@gzl10/nexus-backend 0.19.1 → 0.20.0

package/dist/cli.js

@@ -8709,18 +8709,20 @@ function createSystemController(ctx) {
     /**
      * GET /system/capabilities
      * Public endpoint — no authentication required.
-     * Returns backend version and registered plugin codes.
+     * Resolves all registered capabilities (core + plugin-contributed).
      */
-    getCapabilities(_req, res) {
-      res.set("Cache-Control", "public, max-age=300");
-      const manifest = engine.getCoreManifest();
-      const plugins = engine.getPlugins();
-      const body = {
-        version: manifest.version,
-        plugins: plugins.map((p) => p.code),
-        locales: ctx.locales
-      };
-      res.json(body);
+    async getCapabilities(_req, res) {
+      try {
+        res.set("Cache-Control", "public, max-age=300");
+        const body = await ctx.capabilities.resolve();
+        res.json(body);
+      } catch (err) {
+        ctx.core.logger.error({ err }, "Failed to resolve capabilities");
+        res.set("Cache-Control", "no-cache");
+        res.status(500).json({
+          error: { code: "INTERNAL_ERROR", message: "Failed to resolve capabilities" }
+        });
+      }
     }
   };
   function toManifestDTO(manifest, req) {
@@ -9293,8 +9295,8 @@ function registerCoreVars(registry2) {
   registry2.register("auth", "core", [
     {
       name: "AUTH_SECRET",
-      description: { en: "JWT signing secret. Must be at least 32 characters. Use a cryptographically random string in production", es: "Clave de firma JWT. M\xEDnimo 32 caracteres. Usar una cadena criptogr\xE1ficamente aleatoria en producci\xF3n" },
-      required: true,
+      description: { en: "JWT signing secret (optional). If not set, auto-generated and persisted in database. Must be at least 32 characters. Set explicitly for multi-instance deployments", es: "Clave de firma JWT (opcional). Si no se establece, se genera autom\xE1ticamente y se persiste en la base de datos. M\xEDnimo 32 caracteres. Establecer expl\xEDcitamente para despliegues multi-instancia" },
+      required: false,
       sensitive: true
     },
     {
@@ -9811,96 +9813,70 @@ var init_system = __esm({
   }
 });
 
-// src/modules/ui-settings/ui-branding.entity.ts
-import { useTextField as useTextField7, useImageField } from "@gzl10/nexus-sdk/fields";
-var uiBrandingEntity;
-var init_ui_branding_entity = __esm({
-  "src/modules/ui-settings/ui-branding.entity.ts"() {
+// src/modules/ui-settings/ui-style-guide.entity.ts
+import { useTextField as useTextField7, useImageField, useSelectField as useSelectField6, useColorField, useNumberField as useNumberField4, useSwitchField as useSwitchField2 } from "@gzl10/nexus-sdk/fields";
+var uiStyleGuideEntity;
+var init_ui_style_guide_entity = __esm({
+  "src/modules/ui-settings/ui-style-guide.entity.ts"() {
     "use strict";
-    uiBrandingEntity = {
+    uiStyleGuideEntity = {
       type: "single",
       realtime: "sync",
-      key: "ui_branding",
-      label: { en: "Branding", es: "Identidad Corporativa" },
-      icon: "mdi:palette-swatch-outline",
+      key: "ui_style_guide",
+      label: { en: "Style Guide", es: "Gu\xEDa de Estilos" },
+      icon: "mdi:palette-outline",
       public: true,
-      routePrefix: "/ui-branding",
+      routePrefix: "/ui-style-guide",
       defaults: {
         appName: "Nexus",
         logo: null,
         logoDark: null,
-        favicon: null
+        favicon: null,
+        primaryColor: "#3B82F6",
+        font: "space-grotesk",
+        typographyScale: "default",
+        borderRadius: 8,
+        glassEffect: true,
+        theme: "system",
+        loginLayout: "centered"
       },
       fields: {
         appName: useTextField7({
           label: { en: "App Name", es: "Nombre de la App" },
-          hint: { en: "Displayed in the header, browser tab and emails", es: "Se muestra en el header, pesta\xF1a del navegador y emails" },
+          hint: { en: "Displayed in header, browser tab and emails", es: "Se muestra en header, pesta\xF1a del navegador y emails" },
           size: 100,
           required: true
         }),
         logo: useImageField({
           label: { en: "Logo (Light Theme)", es: "Logo (Tema Claro)" },
-          hint: { en: "Recommended: SVG or PNG with transparent background, max 200px height", es: "Recomendado: SVG o PNG con fondo transparente, m\xE1x 200px de alto" },
+          hint: { en: "SVG or PNG with transparent background, max 200px height", es: "SVG o PNG con fondo transparente, m\xE1x 200px de alto" },
           folder: "branding",
           isPublic: true,
           dedupe: true
         }),
         logoDark: useImageField({
           label: { en: "Logo (Dark Theme)", es: "Logo (Tema Oscuro)" },
-          hint: { en: "Optional: Use a lighter version for dark backgrounds", es: "Opcional: Usa una versi\xF3n m\xE1s clara para fondos oscuros" },
+          hint: { en: "Lighter version for dark backgrounds", es: "Versi\xF3n m\xE1s clara para fondos oscuros" },
           folder: "branding",
           isPublic: true,
           dedupe: true
         }),
         favicon: useImageField({
           label: { en: "Favicon", es: "Favicon" },
-          hint: { en: "Browser tab icon. Recommended: 32x32 or 64x64 PNG/ICO", es: "Icono de pesta\xF1a del navegador. Recomendado: 32x32 o 64x64 PNG/ICO" },
+          hint: { en: "32x32 or 64x64 PNG/ICO", es: "32x32 o 64x64 PNG/ICO" },
           accept: "image/x-icon,image/png,image/svg+xml",
           maxSize: "256KB",
           folder: "branding",
           isPublic: true,
           dedupe: true
-        })
-      },
-      casl: {
-        subject: "UiBranding",
-        permissions: {
-          ADMIN: { actions: ["read", "update"] }
-        }
-      }
-    };
-  }
-});
-
-// src/modules/ui-settings/ui-theme.entity.ts
-import { useSelectField as useSelectField6, useColorField } from "@gzl10/nexus-sdk/fields";
-var uiThemeEntity;
-var init_ui_theme_entity = __esm({
-  "src/modules/ui-settings/ui-theme.entity.ts"() {
-    "use strict";
-    uiThemeEntity = {
-      type: "single",
-      realtime: "sync",
-      key: "ui_theme",
-      label: { en: "Theme & Colors", es: "Tema y Colores" },
-      icon: "mdi:palette",
-      public: true,
-      routePrefix: "/ui-theme",
-      defaults: {
-        // Typography
-        font: "space-grotesk",
-        // Theme & Colors
-        theme: "system",
-        primaryColor: "#3B82F6",
-        dopamineTheme: "none",
-        // Layout
-        loginLayout: "centered"
-      },
-      fields: {
-        // === Typography ===
+        }),
+        primaryColor: useColorField({
+          label: { en: "Primary Color", es: "Color Principal" },
+          hint: { en: "Accent color for buttons, links and highlights", es: "Color de acento para botones, enlaces y resaltados" }
+        }),
         font: useSelectField6({
           label: { en: "Font", es: "Fuente" },
-          hint: { en: "Primary font for headings and UI elements", es: "Fuente principal para t\xEDtulos y elementos de interfaz" },
+          hint: { en: "Primary font for headings and UI", es: "Fuente principal para t\xEDtulos e interfaz" },
           options: [
             { value: "space-grotesk", label: "Space Grotesk" },
             { value: "inter", label: "Inter" },
@@ -9910,37 +9886,38 @@ var init_ui_theme_entity = __esm({
             { value: "system", label: { en: "System Default", es: "Sistema" } }
           ]
         }),
-        // === Theme & Colors ===
+        typographyScale: useSelectField6({
+          label: { en: "Typography Scale", es: "Escala Tipogr\xE1fica" },
+          hint: { en: "Font size scaling (WCAG 1.4.4)", es: "Escala de tama\xF1os de fuente (WCAG 1.4.4)" },
+          options: [
+            { value: "compact", label: { en: "Compact", es: "Compacta" } },
+            { value: "default", label: { en: "Default", es: "Por defecto" } },
+            { value: "relaxed", label: { en: "Relaxed", es: "Relajada" } }
+          ]
+        }),
+        borderRadius: useNumberField4({
+          label: { en: "Border Radius", es: "Radio de Bordes" },
+          hint: { en: "Corner roundness in pixels (0 = sharp, 16 = very round)", es: "Redondeo de esquinas en p\xEDxeles (0 = cuadrado, 16 = muy redondo)" },
+          defaultValue: 8,
+          validation: { min: 0, max: 16 }
+        }),
+        glassEffect: useSwitchField2({
+          label: { en: "Glass Effect", es: "Efecto Glass" },
+          hint: { en: "Glassmorphism blur on cards and modals", es: "Desenfoque glassmorphism en cards y modales" },
+          defaultValue: true
+        }),
         theme: useSelectField6({
           label: { en: "Theme", es: "Tema" },
-          hint: { en: "System follows your device preferences", es: "Sistema sigue las preferencias de tu dispositivo" },
+          hint: { en: "System follows device preferences", es: "Sistema sigue las preferencias del dispositivo" },
           options: [
             { value: "light", label: { en: "Light", es: "Claro" } },
             { value: "dark", label: { en: "Dark", es: "Oscuro" } },
             { value: "system", label: { en: "System", es: "Sistema" } }
           ]
         }),
-        dopamineTheme: useSelectField6({
-          label: { en: "Dopamine Theme", es: "Tema Dopamina" },
-          hint: { en: "Vibrant color presets optimized for light and dark modes (2025/2026 trends)", es: "Presets de colores vibrantes optimizados para modo claro y oscuro (tendencias 2025/2026)" },
-          options: [
-            { value: "none", label: { en: "None (Custom Color)", es: "Ninguno (Color personalizado)" } },
-            { value: "electric", label: { en: "Electric (Cobalt Blue)", es: "El\xE9ctrico (Azul Cobalto)" } },
-            { value: "sunset", label: { en: "Sunset (Coral Red)", es: "Atardecer (Rojo Coral)" } },
-            { value: "ocean", label: { en: "Ocean (Teal)", es: "Oc\xE9ano (Verde Azulado)" } },
-            { value: "forest", label: { en: "Forest (Mint)", es: "Bosque (Menta)" } },
-            { value: "lavender", label: { en: "Lavender (Violet)", es: "Lavanda (Violeta)" } },
-            { value: "cherry", label: { en: "Cherry (Fuchsia)", es: "Cereza (Fucsia)" } },
-            { value: "amber", label: { en: "Amber (Golden)", es: "\xC1mbar (Dorado)" } },
-            { value: "tangerine", label: { en: "Tangerine (Orange)", es: "Mandarina (Naranja)" } },
-            { value: "slate", label: { en: "Slate (Cool Gray)", es: "Pizarra (Gris Fr\xEDo)" } },
-            { value: "bronze", label: { en: "Bronze (Earth)", es: "Bronce (Tierra)" } }
-          ]
-        }),
-        // === Login Layout ===
         loginLayout: useSelectField6({
           label: { en: "Login Layout", es: "Dise\xF1o de Login" },
-          hint: { en: "Visual layout for authentication pages", es: "Dise\xF1o visual para p\xE1ginas de autenticaci\xF3n" },
+          hint: { en: "Auth page visual layout", es: "Dise\xF1o visual de p\xE1ginas de autenticaci\xF3n" },
           options: [
             { value: "centered", label: { en: "Centered", es: "Centrado" } },
             { value: "split", label: { en: "Split", es: "Dividido" } },
@@ -9948,140 +9925,10 @@ var init_ui_theme_entity = __esm({
             { value: "floating", label: { en: "Floating", es: "Flotante" } },
             { value: "minimal", label: { en: "Minimal", es: "Minimalista" } }
           ]
-        }),
-        primaryColor: {
-          ...useColorField({
-            label: { en: "Primary Color", es: "Color Principal" },
-            hint: { en: "Custom accent color for buttons, links and highlights", es: "Color de acento personalizado para botones, enlaces y resaltados" }
-          }),
-          // Hide when a dopamine theme is active (show only if 'none')
-          hidden: { field: "dopamineTheme", $ne: "none" }
-        }
-      },
-      casl: {
-        subject: "UiTheme",
-        permissions: {
-          ADMIN: { actions: ["read", "update"] }
-        }
-      }
-    };
-  }
-});
-
-// src/modules/ui-settings/ui-effects.entity.ts
-import { useSelectField as useSelectField7, useSwitchField as useSwitchField2 } from "@gzl10/nexus-sdk/fields";
-var uiEffectsEntity;
-var init_ui_effects_entity = __esm({
-  "src/modules/ui-settings/ui-effects.entity.ts"() {
-    "use strict";
-    uiEffectsEntity = {
-      type: "single",
-      realtime: "sync",
-      key: "ui_effects",
-      label: { en: "Visual Effects", es: "Efectos Visuales" },
-      icon: "mdi:shimmer",
-      public: true,
-      routePrefix: "/ui-effects",
-      defaults: {
-        glassIntensity: "medium",
-        borderStyle: "rounded",
-        enableAnimations: true,
-        enableOrganicShapes: false
-      },
-      fields: {
-        glassIntensity: useSelectField7({
-          label: { en: "Glass Intensity", es: "Intensidad Glass" },
-          hint: { en: "Glassmorphism blur effect on cards and modals", es: "Efecto de desenfoque glassmorphism en cards y modales" },
-          options: [
-            { value: "none", label: { en: "None", es: "Ninguno" } },
-            { value: "low", label: { en: "Low", es: "Baja" } },
-            { value: "medium", label: { en: "Medium", es: "Media" } },
-            { value: "high", label: { en: "High", es: "Alta" } }
-          ]
-        }),
-        borderStyle: useSelectField7({
-          label: { en: "Border Style", es: "Estilo de Bordes" },
-          hint: { en: "Corner radius for buttons, cards and inputs", es: "Radio de esquinas para botones, cards e inputs" },
-          options: [
-            { value: "sharp", label: { en: "Sharp", es: "Cuadrados" } },
-            { value: "rounded", label: { en: "Rounded", es: "Redondeados" } },
-            { value: "organic", label: { en: "Organic", es: "Org\xE1nicos" } }
-          ]
-        }),
-        enableAnimations: useSwitchField2({
-          label: { en: "Enable Animations", es: "Habilitar Animaciones" },
-          hint: { en: "Micro-interactions and transitions (hover, focus, page changes)", es: "Micro-interacciones y transiciones (hover, focus, cambios de p\xE1gina)" },
-          defaultValue: true,
-          meta: { sortable: true }
-        }),
-        enableOrganicShapes: useSwitchField2({
-          label: { en: "Enable Organic Shapes", es: "Habilitar Formas Org\xE1nicas" },
-          hint: { en: "Asymmetric border-radius for a more natural, playful look", es: "Border-radius asim\xE9trico para un aspecto m\xE1s natural y divertido" },
-          defaultValue: false,
-          meta: { sortable: true },
-          hidden: { field: "borderStyle", $ne: "organic" }
-        })
-      },
-      casl: {
-        subject: "UiEffects",
-        permissions: {
-          ADMIN: { actions: ["read", "update"] }
-        }
-      }
-    };
-  }
-});
-
-// src/modules/ui-settings/ui-accessibility.entity.ts
-import { useSelectField as useSelectField8, useSwitchField as useSwitchField3 } from "@gzl10/nexus-sdk/fields";
-var uiAccessibilityEntity;
-var init_ui_accessibility_entity = __esm({
-  "src/modules/ui-settings/ui-accessibility.entity.ts"() {
-    "use strict";
-    uiAccessibilityEntity = {
-      type: "single",
-      realtime: "sync",
-      key: "ui_accessibility",
-      label: { en: "Accessibility", es: "Accesibilidad" },
-      icon: "mdi:human",
-      public: true,
-      routePrefix: "/ui-accessibility",
-      defaults: {
-        typographyScale: "default",
-        reducedMotion: false,
-        highContrast: false
-      },
-      fields: {
-        typographyScale: useSelectField8({
-          label: { en: "Typography Scale", es: "Escala Tipogr\xE1fica" },
-          hint: { en: "Adjusts font sizes for better readability (WCAG 1.4.4)", es: "Ajusta tama\xF1os de fuente para mejor legibilidad (WCAG 1.4.4)" },
-          options: [
-            { value: "compact", label: { en: "Compact (smaller)", es: "Compacta (m\xE1s peque\xF1a)" } },
-            { value: "default", label: { en: "Default", es: "Por defecto" } },
-            { value: "relaxed", label: { en: "Relaxed (larger)", es: "Relajada (m\xE1s grande)" } }
-          ]
-        }),
-        reducedMotion: useSwitchField3({
-          label: { en: "Reduced Motion", es: "Movimiento Reducido" },
-          defaultValue: false,
-          meta: { sortable: true },
-          hint: {
-            en: "Minimizes animations for users sensitive to motion (WCAG 2.1)",
-            es: "Minimiza animaciones para usuarios sensibles al movimiento (WCAG 2.1)"
-          }
-        }),
-        highContrast: useSwitchField3({
-          label: { en: "High Contrast", es: "Alto Contraste" },
-          defaultValue: false,
-          meta: { sortable: true },
-          hint: {
-            en: "Increases text contrast for better readability (WCAG AAA)",
-            es: "Aumenta el contraste del texto para mejor legibilidad (WCAG AAA)"
-          }
         })
       },
       casl: {
-        subject: "UiAccessibility",
+        subject: "UiStyleGuide",
         permissions: {
           ADMIN: { actions: ["read", "update"] }
         }
@@ -10091,44 +9938,62 @@ var init_ui_accessibility_entity = __esm({
 });
 
 // src/modules/ui-settings/index.ts
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
+import { join as join9 } from "path";
 var uiSettingsModule;
 var init_ui_settings = __esm({
   "src/modules/ui-settings/index.ts"() {
     "use strict";
-    init_ui_branding_entity();
-    init_ui_theme_entity();
-    init_ui_effects_entity();
-    init_ui_accessibility_entity();
-    init_ui_branding_entity();
-    init_ui_theme_entity();
-    init_ui_effects_entity();
-    init_ui_accessibility_entity();
+    init_ui_style_guide_entity();
+    init_ui_style_guide_entity();
     uiSettingsModule = {
       name: "ui-settings",
-      label: { en: "UI Settings", es: "Configuraci\xF3n de UI" },
+      label: { en: "Style Guide", es: "Gu\xEDa de Estilos" },
       icon: "mdi:palette-outline",
       description: {
-        en: "User interface configuration: branding, themes, visual effects, and accessibility",
-        es: "Configuraci\xF3n de interfaz de usuario: marca, temas, efectos visuales y accesibilidad"
+        en: "Brand identity and visual style configuration",
+        es: "Configuraci\xF3n de identidad de marca y estilo visual"
       },
       type: "core",
       category: "settings",
       dependencies: ["logger"],
-      definitions: [
-        uiBrandingEntity,
-        uiThemeEntity,
-        uiEffectsEntity,
-        uiAccessibilityEntity
-      ],
-      routePrefix: "/ui-settings"
+      definitions: [uiStyleGuideEntity],
+      routePrefix: "/ui-settings",
+      /**
+       * Seed style guide from data/seeds/ui-style-guide.json if it exists.
+       * Idempotent: only inserts if no record exists yet.
+       *
+       * Workflow:
+       * 1. Configure style guide in dev via admin UI
+       * 2. Export: GET /api/v1/ui-settings/ui-style-guide → save to data/seeds/ui-style-guide.json
+       * 3. Commit the seed file
+       * 4. On other environments, seed runs automatically on startup
+       */
+      seed: async (ctx) => {
+        const db3 = ctx.db.knex;
+        const existing = await db3("single_records").where("key", "ui_style_guide").first();
+        if (existing) return;
+        const seedPath = join9(process.cwd(), "data", "seeds", "ui-style-guide.json");
+        if (!existsSync6(seedPath)) return;
+        try {
+          const seedData = JSON.parse(readFileSync6(seedPath, "utf-8"));
+          await db3("single_records").insert({
+            key: "ui_style_guide",
+            value: JSON.stringify(seedData)
+          });
+          ctx.core.logger.info("Seeded ui_style_guide from data/seeds/ui-style-guide.json");
+        } catch {
+          ctx.core.logger.warn("Failed to parse data/seeds/ui-style-guide.json, skipping seed");
+        }
+      }
     };
   }
 });
 
 // src/modules/storage/drivers/filesystem.driver.ts
-import { createReadStream, createWriteStream, existsSync as existsSync6, unlinkSync, mkdirSync as mkdirSync3 } from "fs";
+import { createReadStream, createWriteStream, existsSync as existsSync7, unlinkSync, mkdirSync as mkdirSync3 } from "fs";
 import { readFile, readdir, stat, copyFile, rename, mkdir } from "fs/promises";
-import { join as join9, dirname as dirname6, extname, basename } from "path";
+import { join as join10, dirname as dirname6, extname, basename } from "path";
 import { createHash } from "crypto";
 var FilesystemDriver;
 var init_filesystem_driver = __esm({
@@ -10142,7 +10007,7 @@ var init_filesystem_driver = __esm({
         this.basePath = config3.basePath;
         this.baseUrl = config3.baseUrl;
         this.generateId = config3.generateId;
-        if (!existsSync6(this.basePath)) {
+        if (!existsSync7(this.basePath)) {
           mkdirSync3(this.basePath, { recursive: true });
         }
       }
@@ -10152,9 +10017,9 @@ var init_filesystem_driver = __esm({
         const diskFilename = `${id}${ext}`;
         const folder = options?.folder || "";
         const relativePath = folder ? `${folder}/${diskFilename}` : diskFilename;
-        const fullPath = join9(this.basePath, relativePath);
+        const fullPath = join10(this.basePath, relativePath);
         const dir = dirname6(fullPath);
-        if (!existsSync6(dir)) {
+        if (!existsSync7(dir)) {
           mkdirSync3(dir, { recursive: true });
         }
         const hash = createHash("sha256").update(buffer).digest("hex");
@@ -10178,25 +10043,25 @@ var init_filesystem_driver = __esm({
         };
       }
       async get(path3) {
-        const fullPath = join9(this.basePath, path3);
-        if (!existsSync6(fullPath)) {
+        const fullPath = join10(this.basePath, path3);
+        if (!existsSync7(fullPath)) {
           throw new Error(`File not found: ${path3}`);
         }
         return createReadStream(fullPath);
       }
       async getBuffer(path3) {
-        const fullPath = join9(this.basePath, path3);
+        const fullPath = join10(this.basePath, path3);
         return readFile(fullPath);
       }
       async delete(path3) {
-        const fullPath = join9(this.basePath, path3);
-        if (existsSync6(fullPath)) {
+        const fullPath = join10(this.basePath, path3);
+        if (existsSync7(fullPath)) {
           unlinkSync(fullPath);
         }
       }
       async exists(path3) {
-        const fullPath = join9(this.basePath, path3);
-        return existsSync6(fullPath);
+        const fullPath = join10(this.basePath, path3);
+        return existsSync7(fullPath);
       }
       getUrl(path3) {
         if (!this.baseUrl) return null;
@@ -10206,14 +10071,14 @@ var init_filesystem_driver = __esm({
       // EXTENDED METHODS
       // ============================================================================
       async list(folder) {
-        const targetPath = folder ? join9(this.basePath, folder) : this.basePath;
-        if (!existsSync6(targetPath)) {
+        const targetPath = folder ? join10(this.basePath, folder) : this.basePath;
+        if (!existsSync7(targetPath)) {
           return [];
         }
         const entries = await readdir(targetPath, { withFileTypes: true });
         const results = [];
         for (const entry of entries) {
-          const entryPath = join9(targetPath, entry.name);
+          const entryPath = join10(targetPath, entry.name);
           const relativePath = folder ? `${folder}/${entry.name}` : entry.name;
           const stats = await stat(entryPath);
           results.push({
@@ -10227,10 +10092,10 @@ var init_filesystem_driver = __esm({
         return results;
       }
       async copy(src, dst) {
-        const srcPath = join9(this.basePath, src);
-        const dstPath = join9(this.basePath, dst);
+        const srcPath = join10(this.basePath, src);
+        const dstPath = join10(this.basePath, dst);
         const dstDir = dirname6(dstPath);
-        if (!existsSync6(dstDir)) {
+        if (!existsSync7(dstDir)) {
           await mkdir(dstDir, { recursive: true });
         }
         await copyFile(srcPath, dstPath);
@@ -10253,10 +10118,10 @@ var init_filesystem_driver = __esm({
         };
       }
       async move(src, dst) {
-        const srcPath = join9(this.basePath, src);
-        const dstPath = join9(this.basePath, dst);
+        const srcPath = join10(this.basePath, src);
+        const dstPath = join10(this.basePath, dst);
         const dstDir = dirname6(dstPath);
-        if (!existsSync6(dstDir)) {
+        if (!existsSync7(dstDir)) {
           await mkdir(dstDir, { recursive: true });
         }
         await rename(srcPath, dstPath);
@@ -10279,7 +10144,7 @@ var init_filesystem_driver = __esm({
         };
       }
       async getMetadata(path3) {
-        const fullPath = join9(this.basePath, path3);
+        const fullPath = join10(this.basePath, path3);
         const stats = await stat(fullPath);
         return {
           path: path3,
@@ -10293,8 +10158,8 @@ var init_filesystem_driver = __esm({
         throw new Error("Signed URLs are not supported by the filesystem driver");
       }
       async createFolder(path3) {
-        const fullPath = join9(this.basePath, path3);
-        if (!existsSync6(fullPath)) {
+        const fullPath = join10(this.basePath, path3);
+        if (!existsSync7(fullPath)) {
           await mkdir(fullPath, { recursive: true });
         }
       }
@@ -10525,8 +10390,8 @@ var init_s3_driver = __esm({
 });
 
 // src/modules/storage/storage.config.ts
-import { join as join10, isAbsolute as isAbsolute2 } from "path";
-import { existsSync as existsSync7, mkdirSync as mkdirSync4 } from "fs";
+import { join as join11, isAbsolute as isAbsolute2 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4 } from "fs";
 function getDefaultScope(driver) {
   return driver === "s3" ? DEFAULT_S3_SCOPE : DEFAULT_FILESYSTEM_SCOPE;
 }
@@ -10541,7 +10406,7 @@ function resolveStoragePath(path3, projPath) {
     return path3;
   }
   const cleanPath = path3.startsWith("./") ? path3.slice(2) : path3;
-  return join10(projPath, "data", cleanPath);
+  return join11(projPath, "data", cleanPath);
 }
 async function getConfigByScope(db3, scope) {
   if (!generateIdFn) {
@@ -10572,7 +10437,7 @@ function buildConfigFromRow(row) {
   if (row.driver === "filesystem") {
     const fsMeta = metadata;
     config3.basePath = resolveStoragePath(fsMeta.basePath || "./storage", projectPath);
-    if (!existsSync7(config3.basePath)) {
+    if (!existsSync8(config3.basePath)) {
       mkdirSync4(config3.basePath, { recursive: true });
     }
   } else if (row.driver === "s3") {
@@ -10604,7 +10469,7 @@ function buildConfigFromEnv(driver) {
   if (driver === "filesystem") {
     const rawPath = process.env["STORAGE_PATH"] || "./storage";
     config3.basePath = resolveStoragePath(rawPath, projectPath);
-    if (!existsSync7(config3.basePath)) {
+    if (!existsSync8(config3.basePath)) {
       mkdirSync4(config3.basePath, { recursive: true });
     }
   } else if (driver === "s3") {
@@ -11043,7 +10908,7 @@ var init_storage_service = __esm({
 });
 
 // src/modules/storage/storage.entity.ts
-import { useIdField as useIdField3, useTextField as useTextField8, useSelectField as useSelectField9, useUrlField, useNumberField as useNumberField4, useCheckboxField as useCheckboxField3, useJsonField as useJsonField2, useMetadataField, usePublicField } from "@gzl10/nexus-sdk/fields";
+import { useIdField as useIdField3, useTextField as useTextField8, useSelectField as useSelectField7, useUrlField, useNumberField as useNumberField5, useCheckboxField as useCheckboxField3, useJsonField as useJsonField2, useMetadataField, usePublicField } from "@gzl10/nexus-sdk/fields";
 var DEFAULT_MAX_SIZE2, storageConfigEntity, storageFilesEntity;
 var init_storage_entity = __esm({
   "src/modules/storage/storage.entity.ts"() {
@@ -11078,7 +10943,7 @@ var init_storage_entity = __esm({
           hint: { en: "Unique identifier (e.g. default_filesystem, default_s3)", es: "Identificador \xFAnico (ej: default_filesystem, default_s3)" }
         }),
         driver: {
-          ...useSelectField9({
+          ...useSelectField7({
             label: { en: "Driver", es: "Controlador" },
             required: true,
             hint: { en: "Storage backend", es: "Backend de almacenamiento" },
@@ -11095,7 +10960,7 @@ var init_storage_entity = __esm({
           size: 500,
           nullable: true
         }),
-        max_file_size: useNumberField4({
+        max_file_size: useNumberField5({
           label: { en: "Max File Size (bytes)", es: "Tama\xF1o m\xE1ximo de archivo (bytes)" },
           hint: { en: "Maximum size in bytes (default: 10MB = 10485760)", es: "Tama\xF1o m\xE1ximo en bytes (default: 10MB = 10485760)" },
           nullable: false,
@@ -11288,7 +11153,7 @@ var init_storage_entity = __esm({
           index: true,
           meta: { sortable: true, searchable: true }
         }),
-        size: useNumberField4({
+        size: useNumberField5({
           label: { en: "Size", es: "Tama\xF1o" },
           required: true,
           nullable: false,
@@ -11830,7 +11695,7 @@ var init_storage = __esm({
 });
 
 // src/modules/users/users.entity.ts
-import { useIdField as useIdField4, useSelectField as useSelectField10, useEmailField, usePasswordField, useTextField as useTextField9, useDatetimeField as useDatetimeField3, useCheckboxField as useCheckboxField4, useImageField as useImageField2, useNameField as useNameField2, useMetadataField as useMetadataField2, useDescriptionField as useDescriptionField2 } from "@gzl10/nexus-sdk/fields";
+import { useIdField as useIdField4, useSelectField as useSelectField8, useEmailField, usePasswordField, useTextField as useTextField9, useDatetimeField as useDatetimeField3, useCheckboxField as useCheckboxField4, useImageField as useImageField2, useNameField as useNameField2, useMetadataField as useMetadataField2, useDescriptionField as useDescriptionField2 } from "@gzl10/nexus-sdk/fields";
 import { z as z3 } from "zod";
 var userEntity, roleEntity, userRoleEntity;
 var init_users_entity = __esm({
@@ -11904,7 +11769,7 @@ var init_users_entity = __esm({
           label: { en: "Marketing Opt-in", es: "Aceptar marketing" },
           meta: { exportable: true, showInForm: false, showInDisplay: false }
         }),
-        locale: useSelectField10({
+        locale: useSelectField8({
           label: { en: "Language", es: "Idioma" },
           options: [
             { value: "es", label: { en: "Spanish", es: "Espa\xF1ol" } },
@@ -11914,13 +11779,13 @@ var init_users_entity = __esm({
           meta: { sortable: true },
           defaultValue: "en"
         }),
-        timezone: useSelectField10({
+        timezone: useSelectField8({
           label: { en: "Timezone", es: "Zona horaria" },
           master: "timezones",
           meta: { sortable: true },
           defaultValue: "timezones:Europe/Madrid"
         }),
-        type: useSelectField10({
+        type: useSelectField8({
           label: { en: "Type", es: "Tipo" },
           defaultValue: "human",
           options: [
@@ -12089,7 +11954,7 @@ var init_users_entity = __esm({
       expose: false,
       fields: {
         id: useIdField4(),
-        user_id: useSelectField10({
+        user_id: useSelectField8({
           label: { en: "User", es: "Usuario" },
           required: true,
           table: "users",
@@ -12100,7 +11965,7 @@ var init_users_entity = __esm({
           labelField: "name",
           meta: { searchable: true }
         }),
-        role_id: useSelectField10({
+        role_id: useSelectField8({
           label: { en: "Role", es: "Rol" },
           required: true,
           table: "roles",
@@ -13044,7 +12909,7 @@ var init_users = __esm({
 });
 
 // src/modules/auth/auth.entity.ts
-import { useIdField as useIdField5, useTextField as useTextField10, useSelectField as useSelectField11, useDatetimeField as useDatetimeField4, useEmailField as useEmailField2, useMetadataField as useMetadataField3, useExpiresAtField } from "@gzl10/nexus-sdk/fields";
+import { useIdField as useIdField5, useTextField as useTextField10, useSelectField as useSelectField9, useDatetimeField as useDatetimeField4, useEmailField as useEmailField2, useMetadataField as useMetadataField3, useExpiresAtField } from "@gzl10/nexus-sdk/fields";
 var refreshTokenEntity, authIdentitiesEntity;
 var init_auth_entity = __esm({
   "src/modules/auth/auth.entity.ts"() {
@@ -13125,7 +12990,7 @@ var init_auth_entity = __esm({
       order: 5,
       fields: {
         id: useIdField5(),
-        user_id: useSelectField11({
+        user_id: useSelectField9({
           label: { en: "User", es: "Usuario" },
           table: "users",
           column: "id",
@@ -13209,6 +13074,28 @@ var init_auth_routes = __esm({
   }
 });
 
+// src/core/crypto/secret-resolver.ts
+import { randomBytes } from "crypto";
+function _resetSecretResolver() {
+  _secret = null;
+  _db = null;
+}
+function getAuthSecret() {
+  if (_secret) return _secret;
+  const envSecret = process.env["AUTH_SECRET"];
+  if (envSecret) return envSecret;
+  throw new Error("AUTH_SECRET not initialized. Call initAuthSecret() during startup.");
+}
+var _secret, _db;
+var init_secret_resolver = __esm({
+  "src/core/crypto/secret-resolver.ts"() {
+    "use strict";
+    init_database();
+    _secret = null;
+    _db = null;
+  }
+});
+
 // src/modules/auth/auth.config.ts
 import { z as z5 } from "zod";
 function configError(module, errors) {
@@ -13225,12 +13112,6 @@ function parseAuthEnv() {
   if (!result.success) {
     const errors = result.error.issues.map((issue) => {
       const path3 = issue.path.join(".");
-      if (path3 === "AUTH_SECRET" && issue.code === "invalid_type") {
-        return "AUTH_SECRET is required. Set it in your .env file or environment.";
-      }
-      if (path3 === "AUTH_SECRET" && issue.code === "too_small") {
-        return `AUTH_SECRET must be at least 32 characters (current: ${String(process.env["AUTH_SECRET"]).length})`;
-      }
       return `${path3}: ${issue.message}`;
     });
     configError("auth", errors);
@@ -13249,7 +13130,7 @@ function getAuthEnv() {
 function getAuthConfig() {
   const authEnv = getAuthEnv();
   return {
-    secret: authEnv.AUTH_SECRET,
+    secret: getAuthSecret(),
     accessExpires: authEnv.AUTH_ACCESS_EXPIRES,
     refreshExpires: authEnv.AUTH_REFRESH_EXPIRES,
     rateLimitMax: authEnv.AUTH_RATE_LIMIT_MAX,
@@ -13266,8 +13147,8 @@ var authEnvSchema, _authEnv;
 var init_auth_config = __esm({
   "src/modules/auth/auth.config.ts"() {
     "use strict";
+    init_secret_resolver();
     authEnvSchema = z5.object({
-      AUTH_SECRET: z5.string().min(32, "AUTH_SECRET must be at least 32 characters"),
       AUTH_ACCESS_EXPIRES: z5.string().default("15m"),
       AUTH_REFRESH_EXPIRES: z5.string().default("7d"),
       // Rate limiting (default: 5 requests per 15 minutes)
@@ -13441,7 +13322,7 @@ var init_auth_middleware = __esm({
 });
 
 // src/modules/auth/auth.pat.entity.ts
-import { useIdField as useIdField6, useTextField as useTextField11, useSelectField as useSelectField12, useDatetimeField as useDatetimeField5, useExpiresAtField as useExpiresAtField2 } from "@gzl10/nexus-sdk/fields";
+import { useIdField as useIdField6, useTextField as useTextField11, useSelectField as useSelectField10, useDatetimeField as useDatetimeField5, useExpiresAtField as useExpiresAtField2 } from "@gzl10/nexus-sdk/fields";
 var personalTokenEntity;
 var init_auth_pat_entity = __esm({
   "src/modules/auth/auth.pat.entity.ts"() {
@@ -13458,7 +13339,7 @@ var init_auth_pat_entity = __esm({
       routePrefix: "/personal-tokens",
       fields: {
         id: useIdField6(),
-        user_id: useSelectField12({
+        user_id: useSelectField10({
           label: { en: "User", es: "Usuario" },
           table: "users",
           column: "id",
@@ -13493,7 +13374,7 @@ var init_auth_pat_entity = __esm({
           unique: true,
           meta: { exportable: false }
         }),
-        scope: useSelectField12({
+        scope: useSelectField10({
           label: { en: "Permission", es: "Permiso" },
           required: true,
           options: [
@@ -13525,42 +13406,6 @@ var init_auth_pat_entity = __esm({
   }
 });
 
-// src/modules/auth/actions/providers.action.ts
-var providersAction;
-var init_providers_action = __esm({
-  "src/modules/auth/actions/providers.action.ts"() {
-    "use strict";
-    init_auth_config();
-    providersAction = {
-      key: "providers",
-      label: { en: "Get Auth Providers", es: "Obtener proveedores de autenticaci\xF3n" },
-      icon: "mdi:account-key",
-      scope: "module",
-      hidden: true,
-      method: "GET",
-      skipAuth: true,
-      handler: async (ctx) => {
-        const providerServices = ctx.services.getBySuffix(".provider");
-        const results = await Promise.all(
-          providerServices.map(async ({ service }) => {
-            try {
-              return await service.getInfo();
-            } catch {
-              return null;
-            }
-          })
-        );
-        const providers = results.filter((info) => info !== null);
-        const config3 = getAuthConfig();
-        return {
-          providers,
-          registrationEnabled: !config3.disableRegistration
-        };
-      }
-    };
-  }
-});
-
 // src/modules/auth/actions/helpers.ts
 function getCookieOptions(req) {
   const config3 = getAuthConfig();
@@ -14117,7 +13962,6 @@ var authActions;
 var init_actions2 = __esm({
   "src/modules/auth/actions/index.ts"() {
     "use strict";
-    init_providers_action();
     init_login_action();
     init_register_action();
     init_forgot_password_action();
@@ -14133,7 +13977,6 @@ var init_actions2 = __esm({
     init_list_tokens_action();
     init_revoke_token_action();
     init_impersonate_action();
-    init_providers_action();
     init_login_action();
     init_register_action();
     init_forgot_password_action();
@@ -14149,7 +13992,6 @@ var init_actions2 = __esm({
     init_list_tokens_action();
     init_revoke_token_action();
     authActions = [
-      providersAction,
       loginAction,
       registerAction,
       forgotPasswordAction,
@@ -14368,7 +14210,7 @@ var init_otp_manager = __esm({
 });
 
 // src/modules/auth/auth.service.ts
-import { createHash as createHash4, randomBytes } from "crypto";
+import { createHash as createHash4, randomBytes as randomBytes2 } from "crypto";
 function createAuthService(ctx) {
   const { errors, abilities, crypto: crypto3 } = ctx.core;
   const { generateId: generateId2 } = ctx.core;
@@ -14785,7 +14627,7 @@ function createAuthService(ctx) {
     },
     // === Personal Access Tokens ===
     async createPersonalToken(userId, input, requestInfo) {
-      const rawToken = "nxs_" + randomBytes(32).toString("hex");
+      const rawToken = "nxs_" + randomBytes2(32).toString("hex");
       const tokenHash = createHash4("sha256").update(rawToken).digest("hex");
       const tokenPrefix = "nxs_..." + rawToken.slice(-6);
       const id = generateId2();
@@ -15121,8 +14963,8 @@ var init_mail_config = __esm({
 
 // src/modules/mail/mail.service.ts
 import nodemailer from "nodemailer";
-import { readFileSync as readFileSync6, existsSync as existsSync8 } from "fs";
-import { join as join11 } from "path";
+import { readFileSync as readFileSync7, existsSync as existsSync9 } from "fs";
+import { join as join12 } from "path";
 function getMailService() {
   if (!mailServiceInstance) {
     throw new Error("MailService not initialized. Call initMailService() first.");
@@ -15139,8 +14981,8 @@ var init_mail_service = __esm({
   "src/modules/mail/mail.service.ts"() {
     "use strict";
     init_mail_config();
-    TEMPLATE_REL_PATH = join11("public", "mail", "base.html");
-    LOGO_REL_PATH = join11("public", "nexus", "nexus-light-512.png");
+    TEMPLATE_REL_PATH = join12("public", "mail", "base.html");
+    LOGO_REL_PATH = join12("public", "nexus", "nexus-light-512.png");
     mailServiceInstance = null;
     MailService = class {
       transporter;
@@ -15154,10 +14996,10 @@ var init_mail_service = __esm({
         this.logger = logger3.child({ service: "mail" });
         this.loggerService = loggerService;
         const libPath = options?.libPath ?? process.cwd();
-        this.template = readFileSync6(join11(libPath, TEMPLATE_REL_PATH), "utf-8");
-        const logoPath = join11(libPath, LOGO_REL_PATH);
-        if (existsSync8(logoPath)) {
-          const logoBase64 = readFileSync6(logoPath).toString("base64");
+        this.template = readFileSync7(join12(libPath, TEMPLATE_REL_PATH), "utf-8");
+        const logoPath = join12(libPath, LOGO_REL_PATH);
+        if (existsSync9(logoPath)) {
+          const logoBase64 = readFileSync7(logoPath).toString("base64");
           this.defaultLogoUrl = `data:image/png;base64,${logoBase64}`;
         } else {
           this.defaultLogoUrl = "";
@@ -15249,7 +15091,7 @@ var init_mail_service = __esm({
 });
 
 // src/modules/mail/mail.entity.ts
-import { useIdField as useIdField7, useTextField as useTextField12, useSelectField as useSelectField13, useNumberField as useNumberField5, useSwitchField as useSwitchField4, useEmailField as useEmailField3, usePasswordField as usePasswordField2, useTextareaField as useTextareaField3, useTagsField as useTagsField2, useDatetimeField as useDatetimeField6 } from "@gzl10/nexus-sdk/fields";
+import { useIdField as useIdField7, useTextField as useTextField12, useSelectField as useSelectField11, useNumberField as useNumberField6, useSwitchField as useSwitchField3, useEmailField as useEmailField3, usePasswordField as usePasswordField2, useTextareaField as useTextareaField3, useTagsField as useTagsField2, useDatetimeField as useDatetimeField6 } from "@gzl10/nexus-sdk/fields";
 import nodemailer2 from "nodemailer";
 async function getMailConfigFromDB(ctx) {
   const configService = ctx.services["config"];
@@ -15318,12 +15160,12 @@ var init_mail_entity = __esm({
           nullable: false,
           hint: { en: "Default: SMTP_HOST env var", es: "Por defecto: variable SMTP_HOST" }
         }),
-        port: useNumberField5({
+        port: useNumberField6({
           label: { en: "Port", es: "Puerto" },
           nullable: false,
           hint: { en: "Default: SMTP_PORT env var", es: "Por defecto: variable SMTP_PORT" }
         }),
-        secure: useSwitchField4({
+        secure: useSwitchField3({
           label: { en: "TLS/SSL", es: "TLS/SSL" },
           hint: { en: "Default: SMTP_SECURE env var", es: "Por defecto: variable SMTP_SECURE" }
         }),
@@ -15526,7 +15368,7 @@ var init_mail_entity = __esm({
           meta: { searchable: true, sortable: true }
         }),
         status: {
-          ...useSelectField13({
+          ...useSelectField11({
             label: { en: "Status", es: "Estado" },
             options: [
               { value: "pending", label: { en: "Pending", es: "Pendiente" } },
@@ -15550,7 +15392,7 @@ var init_mail_entity = __esm({
           label: { en: "Error", es: "Error" },
           nullable: true
         }),
-        sent_by: useSelectField13({
+        sent_by: useSelectField11({
           label: { en: "Sent by", es: "Enviado por" },
           table: "users",
           column: "id",
@@ -16176,7 +16018,7 @@ var init_toggle_plugin_action = __esm({
 });
 
 // src/modules/plugins/plugins.entity.ts
-import { useTextField as useTextField13, useSelectField as useSelectField14, useCheckboxField as useCheckboxField5 } from "@gzl10/nexus-sdk/fields";
+import { useTextField as useTextField13, useSelectField as useSelectField12, useCheckboxField as useCheckboxField5 } from "@gzl10/nexus-sdk/fields";
 import { OFFICIAL_PLUGINS } from "@gzl10/nexus-sdk";
 var allowPluginManagement, pluginsEntity;
 var init_plugins_entity = __esm({
@@ -16218,7 +16060,7 @@ var init_plugins_entity = __esm({
           size: 20,
           nullable: false
         }),
-        category: useSelectField14({
+        category: useSelectField12({
           label: { en: "Category", es: "Categor\xEDa" },
           options: [
             { value: "content", label: { en: "Content", es: "Contenido" } },
@@ -16297,7 +16139,7 @@ var init_plugins_entity = __esm({
 
 // src/modules/plugins/plugins.routes.ts
 import { Router } from "express";
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 function createPluginRoutes(ctx) {
   const router = Router();
   let imageMap = null;
@@ -16305,7 +16147,7 @@ function createPluginRoutes(ctx) {
     if (!imageMap) {
       const discovered = await ctx.core.plugins.discover();
       imageMap = new Map(
-        discovered.filter((p) => p.image && existsSync9(p.image)).map((p) => [p.code, p.image])
+        discovered.filter((p) => p.image && existsSync10(p.image)).map((p) => [p.code, p.image])
       );
     }
     return imageMap;
@@ -16360,7 +16202,7 @@ var init_plugins = __esm({
 import {
   useIdField as useIdField8,
   useTextField as useTextField14,
-  useSelectField as useSelectField15,
+  useSelectField as useSelectField13,
   useTextareaField as useTextareaField4,
   useJsonField as useJsonField3,
   useDatetimeField as useDatetimeField7,
@@ -16402,7 +16244,7 @@ var init_audit_entity = __esm({
           }),
           validation: { min: 1, max: 100 }
         },
-        actor_id: useSelectField15({
+        actor_id: useSelectField13({
           label: { en: "Actor", es: "Actor" },
           table: "users",
           column: "id",
@@ -16679,6 +16521,7 @@ import jwt3 from "jsonwebtoken";
 var init_jwt = __esm({
   "src/core/jwt/index.ts"() {
     "use strict";
+    init_secret_resolver();
   }
 });
 
@@ -17090,6 +16933,7 @@ var init_socket = __esm({
     "use strict";
     init_emitter();
     init_logger();
+    init_secret_resolver();
     io = null;
     userSockets = /* @__PURE__ */ new Map();
     socketUsers = /* @__PURE__ */ new Map();
@@ -17283,8 +17127,8 @@ var init_port_check = __esm({
 });
 
 // src/db/seed-runner.ts
-import { existsSync as existsSync10 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { join as join13 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 var init_seed_runner = __esm({
   "src/db/seed-runner.ts"() {
@@ -18309,7 +18153,7 @@ var init_migration_helpers = __esm({
 // src/db/migration-generator.ts
 import path2 from "path";
 import fs2 from "fs/promises";
-import { readFileSync as readFileSync7, mkdirSync as mkdirSync5, realpathSync } from "fs";
+import { readFileSync as readFileSync8, mkdirSync as mkdirSync5, realpathSync } from "fs";
 function getColumnIndexBytes(field) {
   if (!field?.db) return 255 * MYSQL_BYTES_PER_CHAR;
   const size = field.db.size ?? 255;
@@ -18401,7 +18245,7 @@ function resolvePrefix(scope) {
 function detectDefaultScope() {
   try {
     const pkgPath = path2.join(getProjectPath(), "package.json");
-    const pkg3 = JSON.parse(readFileSync7(pkgPath, "utf-8"));
+    const pkg3 = JSON.parse(readFileSync8(pkgPath, "utf-8"));
     const pkgName = pkg3?.name;
     if (pkgName === "@gzl10/nexus-backend") {
       return "core";
@@ -19190,7 +19034,7 @@ var init_db = __esm({
 // src/core/tunnel.ts
 import { spawn, execSync } from "child_process";
 import { writeFileSync as writeFileSync2, unlinkSync as unlinkSync2 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 import { tmpdir } from "os";
 function stopTunnel() {
   if (tunnelProcess) {
@@ -19294,6 +19138,7 @@ async function stop() {
     resetConfigCache();
     clearCustomCaslRules();
     clearSeedPermissions();
+    _resetSecretResolver();
     await resetServeSPA();
     return;
   }
@@ -19329,6 +19174,7 @@ async function stop() {
   resetConfigCache();
   clearCustomCaslRules();
   clearSeedPermissions();
+  _resetSecretResolver();
   await resetServeSPA();
   currentConfig = void 0;
   server = null;
@@ -19389,6 +19235,7 @@ var init_server = __esm({
     init_ensure_system_tables();
     init_load_config();
     init_tunnel();
+    init_secret_resolver();
     server = null;
     gracefulShutdownRegistered = false;
     setupGracefulShutdown();
@@ -19444,10 +19291,11 @@ var init_hash = __esm({
 });
 
 // src/core/crypto/symmetric.ts
-import { createCipheriv, createDecipheriv, randomBytes as randomBytes2, hkdfSync } from "crypto";
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes3, hkdfSync } from "crypto";
 var init_symmetric = __esm({
   "src/core/crypto/symmetric.ts"() {
     "use strict";
+    init_secret_resolver();
   }
 });
 
@@ -19559,6 +19407,13 @@ var init_events_api = __esm({
   }
 });
 
+// src/engine/capabilities-registry.ts
+var init_capabilities_registry = __esm({
+  "src/engine/capabilities-registry.ts"() {
+    "use strict";
+  }
+});
+
 // src/engine/context.ts
 import { ForbiddenError as CASLForbiddenError3, subject } from "@casl/ability";
 import { DEFAULT_TENANT_ID as DEFAULT_TENANT_ID2, DEFAULT_LOCALES as DEFAULT_LOCALES2 } from "@gzl10/nexus-sdk";
@@ -19585,6 +19440,7 @@ var init_context = __esm({
     init_plugin_ops();
     init_load_config();
     init_events_api();
+    init_capabilities_registry();
     init_seed_runner();
     init_cache_manager();
     sharedCacheManager = null;
@@ -19603,6 +19459,7 @@ var init_engine = __esm({
     init_subject_extractor();
     init_definition_extractors();
     init_context();
+    init_capabilities_registry();
   }
 });
 
@@ -19620,8 +19477,8 @@ __export(migrate_commands_exports, {
   handleUp: () => handleUp,
   loadModulesForMigration: () => loadModulesForMigration
 });
-import { readFileSync as readFileSync8, existsSync as existsSync11 } from "fs";
-import { join as join14 } from "path";
+import { readFileSync as readFileSync9, existsSync as existsSync12 } from "fs";
+import { join as join15 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 import Table from "cli-table3";
 import { consola as consola2 } from "consola";
@@ -19631,15 +19488,15 @@ function scopeToSourceId(scope) {
 }
 async function loadSelfPlugin() {
   const projectPath2 = getProjectPath();
-  const pkgPath = join14(projectPath2, "package.json");
-  if (!existsSync11(pkgPath)) return;
+  const pkgPath = join15(projectPath2, "package.json");
+  if (!existsSync12(pkgPath)) return;
   try {
-    const pkg3 = JSON.parse(readFileSync8(pkgPath, "utf-8"));
+    const pkg3 = JSON.parse(readFileSync9(pkgPath, "utf-8"));
     const pkgName = pkg3?.name;
     if (!pkgName || !/nexus-plugin-/.test(pkgName)) return;
-    const srcEntry = join14(projectPath2, "src", "index.ts");
-    const distEntry = join14(projectPath2, "dist", "index.js");
-    if (existsSync11(srcEntry)) {
+    const srcEntry = join15(projectPath2, "src", "index.ts");
+    const distEntry = join15(projectPath2, "dist", "index.js");
+    if (existsSync12(srcEntry)) {
       try {
         const { tsImport } = await import("tsx/esm/api");
         const mod = await tsImport(
@@ -19649,7 +19506,7 @@ async function loadSelfPlugin() {
         const manifest = extractPluginManifest(mod);
         if (manifest) {
           if (!manifest.migrationsDir) {
-            manifest.migrationsDir = join14(projectPath2, "migrations");
+            manifest.migrationsDir = join15(projectPath2, "migrations");
           }
           registerPlugin(manifest);
           return;
@@ -19658,13 +19515,13 @@ async function loadSelfPlugin() {
         console.error(`  \u26A0 Failed to load plugin src/index.ts: ${err.message}`);
       }
     }
-    if (existsSync11(distEntry)) {
+    if (existsSync12(distEntry)) {
       try {
         const mod = await import(pathToFileURL3(distEntry).href);
         const manifest = extractPluginManifest(mod);
         if (manifest) {
           if (!manifest.migrationsDir) {
-            manifest.migrationsDir = join14(projectPath2, "migrations");
+            manifest.migrationsDir = join15(projectPath2, "migrations");
           }
           registerPlugin(manifest);
           return;
@@ -19983,7 +19840,7 @@ __export(db_commands_exports, {
   handleDbWipe: () => handleDbWipe
 });
 import { spawn as spawn2 } from "child_process";
-import { isAbsolute as isAbsolute3, join as join15 } from "path";
+import { isAbsolute as isAbsolute3, join as join16 } from "path";
 import { statSync as statSync2 } from "fs";
 import { consola as consola3 } from "consola";
 async function handleDbWipe(options) {
@@ -20071,7 +19928,7 @@ function handleDbShell() {
   if (dbType === "sqlite") {
     let filename = url.replace(/^(file:|sqlite:)/, "");
     if (!isAbsolute3(filename)) {
-      filename = join15(getProjectPath(), "data", filename);
+      filename = join16(getProjectPath(), "data", filename);
     }
     cmd = "sqlite3";
     args = [filename];
@@ -20116,7 +19973,7 @@ async function collectDbInfo() {
       if (url !== ":memory:" && !url.includes(":memory:")) {
         let filename = url.replace(/^(file:|sqlite:)/, "");
         if (!isAbsolute3(filename)) {
-          filename = join15(getProjectPath(), "data", filename);
+          filename = join16(getProjectPath(), "data", filename);
         }
         try {
           const stat2 = statSync2(filename);
@@ -20173,8 +20030,8 @@ __export(plugin_commands_exports, {
   handlePluginList: () => handlePluginList,
   handlePluginRemove: () => handlePluginRemove
 });
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync10 } from "fs";
+import { join as join17 } from "path";
 import Table2 from "cli-table3";
 import { consola as consola4 } from "consola";
 import { OFFICIAL_PLUGINS as OFFICIAL_PLUGINS2 } from "@gzl10/nexus-sdk";
@@ -20182,10 +20039,10 @@ function pluginLabel(name) {
   return shortPluginName(name).split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
 }
 function readPluginVersion(projectPath2, pkgName) {
-  const pkgJsonPath = join16(projectPath2, "node_modules", pkgName, "package.json");
-  if (!existsSync12(pkgJsonPath)) return null;
+  const pkgJsonPath = join17(projectPath2, "node_modules", pkgName, "package.json");
+  if (!existsSync13(pkgJsonPath)) return null;
   try {
-    const pkg3 = JSON.parse(readFileSync9(pkgJsonPath, "utf-8"));
+    const pkg3 = JSON.parse(readFileSync10(pkgJsonPath, "utf-8"));
     return pkg3.version ?? null;
   } catch {
     return null;
@@ -20471,19 +20328,19 @@ var sync_commands_exports = {};
 __export(sync_commands_exports, {
   handleSyncCommands: () => handleSyncCommands
 });
-import { existsSync as existsSync13, mkdirSync as mkdirSync6, readdirSync as readdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync3 } from "fs";
-import { join as join17, basename as basename4 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync6, readdirSync as readdirSync2, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "fs";
+import { join as join18, basename as basename4 } from "path";
 import { homedir } from "os";
 import { createConsola } from "consola";
 async function handleSyncCommands(options) {
-  const sourceDir = join17(getLibPath(), "claude-commands");
-  const targetDir = join17(homedir(), ".claude", "commands");
-  if (!existsSync13(sourceDir)) {
+  const sourceDir = join18(getLibPath(), "claude-commands");
+  const targetDir = join18(homedir(), ".claude", "commands");
+  if (!existsSync14(sourceDir)) {
     logger2.warn(`Commands source not found: ${sourceDir}`);
     logger2.info("Make sure @gzl10/nexus-backend is properly installed.");
     return;
   }
-  if (!existsSync13(targetDir)) {
+  if (!existsSync14(targetDir)) {
     if (options.dryRun) {
       logger2.info(`Would create: ${targetDir}`);
     } else {
@@ -20498,16 +20355,16 @@ async function handleSyncCommands(options) {
   }
   const result = { added: [], updated: [], unchanged: [] };
   for (const file of sourceFiles) {
-    const sourcePath = join17(sourceDir, file);
-    const targetPath = join17(targetDir, file);
-    const sourceContent = readFileSync10(sourcePath, "utf-8");
-    if (!existsSync13(targetPath)) {
+    const sourcePath = join18(sourceDir, file);
+    const targetPath = join18(targetDir, file);
+    const sourceContent = readFileSync11(sourcePath, "utf-8");
+    if (!existsSync14(targetPath)) {
       if (!options.dryRun) {
         writeFileSync3(targetPath, sourceContent, "utf-8");
       }
       result.added.push(file);
     } else {
-      const targetContent = readFileSync10(targetPath, "utf-8");
+      const targetContent = readFileSync11(targetPath, "utf-8");
       if (sourceContent !== targetContent) {
         if (!options.dryRun) {
           writeFileSync3(targetPath, sourceContent, "utf-8");
@@ -20553,8 +20410,8 @@ __export(seed_commands_exports, {
   handleSeedExport: () => handleSeedExport,
   importSeedFiles: () => importSeedFiles
 });
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, writeFileSync as writeFileSync4, readdirSync as readdirSync3, readFileSync as readFileSync11 } from "fs";
-import { join as join18, basename as basename5 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync7, writeFileSync as writeFileSync4, readdirSync as readdirSync3, readFileSync as readFileSync12 } from "fs";
+import { join as join19, basename as basename5 } from "path";
 import { consola as consola5 } from "consola";
 function deserializeJsonFields(record, fields) {
   const result = { ...record };
@@ -20583,7 +20440,7 @@ async function handleSeedExport(entity) {
   const db3 = getDb();
   try {
     const modules = getOrderedModules();
-    const seedDir = join18(getProjectPath(), "data", "seeds");
+    const seedDir = join19(getProjectPath(), "data", "seeds");
     const seedableEntities = [];
     for (const mod of modules) {
       for (const def of mod.definitions ?? []) {
@@ -20604,7 +20461,7 @@ async function handleSeedExport(entity) {
       }
       return;
     }
-    if (!existsSync14(seedDir)) {
+    if (!existsSync15(seedDir)) {
       mkdirSync7(seedDir, { recursive: true });
     }
     for (const { module: modName, table, fields } of seedableEntities) {
@@ -20616,7 +20473,7 @@ async function handleSeedExport(entity) {
       const exported = rows.map(
         (row) => deserializeJsonFields(row, fields)
       );
-      const filePath = join18(seedDir, `${table}.json`);
+      const filePath = join19(seedDir, `${table}.json`);
       writeFileSync4(filePath, JSON.stringify(exported, null, 2) + "\n", "utf-8");
       consola5.success(`${table}: exported ${rows.length} records to data/seeds/${table}.json (module: ${modName})`);
     }
@@ -20628,8 +20485,8 @@ async function handleSeedExport(entity) {
   }
 }
 async function importSeedFiles(db3, modules, logger3) {
-  const seedDir = join18(getProjectPath(), "data", "seeds");
-  if (!existsSync14(seedDir)) return;
+  const seedDir = join19(getProjectPath(), "data", "seeds");
+  if (!existsSync15(seedDir)) return;
   const files = readdirSync3(seedDir).filter((f) => f.endsWith(".json"));
   if (files.length === 0) return;
   const seedableDefs = /* @__PURE__ */ new Map();
@@ -20650,8 +20507,8 @@ async function importSeedFiles(db3, modules, logger3) {
       logger3.debug(`data/seeds/${file}: skipped (entity "${table}" is not seedable)`);
       continue;
     }
-    const filePath = join18(seedDir, file);
-    const raw = readFileSync11(filePath, "utf-8");
+    const filePath = join19(seedDir, file);
+    const raw = readFileSync12(filePath, "utf-8");
     let records;
     try {
       records = JSON.parse(raw);
@@ -20698,12 +20555,12 @@ if (!nodeEnv || nodeEnv === "development") {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname8, join as join19 } from "path";
+import { dirname as dirname8, join as join20 } from "path";
 import { Command } from "commander";
 var __dirname2 = dirname8(fileURLToPath3(import.meta.url));
-var pkg2 = JSON.parse(readFileSync12(join19(__dirname2, "..", "package.json"), "utf-8"));
+var pkg2 = JSON.parse(readFileSync13(join20(__dirname2, "..", "package.json"), "utf-8"));
 var program = new Command();
 program.name("nexus").description("Nexus Backend CLI").version(pkg2.version);
 program.command("info").description("Show Nexus environment, database, plugins, and paths").option("--json", "Output as JSON").action(async (options) => {