@kyro-cms/core 0.10.4 → 0.10.6

package/dist/chunk-7WOX27LK.js

@@ -0,0 +1,259 @@
+import {a}from'./chunk-K6WUOU6P.js';var u=false,p=class o{db;cache={};loaded=false;static SENSITIVE_KEYS=["storage.s3.secret_access_key","storage.r2.secret_access_key","storage.gcs.private_key","storage.backblaze.application_key","storage.wasabi.secret_access_key","storage.ftp.password","storage.bunny.api_key","storage.cloudinary.api_secret","storage.imgix.sign_key","email.smtp.pass","auth.jwt_secret","auth.github_secret","auth.google_secret","auth.app_secret","database.url","redis.url","auth.admin_password"];constructor(e){this.db=e;}async load(){if(!this.loaded){await this.ensureSettingsTable();try{if(typeof this.db?.select=="function"){let e=await this.db.select().from(a);this.cache=e.reduce((t,s)=>(t[s.key]=s.value,t),{});}await this.loadFromGlobals();}catch{console.warn("ConfigService: Could not load settings from database, using environment fallbacks.");}this.loaded=true;}}async ensureSettingsTable(){if(!u)try{if(typeof this.db?.execute=="function"){let{sql:e}=await import('drizzle-orm');await this.db.execute(e`
+          CREATE TABLE IF NOT EXISTS "settings" (
+            "key" VARCHAR(255) PRIMARY KEY,
+            "value" TEXT NOT NULL,
+            "description" TEXT,
+            "updated_at" TIMESTAMP DEFAULT NOW()
+          )
+        `),u=!0;}else typeof this.db?.exec=="function"&&(this.db.exec(`
+          CREATE TABLE IF NOT EXISTS settings (
+            key TEXT PRIMARY KEY,
+            value TEXT NOT NULL,
+            description TEXT,
+            updated_at TEXT
+          )
+        `),u=!0);}catch{}}async loadFromGlobals(){try{let e=null;if(typeof this.db?.execute=="function"){let{sql:r}=await import('drizzle-orm'),i=['"_globals_storage-settings"','"_globals_storage_settings"','"global_storage_settings"'];for(let a of i)try{let n=await this.db.execute(r`SELECT * FROM ${r.raw(a)} LIMIT 1`);if(e=Array.isArray(n)?n[0]:n?.rows?n.rows[0]:null,e)break}catch{}}else if(typeof this.db?.prepare=="function"){let r=['"_globals_storage-settings"','"_globals_storage_settings"','"global_storage_settings"'];for(let i of r)try{if(e=this.db.prepare(`SELECT * FROM ${i} LIMIT 1`).get(),e)break}catch{}}if(!e)return;let t=r=>{if(!r)return null;if(typeof r=="string")try{return JSON.parse(r)}catch{return null}return r},s=e.provider||"local";if(this.cache["storage.type"]=s==="aws"?"s3":s,s==="local"){let r=t(e.local);this.cache["storage.local.dir"]=r?.uploadDir||"./public/uploads",this.cache["storage.local.url"]=r?.baseUrl||"/uploads";}if(s==="aws"){let r=t(e.aws);this.cache["storage.s3.bucket"]=r?.bucket||"",this.cache["storage.s3.region"]=r?.region||"us-east-1",this.cache["storage.s3.access_key_id"]=r?.accessKeyId||"",this.cache["storage.s3.secret_access_key"]=r?.secretAccessKey||"",this.cache["storage.s3.endpoint"]=r?.endpoint||"",this.cache["storage.s3.cdn_url"]=r?.cdnUrl||"",this.cache["storage.s3.prefix"]=r?.prefix||"";}if(s==="r2"){let r=t(e.r2);this.cache["storage.r2.account_id"]=r?.accountId||"",this.cache["storage.r2.access_key_id"]=r?.accessKeyId||"",this.cache["storage.r2.secret_access_key"]=r?.secretAccessKey||"",this.cache["storage.r2.bucket"]=r?.bucket||"",this.cache["storage.r2.cdn_url"]=r?.cdnUrl||"",this.cache["storage.r2.prefix"]=r?.prefix||"";}if(s==="cloudinary"){let r=t(e.cloudinary);this.cache["storage.cloudinary.cloud_name"]=r?.cloudName||"",this.cache["storage.cloudinary.api_key"]=r?.apiKey||"",this.cache["storage.cloudinary.api_secret"]=r?.apiSecret||"",this.cache["storage.cloudinary.folder"]=r?.folder||"";}if(s==="ftp"){let r=t(e.ftp);this.cache["storage.ftp.host"]=r?.host||"",this.cache["storage.ftp.port"]=String(r?.port||"21"),this.cache["storage.ftp.user"]=r?.user||"",this.cache["storage.ftp.password"]=r?.password||"",this.cache["storage.ftp.secure"]=r?.secure?"true":"false",this.cache["storage.ftp.base_url"]=r?.baseUrl||"",this.cache["storage.ftp.prefix"]=r?.prefix||"";}}catch(e){console.warn("ConfigService: Could not load storage settings from globals table:",e);}try{let e=null;if(typeof this.db?.execute=="function"){let{sql:t}=await import('drizzle-orm'),s=['"_globals_email-settings"','"_globals_email_settings"','"global_email_settings"'];for(let r of s)try{let i=await this.db.execute(t`SELECT * FROM ${t.raw(r)} LIMIT 1`);if(e=Array.isArray(i)?i[0]:i?.rows?i.rows[0]:null,e)break}catch{}}else if(typeof this.db?.prepare=="function"){let t=['"_globals_email-settings"','"_globals_email_settings"','"global_email_settings"'];for(let s of t)try{if(e=this.db.prepare(`SELECT * FROM ${s} LIMIT 1`).get(),e)break}catch{}}if(e){let t=s=>{if(!s)return null;if(typeof s=="string")try{return JSON.parse(s)}catch{return null}return s};if(this.cache["email.provider"]=e.provider||"smtp",this.cache["email.smtp.from"]=e.fromEmail||"",this.cache["email.smtp.from_name"]=e.fromName||"",this.cache["email.smtp.reply_to"]=e.replyTo||"",e.provider==="smtp"){let s=t(e.smtp);this.cache["email.smtp.host"]=s?.host||"",this.cache["email.smtp.port"]=String(s?.port||"587"),this.cache["email.smtp.user"]=s?.username||"",this.cache["email.smtp.pass"]=s?.password||"",this.cache["email.smtp.secure"]=s?.secure?"true":"false";}else if(e.provider==="resend"){let s=t(e.resend);this.cache["email.smtp.pass"]=s?.apiKey||"";}else if(e.provider==="sendgrid"){let s=t(e.sendgrid);this.cache["email.smtp.pass"]=s?.apiKey||"";}else if(e.provider==="mailgun"){let s=t(e.mailgun);this.cache["email.smtp.pass"]=s?.apiKey||"";}else if(e.provider==="ses"){let s=t(e.ses);this.cache["email.smtp.user"]=s?.accessKeyId||"",this.cache["email.smtp.pass"]=s?.secretAccessKey||"";}}}catch(e){console.warn("ConfigService: Could not load email settings from globals table:",e);}}get(e,t,s){return this.cache[e]?this.cache[e]:t&&process.env[t]?process.env[t]:s}getStorageConfig(){return {type:this.get("storage.type","STORAGE_TYPE","local"),s3:{bucket:this.get("storage.s3.bucket","STORAGE_BUCKET"),region:this.get("storage.s3.region","STORAGE_REGION","us-east-1"),accessKeyId:this.get("storage.s3.access_key_id","STORAGE_ACCESS_KEY_ID"),secretAccessKey:this.get("storage.s3.secret_access_key","STORAGE_SECRET_ACCESS_KEY"),endpoint:this.get("storage.s3.endpoint","STORAGE_ENDPOINT"),cdnUrl:this.get("storage.s3.cdn_url","STORAGE_CDN_URL"),prefix:this.get("storage.s3.prefix","STORAGE_PREFIX")},r2:{accountId:this.get("storage.r2.account_id","R2_ACCOUNT_ID"),accessKeyId:this.get("storage.r2.access_key_id","R2_ACCESS_KEY_ID"),secretAccessKey:this.get("storage.r2.secret_access_key","R2_SECRET_ACCESS_KEY"),bucket:this.get("storage.r2.bucket","R2_BUCKET"),cdnUrl:this.get("storage.r2.cdn_url","R2_CDN_URL"),prefix:this.get("storage.r2.prefix","R2_PREFIX")},gcs:{bucket:this.get("storage.gcs.bucket","GCS_BUCKET"),projectId:this.get("storage.gcs.project_id","GCS_PROJECT_ID"),clientEmail:this.get("storage.gcs.client_email","GCS_CLIENT_EMAIL"),privateKey:this.get("storage.gcs.private_key","GCS_PRIVATE_KEY"),cdnUrl:this.get("storage.gcs.cdn_url","GCS_CDN_URL"),prefix:this.get("storage.gcs.prefix","GCS_PREFIX")},digitalocean:{bucket:this.get("storage.digitalocean.bucket","DO_BUCKET"),region:this.get("storage.digitalocean.region","DO_REGION","nyc3"),accessKeyId:this.get("storage.digitalocean.access_key_id","DO_ACCESS_KEY_ID"),secretAccessKey:this.get("storage.digitalocean.secret_access_key","DO_SECRET_ACCESS_KEY"),cdnUrl:this.get("storage.digitalocean.cdn_url","DO_CDN_URL"),prefix:this.get("storage.digitalocean.prefix","DO_PREFIX")},backblaze:{bucket:this.get("storage.backblaze.bucket","BB_BUCKET"),accountId:this.get("storage.backblaze.account_id","BB_ACCOUNT_ID"),applicationKeyId:this.get("storage.backblaze.application_key_id","BB_APPLICATION_KEY_ID"),applicationKey:this.get("storage.backblaze.application_key","BB_APPLICATION_KEY"),cdnUrl:this.get("storage.backblaze.cdn_url","BB_CDN_URL"),prefix:this.get("storage.backblaze.prefix","BB_PREFIX")},wasabi:{bucket:this.get("storage.wasabi.bucket","WASABI_BUCKET"),region:this.get("storage.wasabi.region","WASABI_REGION","us-east-1"),accessKeyId:this.get("storage.wasabi.access_key_id","WASABI_ACCESS_KEY_ID"),secretAccessKey:this.get("storage.wasabi.secret_access_key","WASABI_SECRET_ACCESS_KEY"),cdnUrl:this.get("storage.wasabi.cdn_url","WASABI_CDN_URL"),prefix:this.get("storage.wasabi.prefix","WASABI_PREFIX")},bunny:{storageZone:this.get("storage.bunny.storage_zone","BUNNY_STORAGE_ZONE"),apiKey:this.get("storage.bunny.api_key","BUNNY_API_KEY"),cdnUrl:this.get("storage.bunny.cdn_url","BUNNY_CDN_URL"),prefix:this.get("storage.bunny.prefix","BUNNY_PREFIX")},ftp:{host:this.get("storage.ftp.host","FTP_HOST"),port:parseInt(this.get("storage.ftp.port","FTP_PORT","21"),10),user:this.get("storage.ftp.user","FTP_USER"),password:this.get("storage.ftp.password","FTP_PASSWORD"),secure:this.get("storage.ftp.secure","FTP_SECURE")==="true",baseUrl:this.get("storage.ftp.base_url","FTP_BASE_URL"),prefix:this.get("storage.ftp.prefix","FTP_PREFIX")},cloudinary:{cloudName:this.get("storage.cloudinary.cloud_name","CLOUDINARY_CLOUD_NAME"),apiKey:this.get("storage.cloudinary.api_key","CLOUDINARY_API_KEY"),apiSecret:this.get("storage.cloudinary.api_secret","CLOUDINARY_API_SECRET"),folder:this.get("storage.cloudinary.folder","CLOUDINARY_FOLDER")},imgix:{domain:this.get("storage.imgix.domain","IMGIX_DOMAIN"),signKey:this.get("storage.imgix.sign_key","IMGIX_SIGN_KEY")},local:{uploadDir:this.get("storage.local.dir","STORAGE_LOCAL_DIR","./public/uploads"),baseUrl:this.get("storage.local.url","STORAGE_LOCAL_URL","/uploads")}}}getEmailConfig(){return {provider:this.get("email.provider","EMAIL_PROVIDER","smtp"),host:this.get("email.smtp.host","SMTP_HOST"),port:parseInt(this.get("email.smtp.port","SMTP_PORT","587"),10),secure:this.get("email.smtp.secure","SMTP_SECURE")==="true",user:this.get("email.smtp.user","SMTP_USER"),pass:this.get("email.smtp.pass","SMTP_PASS"),from:this.get("email.smtp.from","SMTP_FROM","noreply@example.com"),fromName:this.get("email.smtp.from_name","SMTP_FROM_NAME","Kyro CMS"),replyTo:this.get("email.smtp.reply_to","SMTP_REPLY_TO")}}maskSensitive(e,t){return t&&(o.SENSITIVE_KEYS.includes(e)?"********":t)}async set(e,t,s){await this.db.insert(a).values({key:e,value:t,description:s,updatedAt:new Date}).onConflictDoUpdate({target:[a.key],set:{value:t,description:s,updatedAt:new Date}}),this.cache[e]=t;}};var b={verifyEmail:(o,e="User")=>({subject:"Verify your email address",html:`
+      <!DOCTYPE html>
+      <html>
+      <head>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title>Verify Email</title>
+        <style>
+          body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #333; }
+          .container { max-width: 600px; margin: 0 auto; padding: 20px; }
+          .button { display: inline-block; padding: 12px 24px; background: #0b1222; color: white; text-decoration: none; border-radius: 6px; font-weight: 600; }
+          .footer { margin-top: 30px; font-size: 12px; color: #666; }
+        </style>
+      </head>
+      <body>
+        <div class="container">
+          <h1>Welcome, ${e}!</h1>
+          <p>Please verify your email address by clicking the button below:</p>
+          <p style="text-align: center; margin: 30px 0;">
+            <a href="${o}" class="button">Verify Email</a>
+          </p>
+          <p>Or copy and paste this link into your browser:</p>
+          <p style="word-break: break-all; color: #666;">${o}</p>
+          <p>This link will expire in 24 hours.</p>
+          <div class="footer">
+            <p>If you didn't create an account, you can safely ignore this email.</p>
+          </div>
+        </div>
+      </body>
+      </html>
+    `,text:`Welcome ${e}!
+
+Please verify your email by clicking this link: ${o}
+
+This link will expire in 24 hours.
+
+If you didn't create an account, you can safely ignore this email.`}),resetPassword:(o,e="User")=>({subject:"Reset your password",html:`
+      <!DOCTYPE html>
+      <html>
+      <head>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title>Reset Password</title>
+        <style>
+          body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #333; }
+          .container { max-width: 600px; margin: 0 auto; padding: 20px; }
+          .button { display: inline-block; padding: 12px 24px; background: #dc2626; color: white; text-decoration: none; border-radius: 6px; font-weight: 600; }
+          .warning { background: #fef3c7; border: 1px solid #f59e0b; padding: 12px; border-radius: 6px; margin: 20px 0; }
+          .footer { margin-top: 30px; font-size: 12px; color: #666; }
+        </style>
+      </head>
+      <body>
+        <div class="container">
+          <h1>Password Reset Request</h1>
+          <p>Hello ${e},</p>
+          <p>We received a request to reset your password. Click the button below to create a new password:</p>
+          <p style="text-align: center; margin: 30px 0;">
+            <a href="${o}" class="button">Reset Password</a>
+          </p>
+          <p>Or copy and paste this link into your browser:</p>
+          <p style="word-break: break-all; color: #666;">${o}</p>
+          <div class="warning">
+            <strong>\u26A0\uFE0F Important:</strong> This link will expire in 1 hour. If you didn't request a password reset, please ignore this email or contact support if you have concerns.
+          </div>
+          <div class="footer">
+            <p>For security reasons, please don't share this email with anyone.</p>
+          </div>
+        </div>
+      </body>
+      </html>
+    `,text:`Password Reset Request
+
+Hello ${e},
+
+We received a request to reset your password. Click this link to create a new password: ${o}
+
+This link will expire in 1 hour.
+
+If you didn't request a password reset, please ignore this email.`}),welcome:(o="User")=>({subject:"Welcome to Kyro CMS",html:`
+      <!DOCTYPE html>
+      <html>
+      <head>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title>Welcome</title>
+        <style>
+          body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #333; }
+          .container { max-width: 600px; margin: 0 auto; padding: 20px; }
+          .button { display: inline-block; padding: 12px 24px; background: #0b1222; color: white; text-decoration: none; border-radius: 6px; font-weight: 600; }
+        </style>
+      </head>
+      <body>
+        <div class="container">
+          <h1>Welcome to Kyro CMS, ${o}!</h1>
+          <p>Your account has been created successfully.</p>
+          <p>You can now:</p>
+          <ul>
+            <li>Manage your content collections</li>
+            <li>Upload and organize media</li>
+            <li>Configure settings</li>
+            <li>And much more...</li>
+          </ul>
+          <p style="text-align: center; margin: 30px 0;">
+            <a href="#" class="button">Get Started</a>
+          </p>
+          <p>If you have any questions, feel free to reach out to our support team.</p>
+        </div>
+      </body>
+      </html>
+    `,text:`Welcome to Kyro CMS, ${o}!
+
+Your account has been created successfully.
+
+You can now:
+- Manage your content collections
+- Upload and organize media
+- Configure settings
+- And much more...
+
+Get started by logging into your dashboard.`}),accountLocked:(o,e,t="User")=>({subject:"Account Security Alert - Account Locked",html:`
+      <!DOCTYPE html>
+      <html>
+      <head>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title>Account Locked</title>
+        <style>
+          body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #333; }
+          .container { max-width: 600px; margin: 0 auto; padding: 20px; }
+          .alert { background: #fef2f2; border: 1px solid #ef4444; padding: 16px; border-radius: 8px; margin: 20px 0; }
+          .footer { margin-top: 30px; font-size: 12px; color: #666; }
+        </style>
+      </head>
+      <body>
+        <div class="container">
+          <h1>Account Security Alert</h1>
+          <p>Hello ${t},</p>
+          <div class="alert">
+            <p><strong>\u26A0\uFE0F Your account has been temporarily locked due to multiple failed login attempts.</strong></p>
+            <p>Failed attempts: ${o}</p>
+            <p>Lockout duration: ${Math.round(e/6e4)} minutes</p>
+          </div>
+          <p>Your account will automatically unlock after the lockout period expires.</p>
+          <p>If this wasn't you, we recommend:</p>
+          <ul>
+            <li>Using a strong, unique password</li>
+            <li>Enabling two-factor authentication (coming soon)</li>
+            <li>Reviewing your recent account activity</li>
+          </ul>
+          <div class="footer">
+            <p>If you need immediate assistance, please contact support.</p>
+          </div>
+        </div>
+      </body>
+      </html>
+    `,text:`Account Security Alert
+
+Hello ${t},
+
+Your account has been temporarily locked due to multiple failed login attempts (${o}).
+
+Lockout duration: ${Math.round(e/6e4)} minutes
+
+Your account will automatically unlock after this period.
+
+If this wasn't you, we recommend using a strong, unique password.`}),passwordChanged:(o="User")=>({subject:"Your password has been changed",html:`
+      <!DOCTYPE html>
+      <html>
+      <head>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title>Password Changed</title>
+        <style>
+          body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #333; }
+          .container { max-width: 600px; margin: 0 auto; padding: 20px; }
+          .info { background: #f0fdf4; border: 1px solid #22c55e; padding: 12px; border-radius: 6px; margin: 20px 0; }
+        </style>
+      </head>
+      <body>
+        <div class="container">
+          <h1>Password Changed</h1>
+          <p>Hello ${o},</p>
+          <div class="info">
+            <p>Your password was recently changed.</p>
+          </div>
+          <p>If you did this, you can safely ignore this email.</p>
+          <p><strong>If you didn't change your password</strong>, please contact our support team immediately as your account may have been compromised.</p>
+        </div>
+      </body>
+      </html>
+    `,text:`Password Changed
+
+Hello ${o},
+
+Your password was recently changed.
+
+If you did this, you can safely ignore this email.
+
+If you didn't change your password, please contact support immediately.`}),newLogin:(o,e,t="User")=>({subject:"New login to your account",html:`
+      <!DOCTYPE html>
+      <html>
+      <head>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title>New Login</title>
+        <style>
+          body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #333; }
+          .container { max-width: 600px; margin: 0 auto; padding: 20px; }
+          .info-box { background: #f8fafc; border: 1px solid #e2e8f0; padding: 16px; border-radius: 8px; margin: 20px 0; }
+          .footer { margin-top: 30px; font-size: 12px; color: #666; }
+        </style>
+      </head>
+      <body>
+        <div class="container">
+          <h1>New Login Detected</h1>
+          <p>Hello ${t},</p>
+          <p>We detected a new login to your account:</p>
+          <div class="info-box">
+            <p><strong>Location:</strong> ${o}</p>
+            <p><strong>Time:</strong> ${e}</p>
+          </div>
+          <p><strong>If this was you</strong>, no action is needed.</p>
+          <p><strong>If this wasn't you</strong>, your account may be compromised. Please:</p>
+          <ol>
+            <li>Change your password immediately</li>
+            <li>Review your recent account activity</li>
+            <li>Contact support if needed</li>
+          </ol>
+          <div class="footer">
+            <p>This is an automated security notification.</p>
+          </div>
+        </div>
+      </body>
+      </html>
+    `,text:`New Login Detected
+
+Hello ${t},
+
+We detected a new login to your account:
+
+Location: ${o}
+Time: ${e}
+
+If this wasn't you, please change your password immediately and contact support.`})},h=class o{transporter;config;templates;transporterInitialized=false;constructor(e,t){this.config=e,this.templates={...b,...t};}async ensureTransporter(){if(this.transporterInitialized)return this.transporter;let{default:e}=await import('nodemailer');return this.config.provider==="smtp"&&this.config.smtp?this.transporter=e.createTransport({host:this.config.smtp.host,port:this.config.smtp.port,secure:this.config.smtp.secure,auth:this.config.smtp.auth}):this.config.provider==="ses"&&this.config.ses&&(this.transporter=e.createTransport({host:`email-smtp.${this.config.ses.region}.amazonaws.com`,port:587,secure:false,auth:{user:this.config.ses.accessKeyId,pass:this.config.ses.secretAccessKey}})),this.transporterInitialized=true,this.transporter}async send(e){let{provider:t,from:s,fromName:r,replyTo:i}=this.config,a=`"${r||"Kyro CMS"}" <${s}>`,n=e.replyTo||i;try{let c;switch(t){case "smtp":case "ses":{let l=await this.ensureTransporter();if(!l)throw new Error(`${t} transporter not initialized`);c=await l.sendMail({from:a,to:Array.isArray(e.to)?e.to.join(", "):e.to,subject:e.subject,html:e.html,text:e.text,replyTo:n});}break;case "resend":c=await this.sendViaResend(a,e,n);break;case "sendgrid":c=await this.sendViaSendGrid(a,e,n);break;case "mailgun":c=await this.sendViaMailgun(a,e,n);break;default:throw new Error(`Unsupported email provider: ${t}`)}return c}catch(c){throw console.error("[EmailTransport] FAILED to send email:",c.message),c.response&&console.error("[EmailTransport] Provider Error Detail:",JSON.stringify(c.response,null,2)),c}}async sendViaResend(e,t,s){let r=this.config.resend?.apiKey;if(!r)throw new Error("Resend API Key missing");let i={from:e,to:t.to,subject:t.subject,html:t.html,text:t.text,reply_to:s},a=await fetch("https://api.resend.com/emails",{method:"POST",headers:{Authorization:`Bearer ${r}`,"Content-Type":"application/json"},body:JSON.stringify(i)});if(!a.ok){let n=await a.json();throw new Error(`Resend Error: ${JSON.stringify(n)}`)}return a.json()}async sendViaSendGrid(e,t,s){let r=this.config.sendgrid?.apiKey;if(!r)throw new Error("SendGrid API Key missing");let i={personalizations:[{to:Array.isArray(t.to)?t.to.map(n=>({email:n})):[{email:t.to}]}],from:{email:e.match(/<(.+)>/)?.[1]||e,name:e.match(/"(.+)"/)?.[1]},subject:t.subject,content:[{type:"text/plain",value:t.text||""},{type:"text/html",value:t.html}],reply_to:s?{email:s}:void 0},a=await fetch("https://api.sendgrid.com/v3/mail/send",{method:"POST",headers:{Authorization:`Bearer ${r}`,"Content-Type":"application/json"},body:JSON.stringify(i)});if(!a.ok){let n=await a.json();throw new Error(`SendGrid Error: ${JSON.stringify(n)}`)}return {success:true}}async sendViaMailgun(e,t,s){let{apiKey:r,domain:i,region:a}=this.config.mailgun||{};if(!r||!i)throw new Error("Mailgun config missing");let n=a==="eu"?"api.eu.mailgun.net":"api.mailgun.net",c=btoa(`api:${r}`),l=new URLSearchParams;l.append("from",e);let f=Array.isArray(t.to)?t.to.join(", "):t.to;l.append("to",f),l.append("subject",t.subject),l.append("html",t.html),t.text&&l.append("text",t.text),s&&l.append("h:Reply-To",s);let d=await fetch(`https://${n}/v3/${i}/messages`,{method:"POST",headers:{Authorization:`Basic ${c}`,"Content-Type":"application/x-www-form-urlencoded"},body:l});if(!d.ok){let y=await d.json();throw new Error(`Mailgun Error: ${JSON.stringify(y)}`)}return d.json()}getTemplates(){return this.templates}async verifyConnection(){if(this.config.provider==="smtp"||this.config.provider==="ses")try{let e=await this.ensureTransporter();if(e)return await e.verify(),!0}catch{return  false}return !!(this.config.resend?.apiKey||this.config.sendgrid?.apiKey||this.config.mailgun?.apiKey)}static async fromConfig(e){let t=new p(e);await t.load();let s=t.getEmailConfig();if(!s.provider)return this.fromEnv();let r={provider:s.provider||"smtp",from:s.from||"noreply@example.com",fromName:s.fromName,replyTo:s.replyTo,smtp:s.provider==="smtp"?{host:s.host||"",port:s.port||587,secure:s.secure||false,auth:{user:s.user||"",pass:s.pass||""}}:void 0,resend:s.provider==="resend"?{apiKey:s.pass||""}:void 0,sendgrid:s.provider==="sendgrid"?{apiKey:s.pass||""}:void 0,mailgun:s.provider==="mailgun"?{apiKey:s.pass||"",domain:s.host||"",region:s.secure?"eu":"us"}:void 0,ses:s.provider==="ses"?{accessKeyId:s.user||"",secretAccessKey:s.pass||"",region:s.host||"us-east-1"}:void 0};return new o(r)}static fromEnv(){let e=process.env.EMAIL_PROVIDER||"smtp",t=process.env.SMTP_FROM||process.env.DEFAULT_FROM||"noreply@example.com",s=process.env.SMTP_FROM_NAME||"Kyro CMS",r=process.env.SMTP_REPLY_TO;if(e==="smtp"){let i=process.env.SMTP_HOST,a=process.env.SMTP_USER,n=process.env.SMTP_PASS;return !i||!a||!n?null:new o({provider:"smtp",from:t,fromName:s,replyTo:r,smtp:{host:i,port:parseInt(process.env.SMTP_PORT||"587",10),secure:process.env.SMTP_SECURE==="true",auth:{user:a,pass:n}}})}if(e==="resend"){let i=process.env.RESEND_API_KEY||process.env.SMTP_PASS;return i?new o({provider:"resend",from:t,fromName:s,replyTo:r,resend:{apiKey:i}}):null}if(e==="sendgrid"){let i=process.env.SENDGRID_API_KEY||process.env.SMTP_PASS;return i?new o({provider:"sendgrid",from:t,fromName:s,replyTo:r,sendgrid:{apiKey:i}}):null}if(e==="mailgun"){let i=process.env.MAILGUN_API_KEY||process.env.SMTP_PASS,a=process.env.MAILGUN_DOMAIN||process.env.SMTP_HOST;return !i||!a?null:new o({provider:"mailgun",from:t,fromName:s,replyTo:r,mailgun:{apiKey:i,domain:a,region:process.env.MAILGUN_REGION||(process.env.SMTP_SECURE==="true"?"eu":"us")}})}if(e==="ses"){let i=process.env.AWS_ACCESS_KEY_ID||process.env.SMTP_USER,a=process.env.AWS_SECRET_ACCESS_KEY||process.env.SMTP_PASS,n=process.env.AWS_REGION||process.env.SMTP_HOST||"us-east-1";return !i||!a?null:new o({provider:"ses",from:t,fromName:s,replyTo:r,ses:{accessKeyId:i,secretAccessKey:a,region:n}})}return null}};var _={minLength:12,requireUppercase:true,requireLowercase:true,requireNumbers:true,requireSpecialChars:true,preventReuse:5,maxLength:128},m=class{config;constructor(e={}){this.config={..._,...e};}validate(e){let t=[];return this.config.maxLength&&e.length>this.config.maxLength&&t.push(`Password must not exceed ${this.config.maxLength} characters`),e.length<this.config.minLength&&t.push(`Password must be at least ${this.config.minLength} characters`),this.config.requireUppercase&&!/[A-Z]/.test(e)&&t.push("Password must contain at least one uppercase letter"),this.config.requireLowercase&&!/[a-z]/.test(e)&&t.push("Password must contain at least one lowercase letter"),this.config.requireNumbers&&!/[0-9]/.test(e)&&t.push("Password must contain at least one number"),this.config.requireSpecialChars&&!/[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(e)&&t.push("Password must contain at least one special character"),["password","123456","12345678","qwerty","abc123","monkey","1234567","letmein","trustno1","dragon","baseball","iloveyou","master","sunshine","ashley","football","password1","shadow","123123","654321"].includes(e.toLowerCase())&&t.push("This password is too common. Please choose a more secure password"),(/^[a-zA-Z]+$/.test(e)||/^[0-9]+$/.test(e))&&t.push("Password must contain a mix of letters, numbers, and/or special characters"),/(.)\1{2,}/.test(e)&&t.push("Password must not contain more than 2 consecutive identical characters"),/^(012|123|234|345|456|567|678|789|890|098|987|876|765|654|543|432|321|210)+$/i.test(e)&&t.push("Password must not contain sequential numbers or letters"),{valid:t.length===0,errors:t}}async checkReuse(e,t,s){return {valid:true,errors:[]}}async isInHistory(e,t,s){for(let r of t)if(await s(e,r))return  true;return  false}generatePassword(e=16){let t="ABCDEFGHIJKLMNOPQRSTUVWXYZ",s="abcdefghijklmnopqrstuvwxyz",r="0123456789",i="!@#$%^&*()_+-=[]{}|;:,.<>?",a="";a+=t[Math.floor(Math.random()*t.length)],a+=s[Math.floor(Math.random()*s.length)],a+=r[Math.floor(Math.random()*r.length)],a+=i[Math.floor(Math.random()*i.length)];let n=t+s+r+i;for(let c=a.length;c<e;c++)a+=n[Math.floor(Math.random()*n.length)];return a.split("").sort(()=>Math.random()-.5).join("")}getStrength(e){let t=0,s=[];e.length>=8&&(t+=1),e.length>=12&&(t+=1),e.length>=16&&(t+=1),/[a-z]/.test(e)&&(t+=1),/[A-Z]/.test(e)&&(t+=1),/[0-9]/.test(e)&&(t+=1),/[!@#$%^&*()_+\-=\[\]{}|;:,.<>?]/.test(e)&&(t+=1),e.length>8&&(t+=1),e.length>12&&(t+=1);let r=new Set(e).size;r>6&&(t+=1),r>10&&(t+=1);let i;return t<=3?(i="Weak",s.push("Add more characters"),s.push("Include uppercase and lowercase letters")):t<=5?(i="Fair",s.push("Add special characters"),s.push("Consider making it longer")):t<=7?(i="Good",s.push("Consider making it longer for extra security")):i="Strong",{score:t,label:i,feedback:s}}setConfig(e){this.config={...this.config,...e};}getConfig(){return {...this.config}}};
+export{p as a,h as b,m as c};

package/dist/chunk-AE6GXUT7.js

@@ -0,0 +1 @@
+var e={slug:"users",label:"Users",fields:[{name:"name",type:"text",label:"Name"},{name:"email",type:"email",required:true},{name:"passwordHash",type:"text",label:"Password Hash",admin:{hidden:true}},{name:"role",type:"select",options:[{label:"Super Admin",value:"super_admin"},{label:"Admin",value:"admin"},{label:"Editor",value:"editor"},{label:"Author",value:"author"},{label:"Customer",value:"customer"},{label:"Guest",value:"guest"}],required:true},{name:"avatar",type:"upload",relationTo:"media",label:"Profile Picture"},{name:"tenantId",type:"text",label:"Tenant"},{name:"emailVerified",type:"checkbox",label:"Email Verified"},{name:"locked",type:"checkbox"},{name:"lastLogin",type:"date",time:true,label:"Last Login",admin:{readOnly:true}},{name:"failedLoginAttempts",type:"number",label:"Failed Login Attempts",admin:{readOnly:true}}],timestamps:true,admin:{useAsTitle:"email",defaultColumns:["email","role","tenantId","lastLogin"]}},t={slug:"audit_logs",label:"Audit Logs",fields:[{name:"action",type:"text",required:true},{name:"userId",type:"text",label:"User ID"},{name:"userEmail",type:"email",label:"User Email"},{name:"role",type:"text"},{name:"resource",type:"text",label:"Resource"},{name:"ipAddress",type:"text",label:"IP Address"},{name:"success",type:"checkbox"},{name:"timestamp",type:"date",time:true,required:true,admin:{readOnly:true}}],admin:{defaultColumns:["action","userEmail","resource","success","timestamp"]}},a={users:e,audit_logs:t};export{e as a,a as b};

package/dist/chunk-AJAZ7D3W.cjs

@@ -0,0 +1,259 @@
+'use strict';var chunkWIZ6C5QZ_cjs=require('./chunk-WIZ6C5QZ.cjs');var u=false,p=class o{db;cache={};loaded=false;static SENSITIVE_KEYS=["storage.s3.secret_access_key","storage.r2.secret_access_key","storage.gcs.private_key","storage.backblaze.application_key","storage.wasabi.secret_access_key","storage.ftp.password","storage.bunny.api_key","storage.cloudinary.api_secret","storage.imgix.sign_key","email.smtp.pass","auth.jwt_secret","auth.github_secret","auth.google_secret","auth.app_secret","database.url","redis.url","auth.admin_password"];constructor(e){this.db=e;}async load(){if(!this.loaded){await this.ensureSettingsTable();try{if(typeof this.db?.select=="function"){let e=await this.db.select().from(chunkWIZ6C5QZ_cjs.a);this.cache=e.reduce((t,s)=>(t[s.key]=s.value,t),{});}await this.loadFromGlobals();}catch{console.warn("ConfigService: Could not load settings from database, using environment fallbacks.");}this.loaded=true;}}async ensureSettingsTable(){if(!u)try{if(typeof this.db?.execute=="function"){let{sql:e}=await import('drizzle-orm');await this.db.execute(e`
+          CREATE TABLE IF NOT EXISTS "settings" (
+            "key" VARCHAR(255) PRIMARY KEY,
+            "value" TEXT NOT NULL,
+            "description" TEXT,
+            "updated_at" TIMESTAMP DEFAULT NOW()
+          )
+        `),u=!0;}else typeof this.db?.exec=="function"&&(this.db.exec(`
+          CREATE TABLE IF NOT EXISTS settings (
+            key TEXT PRIMARY KEY,
+            value TEXT NOT NULL,
+            description TEXT,
+            updated_at TEXT
+          )
+        `),u=!0);}catch{}}async loadFromGlobals(){try{let e=null;if(typeof this.db?.execute=="function"){let{sql:r}=await import('drizzle-orm'),i=['"_globals_storage-settings"','"_globals_storage_settings"','"global_storage_settings"'];for(let a of i)try{let n=await this.db.execute(r`SELECT * FROM ${r.raw(a)} LIMIT 1`);if(e=Array.isArray(n)?n[0]:n?.rows?n.rows[0]:null,e)break}catch{}}else if(typeof this.db?.prepare=="function"){let r=['"_globals_storage-settings"','"_globals_storage_settings"','"global_storage_settings"'];for(let i of r)try{if(e=this.db.prepare(`SELECT * FROM ${i} LIMIT 1`).get(),e)break}catch{}}if(!e)return;let t=r=>{if(!r)return null;if(typeof r=="string")try{return JSON.parse(r)}catch{return null}return r},s=e.provider||"local";if(this.cache["storage.type"]=s==="aws"?"s3":s,s==="local"){let r=t(e.local);this.cache["storage.local.dir"]=r?.uploadDir||"./public/uploads",this.cache["storage.local.url"]=r?.baseUrl||"/uploads";}if(s==="aws"){let r=t(e.aws);this.cache["storage.s3.bucket"]=r?.bucket||"",this.cache["storage.s3.region"]=r?.region||"us-east-1",this.cache["storage.s3.access_key_id"]=r?.accessKeyId||"",this.cache["storage.s3.secret_access_key"]=r?.secretAccessKey||"",this.cache["storage.s3.endpoint"]=r?.endpoint||"",this.cache["storage.s3.cdn_url"]=r?.cdnUrl||"",this.cache["storage.s3.prefix"]=r?.prefix||"";}if(s==="r2"){let r=t(e.r2);this.cache["storage.r2.account_id"]=r?.accountId||"",this.cache["storage.r2.access_key_id"]=r?.accessKeyId||"",this.cache["storage.r2.secret_access_key"]=r?.secretAccessKey||"",this.cache["storage.r2.bucket"]=r?.bucket||"",this.cache["storage.r2.cdn_url"]=r?.cdnUrl||"",this.cache["storage.r2.prefix"]=r?.prefix||"";}if(s==="cloudinary"){let r=t(e.cloudinary);this.cache["storage.cloudinary.cloud_name"]=r?.cloudName||"",this.cache["storage.cloudinary.api_key"]=r?.apiKey||"",this.cache["storage.cloudinary.api_secret"]=r?.apiSecret||"",this.cache["storage.cloudinary.folder"]=r?.folder||"";}if(s==="ftp"){let r=t(e.ftp);this.cache["storage.ftp.host"]=r?.host||"",this.cache["storage.ftp.port"]=String(r?.port||"21"),this.cache["storage.ftp.user"]=r?.user||"",this.cache["storage.ftp.password"]=r?.password||"",this.cache["storage.ftp.secure"]=r?.secure?"true":"false",this.cache["storage.ftp.base_url"]=r?.baseUrl||"",this.cache["storage.ftp.prefix"]=r?.prefix||"";}}catch(e){console.warn("ConfigService: Could not load storage settings from globals table:",e);}try{let e=null;if(typeof this.db?.execute=="function"){let{sql:t}=await import('drizzle-orm'),s=['"_globals_email-settings"','"_globals_email_settings"','"global_email_settings"'];for(let r of s)try{let i=await this.db.execute(t`SELECT * FROM ${t.raw(r)} LIMIT 1`);if(e=Array.isArray(i)?i[0]:i?.rows?i.rows[0]:null,e)break}catch{}}else if(typeof this.db?.prepare=="function"){let t=['"_globals_email-settings"','"_globals_email_settings"','"global_email_settings"'];for(let s of t)try{if(e=this.db.prepare(`SELECT * FROM ${s} LIMIT 1`).get(),e)break}catch{}}if(e){let t=s=>{if(!s)return null;if(typeof s=="string")try{return JSON.parse(s)}catch{return null}return s};if(this.cache["email.provider"]=e.provider||"smtp",this.cache["email.smtp.from"]=e.fromEmail||"",this.cache["email.smtp.from_name"]=e.fromName||"",this.cache["email.smtp.reply_to"]=e.replyTo||"",e.provider==="smtp"){let s=t(e.smtp);this.cache["email.smtp.host"]=s?.host||"",this.cache["email.smtp.port"]=String(s?.port||"587"),this.cache["email.smtp.user"]=s?.username||"",this.cache["email.smtp.pass"]=s?.password||"",this.cache["email.smtp.secure"]=s?.secure?"true":"false";}else if(e.provider==="resend"){let s=t(e.resend);this.cache["email.smtp.pass"]=s?.apiKey||"";}else if(e.provider==="sendgrid"){let s=t(e.sendgrid);this.cache["email.smtp.pass"]=s?.apiKey||"";}else if(e.provider==="mailgun"){let s=t(e.mailgun);this.cache["email.smtp.pass"]=s?.apiKey||"";}else if(e.provider==="ses"){let s=t(e.ses);this.cache["email.smtp.user"]=s?.accessKeyId||"",this.cache["email.smtp.pass"]=s?.secretAccessKey||"";}}}catch(e){console.warn("ConfigService: Could not load email settings from globals table:",e);}}get(e,t,s){return this.cache[e]?this.cache[e]:t&&process.env[t]?process.env[t]:s}getStorageConfig(){return {type:this.get("storage.type","STORAGE_TYPE","local"),s3:{bucket:this.get("storage.s3.bucket","STORAGE_BUCKET"),region:this.get("storage.s3.region","STORAGE_REGION","us-east-1"),accessKeyId:this.get("storage.s3.access_key_id","STORAGE_ACCESS_KEY_ID"),secretAccessKey:this.get("storage.s3.secret_access_key","STORAGE_SECRET_ACCESS_KEY"),endpoint:this.get("storage.s3.endpoint","STORAGE_ENDPOINT"),cdnUrl:this.get("storage.s3.cdn_url","STORAGE_CDN_URL"),prefix:this.get("storage.s3.prefix","STORAGE_PREFIX")},r2:{accountId:this.get("storage.r2.account_id","R2_ACCOUNT_ID"),accessKeyId:this.get("storage.r2.access_key_id","R2_ACCESS_KEY_ID"),secretAccessKey:this.get("storage.r2.secret_access_key","R2_SECRET_ACCESS_KEY"),bucket:this.get("storage.r2.bucket","R2_BUCKET"),cdnUrl:this.get("storage.r2.cdn_url","R2_CDN_URL"),prefix:this.get("storage.r2.prefix","R2_PREFIX")},gcs:{bucket:this.get("storage.gcs.bucket","GCS_BUCKET"),projectId:this.get("storage.gcs.project_id","GCS_PROJECT_ID"),clientEmail:this.get("storage.gcs.client_email","GCS_CLIENT_EMAIL"),privateKey:this.get("storage.gcs.private_key","GCS_PRIVATE_KEY"),cdnUrl:this.get("storage.gcs.cdn_url","GCS_CDN_URL"),prefix:this.get("storage.gcs.prefix","GCS_PREFIX")},digitalocean:{bucket:this.get("storage.digitalocean.bucket","DO_BUCKET"),region:this.get("storage.digitalocean.region","DO_REGION","nyc3"),accessKeyId:this.get("storage.digitalocean.access_key_id","DO_ACCESS_KEY_ID"),secretAccessKey:this.get("storage.digitalocean.secret_access_key","DO_SECRET_ACCESS_KEY"),cdnUrl:this.get("storage.digitalocean.cdn_url","DO_CDN_URL"),prefix:this.get("storage.digitalocean.prefix","DO_PREFIX")},backblaze:{bucket:this.get("storage.backblaze.bucket","BB_BUCKET"),accountId:this.get("storage.backblaze.account_id","BB_ACCOUNT_ID"),applicationKeyId:this.get("storage.backblaze.application_key_id","BB_APPLICATION_KEY_ID"),applicationKey:this.get("storage.backblaze.application_key","BB_APPLICATION_KEY"),cdnUrl:this.get("storage.backblaze.cdn_url","BB_CDN_URL"),prefix:this.get("storage.backblaze.prefix","BB_PREFIX")},wasabi:{bucket:this.get("storage.wasabi.bucket","WASABI_BUCKET"),region:this.get("storage.wasabi.region","WASABI_REGION","us-east-1"),accessKeyId:this.get("storage.wasabi.access_key_id","WASABI_ACCESS_KEY_ID"),secretAccessKey:this.get("storage.wasabi.secret_access_key","WASABI_SECRET_ACCESS_KEY"),cdnUrl:this.get("storage.wasabi.cdn_url","WASABI_CDN_URL"),prefix:this.get("storage.wasabi.prefix","WASABI_PREFIX")},bunny:{storageZone:this.get("storage.bunny.storage_zone","BUNNY_STORAGE_ZONE"),apiKey:this.get("storage.bunny.api_key","BUNNY_API_KEY"),cdnUrl:this.get("storage.bunny.cdn_url","BUNNY_CDN_URL"),prefix:this.get("storage.bunny.prefix","BUNNY_PREFIX")},ftp:{host:this.get("storage.ftp.host","FTP_HOST"),port:parseInt(this.get("storage.ftp.port","FTP_PORT","21"),10),user:this.get("storage.ftp.user","FTP_USER"),password:this.get("storage.ftp.password","FTP_PASSWORD"),secure:this.get("storage.ftp.secure","FTP_SECURE")==="true",baseUrl:this.get("storage.ftp.base_url","FTP_BASE_URL"),prefix:this.get("storage.ftp.prefix","FTP_PREFIX")},cloudinary:{cloudName:this.get("storage.cloudinary.cloud_name","CLOUDINARY_CLOUD_NAME"),apiKey:this.get("storage.cloudinary.api_key","CLOUDINARY_API_KEY"),apiSecret:this.get("storage.cloudinary.api_secret","CLOUDINARY_API_SECRET"),folder:this.get("storage.cloudinary.folder","CLOUDINARY_FOLDER")},imgix:{domain:this.get("storage.imgix.domain","IMGIX_DOMAIN"),signKey:this.get("storage.imgix.sign_key","IMGIX_SIGN_KEY")},local:{uploadDir:this.get("storage.local.dir","STORAGE_LOCAL_DIR","./public/uploads"),baseUrl:this.get("storage.local.url","STORAGE_LOCAL_URL","/uploads")}}}getEmailConfig(){return {provider:this.get("email.provider","EMAIL_PROVIDER","smtp"),host:this.get("email.smtp.host","SMTP_HOST"),port:parseInt(this.get("email.smtp.port","SMTP_PORT","587"),10),secure:this.get("email.smtp.secure","SMTP_SECURE")==="true",user:this.get("email.smtp.user","SMTP_USER"),pass:this.get("email.smtp.pass","SMTP_PASS"),from:this.get("email.smtp.from","SMTP_FROM","noreply@example.com"),fromName:this.get("email.smtp.from_name","SMTP_FROM_NAME","Kyro CMS"),replyTo:this.get("email.smtp.reply_to","SMTP_REPLY_TO")}}maskSensitive(e,t){return t&&(o.SENSITIVE_KEYS.includes(e)?"********":t)}async set(e,t,s){await this.db.insert(chunkWIZ6C5QZ_cjs.a).values({key:e,value:t,description:s,updatedAt:new Date}).onConflictDoUpdate({target:[chunkWIZ6C5QZ_cjs.a.key],set:{value:t,description:s,updatedAt:new Date}}),this.cache[e]=t;}};var b={verifyEmail:(o,e="User")=>({subject:"Verify your email address",html:`
+      <!DOCTYPE html>
+      <html>
+      <head>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title>Verify Email</title>
+        <style>
+          body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #333; }
+          .container { max-width: 600px; margin: 0 auto; padding: 20px; }
+          .button { display: inline-block; padding: 12px 24px; background: #0b1222; color: white; text-decoration: none; border-radius: 6px; font-weight: 600; }
+          .footer { margin-top: 30px; font-size: 12px; color: #666; }
+        </style>
+      </head>
+      <body>
+        <div class="container">
+          <h1>Welcome, ${e}!</h1>
+          <p>Please verify your email address by clicking the button below:</p>
+          <p style="text-align: center; margin: 30px 0;">
+            <a href="${o}" class="button">Verify Email</a>
+          </p>
+          <p>Or copy and paste this link into your browser:</p>
+          <p style="word-break: break-all; color: #666;">${o}</p>
+          <p>This link will expire in 24 hours.</p>
+          <div class="footer">
+            <p>If you didn't create an account, you can safely ignore this email.</p>
+          </div>
+        </div>
+      </body>
+      </html>
+    `,text:`Welcome ${e}!
+
+Please verify your email by clicking this link: ${o}
+
+This link will expire in 24 hours.
+
+If you didn't create an account, you can safely ignore this email.`}),resetPassword:(o,e="User")=>({subject:"Reset your password",html:`
+      <!DOCTYPE html>
+      <html>
+      <head>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title>Reset Password</title>
+        <style>
+          body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #333; }
+          .container { max-width: 600px; margin: 0 auto; padding: 20px; }
+          .button { display: inline-block; padding: 12px 24px; background: #dc2626; color: white; text-decoration: none; border-radius: 6px; font-weight: 600; }
+          .warning { background: #fef3c7; border: 1px solid #f59e0b; padding: 12px; border-radius: 6px; margin: 20px 0; }
+          .footer { margin-top: 30px; font-size: 12px; color: #666; }
+        </style>
+      </head>
+      <body>
+        <div class="container">
+          <h1>Password Reset Request</h1>
+          <p>Hello ${e},</p>
+          <p>We received a request to reset your password. Click the button below to create a new password:</p>
+          <p style="text-align: center; margin: 30px 0;">
+            <a href="${o}" class="button">Reset Password</a>
+          </p>
+          <p>Or copy and paste this link into your browser:</p>
+          <p style="word-break: break-all; color: #666;">${o}</p>
+          <div class="warning">
+            <strong>\u26A0\uFE0F Important:</strong> This link will expire in 1 hour. If you didn't request a password reset, please ignore this email or contact support if you have concerns.
+          </div>
+          <div class="footer">
+            <p>For security reasons, please don't share this email with anyone.</p>
+          </div>
+        </div>
+      </body>
+      </html>
+    `,text:`Password Reset Request
+
+Hello ${e},
+
+We received a request to reset your password. Click this link to create a new password: ${o}
+
+This link will expire in 1 hour.
+
+If you didn't request a password reset, please ignore this email.`}),welcome:(o="User")=>({subject:"Welcome to Kyro CMS",html:`
+      <!DOCTYPE html>
+      <html>
+      <head>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title>Welcome</title>
+        <style>
+          body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #333; }
+          .container { max-width: 600px; margin: 0 auto; padding: 20px; }
+          .button { display: inline-block; padding: 12px 24px; background: #0b1222; color: white; text-decoration: none; border-radius: 6px; font-weight: 600; }
+        </style>
+      </head>
+      <body>
+        <div class="container">
+          <h1>Welcome to Kyro CMS, ${o}!</h1>
+          <p>Your account has been created successfully.</p>
+          <p>You can now:</p>
+          <ul>
+            <li>Manage your content collections</li>
+            <li>Upload and organize media</li>
+            <li>Configure settings</li>
+            <li>And much more...</li>
+          </ul>
+          <p style="text-align: center; margin: 30px 0;">
+            <a href="#" class="button">Get Started</a>
+          </p>
+          <p>If you have any questions, feel free to reach out to our support team.</p>
+        </div>
+      </body>
+      </html>
+    `,text:`Welcome to Kyro CMS, ${o}!
+
+Your account has been created successfully.
+
+You can now:
+- Manage your content collections
+- Upload and organize media
+- Configure settings
+- And much more...
+
+Get started by logging into your dashboard.`}),accountLocked:(o,e,t="User")=>({subject:"Account Security Alert - Account Locked",html:`
+      <!DOCTYPE html>
+      <html>
+      <head>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title>Account Locked</title>
+        <style>
+          body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #333; }
+          .container { max-width: 600px; margin: 0 auto; padding: 20px; }
+          .alert { background: #fef2f2; border: 1px solid #ef4444; padding: 16px; border-radius: 8px; margin: 20px 0; }
+          .footer { margin-top: 30px; font-size: 12px; color: #666; }
+        </style>
+      </head>
+      <body>
+        <div class="container">
+          <h1>Account Security Alert</h1>
+          <p>Hello ${t},</p>
+          <div class="alert">
+            <p><strong>\u26A0\uFE0F Your account has been temporarily locked due to multiple failed login attempts.</strong></p>
+            <p>Failed attempts: ${o}</p>
+            <p>Lockout duration: ${Math.round(e/6e4)} minutes</p>
+          </div>
+          <p>Your account will automatically unlock after the lockout period expires.</p>
+          <p>If this wasn't you, we recommend:</p>
+          <ul>
+            <li>Using a strong, unique password</li>
+            <li>Enabling two-factor authentication (coming soon)</li>
+            <li>Reviewing your recent account activity</li>
+          </ul>
+          <div class="footer">
+            <p>If you need immediate assistance, please contact support.</p>
+          </div>
+        </div>
+      </body>
+      </html>
+    `,text:`Account Security Alert
+
+Hello ${t},
+
+Your account has been temporarily locked due to multiple failed login attempts (${o}).
+
+Lockout duration: ${Math.round(e/6e4)} minutes
+
+Your account will automatically unlock after this period.
+
+If this wasn't you, we recommend using a strong, unique password.`}),passwordChanged:(o="User")=>({subject:"Your password has been changed",html:`
+      <!DOCTYPE html>
+      <html>
+      <head>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title>Password Changed</title>
+        <style>
+          body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #333; }
+          .container { max-width: 600px; margin: 0 auto; padding: 20px; }
+          .info { background: #f0fdf4; border: 1px solid #22c55e; padding: 12px; border-radius: 6px; margin: 20px 0; }
+        </style>
+      </head>
+      <body>
+        <div class="container">
+          <h1>Password Changed</h1>
+          <p>Hello ${o},</p>
+          <div class="info">
+            <p>Your password was recently changed.</p>
+          </div>
+          <p>If you did this, you can safely ignore this email.</p>
+          <p><strong>If you didn't change your password</strong>, please contact our support team immediately as your account may have been compromised.</p>
+        </div>
+      </body>
+      </html>
+    `,text:`Password Changed
+
+Hello ${o},
+
+Your password was recently changed.
+
+If you did this, you can safely ignore this email.
+
+If you didn't change your password, please contact support immediately.`}),newLogin:(o,e,t="User")=>({subject:"New login to your account",html:`
+      <!DOCTYPE html>
+      <html>
+      <head>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title>New Login</title>
+        <style>
+          body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #333; }
+          .container { max-width: 600px; margin: 0 auto; padding: 20px; }
+          .info-box { background: #f8fafc; border: 1px solid #e2e8f0; padding: 16px; border-radius: 8px; margin: 20px 0; }
+          .footer { margin-top: 30px; font-size: 12px; color: #666; }
+        </style>
+      </head>
+      <body>
+        <div class="container">
+          <h1>New Login Detected</h1>
+          <p>Hello ${t},</p>
+          <p>We detected a new login to your account:</p>
+          <div class="info-box">
+            <p><strong>Location:</strong> ${o}</p>
+            <p><strong>Time:</strong> ${e}</p>
+          </div>
+          <p><strong>If this was you</strong>, no action is needed.</p>
+          <p><strong>If this wasn't you</strong>, your account may be compromised. Please:</p>
+          <ol>
+            <li>Change your password immediately</li>
+            <li>Review your recent account activity</li>
+            <li>Contact support if needed</li>
+          </ol>
+          <div class="footer">
+            <p>This is an automated security notification.</p>
+          </div>
+        </div>
+      </body>
+      </html>
+    `,text:`New Login Detected
+
+Hello ${t},
+
+We detected a new login to your account:
+
+Location: ${o}
+Time: ${e}
+
+If this wasn't you, please change your password immediately and contact support.`})},h=class o{transporter;config;templates;transporterInitialized=false;constructor(e,t){this.config=e,this.templates={...b,...t};}async ensureTransporter(){if(this.transporterInitialized)return this.transporter;let{default:e}=await import('nodemailer');return this.config.provider==="smtp"&&this.config.smtp?this.transporter=e.createTransport({host:this.config.smtp.host,port:this.config.smtp.port,secure:this.config.smtp.secure,auth:this.config.smtp.auth}):this.config.provider==="ses"&&this.config.ses&&(this.transporter=e.createTransport({host:`email-smtp.${this.config.ses.region}.amazonaws.com`,port:587,secure:false,auth:{user:this.config.ses.accessKeyId,pass:this.config.ses.secretAccessKey}})),this.transporterInitialized=true,this.transporter}async send(e){let{provider:t,from:s,fromName:r,replyTo:i}=this.config,a=`"${r||"Kyro CMS"}" <${s}>`,n=e.replyTo||i;try{let c;switch(t){case "smtp":case "ses":{let l=await this.ensureTransporter();if(!l)throw new Error(`${t} transporter not initialized`);c=await l.sendMail({from:a,to:Array.isArray(e.to)?e.to.join(", "):e.to,subject:e.subject,html:e.html,text:e.text,replyTo:n});}break;case "resend":c=await this.sendViaResend(a,e,n);break;case "sendgrid":c=await this.sendViaSendGrid(a,e,n);break;case "mailgun":c=await this.sendViaMailgun(a,e,n);break;default:throw new Error(`Unsupported email provider: ${t}`)}return c}catch(c){throw console.error("[EmailTransport] FAILED to send email:",c.message),c.response&&console.error("[EmailTransport] Provider Error Detail:",JSON.stringify(c.response,null,2)),c}}async sendViaResend(e,t,s){let r=this.config.resend?.apiKey;if(!r)throw new Error("Resend API Key missing");let i={from:e,to:t.to,subject:t.subject,html:t.html,text:t.text,reply_to:s},a=await fetch("https://api.resend.com/emails",{method:"POST",headers:{Authorization:`Bearer ${r}`,"Content-Type":"application/json"},body:JSON.stringify(i)});if(!a.ok){let n=await a.json();throw new Error(`Resend Error: ${JSON.stringify(n)}`)}return a.json()}async sendViaSendGrid(e,t,s){let r=this.config.sendgrid?.apiKey;if(!r)throw new Error("SendGrid API Key missing");let i={personalizations:[{to:Array.isArray(t.to)?t.to.map(n=>({email:n})):[{email:t.to}]}],from:{email:e.match(/<(.+)>/)?.[1]||e,name:e.match(/"(.+)"/)?.[1]},subject:t.subject,content:[{type:"text/plain",value:t.text||""},{type:"text/html",value:t.html}],reply_to:s?{email:s}:void 0},a=await fetch("https://api.sendgrid.com/v3/mail/send",{method:"POST",headers:{Authorization:`Bearer ${r}`,"Content-Type":"application/json"},body:JSON.stringify(i)});if(!a.ok){let n=await a.json();throw new Error(`SendGrid Error: ${JSON.stringify(n)}`)}return {success:true}}async sendViaMailgun(e,t,s){let{apiKey:r,domain:i,region:a}=this.config.mailgun||{};if(!r||!i)throw new Error("Mailgun config missing");let n=a==="eu"?"api.eu.mailgun.net":"api.mailgun.net",c=btoa(`api:${r}`),l=new URLSearchParams;l.append("from",e);let f=Array.isArray(t.to)?t.to.join(", "):t.to;l.append("to",f),l.append("subject",t.subject),l.append("html",t.html),t.text&&l.append("text",t.text),s&&l.append("h:Reply-To",s);let d=await fetch(`https://${n}/v3/${i}/messages`,{method:"POST",headers:{Authorization:`Basic ${c}`,"Content-Type":"application/x-www-form-urlencoded"},body:l});if(!d.ok){let y=await d.json();throw new Error(`Mailgun Error: ${JSON.stringify(y)}`)}return d.json()}getTemplates(){return this.templates}async verifyConnection(){if(this.config.provider==="smtp"||this.config.provider==="ses")try{let e=await this.ensureTransporter();if(e)return await e.verify(),!0}catch{return  false}return !!(this.config.resend?.apiKey||this.config.sendgrid?.apiKey||this.config.mailgun?.apiKey)}static async fromConfig(e){let t=new p(e);await t.load();let s=t.getEmailConfig();if(!s.provider)return this.fromEnv();let r={provider:s.provider||"smtp",from:s.from||"noreply@example.com",fromName:s.fromName,replyTo:s.replyTo,smtp:s.provider==="smtp"?{host:s.host||"",port:s.port||587,secure:s.secure||false,auth:{user:s.user||"",pass:s.pass||""}}:void 0,resend:s.provider==="resend"?{apiKey:s.pass||""}:void 0,sendgrid:s.provider==="sendgrid"?{apiKey:s.pass||""}:void 0,mailgun:s.provider==="mailgun"?{apiKey:s.pass||"",domain:s.host||"",region:s.secure?"eu":"us"}:void 0,ses:s.provider==="ses"?{accessKeyId:s.user||"",secretAccessKey:s.pass||"",region:s.host||"us-east-1"}:void 0};return new o(r)}static fromEnv(){let e=process.env.EMAIL_PROVIDER||"smtp",t=process.env.SMTP_FROM||process.env.DEFAULT_FROM||"noreply@example.com",s=process.env.SMTP_FROM_NAME||"Kyro CMS",r=process.env.SMTP_REPLY_TO;if(e==="smtp"){let i=process.env.SMTP_HOST,a=process.env.SMTP_USER,n=process.env.SMTP_PASS;return !i||!a||!n?null:new o({provider:"smtp",from:t,fromName:s,replyTo:r,smtp:{host:i,port:parseInt(process.env.SMTP_PORT||"587",10),secure:process.env.SMTP_SECURE==="true",auth:{user:a,pass:n}}})}if(e==="resend"){let i=process.env.RESEND_API_KEY||process.env.SMTP_PASS;return i?new o({provider:"resend",from:t,fromName:s,replyTo:r,resend:{apiKey:i}}):null}if(e==="sendgrid"){let i=process.env.SENDGRID_API_KEY||process.env.SMTP_PASS;return i?new o({provider:"sendgrid",from:t,fromName:s,replyTo:r,sendgrid:{apiKey:i}}):null}if(e==="mailgun"){let i=process.env.MAILGUN_API_KEY||process.env.SMTP_PASS,a=process.env.MAILGUN_DOMAIN||process.env.SMTP_HOST;return !i||!a?null:new o({provider:"mailgun",from:t,fromName:s,replyTo:r,mailgun:{apiKey:i,domain:a,region:process.env.MAILGUN_REGION||(process.env.SMTP_SECURE==="true"?"eu":"us")}})}if(e==="ses"){let i=process.env.AWS_ACCESS_KEY_ID||process.env.SMTP_USER,a=process.env.AWS_SECRET_ACCESS_KEY||process.env.SMTP_PASS,n=process.env.AWS_REGION||process.env.SMTP_HOST||"us-east-1";return !i||!a?null:new o({provider:"ses",from:t,fromName:s,replyTo:r,ses:{accessKeyId:i,secretAccessKey:a,region:n}})}return null}};var _={minLength:12,requireUppercase:true,requireLowercase:true,requireNumbers:true,requireSpecialChars:true,preventReuse:5,maxLength:128},m=class{config;constructor(e={}){this.config={..._,...e};}validate(e){let t=[];return this.config.maxLength&&e.length>this.config.maxLength&&t.push(`Password must not exceed ${this.config.maxLength} characters`),e.length<this.config.minLength&&t.push(`Password must be at least ${this.config.minLength} characters`),this.config.requireUppercase&&!/[A-Z]/.test(e)&&t.push("Password must contain at least one uppercase letter"),this.config.requireLowercase&&!/[a-z]/.test(e)&&t.push("Password must contain at least one lowercase letter"),this.config.requireNumbers&&!/[0-9]/.test(e)&&t.push("Password must contain at least one number"),this.config.requireSpecialChars&&!/[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(e)&&t.push("Password must contain at least one special character"),["password","123456","12345678","qwerty","abc123","monkey","1234567","letmein","trustno1","dragon","baseball","iloveyou","master","sunshine","ashley","football","password1","shadow","123123","654321"].includes(e.toLowerCase())&&t.push("This password is too common. Please choose a more secure password"),(/^[a-zA-Z]+$/.test(e)||/^[0-9]+$/.test(e))&&t.push("Password must contain a mix of letters, numbers, and/or special characters"),/(.)\1{2,}/.test(e)&&t.push("Password must not contain more than 2 consecutive identical characters"),/^(012|123|234|345|456|567|678|789|890|098|987|876|765|654|543|432|321|210)+$/i.test(e)&&t.push("Password must not contain sequential numbers or letters"),{valid:t.length===0,errors:t}}async checkReuse(e,t,s){return {valid:true,errors:[]}}async isInHistory(e,t,s){for(let r of t)if(await s(e,r))return  true;return  false}generatePassword(e=16){let t="ABCDEFGHIJKLMNOPQRSTUVWXYZ",s="abcdefghijklmnopqrstuvwxyz",r="0123456789",i="!@#$%^&*()_+-=[]{}|;:,.<>?",a="";a+=t[Math.floor(Math.random()*t.length)],a+=s[Math.floor(Math.random()*s.length)],a+=r[Math.floor(Math.random()*r.length)],a+=i[Math.floor(Math.random()*i.length)];let n=t+s+r+i;for(let c=a.length;c<e;c++)a+=n[Math.floor(Math.random()*n.length)];return a.split("").sort(()=>Math.random()-.5).join("")}getStrength(e){let t=0,s=[];e.length>=8&&(t+=1),e.length>=12&&(t+=1),e.length>=16&&(t+=1),/[a-z]/.test(e)&&(t+=1),/[A-Z]/.test(e)&&(t+=1),/[0-9]/.test(e)&&(t+=1),/[!@#$%^&*()_+\-=\[\]{}|;:,.<>?]/.test(e)&&(t+=1),e.length>8&&(t+=1),e.length>12&&(t+=1);let r=new Set(e).size;r>6&&(t+=1),r>10&&(t+=1);let i;return t<=3?(i="Weak",s.push("Add more characters"),s.push("Include uppercase and lowercase letters")):t<=5?(i="Fair",s.push("Add special characters"),s.push("Consider making it longer")):t<=7?(i="Good",s.push("Consider making it longer for extra security")):i="Strong",{score:t,label:i,feedback:s}}setConfig(e){this.config={...this.config,...e};}getConfig(){return {...this.config}}};
+exports.a=p;exports.b=h;exports.c=m;

package/dist/chunk-ATLSIYRH.cjs

@@ -0,0 +1 @@
+'use strict';var h=require('bcryptjs'),crypto=require('crypto');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var h__default=/*#__PURE__*/_interopDefault(h);var w=class{db;prefix;sessionTTL;refreshTokenTTL;indexesEnsured=false;constructor(e){this.db=e.db,this.prefix=e.collectionPrefix||"",this.sessionTTL=e.sessionTTL||86400,this.refreshTokenTTL=e.refreshTokenTTL||604800;}col(e){return this.db.collection(`${this.prefix}${e}`)}async connect(){this.indexesEnsured||await this.ensureIndexes();}async disconnect(){}async ensureIndexes(){await this.col("users").createIndex({email:1},{unique:true}),await this.col("users").createIndex({tenantId:1}),await this.col("users").createIndex({role:1}),await this.col("sessions").createIndex({token:1},{unique:true}),await this.col("sessions").createIndex({refreshToken:1}),await this.col("sessions").createIndex({userId:1}),await this.col("sessions").createIndex({expiresAt:1},{expireAfterSeconds:0}),await this.col("audit_logs").createIndex({timestamp:-1}),await this.col("audit_logs").createIndex({userId:1}),await this.col("audit_logs").createIndex({action:1}),await this.col("audit_logs").createIndex({resource:1}),await this.col("password_history").createIndex({userId:1,createdAt:-1}),await this.col("lockouts").createIndex({userId:1},{unique:true}),await this.col("lockouts").createIndex({lockedUntil:1}),this.indexesEnsured=true;}async createUser(e){let s=crypto.randomUUID(),t=new Date,i=await this.hashPassword(e.password),n={_id:s,name:e.name||null,email:e.email.toLowerCase(),passwordHash:i,role:e.role||"customer",avatar:e.avatar||null,tenantId:e.tenantId||null,emailVerified:false,locked:false,lastLogin:null,failedLoginAttempts:0,createdAt:t,updatedAt:t};return await this.col("users").insertOne(n),this.docToAuthUser(n)}async findUserByEmail(e){let s=await this.col("users").findOne({email:e.toLowerCase()});return s?this.docToAuthUser(s):null}async findUserById(e){let s=await this.col("users").findOne({_id:e});return s?this.docToAuthUser(s):null}async updateUser(e,s){let t={updatedAt:new Date};s.name!==void 0&&(t.name=s.name),s.email!==void 0&&(t.email=s.email),s.passwordHash!==void 0&&(t.passwordHash=s.passwordHash),s.role!==void 0&&(t.role=s.role),s.avatar!==void 0&&(t.avatar=s.avatar),s.tenantId!==void 0&&(t.tenantId=s.tenantId),s.emailVerified!==void 0&&(t.emailVerified=s.emailVerified),s.locked!==void 0&&(t.locked=s.locked),s.lastLogin!==void 0&&(t.lastLogin=s.lastLogin?new Date(s.lastLogin):null),s.failedLoginAttempts!==void 0&&(t.failedLoginAttempts=s.failedLoginAttempts);let i=await this.col("users").findOneAndUpdate({_id:e},{$set:t},{returnDocument:"after"});return i?this.docToAuthUser(i):null}async deleteUser(e){return (await this.col("users").deleteOne({_id:e})).deletedCount>0}async verifyPassword(e,s){let t=await this.findUserByEmail(e);if(!t)return null;let i=await this.col("users").findOne({email:e.toLowerCase()},{projection:{passwordHash:1}});return i?.passwordHash&&await h__default.default.compare(s,i.passwordHash)?t:null}async hashPassword(e){return h__default.default.hash(e,12)}async createSession(e,s){let t=crypto.randomUUID(),i=crypto.randomBytes(32).toString("base64url"),n=crypto.randomBytes(32).toString("base64url"),a=new Date,u=new Date(a.getTime()+this.sessionTTL*1e3),d={_id:t,userId:e,token:i,refreshToken:n,ipAddress:s?.ipAddress||null,userAgent:s?.userAgent||null,expiresAt:u,createdAt:a};return await this.col("sessions").insertOne(d),this.docToSession(d)}async findSessionByToken(e){let s=await this.col("sessions").findOne({token:e,expiresAt:{$gt:new Date}});return s?this.docToSession(s):null}async findSessionByRefreshToken(e){let s=await this.col("sessions").findOne({refreshToken:e,expiresAt:{$gt:new Date}});return s?this.docToSession(s):null}async deleteSession(e){return (await this.col("sessions").deleteOne({_id:e})).deletedCount>0}async deleteUserSessions(e){return (await this.col("sessions").deleteMany({userId:e})).deletedCount}async hasAnyUsers(){return await this.col("users").countDocuments()>0}async addPasswordToHistory(e,s){await this.col("password_history").insertOne({userId:e,passwordHash:s,createdAt:new Date});}async getPasswordHistory(e,s=5){return (await this.col("password_history").find({userId:e}).sort({createdAt:-1}).limit(s).toArray()).map(i=>i.passwordHash)}async isPasswordInHistory(e,s,t=5){let i=await this.getPasswordHistory(s,t);for(let n of i)if(await h__default.default.compare(e,n))return  true;return  false}async findAuditLogs(e){let{limit:s=50,offset:t=0,userId:i,action:n,resource:a,resourceId:u,success:d,startDate:c,endDate:f}=e,o={};i&&(o.userId=i),n&&(Array.isArray(n)?o.action={$in:n}:o.action=n),a&&(o.resource=a),u&&(o.resourceId=u),d!==void 0&&(o.success=d),(c||f)&&(o.timestamp={},c&&(o.timestamp.$gte=c),f&&(o.timestamp.$lte=f));let g=await this.col("audit_logs").countDocuments(o);return {logs:(await this.col("audit_logs").find(o).sort({timestamp:-1}).skip(t).limit(s).toArray()).map(r=>({id:r._id,timestamp:r.timestamp,action:r.action,userId:r.userId||void 0,userEmail:r.userEmail||void 0,role:r.role||void 0,resource:r.resource,resourceId:r.resourceId||void 0,changes:r.changes||void 0,ipAddress:r.ipAddress||void 0,userAgent:r.userAgent||void 0,success:r.success,error:r.error||void 0,metadata:r.metadata||void 0})),total:g}}async createAuditLog(e){let s=crypto.randomUUID(),t=new Date;return await this.col("audit_logs").insertOne({_id:s,action:e.action,userId:e.userId||null,userEmail:e.userEmail||null,role:e.role||null,resource:e.resource,resourceId:e.resourceId||null,changes:e.changes||null,ipAddress:e.ipAddress||null,userAgent:e.userAgent||null,success:e.success,error:e.error||null,metadata:e.metadata||null,timestamp:t}),{...e,id:s,timestamp:t}}docToAuthUser(e){return {id:e._id,name:e.name||void 0,email:e.email,passwordHash:e.passwordHash||void 0,role:e.role,tenantId:e.tenantId||void 0,avatar:e.avatar||void 0,emailVerified:e.emailVerified||false,locked:e.locked||false,lastLogin:e.lastLogin?.toISOString?.()||e.lastLogin||void 0,failedLoginAttempts:e.failedLoginAttempts||0,createdAt:e.createdAt?.toISOString?.()||e.createdAt,updatedAt:e.updatedAt?.toISOString?.()||e.updatedAt}}docToSession(e){return {id:e._id,userId:e.userId,token:e.token,refreshToken:e.refreshToken||void 0,expiresAt:e.expiresAt?.toISOString?.()||e.expiresAt,createdAt:e.createdAt?.toISOString?.()||e.createdAt,ipAddress:e.ipAddress||void 0,userAgent:e.userAgent||void 0}}async createEmailVerificationToken(e){let s=crypto.randomBytes(32).toString("hex"),t=new Date(Date.now()+1440*60*1e3);return await this.db.collection("email_verifications").insertOne({userId:new(await import('mongodb')).ObjectId(e),token:s,expiresAt:t,createdAt:new Date}),{token:s,expiresAt:t}}async verifyEmailToken(e){let s=await this.db.collection("email_verifications").findOne({token:e});return s?s.expiresAt<new Date?{success:false,error:"Verification token has expired"}:(await this.db.collection("users").updateOne({_id:s.userId},{$set:{emailVerified:true}}),await this.db.collection("email_verifications").deleteOne({_id:s._id}),{success:true,userId:s.userId.toString()}):{success:false,error:"Invalid verification token"}}async createPasswordResetToken(e){let s=await this.findUserByEmail(e);if(!s)return {token:"",expiresAt:new Date,error:"User not found"};let t=crypto.randomBytes(32).toString("hex"),i=new Date(Date.now()+3600*1e3);return await this.db.collection("password_resets").insertOne({userId:new(await import('mongodb')).ObjectId(s.id),token:t,expiresAt:i,createdAt:new Date}),{token:t,expiresAt:i}}async resetPasswordWithToken(e,s){let t=await this.db.collection("password_resets").findOne({token:e});if(!t)return {success:false,error:"Invalid reset token"};if(t.expiresAt<new Date)return {success:false,error:"Reset token has expired"};if(t.usedAt)return {success:false,error:"Reset token has already been used"};let i=await this.hashPassword(s);return await this.db.collection("users").updateOne({_id:t.userId},{$set:{passwordHash:i,updatedAt:new Date}}),await this.db.collection("password_resets").updateOne({_id:t._id},{$set:{usedAt:new Date}}),await this.db.collection("sessions").deleteMany({userId:t.userId}),{success:true}}};exports.a=w;