dineway 0.2.33 → 0.2.34

package/dist/{oauth-authorization-Jf5e3azH.mjs → oauth-authorization--0UtTZpv.mjs}

@@ -1,9 +1,11 @@
-import { t as withTransaction } from "./transaction-BGQgnwUi.mjs";
-import { a as hashApiToken, n as TOKEN_PREFIXES, r as generatePrefixedToken, t as ALL_VALID_SCOPES } from "./api-tokens-CmT83Bgj.mjs";
-import { a as filterExperimentalSiteContextWorkflowScopes, i as experimentalSiteContextWorkflowsEnabled, o as getExperimentalSiteContextWorkflowScopesDisabledMessage, r as disabledExperimentalSiteContextWorkflowScopes } from "./experimental-workflows-B9x8delL.mjs";
-import { c as validateRedirectUri, o as lookupOAuthClient, s as validateClientRedirectUri } from "./oauth-clients-tovQ4D4h.mjs";
-import { t as lookupUserRoleAndStatus } from "./oauth-user-lookup-B451pZmd.mjs";
-import { clampScopes, computeS256Challenge, secureCompare } from "@dineway-ai/auth";
+import { AtomicWriteConflict, atomicBatch, rowUnchanged } from "./database/batch.mjs";
+import { r as currentIsoTimestampValue } from "./dialect-helpers-C6xtO-Ui.mjs";
+import { a as hashApiToken, n as TOKEN_PREFIXES, r as generatePrefixedToken, t as ALL_VALID_SCOPES } from "./api-tokens-D5K_Csub.mjs";
+import { a as filterExperimentalSiteContextWorkflowScopes, i as experimentalSiteContextWorkflowsEnabled, o as getExperimentalSiteContextWorkflowScopesDisabledMessage, r as disabledExperimentalSiteContextWorkflowScopes } from "./experimental-workflows-M5D3RTFo.mjs";
+import { c as validateRedirectUri, s as validateClientRedirectUri } from "./oauth-clients-D4WBYaYW.mjs";
+import { t as readTokenAuthority } from "./oauth-authority-CCqo4eBm.mjs";
+import { sql } from "kysely";
+import { clampScopes, computeS256Challenge, secureCompare, toRoleLevel } from "@dineway-ai/auth";
 import { generateCodeVerifier } from "arctic";
 
 //#region src/api/handlers/oauth-authorization.ts
@@ -58,7 +60,15 @@ async function handleAuthorizationApproval(db, userId, userRole, params) {
 				message: uriError
 			}
 		};
-		const client = await lookupOAuthClient(db, params.client_id);
+		const authority = await readTokenAuthority(db, userId, params.client_id);
+		if (!authority.user || authority.user.disabled) return {
+			success: false,
+			error: {
+				code: "FORBIDDEN",
+				message: "User account is unavailable"
+			}
+		};
+		const client = authority.client;
 		if (!client) return {
 			success: false,
 			error: {
@@ -96,7 +106,7 @@ async function handleAuthorizationApproval(db, userId, userRole, params) {
 				message: getExperimentalSiteContextWorkflowScopesDisabledMessage()
 			}
 		};
-		const userScopes = clampScopes(normalizeScopes(requestedScopes), userRole, { includeExperimental: experimentalSiteContextWorkflowsEnabled() });
+		const userScopes = clampScopes(normalizeScopes(requestedScopes), toRoleLevel(Math.min(userRole, authority.user.role)), { includeExperimental: experimentalSiteContextWorkflowsEnabled() });
 		const clientScopes = client.scopes;
 		const scopes = clientScopes?.length ? userScopes.filter((s) => clientScopes.includes(s)) : userScopes;
 		if (scopes.length === 0) return {
@@ -108,17 +118,20 @@ async function handleAuthorizationApproval(db, userId, userRole, params) {
 		};
 		const code = generateCodeVerifier();
 		const codeHash = hashApiToken(code);
-		await db.insertInto("_dineway_authorization_codes").values({
-			code_hash: codeHash,
-			client_id: params.client_id,
-			redirect_uri: params.redirect_uri,
-			user_id: userId,
-			scopes: JSON.stringify(scopes),
-			code_challenge: params.code_challenge,
-			code_challenge_method: params.code_challenge_method,
-			resource: params.resource ?? null,
-			expires_at: expiresAt(AUTH_CODE_TTL_SECONDS)
-		}).execute();
+		await atomicBatch(db, {
+			checks: authority.checks,
+			statements: [db.insertInto("_dineway_authorization_codes").values({
+				code_hash: codeHash,
+				client_id: params.client_id,
+				redirect_uri: params.redirect_uri,
+				user_id: userId,
+				scopes: JSON.stringify(scopes),
+				code_challenge: params.code_challenge,
+				code_challenge_method: params.code_challenge_method,
+				resource: params.resource ?? null,
+				expires_at: expiresAt(AUTH_CODE_TTL_SECONDS)
+			}).compile()]
+		});
 		const redirectUrl = new URL(params.redirect_uri);
 		redirectUrl.searchParams.set("code", code);
 		if (params.state) redirectUrl.searchParams.set("state", params.state);
@@ -153,7 +166,7 @@ async function handleAuthorizationCodeExchange(db, params) {
 			}
 		};
 		const codeHash = hashApiToken(params.code);
-		const row = await db.deleteFrom("_dineway_authorization_codes").where("code_hash", "=", codeHash).returningAll().executeTakeFirst();
+		const row = await db.selectFrom("_dineway_authorization_codes").selectAll().where("code_hash", "=", codeHash).executeTakeFirst();
 		if (!row) return {
 			success: false,
 			error: {
@@ -161,91 +174,62 @@ async function handleAuthorizationCodeExchange(db, params) {
 				message: "Invalid authorization code"
 			}
 		};
-		if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "Authorization code expired"
-			}
-		};
-		if (row.redirect_uri !== params.redirect_uri) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "redirect_uri mismatch"
-			}
-		};
-		if (row.client_id !== params.client_id) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "client_id mismatch"
-			}
-		};
-		if (!secureCompare(computeS256Challenge(params.code_verifier), row.code_challenge)) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "PKCE verification failed"
-			}
-		};
-		if (row.resource && params.resource && row.resource !== params.resource) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "resource mismatch"
-			}
-		};
-		const userInfo = await lookupUserRoleAndStatus(db, row.user_id);
-		if (!userInfo) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "User not found"
-			}
-		};
-		if (userInfo.disabled) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "User account is disabled"
-			}
+		const rejectCode = async (message) => {
+			await db.deleteFrom("_dineway_authorization_codes").where("code_hash", "=", codeHash).execute();
+			return {
+				success: false,
+				error: {
+					code: "invalid_grant",
+					message
+				}
+			};
 		};
+		if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) return rejectCode("Authorization code expired");
+		if (row.redirect_uri !== params.redirect_uri) return rejectCode("redirect_uri mismatch");
+		if (row.client_id !== params.client_id) return rejectCode("client_id mismatch");
+		if (!secureCompare(computeS256Challenge(params.code_verifier), row.code_challenge)) return rejectCode("PKCE verification failed");
+		if (row.resource && params.resource && row.resource !== params.resource) return rejectCode("resource mismatch");
+		const authority = await readTokenAuthority(db, row.user_id, row.client_id);
+		const userInfo = authority.user;
+		if (!userInfo) return rejectCode("User not found");
+		if (userInfo.disabled) return rejectCode("User account is disabled");
 		let scopes = clampScopes(filterExperimentalSiteContextWorkflowScopes(JSON.parse(row.scopes)), userInfo.role, { includeExperimental: experimentalSiteContextWorkflowsEnabled() });
-		const client = await lookupOAuthClient(db, row.client_id);
+		const client = authority.client;
 		if (client?.scopes?.length) scopes = scopes.filter((scope) => client.scopes.includes(scope));
-		if (scopes.length === 0) return {
-			success: false,
-			error: {
-				code: "invalid_grant",
-				message: "User role no longer supports any of the requested scopes"
-			}
-		};
+		if (scopes.length === 0 || !client || !client.redirectUris.includes(row.redirect_uri)) return rejectCode("User role no longer supports any of the requested scopes");
 		const accessToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_ACCESS);
 		const accessExpires = expiresAt(ACCESS_TOKEN_TTL_SECONDS);
 		const refreshToken = generatePrefixedToken(TOKEN_PREFIXES.OAUTH_REFRESH);
 		const refreshExpires = expiresAt(REFRESH_TOKEN_TTL_SECONDS);
-		await withTransaction(db, async (trx) => {
-			await trx.insertInto("_dineway_oauth_tokens").values({
-				token_hash: accessToken.hash,
-				token_type: "access",
-				user_id: row.user_id,
-				scopes: JSON.stringify(scopes),
-				client_type: "mcp",
-				expires_at: accessExpires,
-				refresh_token_hash: refreshToken.hash,
-				client_id: row.client_id
-			}).execute();
-			await trx.insertInto("_dineway_oauth_tokens").values({
-				token_hash: refreshToken.hash,
-				token_type: "refresh",
-				user_id: row.user_id,
-				scopes: JSON.stringify(scopes),
-				client_type: "mcp",
-				expires_at: refreshExpires,
-				refresh_token_hash: null,
-				client_id: row.client_id
-			}).execute();
+		await atomicBatch(db, {
+			checks: [
+				rowUnchanged("_dineway_authorization_codes", row),
+				...authority.checks,
+				sql`EXISTS (SELECT 1 FROM _dineway_authorization_codes WHERE code_hash = ${codeHash} AND expires_at > ${currentIsoTimestampValue(db)})`
+			],
+			statements: [
+				db.deleteFrom("_dineway_authorization_codes").where("code_hash", "=", codeHash).compile(),
+				db.insertInto("_dineway_oauth_tokens").values({
+					token_hash: accessToken.hash,
+					token_type: "access",
+					user_id: row.user_id,
+					scopes: JSON.stringify(scopes),
+					client_type: "mcp",
+					expires_at: accessExpires,
+					refresh_token_hash: refreshToken.hash,
+					client_id: row.client_id
+				}).compile(),
+				db.insertInto("_dineway_oauth_tokens").values({
+					token_hash: refreshToken.hash,
+					token_type: "refresh",
+					user_id: row.user_id,
+					scopes: JSON.stringify(scopes),
+					client_type: "mcp",
+					expires_at: refreshExpires,
+					refresh_token_hash: null,
+					client_id: row.client_id
+				}).compile()
+			]
 		});
 		return {
 			success: true,
@@ -258,6 +242,13 @@ async function handleAuthorizationCodeExchange(db, params) {
 			}
 		};
 	} catch (error) {
+		if (error instanceof AtomicWriteConflict) return {
+			success: false,
+			error: {
+				code: "invalid_grant",
+				message: "Authorization code or account permissions changed"
+			}
+		};
 		console.error("Token exchange error:", error);
 		return {
 			success: false,

package/dist/{oauth-clients-tovQ4D4h.mjs → oauth-clients-D4WBYaYW.mjs}

@@ -1,5 +1,5 @@
-import { s as validateScopes } from "./api-tokens-CmT83Bgj.mjs";
-import { o as getExperimentalSiteContextWorkflowScopesDisabledMessage, r as disabledExperimentalSiteContextWorkflowScopes } from "./experimental-workflows-B9x8delL.mjs";
+import { s as validateScopes } from "./api-tokens-D5K_Csub.mjs";
+import { o as getExperimentalSiteContextWorkflowScopesDisabledMessage, r as disabledExperimentalSiteContextWorkflowScopes } from "./experimental-workflows-M5D3RTFo.mjs";
 
 //#region src/api/oauth/redirect-uri.ts
 /**

package/dist/object-cache/memory.d.mts

@@ -1,4 +1,4 @@
-import { t as CreateObjectCacheBackendFn } from "../types-CU3Wn2HC.mjs";
+import { t as CreateObjectCacheBackendFn } from "../types-b2sq7ZDk.mjs";
 
 //#region src/object-cache/memory.d.ts
 /**

package/dist/{object-cache-D51qOseS.mjs → object-cache-BGjIlY9s.mjs}

@@ -1,5 +1,5 @@
 import { getRequestContext } from "./request-context.mjs";
-import { t as after } from "./after-BfniwgIf.mjs";
+import { t as after } from "./after-BVaUn7bK.mjs";
 
 //#region src/object-cache/codec.ts
 /**

package/dist/page/index.d.mts

@@ -1,13 +1,13 @@
-import { Dt as PublicSchemaNode, Et as PublicPageSchema, F as PageMetadataContribution, M as PageFragmentContribution, Tt as PublicPageImage, wt as PublicPageContext } from "../types-CfpX1og5.mjs";
-import "../types-BRCUO8NR.mjs";
-import "../runner-Dye73myO.mjs";
-import "../index-Co7xtjkd.mjs";
-import "../types-CPaVj_GC.mjs";
-import "../public-url-BQ9vf0AS.mjs";
-import "../validate-CDWVODvc.mjs";
-import "../byline-fields-51ja6JDa.mjs";
-import "../types--3oJQ0hs.mjs";
-import { _ as CreatePublicPageContextInput, a as generateSiteSeoContributions, c as ResolvedPageMetadata, d as renderPageMetadata, f as resolvePageMetadata, g as resolvePageImage, h as imageMetadataContributions, i as generateBaseSeoContributions, l as createSha256CspHash, m as mergePageSchema, n as buildWebSiteJsonLd, o as renderFragments, p as safeJsonLdSerialize, r as cleanJsonLd, s as resolveFragments, t as buildBlogPostingJsonLd, u as escapeHtmlAttr, v as createPublicPageContext } from "../jsonld-BpvnSp2m.mjs";
+import { Dt as PublicPageSchema, Et as PublicPageImage, F as PageMetadataContribution, M as PageFragmentContribution, Ot as PublicSchemaNode, Tt as PublicPageContext } from "../types-QjOcidFc.mjs";
+import "../types-7Th6Mwz3.mjs";
+import "../runner-JnJSGXEB.mjs";
+import "../index-CSUSBfdD.mjs";
+import "../types-DkXuBo8k.mjs";
+import "../public-url-BV-YQ_LF.mjs";
+import "../validate-A27peRc4.mjs";
+import "../byline-fields-BmkhEDFF.mjs";
+import "../types-DTjrkhKU.mjs";
+import { _ as CreatePublicPageContextInput, a as generateSiteSeoContributions, c as ResolvedPageMetadata, d as renderPageMetadata, f as resolvePageMetadata, g as resolvePageImage, h as imageMetadataContributions, i as generateBaseSeoContributions, l as createSha256CspHash, m as mergePageSchema, n as buildWebSiteJsonLd, o as renderFragments, p as safeJsonLdSerialize, r as cleanJsonLd, s as resolveFragments, t as buildBlogPostingJsonLd, u as escapeHtmlAttr, v as createPublicPageContext } from "../jsonld-CqIVIeZK.mjs";
 
 //#region src/page/index.d.ts
 /**

package/dist/page/index.mjs

@@ -1,4 +1,4 @@
-import { _ as createPublicPageContext, a as createSha256CspHash, c as resolvePageMetadata, d as buildBlogPostingJsonLd, f as buildWebSiteJsonLd, h as resolvePageImage, i as resolveFragments, l as safeJsonLdSerialize, m as imageMetadataContributions, n as generateSiteSeoContributions, o as escapeHtmlAttr, p as cleanJsonLd, r as renderFragments, s as renderPageMetadata, t as generateBaseSeoContributions, u as mergePageSchema } from "../seo-contributions-BAtRDXEQ.mjs";
+import { _ as createPublicPageContext, a as createSha256CspHash, c as resolvePageMetadata, d as buildBlogPostingJsonLd, f as buildWebSiteJsonLd, h as resolvePageImage, i as resolveFragments, l as safeJsonLdSerialize, m as imageMetadataContributions, n as generateSiteSeoContributions, o as escapeHtmlAttr, p as cleanJsonLd, r as renderFragments, s as renderPageMetadata, t as generateBaseSeoContributions, u as mergePageSchema } from "../seo-contributions-Dt57p6Sq.mjs";
 
 //#region src/page/index.ts
 /**

package/dist/{parse-IsGn-5lt.mjs → parse--7nG62_h.mjs}

@@ -1,4 +1,4 @@
-import { t as apiError } from "./error-DLg1H2LT.mjs";
+import { t as apiError } from "./error-Dd8LtpG5.mjs";
 import { z } from "zod";
 
 //#region src/api/parse.ts

package/dist/plugin-utils.d.mts

@@ -1,12 +1,12 @@
-import "./types-CfpX1og5.mjs";
-import "./types-BRCUO8NR.mjs";
-import "./runner-Dye73myO.mjs";
-import "./index-Co7xtjkd.mjs";
-import "./types-CPaVj_GC.mjs";
-import "./public-url-BQ9vf0AS.mjs";
-import "./validate-CDWVODvc.mjs";
-import "./byline-fields-51ja6JDa.mjs";
-import "./types--3oJQ0hs.mjs";
+import "./types-QjOcidFc.mjs";
+import "./types-7Th6Mwz3.mjs";
+import "./runner-JnJSGXEB.mjs";
+import "./index-CSUSBfdD.mjs";
+import "./types-DkXuBo8k.mjs";
+import "./public-url-BV-YQ_LF.mjs";
+import "./validate-A27peRc4.mjs";
+import "./byline-fields-BmkhEDFF.mjs";
+import "./types-DTjrkhKU.mjs";
 import { DinewayHandlers } from "./astro/types.mjs";
 
 //#region src/plugin-utils.d.ts

package/dist/plugins/adapt-sandbox-entry.d.mts

@@ -1,12 +1,12 @@
-import { Ft as StandardPluginDefinition, ko as PluginDescriptor, kt as ResolvedPlugin } from "../types-CfpX1og5.mjs";
-import "../types-BRCUO8NR.mjs";
-import "../runner-Dye73myO.mjs";
-import "../index-Co7xtjkd.mjs";
-import "../types-CPaVj_GC.mjs";
-import "../public-url-BQ9vf0AS.mjs";
-import "../validate-CDWVODvc.mjs";
-import "../byline-fields-51ja6JDa.mjs";
-import "../types--3oJQ0hs.mjs";
+import { At as ResolvedPlugin, It as StandardPluginDefinition, jo as PluginDescriptor } from "../types-QjOcidFc.mjs";
+import "../types-7Th6Mwz3.mjs";
+import "../runner-JnJSGXEB.mjs";
+import "../index-CSUSBfdD.mjs";
+import "../types-DkXuBo8k.mjs";
+import "../public-url-BV-YQ_LF.mjs";
+import "../validate-A27peRc4.mjs";
+import "../byline-fields-BmkhEDFF.mjs";
+import "../types-DTjrkhKU.mjs";
 
 //#region src/plugins/adapt-sandbox-entry.d.ts
 /**

package/dist/plugins/adapt-sandbox-entry.mjs

@@ -1,4 +1,4 @@
-import { n as PLUGIN_CAPABILITIES, t as HOOK_NAMES } from "../manifest-schema-CfKD0thC.mjs";
+import { n as PLUGIN_CAPABILITIES, t as HOOK_NAMES } from "../manifest-schema-DG29meRy.mjs";
 
 //#region src/plugins/adapt-sandbox-entry.ts
 /**

package/dist/{plugins-DXyLI3Hb.mjs → plugins-DK1wLuao.mjs}

@@ -1,16 +1,17 @@
-import { r as validatePluginIdentifier, t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
-import { i as encodeBase64url, n as decodeBase64url } from "./base64-F8-DUraK.mjs";
-import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-CnuL55JE.mjs";
-import { t as OptionsRepository } from "./options-1dBRkoCl.mjs";
-import { n as createPluginContext, t as PluginContextFactory } from "./context-MftkHbWx.mjs";
-import { i as parseEncryptionKeys, t as DinewaySecretsError } from "./secrets-AdCrGg1c.mjs";
-import { t as extractRequestMeta } from "./request-meta-BW0the1R.mjs";
-import { r as setCronTasksEnabled } from "./cron-mGVPQ5e6.mjs";
-import { Migrator, sql } from "kysely";
-import { AsyncLocalStorage } from "node:async_hooks";
+import { r as validatePluginIdentifier, t as validateIdentifier } from "./validate-Co3j6T_K.mjs";
+import { i as encodeBase64url, n as decodeBase64url } from "./base64-Cz-aU0X1.mjs";
+import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-BnG3LPMN.mjs";
+import { t as OptionsRepository } from "./options-BcqHWpc-.mjs";
+import { n as createPluginContext, t as PluginContextFactory } from "./context-6uqzU-M9.mjs";
+import { t as readRuntimeEnv } from "./runtime-env-CQVAWHzH.mjs";
+import { i as parseEncryptionKeys, t as DinewaySecretsError } from "./secrets-Cg0D2gQW.mjs";
+import { t as extractRequestMeta } from "./request-meta-BOcuHAXD.mjs";
+import { r as setCronTasksEnabled } from "./cron-D7zB6m8i.mjs";
+import { sql } from "kysely";
 import { ulid } from "ulidx";
-import { z } from "astro/zod";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { Permissions } from "@dineway-ai/auth";
+import { z } from "astro/zod";
 import { Worker } from "node:worker_threads";
 
 //#region src/database/repositories/plugin-secrets.ts
@@ -18,7 +19,7 @@ var PluginSecretRepository = class {
 	constructor(db) {
 		this.db = db;
 	}
-	async put(input) {
+	preparePut(input) {
 		const now = input.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
 		const row = {
 			plugin_id: input.pluginId,
@@ -31,14 +32,17 @@ var PluginSecretRepository = class {
 			created_at: now,
 			updated_at: now
 		};
-		await this.db.insertInto("_dineway_plugin_secrets").values(row).onConflict((conflict) => conflict.columns(["plugin_id", "secret_name"]).doUpdateSet({
+		return this.db.insertInto("_dineway_plugin_secrets").values(row).onConflict((conflict) => conflict.columns(["plugin_id", "secret_name"]).doUpdateSet({
 			encryption_version: row.encryption_version,
 			key_id: row.key_id,
 			nonce: row.nonce,
 			ciphertext: row.ciphertext,
 			fingerprint: row.fingerprint,
 			updated_at: now
-		})).execute();
+		})).compile();
+	}
+	async put(input) {
+		await this.db.executeQuery(this.preparePut(input));
 		const stored = await this.find(input.pluginId, input.name);
 		if (!stored) throw new Error("Plugin secret write did not persist.");
 		return stored;
@@ -50,6 +54,9 @@ var PluginSecretRepository = class {
 	async list(pluginId) {
 		return (await this.db.selectFrom("_dineway_plugin_secrets").selectAll().where("plugin_id", "=", pluginId).orderBy("secret_name", "asc").execute()).map(rowToStoredPluginSecret);
 	}
+	prepareDelete(pluginId, name) {
+		return this.db.deleteFrom("_dineway_plugin_secrets").where("plugin_id", "=", pluginId).where("secret_name", "=", name).compile();
+	}
 	async delete(pluginId, name) {
 		const result = await this.db.deleteFrom("_dineway_plugin_secrets").where("plugin_id", "=", pluginId).where("secret_name", "=", name).executeTakeFirst();
 		return Number(result.numDeletedRows ?? 0) > 0;
@@ -1304,6 +1311,7 @@ function defineNativePlugin(definition) {
 	return {
 		id,
 		version,
+		d1: definition.d1,
 		capabilities: normalizedCapabilities,
 		allowedHosts,
 		storage,
@@ -1439,69 +1447,6 @@ function resolveHook(hook, pluginId) {
 	};
 }
 
-//#endregion
-//#region src/plugins/migrations.ts
-const LEADING_AT = /^@/;
-var StaticPluginMigrationProvider = class {
-	constructor(migrations) {
-		this.migrations = migrations;
-	}
-	async getMigrations() {
-		return this.migrations;
-	}
-};
-/**
-* Run migrations contributed by configured trusted native plugins.
-*
-* Each plugin receives isolated Kysely migration and lock tables. This keeps migration history valid
-* when another plugin is removed and lets different plugins safely reuse local migration names.
-*/
-async function runPluginMigrations(db, plugins) {
-	const applied = [];
-	for (const plugin of [...plugins].toSorted((left, right) => left.id.localeCompare(right.id))) {
-		if (Object.keys(plugin.migrations).length === 0) continue;
-		const tables = pluginMigrationTableNames(plugin.id);
-		const { error, results } = await new Migrator({
-			db,
-			provider: new StaticPluginMigrationProvider(plugin.migrations),
-			migrationTableName: tables.migrations,
-			migrationLockTableName: tables.lock
-		}).migrateToLatest();
-		const successful = results?.filter((result) => result.status === "Success").map((result) => result.migrationName) ?? [];
-		if (error) {
-			const failed = results?.find((result) => result.status === "Error")?.migrationName;
-			throw new Error(`Plugin migration failed for ${plugin.id}${failed ? ` (${failed})` : ""}: ${errorMessage(error)}`, { cause: error });
-		}
-		applied.push({
-			pluginId: plugin.id,
-			applied: successful
-		});
-	}
-	return applied;
-}
-function pluginMigrationTableNames(pluginId) {
-	const slug = pluginId.replace(LEADING_AT, "").replaceAll("/", "_").replaceAll("-", "_").slice(0, 20);
-	const suffix = fnv1a(pluginId);
-	return {
-		migrations: `_dineway_plugin_migration_${slug}_${suffix}`,
-		lock: `_dineway_plugin_migration_lock_${slug}_${suffix}`
-	};
-}
-function fnv1a(value) {
-	let hash = 2166136261;
-	for (let index = 0; index < value.length; index++) {
-		hash ^= value.charCodeAt(index);
-		hash = Math.imul(hash, 16777619);
-	}
-	return (hash >>> 0).toString(16).padStart(8, "0");
-}
-function errorMessage(error) {
-	if (!(error instanceof Error)) return JSON.stringify(error);
-	if (error.message) return error.message;
-	if (error.cause instanceof Error && error.cause.message) return error.cause.message;
-	return "unknown error";
-}
-
 //#endregion
 //#region src/plugins/hooks.ts
 /**
@@ -2922,13 +2867,13 @@ var PluginSecretStore = class {
 		this.repository = new PluginSecretRepository(db);
 		this.keysPromise = options.keys ? Promise.resolve(options.keys) : parseEncryptionKeys(readEncryptionKey(options.env));
 	}
-	async set(pluginId, name, value) {
+	async prepareValue(pluginId, name, value) {
 		validateSecretIdentity(pluginId, name);
 		validateSecretValue(value);
 		const primaryKey = (await this.requireKeys())[0];
 		if (!primaryKey) throw encryptionKeyRequired();
 		const encrypted = await encryptSecret(primaryKey, pluginId, name, value);
-		return toStatus(await this.repository.put({
+		return {
 			pluginId,
 			name,
 			encryptionVersion: ENCRYPTION_VERSION,
@@ -2936,7 +2881,15 @@ var PluginSecretStore = class {
 			nonce: encrypted.nonce,
 			ciphertext: encrypted.ciphertext,
 			fingerprint: await fingerprintSecret(primaryKey, value)
-		}));
+		};
+	}
+	/** Encrypt before composing a larger atomic write; this method does not change storage. */
+	async prepareWrite(pluginId, name, value) {
+		validateSecretIdentity(pluginId, name);
+		return value === null ? this.repository.prepareDelete(pluginId, name) : this.repository.preparePut(await this.prepareValue(pluginId, name, value));
+	}
+	async set(pluginId, name, value) {
+		return toStatus(await this.repository.put(await this.prepareValue(pluginId, name, value)));
 	}
 	async status(pluginId, name) {
 		validateSecretIdentity(pluginId, name);
@@ -3045,9 +2998,7 @@ function encryptionKeyRequired() {
 }
 function readEncryptionKey(env) {
 	if (env) return env.DINEWAY_ENCRYPTION_KEY;
-	const meta = import.meta.env ?? {};
-	const proc = typeof process !== "undefined" && process.env ? process.env : {};
-	return meta.DINEWAY_ENCRYPTION_KEY ?? proc.DINEWAY_ENCRYPTION_KEY;
+	return readRuntimeEnv("DINEWAY_ENCRYPTION_KEY");
 }
 function toStatus(stored) {
 	return {
@@ -4324,4 +4275,4 @@ function createNodeSandboxRunner(options) {
 }
 
 //#endregion
-export { portableTextToProsemirror as C, image as D, reference as E, RelationRepository as O, verifyGuestAccessToken as S, portableText as T, DEFAULT_PLUGIN_RAW_BODY_LIMIT_BYTES as _, createNoopSandboxRunner as a, hashGuestAccessToken as b, PluginSecretStore as c, EmailPipeline as d, HookPipeline as f, definePlugin as g, runPluginMigrations as h, SandboxNotAvailableError as i, PluginRouteError as l, resolveExclusiveHooks as m, createNodeSandboxRunner as n, PluginManager as o, createHookPipeline as p, NoopSandboxRunner as r, createPluginManager as s, NodeSandboxRunner as t, PluginRouteRegistry as u, readBoundedPluginRouteBody as v, prosemirrorToPortableText as w, issueGuestAccessToken as x, GuestAccessTokenConfigurationError as y };
+export { prosemirrorToPortableText as C, RelationRepository as D, image as E, portableTextToProsemirror as S, reference as T, readBoundedPluginRouteBody as _, createNoopSandboxRunner as a, issueGuestAccessToken as b, PluginSecretStore as c, EmailPipeline as d, HookPipeline as f, DEFAULT_PLUGIN_RAW_BODY_LIMIT_BYTES as g, definePlugin as h, SandboxNotAvailableError as i, PluginRouteError as l, resolveExclusiveHooks as m, createNodeSandboxRunner as n, PluginManager as o, createHookPipeline as p, NoopSandboxRunner as r, createPluginManager as s, NodeSandboxRunner as t, PluginRouteRegistry as u, GuestAccessTokenConfigurationError as v, portableText as w, verifyGuestAccessToken as x, hashGuestAccessToken as y };

package/dist/{policy-DKdNMv8y.mjs → policy-Dej7NJFD.mjs}

@@ -1,5 +1,5 @@
-import { t as OptionsRepository } from "./options-1dBRkoCl.mjs";
-import { t as buildStableHash } from "./stable-hash-DF7R5eN8.mjs";
+import { t as OptionsRepository } from "./options-BcqHWpc-.mjs";
+import { t as buildStableHash } from "./stable-hash-DEtJgcp7.mjs";
 import { z } from "zod";
 
 //#region src/review-automation/policy.ts

package/dist/{preview-BXmS1SXL.mjs → preview-q0pkibNO.mjs}

@@ -1,7 +1,7 @@
 import { n as loadBetterSqlite3, t as createDatabase } from "./connection-DJ3GzHVH.mjs";
 import { runWithContext } from "./request-context.mjs";
-import { a as verifyPreviewSignature, t as buildPreviewSignatureHeader } from "./sidecar-client-Bw2C0XTf.mjs";
-import { t as generatePreviewToken } from "./tokens-c-qxNqzC.mjs";
+import { a as verifyPreviewSignature, t as buildPreviewSignatureHeader } from "./sidecar-client-CnpGTvYq.mjs";
+import { t as generatePreviewToken } from "./tokens-Bjuf1HID.mjs";
 import { createHash } from "node:crypto";
 import { sql } from "kysely";
 import { ulid } from "ulidx";

package/dist/{provider-loader-DDq7R_RN.d.mts → provider-loader-C0GaLwKB.d.mts}

@@ -1,4 +1,4 @@
-import { f as MediaProvider } from "./placeholder-D03pGvqM.mjs";
+import { f as MediaProvider } from "./placeholder-BHTaoCYx.mjs";
 
 //#region src/media/provider-loader.d.ts
 /**

package/dist/{public-url-Ci7UbC0W.d.mts → public-url-B9zEdO8p.d.mts}

@@ -1,4 +1,4 @@
-import { Oo as DinewayConfig } from "./types-CfpX1og5.mjs";
+import { Ao as DinewayConfig } from "./types-QjOcidFc.mjs";
 
 //#region src/api/public-url.d.ts
 /**

package/dist/{public-url-BQ9vf0AS.d.mts → public-url-BV-YQ_LF.d.mts}

@@ -1,5 +1,5 @@
-import { i as CollectionWithFields } from "./types-CKIt_jmM.mjs";
-import { t as Database } from "./types-BRCUO8NR.mjs";
+import { i as CollectionWithFields } from "./types-Bs-7Geuh.mjs";
+import { t as Database } from "./types-7Th6Mwz3.mjs";
 import { Kysely } from "kysely";
 import { z } from "zod";