dineway 0.2.33 → 0.2.35

package/dist/{site-context-CA7rbxux.mjs → site-context-D9oETfxF.mjs}

@@ -1,19 +1,20 @@
-import { t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
-import { i as encodeCursor, r as decodeCursor } from "./types-BpSTdH1H.mjs";
-import { t as ContentRepository } from "./content-CVCrcuvD.mjs";
-import { t as SiteActivityRepository } from "./site-activity-7oezuHXK.mjs";
-import { n as ReviewRequestRepository } from "./review-requests-DICrYH2-.mjs";
-import { o as HitlRequestRepository } from "./publication-authorization-C-vYPGD8.mjs";
-import { r as isPattern } from "./patterns-3XE9bU4r.mjs";
-import { i as parseSiteBriefingScope, o as ContextRepository, u as handlePluginList } from "./briefing-BgQTljQt.mjs";
-import { t as FTSManager } from "./fts-manager-DX7ZkrCa.mjs";
-import { n as SchemaRegistry } from "./registry-D-IV_h50.mjs";
-import { a as getSiteSettingsWithDb } from "./settings-CAsQLi0N.mjs";
-import { n as buildStableActionHash, t as ReviewPayloadBuilder } from "./review-payload-f1L4lzQg.mjs";
-import { n as assertExperimentalSiteContextWorkflowsEnabled } from "./experimental-workflows-B9x8delL.mjs";
-import { m as normalizeUrl } from "./utils-BK2efsHv.mjs";
-import { t as sanitizeWordPressImportSlug } from "./wordpress-slugs-WdPZaVXf.mjs";
-import { s as searchCollection } from "./search-DxUKN9Zz.mjs";
+import { atomicBatch, rowUnchanged } from "./database/batch.mjs";
+import { t as validateIdentifier } from "./validate-Co3j6T_K.mjs";
+import { i as encodeCursor, r as decodeCursor } from "./types-BqxIv8Il.mjs";
+import { t as ContentRepository } from "./content-D9xKUSno.mjs";
+import { t as SiteActivityRepository } from "./site-activity-BrN2NviL.mjs";
+import { r as ReviewRequestRepository } from "./review-requests-BF2eEKr8.mjs";
+import { o as HitlRequestRepository } from "./publication-authorization-Dq_20SZR.mjs";
+import { r as isPattern } from "./patterns-CZ7D4y_R.mjs";
+import { n as buildStableActionHash, t as ReviewPayloadBuilder } from "./review-payload-LLIi1sxO.mjs";
+import { d as ContextRepository, i as parseSiteBriefingScope, l as handlePluginList } from "./briefing-5zf0YZbR.mjs";
+import { t as FTSManager } from "./fts-manager-DA74x_uP.mjs";
+import { n as SchemaRegistry } from "./registry-DcV93OL_.mjs";
+import { a as getSiteSettingsWithDb } from "./settings-DRFy8JQx.mjs";
+import { n as assertExperimentalSiteContextWorkflowsEnabled } from "./experimental-workflows-fzJHB3ZI.mjs";
+import { m as normalizeUrl } from "./utils-BoWkoty8.mjs";
+import { t as sanitizeWordPressImportSlug } from "./wordpress-slugs-pQlLXbKn.mjs";
+import { s as searchCollection } from "./search-C9qOBgvo.mjs";
 import { sql } from "kysely";
 import { ulid } from "ulidx";
 import { Role } from "@dineway-ai/auth";
@@ -331,13 +332,24 @@ var HandoffSnapshotRepository = class {
 	constructor(db) {
 		this.db = db;
 	}
-	async create(input) {
+	prepareCreate(input) {
 		const id = ulid();
-		await this.db.insertInto("_dineway_handoff_snapshots").values(toInsertableHandoffSnapshot(id, input)).execute();
-		return this.findById(id).then((snapshot) => {
-			if (!snapshot) throw new Error("Failed to create handoff snapshot");
-			return snapshot;
-		});
+		const createdAt = input.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
+		return {
+			id,
+			createdAt,
+			statement: this.db.insertInto("_dineway_handoff_snapshots").values(toInsertableHandoffSnapshot(id, {
+				...input,
+				createdAt
+			})).compile()
+		};
+	}
+	async create(input) {
+		const prepared = this.prepareCreate(input);
+		await atomicBatch(this.db, { statements: [prepared.statement] });
+		const snapshot = await this.findById(prepared.id);
+		if (!snapshot) throw new Error("Failed to create handoff snapshot");
+		return snapshot;
 	}
 	async findById(id) {
 		const row = await this.db.selectFrom("_dineway_handoff_snapshots").selectAll().where("id", "=", id).executeTakeFirst();
@@ -3579,18 +3591,23 @@ var HandoffSnapshotStore = class {
 	async capture(input) {
 		parseSiteBriefingScope(input.scope);
 		if (Boolean(input.referenceType) !== Boolean(input.referenceId)) throw new Error("Handoff reference type and id must be provided together.");
-		return this.withTransaction(async (transaction) => {
-			if (input.referenceType === "assignment") {
-				const assignment = await new AssignmentRepository(transaction).findById(input.referenceId);
-				if (!assignment) throw new Error(`Assignment not found: ${input.referenceId}`);
-				if (assignment.scope !== input.scope) throw new Error("Referenced Assignment scope must match the Handoff scope.");
-			}
-			const snapshot = await new HandoffSnapshotRepository(transaction).create(input);
-			if (input.referenceType === "assignment") {
-				if (!await new AssignmentRepository(transaction).linkHandoffSnapshot(input.referenceId, snapshot.id, snapshot.createdAt)) throw new Error(`Assignment not found: ${input.referenceId}`);
-			}
-			return snapshot;
+		const assignment = input.referenceType === "assignment" ? await this.db.selectFrom("_dineway_assignments").selectAll().where("id", "=", input.referenceId).executeTakeFirst() : null;
+		if (input.referenceType === "assignment" && !assignment) throw new Error(`Assignment not found: ${input.referenceId}`);
+		if (assignment && assignment.scope !== input.scope) throw new Error("Referenced Assignment scope must match the Handoff scope.");
+		const repository = new HandoffSnapshotRepository(this.db);
+		const prepared = repository.prepareCreate(input);
+		const statements = [prepared.statement];
+		if (assignment) statements.push(this.db.updateTable("_dineway_assignments").set({
+			related_handoff_snapshot_id: prepared.id,
+			updated_at: prepared.createdAt
+		}).where("id", "=", assignment.id).compile());
+		await atomicBatch(this.db, {
+			checks: assignment ? [rowUnchanged("_dineway_assignments", assignment)] : [],
+			statements
 		});
+		const snapshot = await repository.findById(prepared.id);
+		if (!snapshot) throw new Error("Failed to create handoff snapshot");
+		return snapshot;
 	}
 	async get(id) {
 		return new HandoffSnapshotRepository(this.db).findById(id);
@@ -3665,10 +3682,6 @@ var HandoffSnapshotStore = class {
 			}
 		};
 	}
-	async withTransaction(operation) {
-		if (this.db.isTransaction) return operation(this.db);
-		return this.db.transaction().execute(operation);
-	}
 };
 function summarizeScope(scope) {
 	return {

package/dist/{site-url-DoZf_jVj.mjs → site-url-DoTPKRND.mjs}

@@ -1,4 +1,4 @@
-import { t as OptionsRepository } from "./options-1dBRkoCl.mjs";
+import { t as OptionsRepository } from "./options-BcqHWpc-.mjs";
 
 //#region src/api/site-url.ts
 async function getSiteBaseUrl(db, request) {

package/dist/state-D8AogXCV.mjs

@@ -0,0 +1,30 @@
+import { t as MIGRATION_NAMES } from "./runner-CVeq0266.mjs";
+import { createHash } from "node:crypto";
+import { sql } from "kysely";
+
+//#region src/database/d1/state.ts
+function d1ReleaseRevision(plugins) {
+	for (const plugin of plugins) {
+		if (!plugin.d1) throw new Error(`Plugin ${plugin.id} does not declare verified D1 support.`);
+		if (Object.keys(plugin.migrations).length && !plugin.d1.migrations) throw new Error(`Plugin ${plugin.id} has no D1 migration plan.`);
+	}
+	return createHash("sha256").update(JSON.stringify({
+		core: MIGRATION_NAMES,
+		plugins: plugins.map((plugin) => [
+			plugin.id,
+			plugin.version,
+			Object.keys(plugin.migrations).toSorted()
+		]).toSorted(([left], [right]) => String(left).localeCompare(String(right)))
+	})).digest("hex");
+}
+async function assertD1Release(db, revision) {
+	try {
+		const state = (await sql`SELECT revision, ready FROM _dineway_d1_release WHERE id = 1`.execute(db)).rows[0];
+		if (!state || state.ready !== 1 || state.revision !== revision) throw new Error("D1 release is not ready");
+	} catch (cause) {
+		throw new Error("D1 schema is unavailable or differs from this release. Run dineway database migrate before serving requests.", { cause });
+	}
+}
+
+//#endregion
+export { d1ReleaseRevision as n, assertD1Release as t };

package/dist/storage/local.d.mts

@@ -1,4 +1,4 @@
-import { a as ListOptions, d as Storage, l as SignedUploadOptions, o as ListResult, p as UploadResult, r as DownloadResult, s as LocalStorageConfig, u as SignedUploadUrl } from "../types-CLMOusxP.mjs";
+import { a as ListOptions, d as Storage, l as SignedUploadOptions, o as ListResult, p as UploadResult, r as DownloadResult, s as LocalStorageConfig, u as SignedUploadUrl } from "../types-BWsEjujW.mjs";
 
 //#region src/storage/local.d.ts
 /**

package/dist/storage/local.mjs

@@ -1,4 +1,4 @@
-import { t as DinewayStorageError } from "../types-BQZFeZjd.mjs";
+import { t as DinewayStorageError } from "../types-BKsk4nnM.mjs";
 import { createReadStream, existsSync } from "node:fs";
 import * as path from "node:path";
 import mime from "mime/lite";

package/dist/storage/s3.d.mts

@@ -1,4 +1,4 @@
-import { a as ListOptions, c as S3StorageConfig, d as Storage, l as SignedUploadOptions, o as ListResult, p as UploadResult, r as DownloadResult, u as SignedUploadUrl } from "../types-CLMOusxP.mjs";
+import { a as ListOptions, c as S3StorageConfig, d as Storage, l as SignedUploadOptions, o as ListResult, p as UploadResult, r as DownloadResult, u as SignedUploadUrl } from "../types-BWsEjujW.mjs";
 
 //#region src/storage/s3.d.ts
 /**

package/dist/storage/s3.mjs

@@ -1,4 +1,5 @@
-import { t as DinewayStorageError } from "../types-BQZFeZjd.mjs";
+import { t as readRuntimeEnv } from "../runtime-env-v-1UXPAH.mjs";
+import { t as DinewayStorageError } from "../types-BKsk4nnM.mjs";
 import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 
@@ -25,8 +26,7 @@ function isConfigKey(key) {
 	return key in ENV_KEYS;
 }
 function getRuntimeEnv(key) {
-	if (typeof process === "undefined" || !process.env) return void 0;
-	const value = process.env[key];
+	const value = readRuntimeEnv(key);
 	return value === "" ? void 0 : value;
 }
 function getPresentExplicitValue(partial, field) {

package/dist/{store-c4qx3gVh.mjs → store-CjmmGlVw.mjs}

@@ -1,12 +1,14 @@
-import { i as encodeBase64url, n as decodeBase64url } from "./base64-F8-DUraK.mjs";
-import { i as parseEncryptionKeys, t as DinewaySecretsError } from "./secrets-AdCrGg1c.mjs";
+import { atomicBatch, rowUnchanged } from "./database/batch.mjs";
+import { i as encodeBase64url, n as decodeBase64url } from "./base64-Cz-aU0X1.mjs";
+import { t as readRuntimeEnv } from "./runtime-env-v-1UXPAH.mjs";
+import { i as parseEncryptionKeys, t as DinewaySecretsError } from "./secrets-BP2YTPWn.mjs";
 
 //#region src/database/repositories/integration-credentials.ts
 var IntegrationCredentialRepository = class {
 	constructor(db) {
 		this.db = db;
 	}
-	async put(input) {
+	preparePut(input) {
 		const now = input.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
 		const row = {
 			provider: input.provider,
@@ -20,7 +22,7 @@ var IntegrationCredentialRepository = class {
 			created_at: now,
 			updated_at: now
 		};
-		await this.db.insertInto("_dineway_integration_credentials").values(row).onConflict((conflict) => conflict.column("provider").doUpdateSet({
+		return this.db.insertInto("_dineway_integration_credentials").values(row).onConflict((conflict) => conflict.column("provider").doUpdateSet({
 			credential_type: row.credential_type,
 			encryption_version: row.encryption_version,
 			key_id: row.key_id,
@@ -29,7 +31,25 @@ var IntegrationCredentialRepository = class {
 			fingerprint: row.fingerprint,
 			source: row.source,
 			updated_at: now
-		})).execute();
+		})).compile();
+	}
+	async put(input, expected) {
+		const checks = expected ? [rowUnchanged("_dineway_integration_credentials", {
+			provider: expected.provider,
+			credential_type: expected.credentialType,
+			encryption_version: expected.encryptionVersion,
+			key_id: expected.keyId,
+			nonce: expected.nonce,
+			ciphertext: expected.ciphertext,
+			fingerprint: expected.fingerprint,
+			source: expected.source,
+			created_at: expected.createdAt,
+			updated_at: expected.updatedAt
+		})] : [];
+		await atomicBatch(this.db, {
+			checks,
+			statements: [this.preparePut(input)]
+		});
 		const stored = await this.find(input.provider);
 		if (!stored) throw new Error("Integration credential write did not persist.");
 		return stored;
@@ -71,17 +91,18 @@ var IntegrationCredentialStore = class {
 	repository;
 	keysPromise;
 	constructor(db, options = {}) {
+		this.db = db;
 		this.repository = new IntegrationCredentialRepository(db);
 		this.keysPromise = options.keys ? Promise.resolve(options.keys) : parseEncryptionKeys(readEncryptionKey(options.env));
 	}
-	async set(provider, credential, source = "admin") {
+	async prepareSet(provider, credential, source = "admin") {
 		validateProvider(provider);
 		validateCredential(credential);
 		const primaryKey = (await this.requireKeys())[0];
 		if (!primaryKey) throw encryptionKeyRequired();
 		const serialized = serializeCredential(credential);
 		const encrypted = await encryptCredential(primaryKey, provider, credential.type, serialized);
-		return toStatus(await this.repository.put({
+		return this.repository.preparePut({
 			provider,
 			credentialType: credential.type,
 			encryptionVersion: ENCRYPTION_VERSION,
@@ -90,7 +111,13 @@ var IntegrationCredentialStore = class {
 			ciphertext: encrypted.ciphertext,
 			fingerprint: await fingerprintCredential(primaryKey, provider, serialized),
 			source
-		}));
+		});
+	}
+	async set(provider, credential, source = "admin") {
+		await atomicBatch(this.db, { statements: [await this.prepareSet(provider, credential, source)] });
+		const status = await this.status(provider);
+		if (!status) throw new Error("Integration credential write did not persist.");
+		return status;
 	}
 	async status(provider) {
 		validateProvider(provider);
@@ -131,7 +158,7 @@ var IntegrationCredentialStore = class {
 				ciphertext: encrypted.ciphertext,
 				fingerprint: await fingerprintCredential(primaryKey, provider, serialized),
 				source: stored.source
-			});
+			}, stored);
 		}
 		return credential;
 	}
@@ -234,9 +261,7 @@ function encryptionKeyRequired() {
 }
 function readEncryptionKey(env) {
 	if (env) return env.DINEWAY_ENCRYPTION_KEY;
-	const meta = import.meta.env ?? {};
-	const proc = typeof process !== "undefined" && process.env ? process.env : {};
-	return meta.DINEWAY_ENCRYPTION_KEY ?? proc.DINEWAY_ENCRYPTION_KEY;
+	return readRuntimeEnv("DINEWAY_ENCRYPTION_KEY");
 }
 function toStatus(stored) {
 	return {