx.insertInto("_dineway_menu_items").values(sourceItems.map((item) => ({
-						id: idMap.get(item.id),
-						menu_id: id,
-						parent_id: item.parent_id ? idMap.get(item.parent_id) ?? null : null,
-						sort_order: item.sort_order,
-						type: item.type,
-						reference_collection: item.reference_collection,
-						reference_id: item.reference_id,
-						custom_url: item.custom_url,
-						label: item.label,
-						title_attr: item.title_attr,
-						target: item.target,
-						css_classes: item.css_classes,
-						...input.locale !== void 0 ? { locale: input.locale } : {},
-						translation_group: item.translation_group ?? item.id
-					}))).execute();
-				}
-			}
+				translation_group: item.translation_group ?? item.id
+			}).compile());
+		}
+		await atomicBatch(this.db, {
+			checks,
+			statements
 		});
 		invalidateMenuObjectCache();
 		const created = await this.findById(id);
@@ -191,17 +195,13 @@ var MenuRepository = class {
 		}
 		return await this.findById(id);
 	}
-	/**
-	* Delete a menu. Items are deleted explicitly first because D1 disables
-	* FK enforcement at the database level, so `ON DELETE CASCADE` declared in
-	* migration 005 cannot be relied on. On SQLite/Postgres the cascade also
-	* fires, making the explicit delete a no-op there.
-	*/
+	/** Delete the menu and its items in one commit. */
 	async delete(id) {
-		if (!await this.findById(id)) return false;
-		await withTransaction(this.db, async (trx) => {
-			await trx.deleteFrom("_dineway_menu_items").where("menu_id", "=", id).execute();
-			await trx.deleteFrom("_dineway_menus").where("id", "=", id).execute();
+		const existing = await this.db.selectFrom("_dineway_menus").selectAll().where("id", "=", id).executeTakeFirst();
+		if (!existing) return false;
+		await atomicBatch(this.db, {
+			checks: [rowUnchanged("_dineway_menus", existing)],
+			statements: [this.db.deleteFrom("_dineway_menu_items").where("menu_id", "=", id).compile(), this.db.deleteFrom("_dineway_menus").where("id", "=", id).compile()]
 		});
 		invalidateMenuObjectCache();
 		return true;
@@ -294,34 +294,39 @@ var MenuRepository = class {
 	* Returns the count of inserted items (matches the existing handler API).
 	*/
 	async setItems(menuId, locale, items) {
-		await withTransaction(this.db, async (trx) => {
-			if (!await trx.selectFrom("_dineway_menus").select("id").where("id", "=", menuId).executeTakeFirst()) throw new MenuGoneError(menuId);
-			await trx.deleteFrom("_dineway_menu_items").where("menu_id", "=", menuId).execute();
-			const insertedIds = [];
-			for (let i = 0; i < items.length; i++) {
-				const item = items[i];
-				if (!item) continue;
-				const id = ulid();
-				const parentId = item.parentIndex !== void 0 ? insertedIds[item.parentIndex] ?? null : null;
-				await trx.insertInto("_dineway_menu_items").values({
-					id,
-					menu_id: menuId,
-					parent_id: parentId,
-					sort_order: i,
-					type: item.type,
-					reference_collection: item.referenceCollection ?? null,
-					reference_id: item.referenceId ?? null,
-					custom_url: item.customUrl ?? null,
-					label: item.label,
-					title_attr: item.titleAttr ?? null,
-					target: item.target ?? null,
-					css_classes: item.cssClasses ?? null,
-					locale
-				}).execute();
-				insertedIds.push(id);
-			}
-			await trx.updateTable("_dineway_menus").set({ updated_at: (/* @__PURE__ */ new Date()).toISOString() }).where("id", "=", menuId).execute();
-		});
+		const menu = await this.db.selectFrom("_dineway_menus").selectAll().where("id", "=", menuId).executeTakeFirst();
+		if (!menu) throw new MenuGoneError(menuId);
+		const previous = await this.snapshotItems(menuId);
+		const statements = [this.db.deleteFrom("_dineway_menu_items").where("menu_id", "=", menuId).compile()];
+		const ids = items.map(() => ulid());
+		for (const [index, item] of items.entries()) {
+			if (item.parentIndex !== void 0 && (!Number.isInteger(item.parentIndex) || item.parentIndex < 0 || item.parentIndex >= index)) throw new Error("Menu parents must reference an earlier item");
+			statements.push(this.db.insertInto("_dineway_menu_items").values({
+				id: ids[index],
+				menu_id: menuId,
+				parent_id: item.parentIndex !== void 0 ? ids[item.parentIndex] : null,
+				sort_order: index,
+				type: item.type,
+				reference_collection: item.referenceCollection ?? null,
+				reference_id: item.referenceId ?? null,
+				custom_url: item.customUrl ?? null,
+				label: item.label,
+				title_attr: item.titleAttr ?? null,
+				target: item.target ?? null,
+				css_classes: item.cssClasses ?? null,
+				locale
+			}).compile());
+		}
+		statements.push(this.db.updateTable("_dineway_menus").set({ updated_at: (/* @__PURE__ */ new Date()).toISOString() }).where("id", "=", menuId).compile());
+		try {
+			await atomicBatch(this.db, {
+				checks: [rowUnchanged("_dineway_menus", menu), ...previous.checks],
+				statements
+			});
+		} catch (error) {
+			if (error instanceof AtomicWriteConflict && !await this.findById(menuId)) throw new MenuGoneError(menuId);
+			throw error;
+		}
 		invalidateMenuObjectCache();
 		return { itemCount: items.length };
 	}
@@ -330,16 +335,59 @@ var MenuRepository = class {
 	* malicious payload cannot move foreign items into this menu's siblings.
 	*/
 	async reorderItems(menuId, items) {
-		invalidateMenuObjectCache();
-		return withTransaction(this.db, async (trx) => {
-			for (const item of items) await trx.updateTable("_dineway_menu_items").set({
+		const snapshot = await this.snapshotItems(menuId);
+		const rows = new Map(snapshot.rows.map((row) => [row.id, row]));
+		const statements = [];
+		for (const item of items) {
+			const row = rows.get(item.id);
+			if (!row) continue;
+			rows.set(item.id, {
+				...row,
 				parent_id: item.parentId,
 				sort_order: item.sortOrder
-			}).where("id", "=", item.id).where("menu_id", "=", menuId).execute();
-			return (await trx.selectFrom("_dineway_menu_items").selectAll().where("menu_id", "=", menuId).orderBy("sort_order", "asc").execute()).map(rowToMenuItem);
+			});
+			statements.push(this.db.updateTable("_dineway_menu_items").set({
+				parent_id: item.parentId,
+				sort_order: item.sortOrder
+			}).where("id", "=", item.id).where("menu_id", "=", menuId).compile());
+		}
+		orderParentsFirst([...rows.values()]);
+		await atomicBatch(this.db, {
+			checks: snapshot.checks,
+			statements
 		});
+		invalidateMenuObjectCache();
+		return this.findItems(menuId);
+	}
+	async snapshotItems(menuId) {
+		const rows = await this.db.selectFrom("_dineway_menu_items").selectAll().where("menu_id", "=", menuId).orderBy("sort_order", "asc").execute();
+		return {
+			rows,
+			checks: [sql`(SELECT COUNT(*) FROM _dineway_menu_items WHERE menu_id = ${menuId}) = ${rows.length}`, ...rows.map((row) => rowUnchanged("_dineway_menu_items", row))]
+		};
 	}
 };
+function orderParentsFirst(items) {
+	const remaining = new Map(items.map((item) => [item.id, item]));
+	const visited = /* @__PURE__ */ new Set();
+	const visiting = /* @__PURE__ */ new Set();
+	const ordered = [];
+	const visit = (item) => {
+		if (visited.has(item.id)) return;
+		if (visiting.has(item.id)) throw new Error("Menu parent links contain a cycle");
+		visiting.add(item.id);
+		if (item.parent_id) {
+			const parent = remaining.get(item.parent_id);
+			if (!parent) throw new Error("Menu parent must belong to the same menu");
+			visit(parent);
+		}
+		visiting.delete(item.id);
+		visited.add(item.id);
+		ordered.push(item);
+	};
+	for (const item of items) visit(item);
+	return ordered;
+}
 
 //#endregion
 //#region src/api/handlers/menus.ts

package/dist/{menus-CZbz5L_V.mjs → menus-CbR_J8cJ.mjs}

@@ -1,11 +1,11 @@
-import { t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
-import { r as getDb } from "./loader-BDje8ME2.mjs";
-import { n as cachedQuery, t as CacheNamespace } from "./object-cache-D51qOseS.mjs";
-import { t as CommentRepository } from "./comment-_nvJSS-A.mjs";
-import { r as requestCached } from "./request-cache-BruBnFAR.mjs";
-import { n as resolveLocaleChain, t as resolveLocale } from "./resolve-pZ4NQM-X.mjs";
-import { n as sanitizeHref } from "./url-Dumsft7G.mjs";
-import { t as CommentReactionRepository } from "./comment-reaction-DhVgJ17S.mjs";
+import { t as validateIdentifier } from "./validate-Co3j6T_K.mjs";
+import { r as getDb } from "./loader-Cgsx23wU.mjs";
+import { n as cachedQuery, t as CacheNamespace } from "./object-cache-BGjIlY9s.mjs";
+import { t as CommentRepository } from "./comment-Bi7cJ9SS.mjs";
+import { r as requestCached } from "./request-cache-DPmV5nk4.mjs";
+import { n as resolveLocaleChain, t as resolveLocale } from "./resolve-C80Pm2DW.mjs";
+import { n as sanitizeHref } from "./url-bv5i4JN0.mjs";
+import { t as CommentReactionRepository } from "./comment-reaction-BLqIj5mx.mjs";
 import { sql } from "kysely";
 
 //#region src/comments/ranking.ts

package/dist/migrations-CMdxWKx-.mjs

@@ -0,0 +1,76 @@
+import { o as assertD1Migrations } from "./runner-CVeq0266.mjs";
+import { n as d1Database } from "./d1-binding-D6HZa3ks.mjs";
+import { Migrator } from "kysely";
+
+//#region src/plugins/migrations.ts
+const LEADING_AT = /^@/;
+var StaticPluginMigrationProvider = class {
+	constructor(migrations) {
+		this.migrations = migrations;
+	}
+	async getMigrations() {
+		return this.migrations;
+	}
+};
+/**
+* Run migrations contributed by configured trusted native plugins.
+*
+* Each plugin receives isolated Kysely migration and lock tables. This keeps migration history valid
+* when another plugin is removed and lets different plugins safely reuse local migration names.
+*/
+async function runPluginMigrations(db, plugins) {
+	const applied = [];
+	for (const plugin of [...plugins].toSorted((left, right) => left.id.localeCompare(right.id))) {
+		if (Object.keys(plugin.migrations).length === 0) continue;
+		const tables = pluginMigrationTableNames(plugin.id);
+		if (d1Database(db)) {
+			await assertD1Migrations(db, tables.migrations, Object.keys(plugin.migrations));
+			applied.push({
+				pluginId: plugin.id,
+				applied: []
+			});
+			continue;
+		}
+		const { error, results } = await new Migrator({
+			db,
+			provider: new StaticPluginMigrationProvider(plugin.migrations),
+			migrationTableName: tables.migrations,
+			migrationLockTableName: tables.lock
+		}).migrateToLatest();
+		const successful = results?.filter((result) => result.status === "Success").map((result) => result.migrationName) ?? [];
+		if (error) {
+			const failed = results?.find((result) => result.status === "Error")?.migrationName;
+			throw new Error(`Plugin migration failed for ${plugin.id}${failed ? ` (${failed})` : ""}: ${errorMessage(error)}`, { cause: error });
+		}
+		applied.push({
+			pluginId: plugin.id,
+			applied: successful
+		});
+	}
+	return applied;
+}
+function pluginMigrationTableNames(pluginId) {
+	const slug = pluginId.replace(LEADING_AT, "").replaceAll("/", "_").replaceAll("-", "_").slice(0, 20);
+	const suffix = fnv1a(pluginId);
+	return {
+		migrations: `_dineway_plugin_migration_${slug}_${suffix}`,
+		lock: `_dineway_plugin_migration_lock_${slug}_${suffix}`
+	};
+}
+function fnv1a(value) {
+	let hash = 2166136261;
+	for (let index = 0; index < value.length; index++) {
+		hash ^= value.charCodeAt(index);
+		hash = Math.imul(hash, 16777619);
+	}
+	return (hash >>> 0).toString(16).padStart(8, "0");
+}
+function errorMessage(error) {
+	if (!(error instanceof Error)) return JSON.stringify(error);
+	if (error.message) return error.message;
+	if (error.cause instanceof Error && error.cause.message) return error.cause.message;
+	return "unknown error";
+}
+
+//#endregion
+export { runPluginMigrations as n, pluginMigrationTableNames as t };

package/dist/oauth-authority-CCqo4eBm.mjs

@@ -0,0 +1,43 @@
+import { rowUnchanged } from "./database/batch.mjs";
+import { sql } from "kysely";
+import { toRoleLevel } from "@dineway-ai/auth";
+
+//#region src/api/handlers/oauth-authority.ts
+/** Keep token permissions tied to the same account and client state through commit. */
+async function readTokenAuthority(db, userId, clientId) {
+	const user = await db.selectFrom("users").select([
+		"id",
+		"role",
+		"disabled"
+	]).where("id", "=", userId).executeTakeFirst();
+	const client = clientId ? await db.selectFrom("_dineway_oauth_clients").select([
+		"id",
+		"redirect_uris",
+		"scopes"
+	]).where("id", "=", clientId).executeTakeFirst() : void 0;
+	const checks = user ? [rowUnchanged("users", user)] : [];
+	if (client) checks.push(rowUnchanged("_dineway_oauth_clients", client));
+	else if (clientId) checks.push(sql`NOT EXISTS (SELECT 1 FROM _dineway_oauth_clients WHERE id = ${clientId})`);
+	return {
+		user: user ? {
+			role: toRoleLevel(user.role),
+			disabled: user.disabled === 1
+		} : null,
+		client: client ? {
+			scopes: client.scopes ? parseStringList(client.scopes) : null,
+			redirectUris: parseStringList(client.redirect_uris)
+		} : null,
+		checks
+	};
+}
+function parseStringList(value) {
+	const parsed = JSON.parse(value);
+	if (!Array.isArray(parsed)) throw new Error("Invalid stored OAuth client configuration");
+	return parsed.map((item) => {
+		if (typeof item !== "string") throw new Error("Invalid stored OAuth client configuration");
+		return item;
+	});
+}
+
+//#endregion
+export { readTokenAuthority as t };