dineway 0.2.33 → 0.2.35

package/dist/api-tokens-DA18zxza.mjs

@@ -0,0 +1,3 @@
+import { ALL_VALID_SCOPES, TOKEN_PREFIXES, generatePrefixedToken, hasScope as hasScope$1, hashPrefixedToken, hashPrefixedToken as hashApiToken, validateScopes } from "@dineway-ai/auth";
+
+export { hashApiToken as a, hasScope$1 as i, TOKEN_PREFIXES as n, hashPrefixedToken as o, generatePrefixedToken as r, validateScopes as s, ALL_VALID_SCOPES as t };

package/dist/{api-tokens-CSomx-l3.mjs → api-tokens-OAgvq4xg.mjs}

@@ -1,4 +1,4 @@
-import { a as hashApiToken, r as generatePrefixedToken } from "./api-tokens-CmT83Bgj.mjs";
+import { a as hashApiToken, r as generatePrefixedToken } from "./api-tokens-DA18zxza.mjs";
 import { ulid } from "ulidx";
 
 //#region src/api/handlers/api-tokens.ts

package/dist/{apply-Bs2jXsms.mjs → apply-BTfAReIv.mjs}

@@ -1,18 +1,19 @@
-import { a as __exportAll } from "./runner-DJiRFyLI.mjs";
-import { n as getI18nConfig } from "./config-CVssduLe.mjs";
-import { t as RevisionRepository } from "./revision-De7OmYVD.mjs";
-import { t as ContentRepository } from "./content-CVCrcuvD.mjs";
-import { t as MediaRepository } from "./media-dvRjj4po.mjs";
-import { t as TaxonomyRepository } from "./taxonomy-BOBTJ_aE.mjs";
-import { t as withTransaction } from "./transaction-BGQgnwUi.mjs";
-import { t as RedirectRepository } from "./redirect-DG-o0CKV.mjs";
-import { t as BylineRepository } from "./byline-Ctil4rij.mjs";
-import { a as markContentMediaUsageCollectionStaleSafely } from "./content-refresh-QvBIyb_g.mjs";
-import { t as FTSManager } from "./fts-manager-DX7ZkrCa.mjs";
-import { n as SchemaRegistry } from "./registry-D-IV_h50.mjs";
-import { s as setSiteSettings } from "./settings-CAsQLi0N.mjs";
-import { a as validateExternalUrl, r as ssrfSafeFetch } from "./ssrf-C7tTSD1r.mjs";
-import { t as validateSeed } from "./validate-C9g9iX3q.mjs";
+import { c as __exportAll } from "./runner-CVeq0266.mjs";
+import { atomicBatch, rowUnchanged } from "./database/batch.mjs";
+import { n as getI18nConfig } from "./config-XW5tMrH8.mjs";
+import { o as invalidateCollectionCache } from "./object-cache-BGjIlY9s.mjs";
+import { t as ContentRepository } from "./content-D9xKUSno.mjs";
+import { t as MediaRepository } from "./media-BZqwtRTZ.mjs";
+import { t as TaxonomyRepository } from "./taxonomy-DWxxLpp5.mjs";
+import { t as RedirectRepository } from "./redirect-HLI3wT5Y.mjs";
+import { t as BylineRepository } from "./byline-DEZKlzD9.mjs";
+import { a as markContentMediaUsageCollectionStaleSafely, o as prepareContentMediaUsageCollectionStale } from "./content-refresh-9M9cc55-.mjs";
+import { a as validateExternalUrl, r as ssrfSafeFetch } from "./ssrf-COxLChKv.mjs";
+import { t as FTSManager } from "./fts-manager-DA74x_uP.mjs";
+import { n as SchemaRegistry } from "./registry-DcV93OL_.mjs";
+import { s as setSiteSettings } from "./settings-DRFy8JQx.mjs";
+import { t as validateSeed } from "./validate-CupwWNWL.mjs";
+import { sql } from "kysely";
 import { ulid } from "ulidx";
 import { imageSize } from "image-size";
 import mime from "mime/lite";
@@ -288,7 +289,7 @@ async function applySeed(db, seed, options = {}) {
 				}
 			}
 		}
-		const { invalidateTaxonomyDefsCache } = await import("./taxonomies-93DV-1QT.mjs").then((n) => n.u);
+		const { invalidateTaxonomyDefsCache } = await import("./taxonomies-DW6Fps-w.mjs").then((n) => n.u);
 		invalidateTaxonomyDefsCache();
 	}
 	if (includeContent && seed.bylines) {
@@ -349,35 +350,10 @@ async function applySeed(db, seed, options = {}) {
 				if (existing) {
 					if (onConflict === "error") throw new Error(`Conflict: content "${entry.slug}" in "${collectionSlug}" already exists`);
 					if (onConflict === "update") {
-						const resolvedData = await resolveReferences(entry.data, seedIdMap, mediaContext, result);
-						const status = entry.status || "published";
-						let contentMutated = false;
-						try {
-							await withTransaction(db, async (trx) => {
-								const trxContentRepo = new ContentRepository(trx);
-								const trxBylineRepo = new BylineRepository(trx);
-								const trxRevisionRepo = new RevisionRepository(trx);
-								await trxContentRepo.update(collectionSlug, existing.id, {
-									status,
-									data: resolvedData
-								});
-								contentMutated = true;
-								await applyContentBylines(trxBylineRepo, collectionSlug, existing.id, entry, seedBylineIdMap, true);
-								await applyContentTaxonomies(trx, collectionSlug, existing.id, entry, true);
-								if (status === "published") {
-									const draft = await trxRevisionRepo.create({
-										collection: collectionSlug,
-										entryId: existing.id,
-										data: resolvedData
-									});
-									await trxContentRepo.setDraftRevision(collectionSlug, existing.id, draft.id);
-									await trxContentRepo.publish(collectionSlug, existing.id);
-								}
-							});
-						} catch (error) {
-							if (contentMutated) await markSeedContentCollectionStale(collectionSlug);
-							throw error;
-						}
+						await writeSeedContent(db, collectionSlug, entry, await resolveReferences(entry.data, seedIdMap, mediaContext, result), seedBylineIdMap, {
+							existingId: existing.id,
+							locale: entryLocale
+						});
 						seedIdMap.set(entry.id, existing.id);
 						result.content.updated++;
 						await markSeedContentCollectionStale(collectionSlug);
@@ -394,32 +370,10 @@ async function applySeed(db, seed, options = {}) {
 					if (!sourceId) console.warn(`content.${collectionSlug}: translationOf "${entry.translationOf}" not found (not yet created or missing). Skipping translation link.`);
 					else translationOf = sourceId;
 				}
-				const status = entry.status || "published";
-				let contentMutated = false;
-				let created;
-				try {
-					created = await withTransaction(db, async (trx) => {
-						const trxContentRepo = new ContentRepository(trx);
-						const trxBylineRepo = new BylineRepository(trx);
-						const item = await trxContentRepo.create({
-							type: collectionSlug,
-							slug: entry.slug,
-							status,
-							data: resolvedData,
-							locale: entryLocale,
-							translationOf,
-							publishedAt: status === "published" ? (/* @__PURE__ */ new Date()).toISOString() : null
-						});
-						contentMutated = true;
-						await applyContentBylines(trxBylineRepo, collectionSlug, item.id, entry, seedBylineIdMap);
-						await applyContentTaxonomies(trx, collectionSlug, item.id, entry, false);
-						if (status === "published") await trxContentRepo.publish(collectionSlug, item.id);
-						return item;
-					});
-				} catch (error) {
-					if (contentMutated) await markSeedContentCollectionStale(collectionSlug);
-					throw error;
-				}
+				const created = await writeSeedContent(db, collectionSlug, entry, resolvedData, seedBylineIdMap, {
+					locale: entryLocale,
+					translationOf
+				});
 				seedIdMap.set(entry.id, created.id);
 				result.content.created++;
 				await markSeedContentCollectionStale(collectionSlug);
@@ -564,9 +518,9 @@ async function applySeed(db, seed, options = {}) {
 			}
 		}
 	}
-	const { invalidateBylineCache } = await import("./bylines-v_ZUQnR-.mjs").then((n) => n.t);
-	const { invalidateUrlPatternCache } = await import("./query-CrW2yI6G.mjs").then((n) => n.o);
-	const { invalidateRedirectCache } = await import("./cache-V2BCplaY.mjs").then((n) => n.t);
+	const { invalidateBylineCache } = await import("./bylines-CXyKpVLQ.mjs").then((n) => n.t);
+	const { invalidateUrlPatternCache } = await import("./query-D6oNo9iz.mjs").then((n) => n.o);
+	const { invalidateRedirectCache } = await import("./cache-DZDOBJv3.mjs").then((n) => n.t);
 	invalidateBylineCache();
 	invalidateUrlPatternCache();
 	invalidateRedirectCache();
@@ -622,14 +576,70 @@ async function applyHierarchicalTerms(termRepo, taxonomyName, defLocale, terms,
 	}
 	if (remaining.length > 0) console.warn(`Could not process ${remaining.length} terms due to missing parents/translations`);
 }
+async function writeSeedContent(db, collection, entry, data, bylineIds, target) {
+	const repository = new ContentRepository(db);
+	const status = entry.status ?? "published";
+	const checks = [];
+	const statements = [];
+	let id;
+	if (target.existingId) {
+		id = target.existingId;
+		const snapshot = await repository.snapshot(collection, id);
+		if (!snapshot) throw new Error("Seed content is no longer available");
+		checks.push(snapshot.check);
+		statements.push(repository.prepareUpdate(collection, id, {
+			status,
+			data
+		}));
+	} else {
+		const created = await repository.prepareCreate({
+			type: collection,
+			slug: entry.slug,
+			status,
+			data,
+			locale: target.locale,
+			translationOf: target.translationOf,
+			publishedAt: status === "published" ? (/* @__PURE__ */ new Date()).toISOString() : null
+		});
+		id = created.id;
+		checks.push(...created.batch.checks ?? []);
+		statements.push(...created.batch.statements);
+	}
+	const bylines = await prepareContentBylines(new BylineRepository(db), collection, id, entry, bylineIds, !!target.existingId);
+	const terms = await prepareContentTaxonomies(db, collection, id, entry, !!target.existingId);
+	const draft = await repository.prepareDraftSnapshot(collection, id);
+	for (const batch of [
+		bylines,
+		terms,
+		draft
+	]) {
+		checks.push(...batch.checks ?? []);
+		statements.push(...batch.statements);
+	}
+	if (status === "published") statements.push(sql`UPDATE ${sql.table(`ec_${collection}`)}
+ SET live_revision_id = draft_revision_id, draft_revision_id = NULL, status = 'published', scheduled_at = NULL,
+ published_at = COALESCE(published_at, ${(/* @__PURE__ */ new Date()).toISOString()}), updated_at = ${(/* @__PURE__ */ new Date()).toISOString()}
+ WHERE id = ${id}`.compile(db));
+	statements.push(prepareContentMediaUsageCollectionStale(db, collection, "CONTENT_USAGE_STALE"));
+	await atomicBatch(db, {
+		checks,
+		statements
+	});
+	invalidateCollectionCache(collection);
+	const { invalidateTermCache } = await import("./taxonomies-DW6Fps-w.mjs").then((n) => n.u);
+	invalidateTermCache();
+	const item = await repository.findById(collection, id);
+	if (!item) throw new Error("Failed to reload seeded content");
+	return item;
+}
 /**
 * Apply byline credits to a content entry.
 * In update mode, clears existing credits even if the seed has none.
 */
-async function applyContentBylines(bylineRepo, collectionSlug, contentId, entry, seedBylineIdMap, isUpdate = false) {
+async function prepareContentBylines(bylineRepo, collectionSlug, contentId, entry, seedBylineIdMap, isUpdate = false) {
 	if (!entry.bylines || entry.bylines.length === 0) {
-		if (isUpdate) await bylineRepo.setContentBylines(collectionSlug, contentId, []);
-		return;
+		if (isUpdate) return bylineRepo.prepareContentBylines(collectionSlug, contentId, []);
+		return { statements: [] };
 	}
 	const credits = entry.bylines.map((credit) => {
 		const bylineId = seedBylineIdMap.get(credit.byline);
@@ -640,30 +650,36 @@ async function applyContentBylines(bylineRepo, collectionSlug, contentId, entry,
 		};
 	}).filter((credit) => Boolean(credit));
 	if (credits.length !== entry.bylines.length) console.warn(`content.${collectionSlug}.${entry.slug}: one or more byline refs could not be resolved`);
-	if (credits.length > 0 || isUpdate) await bylineRepo.setContentBylines(collectionSlug, contentId, credits);
+	if (credits.length > 0 || isUpdate) return bylineRepo.prepareContentBylines(collectionSlug, contentId, credits);
+	return { statements: [] };
 }
 /**
 * Apply taxonomy term assignments to a content entry.
 * In update mode, clears existing assignments before re-attaching.
 */
-async function applyContentTaxonomies(db, collectionSlug, contentId, entry, isUpdate) {
-	if (isUpdate) await db.deleteFrom("content_taxonomies").where("collection", "=", collectionSlug).where("entry_id", "=", contentId).execute();
-	if (!entry.taxonomies) {
-		if (isUpdate) {
-			const { invalidateTermCache } = await import("./taxonomies-93DV-1QT.mjs").then((n) => n.u);
-			invalidateTermCache();
-		}
-		return;
-	}
-	for (const [taxonomyName, termSlugs] of Object.entries(entry.taxonomies)) {
-		const termRepo = new TaxonomyRepository(db);
+async function prepareContentTaxonomies(db, collectionSlug, contentId, entry, isUpdate) {
+	const checks = [];
+	const statements = [];
+	if (isUpdate) statements.push(db.deleteFrom("content_taxonomies").where("collection", "=", collectionSlug).where("entry_id", "=", contentId).compile());
+	for (const [taxonomyName, termSlugs] of Object.entries(entry.taxonomies ?? {})) {
+		const repository = new TaxonomyRepository(db);
 		for (const termSlug of termSlugs) {
-			const term = await termRepo.findBySlug(taxonomyName, termSlug);
-			if (term) await termRepo.attachToEntry(collectionSlug, contentId, term.id);
+			const term = await repository.findBySlug(taxonomyName, termSlug);
+			if (!term) continue;
+			const row = await db.selectFrom("taxonomies").selectAll().where("id", "=", term.id).executeTakeFirst();
+			if (!row) throw new Error("Seed taxonomy changed during import");
+			checks.push(rowUnchanged("taxonomies", row));
+			statements.push(db.insertInto("content_taxonomies").values({
+				collection: collectionSlug,
+				entry_id: contentId,
+				taxonomy_id: row.translation_group ?? row.id
+			}).onConflict((conflict) => conflict.doNothing()).compile());
 		}
 	}
-	const { invalidateTermCache } = await import("./taxonomies-93DV-1QT.mjs").then((n) => n.u);
-	invalidateTermCache();
+	return {
+		checks,
+		statements
+	};
 }
 /**
 * Apply menu items recursively

package/dist/astro/index.d.mts

@@ -1,14 +1,14 @@
-import { i as ContentItem } from "../types-6KmeXInJ.mjs";
-import { Ao as getStoredConfig, Mo as S3StorageConfig, No as StorageDescriptor, Oo as DinewayConfig, Ps as MediaItem, jo as LocalStorageConfig, kt as ResolvedPlugin } from "../types-CfpX1og5.mjs";
-import "../types-BRCUO8NR.mjs";
-import "../runner-Dye73myO.mjs";
-import "../index-Co7xtjkd.mjs";
-import "../types-CPaVj_GC.mjs";
-import { i as ObjectCacheRuntimeConfig, r as ObjectCacheDescriptor } from "../types-CU3Wn2HC.mjs";
-import "../public-url-BQ9vf0AS.mjs";
-import "../validate-CDWVODvc.mjs";
-import "../byline-fields-51ja6JDa.mjs";
-import "../types--3oJQ0hs.mjs";
+import { i as ContentItem } from "../types-BFoQ5a1v.mjs";
+import { Ao as DinewayConfig, At as ResolvedPlugin, Fo as StorageDescriptor, Ks as MediaItem, Mo as getStoredConfig, No as LocalStorageConfig, Po as S3StorageConfig } from "../types-Tt_IGMno.mjs";
+import "../types-CVRNRAA5.mjs";
+import "../runner-Cxl-vyk2.mjs";
+import "../index-mlJSqFkG.mjs";
+import "../types-SddyDti7.mjs";
+import { i as ObjectCacheRuntimeConfig, r as ObjectCacheDescriptor } from "../types-DNPP-eu4.mjs";
+import "../public-url-zoO-QbN6.mjs";
+import "../validate-CCOsvPg2.mjs";
+import "../byline-fields-BO96fXLv.mjs";
+import "../types-CAD4OvmF.mjs";
 import { DinewayHandlers, DinewayManifest, ManifestCollection } from "./types.mjs";
 import { AstroIntegration } from "astro";
 
@@ -82,6 +82,10 @@ declare function memoryCache(options?: MemoryCacheOptions): ObjectCacheDescripto
 /**
  * Create the Dineway Astro integration
  */
-declare function dineway(config?: DinewayConfig): AstroIntegration;
+declare function dineway(config?: DinewayConfig): AstroIntegration & {
+  api: {
+    dinewayConfig: DinewayConfig;
+  };
+};
 //#endregion
 export { type ContentItem, type DinewayConfig, type DinewayHandlers, type DinewayManifest, type LocalStorageConfig, type ManifestCollection, type MediaItem, type MemoryCacheOptions, type ResolvedPlugin, type S3StorageConfig, type StorageDescriptor, dineway as default, getStoredConfig, local, memoryCache, s3 };

package/dist/astro/index.mjs

@@ -1,12 +1,13 @@
-import { t as INTERNAL_MEDIA_PREFIX } from "../normalize-Ev3FiBMx.mjs";
-import { n as VERSION, t as COMMIT } from "../version-CJqc1mwj.mjs";
-import { t as defaultSeed } from "../default-BeIzUa1e.mjs";
-import { n as validateAllowedOrigins, r as validateOriginShape } from "../allowed-origins-DGSyhRCz.mjs";
+import { t as INTERNAL_MEDIA_PREFIX } from "../normalize-5rct_U0I.mjs";
+import { n as VERSION, t as COMMIT } from "../version-DpT-k_Ny.mjs";
+import { t as defaultSeed } from "../default-w3MwLng7.mjs";
+import { n as validateAllowedOrigins, r as validateOriginShape } from "../allowed-origins-Cp7BI3L9.mjs";
+import { r as writeWorkersBuildMetadata } from "../workers-build-QVrquLLe.mjs";
 import { createRequire } from "node:module";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
-import { fontProviders } from "astro/config";
 import { fileURLToPath } from "node:url";
+import { fontProviders } from "astro/config";
 
 //#region src/astro/storage/adapters.ts
 /**
@@ -1376,8 +1377,8 @@ function isWorkersAdapter(name) {
 	return name === "@astrojs/cloudflare";
 }
 function validateWorkersConfig(config) {
-	if (config.database?.entrypoint !== "dineway/db/libsql-http") throw new Error("Cloudflare Workers and ChatGPT Sites require database: libsqlHttp() from dineway/db. Configure DINEWAY_DATABASE_URL and DINEWAY_DATABASE_AUTH_TOKEN as runtime secrets.");
-	if (!config.storage || config.storage.entrypoint === "dineway/storage/local") throw new Error("Cloudflare Workers and ChatGPT Sites require durable object storage. Use storage: s3() from dineway/astro, with S3_* runtime secrets (including R2's S3 API).");
+	if (config.database?.entrypoint !== "dineway/db/d1") throw new Error("Cloudflare Workers require database: d1() from dineway/db. Apply D1 migrations explicitly before deployment.");
+	if (!config.storage || config.storage.entrypoint === "dineway/storage/local") throw new Error("Cloudflare Workers require durable object storage. Use storage: s3() from dineway/astro, with S3_* runtime secrets (including R2's S3 API).");
 	if ((config.sandboxed?.length || config.marketplace) && !config.sandboxRunner) throw new Error("Cloudflare Workers require a Workers-compatible sandboxRunner for sandboxed plugins or the marketplace. The default Node worker-thread sandbox is unavailable.");
 	if (config.playground) throw new Error("The Node playground is unavailable on Cloudflare Workers.");
 }
@@ -1519,6 +1520,28 @@ const NODE_NATIVE_EXTERNALS = [
 	"@libsql/kysely-libsql",
 	"pg"
 ];
+/** Apply SDK browser mappings after the Cloudflare plugin defines its neutral Worker environment. */
+function workersEnvironmentConfig(name) {
+	if (name !== "ssr") return;
+	const fields = {
+		mainFields: [
+			"browser",
+			"module",
+			"main"
+		],
+		aliasFields: [["browser"]]
+	};
+	return {
+		build: { rolldownOptions: { resolve: fields } },
+		optimizeDeps: {
+			esbuildOptions: {
+				platform: "browser",
+				mainFields: fields.mainFields
+			},
+			rolldownOptions: { resolve: fields }
+		}
+	};
+}
 /**
 * Creates the Vite config update for Dineway.
 */
@@ -1575,7 +1598,15 @@ function createViteConfig(options, command) {
 				}
 			]
 		},
-		plugins: [createVirtualModulesPlugin(options), ...useSource ? devPlugins : []],
+		plugins: [
+			createVirtualModulesPlugin(options),
+			...workers ? [{
+				name: "dineway-workers-package-resolution",
+				enforce: "post",
+				configEnvironment: workersEnvironmentConfig
+			}] : [],
+			...useSource ? devPlugins : []
+		],
 		ssr: {
 			...workers ? { resolve: { mainFields: [
 				"browser",
@@ -1755,8 +1786,10 @@ function dineway(config = {}) {
 	};
 	const useExternalAuth = !!(resolvedConfig.auth && "entrypoint" in resolvedConfig.auth);
 	let astroCommand;
+	let workersServerDirectory;
 	return {
 		name: "dineway",
+		api: { dinewayConfig: resolvedConfig },
 		hooks: {
 			"astro:config:setup": ({ injectRoute, addMiddleware, logger, updateConfig, config: astroConfig, command }) => {
 				if (isWorkersAdapter(astroConfig.adapter?.name)) validateWorkersConfig(resolvedConfig);
@@ -1832,6 +1865,10 @@ function dineway(config = {}) {
 					entrypoint: resolvedConfig.playground.middlewareEntrypoint,
 					order: "pre"
 				});
+				if (isWorkersAdapter(astroConfig.adapter?.name)) addMiddleware({
+					entrypoint: "dineway/middleware/workers",
+					order: "pre"
+				});
 				addMiddleware({
 					entrypoint: "dineway/middleware",
 					order: "pre"
@@ -1897,7 +1934,11 @@ function dineway(config = {}) {
 					}
 				});
 			},
-			"astro:build:done": ({ logger }) => {
+			"astro:config:done": ({ config: astroConfig }) => {
+				if (isWorkersAdapter(astroConfig.adapter?.name)) workersServerDirectory = fileURLToPath(astroConfig.build.server);
+			},
+			"astro:build:done": async ({ logger }) => {
+				if (workersServerDirectory) await writeWorkersBuildMetadata(workersServerDirectory, resolvedConfig);
 				logger.info("Build complete");
 			}
 		}

package/dist/astro/middleware/auth.d.mts

@@ -1,12 +1,12 @@
-import { po as SiteAuthTokenContext } from "../../types-CfpX1og5.mjs";
-import "../../types-BRCUO8NR.mjs";
-import "../../runner-Dye73myO.mjs";
-import "../../index-Co7xtjkd.mjs";
-import "../../types-CPaVj_GC.mjs";
-import "../../public-url-BQ9vf0AS.mjs";
-import "../../validate-CDWVODvc.mjs";
-import "../../byline-fields-51ja6JDa.mjs";
-import "../../types--3oJQ0hs.mjs";
+import { ho as SiteAuthTokenContext } from "../../types-Tt_IGMno.mjs";
+import "../../types-CVRNRAA5.mjs";
+import "../../runner-Cxl-vyk2.mjs";
+import "../../index-mlJSqFkG.mjs";
+import "../../types-SddyDti7.mjs";
+import "../../public-url-zoO-QbN6.mjs";
+import "../../validate-CCOsvPg2.mjs";
+import "../../byline-fields-BO96fXLv.mjs";
+import "../../types-CAD4OvmF.mjs";
 import { DinewayHandlers } from "../types.mjs";
 import { User } from "@dineway-ai/auth";
 import * as astro from "astro";

package/dist/astro/middleware/auth.mjs

@@ -1,9 +1,15 @@
-import { t as apiError } from "../../error-DLg1H2LT.mjs";
-import { i as hasScope } from "../../api-tokens-CmT83Bgj.mjs";
-import { n as getPublicOrigin } from "../../public-url-BVIjzMo3.mjs";
-import { t as getAuthMode } from "../../mode-DJeacFCZ.mjs";
-import { t as resolveSessionUser } from "../../session-user-D8WwGEPH.mjs";
-import { a as resolveApiToken, o as resolveOAuthToken } from "../../api-tokens-CSomx-l3.mjs";
+import "../../d1-binding-D6HZa3ks.mjs";
+import { getRequestContext, runWithContext } from "../../request-context.mjs";
+import "../../dialect-helpers-C6xtO-Ui.mjs";
+import { n as bindOAuthTokenHash } from "../../actor-DxUAJgQX.mjs";
+import { n as prepareAuthenticatedWriteChecks } from "../../atomic-authority-CnBQJ14T.mjs";
+import "../../after-BVaUn7bK.mjs";
+import { t as apiError } from "../../error-B-44r5TD.mjs";
+import { a as hashApiToken, i as hasScope } from "../../api-tokens-DA18zxza.mjs";
+import { n as getPublicOrigin } from "../../public-url-4sMO36Gw.mjs";
+import { t as getAuthMode } from "../../mode-BJwb_MgK.mjs";
+import { t as resolveSessionUser } from "../../session-user-DacoiKrJ.mjs";
+import { a as resolveApiToken, o as resolveOAuthToken } from "../../api-tokens-OAgvq4xg.mjs";
 import { ulid } from "ulidx";
 import { defineMiddleware } from "astro:middleware";
 import { createKyselyAdapter } from "@dineway-ai/auth/adapters/kysely";
@@ -180,7 +186,7 @@ function isPublicDinewayRoute(pathname, authProviders = []) {
 function isCsrfExemptPublicRoute(pathname) {
 	return CSRF_EXEMPT_PUBLIC_ROUTES.has(pathname);
 }
-const onRequest = defineMiddleware(async (context, next) => {
+const authenticateRequest = defineMiddleware(async (context, next) => {
 	const { url } = context;
 	const isAdminRoute = url.pathname.startsWith("/_dineway/admin");
 	const isSetupRoute = url.pathname.startsWith("/_dineway/admin/setup");
@@ -442,7 +448,7 @@ async function handleBearerAuth(context) {
 		};
 	} else if (token.startsWith("ec_oat_")) {
 		resolved = await resolveOAuthToken(dineway.db, token);
-		if (resolved) authToken = { type: "oauth_token" };
+		if (resolved) authToken = bindOAuthTokenHash({ type: "oauth_token" }, hashApiToken(token));
 	} else return "invalid";
 	if (!resolved) return "invalid";
 	const user = await createKyselyAdapter(dineway.db).getUserById(resolved.userId);
@@ -700,6 +706,21 @@ function enforceTokenScope(pathname, method, tokenScopes) {
 		}
 	});
 }
+const onRequest = defineMiddleware((context, next) => authenticateRequest(context, () => {
+	const { user, authToken, tokenScopes, dineway } = context.locals;
+	if (!user || !dineway || !authToken && getAuthMode(dineway.config).type !== "passkey") return next();
+	const principal = {
+		id: user.id,
+		role: user.role
+	};
+	const scopes = tokenScopes ? [...tokenScopes] : void 0;
+	return runWithContext({
+		editMode: false,
+		...getRequestContext(),
+		writePrincipal: principal,
+		prepareWriteChecks: (db) => prepareAuthenticatedWriteChecks(db, principal, authToken, scopes)
+	}, next);
+}));
 
 //#endregion
 export { onRequest };

package/dist/astro/middleware/redirect.mjs

@@ -1,11 +1,12 @@
-import "../../dialect-helpers-fk43GbDb.mjs";
+import "../../d1-binding-D6HZa3ks.mjs";
 import { getRequestContext } from "../../request-context.mjs";
-import "../../base64-F8-DUraK.mjs";
-import "../../types-BpSTdH1H.mjs";
-import { r as getDb } from "../../loader-BDje8ME2.mjs";
-import { n as alternateTrailingSlashPath, t as RedirectRepository } from "../../redirect-DG-o0CKV.mjs";
-import { a as matchCachedPatterns, n as compileRedirectRules, o as setCachedRedirects, r as getCachedRedirects } from "../../cache-V2BCplaY.mjs";
-import { n as isTerminalStatus } from "../../status-Bba6RbkS.mjs";
+import "../../dialect-helpers-C6xtO-Ui.mjs";
+import "../../base64-Cz-aU0X1.mjs";
+import "../../types-BqxIv8Il.mjs";
+import { r as getDb } from "../../loader-Cgsx23wU.mjs";
+import { n as alternateTrailingSlashPath, t as RedirectRepository } from "../../redirect-HLI3wT5Y.mjs";
+import { a as matchCachedPatterns, n as compileRedirectRules, o as setCachedRedirects, r as getCachedRedirects } from "../../cache-DZDOBJv3.mjs";
+import { n as isTerminalStatus } from "../../status-DBSB6tdS.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/astro/middleware/redirect.ts

package/dist/astro/middleware/request-context.mjs

@@ -1,8 +1,10 @@
-import { runWithContext } from "../../request-context.mjs";
-import "../../base64-F8-DUraK.mjs";
-import "../../options-1dBRkoCl.mjs";
-import { a as resolveSecretsCached } from "../../secrets-AdCrGg1c.mjs";
-import { n as parseContentId, r as verifyPreviewToken } from "../../tokens-c-qxNqzC.mjs";
+import { getRequestContext, runWithContext } from "../../request-context.mjs";
+import "../../base64-Cz-aU0X1.mjs";
+import "../../after-BVaUn7bK.mjs";
+import "../../options-BcqHWpc-.mjs";
+import "../../runtime-env-v-1UXPAH.mjs";
+import { a as resolveSecretsCached } from "../../secrets-BP2YTPWn.mjs";
+import { n as parseContentId, r as verifyPreviewToken } from "../../tokens-I3tSjoFI.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/visual-editing/toolbar.ts
@@ -1335,11 +1337,15 @@ const onRequest = defineMiddleware(async (context, next) => {
 	const { user } = context.locals;
 	const isEditor = !!user && user.role >= 30;
 	const requestDb = context.locals.__dinewayRequestDb;
-	if (requestDb) return runWithContext({
-		editMode: cookies.get("dineway-edit-mode")?.value === "true",
-		db: requestDb,
-		dbIsIsolated: true
-	}, () => next());
+	if (requestDb) {
+		const hasEditCookie = cookies.get("dineway-edit-mode")?.value === "true";
+		return runWithContext({
+			...getRequestContext(),
+			editMode: hasEditCookie,
+			db: requestDb,
+			dbIsIsolated: true
+		}, () => next());
+	}
 	const hasEditCookie = cookies.get("dineway-edit-mode")?.value === "true";
 	const hasPreviewToken = url.searchParams.has("_preview");
 	if (!hasEditCookie && !hasPreviewToken && !isEditor) return next();
@@ -1364,6 +1370,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 		} else console.warn("[dineway] Preview token present but Dineway runtime not initialized; preview disabled.");
 	}
 	if (hasEditCookie || hasPreviewToken) return runWithContext({
+		...getRequestContext(),
 		editMode,
 		preview,
 		locale

package/dist/astro/middleware/seed.d.mts

@@ -1,4 +1,4 @@
-import { t as Database } from "../../types-BRCUO8NR.mjs";
+import { t as Database } from "../../types-CVRNRAA5.mjs";
 import { Kysely } from "kysely";
 import * as astro from "astro";