@kyro-cms/core 0.1.6 → 0.1.7

package/dist/chunk-LIJVWQKU.cjs

@@ -0,0 +1,256 @@
+'use strict';
+
+var chunk7YITG2US_cjs = require('./chunk-7YITG2US.cjs');
+var drizzleOrm = require('drizzle-orm');
+var bcrypt = require('bcryptjs');
+var crypto$1 = require('crypto');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var bcrypt__default = /*#__PURE__*/_interopDefault(bcrypt);
+
+var PostgresAuthAdapter = class {
+  db;
+  prefix;
+  sessionTTL;
+  refreshTokenTTL;
+  constructor(options) {
+    this.db = options.db;
+    this.prefix = options.prefix || "kyro:";
+    this.sessionTTL = options.sessionTTL || 86400;
+    this.refreshTokenTTL = options.refreshTokenTTL || 604800;
+  }
+  async createUser(data) {
+    const passwordHash = await this.hashPassword(data.password);
+    const [user] = await this.db.insert(chunk7YITG2US_cjs.users).values({
+      email: data.email.toLowerCase(),
+      passwordHash,
+      role: data.role || "customer",
+      tenantId: data.tenantId
+    }).returning();
+    return this.userToAuthUser(user);
+  }
+  async findUserByEmail(email) {
+    const [user] = await this.db.select().from(chunk7YITG2US_cjs.users).where(drizzleOrm.eq(chunk7YITG2US_cjs.users.email, email.toLowerCase())).limit(1);
+    return user ? this.userToAuthUser(user) : null;
+  }
+  async findUserById(id) {
+    const [user] = await this.db.select().from(chunk7YITG2US_cjs.users).where(drizzleOrm.eq(chunk7YITG2US_cjs.users.id, id)).limit(1);
+    return user ? this.userToAuthUser(user) : null;
+  }
+  async updateUser(id, data) {
+    const dbData = { updatedAt: /* @__PURE__ */ new Date() };
+    if (data.email !== void 0) dbData.email = data.email;
+    if (data.passwordHash !== void 0)
+      dbData.passwordHash = data.passwordHash;
+    if (data.role !== void 0) dbData.role = data.role;
+    if (data.tenantId !== void 0) dbData.tenantId = data.tenantId;
+    if (data.emailVerified !== void 0)
+      dbData.emailVerified = data.emailVerified;
+    if (data.locked !== void 0) dbData.locked = data.locked;
+    if (data.lastLogin !== void 0)
+      dbData.lastLogin = data.lastLogin ? new Date(data.lastLogin) : null;
+    if (data.failedLoginAttempts !== void 0)
+      dbData.failedLoginAttempts = data.failedLoginAttempts;
+    const [user] = await this.db.update(chunk7YITG2US_cjs.users).set(dbData).where(drizzleOrm.eq(chunk7YITG2US_cjs.users.id, id)).returning();
+    return user ? this.userToAuthUser(user) : null;
+  }
+  async deleteUser(id) {
+    await this.db.delete(chunk7YITG2US_cjs.users).where(drizzleOrm.eq(chunk7YITG2US_cjs.users.id, id));
+    return true;
+  }
+  async verifyPassword(email, password) {
+    const user = await this.findUserByEmail(email);
+    if (!user) return null;
+    const [stored] = await this.db.select().from(chunk7YITG2US_cjs.users).where(drizzleOrm.eq(chunk7YITG2US_cjs.users.email, email.toLowerCase())).limit(1);
+    if (!stored?.passwordHash) return null;
+    const valid = await bcrypt__default.default.compare(password, stored.passwordHash);
+    return valid ? user : null;
+  }
+  async hashPassword(password) {
+    return bcrypt__default.default.hash(password, 12);
+  }
+  async createSession(userId, data) {
+    const token = crypto$1.randomBytes(32).toString("base64url");
+    const refreshToken = crypto$1.randomBytes(32).toString("base64url");
+    const expiresAt = new Date(Date.now() + this.sessionTTL * 1e3);
+    new Date(Date.now() + this.refreshTokenTTL * 1e3);
+    const [session] = await this.db.insert(chunk7YITG2US_cjs.sessions).values({
+      userId,
+      token,
+      refreshToken,
+      ipAddress: data?.ipAddress,
+      userAgent: data?.userAgent,
+      expiresAt
+    }).returning();
+    return this.sessionToSession(session);
+  }
+  async findSessionByToken(token) {
+    const [session] = await this.db.select().from(chunk7YITG2US_cjs.sessions).where(drizzleOrm.and(drizzleOrm.eq(chunk7YITG2US_cjs.sessions.token, token), drizzleOrm.gt(chunk7YITG2US_cjs.sessions.expiresAt, /* @__PURE__ */ new Date()))).limit(1);
+    return session ? this.sessionToSession(session) : null;
+  }
+  async deleteSession(sessionId) {
+    await this.db.delete(chunk7YITG2US_cjs.sessions).where(drizzleOrm.eq(chunk7YITG2US_cjs.sessions.id, sessionId));
+    return true;
+  }
+  async deleteUserSessions(userId) {
+    await this.db.delete(chunk7YITG2US_cjs.sessions).where(drizzleOrm.eq(chunk7YITG2US_cjs.sessions.userId, userId));
+    return 1;
+  }
+  async addPasswordToHistory(userId, passwordHash) {
+    await this.db.insert(chunk7YITG2US_cjs.passwordHistory).values({
+      userId,
+      passwordHash
+    });
+  }
+  async getPasswordHistory(userId, count = 5) {
+    const history = await this.db.select({ passwordHash: chunk7YITG2US_cjs.passwordHistory.passwordHash }).from(chunk7YITG2US_cjs.passwordHistory).where(drizzleOrm.eq(chunk7YITG2US_cjs.passwordHistory.userId, userId)).orderBy(drizzleOrm.desc(chunk7YITG2US_cjs.passwordHistory.createdAt)).limit(count);
+    return history.map((h) => h.passwordHash);
+  }
+  async isPasswordInHistory(password, userId, historyCount = 5) {
+    const history = await this.getPasswordHistory(userId, historyCount);
+    for (const hash of history) {
+      if (await this.verifyPassword(password, hash)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  async isLocked(userId) {
+    const [lockout] = await this.db.select().from(chunk7YITG2US_cjs.lockouts).where(
+      drizzleOrm.and(drizzleOrm.eq(chunk7YITG2US_cjs.lockouts.userId, userId), drizzleOrm.gt(chunk7YITG2US_cjs.lockouts.lockedUntil, /* @__PURE__ */ new Date()))
+    ).limit(1);
+    return !!lockout;
+  }
+  async getLockout(userId) {
+    const [lockout] = await this.db.select().from(chunk7YITG2US_cjs.lockouts).where(
+      drizzleOrm.and(drizzleOrm.eq(chunk7YITG2US_cjs.lockouts.userId, userId), drizzleOrm.gt(chunk7YITG2US_cjs.lockouts.lockedUntil, /* @__PURE__ */ new Date()))
+    ).limit(1);
+    return lockout ? { lockedUntil: lockout.lockedUntil } : null;
+  }
+  async recordFailedAttempt(userId, ipAddress) {
+    const user = await this.findUserById(userId);
+    const attempts = (user?.failedLoginAttempts || 0) + 1;
+    await this.updateUser(userId, { failedLoginAttempts: attempts });
+    const maxAttempts = 5;
+    const locked = attempts >= maxAttempts;
+    if (locked) {
+      const lockoutDuration = 15 * 60 * 1e3;
+      await this.db.insert(chunk7YITG2US_cjs.lockouts).values({
+        userId,
+        ipAddress,
+        reason: "Too many failed login attempts",
+        lockedUntil: new Date(Date.now() + lockoutDuration)
+      });
+    }
+    return { attempts, locked };
+  }
+  async resetAttempts(userId) {
+    await this.updateUser(userId, { failedLoginAttempts: 0 });
+  }
+  async findAuditLogs(filter) {
+    const {
+      limit = 50,
+      offset = 0,
+      userId,
+      action,
+      resource,
+      resourceId,
+      success,
+      startDate,
+      endDate
+    } = filter;
+    const conditions = [];
+    if (userId) conditions.push(drizzleOrm.eq(chunk7YITG2US_cjs.auditLogs.userId, userId));
+    if (action) {
+      if (Array.isArray(action)) {
+        conditions.push(drizzleOrm.sql`${chunk7YITG2US_cjs.auditLogs.action} = ANY(${action})`);
+      } else {
+        conditions.push(drizzleOrm.eq(chunk7YITG2US_cjs.auditLogs.action, action));
+      }
+    }
+    if (resource) conditions.push(drizzleOrm.eq(chunk7YITG2US_cjs.auditLogs.resource, resource));
+    if (resourceId) conditions.push(drizzleOrm.eq(chunk7YITG2US_cjs.auditLogs.resourceId, resourceId));
+    if (success !== void 0) conditions.push(drizzleOrm.eq(chunk7YITG2US_cjs.auditLogs.success, success));
+    if (startDate) conditions.push(drizzleOrm.sql`${chunk7YITG2US_cjs.auditLogs.timestamp} >= ${startDate}`);
+    if (endDate) conditions.push(drizzleOrm.sql`${chunk7YITG2US_cjs.auditLogs.timestamp} <= ${endDate}`);
+    const whereClause = conditions.length > 0 ? drizzleOrm.and(...conditions) : void 0;
+    const countResult = await this.db.select({ count: drizzleOrm.sql`count(*)` }).from(chunk7YITG2US_cjs.auditLogs).where(whereClause);
+    const logs = await this.db.select().from(chunk7YITG2US_cjs.auditLogs).where(whereClause).orderBy(drizzleOrm.desc(chunk7YITG2US_cjs.auditLogs.timestamp)).limit(limit).offset(offset);
+    return {
+      logs: logs.map((log) => ({
+        id: log.id,
+        timestamp: log.timestamp,
+        action: log.action,
+        userId: log.userId || void 0,
+        userEmail: log.userEmail || void 0,
+        role: log.role || void 0,
+        resource: log.resource,
+        resourceId: log.resourceId || void 0,
+        changes: log.changes || void 0,
+        ipAddress: log.ipAddress || void 0,
+        userAgent: log.userAgent || void 0,
+        success: log.success,
+        error: log.error || void 0,
+        metadata: log.metadata || void 0
+      })),
+      total: Number(countResult[0]?.count || 0)
+    };
+  }
+  async createAuditLog(data) {
+    const id = crypto.randomUUID();
+    const timestamp = /* @__PURE__ */ new Date();
+    await this.db.insert(chunk7YITG2US_cjs.auditLogs).values({
+      id,
+      action: data.action,
+      userId: data.userId,
+      userEmail: data.userEmail,
+      role: data.role,
+      resource: data.resource,
+      resourceId: data.resourceId,
+      changes: data.changes,
+      ipAddress: data.ipAddress,
+      userAgent: data.userAgent,
+      success: data.success,
+      error: data.error,
+      metadata: data.metadata,
+      timestamp
+    });
+    return {
+      ...data,
+      id,
+      timestamp
+    };
+  }
+  userToAuthUser(user) {
+    return {
+      id: user.id,
+      email: user.email,
+      passwordHash: user.passwordHash || void 0,
+      role: user.role,
+      tenantId: user.tenantId || void 0,
+      emailVerified: user.emailVerified || false,
+      locked: user.locked || false,
+      lastLogin: user.lastLogin?.toISOString(),
+      failedLoginAttempts: user.failedLoginAttempts || 0,
+      createdAt: user.createdAt.toISOString(),
+      updatedAt: user.updatedAt.toISOString()
+    };
+  }
+  sessionToSession(session) {
+    return {
+      id: session.id,
+      userId: session.userId,
+      token: session.token,
+      refreshToken: session.refreshToken || void 0,
+      expiresAt: session.expiresAt.toISOString(),
+      createdAt: session.createdAt.toISOString(),
+      ipAddress: session.ipAddress || void 0,
+      userAgent: session.userAgent || void 0
+    };
+  }
+};
+
+exports.PostgresAuthAdapter = PostgresAuthAdapter;
+//# sourceMappingURL=chunk-LIJVWQKU.cjs.map
+//# sourceMappingURL=chunk-LIJVWQKU.cjs.map

package/dist/chunk-LIJVWQKU.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/database/drizzle/postgres-auth-adapter.ts"],"names":["users","eq","bcrypt","randomBytes","sessions","and","gt","passwordHistory","desc","lockouts","auditLogs","sql"],"mappings":";;;;;;;;;;;AA8BO,IAAM,sBAAN,MAAiD;AAAA,EAC9C,EAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,eAAA;AAAA,EAER,YAAY,OAAA,EAAqC;AAC/C,IAAA,IAAA,CAAK,KAAK,OAAA,CAAQ,EAAA;AAClB,IAAA,IAAA,CAAK,MAAA,GAAS,QAAQ,MAAA,IAAU,OAAA;AAChC,IAAA,IAAA,CAAK,UAAA,GAAa,QAAQ,UAAA,IAAc,KAAA;AACxC,IAAA,IAAA,CAAK,eAAA,GAAkB,QAAQ,eAAA,IAAmB,MAAA;AAAA,EACpD;AAAA,EAEA,MAAM,WAAW,IAAA,EAKK;AACpB,IAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,YAAA,CAAa,KAAK,QAAQ,CAAA;AAC1D,IAAA,MAAM,CAAC,IAAI,CAAA,GAAI,MAAM,KAAK,EAAA,CACvB,MAAA,CAAOA,uBAAK,CAAA,CACZ,MAAA,CAAO;AAAA,MACN,KAAA,EAAO,IAAA,CAAK,KAAA,CAAM,WAAA,EAAY;AAAA,MAC9B,YAAA;AAAA,MACA,IAAA,EAAO,KAAK,IAAA,IAAQ,UAAA;AAAA,MACpB,UAAU,IAAA,CAAK;AAAA,KAChB,EACA,SAAA,EAAU;AAEb,IAAA,OAAO,IAAA,CAAK,eAAe,IAAI,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,gBAAgB,KAAA,EAAyC;AAC7D,IAAA,MAAM,CAAC,IAAI,CAAA,GAAI,MAAM,KAAK,EAAA,CACvB,MAAA,GACA,IAAA,CAAKA,uBAAK,EACV,KAAA,CAAMC,aAAA,CAAGD,wBAAM,KAAA,EAAO,KAAA,CAAM,aAAa,CAAC,CAAA,CAC1C,KAAA,CAAM,CAAC,CAAA;AAEV,IAAA,OAAO,IAAA,GAAO,IAAA,CAAK,cAAA,CAAe,IAAI,CAAA,GAAI,IAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,aAAa,EAAA,EAAsC;AACvD,IAAA,MAAM,CAAC,IAAI,CAAA,GAAI,MAAM,IAAA,CAAK,EAAA,CACvB,QAAO,CACP,IAAA,CAAKA,uBAAK,CAAA,CACV,KAAA,CAAMC,cAAGD,uBAAA,CAAM,EAAA,EAAI,EAAE,CAAC,CAAA,CACtB,MAAM,CAAC,CAAA;AAEV,IAAA,OAAO,IAAA,GAAO,IAAA,CAAK,cAAA,CAAe,IAAI,CAAA,GAAI,IAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,UAAA,CACJ,EAAA,EACA,IAAA,EAC0B;AAC1B,IAAA,MAAM,MAAA,GAAkC,EAAE,SAAA,kBAAW,IAAI,MAAK,EAAE;AAChE,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,EAAW,MAAA,CAAO,QAAQ,IAAA,CAAK,KAAA;AAClD,IAAA,IAAI,KAAK,YAAA,KAAiB,MAAA;AACxB,MAAA,MAAA,CAAO,eAAe,IAAA,CAAK,YAAA;AAC7B,IAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,EAAW,MAAA,CAAO,OAAO,IAAA,CAAK,IAAA;AAChD,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,MAAA,EAAW,MAAA,CAAO,WAAW,IAAA,CAAK,QAAA;AACxD,IAAA,IAAI,KAAK,aAAA,KAAkB,MAAA;AACzB,MAAA,MAAA,CAAO,gBAAgB,IAAA,CAAK,aAAA;AAC9B,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,MAAA,EAAW,MAAA,CAAO,SAAS,IAAA,CAAK,MAAA;AACpD,IAAA,IAAI,KAAK,SAAA,KAAc,MAAA;AACrB,MAAA,MAAA,CAAO,YAAY,IAAA,CAAK,SAAA,GAAY,IAAI,IAAA,CAAK,IAAA,CAAK,SAAS,CAAA,GAAI,IAAA;AACjE,IAAA,IAAI,KAAK,mBAAA,KAAwB,MAAA;AAC/B,MAAA,MAAA,CAAO,sBAAsB,IAAA,CAAK,mBAAA;AAEpC,IAAA,MAAM,CAAC,IAAI,CAAA,GAAI,MAAM,IAAA,CAAK,EAAA,CACvB,OAAOA,uBAAK,CAAA,CACZ,IAAI,MAAM,CAAA,CACV,MAAMC,aAAA,CAAGD,uBAAA,CAAM,IAAI,EAAE,CAAC,EACtB,SAAA,EAAU;AAEb,IAAA,OAAO,IAAA,GAAO,IAAA,CAAK,cAAA,CAAe,IAAI,CAAA,GAAI,IAAA;AAAA,EAC5C;AAAA,EAEA,MAAM,WAAW,EAAA,EAA8B;AAC7C,IAAA,MAAM,IAAA,CAAK,EAAA,CAAG,MAAA,CAAOA,uBAAK,CAAA,CAAE,MAAMC,aAAA,CAAGD,uBAAA,CAAM,EAAA,EAAI,EAAE,CAAC,CAAA;AAClD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,cAAA,CACJ,KAAA,EACA,QAAA,EAC0B;AAC1B,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,eAAA,CAAgB,KAAK,CAAA;AAC7C,IAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,IAAA,MAAM,CAAC,MAAM,CAAA,GAAI,MAAM,KAAK,EAAA,CACzB,MAAA,GACA,IAAA,CAAKA,uBAAK,EACV,KAAA,CAAMC,aAAA,CAAGD,wBAAM,KAAA,EAAO,KAAA,CAAM,aAAa,CAAC,CAAA,CAC1C,KAAA,CAAM,CAAC,CAAA;AACV,IAAA,IAAI,CAAC,MAAA,EAAQ,YAAA,EAAc,OAAO,IAAA;AAClC,IAAA,MAAM,QAAQ,MAAME,uBAAA,CAAO,OAAA,CAAQ,QAAA,EAAU,OAAO,YAAY,CAAA;AAChE,IAAA,OAAO,QAAQ,IAAA,GAAO,IAAA;AAAA,EACxB;AAAA,EAEA,MAAM,aAAa,QAAA,EAAmC;AACpD,IAAA,OAAOA,uBAAA,CAAO,IAAA,CAAK,QAAA,EAAU,EAAE,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,aAAA,CACJ,MAAA,EACA,IAAA,EACkB;AAClB,IAAA,MAAM,KAAA,GAAQC,oBAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AAClD,IAAA,MAAM,YAAA,GAAeA,oBAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AACzD,IAAA,MAAM,SAAA,GAAY,IAAI,IAAA,CAAK,IAAA,CAAK,KAAI,GAAI,IAAA,CAAK,aAAa,GAAI,CAAA;AAC9D,IAAyB,IAAI,IAAA,CAAK,IAAA,CAAK,KAAI,GAAI,IAAA,CAAK,kBAAkB,GAAI;AAE1E,IAAA,MAAM,CAAC,OAAO,CAAA,GAAI,MAAM,KAAK,EAAA,CAC1B,MAAA,CAAOC,0BAAQ,CAAA,CACf,MAAA,CAAO;AAAA,MACN,MAAA;AAAA,MACA,KAAA;AAAA,MACA,YAAA;AAAA,MACA,WAAW,IAAA,EAAM,SAAA;AAAA,MACjB,WAAW,IAAA,EAAM,SAAA;AAAA,MACjB;AAAA,KACD,EACA,SAAA,EAAU;AAEb,IAAA,OAAO,IAAA,CAAK,iBAAiB,OAAO,CAAA;AAAA,EACtC;AAAA,EAEA,MAAM,mBAAmB,KAAA,EAAwC;AAC/D,IAAA,MAAM,CAAC,OAAO,CAAA,GAAI,MAAM,IAAA,CAAK,EAAA,CAC1B,MAAA,EAAO,CACP,IAAA,CAAKA,0BAAQ,CAAA,CACb,KAAA,CAAMC,cAAA,CAAIJ,aAAA,CAAGG,0BAAA,CAAS,KAAA,EAAO,KAAK,CAAA,EAAGE,aAAA,CAAGF,0BAAA,CAAS,SAAA,kBAAW,IAAI,IAAA,EAAM,CAAC,CAAC,CAAA,CACxE,KAAA,CAAM,CAAC,CAAA;AAEV,IAAA,OAAO,OAAA,GAAU,IAAA,CAAK,gBAAA,CAAiB,OAAO,CAAA,GAAI,IAAA;AAAA,EACpD;AAAA,EAEA,MAAM,cAAc,SAAA,EAAqC;AACvD,IAAA,MAAM,IAAA,CAAK,EAAA,CAAG,MAAA,CAAOA,0BAAQ,CAAA,CAAE,MAAMH,aAAA,CAAGG,0BAAA,CAAS,EAAA,EAAI,SAAS,CAAC,CAAA;AAC/D,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,mBAAmB,MAAA,EAAiC;AACxD,IAAA,MAAM,IAAA,CAAK,EAAA,CAAG,MAAA,CAAOA,0BAAQ,CAAA,CAAE,MAAMH,aAAA,CAAGG,0BAAA,CAAS,MAAA,EAAQ,MAAM,CAAC,CAAA;AAChE,IAAA,OAAO,CAAA;AAAA,EACT;AAAA,EAEA,MAAM,oBAAA,CACJ,MAAA,EACA,YAAA,EACe;AACf,IAAA,MAAM,IAAA,CAAK,EAAA,CAAG,MAAA,CAAOG,iCAAe,EAAE,MAAA,CAAO;AAAA,MAC3C,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,kBAAA,CACJ,MAAA,EACA,KAAA,GAAgB,CAAA,EACG;AACnB,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,EAAA,CACxB,MAAA,CAAO,EAAE,YAAA,EAAcA,iCAAA,CAAgB,YAAA,EAAc,CAAA,CACrD,IAAA,CAAKA,iCAAe,CAAA,CACpB,KAAA,CAAMN,aAAA,CAAGM,iCAAA,CAAgB,MAAA,EAAQ,MAAM,CAAC,CAAA,CACxC,OAAA,CAAQC,eAAA,CAAKD,iCAAA,CAAgB,SAAS,CAAC,CAAA,CACvC,KAAA,CAAM,KAAK,CAAA;AAEd,IAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,YAAY,CAAA;AAAA,EAC1C;AAAA,EAEA,MAAM,mBAAA,CACJ,QAAA,EACA,MAAA,EACA,eAAuB,CAAA,EACL;AAClB,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,kBAAA,CAAmB,QAAQ,YAAY,CAAA;AAElE,IAAA,KAAA,MAAW,QAAQ,OAAA,EAAS;AAC1B,MAAA,IAAI,MAAM,IAAA,CAAK,cAAA,CAAe,QAAA,EAAU,IAAI,CAAA,EAAG;AAC7C,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,MAAA,EAAkC;AAC/C,IAAA,MAAM,CAAC,OAAO,CAAA,GAAI,MAAM,IAAA,CAAK,GAC1B,MAAA,EAAO,CACP,IAAA,CAAKE,0BAAQ,CAAA,CACb,KAAA;AAAA,MACCJ,cAAA,CAAIJ,aAAA,CAAGQ,0BAAA,CAAS,MAAA,EAAQ,MAAM,CAAA,EAAGH,aAAA,CAAGG,0BAAA,CAAS,WAAA,kBAAa,IAAI,IAAA,EAAM,CAAC;AAAA,KACvE,CACC,MAAM,CAAC,CAAA;AAEV,IAAA,OAAO,CAAC,CAAC,OAAA;AAAA,EACX;AAAA,EAEA,MAAM,WAAW,MAAA,EAAuD;AACtE,IAAA,MAAM,CAAC,OAAO,CAAA,GAAI,MAAM,IAAA,CAAK,GAC1B,MAAA,EAAO,CACP,IAAA,CAAKA,0BAAQ,CAAA,CACb,KAAA;AAAA,MACCJ,cAAA,CAAIJ,aAAA,CAAGQ,0BAAA,CAAS,MAAA,EAAQ,MAAM,CAAA,EAAGH,aAAA,CAAGG,0BAAA,CAAS,WAAA,kBAAa,IAAI,IAAA,EAAM,CAAC;AAAA,KACvE,CACC,MAAM,CAAC,CAAA;AAEV,IAAA,OAAO,OAAA,GAAU,EAAE,WAAA,EAAa,OAAA,CAAQ,aAAY,GAAI,IAAA;AAAA,EAC1D;AAAA,EAEA,MAAM,mBAAA,CACJ,MAAA,EACA,SAAA,EACgD;AAChD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,YAAA,CAAa,MAAM,CAAA;AAC3C,IAAA,MAAM,QAAA,GAAA,CAAY,IAAA,EAAM,mBAAA,IAAuB,CAAA,IAAK,CAAA;AAEpD,IAAA,MAAM,KAAK,UAAA,CAAW,MAAA,EAAQ,EAAE,mBAAA,EAAqB,UAAU,CAAA;AAE/D,IAAA,MAAM,WAAA,GAAc,CAAA;AACpB,IAAA,MAAM,SAAS,QAAA,IAAY,WAAA;AAE3B,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,MAAM,eAAA,GAAkB,KAAK,EAAA,GAAK,GAAA;AAClC,MAAA,MAAM,IAAA,CAAK,EAAA,CAAG,MAAA,CAAOA,0BAAQ,EAAE,MAAA,CAAO;AAAA,QACpC,MAAA;AAAA,QACA,SAAA;AAAA,QACA,MAAA,EAAQ,gCAAA;AAAA,QACR,aAAa,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,KAAQ,eAAe;AAAA,OACnD,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,EAAE,UAAU,MAAA,EAAO;AAAA,EAC5B;AAAA,EAEA,MAAM,cAAc,MAAA,EAA+B;AACjD,IAAA,MAAM,KAAK,UAAA,CAAW,MAAA,EAAQ,EAAE,mBAAA,EAAqB,GAAG,CAAA;AAAA,EAC1D;AAAA,EAEA,MAAM,cACJ,MAAA,EAC8C;AAC9C,IAAA,MAAM;AAAA,MACJ,KAAA,GAAQ,EAAA;AAAA,MACR,MAAA,GAAS,CAAA;AAAA,MACT,MAAA;AAAA,MACA,MAAA;AAAA,MACA,QAAA;AAAA,MACA,UAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACF,GAAI,MAAA;AAEJ,IAAA,MAAM,aAAa,EAAC;AACpB,IAAA,IAAI,QAAQ,UAAA,CAAW,IAAA,CAAKR,cAAGS,2BAAA,CAAU,MAAA,EAAQ,MAAM,CAAC,CAAA;AACxD,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACzB,QAAA,UAAA,CAAW,KAAKC,cAAA,CAAA,EAAMD,2BAAA,CAAU,MAAM,CAAA,OAAA,EAAU,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,MAC3D,CAAA,MAAO;AACL,QAAA,UAAA,CAAW,IAAA,CAAKT,aAAA,CAAGS,2BAAA,CAAU,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,MAC9C;AAAA,IACF;AACA,IAAA,IAAI,UAAU,UAAA,CAAW,IAAA,CAAKT,cAAGS,2BAAA,CAAU,QAAA,EAAU,QAAQ,CAAC,CAAA;AAC9D,IAAA,IAAI,YAAY,UAAA,CAAW,IAAA,CAAKT,cAAGS,2BAAA,CAAU,UAAA,EAAY,UAAU,CAAC,CAAA;AACpE,IAAA,IAAI,OAAA,KAAY,QAAW,UAAA,CAAW,IAAA,CAAKT,cAAGS,2BAAA,CAAU,OAAA,EAAS,OAAO,CAAC,CAAA;AACzE,IAAA,IAAI,SAAA,aAAsB,IAAA,CAAKC,cAAA,CAAA,EAAMD,4BAAU,SAAS,CAAA,IAAA,EAAO,SAAS,CAAA,CAAE,CAAA;AAC1E,IAAA,IAAI,OAAA,aAAoB,IAAA,CAAKC,cAAA,CAAA,EAAMD,4BAAU,SAAS,CAAA,IAAA,EAAO,OAAO,CAAA,CAAE,CAAA;AAEtE,IAAA,MAAM,cAAc,UAAA,CAAW,MAAA,GAAS,IAAIL,cAAA,CAAI,GAAG,UAAU,CAAA,GAAI,MAAA;AAEjE,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,EAAA,CAC5B,OAAO,EAAE,KAAA,EAAOM,cAAA,CAAA,QAAA,CAAA,EAAuB,CAAA,CACvC,IAAA,CAAKD,2BAAS,CAAA,CACd,MAAM,WAAW,CAAA;AAEpB,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,EAAA,CACrB,QAAO,CACP,IAAA,CAAKA,2BAAS,CAAA,CACd,KAAA,CAAM,WAAW,EACjB,OAAA,CAAQF,eAAA,CAAKE,4BAAU,SAAS,CAAC,EACjC,KAAA,CAAM,KAAK,CAAA,CACX,MAAA,CAAO,MAAM,CAAA;AAEhB,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,IAAA,CAAK,GAAA,CAAI,CAAC,GAAA,MAAS;AAAA,QACvB,IAAI,GAAA,CAAI,EAAA;AAAA,QACR,WAAW,GAAA,CAAI,SAAA;AAAA,QACf,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,MAAA,EAAQ,IAAI,MAAA,IAAU,MAAA;AAAA,QACtB,SAAA,EAAW,IAAI,SAAA,IAAa,MAAA;AAAA,QAC5B,IAAA,EAAM,IAAI,IAAA,IAAQ,MAAA;AAAA,QAClB,UAAU,GAAA,CAAI,QAAA;AAAA,QACd,UAAA,EAAY,IAAI,UAAA,IAAc,MAAA;AAAA,QAC9B,OAAA,EAAS,IAAI,OAAA,IAAW,MAAA;AAAA,QACxB,SAAA,EAAW,IAAI,SAAA,IAAa,MAAA;AAAA,QAC5B,SAAA,EAAW,IAAI,SAAA,IAAa,MAAA;AAAA,QAC5B,SAAS,GAAA,CAAI,OAAA;AAAA,QACb,KAAA,EAAO,IAAI,KAAA,IAAS,MAAA;AAAA,QACpB,QAAA,EAAU,IAAI,QAAA,IAAY;AAAA,OAC5B,CAAE,CAAA;AAAA,MACF,OAAO,MAAA,CAAO,WAAA,CAAY,CAAC,CAAA,EAAG,SAAS,CAAC;AAAA,KAC1C;AAAA,EACF;AAAA,EAEA,MAAM,eACJ,IAAA,EACmB;AACnB,IAAA,MAAM,EAAA,GAAK,OAAO,UAAA,EAAW;AAC7B,IAAA,MAAM,SAAA,uBAAgB,IAAA,EAAK;AAE3B,IAAA,MAAM,IAAA,CAAK,EAAA,CAAG,MAAA,CAAOA,2BAAS,EAAE,MAAA,CAAO;AAAA,MACrC,EAAA;AAAA,MACA,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,UAAU,IAAA,CAAK,QAAA;AAAA,MACf;AAAA,KACD,CAAA;AAED,IAAA,OAAO;AAAA,MACL,GAAG,IAAA;AAAA,MACH,EAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAEQ,eAAe,IAAA,EAA6B;AAClD,IAAA,OAAO;AAAA,MACL,IAAI,IAAA,CAAK,EAAA;AAAA,MACT,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,YAAA,EAAc,KAAK,YAAA,IAAgB,MAAA;AAAA,MACnC,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,QAAA,EAAU,KAAK,QAAA,IAAY,MAAA;AAAA,MAC3B,aAAA,EAAe,KAAK,aAAA,IAAiB,KAAA;AAAA,MACrC,MAAA,EAAQ,KAAK,MAAA,IAAU,KAAA;AAAA,MACvB,SAAA,EAAW,IAAA,CAAK,SAAA,EAAW,WAAA,EAAY;AAAA,MACvC,mBAAA,EAAqB,KAAK,mBAAA,IAAuB,CAAA;AAAA,MACjD,SAAA,EAAW,IAAA,CAAK,SAAA,CAAU,WAAA,EAAY;AAAA,MACtC,SAAA,EAAW,IAAA,CAAK,SAAA,CAAU,WAAA;AAAY,KACxC;AAAA,EACF;AAAA,EAEQ,iBAAiB,OAAA,EAAgD;AACvE,IAAA,OAAO;AAAA,MACL,IAAI,OAAA,CAAQ,EAAA;AAAA,MACZ,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,YAAA,EAAc,QAAQ,YAAA,IAAgB,MAAA;AAAA,MACtC,SAAA,EAAW,OAAA,CAAQ,SAAA,CAAU,WAAA,EAAY;AAAA,MACzC,SAAA,EAAW,OAAA,CAAQ,SAAA,CAAU,WAAA,EAAY;AAAA,MACzC,SAAA,EAAW,QAAQ,SAAA,IAAa,MAAA;AAAA,MAChC,SAAA,EAAW,QAAQ,SAAA,IAAa;AAAA,KAClC;AAAA,EACF;AACF","file":"chunk-LIJVWQKU.cjs","sourcesContent":["import type { PostgresJsDatabase } from \"drizzle-orm/postgres-js\";\nimport { eq, and, gt, desc, sql } from \"drizzle-orm\";\nimport bcrypt from \"bcryptjs\";\nimport { randomBytes } from \"crypto\";\nimport type {\n  AuthAdapter,\n  AuthUser,\n  Session,\n  UserRole,\n} from \"../../auth/types.js\";\nimport {\n  users,\n  sessions,\n  passwordHistory,\n  auditLogs,\n  lockouts,\n  type AuthUser as AuthUserRow,\n} from \"./schema/auth.js\";\nimport type {\n  AuditLog,\n  AuditLogFilter,\n} from \"../../auth/security/audit-log.js\";\n\nexport interface PostgresAuthAdapterOptions {\n  db: PostgresJsDatabase;\n  prefix?: string;\n  sessionTTL?: number;\n  refreshTokenTTL?: number;\n}\n\nexport class PostgresAuthAdapter implements AuthAdapter {\n  private db: PostgresJsDatabase;\n  private prefix: string;\n  private sessionTTL: number;\n  private refreshTokenTTL: number;\n\n  constructor(options: PostgresAuthAdapterOptions) {\n    this.db = options.db;\n    this.prefix = options.prefix || \"kyro:\";\n    this.sessionTTL = options.sessionTTL || 86400;\n    this.refreshTokenTTL = options.refreshTokenTTL || 604800;\n  }\n\n  async createUser(data: {\n    email: string;\n    password: string;\n    role?: UserRole;\n    tenantId?: string;\n  }): Promise<AuthUser> {\n    const passwordHash = await this.hashPassword(data.password);\n    const [user] = await this.db\n      .insert(users)\n      .values({\n        email: data.email.toLowerCase(),\n        passwordHash,\n        role: (data.role || \"customer\") as string,\n        tenantId: data.tenantId,\n      })\n      .returning();\n\n    return this.userToAuthUser(user);\n  }\n\n  async findUserByEmail(email: string): Promise<AuthUser | null> {\n    const [user] = await this.db\n      .select()\n      .from(users)\n      .where(eq(users.email, email.toLowerCase()))\n      .limit(1);\n\n    return user ? this.userToAuthUser(user) : null;\n  }\n\n  async findUserById(id: string): Promise<AuthUser | null> {\n    const [user] = await this.db\n      .select()\n      .from(users)\n      .where(eq(users.id, id))\n      .limit(1);\n\n    return user ? this.userToAuthUser(user) : null;\n  }\n\n  async updateUser(\n    id: string,\n    data: Partial<AuthUser>,\n  ): Promise<AuthUser | null> {\n    const dbData: Record<string, unknown> = { updatedAt: new Date() };\n    if (data.email !== undefined) dbData.email = data.email;\n    if (data.passwordHash !== undefined)\n      dbData.passwordHash = data.passwordHash;\n    if (data.role !== undefined) dbData.role = data.role;\n    if (data.tenantId !== undefined) dbData.tenantId = data.tenantId;\n    if (data.emailVerified !== undefined)\n      dbData.emailVerified = data.emailVerified;\n    if (data.locked !== undefined) dbData.locked = data.locked;\n    if (data.lastLogin !== undefined)\n      dbData.lastLogin = data.lastLogin ? new Date(data.lastLogin) : null;\n    if (data.failedLoginAttempts !== undefined)\n      dbData.failedLoginAttempts = data.failedLoginAttempts;\n\n    const [user] = await this.db\n      .update(users)\n      .set(dbData)\n      .where(eq(users.id, id))\n      .returning();\n\n    return user ? this.userToAuthUser(user) : null;\n  }\n\n  async deleteUser(id: string): Promise<boolean> {\n    await this.db.delete(users).where(eq(users.id, id));\n    return true;\n  }\n\n  async verifyPassword(\n    email: string,\n    password: string,\n  ): Promise<AuthUser | null> {\n    const user = await this.findUserByEmail(email);\n    if (!user) return null;\n    const [stored] = await this.db\n      .select()\n      .from(users)\n      .where(eq(users.email, email.toLowerCase()))\n      .limit(1);\n    if (!stored?.passwordHash) return null;\n    const valid = await bcrypt.compare(password, stored.passwordHash);\n    return valid ? user : null;\n  }\n\n  async hashPassword(password: string): Promise<string> {\n    return bcrypt.hash(password, 12);\n  }\n\n  async createSession(\n    userId: string,\n    data?: { ipAddress?: string; userAgent?: string },\n  ): Promise<Session> {\n    const token = randomBytes(32).toString(\"base64url\");\n    const refreshToken = randomBytes(32).toString(\"base64url\");\n    const expiresAt = new Date(Date.now() + this.sessionTTL * 1000);\n    const refreshExpiresAt = new Date(Date.now() + this.refreshTokenTTL * 1000);\n\n    const [session] = await this.db\n      .insert(sessions)\n      .values({\n        userId,\n        token,\n        refreshToken,\n        ipAddress: data?.ipAddress,\n        userAgent: data?.userAgent,\n        expiresAt,\n      })\n      .returning();\n\n    return this.sessionToSession(session);\n  }\n\n  async findSessionByToken(token: string): Promise<Session | null> {\n    const [session] = await this.db\n      .select()\n      .from(sessions)\n      .where(and(eq(sessions.token, token), gt(sessions.expiresAt, new Date())))\n      .limit(1);\n\n    return session ? this.sessionToSession(session) : null;\n  }\n\n  async deleteSession(sessionId: string): Promise<boolean> {\n    await this.db.delete(sessions).where(eq(sessions.id, sessionId));\n    return true;\n  }\n\n  async deleteUserSessions(userId: string): Promise<number> {\n    await this.db.delete(sessions).where(eq(sessions.userId, userId));\n    return 1;\n  }\n\n  async addPasswordToHistory(\n    userId: string,\n    passwordHash: string,\n  ): Promise<void> {\n    await this.db.insert(passwordHistory).values({\n      userId,\n      passwordHash,\n    });\n  }\n\n  async getPasswordHistory(\n    userId: string,\n    count: number = 5,\n  ): Promise<string[]> {\n    const history = await this.db\n      .select({ passwordHash: passwordHistory.passwordHash })\n      .from(passwordHistory)\n      .where(eq(passwordHistory.userId, userId))\n      .orderBy(desc(passwordHistory.createdAt))\n      .limit(count);\n\n    return history.map((h) => h.passwordHash);\n  }\n\n  async isPasswordInHistory(\n    password: string,\n    userId: string,\n    historyCount: number = 5,\n  ): Promise<boolean> {\n    const history = await this.getPasswordHistory(userId, historyCount);\n\n    for (const hash of history) {\n      if (await this.verifyPassword(password, hash)) {\n        return true;\n      }\n    }\n\n    return false;\n  }\n\n  async isLocked(userId: string): Promise<boolean> {\n    const [lockout] = await this.db\n      .select()\n      .from(lockouts)\n      .where(\n        and(eq(lockouts.userId, userId), gt(lockouts.lockedUntil, new Date())),\n      )\n      .limit(1);\n\n    return !!lockout;\n  }\n\n  async getLockout(userId: string): Promise<{ lockedUntil: Date } | null> {\n    const [lockout] = await this.db\n      .select()\n      .from(lockouts)\n      .where(\n        and(eq(lockouts.userId, userId), gt(lockouts.lockedUntil, new Date())),\n      )\n      .limit(1);\n\n    return lockout ? { lockedUntil: lockout.lockedUntil } : null;\n  }\n\n  async recordFailedAttempt(\n    userId: string,\n    ipAddress?: string,\n  ): Promise<{ attempts: number; locked: boolean }> {\n    const user = await this.findUserById(userId);\n    const attempts = (user?.failedLoginAttempts || 0) + 1;\n\n    await this.updateUser(userId, { failedLoginAttempts: attempts });\n\n    const maxAttempts = 5;\n    const locked = attempts >= maxAttempts;\n\n    if (locked) {\n      const lockoutDuration = 15 * 60 * 1000;\n      await this.db.insert(lockouts).values({\n        userId,\n        ipAddress,\n        reason: \"Too many failed login attempts\",\n        lockedUntil: new Date(Date.now() + lockoutDuration),\n      });\n    }\n\n    return { attempts, locked };\n  }\n\n  async resetAttempts(userId: string): Promise<void> {\n    await this.updateUser(userId, { failedLoginAttempts: 0 });\n  }\n\n  async findAuditLogs(\n    filter: AuditLogFilter,\n  ): Promise<{ logs: AuditLog[]; total: number }> {\n    const {\n      limit = 50,\n      offset = 0,\n      userId,\n      action,\n      resource,\n      resourceId,\n      success,\n      startDate,\n      endDate,\n    } = filter;\n\n    const conditions = [];\n    if (userId) conditions.push(eq(auditLogs.userId, userId));\n    if (action) {\n      if (Array.isArray(action)) {\n        conditions.push(sql`${auditLogs.action} = ANY(${action})`);\n      } else {\n        conditions.push(eq(auditLogs.action, action));\n      }\n    }\n    if (resource) conditions.push(eq(auditLogs.resource, resource));\n    if (resourceId) conditions.push(eq(auditLogs.resourceId, resourceId));\n    if (success !== undefined) conditions.push(eq(auditLogs.success, success));\n    if (startDate) conditions.push(sql`${auditLogs.timestamp} >= ${startDate}`);\n    if (endDate) conditions.push(sql`${auditLogs.timestamp} <= ${endDate}`);\n\n    const whereClause = conditions.length > 0 ? and(...conditions) : undefined;\n\n    const countResult = await this.db\n      .select({ count: sql<number>`count(*)` })\n      .from(auditLogs)\n      .where(whereClause);\n\n    const logs = await this.db\n      .select()\n      .from(auditLogs)\n      .where(whereClause)\n      .orderBy(desc(auditLogs.timestamp))\n      .limit(limit)\n      .offset(offset);\n\n    return {\n      logs: logs.map((log) => ({\n        id: log.id,\n        timestamp: log.timestamp,\n        action: log.action as AuditLog[\"action\"],\n        userId: log.userId || undefined,\n        userEmail: log.userEmail || undefined,\n        role: log.role || undefined,\n        resource: log.resource,\n        resourceId: log.resourceId || undefined,\n        changes: log.changes || undefined,\n        ipAddress: log.ipAddress || undefined,\n        userAgent: log.userAgent || undefined,\n        success: log.success,\n        error: log.error || undefined,\n        metadata: log.metadata || undefined,\n      })),\n      total: Number(countResult[0]?.count || 0),\n    };\n  }\n\n  async createAuditLog(\n    data: Omit<AuditLog, \"id\" | \"timestamp\">,\n  ): Promise<AuditLog> {\n    const id = crypto.randomUUID();\n    const timestamp = new Date();\n\n    await this.db.insert(auditLogs).values({\n      id,\n      action: data.action,\n      userId: data.userId,\n      userEmail: data.userEmail,\n      role: data.role,\n      resource: data.resource,\n      resourceId: data.resourceId,\n      changes: data.changes,\n      ipAddress: data.ipAddress,\n      userAgent: data.userAgent,\n      success: data.success,\n      error: data.error,\n      metadata: data.metadata,\n      timestamp,\n    });\n\n    return {\n      ...data,\n      id,\n      timestamp,\n    };\n  }\n\n  private userToAuthUser(user: AuthUserRow): AuthUser {\n    return {\n      id: user.id,\n      email: user.email,\n      passwordHash: user.passwordHash || undefined,\n      role: user.role as UserRole,\n      tenantId: user.tenantId || undefined,\n      emailVerified: user.emailVerified || false,\n      locked: user.locked || false,\n      lastLogin: user.lastLogin?.toISOString(),\n      failedLoginAttempts: user.failedLoginAttempts || 0,\n      createdAt: user.createdAt.toISOString(),\n      updatedAt: user.updatedAt.toISOString(),\n    };\n  }\n\n  private sessionToSession(session: typeof sessions.$inferSelect): Session {\n    return {\n      id: session.id,\n      userId: session.userId,\n      token: session.token,\n      refreshToken: session.refreshToken || undefined,\n      expiresAt: session.expiresAt.toISOString(),\n      createdAt: session.createdAt.toISOString(),\n      ipAddress: session.ipAddress || undefined,\n      userAgent: session.userAgent || undefined,\n    };\n  }\n}\n"]}

package/dist/{chunk-XTZSUDSI.js → chunk-LTRCYJAG.js}

@@ -1,21 +1,6 @@
-import { __export } from './chunk-NSBPE2FW.js';
 import { pgTable, timestamp, jsonb, integer, boolean, uuid, varchar, uniqueIndex, index, text } from 'drizzle-orm/pg-core';
 
 // src/database/drizzle/schema/auth.ts
-var auth_exports = {};
-__export(auth_exports, {
-  apiKeys: () => apiKeys,
-  auditLogs: () => auditLogs,
-  emailVerifications: () => emailVerifications,
-  lockouts: () => lockouts,
-  passwordHistory: () => passwordHistory,
-  passwordResets: () => passwordResets,
-  permissions: () => permissions,
-  roles: () => roles,
-  sessions: () => sessions,
-  tenants: () => tenants,
-  users: () => users
-});
 var users = pgTable(
   "users",
   {
@@ -201,6 +186,6 @@ var lockouts = pgTable(
   ]
 );
 
-export { auth_exports, lockouts, passwordHistory, sessions, users };
-//# sourceMappingURL=chunk-XTZSUDSI.js.map
-//# sourceMappingURL=chunk-XTZSUDSI.js.map
+export { apiKeys, auditLogs, emailVerifications, lockouts, passwordHistory, passwordResets, permissions, roles, sessions, tenants, users };
+//# sourceMappingURL=chunk-LTRCYJAG.js.map
+//# sourceMappingURL=chunk-LTRCYJAG.js.map

package/dist/chunk-LTRCYJAG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/database/drizzle/schema/auth.ts"],"names":[],"mappings":";;;AAaO,IAAM,KAAA,GAAQ,OAAA;AAAA,EACnB,OAAA;AAAA,EACA;AAAA,IACE,IAAI,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,GAAa,aAAA,EAAc;AAAA,IAC1C,KAAA,EAAO,QAAQ,OAAA,EAAS,EAAE,QAAQ,GAAA,EAAK,EAAE,OAAA,EAAQ;AAAA,IACjD,cAAc,OAAA,CAAQ,eAAA,EAAiB,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,IACtD,IAAA,EAAM,OAAA,CAAQ,MAAA,EAAQ,EAAE,MAAA,EAAQ,EAAA,EAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,OAAA,CAAQ,UAAU,CAAA;AAAA,IAClE,QAAA,EAAU,KAAK,WAAW,CAAA;AAAA,IAC1B,aAAA,EAAe,OAAA,CAAQ,gBAAgB,CAAA,CAAE,QAAQ,KAAK,CAAA;AAAA,IACtD,MAAA,EAAQ,OAAA,CAAQ,QAAQ,CAAA,CAAE,QAAQ,KAAK,CAAA;AAAA,IACvC,SAAA,EAAW,UAAU,YAAY,CAAA;AAAA,IACjC,mBAAA,EAAqB,OAAA,CAAQ,uBAAuB,CAAA,CAAE,QAAQ,CAAC,CAAA;AAAA,IAC/D,QAAA,EAAU,KAAA,CAAM,UAAU,CAAA,CAAE,KAAA,EAA+B;AAAA,IAC3D,WAAW,SAAA,CAAU,YAAY,CAAA,CAAE,UAAA,GAAa,OAAA,EAAQ;AAAA,IACxD,WAAW,SAAA,CAAU,YAAY,CAAA,CAAE,UAAA,GAAa,OAAA;AAAQ,GAC1D;AAAA,EACA,CAAC,KAAA,KAAU;AAAA,IACT,WAAA,CAAY,iBAAiB,CAAA,CAAE,EAAA,CAAG,MAAM,KAAK,CAAA;AAAA,IAC7C,KAAA,CAAM,kBAAkB,CAAA,CAAE,EAAA,CAAG,MAAM,QAAQ,CAAA;AAAA,IAC3C,KAAA,CAAM,gBAAgB,CAAA,CAAE,EAAA,CAAG,MAAM,IAAI;AAAA;AAEzC;AAEO,IAAM,KAAA,GAAQ,OAAA;AAAA,EACnB,OAAA;AAAA,EACA;AAAA,IACE,IAAI,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,GAAa,aAAA,EAAc;AAAA,IAC1C,IAAA,EAAM,OAAA,CAAQ,MAAA,EAAQ,EAAE,MAAA,EAAQ,KAAK,CAAA,CAAE,OAAA,EAAQ,CAAE,MAAA,EAAO;AAAA,IACxD,OAAO,OAAA,CAAQ,OAAO,EAAE,OAAA,EAAQ,CAAE,QAAQ,CAAC,CAAA;AAAA,IAC3C,QAAA,EAAU,IAAA,CAAK,UAAU,CAAA,CAAE,KAAA,EAAM;AAAA,IACjC,WAAA,EAAa,KAAK,aAAa,CAAA;AAAA,IAC/B,WAAA,EAAa,MAAM,aAAa,CAAA,CAAE,OAAgB,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA,IAC9D,QAAA,EAAU,OAAA,CAAQ,WAAW,CAAA,CAAE,QAAQ,KAAK,CAAA;AAAA,IAC5C,WAAW,SAAA,CAAU,YAAY,CAAA,CAAE,UAAA,GAAa,OAAA,EAAQ;AAAA,IACxD,WAAW,SAAA,CAAU,YAAY,CAAA,CAAE,UAAA,GAAa,OAAA;AAAQ,GAC1D;AAAA,EACA,CAAC,UAAU,CAAC,KAAA,CAAM,iBAAiB,CAAA,CAAE,EAAA,CAAG,KAAA,CAAM,KAAK,CAAC;AACtD;AAEO,IAAM,WAAA,GAAc,OAAA;AAAA,EACzB,aAAA;AAAA,EACA;AAAA,IACE,IAAI,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,GAAa,aAAA,EAAc;AAAA,IAC1C,MAAA,EAAQ,IAAA,CAAK,SAAS,CAAA,CAAE,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,SAAA,EAAW,CAAA;AAAA,IAC1E,QAAA,EAAU,QAAQ,UAAA,EAAY,EAAE,QAAQ,GAAA,EAAK,EAAE,OAAA,EAAQ;AAAA,IACvD,MAAA,EAAQ,QAAQ,QAAA,EAAU,EAAE,QAAQ,EAAA,EAAI,EAAE,OAAA,EAAQ;AAAA,IAClD,UAAA,EAAY,KAAA,CAAM,YAAY,CAAA,CAAE,KAAA,EAA+B;AAAA,IAC/D,WAAW,SAAA,CAAU,YAAY,CAAA,CAAE,UAAA,GAAa,OAAA;AAAQ,GAC1D;AAAA,EACA,CAAC,KAAA,KAAU;AAAA,IACT,KAAA,CAAM,sBAAsB,CAAA,CAAE,EAAA,CAAG,MAAM,MAAM,CAAA;AAAA,IAC7C,KAAA,CAAM,0BAA0B,CAAA,CAAE,EAAA,CAAG,MAAM,QAAQ;AAAA;AAEvD;AAEO,IAAM,QAAA,GAAW,OAAA;AAAA,EACtB,UAAA;AAAA,EACA;AAAA,IACE,IAAI,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,GAAa,aAAA,EAAc;AAAA,IAC1C,MAAA,EAAQ,IAAA,CAAK,SAAS,CAAA,CACnB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,IACrD,KAAA,EAAO,OAAA,CAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,KAAK,CAAA,CAAE,OAAA,EAAQ,CAAE,MAAA,EAAO;AAAA,IAC1D,cAAc,OAAA,CAAQ,eAAA,EAAiB,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,IACtD,WAAW,OAAA,CAAQ,YAAA,EAAc,EAAE,MAAA,EAAQ,IAAI,CAAA;AAAA,IAC/C,SAAA,EAAW,KAAK,YAAY,CAAA;AAAA,IAC5B,SAAA,EAAW,SAAA,CAAU,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,IAC3C,WAAW,SAAA,CAAU,YAAY,CAAA,CAAE,UAAA,GAAa,OAAA;AAAQ,GAC1D;AAAA,EACA,CAAC,KAAA,KAAU;AAAA,IACT,KAAA,CAAM,mBAAmB,CAAA,CAAE,EAAA,CAAG,MAAM,MAAM,CAAA;AAAA,IAC1C,KAAA,CAAM,oBAAoB,CAAA,CAAE,EAAA,CAAG,MAAM,KAAK,CAAA;AAAA,IAC1C,KAAA,CAAM,sBAAsB,CAAA,CAAE,EAAA,CAAG,MAAM,SAAS;AAAA;AAEpD;AAEO,IAAM,SAAA,GAAY,OAAA;AAAA,EACvB,YAAA;AAAA,EACA;AAAA,IACE,IAAI,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,GAAa,aAAA,EAAc;AAAA,IAC1C,MAAA,EAAQ,QAAQ,QAAA,EAAU,EAAE,QAAQ,GAAA,EAAK,EAAE,OAAA,EAAQ;AAAA,IACnD,QAAQ,IAAA,CAAK,SAAS,EAAE,UAAA,CAAW,MAAM,MAAM,EAAA,EAAI;AAAA,MACjD,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,IACD,WAAW,OAAA,CAAQ,YAAA,EAAc,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,IAChD,MAAM,OAAA,CAAQ,MAAA,EAAQ,EAAE,MAAA,EAAQ,IAAI,CAAA;AAAA,IACpC,QAAA,EAAU,QAAQ,UAAA,EAAY,EAAE,QAAQ,GAAA,EAAK,EAAE,OAAA,EAAQ;AAAA,IACvD,UAAA,EAAY,KAAK,aAAa,CAAA;AAAA,IAC9B,OAAA,EACE,KAAA,CAAM,SAAS,CAAA,CAAE,KAAA,EAAuD;AAAA,IAC1E,WAAW,OAAA,CAAQ,YAAA,EAAc,EAAE,MAAA,EAAQ,IAAI,CAAA;AAAA,IAC/C,SAAA,EAAW,KAAK,YAAY,CAAA;AAAA,IAC5B,SAAS,OAAA,CAAQ,SAAS,EAAE,OAAA,EAAQ,CAAE,QAAQ,IAAI,CAAA;AAAA,IAClD,KAAA,EAAO,KAAK,OAAO,CAAA;AAAA,IACnB,QAAA,EAAU,KAAA,CAAM,UAAU,CAAA,CAAE,KAAA,EAA+B;AAAA,IAC3D,WAAW,SAAA,CAAU,WAAW,CAAA,CAAE,UAAA,GAAa,OAAA;AAAQ,GACzD;AAAA,EACA,CAAC,KAAA,KAAU;AAAA,IACT,KAAA,CAAM,qBAAqB,CAAA,CAAE,EAAA,CAAG,MAAM,MAAM,CAAA;AAAA,IAC5C,KAAA,CAAM,uBAAuB,CAAA,CAAE,EAAA,CAAG,MAAM,MAAM,CAAA;AAAA,IAC9C,KAAA,CAAM,yBAAyB,CAAA,CAAE,EAAA,CAAG,MAAM,QAAQ,CAAA;AAAA,IAClD,KAAA,CAAM,0BAA0B,CAAA,CAAE,EAAA,CAAG,MAAM,SAAS;AAAA;AAExD;AAEO,IAAM,OAAA,GAAU,OAAA;AAAA,EACrB,SAAA;AAAA,EACA;AAAA,IACE,IAAI,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,GAAa,aAAA,EAAc;AAAA,IAC1C,IAAA,EAAM,QAAQ,MAAA,EAAQ,EAAE,QAAQ,GAAA,EAAK,EAAE,OAAA,EAAQ;AAAA,IAC/C,IAAA,EAAM,OAAA,CAAQ,MAAA,EAAQ,EAAE,MAAA,EAAQ,KAAK,CAAA,CAAE,OAAA,EAAQ,CAAE,MAAA,EAAO;AAAA,IACxD,QAAA,EAAU,MAAM,UAAU,CAAA,CAAE,OAA+B,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA,IACvE,QAAA,EAAU,OAAA,CAAQ,WAAW,CAAA,CAAE,QAAQ,IAAI,CAAA;AAAA,IAC3C,WAAW,SAAA,CAAU,YAAY,CAAA,CAAE,UAAA,GAAa,OAAA,EAAQ;AAAA,IACxD,WAAW,SAAA,CAAU,YAAY,CAAA,CAAE,UAAA,GAAa,OAAA;AAAQ,GAC1D;AAAA,EACA,CAAC,UAAU,CAAC,WAAA,CAAY,kBAAkB,CAAA,CAAE,EAAA,CAAG,KAAA,CAAM,IAAI,CAAC;AAC5D;AAEO,IAAM,OAAA,GAAU,OAAA;AAAA,EACrB,UAAA;AAAA,EACA;AAAA,IACE,IAAI,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,GAAa,aAAA,EAAc;AAAA,IAC1C,MAAA,EAAQ,IAAA,CAAK,SAAS,CAAA,CACnB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,IACrD,IAAA,EAAM,QAAQ,MAAA,EAAQ,EAAE,QAAQ,GAAA,EAAK,EAAE,OAAA,EAAQ;AAAA,IAC/C,GAAA,EAAK,OAAA,CAAQ,KAAA,EAAO,EAAE,MAAA,EAAQ,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,MAAA,EAAO;AAAA,IACrD,SAAA,EAAW,QAAQ,YAAA,EAAc,EAAE,QAAQ,CAAA,EAAG,EAAE,OAAA,EAAQ;AAAA,IACxD,WAAA,EAAa,MAAM,aAAa,CAAA,CAAE,OAAgB,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA,IAC9D,UAAA,EAAY,UAAU,cAAc,CAAA;AAAA,IACpC,SAAA,EAAW,UAAU,YAAY,CAAA;AAAA,IACjC,WAAW,SAAA,CAAU,YAAY,CAAA,CAAE,UAAA,GAAa,OAAA;AAAQ,GAC1D;AAAA,EACA,CAAC,KAAA,KAAU;AAAA,IACT,KAAA,CAAM,mBAAmB,CAAA,CAAE,EAAA,CAAG,MAAM,MAAM,CAAA;AAAA,IAC1C,KAAA,CAAM,kBAAkB,CAAA,CAAE,EAAA,CAAG,MAAM,GAAG;AAAA;AAE1C;AAEO,IAAM,kBAAA,GAAqB,OAAA;AAAA,EAChC,qBAAA;AAAA,EACA;AAAA,IACE,IAAI,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,GAAa,aAAA,EAAc;AAAA,IAC1C,MAAA,EAAQ,IAAA,CAAK,SAAS,CAAA,CACnB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,IACrD,KAAA,EAAO,OAAA,CAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,MAAA,EAAO;AAAA,IACzD,SAAA,EAAW,SAAA,CAAU,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,IAC3C,WAAW,SAAA,CAAU,YAAY,CAAA,CAAE,UAAA,GAAa,OAAA;AAAQ,GAC1D;AAAA,EACA,CAAC,KAAA,KAAU;AAAA,IACT,KAAA,CAAM,+BAA+B,CAAA,CAAE,EAAA,CAAG,MAAM,KAAK,CAAA;AAAA,IACrD,KAAA,CAAM,8BAA8B,CAAA,CAAE,EAAA,CAAG,MAAM,MAAM;AAAA;AAEzD;AAEO,IAAM,cAAA,GAAiB,OAAA;AAAA,EAC5B,iBAAA;AAAA,EACA;AAAA,IACE,IAAI,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,GAAa,aAAA,EAAc;AAAA,IAC1C,MAAA,EAAQ,IAAA,CAAK,SAAS,CAAA,CACnB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,IACrD,KAAA,EAAO,OAAA,CAAQ,OAAA,EAAS,EAAE,MAAA,EAAQ,IAAI,CAAA,CAAE,OAAA,EAAQ,CAAE,MAAA,EAAO;AAAA,IACzD,SAAA,EAAW,SAAA,CAAU,YAAY,CAAA,CAAE,OAAA,EAAQ;AAAA,IAC3C,MAAA,EAAQ,UAAU,SAAS,CAAA;AAAA,IAC3B,WAAW,SAAA,CAAU,YAAY,CAAA,CAAE,UAAA,GAAa,OAAA;AAAQ,GAC1D;AAAA,EACA,CAAC,KAAA,KAAU;AAAA,IACT,KAAA,CAAM,2BAA2B,CAAA,CAAE,EAAA,CAAG,MAAM,KAAK,CAAA;AAAA,IACjD,KAAA,CAAM,0BAA0B,CAAA,CAAE,EAAA,CAAG,MAAM,MAAM;AAAA;AAErD;AAEO,IAAM,eAAA,GAAkB,OAAA;AAAA,EAC7B,kBAAA;AAAA,EACA;AAAA,IACE,IAAI,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,GAAa,aAAA,EAAc;AAAA,IAC1C,MAAA,EAAQ,IAAA,CAAK,SAAS,CAAA,CACnB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,IACrD,YAAA,EAAc,QAAQ,eAAA,EAAiB,EAAE,QAAQ,GAAA,EAAK,EAAE,OAAA,EAAQ;AAAA,IAChE,WAAW,SAAA,CAAU,YAAY,CAAA,CAAE,UAAA,GAAa,OAAA;AAAQ,GAC1D;AAAA,EACA,CAAC,UAAU,CAAC,KAAA,CAAM,2BAA2B,CAAA,CAAE,EAAA,CAAG,KAAA,CAAM,MAAM,CAAC;AACjE;AAEO,IAAM,QAAA,GAAW,OAAA;AAAA,EACtB,UAAA;AAAA,EACA;AAAA,IACE,IAAI,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,GAAa,aAAA,EAAc;AAAA,IAC1C,MAAA,EAAQ,IAAA,CAAK,SAAS,CAAA,CACnB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,KAAA,CAAM,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,IACrD,WAAW,OAAA,CAAQ,YAAA,EAAc,EAAE,MAAA,EAAQ,IAAI,CAAA;AAAA,IAC/C,QAAQ,OAAA,CAAQ,QAAA,EAAU,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,IACzC,WAAA,EAAa,SAAA,CAAU,cAAc,CAAA,CAAE,OAAA,EAAQ;AAAA,IAC/C,UAAA,EAAY,UAAU,aAAa,CAAA;AAAA,IACnC,WAAW,SAAA,CAAU,YAAY,CAAA,CAAE,UAAA,GAAa,OAAA;AAAQ,GAC1D;AAAA,EACA,CAAC,KAAA,KAAU;AAAA,IACT,KAAA,CAAM,mBAAmB,CAAA,CAAE,EAAA,CAAG,MAAM,MAAM,CAAA;AAAA,IAC1C,KAAA,CAAM,iBAAiB,CAAA,CAAE,EAAA,CAAG,MAAM,SAAS,CAAA;AAAA,IAC3C,KAAA,CAAM,2BAA2B,CAAA,CAAE,EAAA,CAAG,MAAM,WAAW;AAAA;AAE3D","file":"chunk-LTRCYJAG.js","sourcesContent":["import {\n  pgTable,\n  uuid,\n  varchar,\n  boolean,\n  timestamp,\n  integer,\n  text,\n  jsonb,\n  index,\n  uniqueIndex,\n} from \"drizzle-orm/pg-core\";\n\nexport const users = pgTable(\n  \"users\",\n  {\n    id: uuid(\"id\").primaryKey().defaultRandom(),\n    email: varchar(\"email\", { length: 255 }).notNull(),\n    passwordHash: varchar(\"password_hash\", { length: 255 }),\n    role: varchar(\"role\", { length: 50 }).notNull().default(\"customer\"),\n    tenantId: uuid(\"tenant_id\"),\n    emailVerified: boolean(\"email_verified\").default(false),\n    locked: boolean(\"locked\").default(false),\n    lastLogin: timestamp(\"last_login\"),\n    failedLoginAttempts: integer(\"failed_login_attempts\").default(0),\n    metadata: jsonb(\"metadata\").$type<Record<string, unknown>>(),\n    createdAt: timestamp(\"created_at\").defaultNow().notNull(),\n    updatedAt: timestamp(\"updated_at\").defaultNow().notNull(),\n  },\n  (table) => [\n    uniqueIndex(\"users_email_idx\").on(table.email),\n    index(\"users_tenant_idx\").on(table.tenantId),\n    index(\"users_role_idx\").on(table.role),\n  ],\n);\n\nexport const roles = pgTable(\n  \"roles\",\n  {\n    id: uuid(\"id\").primaryKey().defaultRandom(),\n    name: varchar(\"name\", { length: 100 }).notNull().unique(),\n    level: integer(\"level\").notNull().default(0),\n    inherits: text(\"inherits\").array(),\n    description: text(\"description\"),\n    permissions: jsonb(\"permissions\").$type<string[]>().default([]),\n    isSystem: boolean(\"is_system\").default(false),\n    createdAt: timestamp(\"created_at\").defaultNow().notNull(),\n    updatedAt: timestamp(\"updated_at\").defaultNow().notNull(),\n  },\n  (table) => [index(\"roles_level_idx\").on(table.level)],\n);\n\nexport const permissions = pgTable(\n  \"permissions\",\n  {\n    id: uuid(\"id\").primaryKey().defaultRandom(),\n    roleId: uuid(\"role_id\").references(() => roles.id, { onDelete: \"cascade\" }),\n    resource: varchar(\"resource\", { length: 100 }).notNull(),\n    action: varchar(\"action\", { length: 50 }).notNull(),\n    conditions: jsonb(\"conditions\").$type<Record<string, unknown>>(),\n    createdAt: timestamp(\"created_at\").defaultNow().notNull(),\n  },\n  (table) => [\n    index(\"permissions_role_idx\").on(table.roleId),\n    index(\"permissions_resource_idx\").on(table.resource),\n  ],\n);\n\nexport const sessions = pgTable(\n  \"sessions\",\n  {\n    id: uuid(\"id\").primaryKey().defaultRandom(),\n    userId: uuid(\"user_id\")\n      .notNull()\n      .references(() => users.id, { onDelete: \"cascade\" }),\n    token: varchar(\"token\", { length: 512 }).notNull().unique(),\n    refreshToken: varchar(\"refresh_token\", { length: 512 }),\n    ipAddress: varchar(\"ip_address\", { length: 45 }),\n    userAgent: text(\"user_agent\"),\n    expiresAt: timestamp(\"expires_at\").notNull(),\n    createdAt: timestamp(\"created_at\").defaultNow().notNull(),\n  },\n  (table) => [\n    index(\"sessions_user_idx\").on(table.userId),\n    index(\"sessions_token_idx\").on(table.token),\n    index(\"sessions_expires_idx\").on(table.expiresAt),\n  ],\n);\n\nexport const auditLogs = pgTable(\n  \"audit_logs\",\n  {\n    id: uuid(\"id\").primaryKey().defaultRandom(),\n    action: varchar(\"action\", { length: 100 }).notNull(),\n    userId: uuid(\"user_id\").references(() => users.id, {\n      onDelete: \"set null\",\n    }),\n    userEmail: varchar(\"user_email\", { length: 255 }),\n    role: varchar(\"role\", { length: 50 }),\n    resource: varchar(\"resource\", { length: 100 }).notNull(),\n    resourceId: uuid(\"resource_id\"),\n    changes:\n      jsonb(\"changes\").$type<{ field: string; old: unknown; new: unknown }[]>(),\n    ipAddress: varchar(\"ip_address\", { length: 45 }),\n    userAgent: text(\"user_agent\"),\n    success: boolean(\"success\").notNull().default(true),\n    error: text(\"error\"),\n    metadata: jsonb(\"metadata\").$type<Record<string, unknown>>(),\n    timestamp: timestamp(\"timestamp\").defaultNow().notNull(),\n  },\n  (table) => [\n    index(\"audit_logs_user_idx\").on(table.userId),\n    index(\"audit_logs_action_idx\").on(table.action),\n    index(\"audit_logs_resource_idx\").on(table.resource),\n    index(\"audit_logs_timestamp_idx\").on(table.timestamp),\n  ],\n);\n\nexport const tenants = pgTable(\n  \"tenants\",\n  {\n    id: uuid(\"id\").primaryKey().defaultRandom(),\n    name: varchar(\"name\", { length: 255 }).notNull(),\n    slug: varchar(\"slug\", { length: 100 }).notNull().unique(),\n    settings: jsonb(\"settings\").$type<Record<string, unknown>>().default({}),\n    isActive: boolean(\"is_active\").default(true),\n    createdAt: timestamp(\"created_at\").defaultNow().notNull(),\n    updatedAt: timestamp(\"updated_at\").defaultNow().notNull(),\n  },\n  (table) => [uniqueIndex(\"tenants_slug_idx\").on(table.slug)],\n);\n\nexport const apiKeys = pgTable(\n  \"api_keys\",\n  {\n    id: uuid(\"id\").primaryKey().defaultRandom(),\n    userId: uuid(\"user_id\")\n      .notNull()\n      .references(() => users.id, { onDelete: \"cascade\" }),\n    name: varchar(\"name\", { length: 255 }).notNull(),\n    key: varchar(\"key\", { length: 64 }).notNull().unique(),\n    keyPrefix: varchar(\"key_prefix\", { length: 8 }).notNull(),\n    permissions: jsonb(\"permissions\").$type<string[]>().default([]),\n    lastUsedAt: timestamp(\"last_used_at\"),\n    expiresAt: timestamp(\"expires_at\"),\n    createdAt: timestamp(\"created_at\").defaultNow().notNull(),\n  },\n  (table) => [\n    index(\"api_keys_user_idx\").on(table.userId),\n    index(\"api_keys_key_idx\").on(table.key),\n  ],\n);\n\nexport const emailVerifications = pgTable(\n  \"email_verifications\",\n  {\n    id: uuid(\"id\").primaryKey().defaultRandom(),\n    userId: uuid(\"user_id\")\n      .notNull()\n      .references(() => users.id, { onDelete: \"cascade\" }),\n    token: varchar(\"token\", { length: 64 }).notNull().unique(),\n    expiresAt: timestamp(\"expires_at\").notNull(),\n    createdAt: timestamp(\"created_at\").defaultNow().notNull(),\n  },\n  (table) => [\n    index(\"email_verifications_token_idx\").on(table.token),\n    index(\"email_verifications_user_idx\").on(table.userId),\n  ],\n);\n\nexport const passwordResets = pgTable(\n  \"password_resets\",\n  {\n    id: uuid(\"id\").primaryKey().defaultRandom(),\n    userId: uuid(\"user_id\")\n      .notNull()\n      .references(() => users.id, { onDelete: \"cascade\" }),\n    token: varchar(\"token\", { length: 64 }).notNull().unique(),\n    expiresAt: timestamp(\"expires_at\").notNull(),\n    usedAt: timestamp(\"used_at\"),\n    createdAt: timestamp(\"created_at\").defaultNow().notNull(),\n  },\n  (table) => [\n    index(\"password_resets_token_idx\").on(table.token),\n    index(\"password_resets_user_idx\").on(table.userId),\n  ],\n);\n\nexport const passwordHistory = pgTable(\n  \"password_history\",\n  {\n    id: uuid(\"id\").primaryKey().defaultRandom(),\n    userId: uuid(\"user_id\")\n      .notNull()\n      .references(() => users.id, { onDelete: \"cascade\" }),\n    passwordHash: varchar(\"password_hash\", { length: 255 }).notNull(),\n    createdAt: timestamp(\"created_at\").defaultNow().notNull(),\n  },\n  (table) => [index(\"password_history_user_idx\").on(table.userId)],\n);\n\nexport const lockouts = pgTable(\n  \"lockouts\",\n  {\n    id: uuid(\"id\").primaryKey().defaultRandom(),\n    userId: uuid(\"user_id\")\n      .notNull()\n      .references(() => users.id, { onDelete: \"cascade\" }),\n    ipAddress: varchar(\"ip_address\", { length: 45 }),\n    reason: varchar(\"reason\", { length: 255 }),\n    lockedUntil: timestamp(\"locked_until\").notNull(),\n    releasedAt: timestamp(\"released_at\"),\n    createdAt: timestamp(\"created_at\").defaultNow().notNull(),\n  },\n  (table) => [\n    index(\"lockouts_user_idx\").on(table.userId),\n    index(\"lockouts_ip_idx\").on(table.ipAddress),\n    index(\"lockouts_locked_until_idx\").on(table.lockedUntil),\n  ],\n);\n\nexport type AuthUser = typeof users.$inferSelect;\nexport type AuthUserNew = typeof users.$inferInsert;\nexport type AuthRole = typeof roles.$inferSelect;\nexport type AuthRoleNew = typeof roles.$inferInsert;\nexport type AuthSession = typeof sessions.$inferSelect;\nexport type AuthSessionNew = typeof sessions.$inferInsert;\nexport type AuthAuditLog = typeof auditLogs.$inferSelect;\nexport type AuthAuditLogNew = typeof auditLogs.$inferInsert;\nexport type AuthTenant = typeof tenants.$inferSelect;\nexport type AuthTenantNew = typeof tenants.$inferInsert;\nexport type AuthApiKey = typeof apiKeys.$inferSelect;\nexport type AuthApiKeyNew = typeof apiKeys.$inferInsert;\nexport type AuthEmailVerification = typeof emailVerifications.$inferSelect;\nexport type AuthPasswordReset = typeof passwordResets.$inferSelect;\nexport type AuthPasswordHistoryEntry = typeof passwordHistory.$inferSelect;\nexport type AuthLockout = typeof lockouts.$inferSelect;\n"]}

package/dist/{chunk-UEYC46RL.js → chunk-OUGKLCYF.js}

@@ -1,17 +1,57 @@
-import { evaluateAccess } from './chunk-SDMNUYVU.js';
+import { WEBHOOK_EVENTS, createWebhookService, extractApiKeyFromRequest, validateApiKey, createApiKeyContext, evaluateAccess } from './chunk-E5X75WNB.js';
 
 // src/api/trpc/context.ts
-function createContext(options) {
-  return {
+async function createContext(options) {
+  const webhookService = createWebhookService(options.db);
+  const baseContext = {
     db: options.db,
     registry: options.registry,
     req: options.req,
     user: options.user,
-    tenantID: options.tenantID
+    tenantID: options.tenantID,
+    webhookService,
+    settings: options.settings
   };
+  const apiKeyRaw = extractApiKeyFromRequest(options.req);
+  if (apiKeyRaw) {
+    const result = await validateApiKey(apiKeyRaw, options.db);
+    if (result.valid) {
+      baseContext.user = result.user || options.user;
+      baseContext.tenantID = result.tenantId || options.tenantID;
+      baseContext.apiKey = createApiKeyContext(result);
+    }
+  }
+  return baseContext;
 }
 
 // src/api/trpc/procedures.ts
+var COLLECTION_EVENT_MAP = {
+  _media: {
+    create: WEBHOOK_EVENTS.MEDIA_UPLOAD,
+    update: WEBHOOK_EVENTS.MEDIA_UPLOAD,
+    delete: WEBHOOK_EVENTS.MEDIA_DELETE
+  }
+};
+function getWebhookEvent(collection, operation) {
+  const mapped = COLLECTION_EVENT_MAP[collection];
+  if (mapped) return mapped[operation];
+  return `collection.${operation}`;
+}
+async function triggerWebhook(ctx, event, payload) {
+  if (!ctx.webhookService) return;
+  try {
+    await ctx.webhookService.trigger(event, {
+      collection: payload.collection,
+      operation: payload.operation,
+      data: payload.data,
+      previousData: payload.previousData,
+      user: ctx.user ? { id: ctx.user.id, email: ctx.user.email, role: ctx.user.role } : void 0,
+      tenantId: ctx.tenantID
+    });
+  } catch (err) {
+    console.error(`[Webhook] Failed to trigger ${event}:`, err);
+  }
+}
 function createFindProcedure(ctx) {
   return async (input) => {
     const { collection, where, sort, limit, page, depth, select } = input;
@@ -164,6 +204,11 @@ function createCreateProcedure(ctx) {
         });
       }
     }
+    await triggerWebhook(ctx, getWebhookEvent(collection, "create"), {
+      collection,
+      data: doc,
+      operation: "create"
+    });
     return { doc };
   };
 }
@@ -176,7 +221,8 @@ function createUpdateProcedure(ctx) {
       id,
       tenantID: ctx.tenantID
     });
-    if (!originalDoc) throw new Error(`Document not found: ${collection}/${id}`);
+    if (!originalDoc)
+      throw new Error(`Document not found: ${collection}/${id}`);
     if (config.access?.update) {
       const allowed = await evaluateAccess(config.access.update, {
         req: ctx.req,
@@ -246,6 +292,12 @@ function createUpdateProcedure(ctx) {
         });
       }
     }
+    await triggerWebhook(ctx, getWebhookEvent(collection, "update"), {
+      collection,
+      data: doc,
+      previousData: originalDoc,
+      operation: "update"
+    });
     return { doc };
   };
 }
@@ -258,7 +310,8 @@ function createDeleteProcedure(ctx) {
       id,
       tenantID: ctx.tenantID
     });
-    if (!originalDoc) throw new Error(`Document not found: ${collection}/${id}`);
+    if (!originalDoc)
+      throw new Error(`Document not found: ${collection}/${id}`);
     if (config.access?.delete) {
       const allowed = await evaluateAccess(config.access.delete, {
         req: ctx.req,
@@ -300,6 +353,12 @@ function createDeleteProcedure(ctx) {
         });
       }
     }
+    await triggerWebhook(ctx, getWebhookEvent(collection, "delete"), {
+      collection,
+      data: doc,
+      previousData: originalDoc,
+      operation: "delete"
+    });
     return { doc, message: "Deleted successfully" };
   };
 }
@@ -366,9 +425,13 @@ function createDynamicRouter(ctx) {
   return router;
 }
 function createKyroServer(ctx) {
+  const apiAccess = ctx.settings?.access?.apiAccess;
+  if (apiAccess?.trpcEnabled === false) {
+    throw new Error("tRPC API is disabled");
+  }
   return createDynamicRouter(ctx);
 }
 
 export { createContext, createCountProcedure, createCreateProcedure, createDeleteProcedure, createDynamicRouter, createFindByIDProcedure, createFindProcedure, createKyroServer, createUpdateProcedure };
-//# sourceMappingURL=chunk-UEYC46RL.js.map
-//# sourceMappingURL=chunk-UEYC46RL.js.map
+//# sourceMappingURL=chunk-OUGKLCYF.js.map
+//# sourceMappingURL=chunk-OUGKLCYF.js.map

package/dist/chunk-OUGKLCYF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/api/trpc/context.ts","../src/api/trpc/procedures.ts","../src/api/trpc/router.ts"],"names":[],"mappings":";;;AAsCA,eAAsB,cAAc,OAAA,EAOX;AACvB,EAAA,MAAM,cAAA,GAAiB,oBAAA,CAAqB,OAAA,CAAQ,EAAE,CAAA;AAEtD,EAAA,MAAM,WAAA,GAA2B;AAAA,IAC/B,IAAI,OAAA,CAAQ,EAAA;AAAA,IACZ,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,cAAA;AAAA,IACA,UAAU,OAAA,CAAQ;AAAA,GACpB;AAEA,EAAA,MAAM,SAAA,GAAY,wBAAA,CAAyB,OAAA,CAAQ,GAAU,CAAA;AAC7D,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,MAAM,MAAA,GAAS,MAAM,cAAA,CAAe,SAAA,EAAW,QAAQ,EAAE,CAAA;AACzD,IAAA,IAAI,OAAO,KAAA,EAAO;AAChB,MAAA,WAAA,CAAY,IAAA,GAAQ,MAAA,CAAO,IAAA,IAAiB,OAAA,CAAQ,IAAA;AACpD,MAAA,WAAA,CAAY,QAAA,GAAW,MAAA,CAAO,QAAA,IAAY,OAAA,CAAQ,QAAA;AAClD,MAAA,WAAA,CAAY,MAAA,GAAS,oBAAoB,MAAM,CAAA;AAAA,IACjD;AAAA,EACF;AAEA,EAAA,OAAO,WAAA;AACT;;;ACxDA,IAAM,oBAAA,GAGF;AAAA,EACF,MAAA,EAAQ;AAAA,IACN,QAAQ,cAAA,CAAe,YAAA;AAAA,IACvB,QAAQ,cAAA,CAAe,YAAA;AAAA,IACvB,QAAQ,cAAA,CAAe;AAAA;AAE3B,CAAA;AAEA,SAAS,eAAA,CACP,YACA,SAAA,EACc;AACd,EAAA,MAAM,MAAA,GAAS,qBAAqB,UAAU,CAAA;AAC9C,EAAA,IAAI,MAAA,EAAQ,OAAO,MAAA,CAAO,SAAS,CAAA;AACnC,EAAA,OAAO,cAAc,SAAS,CAAA,CAAA;AAChC;AAEA,eAAe,cAAA,CACb,GAAA,EACA,KAAA,EACA,OAAA,EAMA;AACA,EAAA,IAAI,CAAC,IAAI,cAAA,EAAgB;AACzB,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,CAAI,cAAA,CAAe,OAAA,CAAQ,KAAA,EAAO;AAAA,MACtC,YAAY,OAAA,CAAQ,UAAA;AAAA,MACpB,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,cAAc,OAAA,CAAQ,YAAA;AAAA,MACtB,MAAM,GAAA,CAAI,IAAA,GACN,EAAE,EAAA,EAAI,IAAI,IAAA,CAAK,EAAA,EAAI,KAAA,EAAO,GAAA,CAAI,KAAK,KAAA,EAAO,IAAA,EAAM,GAAA,CAAI,IAAA,CAAK,MAAK,GAC9D,KAAA,CAAA;AAAA,MACJ,UAAU,GAAA,CAAI;AAAA,KACf,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,4BAAA,EAA+B,KAAK,CAAA,CAAA,CAAA,EAAK,GAAG,CAAA;AAAA,EAC5D;AACF;AAMO,SAAS,oBAAoB,GAAA,EAAkB;AACpD,EAAA,OAAO,OAAO,KAAA,KAQR;AACJ,IAAA,MAAM,EAAE,YAAY,KAAA,EAAO,IAAA,EAAM,OAAO,IAAA,EAAM,KAAA,EAAO,QAAO,GAAI,KAAA;AAChE,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,QAAA,CAAS,aAAA,CAAc,UAAU,CAAA;AAGpD,IAAA,IAAI,MAAA,CAAO,QAAQ,IAAA,EAAM;AACvB,MAAA,MAAM,OAAA,GAAU,MAAM,cAAA,CAAe,MAAA,CAAO,OAAO,IAAA,EAAM;AAAA,QACvD,KAAK,GAAA,CAAI,GAAA;AAAA,QACT,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,UAAU,GAAA,CAAI;AAAA,OACf,CAAA;AACD,MAAA,IAAI,OAAA,KAAY,KAAA,EAAO,MAAM,IAAI,MAAM,eAAe,CAAA;AAAA,IACxD;AAGA,IAAA,IAAI,MAAA,CAAO,OAAO,UAAA,EAAY;AAC5B,MAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,UAAA,EAAY;AAC1C,QAAA,MAAM,IAAA,CAAK;AAAA,UACT,UAAA;AAAA,UACA,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,UAAU,GAAA,CAAI,QAAA;AAAA,UACd,SAAA,EAAW,MAAA;AAAA,UACX;AAAA,SACD,CAAA;AAAA,MACH;AAAA,IACF;AAGA,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,EAAA,CAAG,IAAA,CAAK;AAAA,MAC/B,UAAA;AAAA,MACA,KAAA,EAAO,SAAS,EAAC;AAAA,MACjB,IAAA;AAAA,MACA,OAAO,KAAA,IAAS,EAAA;AAAA,MAChB,MAAM,IAAA,IAAQ,CAAA;AAAA,MACd,OAAO,KAAA,IAAS,CAAA;AAAA,MAChB,UAAU,GAAA,CAAI,QAAA;AAAA,MACd;AAAA,KACD,CAAA;AAGD,IAAA,IAAI,MAAA,CAAO,OAAO,SAAA,EAAW;AAC3B,MAAA,KAAA,MAAW,GAAA,IAAO,OAAO,IAAA,EAAM;AAC7B,QAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,SAAA,EAAW;AACzC,UAAA,MAAM,IAAA,CAAK;AAAA,YACT,UAAA;AAAA,YACA,GAAA;AAAA,YACA,KAAK,GAAA,CAAI,GAAA;AAAA,YACT,MAAM,GAAA,CAAI,IAAA;AAAA,YACV,UAAU,GAAA,CAAI,QAAA;AAAA,YACd,SAAA,EAAW;AAAA,WACZ,CAAA;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT,CAAA;AACF;AAEO,SAAS,wBAAwB,GAAA,EAAkB;AACxD,EAAA,OAAO,OAAO,KAAA,KAKR;AACJ,IAAA,MAAM,EAAE,UAAA,EAAY,EAAA,EAAI,KAAA,EAAO,QAAO,GAAI,KAAA;AAC1C,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,QAAA,CAAS,aAAA,CAAc,UAAU,CAAA;AAGpD,IAAA,IAAI,MAAA,CAAO,QAAQ,IAAA,EAAM;AACvB,MAAA,MAAM,OAAA,GAAU,MAAM,cAAA,CAAe,MAAA,CAAO,OAAO,IAAA,EAAM;AAAA,QACvD,KAAK,GAAA,CAAI,GAAA;AAAA,QACT,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,UAAU,GAAA,CAAI,QAAA;AAAA,QACd;AAAA,OACD,CAAA;AACD,MAAA,IAAI,OAAA,KAAY,KAAA,EAAO,MAAM,IAAI,MAAM,eAAe,CAAA;AAAA,IACxD;AAEA,IAAA,MAAM,GAAA,GAAM,MAAM,GAAA,CAAI,EAAA,CAAG,QAAA,CAAS;AAAA,MAChC,UAAA;AAAA,MACA,EAAA;AAAA,MACA,OAAO,KAAA,IAAS,CAAA;AAAA,MAChB,UAAU,GAAA,CAAI,QAAA;AAAA,MACd;AAAA,KACD,CAAA;AAED,IAAA,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,CAAA,oBAAA,EAAuB,UAAU,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAGnE,IAAA,IAAI,MAAA,CAAO,OAAO,SAAA,EAAW;AAC3B,MAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,SAAA,EAAW;AACzC,QAAA,MAAM,IAAA,CAAK;AAAA,UACT,UAAA;AAAA,UACA,GAAA;AAAA,UACA,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,UAAU,GAAA,CAAI,QAAA;AAAA,UACd,SAAA,EAAW,MAAA;AAAA,UACX;AAAA,SACD,CAAA;AAAA,MACH;AAAA,IACF;AAEA,IAAA,OAAO,GAAA;AAAA,EACT,CAAA;AACF;AAEO,SAAS,sBAAsB,GAAA,EAAkB;AACtD,EAAA,OAAO,OAAO,KAAA,KAKR;AACJ,IAAA,MAAM,EAAE,UAAA,EAAY,IAAA,EAAM,KAAA,EAAO,QAAO,GAAI,KAAA;AAC5C,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,QAAA,CAAS,aAAA,CAAc,UAAU,CAAA;AAGpD,IAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ;AACzB,MAAA,MAAM,OAAA,GAAU,MAAM,cAAA,CAAe,MAAA,CAAO,OAAO,MAAA,EAAQ;AAAA,QACzD,KAAK,GAAA,CAAI,GAAA;AAAA,QACT,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,UAAU,GAAA,CAAI,QAAA;AAAA,QACd;AAAA,OACD,CAAA;AACD,MAAA,IAAI,OAAA,KAAY,KAAA,EAAO,MAAM,IAAI,MAAM,eAAe,CAAA;AAAA,IACxD;AAGA,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,QAAA,CAAS,kBAAA,CAAmB,UAAU,CAAA;AACzD,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA;AAGnC,IAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,GAAA,CAAI,QAAA,EAAU;AACvC,MAAA,SAAA,CAAU,WAAW,GAAA,CAAI,QAAA;AAAA,IAC3B;AAGA,IAAA,IAAI,MAAA,CAAO,OAAO,cAAA,EAAgB;AAChC,MAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,cAAA,EAAgB;AAC9C,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK;AAAA,UAC5B,UAAA;AAAA,UACA,IAAA,EAAM,SAAA;AAAA,UACN,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,UAAU,GAAA,CAAI,QAAA;AAAA,UACd,SAAA,EAAW;AAAA,SACZ,CAAA;AACD,QAAA,IAAI,UAAA,EAAY,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,UAAU,CAAA;AAAA,MACrD;AAAA,IACF;AAGA,IAAA,IAAI,MAAA,CAAO,OAAO,YAAA,EAAc;AAC9B,MAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,YAAA,EAAc;AAC5C,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK;AAAA,UAC5B,UAAA;AAAA,UACA,IAAA,EAAM,SAAA;AAAA,UACN,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,UAAU,GAAA,CAAI,QAAA;AAAA,UACd,SAAA,EAAW;AAAA,SACZ,CAAA;AACD,QAAA,IAAI,UAAA,EAAY,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,UAAU,CAAA;AAAA,MACrD;AAAA,IACF;AAGA,IAAA,MAAM,GAAA,GAAM,MAAM,GAAA,CAAI,EAAA,CAAG,MAAA,CAAO;AAAA,MAC9B,UAAA;AAAA,MACA,IAAA,EAAM,SAAA;AAAA,MACN,OAAO,KAAA,IAAS,CAAA;AAAA,MAChB,UAAU,GAAA,CAAI,QAAA;AAAA,MACd;AAAA,KACD,CAAA;AAGD,IAAA,IAAI,MAAA,CAAO,OAAO,WAAA,EAAa;AAC7B,MAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,WAAA,EAAa;AAC3C,QAAA,MAAM,IAAA,CAAK;AAAA,UACT,UAAA;AAAA,UACA,GAAA;AAAA,UACA,IAAA,EAAM,SAAA;AAAA,UACN,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,UAAU,GAAA,CAAI,QAAA;AAAA,UACd,SAAA,EAAW;AAAA,SACZ,CAAA;AAAA,MACH;AAAA,IACF;AAEA,IAAA,MAAM,cAAA,CAAe,GAAA,EAAK,eAAA,CAAgB,UAAA,EAAY,QAAQ,CAAA,EAAG;AAAA,MAC/D,UAAA;AAAA,MACA,IAAA,EAAM,GAAA;AAAA,MACN,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,OAAO,EAAE,GAAA,EAAI;AAAA,EACf,CAAA;AACF;AAEO,SAAS,sBAAsB,GAAA,EAAkB;AACtD,EAAA,OAAO,OAAO,KAAA,KAMR;AACJ,IAAA,MAAM,EAAE,UAAA,EAAY,EAAA,EAAI,IAAA,EAAM,KAAA,EAAO,QAAO,GAAI,KAAA;AAChD,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,QAAA,CAAS,aAAA,CAAc,UAAU,CAAA;AAGpD,IAAA,MAAM,WAAA,GAAc,MAAM,GAAA,CAAI,EAAA,CAAG,QAAA,CAAS;AAAA,MACxC,UAAA;AAAA,MACA,EAAA;AAAA,MACA,UAAU,GAAA,CAAI;AAAA,KACf,CAAA;AAED,IAAA,IAAI,CAAC,WAAA;AACH,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,UAAU,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAG3D,IAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ;AACzB,MAAA,MAAM,OAAA,GAAU,MAAM,cAAA,CAAe,MAAA,CAAO,OAAO,MAAA,EAAQ;AAAA,QACzD,KAAK,GAAA,CAAI,GAAA;AAAA,QACT,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,UAAU,GAAA,CAAI,QAAA;AAAA,QACd,EAAA;AAAA,QACA,GAAA,EAAK,WAAA;AAAA,QACL;AAAA,OACD,CAAA;AACD,MAAA,IAAI,OAAA,KAAY,KAAA,EAAO,MAAM,IAAI,MAAM,eAAe,CAAA;AAAA,IACxD;AAGA,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,QAAA,CAAS,kBAAA,CAAmB,UAAU,CAAA;AACzD,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA;AAGnC,IAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,GAAA,CAAI,QAAA,EAAU;AACvC,MAAA,SAAA,CAAU,WAAW,GAAA,CAAI,QAAA;AAAA,IAC3B;AAGA,IAAA,IAAI,MAAA,CAAO,OAAO,cAAA,EAAgB;AAChC,MAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,cAAA,EAAgB;AAC9C,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK;AAAA,UAC5B,UAAA;AAAA,UACA,IAAA,EAAM,SAAA;AAAA,UACN,WAAA;AAAA,UACA,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,UAAU,GAAA,CAAI,QAAA;AAAA,UACd,SAAA,EAAW,QAAA;AAAA,UACX;AAAA,SACD,CAAA;AACD,QAAA,IAAI,UAAA,EAAY,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,UAAU,CAAA;AAAA,MACrD;AAAA,IACF;AAGA,IAAA,IAAI,MAAA,CAAO,OAAO,YAAA,EAAc;AAC9B,MAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,YAAA,EAAc;AAC5C,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK;AAAA,UAC5B,UAAA;AAAA,UACA,IAAA,EAAM,SAAA;AAAA,UACN,WAAA;AAAA,UACA,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,UAAU,GAAA,CAAI,QAAA;AAAA,UACd,SAAA,EAAW,QAAA;AAAA,UACX;AAAA,SACD,CAAA;AACD,QAAA,IAAI,UAAA,EAAY,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,UAAU,CAAA;AAAA,MACrD;AAAA,IACF;AAGA,IAAA,MAAM,GAAA,GAAM,MAAM,GAAA,CAAI,EAAA,CAAG,MAAA,CAAO;AAAA,MAC9B,UAAA;AAAA,MACA,EAAA;AAAA,MACA,IAAA,EAAM,SAAA;AAAA,MACN,OAAO,KAAA,IAAS,CAAA;AAAA,MAChB,UAAU,GAAA,CAAI,QAAA;AAAA,MACd;AAAA,KACD,CAAA;AAGD,IAAA,IAAI,MAAA,CAAO,OAAO,WAAA,EAAa;AAC7B,MAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,WAAA,EAAa;AAC3C,QAAA,MAAM,IAAA,CAAK;AAAA,UACT,UAAA;AAAA,UACA,GAAA;AAAA,UACA,IAAA,EAAM,SAAA;AAAA,UACN,WAAA;AAAA,UACA,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,UAAU,GAAA,CAAI,QAAA;AAAA,UACd,SAAA,EAAW,QAAA;AAAA,UACX;AAAA,SACD,CAAA;AAAA,MACH;AAAA,IACF;AAEA,IAAA,MAAM,cAAA,CAAe,GAAA,EAAK,eAAA,CAAgB,UAAA,EAAY,QAAQ,CAAA,EAAG;AAAA,MAC/D,UAAA;AAAA,MACA,IAAA,EAAM,GAAA;AAAA,MACN,YAAA,EAAc,WAAA;AAAA,MACd,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,OAAO,EAAE,GAAA,EAAI;AAAA,EACf,CAAA;AACF;AAEO,SAAS,sBAAsB,GAAA,EAAkB;AACtD,EAAA,OAAO,OAAO,KAAA,KAA8C;AAC1D,IAAA,MAAM,EAAE,UAAA,EAAY,EAAA,EAAG,GAAI,KAAA;AAC3B,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,QAAA,CAAS,aAAA,CAAc,UAAU,CAAA;AAGpD,IAAA,MAAM,WAAA,GAAc,MAAM,GAAA,CAAI,EAAA,CAAG,QAAA,CAAS;AAAA,MACxC,UAAA;AAAA,MACA,EAAA;AAAA,MACA,UAAU,GAAA,CAAI;AAAA,KACf,CAAA;AAED,IAAA,IAAI,CAAC,WAAA;AACH,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,UAAU,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAG3D,IAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ;AACzB,MAAA,MAAM,OAAA,GAAU,MAAM,cAAA,CAAe,MAAA,CAAO,OAAO,MAAA,EAAQ;AAAA,QACzD,KAAK,GAAA,CAAI,GAAA;AAAA,QACT,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,UAAU,GAAA,CAAI,QAAA;AAAA,QACd,EAAA;AAAA,QACA,GAAA,EAAK;AAAA,OACN,CAAA;AACD,MAAA,IAAI,OAAA,KAAY,KAAA,EAAO,MAAM,IAAI,MAAM,eAAe,CAAA;AAAA,IACxD;AAGA,IAAA,IAAI,MAAA,CAAO,OAAO,YAAA,EAAc;AAC9B,MAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,YAAA,EAAc;AAC5C,QAAA,MAAM,IAAA,CAAK;AAAA,UACT,UAAA;AAAA,UACA,GAAA,EAAK,WAAA;AAAA,UACL,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,UAAU,GAAA,CAAI,QAAA;AAAA,UACd,SAAA,EAAW,QAAA;AAAA,UACX;AAAA,SACD,CAAA;AAAA,MACH;AAAA,IACF;AAGA,IAAA,MAAM,GAAA,GAAM,MAAM,GAAA,CAAI,EAAA,CAAG,MAAA,CAAO;AAAA,MAC9B,UAAA;AAAA,MACA,EAAA;AAAA,MACA,UAAU,GAAA,CAAI;AAAA,KACf,CAAA;AAGD,IAAA,IAAI,MAAA,CAAO,OAAO,WAAA,EAAa;AAC7B,MAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,WAAA,EAAa;AAC3C,QAAA,MAAM,IAAA,CAAK;AAAA,UACT,UAAA;AAAA,UACA,GAAA;AAAA,UACA,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,MAAM,GAAA,CAAI,IAAA;AAAA,UACV,UAAU,GAAA,CAAI,QAAA;AAAA,UACd,SAAA,EAAW,QAAA;AAAA,UACX;AAAA,SACD,CAAA;AAAA,MACH;AAAA,IACF;AAEA,IAAA,MAAM,cAAA,CAAe,GAAA,EAAK,eAAA,CAAgB,UAAA,EAAY,QAAQ,CAAA,EAAG;AAAA,MAC/D,UAAA;AAAA,MACA,IAAA,EAAM,GAAA;AAAA,MACN,YAAA,EAAc,WAAA;AAAA,MACd,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,OAAO,EAAE,GAAA,EAAK,OAAA,EAAS,sBAAA,EAAuB;AAAA,EAChD,CAAA;AACF;AAEO,SAAS,qBAAqB,GAAA,EAAkB;AACrD,EAAA,OAAO,OAAO,KAAA,KAA+D;AAC3E,IAAA,MAAM,EAAE,UAAA,EAAY,KAAA,EAAM,GAAI,KAAA;AAC9B,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,QAAA,CAAS,aAAA,CAAc,UAAU,CAAA;AAGpD,IAAA,IAAI,MAAA,CAAO,QAAQ,IAAA,EAAM;AACvB,MAAA,MAAM,OAAA,GAAU,MAAM,cAAA,CAAe,MAAA,CAAO,OAAO,IAAA,EAAM;AAAA,QACvD,KAAK,GAAA,CAAI,GAAA;AAAA,QACT,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,UAAU,GAAA,CAAI;AAAA,OACf,CAAA;AACD,MAAA,IAAI,OAAA,KAAY,KAAA,EAAO,MAAM,IAAI,MAAM,eAAe,CAAA;AAAA,IACxD;AAEA,IAAA,MAAM,SAAA,GAAY,MAAM,GAAA,CAAI,EAAA,CAAG,KAAA,CAAM;AAAA,MACnC,UAAA;AAAA,MACA,KAAA,EAAO,SAAS,EAAC;AAAA,MACjB,UAAU,GAAA,CAAI;AAAA,KACf,CAAA;AAED,IAAA,OAAO,EAAE,SAAA,EAAU;AAAA,EACrB,CAAA;AACF;;;AC5dO,SAAS,oBAAoB,GAAA,EAAkB;AACpD,EAAA,MAAM,SAA8B,EAAC;AACrC,EAAA,MAAM,WAAA,GAAc,GAAA,CAAI,QAAA,CAAS,cAAA,EAAe;AAEhD,EAAA,KAAA,MAAW,cAAc,WAAA,EAAa;AACpC,IAAA,MAAM,OAAO,UAAA,CAAW,IAAA;AAExB,IAAA,MAAA,CAAO,IAAI,CAAA,GAAI;AAAA,MACb,IAAA,EAAM,oBAAoB,GAAG,CAAA;AAAA,MAC7B,QAAA,EAAU,wBAAwB,GAAG,CAAA;AAAA,MACrC,MAAA,EAAQ,sBAAsB,GAAG,CAAA;AAAA,MACjC,MAAA,EAAQ,sBAAsB,GAAG,CAAA;AAAA,MACjC,MAAA,EAAQ,sBAAsB,GAAG,CAAA;AAAA,MACjC,KAAA,EAAO,qBAAqB,GAAG;AAAA,KACjC;AAAA,EACF;AAGA,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,QAAA,CAAS,UAAA,EAAW;AACxC,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AAEpB,IAAA,MAAA,CAAO,CAAA,SAAA,EAAY,IAAI,CAAA,CAAE,CAAA,GAAI;AAAA,MAC3B,KAAK,YAAY;AACf,QAAA,MAAM,GAAA,GAAM,MAAM,GAAA,CAAI,EAAA,CAAG,OAAA,CAAQ;AAAA,UAC/B,UAAA,EAAY,YAAY,IAAI,CAAA,CAAA;AAAA,UAC5B,OAAO,EAAC;AAAA,UACR,UAAU,GAAA,CAAI;AAAA,SACf,CAAA;AACD,QAAA,OAAO,GAAA;AAAA,MACT,CAAA;AAAA,MACA,MAAA,EAAQ,OAAO,KAAA,KAAyC;AACtD,QAAA,MAAM,MAAA,GAAS,GAAA,CAAI,QAAA,CAAS,YAAA,CAAa,IAAI,CAAA;AAC7C,QAAA,MAAM,SAAA,GAAY,MAAA,CAAO,KAAA,CAAM,KAAA,CAAM,IAAI,CAAA;AAEzC,QAAA,MAAM,GAAA,GAAM,MAAM,GAAA,CAAI,EAAA,CAAG,MAAA,CAAO;AAAA,UAC9B,UAAA,EAAY,YAAY,IAAI,CAAA,CAAA;AAAA,UAC5B,IAAA,EAAM,EAAE,GAAG,SAAA,EAAW,IAAI,IAAA,EAAK;AAAA,UAC/B,UAAU,GAAA,CAAI;AAAA,SACf,CAAA;AAED,QAAA,OAAO,GAAA;AAAA,MACT;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAsDO,SAAS,iBAAiB,GAAA,EAA8B;AAE7D,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,QAAA,EAAU,MAAA,EAAQ,SAAA;AACxC,EAAA,IAAI,SAAA,EAAW,gBAAgB,KAAA,EAAO;AACpC,IAAA,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAAA,EACxC;AAEA,EAAA,OAAO,oBAAoB,GAAG,CAAA;AAChC","file":"chunk-OUGKLCYF.js","sourcesContent":["import type { BaseAdapter } from \"../../registry/types.js\";\nimport type { User, Request } from \"../../hooks/types.js\";\nimport {\n  validateApiKey,\n  extractApiKeyFromRequest,\n  createApiKeyContext,\n} from \"../../auth/api-key.js\";\nimport { createWebhookService } from \"../../webhooks/index.js\";\n\n// ============================================================================\n// Context Types\n// ============================================================================\n\nexport interface ApiKeyContext {\n  userId: string;\n  user: Partial<User>;\n  permissions: string[];\n  apiKeyId: string;\n  tenantId?: string;\n  role?: string;\n}\n\nexport interface KyroContext {\n  db: BaseAdapter;\n  registry: any;\n  user?: User;\n  tenantID?: string;\n  req: Request;\n  apiKey?: ApiKeyContext;\n  webhookService?: ReturnType<typeof createWebhookService>;\n  settings?: Record<string, any>;\n  [key: string]: any;\n}\n\n// ============================================================================\n// Context Factory\n// ============================================================================\n\nexport async function createContext(options: {\n  db: BaseAdapter;\n  registry: any;\n  req: Request;\n  user?: User;\n  tenantID?: string;\n  settings?: Record<string, any>;\n}): Promise<KyroContext> {\n  const webhookService = createWebhookService(options.db);\n\n  const baseContext: KyroContext = {\n    db: options.db,\n    registry: options.registry,\n    req: options.req,\n    user: options.user,\n    tenantID: options.tenantID,\n    webhookService,\n    settings: options.settings,\n  };\n\n  const apiKeyRaw = extractApiKeyFromRequest(options.req as any);\n  if (apiKeyRaw) {\n    const result = await validateApiKey(apiKeyRaw, options.db);\n    if (result.valid) {\n      baseContext.user = (result.user as User) || options.user;\n      baseContext.tenantID = result.tenantId || options.tenantID;\n      baseContext.apiKey = createApiKeyContext(result) as ApiKeyContext;\n    }\n  }\n\n  return baseContext;\n}\n","import type {\n  FindArgs,\n  CreateArgs,\n  UpdateArgs,\n  DeleteArgs,\n} from \"../../registry/types.js\";\nimport { runHooks } from \"../../hooks/types.js\";\nimport { evaluateAccess } from \"../../access/types.js\";\nexport type { KyroContext, ApiKeyContext } from \"./context.js\";\nexport { createContext } from \"./context.js\";\nimport type { KyroContext } from \"./context.js\";\nimport { WEBHOOK_EVENTS, type WebhookEvent } from \"../../webhooks/types.js\";\n\nconst COLLECTION_EVENT_MAP: Record<\n  string,\n  { create: WebhookEvent; update: WebhookEvent; delete: WebhookEvent }\n> = {\n  _media: {\n    create: WEBHOOK_EVENTS.MEDIA_UPLOAD,\n    update: WEBHOOK_EVENTS.MEDIA_UPLOAD,\n    delete: WEBHOOK_EVENTS.MEDIA_DELETE,\n  },\n};\n\nfunction getWebhookEvent(\n  collection: string,\n  operation: \"create\" | \"update\" | \"delete\",\n): WebhookEvent {\n  const mapped = COLLECTION_EVENT_MAP[collection];\n  if (mapped) return mapped[operation];\n  return `collection.${operation}` as WebhookEvent;\n}\n\nasync function triggerWebhook(\n  ctx: KyroContext,\n  event: WebhookEvent,\n  payload: {\n    collection: string;\n    data: unknown;\n    previousData?: unknown;\n    operation: \"create\" | \"update\" | \"delete\";\n  },\n) {\n  if (!ctx.webhookService) return;\n  try {\n    await ctx.webhookService.trigger(event, {\n      collection: payload.collection,\n      operation: payload.operation,\n      data: payload.data,\n      previousData: payload.previousData,\n      user: ctx.user\n        ? { id: ctx.user.id, email: ctx.user.email, role: ctx.user.role }\n        : undefined,\n      tenantId: ctx.tenantID,\n    });\n  } catch (err) {\n    console.error(`[Webhook] Failed to trigger ${event}:`, err);\n  }\n}\n\n// ============================================================================\n// CRUD Procedure Builders\n// ============================================================================\n\nexport function createFindProcedure(ctx: KyroContext) {\n  return async (input: {\n    collection: string;\n    where?: Record<string, any>;\n    sort?: string;\n    limit?: number;\n    page?: number;\n    depth?: number;\n    select?: string[];\n  }) => {\n    const { collection, where, sort, limit, page, depth, select } = input;\n    const config = ctx.registry.getCollection(collection);\n\n    // Check access\n    if (config.access?.read) {\n      const allowed = await evaluateAccess(config.access.read, {\n        req: ctx.req,\n        user: ctx.user,\n        tenantID: ctx.tenantID,\n      });\n      if (allowed === false) throw new Error(\"Access denied\");\n    }\n\n    // Run beforeRead hooks\n    if (config.hooks?.beforeRead) {\n      for (const hook of config.hooks.beforeRead) {\n        await hook({\n          collection,\n          req: ctx.req,\n          user: ctx.user,\n          tenantID: ctx.tenantID,\n          operation: \"read\",\n          where,\n        });\n      }\n    }\n\n    // Execute query\n    const result = await ctx.db.find({\n      collection,\n      where: where || {},\n      sort,\n      limit: limit || 10,\n      page: page || 1,\n      depth: depth || 0,\n      tenantID: ctx.tenantID,\n      select,\n    });\n\n    // Run afterRead hooks\n    if (config.hooks?.afterRead) {\n      for (const doc of result.docs) {\n        for (const hook of config.hooks.afterRead) {\n          await hook({\n            collection,\n            doc,\n            req: ctx.req,\n            user: ctx.user,\n            tenantID: ctx.tenantID,\n            operation: \"read\",\n          });\n        }\n      }\n    }\n\n    return result;\n  };\n}\n\nexport function createFindByIDProcedure(ctx: KyroContext) {\n  return async (input: {\n    collection: string;\n    id: string;\n    depth?: number;\n    select?: string[];\n  }) => {\n    const { collection, id, depth, select } = input;\n    const config = ctx.registry.getCollection(collection);\n\n    // Check access\n    if (config.access?.read) {\n      const allowed = await evaluateAccess(config.access.read, {\n        req: ctx.req,\n        user: ctx.user,\n        tenantID: ctx.tenantID,\n        id,\n      });\n      if (allowed === false) throw new Error(\"Access denied\");\n    }\n\n    const doc = await ctx.db.findByID({\n      collection,\n      id,\n      depth: depth || 0,\n      tenantID: ctx.tenantID,\n      select,\n    });\n\n    if (!doc) throw new Error(`Document not found: ${collection}/${id}`);\n\n    // Run afterRead hooks\n    if (config.hooks?.afterRead) {\n      for (const hook of config.hooks.afterRead) {\n        await hook({\n          collection,\n          doc,\n          req: ctx.req,\n          user: ctx.user,\n          tenantID: ctx.tenantID,\n          operation: \"read\",\n          id,\n        });\n      }\n    }\n\n    return doc;\n  };\n}\n\nexport function createCreateProcedure(ctx: KyroContext) {\n  return async (input: {\n    collection: string;\n    data: Record<string, any>;\n    depth?: number;\n    select?: string[];\n  }) => {\n    const { collection, data, depth, select } = input;\n    const config = ctx.registry.getCollection(collection);\n\n    // Check access\n    if (config.access?.create) {\n      const allowed = await evaluateAccess(config.access.create, {\n        req: ctx.req,\n        user: ctx.user,\n        tenantID: ctx.tenantID,\n        data,\n      });\n      if (allowed === false) throw new Error(\"Access denied\");\n    }\n\n    // Validate with Zod\n    const schema = ctx.registry.getCreateZodSchema(collection);\n    const validated = schema.parse(data);\n\n    // Add tenantID if scoped\n    if (config.tenantScoped && ctx.tenantID) {\n      validated.tenantID = ctx.tenantID;\n    }\n\n    // Run beforeValidate hooks\n    if (config.hooks?.beforeValidate) {\n      for (const hook of config.hooks.beforeValidate) {\n        const hookResult = await hook({\n          collection,\n          data: validated,\n          req: ctx.req,\n          user: ctx.user,\n          tenantID: ctx.tenantID,\n          operation: \"create\",\n        });\n        if (hookResult) Object.assign(validated, hookResult);\n      }\n    }\n\n    // Run beforeChange hooks\n    if (config.hooks?.beforeChange) {\n      for (const hook of config.hooks.beforeChange) {\n        const hookResult = await hook({\n          collection,\n          data: validated,\n          req: ctx.req,\n          user: ctx.user,\n          tenantID: ctx.tenantID,\n          operation: \"create\",\n        });\n        if (hookResult) Object.assign(validated, hookResult);\n      }\n    }\n\n    // Execute create\n    const doc = await ctx.db.create({\n      collection,\n      data: validated,\n      depth: depth || 0,\n      tenantID: ctx.tenantID,\n      select,\n    });\n\n    // Run afterChange hooks\n    if (config.hooks?.afterChange) {\n      for (const hook of config.hooks.afterChange) {\n        await hook({\n          collection,\n          doc,\n          data: validated,\n          req: ctx.req,\n          user: ctx.user,\n          tenantID: ctx.tenantID,\n          operation: \"create\",\n        });\n      }\n    }\n\n    await triggerWebhook(ctx, getWebhookEvent(collection, \"create\"), {\n      collection,\n      data: doc,\n      operation: \"create\",\n    });\n\n    return { doc };\n  };\n}\n\nexport function createUpdateProcedure(ctx: KyroContext) {\n  return async (input: {\n    collection: string;\n    id: string;\n    data: Record<string, any>;\n    depth?: number;\n    select?: string[];\n  }) => {\n    const { collection, id, data, depth, select } = input;\n    const config = ctx.registry.getCollection(collection);\n\n    // Get original doc for hooks\n    const originalDoc = await ctx.db.findByID({\n      collection,\n      id,\n      tenantID: ctx.tenantID,\n    });\n\n    if (!originalDoc)\n      throw new Error(`Document not found: ${collection}/${id}`);\n\n    // Check access\n    if (config.access?.update) {\n      const allowed = await evaluateAccess(config.access.update, {\n        req: ctx.req,\n        user: ctx.user,\n        tenantID: ctx.tenantID,\n        id,\n        doc: originalDoc,\n        data,\n      });\n      if (allowed === false) throw new Error(\"Access denied\");\n    }\n\n    // Validate with Zod\n    const schema = ctx.registry.getUpdateZodSchema(collection);\n    const validated = schema.parse(data);\n\n    // Add tenantID if scoped\n    if (config.tenantScoped && ctx.tenantID) {\n      validated.tenantID = ctx.tenantID;\n    }\n\n    // Run beforeValidate hooks\n    if (config.hooks?.beforeValidate) {\n      for (const hook of config.hooks.beforeValidate) {\n        const hookResult = await hook({\n          collection,\n          data: validated,\n          originalDoc,\n          req: ctx.req,\n          user: ctx.user,\n          tenantID: ctx.tenantID,\n          operation: \"update\",\n          id,\n        });\n        if (hookResult) Object.assign(validated, hookResult);\n      }\n    }\n\n    // Run beforeChange hooks\n    if (config.hooks?.beforeChange) {\n      for (const hook of config.hooks.beforeChange) {\n        const hookResult = await hook({\n          collection,\n          data: validated,\n          originalDoc,\n          req: ctx.req,\n          user: ctx.user,\n          tenantID: ctx.tenantID,\n          operation: \"update\",\n          id,\n        });\n        if (hookResult) Object.assign(validated, hookResult);\n      }\n    }\n\n    // Execute update\n    const doc = await ctx.db.update({\n      collection,\n      id,\n      data: validated,\n      depth: depth || 0,\n      tenantID: ctx.tenantID,\n      select,\n    });\n\n    // Run afterChange hooks\n    if (config.hooks?.afterChange) {\n      for (const hook of config.hooks.afterChange) {\n        await hook({\n          collection,\n          doc,\n          data: validated,\n          originalDoc,\n          req: ctx.req,\n          user: ctx.user,\n          tenantID: ctx.tenantID,\n          operation: \"update\",\n          id,\n        });\n      }\n    }\n\n    await triggerWebhook(ctx, getWebhookEvent(collection, \"update\"), {\n      collection,\n      data: doc,\n      previousData: originalDoc,\n      operation: \"update\",\n    });\n\n    return { doc };\n  };\n}\n\nexport function createDeleteProcedure(ctx: KyroContext) {\n  return async (input: { collection: string; id: string }) => {\n    const { collection, id } = input;\n    const config = ctx.registry.getCollection(collection);\n\n    // Get original doc for hooks\n    const originalDoc = await ctx.db.findByID({\n      collection,\n      id,\n      tenantID: ctx.tenantID,\n    });\n\n    if (!originalDoc)\n      throw new Error(`Document not found: ${collection}/${id}`);\n\n    // Check access\n    if (config.access?.delete) {\n      const allowed = await evaluateAccess(config.access.delete, {\n        req: ctx.req,\n        user: ctx.user,\n        tenantID: ctx.tenantID,\n        id,\n        doc: originalDoc,\n      });\n      if (allowed === false) throw new Error(\"Access denied\");\n    }\n\n    // Run beforeDelete hooks\n    if (config.hooks?.beforeDelete) {\n      for (const hook of config.hooks.beforeDelete) {\n        await hook({\n          collection,\n          doc: originalDoc,\n          req: ctx.req,\n          user: ctx.user,\n          tenantID: ctx.tenantID,\n          operation: \"delete\",\n          id,\n        });\n      }\n    }\n\n    // Execute delete\n    const doc = await ctx.db.delete({\n      collection,\n      id,\n      tenantID: ctx.tenantID,\n    });\n\n    // Run afterDelete hooks\n    if (config.hooks?.afterDelete) {\n      for (const hook of config.hooks.afterDelete) {\n        await hook({\n          collection,\n          doc,\n          req: ctx.req,\n          user: ctx.user,\n          tenantID: ctx.tenantID,\n          operation: \"delete\",\n          id,\n        });\n      }\n    }\n\n    await triggerWebhook(ctx, getWebhookEvent(collection, \"delete\"), {\n      collection,\n      data: doc,\n      previousData: originalDoc,\n      operation: \"delete\",\n    });\n\n    return { doc, message: \"Deleted successfully\" };\n  };\n}\n\nexport function createCountProcedure(ctx: KyroContext) {\n  return async (input: { collection: string; where?: Record<string, any> }) => {\n    const { collection, where } = input;\n    const config = ctx.registry.getCollection(collection);\n\n    // Check access\n    if (config.access?.read) {\n      const allowed = await evaluateAccess(config.access.read, {\n        req: ctx.req,\n        user: ctx.user,\n        tenantID: ctx.tenantID,\n      });\n      if (allowed === false) throw new Error(\"Access denied\");\n    }\n\n    const totalDocs = await ctx.db.count({\n      collection,\n      where: where || {},\n      tenantID: ctx.tenantID,\n    });\n\n    return { totalDocs };\n  };\n}\n","import type { KyroContext } from \"./context.js\";\nimport {\n  createFindProcedure,\n  createFindByIDProcedure,\n  createCreateProcedure,\n  createUpdateProcedure,\n  createDeleteProcedure,\n  createCountProcedure,\n} from \"./procedures.js\";\n\n// ============================================================================\n// Dynamic Router Generator\n// ============================================================================\n\nexport function createDynamicRouter(ctx: KyroContext) {\n  const router: Record<string, any> = {};\n  const collections = ctx.registry.getCollections();\n\n  for (const collection of collections) {\n    const slug = collection.slug;\n\n    router[slug] = {\n      find: createFindProcedure(ctx),\n      findByID: createFindByIDProcedure(ctx),\n      create: createCreateProcedure(ctx),\n      update: createUpdateProcedure(ctx),\n      delete: createDeleteProcedure(ctx),\n      count: createCountProcedure(ctx),\n    };\n  }\n\n  // Add globals\n  const globals = ctx.registry.getGlobals();\n  for (const global of globals) {\n    const slug = global.slug;\n\n    router[`_globals_${slug}`] = {\n      get: async () => {\n        const doc = await ctx.db.findOne({\n          collection: `_globals_${slug}`,\n          where: {},\n          tenantID: ctx.tenantID,\n        });\n        return doc;\n      },\n      update: async (input: { data: Record<string, any> }) => {\n        const schema = ctx.registry.getZodSchema(slug);\n        const validated = schema.parse(input.data);\n\n        const doc = await ctx.db.create({\n          collection: `_globals_${slug}`,\n          data: { ...validated, id: slug },\n          tenantID: ctx.tenantID,\n        });\n\n        return doc;\n      },\n    };\n  }\n\n  return router;\n}\n\n// ============================================================================\n// Typed Router Interface\n// ============================================================================\n\nexport interface KyroRouter {\n  [collectionSlug: string]: {\n    find: (input: {\n      where?: Record<string, any>;\n      sort?: string;\n      limit?: number;\n      page?: number;\n      depth?: number;\n      select?: string[];\n    }) => Promise<{\n      docs: any[];\n      totalDocs: number;\n      limit: number;\n      totalPages: number;\n      page: number;\n      pagingCounter: number;\n      hasPrevPage: boolean;\n      hasNextPage: boolean;\n      prevPage: number | null;\n      nextPage: number | null;\n    }>;\n    findByID: (input: {\n      id: string;\n      depth?: number;\n      select?: string[];\n    }) => Promise<any>;\n    create: (input: {\n      data: Record<string, any>;\n      depth?: number;\n      select?: string[];\n    }) => Promise<{ doc: any }>;\n    update: (input: {\n      id: string;\n      data: Record<string, any>;\n      depth?: number;\n      select?: string[];\n    }) => Promise<{ doc: any }>;\n    delete: (input: { id: string }) => Promise<{ doc: any; message: string }>;\n    count: (input: {\n      where?: Record<string, any>;\n    }) => Promise<{ totalDocs: number }>;\n  };\n}\n\n// ============================================================================\n// Server Entry\n// ============================================================================\n\nexport function createKyroServer(ctx: KyroContext): KyroRouter {\n  // Check if tRPC is disabled in settings\n  const apiAccess = ctx.settings?.access?.apiAccess;\n  if (apiAccess?.trpcEnabled === false) {\n    throw new Error(\"tRPC API is disabled\");\n  }\n\n  return createDynamicRouter(ctx) as KyroRouter;\n}\n"]}