@kyro-cms/core 0.10.4 → 0.10.6

package/dist/index.js

@@ -1,1943 +1,43 @@
-export { RedisAuthAdapter } from './chunk-CF7OL6HR.js';
-export { allSettingsGlobals, blogCollections, blogGlobals, coreSettingsGlobals, createTemplateConfig, ecommerceCollections, ecommerceGlobals, kitchenSinkCollections, mediaCollections, minimalCollections, templateCollections } from './chunk-53NYVYVX.js';
-export { kyro } from './chunk-X4BPPD6K.js';
-export { ConfigValidationError, Kyro, LocalAdapter, Registry, collectionToCreateZod, collectionToUpdateZod, collectionToWhereZod, collectionToZod, createKyro, createLocalAdapter, createRegistry, fieldToZod, getRegistry, globalToZod, resetRegistry, validateCollection, validateConfig, validateFields, validateGlobal } from './chunk-HZOMOK5Y.js';
-export { autoBootstrap, bootstrapAdmin, bootstrapWithRetry, getBootstrapFromEnv } from './chunk-HY6B7B5A.js';
-import './chunk-GAOXD3XT.js';
-export { CSSGenerator, createAdminStyling, defaultDarkTheme, defaultFieldStyling, defaultLightTheme, ecommerce2026Theme, generateCSSVariables, generateTailwindConfig } from './chunk-2HFJUUFZ.js';
-export { ALL_FIELD_TYPES, COMPLEX_FIELD_TYPES, LAYOUT_FIELD_TYPES, PRIMITIVE_FIELD_TYPES, RELATIONAL_FIELD_TYPES, isArrayField, isBlocksField, isGroupField, isImageField, isLayoutField, isNumberField, isRelationshipField, isRichTextField, isSelectField, isTextField, isUploadField, normalizeRichTextValue, renderRichText, richTextStyles } from './chunk-FIAMXNTH.js';
-export { createContext, createCountProcedure, createCreateProcedure, createDeleteProcedure, createDynamicRouter, createFindByIDProcedure, createFindProcedure, createKyroServer, createUpdateProcedure } from './chunk-OX6GOIPH.js';
-export { buildGraphQLSchema, createGraphQLSchema } from './chunk-5RPRLTTN.js';
-import { init_secret, AuditLogger, InMemoryRateLimiter, InMemoryAuditLogger, AuthRoutes } from './chunk-OLV7K22H.js';
-export { AuditLogger, InMemoryAuditLogger, InMemoryRateLimiter, MediaService, createAuditContext, createHonoApp, createLocalStorage, createRESTAPI, getAppSecret, getEncryptionKey, getSessionConfig, loadSecrets, resolveProvider, setDbAdapter } from './chunk-OLV7K22H.js';
-import { EmailTransport, PasswordPolicy } from './chunk-N5QSHUA6.js';
-export { ConfigService, EmailTransport, PasswordPolicy } from './chunk-N5QSHUA6.js';
-import './chunk-YT7HXXVN.js';
-import './chunk-XEB7PH2E.js';
-import { SQLiteAuthAdapter } from './chunk-Q72BOAPK.js';
-export { SQLiteAuthAdapter } from './chunk-Q72BOAPK.js';
-import './chunk-P2YW545G.js';
-export { ALL_WEBHOOK_EVENTS, WEBHOOK_COLLECTION, WEBHOOK_DELIVERY_COLLECTION, WEBHOOK_EVENTS, WebhookService, buildDeliveryRecord, createTestPayload, createWebhookService, deliverWebhook, deliverWithRetry, generateWebhookSecret, signPayload } from './chunk-WDTTHKDS.js';
-export { evaluateAccess, getWhereClause, mergeWhereClauses } from './chunk-3AKCVYDB.js';
-export { KyroPubSub, KyroWSServer, PubSub, createWSServer } from './chunk-BYBMTIMT.js';
-import './chunk-QU2RFFH4.js';
-export { DrizzleAdapter, collectionToDrizzleSchema, createDatabase, createDrizzleAdapter, fieldToDrizzleType, runMigrations, seedDefaultRoles } from './chunk-V5AWATUP.js';
-import { PostgresAuthAdapter } from './chunk-CJX74IYK.js';
-export { PostgresAuthAdapter } from './chunk-CJX74IYK.js';
-import './chunk-UUDTPZX6.js';
-import './chunk-GTGRLD4Y.js';
-export { MongoDBAdapter, createMongoDBAdapter } from './chunk-GZS4LMR7.js';
-import { MongoDBAuthAdapter } from './chunk-7OGPN7MP.js';
-export { MongoDBAuthAdapter } from './chunk-7OGPN7MP.js';
-export { AbstractBaseAdapter } from './chunk-WXVB364T.js';
-import './chunk-L4EZKIEX.js';
-import './chunk-4CV4JOE5.js';
-import crypto2, { randomBytes } from 'crypto';
-import { readFileSync } from 'fs';
-import path, { join, resolve } from 'path';
-export { z } from 'zod';
-import { createStorage } from 'unstorage';
-import indexedbDriver from 'unstorage/drivers/indexedb';
-import fsDriver from 'unstorage/drivers/fs';
-
-// src/hooks/types.ts
-async function runHooks(hooks, args) {
-  let result = args.data;
-  for (const hook of hooks) {
-    const hookResult = await hook({
-      ...args,
-      data: result
-    });
-    if (hookResult !== void 0) {
-      result = hookResult;
-    }
-  }
-  return result;
-}
-async function runFieldHooks(hooks, args) {
-  return runHooks(hooks, args);
-}
-
-// src/plugins/index.ts
-var KyroPlugin = class {
-  name;
-  version;
-  description;
-  hooks = {};
-  collections = [];
-  globals = [];
-  fields = [];
-  extensions = { collections: [], globals: [] };
-  adminComponents = {};
-  adminStyles = [];
-  serverMiddleware;
-  clientMiddleware;
-  constructor(name) {
-    this.name = name;
-  }
-  async init(api) {
-  }
-  async beforeInit(api) {
-  }
-  async afterInit(api) {
-  }
-  getCollections() {
-    return this.collections;
-  }
-  getGlobals() {
-    return this.globals;
-  }
-  getHooks() {
-    return this.hooks;
-  }
-};
-var PluginManager = class {
-  plugins = /* @__PURE__ */ new Map();
-  hooks = /* @__PURE__ */ new Map();
-  register(plugin) {
-    if (this.plugins.has(plugin.name)) {
-      throw new Error(`Plugin "${plugin.name}" is already registered`);
-    }
-    this.plugins.set(plugin.name, plugin);
-    const pluginHooks = plugin.getHooks?.() || {};
-    for (const [event, handlers] of Object.entries(pluginHooks)) {
-      if (Array.isArray(handlers)) {
-        for (const handler of handlers) {
-          this.registerHook(event, handler);
-        }
-      }
-    }
-  }
-  unregister(name) {
-    const plugin = this.plugins.get(name);
-    if (!plugin) return;
-    const pluginHooks = plugin.getHooks?.() || {};
-    for (const [event, handlers] of Object.entries(pluginHooks)) {
-      if (Array.isArray(handlers)) {
-        for (const handler of handlers) {
-          this.unregisterHook(event, handler);
-        }
-      }
-    }
-    this.plugins.delete(name);
-  }
-  get(name) {
-    return this.plugins.get(name);
-  }
-  getAll() {
-    return Array.from(this.plugins.values());
-  }
-  has(name) {
-    return this.plugins.has(name);
-  }
-  registerHook(event, handler) {
-    if (!this.hooks.has(event)) {
-      this.hooks.set(event, []);
-    }
-    this.hooks.get(event).push(handler);
-  }
-  unregisterHook(event, handler) {
-    const handlers = this.hooks.get(event);
-    if (handlers) {
-      const index = handlers.indexOf(handler);
-      if (index > -1) {
-        handlers.splice(index, 1);
-      }
-    }
-  }
-  async executeHook(event, args) {
-    const handlers = this.hooks.get(event) || [];
-    let result = args;
-    for (const handler of handlers) {
-      try {
-        const hookResult = await handler({ ...args, data: result });
-        if (hookResult !== void 0) {
-          result = hookResult;
-        }
-      } catch (error) {
-        console.error(`[PluginManager] Error in hook "${event}":`, error);
-      }
-    }
-    return result;
-  }
-  // ========================================================================
-  // Collection/Field Extensions
-  // ========================================================================
-  getAllCollections() {
-    const collections = [];
-    for (const plugin of this.plugins.values()) {
-      const pluginCollections = plugin.getCollections?.() || [];
-      collections.push(...pluginCollections);
-    }
-    return collections;
-  }
-  getAllGlobals() {
-    const globals = [];
-    for (const plugin of this.plugins.values()) {
-      const pluginGlobals = plugin.getGlobals?.() || [];
-      globals.push(...pluginGlobals);
-    }
-    return globals;
-  }
-  getAllFields() {
-    const fields = [];
-    for (const plugin of this.plugins.values()) {
-      fields.push(...plugin.fields);
-    }
-    return fields;
-  }
-  getAdminComponents() {
-    const components = {};
-    for (const plugin of this.plugins.values()) {
-      Object.assign(components, plugin.adminComponents);
-    }
-    return components;
-  }
-  getAdminStyles() {
-    const styles = [];
-    for (const plugin of this.plugins.values()) {
-      styles.push(...plugin.adminStyles);
-    }
-    return styles;
-  }
-};
-var SEOPLugin = class extends KyroPlugin {
-  constructor() {
-    super("seo");
-    this.description = "Advanced SEO features including sitemaps, robots.txt, and structured data";
-    this.collections.push({
-      slug: "seo-settings",
-      label: "SEO Settings",
-      fields: [
-        {
-          name: "sitemap",
-          type: "checkbox",
-          label: "Enable Sitemap",
-          defaultValue: true
-        },
-        { name: "robotsTxt", type: "richtext", label: "robots.txt Content" },
-        {
-          name: "canonicalUrl",
-          type: "text",
-          variant: "url",
-          label: "Canonical URL"
-        },
-        { name: "ogImage", type: "text", label: "Default OG Image URL" }
-      ]
-    });
-  }
-};
-var AnalyticsPlugin = class extends KyroPlugin {
-  constructor() {
-    super("analytics");
-    this.description = "Analytics integration for tracking page views and events";
-    this.collections.push({
-      slug: "analytics-events",
-      label: "Analytics Events",
-      fields: [
-        { name: "name", type: "text", required: true },
-        { name: "properties", type: "json", label: "Event Properties" },
-        { name: "timestamp", type: "date", required: true },
-        { name: "userId", type: "text", label: "User ID" },
-        { name: "sessionId", type: "text", label: "Session ID" }
-      ]
-    });
-    this.adminComponents["AnalyticsDashboard"] = {};
-  }
-};
-var CommentsPlugin = class extends KyroPlugin {
-  constructor() {
-    super("comments");
-    this.description = "Commenting system for products and posts";
-    this.collections.push({
-      slug: "comments",
-      label: "Comments",
-      fields: [
-        { name: "content", type: "richtext", required: true },
-        { name: "author", type: "text", required: true },
-        { name: "email", type: "email" },
-        { name: "approved", type: "checkbox", defaultValue: false },
-        { name: "parent", type: "text", label: "Parent Comment ID" },
-        { name: "resourceType", type: "text", required: true },
-        { name: "resourceId", type: "text", required: true }
-      ]
-    });
-    this.adminComponents["CommentModeration"] = {};
-  }
-};
-var ReviewsPlugin = class extends KyroPlugin {
-  constructor() {
-    super("reviews");
-    this.description = "Product reviews and ratings";
-    this.collections.push({
-      slug: "reviews",
-      label: "Reviews",
-      fields: [
-        { name: "rating", type: "number", required: true, min: 1, max: 5 },
-        { name: "title", type: "text" },
-        { name: "content", type: "richtext", required: true },
-        { name: "author", type: "relationship", relationTo: "customers" },
-        {
-          name: "product",
-          type: "relationship",
-          relationTo: "products",
-          required: true
-        },
-        { name: "approved", type: "checkbox", defaultValue: false },
-        { name: "verified", type: "checkbox", label: "Verified Purchase" },
-        {
-          name: "helpful",
-          type: "number",
-          label: "Helpful Count",
-          defaultValue: 0
-        }
-      ]
-    });
-    this.adminComponents["ReviewModeration"] = {};
-  }
-};
-var WishlistPlugin = class extends KyroPlugin {
-  constructor() {
-    super("wishlist");
-    this.description = "Customer wishlists";
-    this.collections.push({
-      slug: "wishlists",
-      label: "Wishlists",
-      fields: [
-        {
-          name: "customer",
-          type: "relationship",
-          relationTo: "customers",
-          required: true
-        },
-        {
-          name: "name",
-          type: "text",
-          label: "Wishlist Name",
-          defaultValue: "My Wishlist"
-        },
-        {
-          name: "items",
-          type: "blocks",
-          label: "Items",
-          blocks: [
-            {
-              slug: "wishlist-item",
-              label: "Item",
-              fields: [
-                {
-                  name: "product",
-                  type: "relationship",
-                  relationTo: "products"
-                },
-                { name: "quantity", type: "number", defaultValue: 1 },
-                { name: "addedAt", type: "date" },
-                {
-                  name: "priority",
-                  type: "select",
-                  options: [
-                    { label: "Low", value: "low" },
-                    { label: "Medium", value: "medium" },
-                    { label: "High", value: "high" }
-                  ]
-                }
-              ]
-            }
-          ]
-        }
-      ]
-    });
-  }
-};
-var presetPlugins = {
-  SEO: SEOPLugin,
-  Analytics: AnalyticsPlugin,
-  Comments: CommentsPlugin,
-  Reviews: ReviewsPlugin,
-  Wishlist: WishlistPlugin
-};
-
-// src/auth/security/lockout.ts
-var DEFAULT_LOCKOUT_CONFIG = {
-  maxAttempts: 5,
-  lockDuration: 9e5,
-  notifyUser: true,
-  notifyAdmin: true,
-  adminNotifyAfter: 3
-};
-var AccountLockout = class {
-  redis;
-  prefix;
-  config;
-  constructor(redis, config = {}, prefix = "kyro:lockout:") {
-    this.redis = redis;
-    this.prefix = prefix;
-    this.config = { ...DEFAULT_LOCKOUT_CONFIG, ...config };
-  }
-  lockKey(userId) {
-    return `${this.prefix}${userId}`;
-  }
-  historyKey(userId) {
-    return `${this.prefix}${userId}:history`;
-  }
-  async checkLockout(userId) {
-    const key = this.lockKey(userId);
-    const data = await this.redis.hgetall(key);
-    if (!data || Object.keys(data).length === 0) {
-      return {
-        locked: false,
-        attemptsRemaining: this.config.maxAttempts,
-        totalAttempts: 0
-      };
-    }
-    const attempts = parseInt(data.attempts, 10);
-    const lockedUntil = data.lockedUntil ? new Date(parseInt(data.lockedUntil, 10)) : void 0;
-    if (lockedUntil && lockedUntil > /* @__PURE__ */ new Date()) {
-      return {
-        locked: true,
-        attemptsRemaining: 0,
-        lockedUntil,
-        totalAttempts: attempts
-      };
-    }
-    if (lockedUntil && lockedUntil <= /* @__PURE__ */ new Date()) {
-      await this.unlockAccount(userId);
-      return {
-        locked: false,
-        attemptsRemaining: this.config.maxAttempts,
-        totalAttempts: 0
-      };
-    }
-    return {
-      locked: false,
-      attemptsRemaining: Math.max(0, this.config.maxAttempts - attempts),
-      totalAttempts: attempts
-    };
-  }
-  async recordFailedAttempt(userId) {
-    const key = this.lockKey(userId);
-    const historyKey = this.historyKey(userId);
-    const now = Date.now();
-    const current = await this.redis.hincrby(key, "attempts", 1);
-    await this.redis.hset(key, "lastAttempt", now.toString());
-    await this.redis.lpush(historyKey, now.toString());
-    await this.redis.ltrim(historyKey, 0, 99);
-    if (current >= this.config.maxAttempts) {
-      const lockedUntil = new Date(now + this.config.lockDuration);
-      await this.redis.hset(key, {
-        lockedAt: now.toString(),
-        lockedUntil: lockedUntil.getTime().toString()
-      });
-      await this.redis.expire(
-        key,
-        Math.ceil(this.config.lockDuration / 1e3) + 3600
-      );
-      return {
-        locked: true,
-        attemptsRemaining: 0,
-        lockedUntil,
-        totalAttempts: current
-      };
-    }
-    return {
-      locked: false,
-      attemptsRemaining: Math.max(0, this.config.maxAttempts - current),
-      totalAttempts: current
-    };
-  }
-  async lockAccount(userId, duration) {
-    const key = this.lockKey(userId);
-    const now = Date.now();
-    const lockDuration = duration || this.config.lockDuration;
-    const lockedUntil = new Date(now + lockDuration);
-    const pipeline = this.redis.pipeline();
-    pipeline.hset(key, {
-      attempts: this.config.maxAttempts.toString(),
-      lockedAt: now.toString(),
-      lockedUntil: lockedUntil.getTime().toString()
-    });
-    pipeline.expire(key, Math.ceil(lockDuration / 1e3) + 3600);
-    await pipeline.exec();
-  }
-  async unlockAccount(userId) {
-    const key = this.lockKey(userId);
-    await this.redis.del(key);
-  }
-  async resetAttempts(userId) {
-    const key = this.lockKey(userId);
-    const data = await this.redis.hgetall(key);
-    if (data.lockedAt) {
-      await this.redis.hset(key, {
-        attempts: "0",
-        lockedAt: "",
-        lockedUntil: ""
-      });
-    } else {
-      await this.redis.del(key);
-    }
-  }
-  async getLockoutHistory(userId, limit = 10) {
-    const historyKey = this.historyKey(userId);
-    const timestamps = await this.redis.lrange(historyKey, 0, limit - 1);
-    return timestamps.map((ts) => new Date(parseInt(ts, 10)));
-  }
-  async getLockoutStats(userId) {
-    const historyKey = this.historyKey(userId);
-    const timestamps = await this.redis.lrange(historyKey, 0, -1);
-    const lockouts = timestamps.filter((_, i) => {
-      const attemptNum = i + 1;
-      return attemptNum % this.config.maxAttempts === 0;
-    }).length;
-    const lastLockoutData = await this.redis.hget(
-      this.lockKey(userId),
-      "lockedAt"
-    );
-    return {
-      totalFailedAttempts: timestamps.length,
-      lockoutCount: lockouts,
-      lastLockout: lastLockoutData ? new Date(parseInt(lastLockoutData, 10)) : null,
-      averageAttemptsBeforeLockout: lockouts > 0 ? this.config.maxAttempts : 0
-    };
-  }
-  shouldNotifyAdmin(currentAttempts) {
-    return this.config.notifyAdmin && currentAttempts >= this.config.adminNotifyAfter;
-  }
-  getConfig() {
-    return { ...this.config };
-  }
-  setConfig(config) {
-    this.config = { ...this.config, ...config };
-  }
-};
-
-// src/auth/security/rate-limit.ts
-var DEFAULT_RATE_LIMITS = {
-  "auth:login": { window: 9e5, max: 5 },
-  "auth:register": { window: 36e5, max: 3 },
-  "auth:forgot": { window: 36e5, max: 3 },
-  "auth:reset": { window: 36e5, max: 5 },
-  "auth:verify": { window: 36e5, max: 5 },
-  "api:general": { window: 6e4, max: 100 },
-  "api:authenticated": { window: 6e4, max: 200 }
-};
-var RateLimiter = class {
-  redis;
-  prefix;
-  limits;
-  userLimits;
-  constructor(redis, limits, userLimits, prefix = "kyro:ratelimit:") {
-    this.redis = redis;
-    this.prefix = prefix;
-    this.limits = { ...DEFAULT_RATE_LIMITS, ...limits };
-    this.userLimits = userLimits || {
-      "user:api": { window: 6e4, max: 500 },
-      "user:write": { window: 36e5, max: 100 }
-    };
-  }
-  getKey(type, identifier) {
-    return `${this.prefix}${type}:${identifier}`;
-  }
-  async check(type, identifier) {
-    const config = this.limits[type] || this.limits["api:general"];
-    const key = this.getKey(type, identifier);
-    const now = Date.now();
-    const windowStart = now - config.window;
-    const pipeline = this.redis.pipeline();
-    pipeline.zremrangebyscore(key, 0, windowStart);
-    pipeline.zcard(key);
-    pipeline.zadd(key, now, `${now}:${Math.random()}`);
-    pipeline.expire(key, Math.ceil(config.window / 1e3) + 1);
-    const results = await pipeline.exec();
-    const count = results?.[1]?.[1] || 0;
-    if (count >= config.max) {
-      const oldestTimestamp = await this.redis.zrange(key, 0, 0, "WITHSCORES");
-      const resetAt = oldestTimestamp.length > 1 ? parseInt(oldestTimestamp[1], 10) + config.window : now + config.window;
-      return {
-        allowed: false,
-        remaining: 0,
-        resetAt,
-        retryAfter: Math.ceil((resetAt - now) / 1e3)
-      };
-    }
-    return {
-      allowed: true,
-      remaining: config.max - count - 1,
-      resetAt: now + config.window
-    };
-  }
-  async checkUser(type, userId, identifier) {
-    const config = this.userLimits[type] || this.userLimits["user:api"];
-    const key = this.getKey(`user:${type}:${userId}`, identifier);
-    const now = Date.now();
-    const windowStart = now - config.window;
-    const pipeline = this.redis.pipeline();
-    pipeline.zremrangebyscore(key, 0, windowStart);
-    pipeline.zcard(key);
-    pipeline.zadd(key, now, `${now}:${Math.random()}`);
-    pipeline.expire(key, Math.ceil(config.window / 1e3) + 1);
-    const results = await pipeline.exec();
-    const count = results?.[1]?.[1] || 0;
-    if (count >= config.max) {
-      const oldestTimestamp = await this.redis.zrange(key, 0, 0, "WITHSCORES");
-      const resetAt = oldestTimestamp.length > 1 ? parseInt(oldestTimestamp[1], 10) + config.window : now + config.window;
-      return {
-        allowed: false,
-        remaining: 0,
-        resetAt,
-        retryAfter: Math.ceil((resetAt - now) / 1e3)
-      };
-    }
-    return {
-      allowed: true,
-      remaining: config.max - count - 1,
-      resetAt: now + config.window
-    };
-  }
-  async reset(type, identifier) {
-    const key = this.getKey(type, identifier);
-    await this.redis.del(key);
-  }
-  async resetUser(type, userId, identifier) {
-    const key = this.getKey(`user:${type}:${userId}`, identifier);
-    await this.redis.del(key);
-  }
-  async getStatus(type, identifier) {
-    const config = this.limits[type] || this.limits["api:general"];
-    const key = this.getKey(type, identifier);
-    const now = Date.now();
-    const windowStart = now - config.window;
-    await this.redis.zremrangebyscore(key, 0, windowStart);
-    const count = await this.redis.zcard(key);
-    return {
-      count,
-      limit: config.max,
-      remaining: Math.max(0, config.max - count),
-      resetAt: now + config.window
-    };
-  }
-  setLimit(type, config) {
-    this.limits[type] = config;
-  }
-  setUserLimit(type, config) {
-    this.userLimits[type] = config;
-  }
-};
-var InMemoryAuthAdapter = class {
-  users = /* @__PURE__ */ new Map();
-  sessions = /* @__PURE__ */ new Map();
-  refreshTokens = /* @__PURE__ */ new Map();
-  emailToUserId = /* @__PURE__ */ new Map();
-  passwordHistory = /* @__PURE__ */ new Map();
-  emailVerificationTokens = /* @__PURE__ */ new Map();
-  passwordResetTokens = /* @__PURE__ */ new Map();
-  auditLogs = [];
-  externalDb = false;
-  constructor() {
-  }
-  async connect() {
-  }
-  async disconnect() {
-    this.users.clear();
-    this.sessions.clear();
-    this.refreshTokens.clear();
-    this.emailToUserId.clear();
-    this.passwordHistory.clear();
-  }
-  async createUser(data) {
-    const userId = randomBytes(16).toString("hex");
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const passwordHash = await this.hashPassword(data.password);
-    const user = {
-      id: userId,
-      email: data.email.toLowerCase(),
-      passwordHash,
-      role: data.role || "customer",
-      tenantId: data.tenantId,
-      createdAt: now,
-      updatedAt: now
-    };
-    this.users.set(userId, user);
-    this.emailToUserId.set(data.email.toLowerCase(), userId);
-    this.passwordHistory.set(userId, []);
-    return user;
-  }
-  async findUserByEmail(email) {
-    const userId = this.emailToUserId.get(email.toLowerCase());
-    if (!userId) return null;
-    return this.findUserById(userId);
-  }
-  async findUserById(userId) {
-    return this.users.get(userId) || null;
-  }
-  async updateUser(userId, data) {
-    const existing = await this.findUserById(userId);
-    if (!existing) return null;
-    const updated = {
-      ...existing,
-      ...data,
-      id: userId,
-      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    if (data.email && data.email !== existing.email) {
-      this.emailToUserId.delete(existing.email.toLowerCase());
-      this.emailToUserId.set(data.email.toLowerCase(), userId);
-    }
-    this.users.set(userId, updated);
-    return updated;
-  }
-  async deleteUser(userId) {
-    const user = await this.findUserById(userId);
-    if (!user) return false;
-    this.users.delete(userId);
-    this.emailToUserId.delete(user.email.toLowerCase());
-    this.refreshTokens.forEach((sessionId, refreshToken) => {
-      if (this.sessions.get(sessionId)?.userId === userId) {
-        this.refreshTokens.delete(refreshToken);
-        this.sessions.delete(sessionId);
-      }
-    });
-    this.passwordHistory.delete(userId);
-    this.sessions.forEach((session, sessionId) => {
-      if (session.userId === userId) {
-        this.sessions.delete(sessionId);
-      }
-    });
-    return true;
-  }
-  async hashPassword(password) {
-    const bcrypt = (await import('bcryptjs')).default;
-    return bcrypt.hash(password, 12);
-  }
-  async verifyPassword(email, password) {
-    const user = await this.findUserByEmail(email);
-    if (!user || !user.passwordHash) return null;
-    const bcrypt = (await import('bcryptjs')).default;
-    const valid = await bcrypt.compare(password, user.passwordHash);
-    return valid ? user : null;
-  }
-  async createSession(userId, data = {}) {
-    const sessionId = randomBytes(32).toString("hex");
-    const token = randomBytes(32).toString("base64url");
-    const refreshToken = randomBytes(32).toString("base64url");
-    const now = /* @__PURE__ */ new Date();
-    const session = {
-      id: sessionId,
-      userId,
-      token,
-      refreshToken,
-      expiresAt: new Date(now.getTime() + 86400 * 1e3).toISOString(),
-      // 24 hours
-      createdAt: now.toISOString(),
-      ipAddress: data.ipAddress,
-      userAgent: data.userAgent
-    };
-    this.sessions.set(sessionId, session);
-    this.refreshTokens.set(refreshToken, sessionId);
-    return session;
-  }
-  async findSessionByToken(token) {
-    return this.sessions.get(token) || null;
-  }
-  async findSessionByRefreshToken(refreshToken) {
-    const sessionId = this.refreshTokens.get(refreshToken);
-    if (!sessionId) return null;
-    const session = this.sessions.get(sessionId);
-    return session || null;
-  }
-  async deleteSession(sessionId) {
-    const session = this.sessions.get(sessionId);
-    if (!session) return false;
-    if (session.refreshToken) {
-      this.refreshTokens.delete(session.refreshToken);
-    }
-    this.sessions.delete(sessionId);
-    return true;
-  }
-  async deleteUserSessions(userId) {
-    let deleted = 0;
-    this.sessions.forEach((session, sessionId) => {
-      if (session.userId === userId) {
-        if (session.refreshToken) {
-          this.refreshTokens.delete(session.refreshToken);
-        }
-        this.sessions.delete(sessionId);
-        deleted++;
-      }
-    });
-    return deleted;
-  }
-  async addPasswordToHistory(userId, passwordHash) {
-    const history = this.passwordHistory.get(userId) || [];
-    history.push(passwordHash);
-    if (history.length > 5) {
-      history.splice(0, history.length - 5);
-    }
-    this.passwordHistory.set(userId, history);
-  }
-  async getPasswordHistory(userId, count = 5) {
-    return this.passwordHistory.get(userId) || [];
-  }
-  async isPasswordInHistory(password, userId, historyCount = 5) {
-    const history = await this.getPasswordHistory(userId, historyCount);
-    const bcrypt = (await import('bcryptjs')).default;
-    for (const hash of history) {
-      if (await bcrypt.compare(password, hash)) {
-        return true;
-      }
-    }
-    return false;
-  }
-  async createEmailVerificationToken(userId) {
-    const token = randomBytes(32).toString("hex");
-    const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1e3);
-    this.emailVerificationTokens.set(token, { userId, expiresAt });
-    return { token, expiresAt };
-  }
-  async verifyEmailToken(token) {
-    const data = this.emailVerificationTokens.get(token);
-    if (!data || data.expiresAt < /* @__PURE__ */ new Date()) {
-      this.emailVerificationTokens.delete(token);
-      return { success: false, error: "Invalid or expired token" };
-    }
-    this.emailVerificationTokens.delete(token);
-    return { success: true, userId: data.userId };
-  }
-  async createPasswordResetToken(email) {
-    const user = await this.findUserByEmail(email);
-    if (!user) {
-      return { token: "", expiresAt: /* @__PURE__ */ new Date(), error: "User not found" };
-    }
-    const token = randomBytes(32).toString("hex");
-    const expiresAt = new Date(Date.now() + 60 * 60 * 1e3);
-    this.passwordResetTokens.set(token, { userId: user.id, expiresAt });
-    return { token, expiresAt };
-  }
-  async resetPasswordWithToken(token, newPassword) {
-    const data = this.passwordResetTokens.get(token);
-    if (!data || data.expiresAt < /* @__PURE__ */ new Date()) {
-      this.passwordResetTokens.delete(token);
-      return { success: false, error: "Invalid or expired token" };
-    }
-    const passwordHash = await this.hashPassword(newPassword);
-    await this.updateUser(data.userId, { passwordHash });
-    this.passwordResetTokens.delete(token);
-    return { success: true };
-  }
-  async hasAnyUsers() {
-    return this.users.size > 0;
-  }
-  async findAuditLogs(filter) {
-    const { limit = 50, offset = 0 } = filter;
-    let logs = this.auditLogs.slice().reverse();
-    if (filter.userId) logs = logs.filter((l) => l.userId === filter.userId);
-    if (filter.action) {
-      if (Array.isArray(filter.action)) {
-        logs = logs.filter((l) => filter.action.includes(String(l.action)));
-      } else {
-        logs = logs.filter((l) => l.action === filter.action);
-      }
-    }
-    if (filter.resource)
-      logs = logs.filter((l) => l.resource === filter.resource);
-    if (filter.success !== void 0)
-      logs = logs.filter((l) => l.success === filter.success);
-    return { logs: logs.slice(offset, offset + limit), total: logs.length };
-  }
-  async createAuditLog(data) {
-    const id = randomBytes(16).toString("hex");
-    const timestamp = /* @__PURE__ */ new Date();
-    const log = { ...data, id, timestamp };
-    this.auditLogs.push(log);
-    return log;
-  }
-};
-
-// src/auth/security/in-memory-lockout.ts
-var InMemoryAccountLockout = class {
-  storage = /* @__PURE__ */ new Map();
-  history = /* @__PURE__ */ new Map();
-  // userId -> attempt timestamps
-  config;
-  constructor(config = {}) {
-    this.config = {
-      maxAttempts: 5,
-      lockDuration: 9e5,
-      // 15 minutes
-      notifyUser: true,
-      notifyAdmin: true,
-      adminNotifyAfter: 3,
-      ...config
-    };
-  }
-  async checkLockout(userId) {
-    const now = Date.now();
-    const record = this.storage.get(userId);
-    if (record && record.lockedUntil !== null && record.lockedUntil <= now) {
-      await this.resetAttempts(userId);
-      return {
-        locked: false,
-        attemptsRemaining: this.config.maxAttempts,
-        totalAttempts: 0
-      };
-    }
-    if (!record) {
-      return {
-        locked: false,
-        attemptsRemaining: this.config.maxAttempts,
-        totalAttempts: 0
-      };
-    }
-    const { attempts, lockedUntil } = record;
-    if (lockedUntil !== null && lockedUntil > now) {
-      return {
-        locked: true,
-        attemptsRemaining: 0,
-        lockedUntil: new Date(lockedUntil),
-        totalAttempts: attempts
-      };
-    }
-    return {
-      locked: false,
-      attemptsRemaining: Math.max(0, this.config.maxAttempts - attempts),
-      totalAttempts: attempts
-    };
-  }
-  async recordFailedAttempt(userId) {
-    const now = Date.now();
-    const record = this.storage.get(userId) || {
-      attempts: 0,
-      lastAttempt: null,
-      lockedAt: null,
-      lockedUntil: null
-    };
-    record.attempts += 1;
-    record.lastAttempt = now;
-    let history = this.history.get(userId) || [];
-    history.push(now);
-    if (history.length > 100) {
-      history.splice(0, history.length - 100);
-    }
-    this.history.set(userId, history);
-    this.storage.set(userId, record);
-    if (record.attempts >= this.config.maxAttempts) {
-      const lockedUntil = new Date(now + this.config.lockDuration);
-      record.lockedAt = now;
-      record.lockedUntil = lockedUntil.getTime();
-      this.storage.set(userId, record);
-      return {
-        locked: true,
-        attemptsRemaining: 0,
-        lockedUntil,
-        totalAttempts: record.attempts
-      };
-    }
-    return {
-      locked: false,
-      attemptsRemaining: Math.max(0, this.config.maxAttempts - record.attempts),
-      totalAttempts: record.attempts
-    };
-  }
-  async lockAccount(userId, duration) {
-    const now = Date.now();
-    const lockDuration = duration || this.config.lockDuration;
-    const lockedUntil = new Date(now + lockDuration);
-    const record = this.storage.get(userId) || {
-      attempts: 0,
-      lastAttempt: null,
-      lockedAt: null,
-      lockedUntil: null
-    };
-    record.attempts = this.config.maxAttempts;
-    record.lockedAt = now;
-    record.lockedUntil = lockedUntil.getTime();
-    this.storage.set(userId, record);
-  }
-  async unlockAccount(userId) {
-    await this.resetAttempts(userId);
-  }
-  async resetAttempts(userId) {
-    const record = this.storage.get(userId);
-    if (record) {
-      record.attempts = 0;
-      record.lockedAt = null;
-      record.lockedUntil = null;
-      this.storage.set(userId, record);
-    }
-    this.history.delete(userId);
-  }
-  async getLockoutHistory(userId, limit = 10) {
-    const history = this.history.get(userId) || [];
-    return history.slice(-limit).reverse().map((timestamp) => new Date(timestamp));
-  }
-  async getLockoutStats(userId) {
-    const history = this.history.get(userId) || [];
-    const totalFailedAttempts = history.length;
-    const lockoutCount = Math.floor(
-      totalFailedAttempts / this.config.maxAttempts
-    );
-    let lastLockout = null;
-    const record = this.storage.get(userId);
-    if (record && record.lockedAt !== null) {
-      lastLockout = new Date(record.lockedAt);
-    }
-    const averageAttemptsBeforeLockout = lockoutCount > 0 ? this.config.maxAttempts : 0;
-    return {
-      totalFailedAttempts,
-      lockoutCount,
-      lastLockout,
-      averageAttemptsBeforeLockout
-    };
-  }
-  shouldNotifyAdmin(currentAttempts) {
-    return this.config.notifyAdmin && currentAttempts >= this.config.adminNotifyAfter;
-  }
-  getConfig() {
-    return { ...this.config };
-  }
-  setConfig(config) {
-    this.config = { ...this.config, ...config };
-  }
-};
-function getEnv(key, fallback = "") {
-  return process.env[key] || fallback;
-}
-function getEnvBool(key, fallback = false) {
-  const val = process.env[key];
-  if (!val) return fallback;
-  return val.toLowerCase() === "true";
-}
-function getEnvNum(key, fallback = 0) {
-  const val = process.env[key];
-  if (!val) return fallback;
-  return parseInt(val, 10);
-}
-function detectDatabaseType() {
-  const envDb = process.env.KYRO_AUTH_DATABASE?.toLowerCase();
-  if (envDb && ["sqlite", "postgres", "mongodb", "memory"].includes(envDb)) {
-    return envDb;
-  }
-  try {
-    const configPath = join(process.cwd(), "kyro.config.ts");
-    const configContent = readFileSync(configPath, "utf8");
-    if (configContent.includes("createLocalAdapter")) {
-      return "sqlite";
-    } else if (configContent.includes("createDrizzleAdapter")) {
-      if (configContent.includes("postgres") || configContent.includes("postgresql")) {
-        return "postgres";
-      }
-      return "postgres";
-    } else if (configContent.includes("createMongoDBAdapter")) {
-      return "mongodb";
-    }
-  } catch {
-  }
-  return "memory";
-}
-async function createAuthAdapter(databaseType) {
-  const cwd = process.cwd();
-  const rootDir = cwd.endsWith("admin") ? join(cwd, "..") : cwd;
-  const defaultAuthDbPath = resolve(rootDir, "data", "auth.db");
-  switch (databaseType) {
-    case "sqlite":
-      return new SQLiteAuthAdapter({
-        path: getEnv("KYRO_AUTH_DB_PATH", defaultAuthDbPath)
-      });
-    case "postgres": {
-      try {
-        const databaseUrl = getEnv("DATABASE_URL", "");
-        if (databaseUrl) {
-          const { drizzle } = await import('drizzle-orm/postgres-js');
-          const postgres = await import('postgres');
-          const sql = postgres.default(databaseUrl, { onnotice: () => {
-          } });
-          const drizzleDb = drizzle(sql);
-          return new PostgresAuthAdapter({ db: drizzleDb });
-        }
-      } catch (e) {
-        console.warn("[Auth] Could not create PostgresAuthAdapter, falling back to SQLite auth adapter.");
-      }
-      return new SQLiteAuthAdapter({
-        path: getEnv("KYRO_AUTH_DB_PATH", defaultAuthDbPath)
-      });
-    }
-    case "mongodb": {
-      try {
-        const mongoUri = getEnv("MONGODB_URI", "");
-        if (mongoUri) {
-          const { MongoClient } = await import('mongodb');
-          const client = new MongoClient(mongoUri);
-          await client.connect();
-          const url = new URL(mongoUri);
-          const dbName = url.pathname.replace(/^\//, "") || "kyro_cms";
-          const mongoDb = client.db(dbName);
-          return new MongoDBAuthAdapter({ db: mongoDb });
-        }
-      } catch (e) {
-        console.warn("[Auth] Could not create MongoDBAuthAdapter, falling back to SQLite auth adapter.");
-      }
-      return new SQLiteAuthAdapter({
-        path: getEnv("KYRO_AUTH_DB_PATH", defaultAuthDbPath)
-      });
-    }
-    case "memory":
-    default:
-      return new InMemoryAuthAdapter();
-  }
-}
-async function createAuthConfig(databaseType, db) {
-  const distributed = getEnvBool("KYRO_DISTRIBUTED", false);
-  let authAdapter;
-  if (distributed) {
-    const { RedisAuthAdapter: RedisAuthAdapter2 } = await import('./redis-adapter-XALOGWY3.js');
-    const redisUrl = getEnv("REDIS_URL", "redis://localhost:6379");
-    const redisTls = getEnvBool("REDIS_TLS", false);
-    const redisAdapter = new RedisAuthAdapter2({ url: redisUrl, tls: redisTls });
-    await redisAdapter.connect?.();
-    authAdapter = redisAdapter;
-  } else {
-    const initialDbType = databaseType || detectDatabaseType();
-    authAdapter = await createAuthAdapter(initialDbType);
-    if (authAdapter.connect) {
-      await authAdapter.connect();
-    }
-  }
-  const email = db ? await EmailTransport.fromConfig(db).catch(() => null) || EmailTransport.fromEnv() || void 0 : EmailTransport.fromEnv() || void 0;
-  const passwordPolicy = new PasswordPolicy({
-    minLength: getEnvNum("PASSWORD_MIN_LENGTH", 12),
-    requireUppercase: getEnvBool("PASSWORD_REQUIRE_UPPERCASE", true),
-    requireLowercase: getEnvBool("PASSWORD_REQUIRE_LOWERCASE", true),
-    requireNumbers: getEnvBool("PASSWORD_REQUIRE_NUMBERS", true),
-    requireSpecialChars: getEnvBool("PASSWORD_REQUIRE_SPECIAL", true),
-    preventReuse: getEnvNum("PASSWORD_PREVENT_REUSE", 5),
-    maxLength: getEnvNum("PASSWORD_MAX_LENGTH", 128)
-  });
-  let lockout;
-  let rateLimiter;
-  let auditLogger;
-  if (distributed) {
-    const redis = authAdapter;
-    const redisClient = redis.redis;
-    lockout = new AccountLockout(redisClient, {
-      maxAttempts: getEnvNum("LOCKOUT_MAX_ATTEMPTS", 5),
-      lockDuration: getEnvNum("LOCKOUT_DURATION_MINUTES", 15) * 60 * 1e3
-    });
-    rateLimiter = new RateLimiter(redisClient, {
-      "auth:login": {
-        window: getEnvNum("RATE_LIMIT_AUTH_WINDOW_MS", 9e5),
-        max: getEnvNum("RATE_LIMIT_AUTH_MAX_REQUESTS", 10)
-      },
-      "api:general": {
-        window: getEnvNum("RATE_LIMIT_WINDOW_MS", 6e4),
-        max: getEnvNum("RATE_LIMIT_MAX_REQUESTS", 100)
-      }
-    });
-    auditLogger = new AuditLogger(
-      redisClient,
-      getEnvNum("AUDIT_LOG_RETENTION_DAYS", 30)
-    );
-  } else {
-    lockout = new InMemoryAccountLockout({
-      maxAttempts: getEnvNum("LOCKOUT_MAX_ATTEMPTS", 5),
-      lockDuration: getEnvNum("LOCKOUT_DURATION_MINUTES", 15) * 60 * 1e3
-    });
-    rateLimiter = new InMemoryRateLimiter({
-      "auth:login": {
-        window: getEnvNum("RATE_LIMIT_AUTH_WINDOW_MS", 9e5),
-        max: getEnvNum("RATE_LIMIT_AUTH_MAX_REQUESTS", 10)
-      },
-      "api:general": {
-        window: getEnvNum("RATE_LIMIT_WINDOW_MS", 6e4),
-        max: getEnvNum("RATE_LIMIT_MAX_REQUESTS", 100)
-      }
-    });
-    auditLogger = getEnvBool("AUDIT_LOG_ENABLED", true) ? new InMemoryAuditLogger(getEnvNum("AUDIT_LOG_RETENTION_DAYS", 30)) : void 0;
-  }
-  const routes = new AuthRoutes({
-    redis: authAdapter,
-    email,
-    jwtSecret: getEnv("APP_SECRET", "change-me"),
-    jwtExpiresIn: getEnv("JWT_EXPIRES_IN", "24h"),
-    jwtIssuer: getEnv("JWT_ISSUER", "kyro-cms"),
-    jwtAudience: getEnv("JWT_AUDIENCE", "kyro-cms-client"),
-    passwordPolicy,
-    lockout,
-    rateLimiter,
-    auditLogger,
-    baseUrl: getEnv("EMAIL_BASE_URL", "http://localhost:4321"),
-    emailVerificationRequired: getEnvBool("EMAIL_VERIFICATION_REQUIRED", true)
-  });
-  const actualDbType = distributed ? "distributed" : databaseType || detectDatabaseType();
-  return {
-    authAdapter,
-    databaseType: actualDbType,
-    email,
-    passwordPolicy,
-    lockout,
-    rateLimiter,
-    auditLogger,
-    routes
-  };
-}
-var authConfig = createAuthConfig().catch((err) => {
-  console.warn("[AuthConfig] Failed to initialize auth config:", err.message);
-  return null;
-});
-
-// src/auth/index.ts
-var DEFAULT_SALT_ROUNDS = 12;
-var DEFAULT_EXPIRES_IN = "24h";
-var DEFAULT_REFRESH_EXPIRES_IN = "7d";
-var Auth = class {
-  adapter;
-  config;
-  constructor(adapter, config) {
-    this.adapter = adapter;
-    this.config = {
-      secret: config.secret,
-      expiresIn: config.expiresIn ?? DEFAULT_EXPIRES_IN,
-      refreshExpiresIn: config.refreshExpiresIn ?? DEFAULT_REFRESH_EXPIRES_IN,
-      issuer: config.issuer ?? "kyro-cms",
-      audience: config.audience ?? [],
-      saltRounds: config.saltRounds ?? DEFAULT_SALT_ROUNDS
-    };
-  }
-  async register(data) {
-    try {
-      const existing = await this.adapter.findUserByEmail(data.email);
-      if (existing) {
-        return { success: false, error: "Email already registered" };
-      }
-      const user = await this.adapter.createUser({
-        email: data.email,
-        password: data.password,
-        role: data.role ?? "customer",
-        tenantId: data.tenantId
-      });
-      return this.createSessionForUser(user);
-    } catch (error) {
-      return { success: false, error: String(error) };
-    }
-  }
-  async login(credentials) {
-    try {
-      const user = await this.adapter.verifyPassword(
-        credentials.email,
-        credentials.password
-      );
-      if (!user) {
-        return { success: false, error: "Invalid credentials" };
-      }
-      return this.createSessionForUser(user);
-    } catch (error) {
-      return { success: false, error: String(error) };
-    }
-  }
-  async logout(token) {
-    await this.adapter.deleteSession(token);
-  }
-  async refreshToken(refreshToken) {
-    try {
-      const session = await this.adapter.findSessionByToken(refreshToken);
-      if (!session || new Date(session.expiresAt) < /* @__PURE__ */ new Date()) {
-        return { success: false, error: "Invalid or expired refresh token" };
-      }
-      const user = await this.adapter.findUserById(session.userId);
-      if (!user) {
-        return { success: false, error: "User not found" };
-      }
-      await this.adapter.deleteSession(refreshToken);
-      return this.createSessionForUser(user);
-    } catch (error) {
-      return { success: false, error: String(error) };
-    }
-  }
-  async verifyToken(token) {
-    try {
-      const { default: jwtModule } = await import('jsonwebtoken');
-      const decoded = jwtModule.verify(token, this.config.secret, {
-        issuer: this.config.issuer,
-        audience: this.config.audience.length > 0 ? this.config.audience[0] : void 0
-      });
-      return decoded;
-    } catch {
-      return null;
-    }
-  }
-  async getUserFromToken(token) {
-    const payload = await this.verifyToken(token);
-    if (!payload) return null;
-    return this.adapter.findUserById(payload.sub);
-  }
-  async changePassword(userId, currentPassword, newPassword) {
-    try {
-      const user = await this.adapter.findUserById(userId);
-      if (!user) {
-        return { success: false, error: "User not found" };
-      }
-      const valid = await this.adapter.verifyPassword(
-        user.email,
-        currentPassword
-      );
-      if (!valid) {
-        return { success: false, error: "Current password is incorrect" };
-      }
-      await this.adapter.updateUser(userId, { password: newPassword });
-      await this.adapter.deleteUserSessions(userId);
-      return { success: true, user };
-    } catch (error) {
-      return { success: false, error: String(error) };
-    }
-  }
-  async resetPassword(email, newPassword) {
-    try {
-      const user = await this.adapter.findUserByEmail(email);
-      if (!user) {
-        return { success: false, error: "User not found" };
-      }
-      await this.adapter.updateUser(user.id, { password: newPassword });
-      await this.adapter.deleteUserSessions(user.id);
-      return { success: true, user };
-    } catch (error) {
-      return { success: false, error: String(error) };
-    }
-  }
-  async sendEmailVerification(userId) {
-    try {
-      const { token, expiresAt } = await this.adapter.createEmailVerificationToken(userId);
-      return { success: true };
-    } catch (error) {
-      return { success: false, error: String(error) };
-    }
-  }
-  async verifyEmail(token) {
-    try {
-      return await this.adapter.verifyEmailToken(token);
-    } catch (error) {
-      return { success: false, error: String(error) };
-    }
-  }
-  async requestPasswordReset(email) {
-    try {
-      const result = await this.adapter.createPasswordResetToken(email);
-      if (result.error) {
-        return { success: false, error: result.error };
-      }
-      return { success: true };
-    } catch (error) {
-      return { success: false, error: String(error) };
-    }
-  }
-  async resetPasswordWithToken(token, newPassword) {
-    try {
-      return await this.adapter.resetPasswordWithToken(token, newPassword);
-    } catch (error) {
-      return { success: false, error: String(error) };
-    }
-  }
-  async deleteAccount(userId) {
-    try {
-      const user = await this.adapter.findUserById(userId);
-      if (!user) {
-        return { success: false, error: "User not found" };
-      }
-      await this.adapter.deleteUserSessions(userId);
-      await this.adapter.deleteUser(userId);
-      return { success: true };
-    } catch (error) {
-      return { success: false, error: String(error) };
-    }
-  }
-  async createSessionForUser(user) {
-    const token = await this.generateToken(user);
-    const session = await this.adapter.createSession(user.id);
-    return {
-      success: true,
-      user,
-      session,
-      token
-    };
-  }
-  async generateToken(user) {
-    const { default: jwtModule } = await import('jsonwebtoken');
-    const payload = {
-      sub: user.id,
-      email: user.email,
-      role: user.role,
-      tenantId: user.tenantId
-    };
-    const signOptions = {
-      expiresIn: this.parseExpiresIn(this.config.expiresIn) / 1e3,
-      issuer: this.config.issuer
-    };
-    if (this.config.audience.length > 0) {
-      signOptions.audience = this.config.audience[0];
-    }
-    return jwtModule.sign(payload, this.config.secret, signOptions);
-  }
-  async hashPassword(password) {
-    const { default: bcrypt } = await import('bcryptjs');
-    return bcrypt.hash(password, this.config.saltRounds);
-  }
-  parseExpiresIn(value) {
-    if (typeof value === "number") return value;
-    const match = value.match(/^(\d+)([smhd])$/);
-    if (!match) return 864e5;
-    const num = parseInt(match[1], 10);
-    switch (match[2]) {
-      case "s":
-        return num * 1e3;
-      case "m":
-        return num * 6e4;
-      case "h":
-        return num * 36e5;
-      case "d":
-        return num * 864e5;
-      default:
-        return 864e5;
-    }
-  }
-};
-function createAuth(adapter, config) {
-  return new Auth(adapter, config);
-}
-
-// src/versions/types.ts
-function getDefaultDraftPublishConfig() {
-  return {
-    enabled: true,
-    draftsEnabled: true,
-    publishEnabled: true,
-    scheduleEnabled: false,
-    versioningEnabled: true,
-    maxVersionsPerDocument: 50,
-    autoPublish: false,
-    requirePublishPermission: true
-  };
-}
-
-// src/versions/index.ts
-var VersionManager = class {
-  adapter;
-  config;
-  constructor(adapter, config) {
-    this.adapter = adapter;
-    this.config = { ...getDefaultDraftPublishConfig(), ...config };
-  }
-  async createVersion(options) {
-    const latestVersion = await this.adapter.getLatestVersion(options.collection, options.documentId);
-    const nextVersion = (latestVersion?.version ?? 0) + 1;
-    const versionOptions = {
-      ...options,
-      version: nextVersion
-    };
-    const version = await this.adapter.createVersion(versionOptions);
-    if (this.config.maxVersionsPerDocument > 0) {
-      await this.pruneOldVersions(options.collection, options.documentId);
-    }
-    return version;
-  }
-  async publishVersion(options) {
-    const version = await this.adapter.getVersion(options.collection, options.versionId);
-    if (!version) {
-      throw new Error("Version not found");
-    }
-    if (version.status === "published") {
-      throw new Error("Version is already published");
-    }
-    await this.adapter.publishVersion(options);
-  }
-  async unpublishDocument(collection, documentId) {
-    const versions = await this.adapter.getVersions({
-      collection,
-      documentId,
-      limit: 1e3
-    });
-    for (const version of versions) {
-      if (version.status === "published") {
-        await this.createVersion({
-          collection,
-          documentId,
-          data: version.data,
-          status: "draft",
-          createdBy: "system",
-          changeDescription: "Unpublished document"
-        });
-        break;
-      }
-    }
-  }
-  async revertToVersion(collection, documentId, versionId, userId) {
-    const targetVersion = await this.adapter.getVersion(collection, versionId);
-    if (!targetVersion) {
-      throw new Error("Version not found");
-    }
-    const newVersion = await this.adapter.revertToVersion({
-      collection,
-      documentId,
-      versionId,
-      userId
-    });
-    return newVersion;
-  }
-  async getVersionHistory(collection, documentId, limit = 20, offset = 0) {
-    return this.adapter.getVersions({
-      collection,
-      documentId,
-      limit,
-      offset
-    });
-  }
-  async compareTwoVersions(collection, documentId, versionA, versionB) {
-    return this.adapter.compareVersions({
-      collection,
-      documentId,
-      versionA,
-      versionB
-    });
-  }
-  async getLatestDraft(collection, documentId) {
-    return this.adapter.getLatestVersion(collection, documentId);
-  }
-  async getPublishedVersion(collection, documentId) {
-    return this.adapter.getPublishedVersion(collection, documentId);
-  }
-  async getVersion(collection, versionId) {
-    return this.adapter.getVersion(collection, versionId);
-  }
-  async schedulePublish(collection, documentId, versionId, scheduledFor) {
-    if (!this.config.scheduleEnabled) {
-      throw new Error("Scheduled publishing is not enabled");
-    }
-    const version = await this.adapter.getVersion(collection, versionId);
-    if (!version) {
-      throw new Error("Version not found");
-    }
-  }
-  async deleteVersionHistory(collection, documentId) {
-    await this.adapter.deleteVersions(collection, documentId);
-  }
-  async pruneOldVersions(collection, documentId) {
-    const versions = await this.adapter.getVersions({
-      collection,
-      documentId,
-      limit: this.config.maxVersionsPerDocument + 100
-    });
-    if (versions.length <= this.config.maxVersionsPerDocument) {
-      return;
-    }
-    versions.slice(0, this.config.maxVersionsPerDocument);
-    const versionsToDelete = versions.slice(this.config.maxVersionsPerDocument);
-    for (const version of versionsToDelete) {
-      if (version.status !== "published") {
-        await this.adapter.deleteVersions(collection, documentId);
-        break;
-      }
-    }
-  }
-};
-function createVersionManager(adapter, config) {
-  return new VersionManager(adapter, config);
-}
-function isPublished(status) {
-  return status === "published";
-}
-function isDraft(status) {
-  return status === "draft";
-}
-function isArchived(status) {
-  return status === "archived";
-}
-
-// src/registry/config.ts
-function normalizeCollections(collections) {
-  if (!collections) return [];
-  if (Array.isArray(collections)) return collections;
-  return Object.values(collections);
-}
-function normalizeGlobals(globals) {
-  if (!globals) return [];
-  if (Array.isArray(globals)) return globals;
-  return Object.values(globals);
-}
-function defineConfig(config) {
-  return {
-    collections: normalizeCollections(config.collections),
-    globals: normalizeGlobals(config.globals),
-    adapter: config.adapter,
-    plugins: config.plugins,
-    auth: config.auth,
-    cors: config.cors,
-    admin: config.admin,
-    upload: config.upload,
-    graphQL: config.graphQL,
-    typescript: config.typescript,
-    localization: config.localization,
-    rateLimit: config.rateLimit,
-    debug: config.debug
-  };
-}
-var defineKyroConfig = defineConfig;
-
-// src/lib/seo.ts
-function generateSeoTags(options) {
-  const { siteSettings, seoSettings, title, description, image, url } = options;
-  if (!siteSettings) return "";
-  const siteName = siteSettings.siteName || "";
-  const rawTitle = title || seoSettings?.defaultTitle || siteName;
-  const titleTemplate = seoSettings?.titleTemplate;
-  const separator = seoSettings?.separator || " | ";
-  const siteNameInTitle = seoSettings?.siteNameInTitle !== false;
-  const finalTitle = titleTemplate ? titleTemplate.replace(/\{\{title\}\}/g, rawTitle).replace(/\{\{siteName\}\}/g, siteNameInTitle ? siteName : "").replace(/\{\{separator\}\}/g, separator).replace(/\s+/g, " ").trim() : rawTitle;
-  const finalDesc = description || seoSettings?.defaultDescription || siteSettings.siteDescription || "";
-  const finalImage = image || siteSettings.siteOgImage?.url || "";
-  const finalUrl = url || siteSettings.siteUrl || "";
-  let tags = `
-    <title>${finalTitle}</title>
-    <meta name="description" content="${finalDesc}">
-  `;
-  if (siteSettings.siteFavicon?.url) {
-    tags += `
-    <link rel="icon" type="${siteSettings.siteFavicon.mimeType || "image/x-icon"}" href="${siteSettings.siteFavicon.url}">`;
-  }
-  const robots = seoSettings?.meta?.robots;
-  if (robots) {
-    tags += `
-    <meta name="robots" content="${robots}">`;
-  }
-  const canonical = seoSettings?.meta?.canonicalUrl || finalUrl;
-  if (canonical) {
-    tags += `
-    <link rel="canonical" href="${canonical}">`;
-  }
-  const ogType = seoSettings?.meta?.ogType || "website";
-  tags += `
-    <meta property="og:type" content="${ogType}">
-    <meta property="og:title" content="${finalTitle}">
-    <meta property="og:description" content="${finalDesc}">
-    <meta property="og:site_name" content="${siteName}">
-  `;
-  if (finalUrl) tags += `
-    <meta property="og:url" content="${finalUrl}">`;
-  if (finalImage) tags += `
-    <meta property="og:image" content="${finalImage}">`;
-  if (seoSettings?.social?.fbAppId) {
-    tags += `
-    <meta property="fb:app_id" content="${seoSettings.social.fbAppId}">`;
-  }
-  const twitterCard = seoSettings?.social?.twitterCardType || "summary_large_image";
-  tags += `
-    <meta name="twitter:card" content="${twitterCard}">
-    <meta name="twitter:title" content="${finalTitle}">
-    <meta name="twitter:description" content="${finalDesc}">
-  `;
-  if (seoSettings?.social?.twitterHandle) {
-    tags += `
-    <meta name="twitter:site" content="${seoSettings.social.twitterHandle}">`;
-  }
-  if (finalImage) tags += `
-    <meta name="twitter:image" content="${finalImage}">`;
-  if (siteSettings.enableI18n && siteSettings.i18n?.language) {
-    tags += `
-    <meta http-equiv="content-language" content="${siteSettings.i18n.language}">`;
-  }
-  return tags;
-}
-function generateAnalyticsTags(siteSettings) {
-  if (!siteSettings || !siteSettings.analyticsEnabled || !siteSettings.analytics) {
-    return "";
-  }
-  const { googleAnalyticsId, googleTagManagerId, plausibleDomain } = siteSettings.analytics;
-  let scripts = "";
-  if (googleAnalyticsId) {
-    scripts += `
+export{a as RedisAuthAdapter}from'./chunk-AU6IWTBO.js';export{P as allSettingsGlobals,c as blogCollections,d as blogGlobals,Q as coreSettingsGlobals,U as createTemplateConfig,e as ecommerceCollections,f as ecommerceGlobals,g as kitchenSinkCollections,i as mediaCollections,a as minimalCollections,T as templateCollections}from'./chunk-ZELCS7IC.js';export{a as kyro}from'./chunk-LZ6YFYQM.js';export{a as ConfigValidationError,p as Kyro,r as LocalAdapter,l as Registry,h as collectionToCreateZod,i as collectionToUpdateZod,j as collectionToWhereZod,g as collectionToZod,q as createKyro,s as createLocalAdapter,o as createRegistry,f as fieldToZod,m as getRegistry,k as globalToZod,n as resetRegistry,b as validateCollection,e as validateConfig,d as validateFields,c as validateGlobal}from'./chunk-FS7GL2BR.js';export{d as autoBootstrap,a as bootstrapAdmin,e as bootstrapWithRetry,c as getBootstrapFromEnv}from'./chunk-FO3HLBC7.js';import'./chunk-NZ35PV5R.js';export{a as CSSGenerator,g as createAdminStyling,d as defaultDarkTheme,h as defaultFieldStyling,c as defaultLightTheme,e as ecommerce2026Theme,f as generateCSSVariables,b as generateTailwindConfig}from'./chunk-UHFDH3PG.js';export{p as ALL_FIELD_TYPES,m as COMPLEX_FIELD_TYPES,o as LAYOUT_FIELD_TYPES,l as PRIMITIVE_FIELD_TYPES,n as RELATIONAL_FIELD_TYPES,d as isArrayField,f as isBlocksField,e as isGroupField,h as isImageField,k as isLayoutField,b as isNumberField,c as isRelationshipField,i as isRichTextField,j as isSelectField,a as isTextField,g as isUploadField,s as normalizeRichTextValue,t as renderRichText,r as richTextStyles}from'./chunk-NGBJKZMT.js';export{a as createContext,g as createCountProcedure,d as createCreateProcedure,f as createDeleteProcedure,h as createDynamicRouter,c as createFindByIDProcedure,b as createFindProcedure,i as createKyroServer,e as createUpdateProcedure}from'./chunk-7N6NKCRT.js';export{I as buildGraphQLSchema,J as createGraphQLSchema}from'./chunk-LRGAPGG3.js';import {l,n,m,p as p$1,q}from'./chunk-URCLFIME.js';export{n as AuditLogger,p as InMemoryAuditLogger,m as InMemoryRateLimiter,r as MediaService,o as createAuditContext,s as createHonoApp,e as createLocalStorage,t as createRESTAPI,i as getAppSecret,j as getEncryptionKey,k as getSessionConfig,h as loadSecrets,d as resolveProvider,g as setDbAdapter}from'./chunk-URCLFIME.js';import {b as b$1,c}from'./chunk-7WOX27LK.js';export{a as ConfigService,b as EmailTransport,c as PasswordPolicy}from'./chunk-7WOX27LK.js';import'./chunk-K6WUOU6P.js';import'./chunk-AE6GXUT7.js';import {a as a$1}from'./chunk-2W4FK6CJ.js';export{a as SQLiteAuthAdapter}from'./chunk-2W4FK6CJ.js';import'./chunk-NRLIGDYF.js';export{d as ALL_WEBHOOK_EVENTS,e as WEBHOOK_COLLECTION,f as WEBHOOK_DELIVERY_COLLECTION,c as WEBHOOK_EVENTS,m as WebhookService,k as buildDeliveryRecord,l as createTestPayload,n as createWebhookService,i as deliverWebhook,j as deliverWithRetry,h as generateWebhookSecret,g as signPayload}from'./chunk-UVTS2IWM.js';export{a as evaluateAccess,c as getWhereClause,b as mergeWhereClauses}from'./chunk-HLSB2MCK.js';export{b as KyroPubSub,c as KyroWSServer,a as PubSub,d as createWSServer}from'./chunk-SL3LZQCF.js';import'./chunk-PP5S2UBV.js';export{c as DrizzleAdapter,b as collectionToDrizzleSchema,f as createDatabase,d as createDrizzleAdapter,a as fieldToDrizzleType,g as runMigrations,h as seedDefaultRoles}from'./chunk-CDL7ARXT.js';import {a as a$2}from'./chunk-RHCWCG3O.js';export{a as PostgresAuthAdapter}from'./chunk-RHCWCG3O.js';import'./chunk-OG7CNQGU.js';import'./chunk-QRXDCV6K.js';export{a as MongoDBAdapter,b as createMongoDBAdapter}from'./chunk-G6A7OSIG.js';import {a}from'./chunk-P7CESLDJ.js';export{a as MongoDBAuthAdapter}from'./chunk-P7CESLDJ.js';export{a as AbstractBaseAdapter}from'./chunk-ZAQOSRP6.js';import'./chunk-KDNYHLD2.js';import'./chunk-DGJUBN33.js';import q$1,{randomBytes}from'crypto';import {readFileSync}from'fs';import Me,{join,resolve}from'path';export{z}from'zod';import {createStorage}from'unstorage';import $r from'unstorage/drivers/indexedb';import zr from'unstorage/drivers/fs';async function Ie(s,e){let t=e.data;for(let r of s){let o=await r({...e,data:t});o!==void 0&&(t=o);}return t}async function br(s,e){return Ie(s,e)}var b=class{name;version;description;hooks={};collections=[];globals=[];fields=[];extensions={collections:[],globals:[]};adminComponents={};adminStyles=[];serverMiddleware;clientMiddleware;constructor(e){this.name=e;}async init(e){}async beforeInit(e){}async afterInit(e){}getCollections(){return this.collections}getGlobals(){return this.globals}getHooks(){return this.hooks}},$=class{plugins=new Map;hooks=new Map;register(e){if(this.plugins.has(e.name))throw new Error(`Plugin "${e.name}" is already registered`);this.plugins.set(e.name,e);let t=e.getHooks?.()||{};for(let[r,o]of Object.entries(t))if(Array.isArray(o))for(let i of o)this.registerHook(r,i);}unregister(e){let t=this.plugins.get(e);if(!t)return;let r=t.getHooks?.()||{};for(let[o,i]of Object.entries(r))if(Array.isArray(i))for(let n of i)this.unregisterHook(o,n);this.plugins.delete(e);}get(e){return this.plugins.get(e)}getAll(){return Array.from(this.plugins.values())}has(e){return this.plugins.has(e)}registerHook(e,t){this.hooks.has(e)||this.hooks.set(e,[]),this.hooks.get(e).push(t);}unregisterHook(e,t){let r=this.hooks.get(e);if(r){let o=r.indexOf(t);o>-1&&r.splice(o,1);}}async executeHook(e,t){let r=this.hooks.get(e)||[],o=t;for(let i of r)try{let n=await i({...t,data:o});n!==void 0&&(o=n);}catch(n){console.error(`[PluginManager] Error in hook "${e}":`,n);}return o}getAllCollections(){let e=[];for(let t of this.plugins.values()){let r=t.getCollections?.()||[];e.push(...r);}return e}getAllGlobals(){let e=[];for(let t of this.plugins.values()){let r=t.getGlobals?.()||[];e.push(...r);}return e}getAllFields(){let e=[];for(let t of this.plugins.values())e.push(...t.fields);return e}getAdminComponents(){let e={};for(let t of this.plugins.values())Object.assign(e,t.adminComponents);return e}getAdminStyles(){let e=[];for(let t of this.plugins.values())e.push(...t.adminStyles);return e}},L=class extends b{constructor(){super("seo"),this.description="Advanced SEO features including sitemaps, robots.txt, and structured data",this.collections.push({slug:"seo-settings",label:"SEO Settings",fields:[{name:"sitemap",type:"checkbox",label:"Enable Sitemap",defaultValue:true},{name:"robotsTxt",type:"richtext",label:"robots.txt Content"},{name:"canonicalUrl",type:"text",variant:"url",label:"Canonical URL"},{name:"ogImage",type:"text",label:"Default OG Image URL"}]});}},E=class extends b{constructor(){super("analytics"),this.description="Analytics integration for tracking page views and events",this.collections.push({slug:"analytics-events",label:"Analytics Events",fields:[{name:"name",type:"text",required:true},{name:"properties",type:"json",label:"Event Properties"},{name:"timestamp",type:"date",required:true},{name:"userId",type:"text",label:"User ID"},{name:"sessionId",type:"text",label:"Session ID"}]}),this.adminComponents.AnalyticsDashboard={};}},U=class extends b{constructor(){super("comments"),this.description="Commenting system for products and posts",this.collections.push({slug:"comments",label:"Comments",fields:[{name:"content",type:"richtext",required:true},{name:"author",type:"text",required:true},{name:"email",type:"email"},{name:"approved",type:"checkbox",defaultValue:false},{name:"parent",type:"text",label:"Parent Comment ID"},{name:"resourceType",type:"text",required:true},{name:"resourceId",type:"text",required:true}]}),this.adminComponents.CommentModeration={};}},V=class extends b{constructor(){super("reviews"),this.description="Product reviews and ratings",this.collections.push({slug:"reviews",label:"Reviews",fields:[{name:"rating",type:"number",required:true,min:1,max:5},{name:"title",type:"text"},{name:"content",type:"richtext",required:true},{name:"author",type:"relationship",relationTo:"customers"},{name:"product",type:"relationship",relationTo:"products",required:true},{name:"approved",type:"checkbox",defaultValue:false},{name:"verified",type:"checkbox",label:"Verified Purchase"},{name:"helpful",type:"number",label:"Helpful Count",defaultValue:0}]}),this.adminComponents.ReviewModeration={};}},O=class extends b{constructor(){super("wishlist"),this.description="Customer wishlists",this.collections.push({slug:"wishlists",label:"Wishlists",fields:[{name:"customer",type:"relationship",relationTo:"customers",required:true},{name:"name",type:"text",label:"Wishlist Name",defaultValue:"My Wishlist"},{name:"items",type:"blocks",label:"Items",blocks:[{slug:"wishlist-item",label:"Item",fields:[{name:"product",type:"relationship",relationTo:"products"},{name:"quantity",type:"number",defaultValue:1},{name:"addedAt",type:"date"},{name:"priority",type:"select",options:[{label:"Low",value:"low"},{label:"Medium",value:"medium"},{label:"High",value:"high"}]}]}]}]});}},Ar={SEO:L,Analytics:E,Comments:U,Reviews:V,Wishlist:O};var wr={maxAttempts:5,lockDuration:9e5,notifyUser:true,notifyAdmin:true,adminNotifyAfter:3},x=class{redis;prefix;config;constructor(e,t={},r="kyro:lockout:"){this.redis=e,this.prefix=r,this.config={...wr,...t};}lockKey(e){return `${this.prefix}${e}`}historyKey(e){return `${this.prefix}${e}:history`}async checkLockout(e){let t=this.lockKey(e),r=await this.redis.hgetall(t);if(!r||Object.keys(r).length===0)return {locked:false,attemptsRemaining:this.config.maxAttempts,totalAttempts:0};let o=parseInt(r.attempts,10),i=r.lockedUntil?new Date(parseInt(r.lockedUntil,10)):void 0;return i&&i>new Date?{locked:true,attemptsRemaining:0,lockedUntil:i,totalAttempts:o}:i&&i<=new Date?(await this.unlockAccount(e),{locked:false,attemptsRemaining:this.config.maxAttempts,totalAttempts:0}):{locked:false,attemptsRemaining:Math.max(0,this.config.maxAttempts-o),totalAttempts:o}}async recordFailedAttempt(e){let t=this.lockKey(e),r=this.historyKey(e),o=Date.now(),i=await this.redis.hincrby(t,"attempts",1);if(await this.redis.hset(t,"lastAttempt",o.toString()),await this.redis.lpush(r,o.toString()),await this.redis.ltrim(r,0,99),i>=this.config.maxAttempts){let n=new Date(o+this.config.lockDuration);return await this.redis.hset(t,{lockedAt:o.toString(),lockedUntil:n.getTime().toString()}),await this.redis.expire(t,Math.ceil(this.config.lockDuration/1e3)+3600),{locked:true,attemptsRemaining:0,lockedUntil:n,totalAttempts:i}}return {locked:false,attemptsRemaining:Math.max(0,this.config.maxAttempts-i),totalAttempts:i}}async lockAccount(e,t){let r=this.lockKey(e),o=Date.now(),i=t||this.config.lockDuration,n=new Date(o+i),a=this.redis.pipeline();a.hset(r,{attempts:this.config.maxAttempts.toString(),lockedAt:o.toString(),lockedUntil:n.getTime().toString()}),a.expire(r,Math.ceil(i/1e3)+3600),await a.exec();}async unlockAccount(e){let t=this.lockKey(e);await this.redis.del(t);}async resetAttempts(e){let t=this.lockKey(e);(await this.redis.hgetall(t)).lockedAt?await this.redis.hset(t,{attempts:"0",lockedAt:"",lockedUntil:""}):await this.redis.del(t);}async getLockoutHistory(e,t=10){let r=this.historyKey(e);return (await this.redis.lrange(r,0,t-1)).map(i=>new Date(parseInt(i,10)))}async getLockoutStats(e){let t=this.historyKey(e),r=await this.redis.lrange(t,0,-1),o=r.filter((n,a)=>(a+1)%this.config.maxAttempts===0).length,i=await this.redis.hget(this.lockKey(e),"lockedAt");return {totalFailedAttempts:r.length,lockoutCount:o,lastLockout:i?new Date(parseInt(i,10)):null,averageAttemptsBeforeLockout:o>0?this.config.maxAttempts:0}}shouldNotifyAdmin(e){return this.config.notifyAdmin&&e>=this.config.adminNotifyAfter}getConfig(){return {...this.config}}setConfig(e){this.config={...this.config,...e};}};var kr={"auth:login":{window:9e5,max:5},"auth:register":{window:36e5,max:3},"auth:forgot":{window:36e5,max:3},"auth:reset":{window:36e5,max:5},"auth:verify":{window:36e5,max:5},"api:general":{window:6e4,max:100},"api:authenticated":{window:6e4,max:200}},S=class{redis;prefix;limits;userLimits;constructor(e,t,r,o="kyro:ratelimit:"){this.redis=e,this.prefix=o,this.limits={...kr,...t},this.userLimits=r||{"user:api":{window:6e4,max:500},"user:write":{window:36e5,max:100}};}getKey(e,t){return `${this.prefix}${e}:${t}`}async check(e,t){let r=this.limits[e]||this.limits["api:general"],o=this.getKey(e,t),i=Date.now(),n=i-r.window,a=this.redis.pipeline();a.zremrangebyscore(o,0,n),a.zcard(o),a.zadd(o,i,`${i}:${Math.random()}`),a.expire(o,Math.ceil(r.window/1e3)+1);let c=(await a.exec())?.[1]?.[1]||0;if(c>=r.max){let g=await this.redis.zrange(o,0,0,"WITHSCORES"),d=g.length>1?parseInt(g[1],10)+r.window:i+r.window;return {allowed:false,remaining:0,resetAt:d,retryAfter:Math.ceil((d-i)/1e3)}}return {allowed:true,remaining:r.max-c-1,resetAt:i+r.window}}async checkUser(e,t,r){let o=this.userLimits[e]||this.userLimits["user:api"],i=this.getKey(`user:${e}:${t}`,r),n=Date.now(),a=n-o.window,l=this.redis.pipeline();l.zremrangebyscore(i,0,a),l.zcard(i),l.zadd(i,n,`${n}:${Math.random()}`),l.expire(i,Math.ceil(o.window/1e3)+1);let g=(await l.exec())?.[1]?.[1]||0;if(g>=o.max){let d=await this.redis.zrange(i,0,0,"WITHSCORES"),u=d.length>1?parseInt(d[1],10)+o.window:n+o.window;return {allowed:false,remaining:0,resetAt:u,retryAfter:Math.ceil((u-n)/1e3)}}return {allowed:true,remaining:o.max-g-1,resetAt:n+o.window}}async reset(e,t){let r=this.getKey(e,t);await this.redis.del(r);}async resetUser(e,t,r){let o=this.getKey(`user:${e}:${t}`,r);await this.redis.del(o);}async getStatus(e,t){let r=this.limits[e]||this.limits["api:general"],o=this.getKey(e,t),i=Date.now(),n=i-r.window;await this.redis.zremrangebyscore(o,0,n);let a=await this.redis.zcard(o);return {count:a,limit:r.max,remaining:Math.max(0,r.max-a),resetAt:i+r.window}}setLimit(e,t){this.limits[e]=t;}setUserLimit(e,t){this.userLimits[e]=t;}};var P=class{users=new Map;sessions=new Map;refreshTokens=new Map;emailToUserId=new Map;passwordHistory=new Map;emailVerificationTokens=new Map;passwordResetTokens=new Map;auditLogs=[];externalDb=false;constructor(){}async connect(){}async disconnect(){this.users.clear(),this.sessions.clear(),this.refreshTokens.clear(),this.emailToUserId.clear(),this.passwordHistory.clear();}async createUser(e){let t=randomBytes(16).toString("hex"),r=new Date().toISOString(),o=await this.hashPassword(e.password),i={id:t,email:e.email.toLowerCase(),passwordHash:o,role:e.role||"customer",tenantId:e.tenantId,createdAt:r,updatedAt:r};return this.users.set(t,i),this.emailToUserId.set(e.email.toLowerCase(),t),this.passwordHistory.set(t,[]),i}async findUserByEmail(e){let t=this.emailToUserId.get(e.toLowerCase());return t?this.findUserById(t):null}async findUserById(e){return this.users.get(e)||null}async updateUser(e,t){let r=await this.findUserById(e);if(!r)return null;let o={...r,...t,id:e,updatedAt:new Date().toISOString()};return t.email&&t.email!==r.email&&(this.emailToUserId.delete(r.email.toLowerCase()),this.emailToUserId.set(t.email.toLowerCase(),e)),this.users.set(e,o),o}async deleteUser(e){let t=await this.findUserById(e);return t?(this.users.delete(e),this.emailToUserId.delete(t.email.toLowerCase()),this.refreshTokens.forEach((r,o)=>{this.sessions.get(r)?.userId===e&&(this.refreshTokens.delete(o),this.sessions.delete(r));}),this.passwordHistory.delete(e),this.sessions.forEach((r,o)=>{r.userId===e&&this.sessions.delete(o);}),true):false}async hashPassword(e){return (await import('bcryptjs')).default.hash(e,12)}async verifyPassword(e,t){let r=await this.findUserByEmail(e);return !r||!r.passwordHash?null:await(await import('bcryptjs')).default.compare(t,r.passwordHash)?r:null}async createSession(e,t={}){let r=randomBytes(32).toString("hex"),o=randomBytes(32).toString("base64url"),i=randomBytes(32).toString("base64url"),n=new Date,a={id:r,userId:e,token:o,refreshToken:i,expiresAt:new Date(n.getTime()+86400*1e3).toISOString(),createdAt:n.toISOString(),ipAddress:t.ipAddress,userAgent:t.userAgent};return this.sessions.set(r,a),this.refreshTokens.set(i,r),a}async findSessionByToken(e){return this.sessions.get(e)||null}async findSessionByRefreshToken(e){let t=this.refreshTokens.get(e);return t&&this.sessions.get(t)||null}async deleteSession(e){let t=this.sessions.get(e);return t?(t.refreshToken&&this.refreshTokens.delete(t.refreshToken),this.sessions.delete(e),true):false}async deleteUserSessions(e){let t=0;return this.sessions.forEach((r,o)=>{r.userId===e&&(r.refreshToken&&this.refreshTokens.delete(r.refreshToken),this.sessions.delete(o),t++);}),t}async addPasswordToHistory(e,t){let r=this.passwordHistory.get(e)||[];r.push(t),r.length>5&&r.splice(0,r.length-5),this.passwordHistory.set(e,r);}async getPasswordHistory(e,t=5){return this.passwordHistory.get(e)||[]}async isPasswordInHistory(e,t,r=5){let o=await this.getPasswordHistory(t,r),i=(await import('bcryptjs')).default;for(let n of o)if(await i.compare(e,n))return  true;return  false}async createEmailVerificationToken(e){let t=randomBytes(32).toString("hex"),r=new Date(Date.now()+1440*60*1e3);return this.emailVerificationTokens.set(t,{userId:e,expiresAt:r}),{token:t,expiresAt:r}}async verifyEmailToken(e){let t=this.emailVerificationTokens.get(e);return !t||t.expiresAt<new Date?(this.emailVerificationTokens.delete(e),{success:false,error:"Invalid or expired token"}):(this.emailVerificationTokens.delete(e),{success:true,userId:t.userId})}async createPasswordResetToken(e){let t=await this.findUserByEmail(e);if(!t)return {token:"",expiresAt:new Date,error:"User not found"};let r=randomBytes(32).toString("hex"),o=new Date(Date.now()+3600*1e3);return this.passwordResetTokens.set(r,{userId:t.id,expiresAt:o}),{token:r,expiresAt:o}}async resetPasswordWithToken(e,t){let r=this.passwordResetTokens.get(e);if(!r||r.expiresAt<new Date)return this.passwordResetTokens.delete(e),{success:false,error:"Invalid or expired token"};let o=await this.hashPassword(t);return await this.updateUser(r.userId,{passwordHash:o}),this.passwordResetTokens.delete(e),{success:true}}async hasAnyUsers(){return this.users.size>0}async findAuditLogs(e){let{limit:t=50,offset:r=0}=e,o=this.auditLogs.slice().reverse();return e.userId&&(o=o.filter(i=>i.userId===e.userId)),e.action&&(Array.isArray(e.action)?o=o.filter(i=>e.action.includes(String(i.action))):o=o.filter(i=>i.action===e.action)),e.resource&&(o=o.filter(i=>i.resource===e.resource)),e.success!==void 0&&(o=o.filter(i=>i.success===e.success)),{logs:o.slice(r,r+t),total:o.length}}async createAuditLog(e){let t=randomBytes(16).toString("hex"),o={...e,id:t,timestamp:new Date};return this.auditLogs.push(o),o}};var C=class{storage=new Map;history=new Map;config;constructor(e={}){this.config={maxAttempts:5,lockDuration:9e5,notifyUser:true,notifyAdmin:true,adminNotifyAfter:3,...e};}async checkLockout(e){let t=Date.now(),r=this.storage.get(e);if(r&&r.lockedUntil!==null&&r.lockedUntil<=t)return await this.resetAttempts(e),{locked:false,attemptsRemaining:this.config.maxAttempts,totalAttempts:0};if(!r)return {locked:false,attemptsRemaining:this.config.maxAttempts,totalAttempts:0};let{attempts:o,lockedUntil:i}=r;return i!==null&&i>t?{locked:true,attemptsRemaining:0,lockedUntil:new Date(i),totalAttempts:o}:{locked:false,attemptsRemaining:Math.max(0,this.config.maxAttempts-o),totalAttempts:o}}async recordFailedAttempt(e){let t=Date.now(),r=this.storage.get(e)||{attempts:0,lastAttempt:null,lockedAt:null,lockedUntil:null};r.attempts+=1,r.lastAttempt=t;let o=this.history.get(e)||[];if(o.push(t),o.length>100&&o.splice(0,o.length-100),this.history.set(e,o),this.storage.set(e,r),r.attempts>=this.config.maxAttempts){let i=new Date(t+this.config.lockDuration);return r.lockedAt=t,r.lockedUntil=i.getTime(),this.storage.set(e,r),{locked:true,attemptsRemaining:0,lockedUntil:i,totalAttempts:r.attempts}}return {locked:false,attemptsRemaining:Math.max(0,this.config.maxAttempts-r.attempts),totalAttempts:r.attempts}}async lockAccount(e,t){let r=Date.now(),o=t||this.config.lockDuration,i=new Date(r+o),n=this.storage.get(e)||{attempts:0,lastAttempt:null,lockedAt:null,lockedUntil:null};n.attempts=this.config.maxAttempts,n.lockedAt=r,n.lockedUntil=i.getTime(),this.storage.set(e,n);}async unlockAccount(e){await this.resetAttempts(e);}async resetAttempts(e){let t=this.storage.get(e);t&&(t.attempts=0,t.lockedAt=null,t.lockedUntil=null,this.storage.set(e,t)),this.history.delete(e);}async getLockoutHistory(e,t=10){return (this.history.get(e)||[]).slice(-t).reverse().map(o=>new Date(o))}async getLockoutStats(e){let r=(this.history.get(e)||[]).length,o=Math.floor(r/this.config.maxAttempts),i=null,n=this.storage.get(e);n&&n.lockedAt!==null&&(i=new Date(n.lockedAt));let a=o>0?this.config.maxAttempts:0;return {totalFailedAttempts:r,lockoutCount:o,lastLockout:i,averageAttemptsBeforeLockout:a}}shouldNotifyAdmin(e){return this.config.notifyAdmin&&e>=this.config.adminNotifyAfter}getConfig(){return {...this.config}}setConfig(e){this.config={...this.config,...e};}};function h(s,e=""){return process.env[s]||e}function A(s,e=false){let t=process.env[s];return t?t.toLowerCase()==="true":e}function p(s,e=0){let t=process.env[s];return t?parseInt(t,10):e}function Le(){let s=process.env.KYRO_AUTH_DATABASE?.toLowerCase();if(s&&["sqlite","postgres","mongodb","memory"].includes(s))return s;try{let e=join(process.cwd(),"kyro.config.ts"),t=readFileSync(e,"utf8");if(t.includes("createLocalAdapter"))return "sqlite";if(t.includes("createDrizzleAdapter"))return t.includes("postgres")||t.includes("postgresql"),"postgres";if(t.includes("createMongoDBAdapter"))return "mongodb"}catch{}return "memory"}async function Pr(s){let e=process.cwd(),t=e.endsWith("admin")?join(e,".."):e,r=resolve(t,"data","auth.db");switch(s){case "sqlite":return new a$1({path:h("KYRO_AUTH_DB_PATH",r)});case "postgres":{try{let o=h("DATABASE_URL","");if(o){let{drizzle:i}=await import('drizzle-orm/postgres-js'),a=(await import('postgres')).default(o,{onnotice:()=>{}}),l=i(a);return new a$2({db:l})}}catch{console.warn("[Auth] Could not create PostgresAuthAdapter, falling back to SQLite auth adapter.");}return new a$1({path:h("KYRO_AUTH_DB_PATH",r)})}case "mongodb":{try{let o=h("MONGODB_URI","");if(o){let{MongoClient:i}=await import('mongodb'),n=new i(o);await n.connect();let l=new URL(o).pathname.replace(/^\//,"")||"kyro_cms",c=n.db(l);return new a({db:c})}}catch{console.warn("[Auth] Could not create MongoDBAuthAdapter, falling back to SQLite auth adapter.");}return new a$1({path:h("KYRO_AUTH_DB_PATH",r)})}default:return new P}}async function W(s,e){let t=A("KYRO_DISTRIBUTED",false),r;if(t){let{RedisAuthAdapter:d}=await import('./redis-adapter-AUKOV74G.js'),u=h("REDIS_URL","redis://localhost:6379"),y=A("REDIS_TLS",false),f=new d({url:u,tls:y});await f.connect?.(),r=f;}else {let d=s||Le();r=await Pr(d),r.connect&&await r.connect();}let o=e?await b$1.fromConfig(e).catch(()=>null)||b$1.fromEnv()||void 0:b$1.fromEnv()||void 0,i=new c({minLength:p("PASSWORD_MIN_LENGTH",12),requireUppercase:A("PASSWORD_REQUIRE_UPPERCASE",true),requireLowercase:A("PASSWORD_REQUIRE_LOWERCASE",true),requireNumbers:A("PASSWORD_REQUIRE_NUMBERS",true),requireSpecialChars:A("PASSWORD_REQUIRE_SPECIAL",true),preventReuse:p("PASSWORD_PREVENT_REUSE",5),maxLength:p("PASSWORD_MAX_LENGTH",128)}),n$1,a,l;if(t){let u=r.redis;n$1=new x(u,{maxAttempts:p("LOCKOUT_MAX_ATTEMPTS",5),lockDuration:p("LOCKOUT_DURATION_MINUTES",15)*60*1e3}),a=new S(u,{"auth:login":{window:p("RATE_LIMIT_AUTH_WINDOW_MS",9e5),max:p("RATE_LIMIT_AUTH_MAX_REQUESTS",10)},"api:general":{window:p("RATE_LIMIT_WINDOW_MS",6e4),max:p("RATE_LIMIT_MAX_REQUESTS",100)}}),l=new n(u,p("AUDIT_LOG_RETENTION_DAYS",30));}else n$1=new C({maxAttempts:p("LOCKOUT_MAX_ATTEMPTS",5),lockDuration:p("LOCKOUT_DURATION_MINUTES",15)*60*1e3}),a=new m({"auth:login":{window:p("RATE_LIMIT_AUTH_WINDOW_MS",9e5),max:p("RATE_LIMIT_AUTH_MAX_REQUESTS",10)},"api:general":{window:p("RATE_LIMIT_WINDOW_MS",6e4),max:p("RATE_LIMIT_MAX_REQUESTS",100)}}),l=A("AUDIT_LOG_ENABLED",true)?new p$1(p("AUDIT_LOG_RETENTION_DAYS",30)):void 0;let c$1=new q({redis:r,email:o,jwtSecret:h("APP_SECRET","change-me"),jwtExpiresIn:h("JWT_EXPIRES_IN","24h"),jwtIssuer:h("JWT_ISSUER","kyro-cms"),jwtAudience:h("JWT_AUDIENCE","kyro-cms-client"),passwordPolicy:i,lockout:n$1,rateLimiter:a,auditLogger:l,baseUrl:h("EMAIL_BASE_URL","http://localhost:4321"),emailVerificationRequired:A("EMAIL_VERIFICATION_REQUIRED",true)}),g=t?"distributed":s||Le();return {authAdapter:r,databaseType:g,email:o,passwordPolicy:i,lockout:n$1,rateLimiter:a,auditLogger:l,routes:c$1}}var Ue=W().catch(s=>(console.warn("[AuthConfig] Failed to initialize auth config:",s.message),null));var Cr=12,Tr="24h",vr="7d",H=class{adapter;config;constructor(e,t){this.adapter=e,this.config={secret:t.secret,expiresIn:t.expiresIn??Tr,refreshExpiresIn:t.refreshExpiresIn??vr,issuer:t.issuer??"kyro-cms",audience:t.audience??[],saltRounds:t.saltRounds??Cr};}async register(e){try{if(await this.adapter.findUserByEmail(e.email))return {success:!1,error:"Email already registered"};let r=await this.adapter.createUser({email:e.email,password:e.password,role:e.role??"customer",tenantId:e.tenantId});return this.createSessionForUser(r)}catch(t){return {success:false,error:String(t)}}}async login(e){try{let t=await this.adapter.verifyPassword(e.email,e.password);return t?this.createSessionForUser(t):{success:!1,error:"Invalid credentials"}}catch(t){return {success:false,error:String(t)}}}async logout(e){await this.adapter.deleteSession(e);}async refreshToken(e){try{let t=await this.adapter.findSessionByToken(e);if(!t||new Date(t.expiresAt)<new Date)return {success:!1,error:"Invalid or expired refresh token"};let r=await this.adapter.findUserById(t.userId);return r?(await this.adapter.deleteSession(e),this.createSessionForUser(r)):{success:!1,error:"User not found"}}catch(t){return {success:false,error:String(t)}}}async verifyToken(e){try{let{default:t}=await import('jsonwebtoken');return t.verify(e,this.config.secret,{issuer:this.config.issuer,audience:this.config.audience.length>0?this.config.audience[0]:void 0})}catch{return null}}async getUserFromToken(e){let t=await this.verifyToken(e);return t?this.adapter.findUserById(t.sub):null}async changePassword(e,t,r){try{let o=await this.adapter.findUserById(e);return o?await this.adapter.verifyPassword(o.email,t)?(await this.adapter.updateUser(e,{password:r}),await this.adapter.deleteUserSessions(e),{success:!0,user:o}):{success:!1,error:"Current password is incorrect"}:{success:!1,error:"User not found"}}catch(o){return {success:false,error:String(o)}}}async resetPassword(e,t){try{let r=await this.adapter.findUserByEmail(e);return r?(await this.adapter.updateUser(r.id,{password:t}),await this.adapter.deleteUserSessions(r.id),{success:!0,user:r}):{success:!1,error:"User not found"}}catch(r){return {success:false,error:String(r)}}}async sendEmailVerification(e){try{let{token:t,expiresAt:r}=await this.adapter.createEmailVerificationToken(e);return {success:!0}}catch(t){return {success:false,error:String(t)}}}async verifyEmail(e){try{return await this.adapter.verifyEmailToken(e)}catch(t){return {success:false,error:String(t)}}}async requestPasswordReset(e){try{let t=await this.adapter.createPasswordResetToken(e);return t.error?{success:!1,error:t.error}:{success:!0}}catch(t){return {success:false,error:String(t)}}}async resetPasswordWithToken(e,t){try{return await this.adapter.resetPasswordWithToken(e,t)}catch(r){return {success:false,error:String(r)}}}async deleteAccount(e){try{return await this.adapter.findUserById(e)?(await this.adapter.deleteUserSessions(e),await this.adapter.deleteUser(e),{success:!0}):{success:!1,error:"User not found"}}catch(t){return {success:false,error:String(t)}}}async createSessionForUser(e){let t=await this.generateToken(e),r=await this.adapter.createSession(e.id);return {success:true,user:e,session:r,token:t}}async generateToken(e){let{default:t}=await import('jsonwebtoken'),r={sub:e.id,email:e.email,role:e.role,tenantId:e.tenantId},o={expiresIn:this.parseExpiresIn(this.config.expiresIn)/1e3,issuer:this.config.issuer};return this.config.audience.length>0&&(o.audience=this.config.audience[0]),t.sign(r,this.config.secret,o)}async hashPassword(e){let{default:t}=await import('bcryptjs');return t.hash(e,this.config.saltRounds)}parseExpiresIn(e){if(typeof e=="number")return e;let t=e.match(/^(\d+)([smhd])$/);if(!t)return 864e5;let r=parseInt(t[1],10);switch(t[2]){case "s":return r*1e3;case "m":return r*6e4;case "h":return r*36e5;case "d":return r*864e5;default:return 864e5}}};function Rr(s,e){return new H(s,e)}function _(){return {enabled:true,draftsEnabled:true,publishEnabled:true,scheduleEnabled:false,versioningEnabled:true,maxVersionsPerDocument:50,autoPublish:false,requirePublishPermission:true}}var M=class{adapter;config;constructor(e,t){this.adapter=e,this.config={..._(),...t};}async createVersion(e){let r=((await this.adapter.getLatestVersion(e.collection,e.documentId))?.version??0)+1,o={...e,version:r},i=await this.adapter.createVersion(o);return this.config.maxVersionsPerDocument>0&&await this.pruneOldVersions(e.collection,e.documentId),i}async publishVersion(e){let t=await this.adapter.getVersion(e.collection,e.versionId);if(!t)throw new Error("Version not found");if(t.status==="published")throw new Error("Version is already published");await this.adapter.publishVersion(e);}async unpublishDocument(e,t){let r=await this.adapter.getVersions({collection:e,documentId:t,limit:1e3});for(let o of r)if(o.status==="published"){await this.createVersion({collection:e,documentId:t,data:o.data,status:"draft",createdBy:"system",changeDescription:"Unpublished document"});break}}async revertToVersion(e,t,r,o){if(!await this.adapter.getVersion(e,r))throw new Error("Version not found");return await this.adapter.revertToVersion({collection:e,documentId:t,versionId:r,userId:o})}async getVersionHistory(e,t,r=20,o=0){return this.adapter.getVersions({collection:e,documentId:t,limit:r,offset:o})}async compareTwoVersions(e,t,r,o){return this.adapter.compareVersions({collection:e,documentId:t,versionA:r,versionB:o})}async getLatestDraft(e,t){return this.adapter.getLatestVersion(e,t)}async getPublishedVersion(e,t){return this.adapter.getPublishedVersion(e,t)}async getVersion(e,t){return this.adapter.getVersion(e,t)}async schedulePublish(e,t,r,o){if(!this.config.scheduleEnabled)throw new Error("Scheduled publishing is not enabled");if(!await this.adapter.getVersion(e,r))throw new Error("Version not found")}async deleteVersionHistory(e,t){await this.adapter.deleteVersions(e,t);}async pruneOldVersions(e,t){let r=await this.adapter.getVersions({collection:e,documentId:t,limit:this.config.maxVersionsPerDocument+100});if(r.length<=this.config.maxVersionsPerDocument)return;r.slice(0,this.config.maxVersionsPerDocument);let i=r.slice(this.config.maxVersionsPerDocument);for(let n of i)if(n.status!=="published"){await this.adapter.deleteVersions(e,t);break}}};function Dr(s,e){return new M(s,e)}function Ir(s){return s==="published"}function Lr(s){return s==="draft"}function Er(s){return s==="archived"}function Ur(s){return s?Array.isArray(s)?s:Object.values(s):[]}function Vr(s){return s?Array.isArray(s)?s:Object.values(s):[]}function Ve(s){return {collections:Ur(s.collections),globals:Vr(s.globals),adapter:s.adapter,plugins:s.plugins,auth:s.auth,cors:s.cors,admin:s.admin,upload:s.upload,graphQL:s.graphQL,typescript:s.typescript,localization:s.localization,rateLimit:s.rateLimit,debug:s.debug}}var Or=Ve;function Hr(s){let{siteSettings:e,seoSettings:t,title:r,description:o,image:i,url:n}=s;if(!e)return "";let a=e.siteName||"",l=r||t?.defaultTitle||a,c=t?.titleTemplate,g=t?.separator||" | ",d=t?.siteNameInTitle!==false,u=c?c.replace(/\{\{title\}\}/g,l).replace(/\{\{siteName\}\}/g,d?a:"").replace(/\{\{separator\}\}/g,g).replace(/\s+/g," ").trim():l,y=o||t?.defaultDescription||e.siteDescription||"",f=i||e.siteOgImage?.url||"",F=n||e.siteUrl||"",m=`
+    <title>${u}</title>
+    <meta name="description" content="${y}">
+  `;e.siteFavicon?.url&&(m+=`
+    <link rel="icon" type="${e.siteFavicon.mimeType||"image/x-icon"}" href="${e.siteFavicon.url}">`);let X=t?.meta?.robots;X&&(m+=`
+    <meta name="robots" content="${X}">`);let J=t?.meta?.canonicalUrl||F;J&&(m+=`
+    <link rel="canonical" href="${J}">`);let Be=t?.meta?.ogType||"website";m+=`
+    <meta property="og:type" content="${Be}">
+    <meta property="og:title" content="${u}">
+    <meta property="og:description" content="${y}">
+    <meta property="og:site_name" content="${a}">
+  `,F&&(m+=`
+    <meta property="og:url" content="${F}">`),f&&(m+=`
+    <meta property="og:image" content="${f}">`),t?.social?.fbAppId&&(m+=`
+    <meta property="fb:app_id" content="${t.social.fbAppId}">`);let Ne=t?.social?.twitterCardType||"summary_large_image";return m+=`
+    <meta name="twitter:card" content="${Ne}">
+    <meta name="twitter:title" content="${u}">
+    <meta name="twitter:description" content="${y}">
+  `,t?.social?.twitterHandle&&(m+=`
+    <meta name="twitter:site" content="${t.social.twitterHandle}">`),f&&(m+=`
+    <meta name="twitter:image" content="${f}">`),e.enableI18n&&e.i18n?.language&&(m+=`
+    <meta http-equiv="content-language" content="${e.i18n.language}">`),m}function _r(s){if(!s||!s.analyticsEnabled||!s.analytics)return "";let{googleAnalyticsId:e,googleTagManagerId:t,plausibleDomain:r}=s.analytics,o="";return e&&(o+=`
       <!-- Google Analytics -->
-      <script async src="https://www.googletagmanager.com/gtag/js?id=${googleAnalyticsId}"></script>
+      <script async src="https://www.googletagmanager.com/gtag/js?id=${e}"></script>
       <script>
         window.dataLayer = window.dataLayer || [];
         function gtag(){dataLayer.push(arguments);}
         gtag('js', new Date());
-        gtag('config', '${googleAnalyticsId}');
+        gtag('config', '${e}');
       </script>
-    `;
-  }
-  if (googleTagManagerId) {
-    scripts += `
+    `),t&&(o+=`
       <!-- Google Tag Manager -->
       <script>
         (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
         new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
         j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
         'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
-        })(window,document,'script','dataLayer','${googleTagManagerId}');
+        })(window,document,'script','dataLayer','${t}');
       </script>
-    `;
-  }
-  if (plausibleDomain) {
-    scripts += `
+    `),r&&(o+=`
       <!-- Plausible Analytics -->
-      <script defer data-domain="${plausibleDomain}" src="https://plausible.io/js/script.js"></script>
-    `;
-  }
-  return scripts;
-}
-
-// src/lib/social.ts
-var PLATFORM_META = {
-  facebook: { label: "Facebook" },
-  twitter: { label: "Twitter / X" },
-  instagram: { label: "Instagram" },
-  linkedin: { label: "LinkedIn" },
-  youtube: { label: "YouTube" },
-  tiktok: { label: "TikTok" },
-  pinterest: { label: "Pinterest" },
-  discord: { label: "Discord" },
-  twitch: { label: "Twitch" },
-  github: { label: "GitHub" },
-  mastodon: { label: "Mastodon" }
-};
-var ALL_PLATFORMS = [
-  "facebook",
-  "twitter",
-  "instagram",
-  "linkedin",
-  "youtube",
-  "tiktok",
-  "pinterest",
-  "discord",
-  "twitch",
-  "github",
-  "mastodon"
-];
-function getSocialLinksFromSettings(socialSettings) {
-  if (!socialSettings) return [];
-  const showAll = socialSettings.showAll === true;
-  const links = [];
-  for (const platform of ALL_PLATFORMS) {
-    const url = socialSettings[platform];
-    if (!url) continue;
-    const isNiche = ["tiktok", "pinterest", "discord", "twitch", "github", "mastodon"].includes(platform);
-    if (isNiche && !showAll) continue;
-    const meta = PLATFORM_META[platform];
-    links.push({
-      platform,
-      url,
-      label: meta?.label || platform
-    });
-  }
-  return links;
-}
-async function getSocialLinks(db, options) {
-  try {
-    const doc = await db.findOne({
-      collection: "_globals_social-settings",
-      where: {},
-      draft: options?.draft ?? false
-    });
-    return getSocialLinksFromSettings(doc);
-  } catch {
-    return [];
-  }
-}
-
-// src/lib/store.ts
-function getStoreConfigFromSettings(settings) {
-  if (!settings) return {};
-  return {
-    storeName: settings.storeName,
-    storeEmail: settings.storeEmail,
-    storePhone: settings.storePhone,
-    address: settings.address,
-    currency: settings.currency,
-    tax: settings.tax,
-    shipping: settings.shipping,
-    orders: settings.orders
-  };
-}
-async function getStoreConfig(db, options) {
-  try {
-    const doc = await db.findOne({
-      collection: "_globals_store-settings",
-      where: {},
-      draft: options?.draft ?? false
-    });
-    return getStoreConfigFromSettings(doc);
-  } catch {
-    return {};
-  }
-}
-
-// src/lib/payment.ts
-function getPaymentConfigFromSettings(settings) {
-  if (!settings) return {};
-  return {
-    testMode: settings.testMode,
-    provider: settings.provider,
-    stripe: settings.stripe,
-    paypal: settings.paypal,
-    square: settings.square,
-    methods: settings.methods,
-    bankTransfer: settings.bankTransfer
-  };
-}
-async function getPaymentConfig(db, options) {
-  try {
-    const doc = await db.findOne({
-      collection: "_globals_payment-settings",
-      where: {},
-      draft: options?.draft ?? false
-    });
-    return getPaymentConfigFromSettings(doc);
-  } catch {
-    return {};
-  }
-}
-async function createBrowserStorage(options = {}) {
-  const { namespace = "kyro", ttl } = options;
-  const store = createStorage({
-    driver: indexedbDriver({
-      dbName: "kyro-cms",
-      storeName: namespace
-    })
-  });
-  const prefix = namespace ? `${namespace}:` : "";
-  const storage = {
-    getItem: async (name) => {
-      const key = `${prefix}${name}`;
-      const raw = await store.getItem(key);
-      if (raw == null) return null;
-      try {
-        const parsed = JSON.parse(raw);
-        if (parsed.expiry && Date.now() > parsed.expiry) {
-          await store.removeItem(key);
-          return null;
-        }
-        return parsed.value;
-      } catch {
-        return raw;
-      }
-    },
-    setItem: async (name, value) => {
-      const key = `${prefix}${name}`;
-      const data = JSON.stringify(
-        ttl ? { value, expiry: Date.now() + ttl } : { value }
-      );
-      await store.setItem(key, data);
-    },
-    removeItem: async (name) => {
-      await store.removeItem(`${prefix}${name}`);
-    }
-  };
-  return {
-    storage,
-    cleanup: async () => {
-      await store.dispose?.();
-    }
-  };
-}
-function getEncryptionKey2(secret) {
-  const appSecret = secret || process.env.APP_SECRET || process.env.AUTH_SECRET || "development-secret-key";
-  return crypto2.createHash("sha256").update(appSecret).digest("hex");
-}
-function encrypt(text, key) {
-  const iv = crypto2.randomBytes(16);
-  const cipher = crypto2.createCipheriv("aes-256-gcm", Buffer.from(key, "hex").subarray(0, 32), iv);
-  let encrypted = cipher.update(text, "utf8", "hex");
-  encrypted += cipher.final("hex");
-  const authTag = cipher.getAuthTag().toString("hex");
-  return `${iv.toString("hex")}:${authTag}:${encrypted}`;
-}
-function decrypt(encryptedText, key) {
-  const [ivHex, authTagHex, encrypted] = encryptedText.split(":");
-  const iv = Buffer.from(ivHex, "hex");
-  const authTag = Buffer.from(authTagHex, "hex");
-  const decipher = crypto2.createDecipheriv("aes-256-gcm", Buffer.from(key, "hex").subarray(0, 32), iv);
-  decipher.setAuthTag(authTag);
-  let decrypted = decipher.update(encrypted, "hex", "utf8");
-  decrypted += decipher.final("utf8");
-  return decrypted;
-}
-async function createNodeStorage(options = {}) {
-  const {
-    namespace = "kyro",
-    ttl,
-    encryption = true,
-    secret,
-    basePath
-  } = options;
-  const defaultPath = basePath ? path.join(basePath, ".astro", "kyro.json") : path.join(process.cwd(), ".astro", "kyro.json");
-  const store = createStorage({
-    driver: fsDriver({ base: defaultPath })
-  });
-  const encKey = encryption ? getEncryptionKey2(secret) : null;
-  const prefix = namespace ? `${namespace}:` : "";
-  return {
-    storage: {
-      getItem: async (name) => {
-        const key = `${prefix}${name}`;
-        const raw = await store.getItem(key);
-        if (raw == null) return null;
-        try {
-          const data = encKey ? decrypt(raw, encKey) : raw;
-          const parsed = JSON.parse(data);
-          if (parsed.expiry && Date.now() > parsed.expiry) {
-            await store.removeItem(key);
-            return null;
-          }
-          return parsed.value;
-        } catch {
-          return raw;
-        }
-      },
-      setItem: async (name, value) => {
-        const key = `${prefix}${name}`;
-        const data = JSON.stringify(
-          ttl ? { value, expiry: Date.now() + ttl } : { value }
-        );
-        await store.setItem(key, encKey ? encrypt(data, encKey) : data);
-      },
-      removeItem: async (name) => {
-        await store.removeItem(`${prefix}${name}`);
-      }
-    },
-    cleanup: async () => {
-      await store.dispose?.();
-    }
-  };
-}
-
-// src/lib/storage/factory.ts
-async function createStorage3(config) {
-  const { environment, adapter, connectionString, encryption } = config;
-  const secret = process.env.APP_SECRET || process.env.AUTH_SECRET;
-  const encryptionOptions = {
-    enabled: encryption?.enabled ?? true,
-    algorithm: encryption?.algorithm
-  };
-  if (environment === "browser") {
-    return createBrowserStorage({
-      namespace: "kyro"
-    });
-  }
-  return createNodeStorage({
-    namespace: "kyro",
-    encryption: encryptionOptions.enabled,
-    secret
-  });
-}
-async function createAuthStorage(config) {
-  const storageConfig = {
-    ...config,
-    encryption: {
-      enabled: true,
-      algorithm: config.encryption?.algorithm
-    }
-  };
-  return createStorage3(storageConfig);
-}
-
-// src/index.ts
-init_secret();
-
-export { AccountLockout, AnalyticsPlugin, Auth, CommentsPlugin, InMemoryAccountLockout, InMemoryAuthAdapter, KyroPlugin, PluginManager, RateLimiter, ReviewsPlugin, SEOPLugin, VersionManager, WishlistPlugin, authConfig, createAuth, createAuthConfig, createAuthStorage, createStorage3 as createStorage, createVersionManager, defineConfig, defineKyroConfig, generateAnalyticsTags, generateSeoTags, getDefaultDraftPublishConfig, getPaymentConfig, getPaymentConfigFromSettings, getSocialLinks, getSocialLinksFromSettings, getStoreConfig, getStoreConfigFromSettings, isArchived, isDraft, isPublished, presetPlugins, runFieldHooks, runHooks };
-//# sourceMappingURL=index.js.map
-//# sourceMappingURL=index.js.map
+      <script defer data-domain="${r}" src="https://plausible.io/js/script.js"></script>
+    `),o}var Mr={facebook:{label:"Facebook"},twitter:{label:"Twitter / X"},instagram:{label:"Instagram"},linkedin:{label:"LinkedIn"},youtube:{label:"YouTube"},tiktok:{label:"TikTok"},pinterest:{label:"Pinterest"},discord:{label:"Discord"},twitch:{label:"Twitch"},github:{label:"GitHub"},mastodon:{label:"Mastodon"}},Fr=["facebook","twitter","instagram","linkedin","youtube","tiktok","pinterest","discord","twitch","github","mastodon"];function Oe(s){if(!s)return [];let e=s.showAll===true,t=[];for(let r of Fr){let o=s[r];if(!o||["tiktok","pinterest","discord","twitch","github","mastodon"].includes(r)&&!e)continue;let n=Mr[r];t.push({platform:r,url:o,label:n?.label||r});}return t}async function Br(s,e){try{let t=await s.findOne({collection:"_globals_social-settings",where:{},draft:e?.draft??!1});return Oe(t)}catch{return []}}function He(s){return s?{storeName:s.storeName,storeEmail:s.storeEmail,storePhone:s.storePhone,address:s.address,currency:s.currency,tax:s.tax,shipping:s.shipping,orders:s.orders}:{}}async function Nr(s,e){try{let t=await s.findOne({collection:"_globals_store-settings",where:{},draft:e?.draft??!1});return He(t)}catch{return {}}}function _e(s){return s?{testMode:s.testMode,provider:s.provider,stripe:s.stripe,paypal:s.paypal,square:s.square,methods:s.methods,bankTransfer:s.bankTransfer}:{}}async function Kr(s,e){try{let t=await s.findOne({collection:"_globals_payment-settings",where:{},draft:e?.draft??!1});return _e(t)}catch{return {}}}async function G(s={}){let{namespace:e="kyro",ttl:t}=s,r=createStorage({driver:$r({dbName:"kyro-cms",storeName:e})}),o=e?`${e}:`:"";return {storage:{getItem:async n=>{let a=`${o}${n}`,l=await r.getItem(a);if(l==null)return null;try{let c=JSON.parse(l);return c.expiry&&Date.now()>c.expiry?(await r.removeItem(a),null):c.value}catch{return l}},setItem:async(n,a)=>{let l=`${o}${n}`,c=JSON.stringify(t?{value:a,expiry:Date.now()+t}:{value:a});await r.setItem(l,c);},removeItem:async n=>{await r.removeItem(`${o}${n}`);}},cleanup:async()=>{await r.dispose?.();}}}function z(s){let e=s||process.env.APP_SECRET||process.env.AUTH_SECRET||"development-secret-key";return q$1.createHash("sha256").update(e).digest("hex")}function qr(s,e){let t=q$1.randomBytes(16),r=q$1.createCipheriv("aes-256-gcm",Buffer.from(e,"hex").subarray(0,32),t),o=r.update(s,"utf8","hex");o+=r.final("hex");let i=r.getAuthTag().toString("hex");return `${t.toString("hex")}:${i}:${o}`}function Qr(s,e){let[t,r,o]=s.split(":"),i=Buffer.from(t,"hex"),n=Buffer.from(r,"hex"),a=q$1.createDecipheriv("aes-256-gcm",Buffer.from(e,"hex").subarray(0,32),i);a.setAuthTag(n);let l=a.update(o,"hex","utf8");return l+=a.final("utf8"),l}async function Q(s={}){let{namespace:e="kyro",ttl:t,encryption:r=true,secret:o,basePath:i}=s,n=i?Me.join(i,".astro","kyro.json"):Me.join(process.cwd(),".astro","kyro.json"),a=createStorage({driver:zr({base:n})}),l=r?z(o):null,c=e?`${e}:`:"";return {storage:{getItem:async g=>{let d=`${c}${g}`,u=await a.getItem(d);if(u==null)return null;try{let y=l?Qr(u,l):u,f=JSON.parse(y);return f.expiry&&Date.now()>f.expiry?(await a.removeItem(d),null):f.value}catch{return u}},setItem:async(g,d)=>{let u=`${c}${g}`,y=JSON.stringify(t?{value:d,expiry:Date.now()+t}:{value:d});await a.setItem(u,l?qr(y,l):y);},removeItem:async g=>{await a.removeItem(`${c}${g}`);}},cleanup:async()=>{await a.dispose?.();}}}async function Y(s){let{environment:e,adapter:t,connectionString:r,encryption:o}=s,i=process.env.APP_SECRET||process.env.AUTH_SECRET,n={enabled:o?.enabled??true,algorithm:o?.algorithm};return e==="browser"?G({namespace:"kyro"}):Q({namespace:"kyro",encryption:n.enabled,secret:i})}async function Fe(s){let e={...s,encryption:{enabled:true,algorithm:s.encryption?.algorithm}};return Y(e)}l();export{x as AccountLockout,E as AnalyticsPlugin,H as Auth,U as CommentsPlugin,C as InMemoryAccountLockout,P as InMemoryAuthAdapter,b as KyroPlugin,$ as PluginManager,S as RateLimiter,V as ReviewsPlugin,L as SEOPLugin,M as VersionManager,O as WishlistPlugin,Ue as authConfig,Rr as createAuth,W as createAuthConfig,Fe as createAuthStorage,Y as createStorage,Dr as createVersionManager,Ve as defineConfig,Or as defineKyroConfig,_r as generateAnalyticsTags,Hr as generateSeoTags,_ as getDefaultDraftPublishConfig,Kr as getPaymentConfig,_e as getPaymentConfigFromSettings,Br as getSocialLinks,Oe as getSocialLinksFromSettings,Nr as getStoreConfig,He as getStoreConfigFromSettings,Er as isArchived,Lr as isDraft,Ir as isPublished,Ar as presetPlugins,br as runFieldHooks,Ie as runHooks};