@kyro-cms/core 0.10.3 → 0.10.5

package/dist/chunk-4OCMVGEY.cjs

@@ -1,173 +0,0 @@
-'use strict';
-
-var crypto = require('crypto');
-
-// src/access/types.ts
-async function evaluateAccess(access, args) {
-  if (typeof access === "boolean") {
-    return access;
-  }
-  if (typeof access === "function") {
-    return await access(args);
-  }
-  return true;
-}
-function mergeWhereClauses(...whereClauses) {
-  const result = {};
-  for (const clause of whereClauses) {
-    if (clause && typeof clause === "object") {
-      Object.assign(result, clause);
-    }
-  }
-  return result;
-}
-function getWhereClause(access, args) {
-  return evaluateAccess(access, args).then((result) => {
-    if (result === true) return void 0;
-    if (result === false) return { _id: { $eq: null } };
-    return result;
-  });
-}
-var API_KEY_COLLECTION = "api_keys";
-function generateKeyPrefix(key) {
-  return key.substring(0, 8);
-}
-function constantTimeCompare(a, b) {
-  if (a.length !== b.length) {
-    return false;
-  }
-  try {
-    return crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));
-  } catch {
-    return false;
-  }
-}
-async function validateApiKey(rawKey, db, userLookup) {
-  if (!rawKey || typeof rawKey !== "string") {
-    return { valid: false, error: "No API key provided" };
-  }
-  if (!rawKey.startsWith("kyro_")) {
-    return { valid: false, error: "Invalid API key format" };
-  }
-  const keyPrefix = generateKeyPrefix(rawKey);
-  try {
-    const result = await db.find({
-      collection: API_KEY_COLLECTION,
-      where: { keyPrefix: { equals: keyPrefix } },
-      limit: 100,
-      page: 1
-    });
-    if (!result.docs || result.docs.length === 0) {
-      return { valid: false, error: "Invalid API key" };
-    }
-    let matchedKey = null;
-    for (const doc of result.docs) {
-      const record = doc;
-      if (constantTimeCompare(record.key, rawKey)) {
-        matchedKey = record;
-        break;
-      }
-    }
-    if (!matchedKey) {
-      return { valid: false, error: "Invalid API key" };
-    }
-    if (matchedKey.expiresAt) {
-      const expiresAt = new Date(matchedKey.expiresAt);
-      if (expiresAt < /* @__PURE__ */ new Date()) {
-        return { valid: false, error: "API key has expired" };
-      }
-    }
-    try {
-      await db.update({
-        collection: API_KEY_COLLECTION,
-        id: matchedKey.id,
-        data: { lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }
-      });
-    } catch {
-    }
-    const user = {
-      id: matchedKey.userId,
-      role: matchedKey.role || "author",
-      tenantId: matchedKey.tenantId
-    };
-    if (userLookup) {
-      const dbUser = await userLookup(matchedKey.userId);
-      if (dbUser) {
-        Object.assign(user, dbUser);
-      }
-    }
-    return {
-      valid: true,
-      userId: matchedKey.userId,
-      user,
-      permissions: matchedKey.permissions || [],
-      apiKeyId: matchedKey.id,
-      tenantId: user.tenantId,
-      role: user.role
-    };
-  } catch (error) {
-    console.error("[ApiKey] Validation error:", error);
-    return { valid: false, error: "Failed to validate API key" };
-  }
-}
-function extractApiKeyFromRequest(request) {
-  const authHeader = request.headers.get("Authorization");
-  if (authHeader) {
-    if (authHeader.startsWith("ApiKey ")) {
-      return authHeader.slice(7).trim();
-    }
-    if (authHeader.startsWith("Bearer ")) {
-      return null;
-    }
-  }
-  const xApiKey = request.headers.get("X-API-Key");
-  if (xApiKey) {
-    return xApiKey.trim();
-  }
-  return null;
-}
-function createApiKeyContext(result) {
-  if (!result.valid || !result.userId) {
-    return null;
-  }
-  return {
-    userId: result.userId,
-    user: result.user || {},
-    permissions: result.permissions || [],
-    apiKeyId: result.apiKeyId || "",
-    tenantId: result.tenantId,
-    role: result.role
-  };
-}
-function hasApiKeyPermission(permissions, required) {
-  if (permissions.length === 0) return false;
-  if (permissions.includes("*")) return true;
-  if (permissions.includes(required)) return true;
-  const [resource, action] = required.split(":");
-  if (permissions.includes(`${resource}:*`)) return true;
-  return false;
-}
-function generateApiKey() {
-  const chars = "abcdefghijklmnopqrstuvwxyz0123456789";
-  let suffix = "";
-  for (let i = 0; i < 32; i++) {
-    suffix += chars[Math.floor(Math.random() * chars.length)];
-  }
-  return `kyro_${suffix}`;
-}
-function generateApiKeyPrefix(key) {
-  return key.substring(0, 8);
-}
-
-exports.API_KEY_COLLECTION = API_KEY_COLLECTION;
-exports.createApiKeyContext = createApiKeyContext;
-exports.evaluateAccess = evaluateAccess;
-exports.extractApiKeyFromRequest = extractApiKeyFromRequest;
-exports.generateApiKey = generateApiKey;
-exports.generateApiKeyPrefix = generateApiKeyPrefix;
-exports.getWhereClause = getWhereClause;
-exports.hasApiKeyPermission = hasApiKeyPermission;
-exports.mergeWhereClauses = mergeWhereClauses;
-exports.validateApiKey = validateApiKey;
-//# sourceMappingURL=chunk-4OCMVGEY.cjs.map
-//# sourceMappingURL=chunk-4OCMVGEY.cjs.map

package/dist/chunk-4OCMVGEY.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/access/types.ts","../src/auth/api-key.ts"],"names":["timingSafeEqual"],"mappings":";;;;;AA+CA,eAAsB,cAAA,CACpB,QACA,IAAA,EACgC;AAChC,EAAA,IAAI,OAAO,WAAW,SAAA,EAAW;AAC/B,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,WAAW,UAAA,EAAY;AAChC,IAAA,OAAO,MAAM,OAAO,IAAI,CAAA;AAAA,EAC1B;AACA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,qBACX,YAAA,EACU;AACb,EAAA,MAAM,SAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,UAAU,YAAA,EAAc;AACjC,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACxC,MAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,IAC9B;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,cAAA,CACd,QACA,IAAA,EACkC;AAClC,EAAA,OAAO,cAAA,CAAe,MAAA,EAAQ,IAAI,CAAA,CAAE,KAAK,CAAA,MAAA,KAAU;AACjD,IAAA,IAAI,MAAA,KAAW,MAAM,OAAO,MAAA;AAC5B,IAAA,IAAI,MAAA,KAAW,OAAO,OAAO,EAAE,KAAK,EAAE,GAAA,EAAK,MAAK,EAAE;AAClD,IAAA,OAAO,MAAA;AAAA,EACT,CAAC,CAAA;AACH;AC7CO,IAAM,kBAAA,GAAqB;AAElC,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAO,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AAC3B;AAEA,SAAS,mBAAA,CAAoB,GAAW,CAAA,EAAoB;AAC1D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAOA,sBAAA,CAAgB,OAAO,IAAA,CAAK,CAAC,GAAG,MAAA,CAAO,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,eAAsB,cAAA,CACpB,MAAA,EACA,EAAA,EACA,UAAA,EACiC;AACjC,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,EACtD;AAEA,EAAA,IAAI,CAAC,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,wBAAA,EAAyB;AAAA,EACzD;AAEA,EAAA,MAAM,SAAA,GAAY,kBAAkB,MAAM,CAAA;AAE1C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,IAAA,CAAK;AAAA,MAC3B,UAAA,EAAY,kBAAA;AAAA,MACZ,OAAO,EAAE,SAAA,EAAW,EAAE,MAAA,EAAQ,WAAU,EAAE;AAAA,MAC1C,KAAA,EAAO,GAAA;AAAA,MACP,IAAA,EAAM;AAAA,KACP,CAAA;AAED,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA,EAAG;AAC5C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,iBAAA,EAAkB;AAAA,IAClD;AAEA,IAAA,IAAI,UAAA,GAAkC,IAAA;AACtC,IAAA,KAAA,MAAW,GAAA,IAAO,OAAO,IAAA,EAAM;AAC7B,MAAA,MAAM,MAAA,GAAS,GAAA;AACf,MAAA,IAAI,mBAAA,CAAoB,MAAA,CAAO,GAAA,EAAK,MAAM,CAAA,EAAG;AAC3C,QAAA,UAAA,GAAa,MAAA;AACb,QAAA;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,iBAAA,EAAkB;AAAA,IAClD;AAEA,IAAA,IAAI,WAAW,SAAA,EAAW;AACxB,MAAA,MAAM,SAAA,GAAY,IAAI,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA;AAC/C,MAAA,IAAI,SAAA,mBAAY,IAAI,IAAA,EAAK,EAAG;AAC1B,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,MACtD;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,GAAG,MAAA,CAAO;AAAA,QACd,UAAA,EAAY,kBAAA;AAAA,QACZ,IAAI,UAAA,CAAW,EAAA;AAAA,QACf,MAAM,EAAE,UAAA,EAAA,qBAAgB,IAAA,EAAK,EAAE,aAAY;AAAE,OAC9C,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,MAAM,IAAA,GAA0B;AAAA,MAC9B,IAAI,UAAA,CAAW,MAAA;AAAA,MACf,IAAA,EAAO,WAAmB,IAAA,IAAQ,QAAA;AAAA,MAClC,UAAW,UAAA,CAAmB;AAAA,KAChC;AAEA,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,UAAA,CAAW,MAAM,CAAA;AACjD,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAA,CAAO,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,MAC5B;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,IAAA;AAAA,MACP,QAAQ,UAAA,CAAW,MAAA;AAAA,MACnB,IAAA;AAAA,MACA,WAAA,EAAa,UAAA,CAAW,WAAA,IAAe,EAAC;AAAA,MACxC,UAAU,UAAA,CAAW,EAAA;AAAA,MACrB,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,MAAM,IAAA,CAAK;AAAA,KACb;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,4BAAA,EAA6B;AAAA,EAC7D;AACF;AAEO,SAAS,yBAAyB,OAAA,EAAiC;AACxE,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACtD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAI,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpC,MAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,EAAK;AAAA,IAClC;AACA,IAAA,IAAI,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AAC/C,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,OAAO,QAAQ,IAAA,EAAK;AAAA,EACtB;AAEA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,oBACd,MAAA,EACsB;AACtB,EAAA,IAAI,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,OAAO,MAAA,EAAQ;AACnC,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,IAAA,EAAM,MAAA,CAAO,IAAA,IAAQ,EAAC;AAAA,IACtB,WAAA,EAAa,MAAA,CAAO,WAAA,IAAe,EAAC;AAAA,IACpC,QAAA,EAAU,OAAO,QAAA,IAAY,EAAA;AAAA,IAC7B,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,MAAM,MAAA,CAAO;AAAA,GACf;AACF;AAEO,SAAS,mBAAA,CACd,aACA,QAAA,EACS;AACT,EAAA,IAAI,WAAA,CAAY,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AACrC,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,GAAG,CAAA,EAAG,OAAO,IAAA;AACtC,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,IAAA;AAE3C,EAAA,MAAM,CAAC,QAAA,EAAU,MAAM,CAAA,GAAI,QAAA,CAAS,MAAM,GAAG,CAAA;AAC7C,EAAA,IAAI,YAAY,QAAA,CAAS,CAAA,EAAG,QAAQ,CAAA,EAAA,CAAI,GAAG,OAAO,IAAA;AAElD,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,cAAA,GAAyB;AACvC,EAAA,MAAM,KAAA,GAAQ,sCAAA;AACd,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,IAAA,MAAA,IAAU,KAAA,CAAM,KAAK,KAAA,CAAM,IAAA,CAAK,QAAO,GAAI,KAAA,CAAM,MAAM,CAAC,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,QAAQ,MAAM,CAAA,CAAA;AACvB;AAEO,SAAS,qBAAqB,GAAA,EAAqB;AACxD,EAAA,OAAO,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AAC3B","file":"chunk-4OCMVGEY.cjs","sourcesContent":["import type { User, Request } from '../hooks/types.js';\n\n// ============================================================================\n// Access Control Types\n// ============================================================================\n\nexport interface WhereClause {\n  [field: string]: any;\n}\n\nexport interface AccessArgs {\n  req: Request;\n  user?: User;\n  data?: unknown;\n  doc?: unknown;\n  id?: string;\n  tenantID?: string;\n  context?: Record<string, unknown>;\n}\n\nexport type AccessControl = boolean | ((args: AccessArgs) => Promise<boolean | WhereClause> | boolean | WhereClause);\n\nexport interface CollectionAccess {\n  create?: AccessControl;\n  read?: AccessControl;\n  update?: AccessControl;\n  delete?: AccessControl;\n  admin?: AccessControl;\n  unlock?: AccessControl;\n  readVersions?: AccessControl;\n}\n\nexport interface GlobalAccess {\n  read?: AccessControl;\n  update?: AccessControl;\n}\n\nexport interface FieldAccess {\n  create?: AccessControl;\n  read?: AccessControl;\n  update?: AccessControl;\n}\n\n// ============================================================================\n// Access Control Evaluation\n// ============================================================================\n\nexport async function evaluateAccess(\n  access: AccessControl,\n  args: AccessArgs\n): Promise<boolean | WhereClause> {\n  if (typeof access === 'boolean') {\n    return access;\n  }\n  if (typeof access === 'function') {\n    return await access(args);\n  }\n  return true;\n}\n\nexport function mergeWhereClauses(\n  ...whereClauses: (WhereClause | boolean | undefined)[]\n): WhereClause {\n  const result: WhereClause = {};\n  for (const clause of whereClauses) {\n    if (clause && typeof clause === 'object') {\n      Object.assign(result, clause);\n    }\n  }\n  return result;\n}\n\nexport function getWhereClause(\n  access: AccessControl,\n  args: AccessArgs\n): Promise<WhereClause | undefined> {\n  return evaluateAccess(access, args).then(result => {\n    if (result === true) return undefined;\n    if (result === false) return { _id: { $eq: null } };\n    return result;\n  });\n}\n","import { timingSafeEqual } from \"crypto\";\nimport type { BaseAdapter } from \"../registry/types.js\";\nimport type { AuthUser, UserRole } from \"./types.js\";\n\nexport interface ApiKeyRecord {\n  id: string;\n  userId: string;\n  name: string;\n  key: string;\n  keyPrefix: string;\n  permissions: string[];\n  lastUsedAt?: string;\n  expiresAt?: string;\n  createdAt: string;\n}\n\nexport interface ApiKeyValidationResult {\n  valid: boolean;\n  userId?: string;\n  user?: Partial<AuthUser>;\n  permissions?: string[];\n  apiKeyId?: string;\n  error?: string;\n  tenantId?: string;\n  role?: UserRole;\n}\n\nexport interface ApiKeyContext {\n  userId: string;\n  user: Partial<AuthUser>;\n  permissions: string[];\n  apiKeyId: string;\n  tenantId?: string;\n  role?: UserRole;\n}\n\nexport const API_KEY_COLLECTION = \"api_keys\";\n\nfunction generateKeyPrefix(key: string): string {\n  return key.substring(0, 8);\n}\n\nfunction constantTimeCompare(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  try {\n    return timingSafeEqual(Buffer.from(a), Buffer.from(b));\n  } catch {\n    return false;\n  }\n}\n\nexport async function validateApiKey(\n  rawKey: string,\n  db: BaseAdapter,\n  userLookup?: (userId: string) => Promise<Partial<AuthUser> | null>,\n): Promise<ApiKeyValidationResult> {\n  if (!rawKey || typeof rawKey !== \"string\") {\n    return { valid: false, error: \"No API key provided\" };\n  }\n\n  if (!rawKey.startsWith(\"kyro_\")) {\n    return { valid: false, error: \"Invalid API key format\" };\n  }\n\n  const keyPrefix = generateKeyPrefix(rawKey);\n\n  try {\n    const result = await db.find({\n      collection: API_KEY_COLLECTION,\n      where: { keyPrefix: { equals: keyPrefix } },\n      limit: 100,\n      page: 1,\n    });\n\n    if (!result.docs || result.docs.length === 0) {\n      return { valid: false, error: \"Invalid API key\" };\n    }\n\n    let matchedKey: ApiKeyRecord | null = null;\n    for (const doc of result.docs) {\n      const record = doc as unknown as ApiKeyRecord;\n      if (constantTimeCompare(record.key, rawKey)) {\n        matchedKey = record;\n        break;\n      }\n    }\n\n    if (!matchedKey) {\n      return { valid: false, error: \"Invalid API key\" };\n    }\n\n    if (matchedKey.expiresAt) {\n      const expiresAt = new Date(matchedKey.expiresAt);\n      if (expiresAt < new Date()) {\n        return { valid: false, error: \"API key has expired\" };\n      }\n    }\n\n    try {\n      await db.update({\n        collection: API_KEY_COLLECTION,\n        id: matchedKey.id,\n        data: { lastUsedAt: new Date().toISOString() },\n      });\n    } catch {\n      // Non-critical: don't fail if lastUsedAt update fails\n    }\n\n    const user: Partial<AuthUser> = {\n      id: matchedKey.userId,\n      role: (matchedKey as any).role || \"author\",\n      tenantId: (matchedKey as any).tenantId,\n    };\n\n    if (userLookup) {\n      const dbUser = await userLookup(matchedKey.userId);\n      if (dbUser) {\n        Object.assign(user, dbUser);\n      }\n    }\n\n    return {\n      valid: true,\n      userId: matchedKey.userId,\n      user,\n      permissions: matchedKey.permissions || [],\n      apiKeyId: matchedKey.id,\n      tenantId: user.tenantId,\n      role: user.role,\n    };\n  } catch (error) {\n    console.error(\"[ApiKey] Validation error:\", error);\n    return { valid: false, error: \"Failed to validate API key\" };\n  }\n}\n\nexport function extractApiKeyFromRequest(request: Request): string | null {\n  const authHeader = request.headers.get(\"Authorization\");\n  if (authHeader) {\n    if (authHeader.startsWith(\"ApiKey \")) {\n      return authHeader.slice(7).trim();\n    }\n    if (authHeader.startsWith(\"Bearer \")) {\n      return null;\n    }\n  }\n\n  const xApiKey = request.headers.get(\"X-API-Key\");\n  if (xApiKey) {\n    return xApiKey.trim();\n  }\n\n  return null;\n}\n\nexport function createApiKeyContext(\n  result: ApiKeyValidationResult,\n): ApiKeyContext | null {\n  if (!result.valid || !result.userId) {\n    return null;\n  }\n  return {\n    userId: result.userId,\n    user: result.user || {},\n    permissions: result.permissions || [],\n    apiKeyId: result.apiKeyId || \"\",\n    tenantId: result.tenantId,\n    role: result.role,\n  };\n}\n\nexport function hasApiKeyPermission(\n  permissions: string[],\n  required: string,\n): boolean {\n  if (permissions.length === 0) return false;\n  if (permissions.includes(\"*\")) return true;\n  if (permissions.includes(required)) return true;\n\n  const [resource, action] = required.split(\":\");\n  if (permissions.includes(`${resource}:*`)) return true;\n\n  return false;\n}\n\nexport function generateApiKey(): string {\n  const chars = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n  let suffix = \"\";\n  for (let i = 0; i < 32; i++) {\n    suffix += chars[Math.floor(Math.random() * chars.length)];\n  }\n  return `kyro_${suffix}`;\n}\n\nexport function generateApiKeyPrefix(key: string): string {\n  return key.substring(0, 8);\n}\n"]}

package/dist/chunk-4PWRCMTQ.cjs

@@ -1,15 +0,0 @@
-'use strict';
-
-var pgCore = require('drizzle-orm/pg-core');
-
-// src/database/drizzle/schema/settings.ts
-var settings = pgCore.pgTable("settings", {
-  key: pgCore.varchar("key", { length: 255 }).primaryKey(),
-  value: pgCore.text("value").notNull(),
-  description: pgCore.text("description"),
-  updatedAt: pgCore.timestamp("updated_at").defaultNow()
-});
-
-exports.settings = settings;
-//# sourceMappingURL=chunk-4PWRCMTQ.cjs.map
-//# sourceMappingURL=chunk-4PWRCMTQ.cjs.map

package/dist/chunk-4PWRCMTQ.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/database/drizzle/schema/settings.ts"],"names":["pgTable","varchar","text","timestamp"],"mappings":";;;;;AAEO,IAAM,QAAA,GAAWA,eAAQ,UAAA,EAAY;AAAA,EAC1C,GAAA,EAAKC,eAAQ,KAAA,EAAO,EAAE,QAAQ,GAAA,EAAK,EAAE,UAAA,EAAW;AAAA,EAChD,KAAA,EAAOC,WAAA,CAAK,OAAO,CAAA,CAAE,OAAA,EAAQ;AAAA,EAC7B,WAAA,EAAaA,YAAK,aAAa,CAAA;AAAA,EAC/B,SAAA,EAAWC,gBAAA,CAAU,YAAY,CAAA,CAAE,UAAA;AACrC,CAAC","file":"chunk-4PWRCMTQ.cjs","sourcesContent":["import { pgTable, varchar, text, timestamp } from \"drizzle-orm/pg-core\";\n\nexport const settings = pgTable(\"settings\", {\n  key: varchar(\"key\", { length: 255 }).primaryKey(),\n  value: text(\"value\").notNull(),\n  description: text(\"description\"),\n  updatedAt: timestamp(\"updated_at\").defaultNow(),\n});\n\nexport type Setting = typeof settings.$inferSelect;\nexport type NewSetting = typeof settings.$inferInsert;\n"]}

package/dist/chunk-526M5MOA.js

@@ -1,103 +0,0 @@
-import { createKyro, LocalAdapter } from './chunk-AN2L2CJZ.js';
-import { autoBootstrap } from './chunk-HY6B7B5A.js';
-import { SQLiteAuthAdapter } from './chunk-Q72BOAPK.js';
-import { DrizzleAdapter } from './chunk-XHAAAEXX.js';
-import { PostgresAuthAdapter } from './chunk-CJX74IYK.js';
-import { MongoDBAdapter } from './chunk-GZS4LMR7.js';
-import { MongoDBAuthAdapter } from './chunk-7OGPN7MP.js';
-import projectConfig from 'kyro:config';
-
-var kyroInstance = null;
-var initPromise = null;
-async function doInit() {
-  if (kyroInstance) return;
-  try {
-    const config = projectConfig.default || projectConfig;
-    kyroInstance = createKyro(config);
-    await kyroInstance.init();
-    await kyroInstance.loadSettings();
-    const db = kyroInstance.db;
-    let bootstrapAuthAdapter = void 0;
-    if (db instanceof DrizzleAdapter) {
-      if (db.dialect === "postgres") {
-        bootstrapAuthAdapter = new PostgresAuthAdapter({ db: db.client });
-      } else if (db.dialect === "sqlite") {
-        const authDbPath = process.env.KYRO_AUTH_DB_PATH || "./data/auth.db";
-        bootstrapAuthAdapter = new SQLiteAuthAdapter({ path: authDbPath });
-      }
-    } else if (db instanceof LocalAdapter) {
-      const authDbPath = process.env.KYRO_AUTH_DB_PATH || "./data/auth.db";
-      bootstrapAuthAdapter = new SQLiteAuthAdapter({ path: authDbPath });
-    } else if (db instanceof MongoDBAdapter) {
-      bootstrapAuthAdapter = new MongoDBAuthAdapter({ db: db.db });
-    }
-    if (bootstrapAuthAdapter?.connect) {
-      await bootstrapAuthAdapter.connect();
-    }
-    const result = await autoBootstrap(bootstrapAuthAdapter);
-    if (result?.success) {
-    }
-    if (typeof kyroInstance.startWebSocket === "function") {
-      kyroInstance.startWebSocket().catch((err) => {
-        console.error("[Kyro] WebSocket auto-start failed:", err);
-      });
-    }
-    globalThis.__KYRO_INSTANCE__ = kyroInstance;
-  } catch (err) {
-    kyroInstance = null;
-    initPromise = null;
-    console.error("[Kyro API] Init failed, will retry:", err);
-    throw err;
-  }
-}
-async function warmKyroInstance() {
-  if (!initPromise) {
-    initPromise = doInit();
-  }
-  await initPromise;
-}
-var ALL = async (context) => {
-  if (!kyroInstance) {
-    if (!initPromise) {
-      initPromise = doInit();
-    }
-    try {
-      await Promise.race([
-        initPromise,
-        new Promise(
-          (_, reject) => setTimeout(() => reject(new Error("Initialization timeout")), 3e4)
-        )
-      ]);
-    } catch {
-      return new Response(JSON.stringify({
-        error: "Service Unavailable",
-        message: "Kyro CMS is still starting up. Please try again in a moment."
-      }), {
-        status: 503,
-        headers: {
-          "Content-Type": "application/json",
-          "Retry-After": "5"
-        }
-      });
-    }
-  }
-  const url = new URL(context.request.url);
-  const path = url.pathname;
-  const p = __KYRO_API_PATH__;
-  if (path === `${p}/graphql` && typeof kyroInstance.getGraphQL === "function") {
-    const yoga = kyroInstance.getGraphQL();
-    const res = await yoga.fetch(context.request, context.locals);
-    return new Response(res.body, res);
-  }
-  if (path.startsWith(`${p}/trpc/`) && typeof kyroInstance.getTRPC === "function") {
-    const trpc = kyroInstance.getTRPC();
-    const res = await trpc.fetch(context.request, context.locals);
-    return new Response(res.body, res);
-  }
-  const app = kyroInstance.getREST();
-  return app.fetch(context.request, context.locals);
-};
-
-export { ALL, kyroInstance, warmKyroInstance };
-//# sourceMappingURL=chunk-526M5MOA.js.map
-//# sourceMappingURL=chunk-526M5MOA.js.map

package/dist/chunk-526M5MOA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/api-handler.ts"],"names":[],"mappings":";;;;;;;;;AAcO,IAAI,YAAA,GAAoB;AAC/B,IAAI,WAAA,GAAoC,IAAA;AAExC,eAAe,MAAA,GAAwB;AACrC,EAAA,IAAI,YAAA,EAAc;AAElB,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,cAAc,OAAA,IAAW,aAAA;AACxC,IAAA,YAAA,GAAe,WAAW,MAAM,CAAA;AAChC,IAAA,MAAM,aAAa,IAAA,EAAK;AACxB,IAAA,MAAM,aAAa,YAAA,EAAa;AAEhC,IAAA,MAAM,KAAK,YAAA,CAAa,EAAA;AACxB,IAAA,IAAI,oBAAA,GAA4B,KAAA,CAAA;AAEhC,IAAA,IAAI,cAAc,cAAA,EAAgB;AAChC,MAAA,IAAI,EAAA,CAAG,YAAY,UAAA,EAAY;AAC7B,QAAA,oBAAA,GAAuB,IAAI,mBAAA,CAAoB,EAAE,EAAA,EAAI,EAAA,CAAG,QAAQ,CAAA;AAAA,MAClE,CAAA,MAAA,IAAW,EAAA,CAAG,OAAA,KAAY,QAAA,EAAU;AAClC,QAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,CAAI,iBAAA,IAAqB,gBAAA;AACpD,QAAA,oBAAA,GAAuB,IAAI,iBAAA,CAAkB,EAAE,IAAA,EAAM,YAAY,CAAA;AAAA,MACnE;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,YAAA,EAAc;AACrC,MAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,CAAI,iBAAA,IAAqB,gBAAA;AACpD,MAAA,oBAAA,GAAuB,IAAI,iBAAA,CAAkB,EAAE,IAAA,EAAM,YAAY,CAAA;AAAA,IACnE,CAAA,MAAA,IAAW,cAAc,cAAA,EAAgB;AACvC,MAAA,oBAAA,GAAuB,IAAI,kBAAA,CAAmB,EAAE,EAAA,EAAI,EAAA,CAAG,IAAI,CAAA;AAAA,IAC7D;AAEA,IAAA,IAAI,sBAAsB,OAAA,EAAS;AACjC,MAAA,MAAM,qBAAqB,OAAA,EAAQ;AAAA,IACrC;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,oBAAoB,CAAA;AACvD,IAAA,IAAI,QAAQ,OAAA,EAAS;AAAA,IACrB;AAGA,IAAA,IAAI,OAAO,YAAA,CAAa,cAAA,KAAmB,UAAA,EAAY;AACrD,MAAA,YAAA,CAAa,cAAA,EAAe,CAAE,KAAA,CAAM,CAAC,GAAA,KAAa;AAChD,QAAA,OAAA,CAAQ,KAAA,CAAM,uCAAuC,GAAG,CAAA;AAAA,MAC1D,CAAC,CAAA;AAAA,IACH;AAGA,IAAC,WAAmB,iBAAA,GAAoB,YAAA;AAAA,EAE1C,SAAS,GAAA,EAAK;AACZ,IAAA,YAAA,GAAe,IAAA;AACf,IAAA,WAAA,GAAc,IAAA;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,uCAAuC,GAAG,CAAA;AACxD,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAEA,eAAsB,gBAAA,GAAkC;AACtD,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,WAAA,GAAc,MAAA,EAAO;AAAA,EACvB;AACA,EAAA,MAAM,WAAA;AACR;AAEO,IAAM,GAAA,GAAgB,OAAO,OAAA,KAAY;AAC9C,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,WAAA,GAAc,MAAA,EAAO;AAAA,IACvB;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,QAAQ,IAAA,CAAK;AAAA,QACjB,WAAA;AAAA,QACA,IAAI,OAAA;AAAA,UAAc,CAAC,CAAA,EAAG,MAAA,KACpB,UAAA,CAAW,MAAM,MAAA,CAAO,IAAI,KAAA,CAAM,wBAAwB,CAAC,CAAA,EAAG,GAAK;AAAA;AACrE,OACD,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU;AAAA,QACjC,KAAA,EAAO,qBAAA;AAAA,QACP,OAAA,EAAS;AAAA,OACV,CAAA,EAAG;AAAA,QACF,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,aAAA,EAAe;AAAA;AACjB,OACD,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,QAAQ,GAAG,CAAA;AACvC,EAAA,MAAM,OAAO,GAAA,CAAI,QAAA;AACjB,EAAA,MAAM,CAAA,GAAI,iBAAA;AAEV,EAAA,IAAI,SAAS,CAAA,EAAG,CAAC,cAAc,OAAO,YAAA,CAAa,eAAe,UAAA,EAAY;AAC5E,IAAA,MAAM,IAAA,GAAO,aAAa,UAAA,EAAW;AACrC,IAAA,MAAM,MAAM,MAAM,IAAA,CAAK,MAAM,OAAA,CAAQ,OAAA,EAAS,QAAQ,MAAM,CAAA;AAC5D,IAAA,OAAO,IAAI,QAAA,CAAS,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,EACnC;AAEA,EAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG,CAAC,QAAQ,CAAA,IAAK,OAAO,YAAA,CAAa,OAAA,KAAY,UAAA,EAAY;AAC/E,IAAA,MAAM,IAAA,GAAO,aAAa,OAAA,EAAQ;AAClC,IAAA,MAAM,MAAM,MAAM,IAAA,CAAK,MAAM,OAAA,CAAQ,OAAA,EAAS,QAAQ,MAAM,CAAA;AAC5D,IAAA,OAAO,IAAI,QAAA,CAAS,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,EACnC;AAEA,EAAA,MAAM,GAAA,GAAM,aAAa,OAAA,EAAQ;AACjC,EAAA,OAAO,GAAA,CAAI,KAAA,CAAM,OAAA,CAAQ,OAAA,EAAS,QAAQ,MAAM,CAAA;AAClD","file":"chunk-526M5MOA.js","sourcesContent":["import type { APIRoute } from \"astro\";\nimport { createKyro } from \"./createKyro.js\";\nimport { autoBootstrap } from \"./auth/bootstrap.js\";\nimport { DrizzleAdapter } from \"./database/drizzle/adapter.js\";\nimport { PostgresAuthAdapter } from \"./database/drizzle/postgres-auth-adapter.js\";\nimport { LocalAdapter } from \"./database/local/adapter.js\";\nimport { SQLiteAuthAdapter } from \"./auth/sqlite-adapter.js\";\nimport { MongoDBAdapter } from \"./database/mongodb/adapter.js\";\nimport { MongoDBAuthAdapter } from \"./database/mongodb/mongo-auth-adapter.js\";\n// @ts-ignore - handled by vite alias\nimport projectConfig from \"kyro:config\";\n\ndeclare var __KYRO_API_PATH__: string;\n\nexport let kyroInstance: any = null;\nlet initPromise: Promise<void> | null = null;\n\nasync function doInit(): Promise<void> {\n  if (kyroInstance) return;\n\n  try {\n    const config = projectConfig.default || projectConfig;\n    kyroInstance = createKyro(config);\n    await kyroInstance.init();\n    await kyroInstance.loadSettings();\n\n    const db = kyroInstance.db;\n    let bootstrapAuthAdapter: any = undefined;\n    \n    if (db instanceof DrizzleAdapter) {\n      if (db.dialect === \"postgres\") {\n        bootstrapAuthAdapter = new PostgresAuthAdapter({ db: db.client });\n      } else if (db.dialect === \"sqlite\") {\n        const authDbPath = process.env.KYRO_AUTH_DB_PATH || \"./data/auth.db\";\n        bootstrapAuthAdapter = new SQLiteAuthAdapter({ path: authDbPath });\n      }\n    } else if (db instanceof LocalAdapter) {\n      const authDbPath = process.env.KYRO_AUTH_DB_PATH || \"./data/auth.db\";\n      bootstrapAuthAdapter = new SQLiteAuthAdapter({ path: authDbPath });\n    } else if (db instanceof MongoDBAdapter) {\n      bootstrapAuthAdapter = new MongoDBAuthAdapter({ db: db.db });\n    }\n\n    if (bootstrapAuthAdapter?.connect) {\n      await bootstrapAuthAdapter.connect();\n    }\n\n    const result = await autoBootstrap(bootstrapAuthAdapter);\n    if (result?.success) {\n    }\n\n    // Auto-start WebSocket (checks settings.access.apiAccess.wsEnabled internally)\n    if (typeof kyroInstance.startWebSocket === \"function\") {\n      kyroInstance.startWebSocket().catch((err: any) => {\n        console.error(\"[Kyro] WebSocket auto-start failed:\", err);\n      });\n    }\n\n    // Expose instance globally so admin SSR can read DB directly\n    (globalThis as any).__KYRO_INSTANCE__ = kyroInstance;\n\n  } catch (err) {\n    kyroInstance = null;\n    initPromise = null;\n    console.error(\"[Kyro API] Init failed, will retry:\", err);\n    throw err;\n  }\n}\n\nexport async function warmKyroInstance(): Promise<void> {\n  if (!initPromise) {\n    initPromise = doInit();\n  }\n  await initPromise;\n}\n\nexport const ALL: APIRoute = async (context) => {\n  if (!kyroInstance) {\n    if (!initPromise) {\n      initPromise = doInit();\n    }\n\n    try {\n      await Promise.race([\n        initPromise,\n        new Promise<void>((_, reject) =>\n          setTimeout(() => reject(new Error(\"Initialization timeout\")), 30000)\n        ),\n      ]);\n    } catch {\n      return new Response(JSON.stringify({\n        error: \"Service Unavailable\",\n        message: \"Kyro CMS is still starting up. Please try again in a moment.\",\n      }), {\n        status: 503,\n        headers: {\n          \"Content-Type\": \"application/json\",\n          \"Retry-After\": \"5\",\n        },\n      });\n    }\n  }\n\n  const url = new URL(context.request.url);\n  const path = url.pathname;\n  const p = __KYRO_API_PATH__;\n\n  if (path === `${p}/graphql` && typeof kyroInstance.getGraphQL === \"function\") {\n    const yoga = kyroInstance.getGraphQL();\n    const res = await yoga.fetch(context.request, context.locals);\n    return new Response(res.body, res);\n  }\n\n  if (path.startsWith(`${p}/trpc/`) && typeof kyroInstance.getTRPC === \"function\") {\n    const trpc = kyroInstance.getTRPC();\n    const res = await trpc.fetch(context.request, context.locals);\n    return new Response(res.body, res);\n  }\n\n  const app = kyroInstance.getREST();\n  return app.fetch(context.request, context.locals);\n};\n"]}