dineway 0.2.33 → 0.2.35

package/dist/astro/routes/api/auth/magic-link/send.mjs

@@ -1,15 +1,16 @@
-import { t as OptionsRepository } from "../../../../../options-1dBRkoCl.mjs";
-import "../../../../../context-types-CPWAJRs5.mjs";
-import "../../../../../public-discovery-CyDzK1-S.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../error-DLg1H2LT.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-IsGn-5lt.mjs";
-import "../../../../../redirects-N8gmWhVM.mjs";
-import { _ as magicLinkSendBody } from "../../../../../byline-fields-QpmruT5r.mjs";
-import "../../../../../status-Bba6RbkS.mjs";
+import { t as OptionsRepository } from "../../../../../options-BcqHWpc-.mjs";
+import "../../../../../context-types-DLD_HnKT.mjs";
+import "../../../../../runtime-env-v-1UXPAH.mjs";
+import "../../../../../public-discovery-CTql6jdZ.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../error-B-44r5TD.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-BscLr3p2.mjs";
+import "../../../../../redirects-DpRiuRWn.mjs";
+import { _ as magicLinkSendBody } from "../../../../../byline-fields-DGNKitg3.mjs";
+import "../../../../../status-DBSB6tdS.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-CdEl6g6B.mjs";
-import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-DEkoxTsP.mjs";
-import { t as getSiteBaseUrl } from "../../../../../site-url-DoZf_jVj.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-CvDP0g0F.mjs";
+import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-RaBJEgyt.mjs";
+import { t as getSiteBaseUrl } from "../../../../../site-url-DoTPKRND.mjs";
 import { sendMagicLink } from "@dineway-ai/auth";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/magic-link/verify.mjs

@@ -1,5 +1,5 @@
-import { t as apiError } from "../../../../../error-DLg1H2LT.mjs";
-import { t as isSafeRedirect } from "../../../../../redirect-Dp5u-8dH.mjs";
+import { t as apiError } from "../../../../../error-B-44r5TD.mjs";
+import { t as isSafeRedirect } from "../../../../../redirect-Cjjb5VYr.mjs";
 import { MagicLinkError, verifyMagicLink } from "@dineway-ai/auth";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/me.mjs

@@ -1,14 +1,14 @@
-import "../../../../base64-F8-DUraK.mjs";
-import "../../../../types-BpSTdH1H.mjs";
-import { t as UserRepository } from "../../../../user-D0NJ7gYf.mjs";
-import { t as OptionsRepository } from "../../../../options-1dBRkoCl.mjs";
-import "../../../../context-types-CPWAJRs5.mjs";
-import "../../../../public-discovery-CyDzK1-S.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-DLg1H2LT.mjs";
-import { n as parseBody, t as isParseError } from "../../../../parse-IsGn-5lt.mjs";
-import "../../../../redirects-N8gmWhVM.mjs";
-import { p as authMeActionBody } from "../../../../byline-fields-QpmruT5r.mjs";
-import "../../../../status-Bba6RbkS.mjs";
+import "../../../../base64-Cz-aU0X1.mjs";
+import "../../../../types-BqxIv8Il.mjs";
+import { t as UserRepository } from "../../../../user-1-YV30lf.mjs";
+import { t as OptionsRepository } from "../../../../options-BcqHWpc-.mjs";
+import "../../../../context-types-DLD_HnKT.mjs";
+import "../../../../public-discovery-CTql6jdZ.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../error-B-44r5TD.mjs";
+import { n as parseBody, t as isParseError } from "../../../../parse-BscLr3p2.mjs";
+import "../../../../redirects-DpRiuRWn.mjs";
+import { p as authMeActionBody } from "../../../../byline-fields-DGNKitg3.mjs";
+import "../../../../status-DBSB6tdS.mjs";
 import "../../../../api/schemas/index.mjs";
 
 //#region src/astro/routes/api/auth/me.ts

package/dist/astro/routes/api/auth/mode.mjs

@@ -1,4 +1,4 @@
-import { t as getAuthMode } from "../../../../mode-DJeacFCZ.mjs";
+import { t as getAuthMode } from "../../../../mode-BJwb_MgK.mjs";
 import { sql } from "kysely";
 
 //#region src/astro/routes/api/auth/mode.ts

package/dist/astro/routes/api/auth/oauth/_provider_/callback.mjs

@@ -1,5 +1,6 @@
-import { n as getPublicOrigin } from "../../../../../../public-url-BVIjzMo3.mjs";
-import { t as createOAuthStateStore } from "../../../../../../oauth-state-store-Do1a_o3H.mjs";
+import { t as readRuntimeEnv } from "../../../../../../runtime-env-v-1UXPAH.mjs";
+import { n as getPublicOrigin } from "../../../../../../public-url-4sMO36Gw.mjs";
+import { t as createOAuthStateStore } from "../../../../../../oauth-state-store-D2H9hKcN.mjs";
 import { OAuthError, Role, handleOAuthCallback } from "@dineway-ai/auth";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 
@@ -12,7 +13,7 @@ function isValidProvider(provider) {
 /** Safely extract a string value from an env-like record */
 function envString(env, ...keys) {
 	for (const key of keys) {
-		const val = env[key];
+		const val = env[key] ?? readRuntimeEnv(key);
 		if (typeof val === "string" && val) return val;
 	}
 }
@@ -51,7 +52,7 @@ const GET = async ({ params, request, locals, session, redirect }) => {
 	}
 	if (!code || !state) return redirect(`/_dineway/admin/login?error=invalid_callback&message=${encodeURIComponent("Missing code or state parameter")}`);
 	try {
-		const providers = getOAuthConfig(locals.runtime?.env ?? import.meta.env);
+		const providers = getOAuthConfig(locals.runtime?.env ?? {});
 		if (!providers[provider]) return redirect(`/_dineway/admin/login?error=provider_not_configured&message=${encodeURIComponent(`OAuth provider ${provider} is not configured`)}`);
 		const user = await handleOAuthCallback({
 			baseUrl: `${getPublicOrigin(url, dineway?.config)}/_dineway`,

package/dist/astro/routes/api/auth/oauth/_provider_.mjs

@@ -1,5 +1,6 @@
-import { n as getPublicOrigin } from "../../../../../public-url-BVIjzMo3.mjs";
-import { t as createOAuthStateStore } from "../../../../../oauth-state-store-Do1a_o3H.mjs";
+import { t as readRuntimeEnv } from "../../../../../runtime-env-v-1UXPAH.mjs";
+import { n as getPublicOrigin } from "../../../../../public-url-4sMO36Gw.mjs";
+import { t as createOAuthStateStore } from "../../../../../oauth-state-store-D2H9hKcN.mjs";
 import { createAuthorizationUrl } from "@dineway-ai/auth";
 
 //#region src/astro/routes/api/auth/oauth/[provider].ts
@@ -11,7 +12,7 @@ function isValidProvider(provider) {
 /** Safely extract a string value from an env-like record */
 function envString(env, ...keys) {
 	for (const key of keys) {
-		const val = env[key];
+		const val = env[key] ?? readRuntimeEnv(key);
 		if (typeof val === "string" && val) return val;
 	}
 }
@@ -41,7 +42,7 @@ const GET = async ({ params, request, locals, redirect }) => {
 	if (!dineway?.db) return redirect(`/_dineway/admin/login?error=server_error&message=${encodeURIComponent("Database not configured")}`);
 	try {
 		const url = new URL(request.url);
-		const providers = getOAuthConfig(locals.runtime?.env ?? import.meta.env);
+		const providers = getOAuthConfig(locals.runtime?.env ?? {});
 		if (!providers[provider]) return redirect(`/_dineway/admin/login?error=provider_not_configured&message=${encodeURIComponent(`OAuth provider ${provider} is not configured`)}`);
 		const { url: authUrl } = await createAuthorizationUrl({
 			baseUrl: `${getPublicOrigin(url, dineway?.config)}/_dineway`,

package/dist/astro/routes/api/auth/passkey/_id_.mjs

@@ -1,10 +1,10 @@
-import "../../../../../context-types-CPWAJRs5.mjs";
-import "../../../../../public-discovery-CyDzK1-S.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DLg1H2LT.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-IsGn-5lt.mjs";
-import "../../../../../redirects-N8gmWhVM.mjs";
-import { x as passkeyRenameBody } from "../../../../../byline-fields-QpmruT5r.mjs";
-import "../../../../../status-Bba6RbkS.mjs";
+import "../../../../../context-types-DLD_HnKT.mjs";
+import "../../../../../public-discovery-CTql6jdZ.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B-44r5TD.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-BscLr3p2.mjs";
+import "../../../../../redirects-DpRiuRWn.mjs";
+import { x as passkeyRenameBody } from "../../../../../byline-fields-DGNKitg3.mjs";
+import "../../../../../status-DBSB6tdS.mjs";
 import "../../../../../api/schemas/index.mjs";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/passkey/index.mjs

@@ -1,4 +1,4 @@
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DLg1H2LT.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B-44r5TD.mjs";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 
 //#region src/astro/routes/api/auth/passkey/index.ts

package/dist/astro/routes/api/auth/passkey/options.mjs

@@ -1,17 +1,18 @@
-import { t as OptionsRepository } from "../../../../../options-1dBRkoCl.mjs";
-import "../../../../../context-types-CPWAJRs5.mjs";
-import "../../../../../public-discovery-CyDzK1-S.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DLg1H2LT.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../parse-IsGn-5lt.mjs";
-import "../../../../../redirects-N8gmWhVM.mjs";
-import { v as passkeyOptionsBody } from "../../../../../byline-fields-QpmruT5r.mjs";
-import "../../../../../status-Bba6RbkS.mjs";
+import { t as OptionsRepository } from "../../../../../options-BcqHWpc-.mjs";
+import "../../../../../context-types-DLD_HnKT.mjs";
+import "../../../../../runtime-env-v-1UXPAH.mjs";
+import "../../../../../public-discovery-CTql6jdZ.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B-44r5TD.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../parse-BscLr3p2.mjs";
+import "../../../../../redirects-DpRiuRWn.mjs";
+import { v as passkeyOptionsBody } from "../../../../../byline-fields-DGNKitg3.mjs";
+import "../../../../../status-DBSB6tdS.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-CdEl6g6B.mjs";
-import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-DEkoxTsP.mjs";
-import { n as getPublicOrigin } from "../../../../../public-url-BVIjzMo3.mjs";
-import { n as createChallengeStore, t as cleanupExpiredChallenges } from "../../../../../challenge-store-CDKfye2r.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-CRN44T04.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-CvDP0g0F.mjs";
+import { n as getClientIp, r as rateLimitResponse, t as checkRateLimit } from "../../../../../rate-limit-RaBJEgyt.mjs";
+import { n as getPublicOrigin } from "../../../../../public-url-4sMO36Gw.mjs";
+import { n as createChallengeStore, t as cleanupExpiredChallenges } from "../../../../../challenge-store-DFGsDtCj.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-sUQoLEj_.mjs";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 import { generateAuthenticationOptions } from "@dineway-ai/auth/passkey";
 

package/dist/astro/routes/api/auth/passkey/register/options.mjs

@@ -1,15 +1,15 @@
-import { t as OptionsRepository } from "../../../../../../options-1dBRkoCl.mjs";
-import "../../../../../../context-types-CPWAJRs5.mjs";
-import "../../../../../../public-discovery-CyDzK1-S.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-DLg1H2LT.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-IsGn-5lt.mjs";
-import "../../../../../../redirects-N8gmWhVM.mjs";
-import { y as passkeyRegisterOptionsBody } from "../../../../../../byline-fields-QpmruT5r.mjs";
-import "../../../../../../status-Bba6RbkS.mjs";
+import { t as OptionsRepository } from "../../../../../../options-BcqHWpc-.mjs";
+import "../../../../../../context-types-DLD_HnKT.mjs";
+import "../../../../../../public-discovery-CTql6jdZ.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-B-44r5TD.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-BscLr3p2.mjs";
+import "../../../../../../redirects-DpRiuRWn.mjs";
+import { y as passkeyRegisterOptionsBody } from "../../../../../../byline-fields-DGNKitg3.mjs";
+import "../../../../../../status-DBSB6tdS.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { n as getPublicOrigin } from "../../../../../../public-url-BVIjzMo3.mjs";
-import { n as createChallengeStore } from "../../../../../../challenge-store-CDKfye2r.mjs";
-import { t as getPasskeyConfig } from "../../../../../../passkey-config-CRN44T04.mjs";
+import { n as getPublicOrigin } from "../../../../../../public-url-4sMO36Gw.mjs";
+import { n as createChallengeStore } from "../../../../../../challenge-store-DFGsDtCj.mjs";
+import { t as getPasskeyConfig } from "../../../../../../passkey-config-sUQoLEj_.mjs";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 import { generateRegistrationOptions } from "@dineway-ai/auth/passkey";
 

package/dist/astro/routes/api/auth/passkey/register/verify.mjs

@@ -1,16 +1,16 @@
-import { t as OptionsRepository } from "../../../../../../options-1dBRkoCl.mjs";
-import "../../../../../../context-types-CPWAJRs5.mjs";
-import "../../../../../../public-discovery-CyDzK1-S.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../../error-DLg1H2LT.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../../parse-IsGn-5lt.mjs";
-import "../../../../../../redirects-N8gmWhVM.mjs";
-import { b as passkeyRegisterVerifyBody } from "../../../../../../byline-fields-QpmruT5r.mjs";
-import "../../../../../../status-Bba6RbkS.mjs";
+import { t as OptionsRepository } from "../../../../../../options-BcqHWpc-.mjs";
+import "../../../../../../context-types-DLD_HnKT.mjs";
+import "../../../../../../public-discovery-CTql6jdZ.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../../error-B-44r5TD.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../parse-BscLr3p2.mjs";
+import "../../../../../../redirects-DpRiuRWn.mjs";
+import { b as passkeyRegisterVerifyBody } from "../../../../../../byline-fields-DGNKitg3.mjs";
+import "../../../../../../status-DBSB6tdS.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { n as getPublicOrigin } from "../../../../../../public-url-BVIjzMo3.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../../allowed-origins-DGSyhRCz.mjs";
-import { n as createChallengeStore } from "../../../../../../challenge-store-CDKfye2r.mjs";
-import { t as getPasskeyConfig } from "../../../../../../passkey-config-CRN44T04.mjs";
+import { n as getPublicOrigin } from "../../../../../../public-url-4sMO36Gw.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../../allowed-origins-Cp7BI3L9.mjs";
+import { n as createChallengeStore } from "../../../../../../challenge-store-DFGsDtCj.mjs";
+import { t as getPasskeyConfig } from "../../../../../../passkey-config-sUQoLEj_.mjs";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 import { registerPasskey, verifyRegistrationResponse } from "@dineway-ai/auth/passkey";
 

package/dist/astro/routes/api/auth/passkey/verify.mjs

@@ -1,16 +1,16 @@
-import { t as OptionsRepository } from "../../../../../options-1dBRkoCl.mjs";
-import "../../../../../context-types-CPWAJRs5.mjs";
-import "../../../../../public-discovery-CyDzK1-S.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DLg1H2LT.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-IsGn-5lt.mjs";
-import "../../../../../redirects-N8gmWhVM.mjs";
-import { S as passkeyVerifyBody } from "../../../../../byline-fields-QpmruT5r.mjs";
-import "../../../../../status-Bba6RbkS.mjs";
+import { t as OptionsRepository } from "../../../../../options-BcqHWpc-.mjs";
+import "../../../../../context-types-DLD_HnKT.mjs";
+import "../../../../../public-discovery-CTql6jdZ.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B-44r5TD.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-BscLr3p2.mjs";
+import "../../../../../redirects-DpRiuRWn.mjs";
+import { S as passkeyVerifyBody } from "../../../../../byline-fields-DGNKitg3.mjs";
+import "../../../../../status-DBSB6tdS.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as getPublicOrigin } from "../../../../../public-url-BVIjzMo3.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-DGSyhRCz.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-CDKfye2r.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-CRN44T04.mjs";
+import { n as getPublicOrigin } from "../../../../../public-url-4sMO36Gw.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-Cp7BI3L9.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-DFGsDtCj.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-sUQoLEj_.mjs";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 import { PasskeyAuthenticationError, authenticateWithPasskey } from "@dineway-ai/auth/passkey";
 

package/dist/astro/routes/api/auth/setup-token/index.mjs

@@ -1,9 +1,12 @@
-import "../../../../../base64-F8-DUraK.mjs";
-import "../../../../../types-BpSTdH1H.mjs";
-import { t as AuditRepository } from "../../../../../audit-CYjfxG9i.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DLg1H2LT.mjs";
-import { i as hasScope, n as TOKEN_PREFIXES, r as generatePrefixedToken } from "../../../../../api-tokens-CmT83Bgj.mjs";
-import { n as getPublicOrigin } from "../../../../../public-url-BVIjzMo3.mjs";
+import "../../../../../d1-binding-D6HZa3ks.mjs";
+import { AtomicWriteConflict, atomicBatch } from "../../../../../database/batch.mjs";
+import "../../../../../base64-Cz-aU0X1.mjs";
+import "../../../../../types-BqxIv8Il.mjs";
+import { t as AuditRepository } from "../../../../../audit-F5iWkbcJ.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B-44r5TD.mjs";
+import { i as hasScope$1, n as TOKEN_PREFIXES, r as generatePrefixedToken } from "../../../../../api-tokens-DA18zxza.mjs";
+import { n as getPublicOrigin } from "../../../../../public-url-4sMO36Gw.mjs";
+import { sql } from "kysely";
 import { ulid } from "ulidx";
 import { Role } from "@dineway-ai/auth";
 
@@ -21,26 +24,12 @@ const POST = async ({ locals, request, url }) => {
 	const { dineway, user } = locals;
 	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
 	if (!user || user.role < Role.ADMIN) return apiError("FORBIDDEN", "Admin privileges required", 403);
-	if (locals.tokenScopes && !hasScope(locals.tokenScopes, "admin")) return apiError("FORBIDDEN", "Admin token scope required", 403);
+	if (locals.tokenScopes && !hasScope$1(locals.tokenScopes, "admin")) return apiError("FORBIDDEN", "Admin token scope required", 403);
 	try {
 		const { raw, hash } = generatePrefixedToken(TOKEN_PREFIXES.SETUP_LINK);
 		const expiresAt = new Date(Date.now() + SETUP_LINK_TTL_MS).toISOString();
-		await dineway.db.transaction().execute(async (trx) => {
-			await trx.deleteFrom("auth_tokens").where("user_id", "=", user.id).where("type", "=", SETUP_TOKEN_TYPE).execute();
-			await trx.insertInto("auth_tokens").values({
-				hash,
-				user_id: user.id,
-				email: user.email,
-				type: SETUP_TOKEN_TYPE,
-				role: null,
-				invited_by: null,
-				expires_at: expiresAt
-			}).execute();
-		});
-		const origin = getPublicOrigin(url, dineway.config);
-		const setupUrl = new URL("/_dineway/api/auth/setup-token/verify", origin);
-		setupUrl.searchParams.set("token", raw);
-		await new AuditRepository(dineway.db).log({
+		const db = dineway.db;
+		const audit = new AuditRepository(db).prepareLog({
 			actorId: user.id,
 			actorIp: request.headers.get("x-forwarded-for") ?? void 0,
 			action: "settings_update",
@@ -49,11 +38,31 @@ const POST = async ({ locals, request, url }) => {
 			details: { expiresAt },
 			status: "success"
 		});
+		await atomicBatch(db, {
+			checks: [sql`EXISTS (SELECT 1 FROM users WHERE id = ${user.id} AND role >= ${Role.ADMIN} AND disabled = 0 AND email = ${user.email})`],
+			statements: [
+				db.deleteFrom("auth_tokens").where("user_id", "=", user.id).where("type", "=", SETUP_TOKEN_TYPE).compile(),
+				db.insertInto("auth_tokens").values({
+					hash,
+					user_id: user.id,
+					email: user.email,
+					type: SETUP_TOKEN_TYPE,
+					role: null,
+					invited_by: null,
+					expires_at: expiresAt
+				}).compile(),
+				audit.statement
+			]
+		});
+		const origin = getPublicOrigin(url, dineway.config);
+		const setupUrl = new URL("/_dineway/api/auth/setup-token/verify", origin);
+		setupUrl.searchParams.set("token", raw);
 		return apiSuccess({
 			setupUrl: setupUrl.toString(),
 			expiresAt
 		}, 201);
 	} catch (error) {
+		if (error instanceof AtomicWriteConflict) return apiError("CONFLICT", "Administrator permissions changed. Sign in again and retry.", 409);
 		return handleError(error, "Failed to create setup link", "SETUP_TOKEN_CREATE_ERROR");
 	}
 };

package/dist/astro/routes/api/auth/setup-token/verify.mjs

@@ -1,5 +1,9 @@
-import { o as hashPrefixedToken } from "../../../../../api-tokens-CmT83Bgj.mjs";
-import { t as escapeHtml } from "../../../../../escape-C6lkys0j.mjs";
+import "../../../../../d1-binding-D6HZa3ks.mjs";
+import { AtomicWriteConflict, atomicBatch, rowUnchanged } from "../../../../../database/batch.mjs";
+import { r as currentIsoTimestampValue } from "../../../../../dialect-helpers-C6xtO-Ui.mjs";
+import { o as hashPrefixedToken } from "../../../../../api-tokens-DA18zxza.mjs";
+import { t as escapeHtml } from "../../../../../escape-B1GM0yJU.mjs";
+import { sql } from "kysely";
 
 //#region src/astro/routes/api/auth/setup-token/verify.ts
 const prerender = false;
@@ -92,30 +96,32 @@ const POST = async ({ request, locals, session }) => {
 	const token = typeof tokenValue === "string" ? tokenValue : null;
 	if (!token?.startsWith("ec_slt_")) return genericFailurePage();
 	const hash = hashPrefixedToken(token);
-	const result = await dineway.db.transaction().execute(async (trx) => {
-		const row = await trx.selectFrom("auth_tokens").innerJoin("users", "users.id", "auth_tokens.user_id").select([
-			"users.id as id",
-			"users.email as email",
-			"users.name as name",
-			"users.disabled as disabled",
-			"auth_tokens.expires_at as expires_at"
-		]).where("auth_tokens.hash", "=", hash).where("auth_tokens.type", "=", SETUP_TOKEN_TYPE).executeTakeFirst();
-		if (!row || row.disabled || new Date(row.expires_at) <= /* @__PURE__ */ new Date()) return null;
-		if (((await trx.deleteFrom("auth_tokens").where("hash", "=", hash).where("type", "=", SETUP_TOKEN_TYPE).executeTakeFirst()).numDeletedRows ?? 0n) === 0n) return null;
-		const credentialCount = await trx.selectFrom("credentials").select((eb) => eb.fn.countAll().as("count")).where("user_id", "=", row.id).executeTakeFirstOrThrow();
-		return {
-			user: {
-				id: row.id,
-				email: row.email,
-				name: row.name,
-				disabled: row.disabled
-			},
-			hasPasskeys: Number(credentialCount.count) > 0
-		};
-	});
-	if (!result) return genericFailurePage();
-	session.set("user", { id: result.user.id });
-	return redirectPage(result.hasPasskeys ? ADMIN_DASHBOARD_PATH : PASSKEY_REGISTRATION_PATH);
+	const db = dineway.db;
+	const tokenRow = await db.selectFrom("auth_tokens").selectAll().where("hash", "=", hash).where("type", "=", SETUP_TOKEN_TYPE).executeTakeFirst();
+	if (!tokenRow?.user_id || new Date(tokenRow.expires_at) <= /* @__PURE__ */ new Date()) return genericFailurePage();
+	const user = await db.selectFrom("users").select([
+		"id",
+		"email",
+		"name",
+		"disabled"
+	]).where("id", "=", tokenRow.user_id).executeTakeFirst();
+	if (!user || user.disabled) return genericFailurePage();
+	try {
+		await atomicBatch(db, {
+			checks: [
+				rowUnchanged("auth_tokens", tokenRow),
+				rowUnchanged("users", user),
+				sql`EXISTS (SELECT 1 FROM auth_tokens WHERE hash = ${hash} AND expires_at > ${currentIsoTimestampValue(db)})`
+			],
+			statements: [db.deleteFrom("auth_tokens").where("hash", "=", hash).where("type", "=", SETUP_TOKEN_TYPE).compile()]
+		});
+	} catch (error) {
+		if (error instanceof AtomicWriteConflict) return genericFailurePage();
+		throw error;
+	}
+	const credentialCount = await db.selectFrom("credentials").select((eb) => eb.fn.countAll().as("count")).where("user_id", "=", user.id).executeTakeFirstOrThrow();
+	session.set("user", { id: user.id });
+	return redirectPage(Number(credentialCount.count) > 0 ? ADMIN_DASHBOARD_PATH : PASSKEY_REGISTRATION_PATH);
 };
 
 //#endregion

package/dist/astro/routes/api/auth/signup/complete.mjs

@@ -1,16 +1,16 @@
-import { t as OptionsRepository } from "../../../../../options-1dBRkoCl.mjs";
-import "../../../../../context-types-CPWAJRs5.mjs";
-import "../../../../../public-discovery-CyDzK1-S.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DLg1H2LT.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-IsGn-5lt.mjs";
-import "../../../../../redirects-N8gmWhVM.mjs";
-import { C as signupCompleteBody } from "../../../../../byline-fields-QpmruT5r.mjs";
-import "../../../../../status-Bba6RbkS.mjs";
+import { t as OptionsRepository } from "../../../../../options-BcqHWpc-.mjs";
+import "../../../../../context-types-DLD_HnKT.mjs";
+import "../../../../../public-discovery-CTql6jdZ.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B-44r5TD.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-BscLr3p2.mjs";
+import "../../../../../redirects-DpRiuRWn.mjs";
+import { C as signupCompleteBody } from "../../../../../byline-fields-DGNKitg3.mjs";
+import "../../../../../status-DBSB6tdS.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { n as getPublicOrigin } from "../../../../../public-url-BVIjzMo3.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-DGSyhRCz.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-CDKfye2r.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-CRN44T04.mjs";
+import { n as getPublicOrigin } from "../../../../../public-url-4sMO36Gw.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-Cp7BI3L9.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-DFGsDtCj.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-sUQoLEj_.mjs";
 import { SignupError, completeSignup } from "@dineway-ai/auth";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 import { registerPasskey, verifyRegistrationResponse } from "@dineway-ai/auth/passkey";

package/dist/astro/routes/api/auth/signup/request.mjs

@@ -1,15 +1,16 @@
-import { t as OptionsRepository } from "../../../../../options-1dBRkoCl.mjs";
-import "../../../../../context-types-CPWAJRs5.mjs";
-import "../../../../../public-discovery-CyDzK1-S.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../error-DLg1H2LT.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-IsGn-5lt.mjs";
-import "../../../../../redirects-N8gmWhVM.mjs";
-import { w as signupRequestBody } from "../../../../../byline-fields-QpmruT5r.mjs";
-import "../../../../../status-Bba6RbkS.mjs";
+import { t as OptionsRepository } from "../../../../../options-BcqHWpc-.mjs";
+import "../../../../../context-types-DLD_HnKT.mjs";
+import "../../../../../runtime-env-v-1UXPAH.mjs";
+import "../../../../../public-discovery-CTql6jdZ.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../error-B-44r5TD.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-BscLr3p2.mjs";
+import "../../../../../redirects-DpRiuRWn.mjs";
+import { w as signupRequestBody } from "../../../../../byline-fields-DGNKitg3.mjs";
+import "../../../../../status-DBSB6tdS.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-CdEl6g6B.mjs";
-import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-DEkoxTsP.mjs";
-import { t as getSiteBaseUrl } from "../../../../../site-url-DoZf_jVj.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-CvDP0g0F.mjs";
+import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-RaBJEgyt.mjs";
+import { t as getSiteBaseUrl } from "../../../../../site-url-DoTPKRND.mjs";
 import { requestSignup } from "@dineway-ai/auth";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/signup/verify.mjs

@@ -1,4 +1,4 @@
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DLg1H2LT.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-B-44r5TD.mjs";
 import { SignupError, roleFromLevel, validateSignupToken } from "@dineway-ai/auth";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
 

package/dist/astro/routes/api/comments/_collection_/_contentId_/index.d.mts

@@ -1,5 +1,66 @@
-import { APIRoute } from "astro";
+import { Hs as Comment, a as CommentAfterModerateEvent, j as ModerationDecision, l as CommentModerateEvent, n as CollectionCommentSettings, r as CommentAfterCreateEvent, s as CommentBeforeCreateEvent } from "../../../../../../types-Tt_IGMno.mjs";
+import { t as Database } from "../../../../../../types-CVRNRAA5.mjs";
+import "../../../../../../runner-Cxl-vyk2.mjs";
+import { AtomicBatch } from "../../../../../../database/batch.mjs";
+import "../../../../../../index-mlJSqFkG.mjs";
+import "../../../../../../types-SddyDti7.mjs";
+import "../../../../../../public-url-zoO-QbN6.mjs";
+import "../../../../../../validate-CCOsvPg2.mjs";
+import "../../../../../../byline-fields-BO96fXLv.mjs";
+import "../../../../../../types-CAD4OvmF.mjs";
+import { Kysely } from "kysely";
+import { APIContext, APIRoute } from "astro";
 
+//#region src/comments/service.d.ts
+interface CommentCreateInput {
+  collection: string;
+  contentId: string;
+  parentId?: string | null;
+  authorName: string;
+  authorEmail: string;
+  authorUserId?: string | null;
+  body: string;
+  ipHash?: string | null;
+  userAgent?: string | null;
+}
+interface CommentCreateResult {
+  comment: Comment;
+  decision: ModerationDecision;
+}
+/**
+ * Hook runner interface — injected from the runtime so the service
+ * doesn't need to know about the hook pipeline internals.
+ */
+interface CommentHookRunner {
+  /** Run comment:beforeCreate pipeline. Returns modified event or false. */
+  runBeforeCreate(event: CommentBeforeCreateEvent): Promise<CommentBeforeCreateEvent | false>;
+  /** Run comment:moderate exclusive hook. Returns moderation decision. */
+  runModerate(event: CommentModerateEvent): Promise<ModerationDecision>;
+  /** Run comment:afterCreate after the comment's batch has committed. */
+  fireAfterCreate(event: CommentAfterCreateEvent): void | Promise<void>;
+  /** Fire comment:afterModerate (fire-and-forget). */
+  fireAfterModerate(event: CommentAfterModerateEvent): void;
+}
+/**
+ * Create a comment through the full hook pipeline.
+ *
+ * Returns null if the comment was rejected by a beforeCreate handler.
+ */
+declare function prepareComment(db: Kysely<Database>, input: CommentCreateInput, collectionSettings: CollectionCommentSettings, hooks: CommentHookRunner, contentInfo?: {
+  id: string;
+  collection: string;
+  slug: string;
+  title?: string;
+  author?: {
+    id: string;
+    name: string | null;
+    email: string;
+  };
+}): Promise<(CommentCreateResult & {
+  batch: AtomicBatch;
+  afterCommit: () => Promise<void>;
+}) | null>;
+//#endregion
 //#region src/astro/routes/api/comments/[collection]/[contentId]/index.d.ts
 declare const prerender = false;
 /**
@@ -9,6 +70,16 @@ declare const GET: APIRoute;
 /**
  * Submit a comment (public, gated by anti-spam checks)
  */
+interface PreparedCommentRequest {
+  comment: NonNullable<Awaited<ReturnType<typeof prepareComment>>>["comment"];
+  batch: AtomicBatch;
+  afterCommit: () => Promise<Response>;
+}
+declare function prepareCommentRequest({
+  params,
+  request,
+  locals
+}: APIContext): Promise<Response | PreparedCommentRequest>;
 declare const POST: APIRoute;
 //#endregion
-export { GET, POST, prerender };
+export { GET, POST, PreparedCommentRequest, prepareCommentRequest, prerender };