@kyro-cms/core 0.12.45 → 0.12.47
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/api-handler-graphql.cjs +1 -1
- package/dist/api-handler-graphql.js +1 -1
- package/dist/api-handler-trpc.cjs +1 -1
- package/dist/api-handler-trpc.js +1 -1
- package/dist/api-handler.cjs +1 -1
- package/dist/api-handler.js +1 -1
- package/dist/{chunk-ZYDOF65Q.cjs → chunk-F3MCWKOW.cjs} +1 -1
- package/dist/{chunk-UK43ADRO.js → chunk-FYPEL7XW.js} +1 -1
- package/dist/{chunk-FLM37UVD.js → chunk-MPGROUMH.js} +1 -1
- package/dist/{chunk-6V3AP7HR.cjs → chunk-QN5ULXBX.cjs} +1 -1
- package/dist/{chunk-M6ESQ5TE.cjs → chunk-R4N352LI.cjs} +3 -3
- package/dist/{chunk-7SSFHJTR.js → chunk-XSRISWOY.js} +1 -1
- package/dist/index.cjs +3 -3
- package/dist/index.js +1 -1
- package/dist/rest/index.cjs +1 -1
- package/dist/rest/index.js +1 -1
- package/package.json +2 -2
|
@@ -1 +1 @@
|
|
|
1
|
-
'use strict';var
|
|
1
|
+
'use strict';var chunkF3MCWKOW_cjs=require('./chunk-F3MCWKOW.cjs');require('./chunk-R4N352LI.cjs'),require('./chunk-QYI3GOHF.cjs'),require('./chunk-7GGZA5YU.cjs'),require('./chunk-5LPNEYK5.cjs'),require('./chunk-MP5VC5ER.cjs'),require('./chunk-VOQUO2EZ.cjs'),require('./chunk-QN5ULXBX.cjs'),require('./chunk-P7XYIKL6.cjs'),require('./chunk-HPYH7GTS.cjs'),require('./chunk-BHR7OAU4.cjs'),require('./chunk-XPPVX4GQ.cjs'),require('./chunk-35PGCW3S.cjs'),require('./chunk-UNYXWPLZ.cjs'),require('./chunk-PITMDQYN.cjs'),require('./chunk-GIS6X43A.cjs'),require('./chunk-LEBM6ZSZ.cjs'),require('./chunk-GNEVCEJU.cjs'),require('./chunk-ZO3YB5DK.cjs'),require('./chunk-3VXEK5ZW.cjs'),require('./chunk-EZIDQBXI.cjs'),require('./chunk-LQ3YZTPU.cjs'),require('./chunk-MVX2PYJJ.cjs'),require('./chunk-AK754S3T.cjs'),require('./chunk-DUO523BH.cjs'),require('./chunk-WCFHS7EZ.cjs'),require('./chunk-73D2PNHD.cjs'),require('./chunk-AMGJ5AFH.cjs'),require('./chunk-6KUL2BSA.cjs'),require('./chunk-KCHPADCH.cjs'),require('./chunk-LY7N3UHH.cjs'),require('./chunk-7ACHOBWY.cjs'),require('./chunk-GNOSG3PK.cjs'),require('./chunk-B3GDQ7UI.cjs'),require('./chunk-7JWQ2PZP.cjs'),require('./chunk-BAVN7VDR.cjs'),require('./chunk-NGNJSUGL.cjs'),require('./chunk-BCEE4NBZ.cjs'),require('./chunk-VRZC4TTF.cjs'),require('./chunk-QDHP5E4P.cjs'),require('./chunk-5DWYVUQR.cjs'),require('./chunk-VQ53TFYA.cjs'),require('./chunk-F4ITQ6XQ.cjs'),require('./chunk-HTYVI2HK.cjs'),require('./chunk-ZOVH6QT5.cjs'),require('./chunk-7WMMKGEO.cjs');var chunkBUNLC3II_cjs=require('./chunk-BUNLC3II.cjs');chunkBUNLC3II_cjs.h();function n(e){return new Response(e.body,e)}var i={graphqlEnabled:false,trpcEnabled:false,wsEnabled:false,requireAuth:false};function o(){return new Response(JSON.stringify({error:"GraphQL is disabled"}),{status:503,headers:{"Content-Type":"application/json"}})}async function c(){try{return (await chunkF3MCWKOW_cjs.a.db.findOne({collection:"_globals_access-settings",where:{},draft:!0}))?.apiAccess?.graphqlEnabled??i.graphqlEnabled}catch{return true}}var d=async e=>{if(await chunkF3MCWKOW_cjs.b(e),!await c())return o();let s=await chunkF3MCWKOW_cjs.a.getGraphQL().fetch(e.request,e.locals);return n(s)},f=async e=>{if(await chunkF3MCWKOW_cjs.b(e),!await c())return o();let s=await chunkF3MCWKOW_cjs.a.getGraphQL().fetch(e.request,e.locals);return n(s)};exports.GET=f;exports.POST=d;
|
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
import {createRequire}from'module';import {b,a}from'./chunk-
|
|
1
|
+
import {createRequire}from'module';import {b,a}from'./chunk-MPGROUMH.js';import'./chunk-XSRISWOY.js';import'./chunk-DS5DE5BU.js';import'./chunk-R3NEPC4I.js';import'./chunk-IPXOY4RI.js';import'./chunk-JUJZOG6P.js';import'./chunk-7T35572E.js';import'./chunk-FYPEL7XW.js';import'./chunk-45TJAB5X.js';import'./chunk-R4LXRAMX.js';import'./chunk-XBH4YMC7.js';import'./chunk-PL5AIE6F.js';import'./chunk-MY42EWZP.js';import'./chunk-KH7LM52S.js';import'./chunk-SYEP5QLG.js';import'./chunk-7I6URA6F.js';import'./chunk-A73AVVFR.js';import'./chunk-XOACKBG7.js';import'./chunk-2WFTETFB.js';import'./chunk-ATBH763U.js';import'./chunk-ICVQWR2A.js';import'./chunk-OSAVAYJZ.js';import'./chunk-UD6ZPO7T.js';import'./chunk-NWCREF47.js';import'./chunk-E27KEZPT.js';import'./chunk-6MSS5X77.js';import'./chunk-WSP7PSXC.js';import'./chunk-UB5TJHQR.js';import'./chunk-ZJE3VAAW.js';import'./chunk-WGESLAWV.js';import'./chunk-HT44I66C.js';import'./chunk-OMWQVPV7.js';import'./chunk-VBPAAQEF.js';import'./chunk-SVYUTQVE.js';import'./chunk-VIUU4D5I.js';import'./chunk-66BJXVFJ.js';import'./chunk-2BUODBE2.js';import'./chunk-IP6JUEH3.js';import'./chunk-7AQSH3KR.js';import'./chunk-EOOZDOL7.js';import'./chunk-6QWLXJ7L.js';import'./chunk-MCZ3YZ2L.js';import'./chunk-CGPAS4U5.js';import'./chunk-BPMA2ECA.js';import'./chunk-BLH2MRK4.js';import'./chunk-6KRR7YHA.js';import {g}from'./chunk-C2PXMVR5.js';createRequire(import.meta.url);
|
|
2
2
|
g();function n(e){return new Response(e.body,e)}var i={graphqlEnabled:false,trpcEnabled:false,wsEnabled:false,requireAuth:false};function o(){return new Response(JSON.stringify({error:"GraphQL is disabled"}),{status:503,headers:{"Content-Type":"application/json"}})}async function c(){try{return (await a.db.findOne({collection:"_globals_access-settings",where:{},draft:!0}))?.apiAccess?.graphqlEnabled??i.graphqlEnabled}catch{return true}}var f=async e=>{if(await b(e),!await c())return o();let s=await a.getGraphQL().fetch(e.request,e.locals);return n(s)},h=async e=>{if(await b(e),!await c())return o();let s=await a.getGraphQL().fetch(e.request,e.locals);return n(s)};export{h as GET,f as POST};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
'use strict';var
|
|
1
|
+
'use strict';var chunkF3MCWKOW_cjs=require('./chunk-F3MCWKOW.cjs');require('./chunk-R4N352LI.cjs'),require('./chunk-QYI3GOHF.cjs'),require('./chunk-7GGZA5YU.cjs'),require('./chunk-5LPNEYK5.cjs'),require('./chunk-MP5VC5ER.cjs'),require('./chunk-VOQUO2EZ.cjs'),require('./chunk-QN5ULXBX.cjs'),require('./chunk-P7XYIKL6.cjs'),require('./chunk-HPYH7GTS.cjs'),require('./chunk-BHR7OAU4.cjs'),require('./chunk-XPPVX4GQ.cjs'),require('./chunk-35PGCW3S.cjs'),require('./chunk-UNYXWPLZ.cjs'),require('./chunk-PITMDQYN.cjs'),require('./chunk-GIS6X43A.cjs'),require('./chunk-LEBM6ZSZ.cjs'),require('./chunk-GNEVCEJU.cjs'),require('./chunk-ZO3YB5DK.cjs'),require('./chunk-3VXEK5ZW.cjs'),require('./chunk-EZIDQBXI.cjs'),require('./chunk-LQ3YZTPU.cjs'),require('./chunk-MVX2PYJJ.cjs'),require('./chunk-AK754S3T.cjs'),require('./chunk-DUO523BH.cjs'),require('./chunk-WCFHS7EZ.cjs'),require('./chunk-73D2PNHD.cjs'),require('./chunk-AMGJ5AFH.cjs'),require('./chunk-6KUL2BSA.cjs'),require('./chunk-KCHPADCH.cjs'),require('./chunk-LY7N3UHH.cjs'),require('./chunk-7ACHOBWY.cjs'),require('./chunk-GNOSG3PK.cjs'),require('./chunk-B3GDQ7UI.cjs'),require('./chunk-7JWQ2PZP.cjs'),require('./chunk-BAVN7VDR.cjs'),require('./chunk-NGNJSUGL.cjs'),require('./chunk-BCEE4NBZ.cjs'),require('./chunk-VRZC4TTF.cjs'),require('./chunk-QDHP5E4P.cjs'),require('./chunk-5DWYVUQR.cjs'),require('./chunk-VQ53TFYA.cjs'),require('./chunk-F4ITQ6XQ.cjs'),require('./chunk-HTYVI2HK.cjs'),require('./chunk-ZOVH6QT5.cjs'),require('./chunk-7WMMKGEO.cjs');var chunkBUNLC3II_cjs=require('./chunk-BUNLC3II.cjs');chunkBUNLC3II_cjs.h();function n(){return new Response(JSON.stringify({error:"tRPC is disabled"}),{status:503,headers:{"Content-Type":"application/json"}})}var s={graphqlEnabled:false,trpcEnabled:false,wsEnabled:false,requireAuth:false};async function o(){try{return (await chunkF3MCWKOW_cjs.a.db.findOne({collection:"_globals_access-settings",where:{},draft:!0}))?.apiAccess?.trpcEnabled??s.trpcEnabled}catch{return true}}var p=async e=>(await chunkF3MCWKOW_cjs.b(e),await o()?chunkF3MCWKOW_cjs.a.getTRPC().fetch(e.request,e.locals):n());exports.ALL=p;
|
package/dist/api-handler-trpc.js
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
import {createRequire}from'module';import {b,a}from'./chunk-
|
|
1
|
+
import {createRequire}from'module';import {b,a}from'./chunk-MPGROUMH.js';import'./chunk-XSRISWOY.js';import'./chunk-DS5DE5BU.js';import'./chunk-R3NEPC4I.js';import'./chunk-IPXOY4RI.js';import'./chunk-JUJZOG6P.js';import'./chunk-7T35572E.js';import'./chunk-FYPEL7XW.js';import'./chunk-45TJAB5X.js';import'./chunk-R4LXRAMX.js';import'./chunk-XBH4YMC7.js';import'./chunk-PL5AIE6F.js';import'./chunk-MY42EWZP.js';import'./chunk-KH7LM52S.js';import'./chunk-SYEP5QLG.js';import'./chunk-7I6URA6F.js';import'./chunk-A73AVVFR.js';import'./chunk-XOACKBG7.js';import'./chunk-2WFTETFB.js';import'./chunk-ATBH763U.js';import'./chunk-ICVQWR2A.js';import'./chunk-OSAVAYJZ.js';import'./chunk-UD6ZPO7T.js';import'./chunk-NWCREF47.js';import'./chunk-E27KEZPT.js';import'./chunk-6MSS5X77.js';import'./chunk-WSP7PSXC.js';import'./chunk-UB5TJHQR.js';import'./chunk-ZJE3VAAW.js';import'./chunk-WGESLAWV.js';import'./chunk-HT44I66C.js';import'./chunk-OMWQVPV7.js';import'./chunk-VBPAAQEF.js';import'./chunk-SVYUTQVE.js';import'./chunk-VIUU4D5I.js';import'./chunk-66BJXVFJ.js';import'./chunk-2BUODBE2.js';import'./chunk-IP6JUEH3.js';import'./chunk-7AQSH3KR.js';import'./chunk-EOOZDOL7.js';import'./chunk-6QWLXJ7L.js';import'./chunk-MCZ3YZ2L.js';import'./chunk-CGPAS4U5.js';import'./chunk-BPMA2ECA.js';import'./chunk-BLH2MRK4.js';import'./chunk-6KRR7YHA.js';import {g}from'./chunk-C2PXMVR5.js';createRequire(import.meta.url);
|
|
2
2
|
g();function n(){return new Response(JSON.stringify({error:"tRPC is disabled"}),{status:503,headers:{"Content-Type":"application/json"}})}var s={graphqlEnabled:false,trpcEnabled:false,wsEnabled:false,requireAuth:false};async function o(){try{return (await a.db.findOne({collection:"_globals_access-settings",where:{},draft:!0}))?.apiAccess?.trpcEnabled??s.trpcEnabled}catch{return true}}var d=async e=>(await b(e),await o()?a.getTRPC().fetch(e.request,e.locals):n());export{d as ALL};
|
package/dist/api-handler.cjs
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
'use strict';var
|
|
1
|
+
'use strict';var chunkF3MCWKOW_cjs=require('./chunk-F3MCWKOW.cjs');require('./chunk-R4N352LI.cjs'),require('./chunk-QYI3GOHF.cjs'),require('./chunk-7GGZA5YU.cjs'),require('./chunk-5LPNEYK5.cjs'),require('./chunk-MP5VC5ER.cjs'),require('./chunk-VOQUO2EZ.cjs'),require('./chunk-QN5ULXBX.cjs'),require('./chunk-P7XYIKL6.cjs'),require('./chunk-HPYH7GTS.cjs'),require('./chunk-BHR7OAU4.cjs'),require('./chunk-XPPVX4GQ.cjs'),require('./chunk-35PGCW3S.cjs'),require('./chunk-UNYXWPLZ.cjs'),require('./chunk-PITMDQYN.cjs'),require('./chunk-GIS6X43A.cjs'),require('./chunk-LEBM6ZSZ.cjs'),require('./chunk-GNEVCEJU.cjs'),require('./chunk-ZO3YB5DK.cjs'),require('./chunk-3VXEK5ZW.cjs'),require('./chunk-EZIDQBXI.cjs'),require('./chunk-LQ3YZTPU.cjs'),require('./chunk-MVX2PYJJ.cjs'),require('./chunk-AK754S3T.cjs'),require('./chunk-DUO523BH.cjs'),require('./chunk-WCFHS7EZ.cjs'),require('./chunk-73D2PNHD.cjs'),require('./chunk-AMGJ5AFH.cjs'),require('./chunk-6KUL2BSA.cjs'),require('./chunk-KCHPADCH.cjs'),require('./chunk-LY7N3UHH.cjs'),require('./chunk-7ACHOBWY.cjs'),require('./chunk-GNOSG3PK.cjs'),require('./chunk-B3GDQ7UI.cjs'),require('./chunk-7JWQ2PZP.cjs'),require('./chunk-BAVN7VDR.cjs'),require('./chunk-NGNJSUGL.cjs'),require('./chunk-BCEE4NBZ.cjs'),require('./chunk-VRZC4TTF.cjs'),require('./chunk-QDHP5E4P.cjs'),require('./chunk-5DWYVUQR.cjs'),require('./chunk-VQ53TFYA.cjs'),require('./chunk-F4ITQ6XQ.cjs'),require('./chunk-HTYVI2HK.cjs'),require('./chunk-ZOVH6QT5.cjs'),require('./chunk-7WMMKGEO.cjs'),require('./chunk-BUNLC3II.cjs');Object.defineProperty(exports,"ALL",{enumerable:true,get:function(){return chunkF3MCWKOW_cjs.c}});Object.defineProperty(exports,"kyroInstance",{enumerable:true,get:function(){return chunkF3MCWKOW_cjs.a}});Object.defineProperty(exports,"warmKyroInstance",{enumerable:true,get:function(){return chunkF3MCWKOW_cjs.b}});
|
package/dist/api-handler.js
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
import {createRequire}from'module';export{c as ALL,a as kyroInstance,b as warmKyroInstance}from'./chunk-
|
|
1
|
+
import {createRequire}from'module';export{c as ALL,a as kyroInstance,b as warmKyroInstance}from'./chunk-MPGROUMH.js';import'./chunk-XSRISWOY.js';import'./chunk-DS5DE5BU.js';import'./chunk-R3NEPC4I.js';import'./chunk-IPXOY4RI.js';import'./chunk-JUJZOG6P.js';import'./chunk-7T35572E.js';import'./chunk-FYPEL7XW.js';import'./chunk-45TJAB5X.js';import'./chunk-R4LXRAMX.js';import'./chunk-XBH4YMC7.js';import'./chunk-PL5AIE6F.js';import'./chunk-MY42EWZP.js';import'./chunk-KH7LM52S.js';import'./chunk-SYEP5QLG.js';import'./chunk-7I6URA6F.js';import'./chunk-A73AVVFR.js';import'./chunk-XOACKBG7.js';import'./chunk-2WFTETFB.js';import'./chunk-ATBH763U.js';import'./chunk-ICVQWR2A.js';import'./chunk-OSAVAYJZ.js';import'./chunk-UD6ZPO7T.js';import'./chunk-NWCREF47.js';import'./chunk-E27KEZPT.js';import'./chunk-6MSS5X77.js';import'./chunk-WSP7PSXC.js';import'./chunk-UB5TJHQR.js';import'./chunk-ZJE3VAAW.js';import'./chunk-WGESLAWV.js';import'./chunk-HT44I66C.js';import'./chunk-OMWQVPV7.js';import'./chunk-VBPAAQEF.js';import'./chunk-SVYUTQVE.js';import'./chunk-VIUU4D5I.js';import'./chunk-66BJXVFJ.js';import'./chunk-2BUODBE2.js';import'./chunk-IP6JUEH3.js';import'./chunk-7AQSH3KR.js';import'./chunk-EOOZDOL7.js';import'./chunk-6QWLXJ7L.js';import'./chunk-MCZ3YZ2L.js';import'./chunk-CGPAS4U5.js';import'./chunk-BPMA2ECA.js';import'./chunk-BLH2MRK4.js';import'./chunk-6KRR7YHA.js';import'./chunk-C2PXMVR5.js';createRequire(import.meta.url);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
'use strict';var
|
|
1
|
+
'use strict';var chunkR4N352LI_cjs=require('./chunk-R4N352LI.cjs'),chunkQYI3GOHF_cjs=require('./chunk-QYI3GOHF.cjs'),chunkQN5ULXBX_cjs=require('./chunk-QN5ULXBX.cjs'),chunkBHR7OAU4_cjs=require('./chunk-BHR7OAU4.cjs'),chunk6KUL2BSA_cjs=require('./chunk-6KUL2BSA.cjs'),chunkB3GDQ7UI_cjs=require('./chunk-B3GDQ7UI.cjs'),chunk5DWYVUQR_cjs=require('./chunk-5DWYVUQR.cjs'),chunkBUNLC3II_cjs=require('./chunk-BUNLC3II.cjs'),w=require('kyro:config');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var w__default=/*#__PURE__*/_interopDefault(w);chunkBUNLC3II_cjs.h();exports.a=null;var l=null;async function b(){if(!exports.a){if(globalThis.__KYRO_INSTANCE__)try{await globalThis.__KYRO_INSTANCE__.shutdown();}catch{}try{let e=w__default.default.default||w__default.default,t=e.adapter,o=t&&!t.dialect&&typeof t.connect=="function";if(globalThis.DB&&(!t||o)){let s=globalThis.DB;e.adapter=new chunk6KUL2BSA_cjs.c({type:"sqlite",client:s}),chunkR4N352LI_cjs.C.info("Hot-swapped to D1 DrizzleAdapter");}exports.a=chunkR4N352LI_cjs.A(e);let a=e.adapter,p=a&&a.dialect&&(a.dialect==="postgres"||a.dialect==="sqlite"),c=a&&a.dialect==="mongodb",n;if(p)a.dialect==="postgres"?n=new chunkB3GDQ7UI_cjs.a({db:a.client}):a.dialect==="sqlite"&&(n=new chunkQN5ULXBX_cjs.nb({db:a.rawClient||a.client}));else if(o&&!globalThis.DB){let s=process.env.KYRO_AUTH_DB_PATH||"./data/auth.db";n=new chunkBHR7OAU4_cjs.a({path:s});}else c&&(n=new chunk5DWYVUQR_cjs.a({db:a.client}));if(n?.connect)try{await n.connect();}catch(s){chunkR4N352LI_cjs.C.warn("Auth connect warning:",s);}await exports.a.init();try{await exports.a.loadSettings();}catch(s){chunkR4N352LI_cjs.C.warn("loadSettings warning:",s);}try{await chunkQYI3GOHF_cjs.e(n);}catch(s){chunkR4N352LI_cjs.C.warn("autoBootstrap warning:",s);}globalThis.__KYRO_INSTANCE__=exports.a;}catch(e){throw exports.a=null,l=null,chunkR4N352LI_cjs.C.error("Init failed, will retry:",e),e}}}async function E(e){let t=globalThis.DB?globalThis:null;try{let{env:o}=await import('cloudflare:workers');o&&(t=o);}catch{}if(e)try{t=e.locals?.cfContext?.env||e?.env||t;}catch{}if(!t)try{t=process.env;}catch{}t?.DB&&(globalThis.DB=t.DB),t?.STORAGE_BUCKET&&(globalThis.STORAGE_BUCKET=t.STORAGE_BUCKET),l||(l=b()),await l;}var _={graphqlEnabled:false,trpcEnabled:false,wsEnabled:false,requireAuth:false};function T(e){return exports.a?exports.a.settings?.access?.apiAccess?.[e]??_[e]??true:_[e]??true}var q=async e=>{if(!exports.a)try{await Promise.race([E(e),new Promise((t,o)=>setTimeout(()=>o(new Error("Initialization timeout")),3e4))]);}catch(t){return console.error("[Kyro API] Warm error:",t?.stack||t?.message||t),new Response(JSON.stringify({error:"Service Unavailable",message:"Kyro CMS is still starting up. Please try again in a moment."}),{status:503,headers:{"Content-Type":"application/json","Retry-After":"5"}})}try{let o=new URL(e.request.url).pathname,a=__KYRO_API_PATH__;if(o===`${a}/graphql`&&typeof exports.a.getGraphQL=="function"){if(!T("graphqlEnabled"))return new Response(JSON.stringify({error:"GraphQL is disabled"}),{status:503,headers:{"Content-Type":"application/json"}});let n=await exports.a.getGraphQL().fetch(e.request,e.locals);return new Response(n.body,n)}if(o.startsWith(`${a}/trpc/`)&&typeof exports.a.getTRPC=="function"){if(!T("trpcEnabled"))return new Response(JSON.stringify({error:"tRPC is disabled"}),{status:503,headers:{"Content-Type":"application/json"}});let n=await exports.a.getTRPC().fetch(e.request,e.locals);return new Response(n.body,n)}return await(await exports.a.getREST()).fetch(e.request,e.locals)}catch(t){return console.error("[Kyro API Execution Error]:",t?.stack||t?.message||t),new Response(JSON.stringify({error:"Internal Server Error",message:t?.message||String(t),stack:t?.stack}),{status:500,headers:{"Content-Type":"application/json"}})}};exports.b=E;exports.c=q;
|
|
@@ -122,7 +122,7 @@ function r5(t){fu=t;}async function ym(){if(fu)try{let t=await fu.findOne({colle
|
|
|
122
122
|
]))`;continue}}if(r.s&&s[p]==="."){n+=i?`${s[p]}\r
|
|
123
123
|
`:`[${s[p]}\r
|
|
124
124
|
]`;continue}n+=s[p],s[p]==="\\"?o=true:i&&s[p]==="]"?i=false:!i&&s[p]==="["&&(i=true);}try{new RegExp(n);}catch{return console.warn(`Could not convert regex pattern at ${e.currentPath.join("/")} to a flag-independent form! Falling back to the flag-ignorant source`),t.source}return n}function Nc(t,e){if(e.target==="openAi"&&console.warn("Warning: OpenAI may not support records in schemas! Try an array of key-value pairs instead."),e.target==="openApi3"&&t.keyType?._def.typeName===F.ZodEnum)return {type:"object",required:t.keyType._def.values,properties:t.keyType._def.values.reduce((s,n)=>({...s,[n]:ne(t.valueType._def,{...e,currentPath:[...e.currentPath,"properties",n]})??$e(e)}),{}),additionalProperties:e.rejectedAdditionalProperties};let r={type:"object",additionalProperties:ne(t.valueType._def,{...e,currentPath:[...e.currentPath,"additionalProperties"]})??e.allowedAdditionalProperties};if(e.target==="openApi3")return r;if(t.keyType?._def.typeName===F.ZodString&&t.keyType._def.checks?.length){let{type:s,...n}=Bc(t.keyType._def,e);return {...r,propertyNames:n}}else {if(t.keyType?._def.typeName===F.ZodEnum)return {...r,propertyNames:{enum:t.keyType._def.values}};if(t.keyType?._def.typeName===F.ZodBranded&&t.keyType._def.type._def.typeName===F.ZodString&&t.keyType._def.type._def.checks?.length){let{type:s,...n}=$c(t.keyType._def,e);return {...r,propertyNames:n}}}return r}function p_(t,e){if(e.mapStrategy==="record")return Nc(t,e);let r=ne(t.keyType._def,{...e,currentPath:[...e.currentPath,"items","items","0"]})||$e(e),s=ne(t.valueType._def,{...e,currentPath:[...e.currentPath,"items","items","1"]})||$e(e);return {type:"array",maxItems:125,items:{type:"array",items:[r,s],minItems:2,maxItems:2}}}g();function f_(t){let e=t.values,s=Object.keys(t.values).filter(o=>typeof e[e[o]]!="number").map(o=>e[o]),n=Array.from(new Set(s.map(o=>typeof o)));return {type:n.length===1?n[0]==="string"?"string":"number":["string","number"],enum:s}}g();function m_(t){return t.target==="openAi"?void 0:{not:$e({...t,currentPath:[...t.currentPath,"not"]})}}g();function h_(t){return t.target==="openApi3"?{enum:["null"],nullable:true}:{type:"null"}}g();g();var la={ZodString:"string",ZodNumber:"number",ZodBigInt:"integer",ZodBoolean:"boolean",ZodNull:"null"};function y_(t,e){if(e.target==="openApi3")return g_(t,e);let r=t.options instanceof Map?Array.from(t.options.values()):t.options;if(r.every(s=>s._def.typeName in la&&(!s._def.checks||!s._def.checks.length))){let s=r.reduce((n,o)=>{let i=la[o._def.typeName];return i&&!n.includes(i)?[...n,i]:n},[]);return {type:s.length>1?s:s[0]}}else if(r.every(s=>s._def.typeName==="ZodLiteral"&&!s.description)){let s=r.reduce((n,o)=>{let i=typeof o._def.value;switch(i){case "string":case "number":case "boolean":return [...n,i];case "bigint":return [...n,"integer"];case "object":if(o._def.value===null)return [...n,"null"];default:return n}},[]);if(s.length===r.length){let n=s.filter((o,i,c)=>c.indexOf(o)===i);return {type:n.length>1?n:n[0],enum:r.reduce((o,i)=>o.includes(i._def.value)?o:[...o,i._def.value],[])}}}else if(r.every(s=>s._def.typeName==="ZodEnum"))return {type:"string",enum:r.reduce((s,n)=>[...s,...n._def.values.filter(o=>!s.includes(o))],[])};return g_(t,e)}var g_=(t,e)=>{let r=(t.options instanceof Map?Array.from(t.options.values()):t.options).map((s,n)=>ne(s._def,{...e,currentPath:[...e.currentPath,"anyOf",`${n}`]})).filter(s=>!!s&&(!e.strictUnions||typeof s=="object"&&Object.keys(s).length>0));return r.length?{anyOf:r}:void 0};function x_(t,e){if(["ZodString","ZodNumber","ZodBigInt","ZodBoolean","ZodNull"].includes(t.innerType._def.typeName)&&(!t.innerType._def.checks||!t.innerType._def.checks.length))return e.target==="openApi3"?{type:la[t.innerType._def.typeName],nullable:true}:{type:[la[t.innerType._def.typeName],"null"]};if(e.target==="openApi3"){let s=ne(t.innerType._def,{...e,currentPath:[...e.currentPath]});return s&&"$ref"in s?{allOf:[s],nullable:true}:s&&{...s,nullable:true}}let r=ne(t.innerType._def,{...e,currentPath:[...e.currentPath,"anyOf","0"]});return r&&{anyOf:[r,{type:"null"}]}}g();function w_(t,e){let r={type:"number"};if(!t.checks)return r;for(let s of t.checks)switch(s.kind){case "int":r.type="integer",Od(r,"type",s.message,e);break;case "min":e.target==="jsonSchema7"?s.inclusive?he(r,"minimum",s.value,s.message,e):he(r,"exclusiveMinimum",s.value,s.message,e):(s.inclusive||(r.exclusiveMinimum=true),he(r,"minimum",s.value,s.message,e));break;case "max":e.target==="jsonSchema7"?s.inclusive?he(r,"maximum",s.value,s.message,e):he(r,"exclusiveMaximum",s.value,s.message,e):(s.inclusive||(r.exclusiveMaximum=true),he(r,"maximum",s.value,s.message,e));break;case "multipleOf":he(r,"multipleOf",s.value,s.message,e);break}return r}g();function __(t,e){let r=e.target==="openAi",s={type:"object",properties:{}},n=[],o=t.shape();for(let c in o){let p=o[c];if(p===void 0||p._def===void 0)continue;let d=jN(p);d&&r&&(p._def.typeName==="ZodOptional"&&(p=p._def.innerType),p.isNullable()||(p=p.nullable()),d=false);let x=ne(p._def,{...e,currentPath:[...e.currentPath,"properties",c],propertyPath:[...e.currentPath,"properties",c]});x!==void 0&&(s.properties[c]=x,d||n.push(c));}n.length&&(s.required=n);let i=MN(t,e);return i!==void 0&&(s.additionalProperties=i),s}function MN(t,e){if(t.catchall._def.typeName!=="ZodNever")return ne(t.catchall._def,{...e,currentPath:[...e.currentPath,"additionalProperties"]});switch(t.unknownKeys){case "passthrough":return e.allowedAdditionalProperties;case "strict":return e.rejectedAdditionalProperties;case "strip":return e.removeAdditionalStrategy==="strict"?e.allowedAdditionalProperties:e.rejectedAdditionalProperties}}function jN(t){try{return t.isOptional()}catch{return true}}g();var v_=(t,e)=>{if(e.currentPath.toString()===e.propertyPath?.toString())return ne(t.innerType._def,e);let r=ne(t.innerType._def,{...e,currentPath:[...e.currentPath,"anyOf","1"]});return r?{anyOf:[{not:$e(e)},r]}:$e(e)};g();var b_=(t,e)=>{if(e.pipeStrategy==="input")return ne(t.in._def,e);if(e.pipeStrategy==="output")return ne(t.out._def,e);let r=ne(t.in._def,{...e,currentPath:[...e.currentPath,"allOf","0"]}),s=ne(t.out._def,{...e,currentPath:[...e.currentPath,"allOf",r?"1":"0"]});return {allOf:[r,s].filter(n=>n!==void 0)}};g();function S_(t,e){return ne(t.type._def,e)}g();function A_(t,e){let s={type:"array",uniqueItems:true,items:ne(t.valueType._def,{...e,currentPath:[...e.currentPath,"items"]})};return t.minSize&&he(s,"minItems",t.minSize.value,t.minSize.message,e),t.maxSize&&he(s,"maxItems",t.maxSize.value,t.maxSize.message,e),s}g();function R_(t,e){return t.rest?{type:"array",minItems:t.items.length,items:t.items.map((r,s)=>ne(r._def,{...e,currentPath:[...e.currentPath,"items",`${s}`]})).reduce((r,s)=>s===void 0?r:[...r,s],[]),additionalItems:ne(t.rest._def,{...e,currentPath:[...e.currentPath,"additionalItems"]})}:{type:"array",minItems:t.items.length,maxItems:t.items.length,items:t.items.map((r,s)=>ne(r._def,{...e,currentPath:[...e.currentPath,"items",`${s}`]})).reduce((r,s)=>s===void 0?r:[...r,s],[])}}g();function E_(t){return {not:$e(t)}}g();function C_(t){return $e(t)}g();var k_=(t,e)=>ne(t.innerType._def,e);var T_=(t,e,r)=>{switch(e){case F.ZodString:return Bc(t,r);case F.ZodNumber:return w_(t,r);case F.ZodObject:return __(t,r);case F.ZodBigInt:return s_(t,r);case F.ZodBoolean:return n_();case F.ZodDate:return jd(t,r);case F.ZodUndefined:return E_(r);case F.ZodNull:return h_(r);case F.ZodArray:return r_(t,r);case F.ZodUnion:case F.ZodDiscriminatedUnion:return y_(t,r);case F.ZodIntersection:return u_(t,r);case F.ZodTuple:return R_(t,r);case F.ZodRecord:return Nc(t,r);case F.ZodLiteral:return l_(t,r);case F.ZodEnum:return c_(t);case F.ZodNativeEnum:return f_(t);case F.ZodNullable:return x_(t,r);case F.ZodOptional:return v_(t,r);case F.ZodMap:return p_(t,r);case F.ZodSet:return A_(t,r);case F.ZodLazy:return ()=>t.getter()._def;case F.ZodPromise:return S_(t,r);case F.ZodNaN:case F.ZodNever:return m_(r);case F.ZodEffects:return i_(t,r);case F.ZodAny:return $e(r);case F.ZodUnknown:return C_(r);case F.ZodDefault:return a_(t,r);case F.ZodBranded:return $c(t,r);case F.ZodReadonly:return k_(t,r);case F.ZodCatch:return o_(t,r);case F.ZodPipeline:return b_(t,r);case F.ZodFunction:case F.ZodVoid:case F.ZodSymbol:return;default:return (s=>{})()}};function ne(t,e,r=false){let s=e.seen.get(t);if(e.override){let c=e.override?.(t,e,s,r);if(c!==Kw)return c}if(s&&!r){let c=UN(s,e);if(c!==void 0)return c}let n={def:t,path:e.currentPath,jsonSchema:void 0};e.seen.set(t,n);let o=T_(t,t.typeName,e),i=typeof o=="function"?ne(o(),e):o;if(i&&qN(t,e,i),e.postProcess){let c=e.postProcess(i,t,e);return n.jsonSchema=i,c}return n.jsonSchema=i,i}var UN=(t,e)=>{switch(e.$refStrategy){case "root":return {$ref:t.path.join("/")};case "relative":return {$ref:Oc(e.currentPath,t.path)};case "none":case "seen":return t.path.length<e.currentPath.length&&t.path.every((r,s)=>e.currentPath[s]===r)?(console.warn(`Recursive reference detected at ${e.currentPath.join("/")}! Defaulting to any`),$e(e)):e.$refStrategy==="seen"?$e(e):void 0}},qN=(t,e,r)=>(t.description&&(r.description=t.description,e.markdownDescription&&(r.markdownDescription=t.description)),r);g();g();var ro=(t,e)=>{let r=Ww(e),s=typeof e=="object"&&e.definitions?Object.entries(e.definitions).reduce((p,[d,x])=>({...p,[d]:ne(x._def,{...r,currentPath:[...r.basePath,r.definitionPath,d]},true)??$e(r)}),{}):void 0,n=typeof e=="string"?e:e?.nameStrategy==="title"?void 0:e?.name,o=ne(t._def,n===void 0?r:{...r,currentPath:[...r.basePath,r.definitionPath,n]},false)??$e(r),i=typeof e=="object"&&e.name!==void 0&&e.nameStrategy==="title"?e.name:void 0;i!==void 0&&(o.title=i),r.flags.hasReferencedOpenAiAnyType&&(s||(s={}),s[r.openAiAnyTypeName]||(s[r.openAiAnyTypeName]={type:["string","number","integer","boolean","array","null"],items:{$ref:r.$refStrategy==="relative"?"1":[...r.basePath,r.definitionPath,r.openAiAnyTypeName].join("/")}}));let c=n===void 0?s?{...o,[r.definitionPath]:s}:o:{$ref:[...r.$refStrategy==="relative"?[]:r.basePath,r.definitionPath,n].join("/"),[r.definitionPath]:{...s,[n]:o}};return r.target==="jsonSchema7"?c.$schema="http://json-schema.org/draft-07/schema#":(r.target==="jsonSchema2019-09"||r.target==="openAi")&&(c.$schema="https://json-schema.org/draft/2019-09/schema#"),r.target==="openAi"&&("anyOf"in c||"oneOf"in c||"allOf"in c||"type"in c&&Array.isArray(c.type))&&console.warn("Warning: OpenAI may not support schemas with unions as roots! Try wrapping it in an object property."),c};var zN={_media:{create:d$1.MEDIA_UPLOAD,update:d$1.MEDIA_UPLOAD,delete:d$1.MEDIA_DELETE}};function da(t,e){let r=zN[t];return r?r[e]:`collection.${e}`}function KN(t){let e=t.headers.get("x-forwarded-for");return e?e.split(",")[0].trim():t.headers.get("x-real-ip")||"unknown"}function Mc(t,e,r,s,n){e?.apiKeyId&&t&&t.createAuditLog({action:"api_request",userId:e.userId||"",resource:"api_key",resourceId:e.apiKeyId,success:true,metadata:{endpoint:r,method:s,ip:KN(n)}});}function jc(t){return t.baseUpdatedAt??t._baseUpdatedAt}function Fd(t){let{baseUpdatedAt:e,_baseUpdatedAt:r,...s}=t;return s}function Hd(t,e){return {error:"Document has changed since you started editing",code:"REVISION_CONFLICT",conflict:{expectedUpdatedAt:t??null,actualUpdatedAt:e.updatedAt??null,current:e}}}async function De(t,e,r,s,n,o,i=true,c="none"){return await b$1(t,e,{user:s,req:r,tenantId:n,apiKey:o},{enablePublicAccess:i,defaultAccess:c})}async function rr(t,e,r,s,n,o=true){return await c$3(t,e,{user:s,req:r,tenantId:n},{enablePublicAccess:o})}async function Z(t,e,r,s){if(r)return {user:r,tenantId:s,apiKeyContext:void 0,authType:"static"};if(e){let n=await e(t);if(n.status===200&&n.user)return {user:n.user,tenantId:n.tenantContext?.tenantId,apiKeyContext:n.apiKeyContext,authType:n.authType}}return {user:void 0,tenantId:void 0,apiKeyContext:void 0,authType:void 0}}async function VN(t,e){if("dialect"in t&&t.dialect==="postgres"&&t instanceof c$1)return new a$9({db:t.client});if("dialect"in t&&t.dialect==="sqlite"&&t instanceof c$1)return new Fa({db:t.client});if("dialect"in t&&t.dialect==="mongodb"){let s=t;return new a$a({db:()=>s.db})}let r=resolve(e,"data","auth.db");return new a$b({path:process.env.KYRO_AUTH_DB_PATH||r})}async function I_(t){let{registry:e,db:r,authSecret:s,authAdapter:n,checkSession:o,user:i,tenantId:c,cors:p,webhookService:d,settings:x}=t,w=new tu;function R(l){if(Array.isArray(l))return l.map(R);if(l!==null&&typeof l=="object"){let y={};for(let v in l)v!=="attrs"&&(y[v]=R(l[v]));return y}return l}w.use("*",async(l,y)=>{await y();let v=l.req.header("referer")||"";if(!(l.req.header("x-kyro-admin")==="true"||v.includes("/admin"))){let g=l.res.headers.get("Content-Type");if(g&&g.includes("application/json"))try{let _=await l.res.clone().json(),k=R(_);l.res=l.json(k,l.res.status);}catch{}}});for(let l of e.getPlugins())typeof l.serverMiddleware=="function"&&l.serverMiddleware(w);let $=x?.access?.apiAccess,I=x?.access?.enablePublicAccess??false,H=x?.access?.defaultCollectionAccess??"none";$?.requireAuth;let te=process.cwd(),_e=te.endsWith("admin")?resolve(te,".."):te,W=n||await VN(r,_e),G=$m({db:r,userLookup:async l=>await W.findUserById(l)||null}),$t=$?.cors?.allowedOrigins,ys=p?.origins,$r=Array.isArray($t)?$t:typeof $t=="string"&&$t?$t.split(`
|
|
125
|
-
`).map(l=>l.trim()).filter(Boolean):[],He=$r.length>0?$r:ys||[];(He.length>0||p)&&w.use("*",async(l,y)=>{let v=l.req.header("Origin")||"*";if(He.length>0&&!He.includes(v))return l.json({error:"Origin not allowed"},403);let E=He.length>0?v:"*";if(l.header("Access-Control-Allow-Origin",E),l.header("Access-Control-Allow-Methods","GET, POST, PATCH, DELETE, OPTIONS"),l.header("Access-Control-Allow-Headers","Content-Type, Authorization, X-API-Key"),p?.credentials&&l.header("Access-Control-Allow-Credentials","true"),l.req.method==="OPTIONS")return l.text("");await y();});let yr=x?.access?.rateLimiting,sr;if(yr?.enabled){let l=yr.maxRequests||100,y=yr.windowMs||6e4;sr=new ja({"api:general":{window:y,max:l}}),w.use("/api/*",async(v,E)=>{if(!sr)return E();let g=v.req.header("CF-Connecting-IP")||v.req.header("X-Forwarded-For")?.split(",")[0]?.trim()||v.req.header("X-Real-IP")||"unknown",f=await sr.check("api:general",g);if(v.header("X-RateLimit-Limit",String(l)),v.header("X-RateLimit-Remaining",String(f.remaining)),v.header("X-RateLimit-Reset",String(f.resetAt)),!f.allowed)return v.json({error:"Too many requests",retryAfter:f.retryAfter},429);await E();});}let Ee=new qa({redis:W,jwtSecret:s||"change-me",baseUrl:process.env.KYRO_BASE_URL||"http://localhost:4321",rateLimiter:sr});k.fromConfig(r).then(l=>{l&&(Ee.email=l);}).catch(l=>{console.error("[Email] Failed to initialize transport from config:",l);}),w.post("/api/auth/login",async l=>Ee.login(l.req.raw)),w.post("/api/auth/register",async l=>{try{let y=await r.findOne({collection:"_globals_system",where:{}});if(y&&y.enableRegistration===!1)return l.json({error:"User registration is currently disabled by administrator."},403);if(y?.defaultRegistrationRole){let v=l.req.raw;if((v.headers.get("content-type")||"").includes("application/json")){let g=await l.req.json();g.role||(g.role=y.defaultRegistrationRole);let f=new Request(v.url,{method:v.method,headers:v.headers,body:JSON.stringify(g)});return Ee.register(f)}}}catch{}return Ee.register(l.req.raw)}),w.post("/api/auth/logout",async l=>Ee.logout(l.req.raw)),w.post("/api/auth/refresh",async l=>Ee.refresh(l.req.raw)),w.get("/api/auth/me",async l=>Ee.me(l.req.raw)),w.post("/api/auth/forgot-password",async l=>Ee.forgotPassword(l.req.raw)),w.post("/api/auth/reset-password",async l=>Ee.resetPassword(l.req.raw)),w.post("/api/auth/change-password",async l=>Ee.changePassword(l.req.raw)),w.get("/api/auth/verify-email",async l=>Ee.verifyEmail(l.req.raw)),w.post("/api/auth/verify-email",async l=>Ee.verifyEmail(l.req.raw)),w.get("/api/auth/verify",async l=>Ee.verifyEmail(l.req.raw)),w.post("/api/auth/verify",async l=>Ee.verifyEmail(l.req.raw)),w.get("/api/auth/sessions",async l=>Ee.listSessions(l.req.raw)),w.post("/api/auth/sessions/refresh",async l=>Ee.refreshSession(l.req.raw)),w.delete("/api/auth/sessions",async l=>Ee.revokeOtherSessions(l.req.raw)),w.delete("/api/auth/sessions/:id",async l=>Ee.revokeSession(l.req.raw,l.req.param("id"))),w.put("/api/auth/sessions/:id/name",async l=>Ee.renameSession(l.req.raw,l.req.param("id"))),w.get("/api/auth/access",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Not authenticated"},401);let E={},g={};for(let f of e.getCollections()){let _={read:(await De(f,"read",l.req.raw,y,v,void 0,I,H)).allowed,create:(await De(f,"create",l.req.raw,y,v,void 0,I,H)).allowed,update:(await De(f,"update",l.req.raw,y,v,void 0,I,H)).allowed,delete:(await De(f,"delete",l.req.raw,y,v,void 0,I,H)).allowed};E[f.slug]=_;}for(let f of e.getGlobals()){let _={read:(await rr(f,"read",l.req.raw,y,v,I)).allowed,update:(await rr(f,"update",l.req.raw,y,v,I)).allowed};g[f.slug]=_;}return l.json({collections:E,globals:g})}catch(y){return l.json({error:y.message},500)}});let Bt=typeof e.hasCollection=="function"&&e.hasCollection("users")?e.getCollection("users"):(()=>{try{return e.getCollection("users")}catch{return a$5}})();w.get("/api/users",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c),E=await De(Bt,"read",l.req.raw,y,v,void 0,I,H);if(!E.allowed)return l.json({error:E.error},E.status||403);let g=parseInt(l.req.query("page")||"1"),f=Math.min(parseInt(l.req.query("limit")||"10"),100),_=l.req.query("search")||void 0,k=[],A=0;if(typeof W.findUsers=="function"){let C=await W.findUsers({page:g,limit:f,search:_});k=C.users||[],A=C.total||0;}else {let C=await r.find({collection:"users",page:g,limit:f,where:_?{email:{contains:_}}:{},tenantId:v});k=C.docs||[],A=C.totalDocs||0;}return l.json({docs:k,totalDocs:A,limit:f,totalPages:Math.ceil(A/f)||1,page:g,pagingCounter:(g-1)*f+1,hasPrevPage:g>1,hasNextPage:g<Math.ceil(A/f),prevPage:g>1?g-1:null,nextPage:g<Math.ceil(A/f)?g+1:null})}catch(y){return console.error("[API] Error listing users:",y),l.json({error:y.message},500)}}),w.get("/api/users/:id",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c),E=l.req.param("id"),g=await W.findUserById(E);return g?l.json({data:g}):l.json({error:"User not found"},404)}catch(y){return l.json({error:y.message},500)}}),w.post("/api/users",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c),E=await De(Bt,"create",l.req.raw,y,v,void 0,I,H);if(!E.allowed)return l.json({error:E.error},E.status||403);let g=await l.req.json();if(!g.email||!g.password)return l.json({error:"Email and password are required"},400);if(await W.findUserByEmail(g.email))return l.json({error:"Email already in use"},400);let _=g.role||"customer";if(_!=="customer"&&y?.role!=="super_admin")return l.json({error:"Forbidden: Only super_admin can assign administrative roles"},403);let k=await W.createUser({email:g.email,password:g.password,name:g.name,role:_,avatar:g.avatar,tenantId:g.tenantId});return y&&W?.createAuditLog({action:"user_create",userId:y.id,resource:"users",resourceId:k.id,success:!0}),l.json({data:k,message:"User created successfully"},201)}catch(y){return l.json({error:y.message},500)}}),w.patch("/api/users/:id",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c),E=await De(Bt,"update",l.req.raw,y,v,void 0,I,H);if(!E.allowed)return l.json({error:E.error},E.status||403);let g=l.req.param("id"),f=await l.req.json(),_=await W.findUserById(g);if(!_)return l.json({error:"User not found"},404);let k={};if(f.name!==void 0&&(k.name=f.name),f.email!==void 0&&(k.email=f.email),f.role!==void 0&&f.role!==_.role){if(y?.role!=="super_admin")return l.json({error:"Forbidden: Only super_admin can modify user roles"},403);k.role=f.role;}f.avatar!==void 0&&(k.avatar=typeof f.avatar=="object"&&f.avatar!==null?f.avatar.id||String(f.avatar):f.avatar),f.tenantId!==void 0&&(k.tenantId=f.tenantId),f.emailVerified!==void 0&&(k.emailVerified=f.emailVerified),f.locked!==void 0&&(k.locked=f.locked),f.failedLoginAttempts!==void 0&&(k.failedLoginAttempts=f.failedLoginAttempts),f.lastLogin!==void 0&&(k.lastLogin=f.lastLogin);let A=await W.updateUser(g,k);return A?(y&&(W?.createAuditLog({action:"user_update",userId:y.id,resource:"users",resourceId:g,success:!0}),f.role&&_.role!==f.role&&W?.createAuditLog({action:"role_change",userId:y.id,resource:"users",resourceId:g,success:!0,metadata:{oldRole:_.role,newRole:f.role}})),l.json({data:A,message:"User updated successfully"})):l.json({error:"User update failed"},500)}catch(y){return l.json({error:y.message},500)}}),w.delete("/api/users/:id",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c),E=await De(Bt,"delete",l.req.raw,y,v,void 0,I,H);if(!E.allowed)return l.json({error:E.error},E.status||403);let g=l.req.param("id");if(y&&y.id===g)return l.json({error:"You cannot delete your own account"},403);let f=await W.findUserById(g);return f?await W.deleteUser(g)?(y&&W?.createAuditLog({action:"user_delete",userId:y.id,resource:"users",resourceId:g,success:!0}),l.json({data:f,message:"User deleted successfully"})):l.json({error:"User deletion failed"},500):l.json({error:"User not found"},404)}catch(y){return l.json({error:y.message},500)}}),w.get("/api/auth/audit-logs",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c),E=e.getCollection("audit_logs");if(E){let L=await De(E,"read",l.req.raw,y,v,void 0,I,H);if(!L.allowed)return l.json({error:L.error},L.status||403)}else if(!y)return l.json({error:"Authentication required"},401);let g=parseInt(l.req.query("page")||"1"),f=Math.min(parseInt(l.req.query("limit")||"50"),100),_=l.req.query("action")||void 0,k=l.req.query("userId")||void 0,A=l.req.query("resource")||void 0,C=await W.findAuditLogs({action:_,userId:k,resource:A,limit:f,offset:(g-1)*f});return l.json({docs:C.logs,totalDocs:C.total,limit:f,totalPages:Math.ceil(C.total/f),page:g,pagingCounter:(g-1)*f+1,hasPrevPage:g>1,hasNextPage:g<Math.ceil(C.total/f),prevPage:g>1?g-1:null,nextPage:g<Math.ceil(C.total/f)?g+1:null})}catch(y){return console.error("[API] Error listing audit logs:",y),l.json({error:y.message},500)}});let Nt=null,Br=null,gt=async()=>{if(Br)throw Br;if(!Nt)try{let l="sqlite";"dialect"in r&&r.dialect==="postgres"&&r instanceof c$1?l=r.dialect:"dialect"in r&&r.dialect==="mongodb"&&(l="mongodb");let y=l==="postgres"&&r instanceof c$1?r.client:r;Nt=await Pc.init(y,{dialect:l});}catch(l){throw console.error("[getMedia] Init error:",l),Br=l,l}return Nt};w.get("/api/media",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=await gt(),E=new URL(l.req.url).origin,g=parseInt(l.req.query("page")||"1"),f=parseInt(l.req.query("limit")||"30"),_=l.req.query("search")||"",k=l.req.query("type")||"",A=l.req.query("folder")||"",C=await v.find({page:g,limit:f,search:_,type:k,folder:A},E);return l.json(C)}catch(y){return console.error("[Media] find error:",y),l.json({error:y.message},500)}}),w.post("/api/media/upload",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=await gt(),E=l.req.header("content-type")||"",g=new URL(l.req.url).origin;if(E.includes("multipart/form-data")){let C=await l.req.formData(),L=C.get("file"),O=C.get("folder")||"";if(!L)return l.json({error:"No file uploaded"},400);let U=await v.upload(L,O,g);return l.json(U)}let f=await l.req.json(),{url:_}=f,k=f.folder||"";if(!_)return l.json({error:"No URL provided"},400);let A=await v.uploadFromUrl(_,k,g);return l.json(A)}catch(y){return console.error("[Media] upload error:",y),l.json({error:y.message},500)}}),w.get("/api/media/folders",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let E=await(await gt()).listFolders();return l.json(E)}catch(y){return console.error("[Media] folders error:",y),l.json({error:y.message},500)}}),w.post("/api/media/folders",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=await gt(),E=await l.req.json(),{name:g,parentPath:f}=E;return g?(await v.createFolder(g,f||""),l.json({message:"Folder created",path:f?`${f}/${g}`:g})):l.json({error:"Folder name is required"},400)}catch(y){return console.error("[Media] create folder error:",y),l.json({error:y.message},500)}}),w.delete("/api/media/folders",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=await gt(),E=l.req.query("path");return E?(await v.deleteFolder(E),l.json({message:"Folder deleted"})):l.json({error:"Path is required"},400)}catch(y){return console.error("[Media] delete folder error:",y),l.json({error:y.message},500)}}),w.delete("/api/media/:id",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=await gt(),E=l.req.param("id"),g=new URL(l.req.url).origin;return await v.delete(E,g),l.json({success:!0})}catch(y){return console.error("[Media] delete error:",y),l.json({error:y.message},500)}}),w.get("/api/media/file/:key{.+$}",async l=>{let y=l.req.param("key"),v=globalThis.STORAGE_BUCKET;if(v){let E=await v.get(y);if(!E)return l.notFound();let g=new Headers;return E.writeHttpMetadata(g),g.set("etag",E.httpEtag),new Response(E.body,{headers:g})}return l.notFound()}),w.get("/api/media/resize",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=l.req.query("url"),E=parseInt(l.req.query("w")||"0"),g=parseInt(l.req.query("h")||"0"),f=l.req.query("fit")||"cover",_=parseFloat(l.req.query("cx")||"0"),k=parseFloat(l.req.query("cy")||"0"),A=parseFloat(l.req.query("cw")||"0"),C=parseFloat(l.req.query("ch")||"0");if(!v)return l.json({error:"URL is required"},400);let O=(await gt()).storage;if(O.name!=="local")return l.redirect(v);let U=O.config?.uploadDir||join(process.cwd(),"public","uploads"),M=O.config?.baseUrl||"/uploads";if(!v.startsWith(M))return l.redirect(v);let K=v.replace(M,""),Q=join(U,K);if(!existsSync(Q))return l.json({error:"File not found"},404);let le=readFileSync(Q),{default:X}=await import('sharp'),xe=X(le);if(A>0&&C>0){let Ye=await X(le).metadata(),Yr=Ye.width||0,At=Ye.height||0;if(Yr>0&&At>0){let Dt=Math.max(0,Math.min(Math.round(_/100*Yr),Yr-1)),Us=Math.max(0,Math.min(Math.round(k/100*At),At-1)),D_=Math.max(1,Math.min(Math.round(A/100*Yr),Yr-Dt)),L_=Math.max(1,Math.min(Math.round(C/100*At),At-Us));xe=xe.extract({left:Dt,top:Us,width:D_,height:L_});}}(E>0||g>0)&&(xe=xe.resize({width:E>0?E:void 0,height:g>0?g:void 0,fit:f}));let Xe=await xe.toBuffer(),Mt=await X(le).metadata();return l.header("Content-Type",`image/${Mt.format||"webp"}`),l.header("Cache-Control","public, max-age=31536000, immutable"),l.body(Xe)}catch(y){return console.error("[Media] resize error:",y),l.json({error:y.message},500)}}),w.get("/api/media/:id",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=await gt(),E=l.req.param("id"),g=new URL(l.req.url).origin,f=await v.findById(E,g);return f?l.json(f):l.json({error:"Media not found"},404)}catch(y){return console.error("[Media] get error:",y),l.json({error:y.message},500)}}),w.patch("/api/media/:id",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=await gt(),E=l.req.param("id"),g=await l.req.json(),f=new URL(l.req.url).origin,_=["folder","metadata","title","alt","caption","originalName"],k={};for(let A of _)g[A]!==void 0&&(k[A]=g[A]);if(Object.keys(k).length>0){let A=await v.update(E,k,f);return l.json({doc:A})}return l.json({error:"No valid fields to update"},400)}catch(y){return console.error("[Media] update error:",y),l.json({error:y.message},500)}}),w.get("/api/media/test",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=await gt();return l.json({status:v?"initialized":"failed",serviceType:v?.constructor?.name})}catch(y){return console.error("[test] Error:",y),l.json({error:y.message,type:y.constructor?.name,stack:y.stack},500)}}),w.get("/api/storage-status",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=typeof globalThis.STORAGE_BUCKET<"u"||typeof l.env?.STORAGE_BUCKET<"u",E=v,g=v?"cloudflare_r2":"local";if(r)try{let f=r.prepare('SELECT provider FROM "_globals_storage-settings" LIMIT 1').get();f&&f.provider&&(E=!0,g=f.provider==="aws"?"s3":f.provider);}catch{try{let f=await r.findOne({collection:"_globals_storage-settings",where:{},draft:!0});f&&f.provider&&(E=!0,g=f.provider==="aws"?"s3":f.provider);}catch{}}return l.json({provider:g,configured:E,usage:0,limit:"unlimited"})}catch(y){return console.error("[Storage] status error:",y),l.json({error:y.message},500)}}),w.get("/api/plugins",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=e.getPlugins(),E=e.storageProviders,g=await Promise.all(v.map(async f=>{let _=!0,k=f.name,A={};try{let O=await r.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});O&&O.states&&(A=O.states);}catch{}A[k]!==void 0&&(_=A[k]),E.setPluginEnabled(k,_);let C=k.replace(/^@[^/]+\//,"");C=C.replace(/^(plugin|kyro)-/,"");let L={ai:"AI",seo:"SEO",s3:"S3",aws:"AWS",api:"API",ui:"UI",ftp:"FTP"};if(C=C.split("-").map(O=>{let U=O.toLowerCase();return L[U]?L[U]:O.charAt(0).toUpperCase()+O.slice(1)}).join(" "),C.toLowerCase().startsWith("storage ")){let O=C.split(" ");O.length===2&&(C=`${O[1]} Storage`);}return {id:k,name:f.displayName||C,version:f.version||"1.0.0",description:f.description||"",enabled:_,status:_?"active":"disabled"}}));return l.json(g)}catch(y){return console.error("[Plugins] list error:",y),l.json({error:y.message},500)}}),w.put("/api/plugins/:name/toggle",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=l.req.param("name"),E=e.storageProviders,f=!E.isPluginEnabled(v),_=[];if(!f)for(let A of E.getAll())A.pluginName===v&&_.push(A.type);if(!(l.req.query("force")==="1")&&!f&&_.length>0){let A="local";try{let C=r?.prepare?.('SELECT provider FROM "_globals_storage-settings" LIMIT 1')?.get();C?.provider&&(A=C.provider);}catch{try{let C=await r?.findOne?.({collection:"_globals_storage-settings",where:{},draft:!0});C?.provider&&(A=C.provider);}catch{}}if(_.includes(A))return l.json({error:`Cannot disable "${v}" \u2014 storage provider "${A}" is currently active. Switch to Local storage first.`,requiresAction:!0,activeProvider:A},409)}try{let A={},C="global",L=await r.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});L&&(A=L.states||{},C=L.id),A[v]=f,L?await r.update({collection:"_globals_plugin-settings",id:C,data:{states:A}}):await r.create({collection:"_globals_plugin-settings",data:{states:A,id:"global"}});}catch(A){console.warn(`[Plugins] Could not persist state for "${v}":`,A);}return E.setPluginEnabled(v,f),l.json({name:v,enabled:f})}catch(y){return console.error("[Plugins] toggle error:",y),l.json({error:y.message},500)}}),w.get("/api/health",l=>l.json({status:"ok",version:"0.12.45",collections:e.getCollectionSlugs(),timestamp:new Date().toISOString()})),w.get("/api/metrics",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let E=y.role==="admin"||y.role==="super_admin",f=e.getCollectionSlugs().filter(M=>!["users","audit_logs","media","_globals_access-settings","_globals_brand-settings"].includes(M)&&!M.startsWith("_globals_")).filter(M=>E||a$6(y,`${M}:read`)),_=0,k={};await Promise.all(f.map(async M=>{try{let Q=(await r.find({collection:M,where:{},limit:1,page:1,tenantId:v})).totalDocs??0;_+=Q,k[M]=Q;}catch{}}));let A=0;try{A=(await r.find({collection:"media",where:{},limit:1,page:1,tenantId:v})).totalDocs??0;}catch{}let C=0;try{C=(await r.find({collection:"users",where:{},limit:1,page:1,tenantId:v})).totalDocs??0;}catch{}let L=0;try{if(d){let M=await d.getWebhooks();L=Array.isArray(M)?M.length:0;}}catch{}let O=0;try{O=(await r.find({collection:d$2,where:{},limit:1,page:1,tenantId:v})).totalDocs??0;}catch{}let U=_+A+C;return l.json({totalDocuments:_,totalMedia:E||a$6(y,"media:read")?A:void 0,totalUsers:E||a$6(y,"users:read")?C:void 0,totalWebhooks:E?L:void 0,totalApiKeys:E?O:void 0,totalStoredRecords:U,collectionCounts:k,collections:f.length,timestamp:new Date().toISOString()})}catch(y){return console.error("[API] Metrics error:",y),l.json({error:y.message},500)}}),w.get("/api/analytics",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);if(!(y.role==="admin"||y.role==="super_admin"))return l.json({error:"Unauthorized"},403);let f=(await r.find({collection:"orders",where:{},limit:1e3,page:1,tenantId:v})).docs||[],_=await r.findOne({collection:"_globals_store-settings",where:{},tenantId:v}),k=_?.currency?.code||_?.currency||"USD",A={},C={},L={};f.forEach(M=>{let K=M.createdAt||M.updatedAt,Q=K?new Date(K).toISOString().split("T")[0]:new Date().toISOString().split("T")[0];A[Q]||(A[Q]=0),C[Q]||(C[Q]=0);let le=typeof M.total=="number"?M.total:parseFloat(String(M.total||0));A[Q]+=isNaN(le)?0:le,C[Q]+=1;let X=M.orderStatus||M.status||"pending";L[X]=(L[X]||0)+1;});let O=Object.keys(A).sort().map(M=>({date:M,revenue:Math.round(A[M]*100)/100,orders:C[M]})),U=Math.round(O.reduce((M,K)=>M+K.revenue,0)*100)/100;return l.json({chartData:O,totalRevenue:U,totalOrders:f.length,ordersByStatus:L,currencyCode:typeof k=="string"?k:"USD"})}catch(y){return l.json({error:y.message},500)}}),w.get("/api/kyro/schema",async l=>{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=g=>g.map(f=>{let _={name:f.name,type:f.type,label:f.label,required:f.required??false,unique:f.unique??false,indexed:f.indexed??false,defaultValue:f.defaultValue,admin:f.admin?{...f.admin}:void 0};return f.minLength!==void 0&&(_.minLength=f.minLength),f.maxLength!==void 0&&(_.maxLength=f.maxLength),f.pattern!==void 0&&(_.pattern=f.pattern),f.variant!==void 0&&(_.variant=f.variant),f.hasMany!==void 0&&(_.hasMany=f.hasMany),f.min!==void 0&&(_.min=f.min),f.max!==void 0&&(_.max=f.max),f.step!==void 0&&(_.step=f.step),f.integer!==void 0&&(_.integer=f.integer),f.options&&(_.options=f.options),f.relationTo&&(_.relationTo=f.relationTo),f.maxDepth!==void 0&&(_.maxDepth=f.maxDepth),f.minRows!==void 0&&(_.minRows=f.minRows),f.maxRows!==void 0&&(_.maxRows=f.maxRows),f.localized!==void 0&&(_.localized=f.localized),f.language&&(_.language=f.language),f.format&&(_.format=f.format),f.allowedTypes&&(_.allowedTypes=f.allowedTypes),f.maxSize&&(_.maxSize=f.maxSize),(f.type==="group"||f.type==="row"||f.type==="collapsible"&&f.fields)&&(_.fields=v(f.fields)),f.type==="array"&&f.fields&&(_.fields=v(f.fields)),f.type==="blocks"&&f.blocks&&(_.blocks=f.blocks.map(k=>({slug:k.slug,label:k.label,fields:v(k.fields)}))),f.type==="tabs"&&f.tabs&&(_.tabs=f.tabs.map(k=>({label:k.label,name:k.name,fields:v(k.fields)}))),_}),E={collections:{},globals:{}};for(let g of e.getCollections()){let f=g.slug;try{E.collections[f]={slug:f,label:g.label||f,fields:v(g.fields),jsonSchema:ro(e.getZodSchema(f),{target:"openApi3"}),createSchema:ro(e.getCreateZodSchema(f),{target:"openApi3"}),updateSchema:ro(e.getUpdateZodSchema(f),{target:"openApi3"}),procedures:{find:{collection:f,where:"Record<string,any>",sort:"string",limit:"number",page:"number",depth:"number",select:"string[]",draft:"boolean"},findByID:{collection:f,id:"string",depth:"number",select:"string[]",draft:"boolean"},create:{collection:f,data:"Record<string,any>",depth:"number",select:"string[]"},update:{collection:f,id:"string",data:"Record<string,any>",depth:"number",select:"string[]",baseUpdatedAt:"string"},delete:{collection:f,id:"string"},count:{collection:f,where:"Record<string,any>"}}};}catch{}}for(let g of e.getGlobals()){let f=g.slug,_=g.fields;if(f==="storage-settings"){let k=e.storageProviders,A=k.getAll(),C=new Set(k.getAllAvailable(O=>k.isPluginEnabled(O)).map(O=>O.type));C.add("local");let L=new Set(A.map(O=>O.type));_=_.filter(O=>O.type==="group"&&O.name&&L.has(O.name)?C.has(O.name):true).map(O=>O.name==="provider"&&O.type==="select"?{...O,options:O.options.filter(U=>C.has(U.value))}:O);}try{E.globals[f]={slug:f,label:g.label||f,fields:v(_),jsonSchema:ro(e.getZodSchema(f),{target:"openApi3"}),procedures:{get:{},update:{data:"Record<string,any>"}}};}catch{}}return l.json(E)}),w.get("/api/collections",async l=>{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=e.getCollections().map(E=>({slug:E.slug,label:E.label||E.slug,fields:E.fields.filter(g=>g.name).map(g=>({name:g.name,type:g.type,required:g.required,label:g.label}))}));return l.json(v)});function so(l,y,v){if(v in y)return y[v];for(let E of l)if(E.name){if(E.type==="tabs"&&E.tabs){let g=y[E.name];if(g&&typeof g=="object"&&v in g)return g[v]}if((E.type==="group"||E.type==="collapsible")&&E.fields){let g=y[E.name];if(g&&typeof g=="object"){if(v in g)return g[v];let f=so(E.fields,g,v);if(f!==void 0)return f}}}}w.get("/api/search",async l=>{try{let y=l.req.query("q")||"",v=l.req.query("collections")||"",E=Math.min(parseInt(l.req.query("limit")||"10"),50);if(!y||y.length<2)return l.json({results:[],message:"Query too short"});let{user:g,tenantId:f}=await Z(l.req.raw,G,i,c),_=v?v.split(",").filter(Boolean):e.getCollectionSlugs(),k=[],A=new RegExp(y.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),"i");for(let C of e.getCollections()){if(!_.includes(C.slug)||!(await De(C,"read",l.req.raw,g,f,void 0,I,H)).allowed)continue;let O=C.fields.filter(U=>U.name&&U.name!=="id"&&(U.type==="text"||U.type==="email"||U.type==="textarea"||U.type==="richtext"||U.indexed)&&!U.admin?.hidden).map(U=>U.name);if(O.length!==0)try{let U=O.map(K=>{let Q={};return Q[K]={like:`%${y}%`},Q}),M=await r.find({collection:C.slug,where:{OR:U},limit:E,tenantId:f});await a$7(M.docs,C.fields,r,e,1,0);for(let K of M.docs){let Q=C.admin?.useAsTitle||O.find(X=>X==="title"||X==="name"||X==="heading"||X==="slug"),le=Q?so(C.fields,K,Q)??K.id:K.id;k.push({collection:C.slug,label:C.label||C.slug,id:K.id,title:String(le||"Untitled"),doc:K});}}catch(U){console.error(`Search error for ${C.slug}:`,U);}}return k.sort((C,L)=>C.label.localeCompare(L.label)),l.json({results:k})}catch(y){return l.json({error:y.message,results:[]},500)}}),w.get("/api/keys",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:read"))return l.json({error:"Forbidden"},403);let E=parseInt(l.req.query("page")||"1"),g=Math.min(parseInt(l.req.query("limit")||"50"),100),f=await r.find({collection:d$2,where:{},page:E,limit:g,tenantId:v}),_=(f.docs||[]).map(k=>({id:k.id,name:k.name,keyPrefix:k.keyPrefix,permissions:k.permissions||[],lastUsed:k.lastUsedAt,createdAt:k.createdAt}));return l.json({docs:_,totalDocs:f.totalDocs||_.length,totalPages:f.totalPages||1})}catch(y){return console.error("[ApiKeys] GET error:",y),l.json({error:y.message},500)}}),w.post("/api/keys",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:admin"))return l.json({error:"Forbidden"},403);let v=await l.req.json();if(!v.name||typeof v.name!="string")return l.json({error:"name is required"},400);let E=i$1(),g=await r.create({collection:d$2,data:{userId:y.id,name:v.name,key:E,keyPrefix:j$2(E),permissions:Array.isArray(v.permissions)?v.permissions:["*"],expiresAt:v.expiresAt||null,createdAt:new Date().toISOString()}});return await W?.createAuditLog({action:"api_key_create",userId:y.id,resource:"api_key",resourceId:g.id,success:!0,metadata:{keyName:v.name}}),l.json({...g,key:E,permissions:Array.isArray(v.permissions)?v.permissions:["*"]},201)}catch(y){return console.error("[ApiKeys] POST error:",y),l.json({error:y.message},500)}}),w.delete("/api/keys/:id",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:admin"))return l.json({error:"Forbidden"},403);let v=l.req.param("id"),E=await r.findByID({collection:d$2,id:v});return E?(await r.delete({collection:d$2,id:v}),await W?.createAuditLog({action:"api_key_delete",userId:y.id,resource:"api_key",resourceId:v,success:!0,metadata:{keyName:E.name}}),l.json({message:"API key deleted"})):l.json({error:"API key not found"},404)}catch(y){return console.error("[ApiKeys] DELETE error:",y),l.json({error:y.message},500)}}),w.patch("/api/keys/:id",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:admin"))return l.json({error:"Forbidden"},403);let v=l.req.param("id"),E=await l.req.json(),g=await r.findByID({collection:d$2,id:v});if(!g)return l.json({error:"API key not found"},404);let f={};if(typeof E.name=="string"&&E.name.trim()&&(f.name=E.name.trim()),Array.isArray(E.permissions)&&(f.permissions=E.permissions),E.expiresAt!==void 0&&(f.expiresAt=E.expiresAt||null),Object.keys(f).length===0)return l.json({error:"Nothing to update"},400);let _=await r.update({collection:d$2,id:v,data:f});return l.json({..._,keyPrefix:g.keyPrefix})}catch(y){return console.error("[ApiKeys] PATCH error:",y),l.json({error:y.message},500)}}),w.post("/api/keys/:id/rotate",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:admin"))return l.json({error:"Forbidden"},403);let v=l.req.param("id"),E=await r.findByID({collection:d$2,id:v});if(!E)return l.json({error:"API key not found"},404);let g=i$1(),f=await r.update({collection:d$2,id:v,data:{key:g,keyPrefix:j$2(g),lastUsedAt:null}});return await W?.createAuditLog({action:"api_key_rotate",userId:y.id,resource:"api_key",resourceId:v,success:!0,metadata:{keyName:E.name}}),l.json({...f,key:g,permissions:E.permissions,expiresAt:E.expiresAt})}catch(y){return console.error("[ApiKeys] rotate error:",y),l.json({error:y.message},500)}}),w.get("/api/webhooks/actions",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:read"))return l.json({error:"Forbidden"},403);let v={generic:{label:"Custom URL",description:"POST to any endpoint with Kyro payload",configFields:[],envVars:[]},"github-push":{label:"GitHub Push",description:"Push an empty commit to simulate a push event",configFields:[{name:"githubOwner",label:"Owner",required:!0,placeholder:"e.g., kyro-dev"},{name:"githubRepo",label:"Repository",required:!0,placeholder:"e.g., my-website"},{name:"githubBranch",label:"Branch",required:!1,placeholder:"main"}],envVars:["GITHUB_TOKEN"]}};return l.json({actions:v})}catch(y){return console.error("[Webhooks] actions error:",y),l.json({error:y.message},500)}}),w.get("/api/webhooks",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:read"))return l.json({error:"Forbidden"},403);if(!d)return l.json({error:"Webhook service not available"},503);let v=await d.getWebhooks();return l.json({docs:v})}catch(y){return console.error("[Webhooks] GET error:",y),l.json({error:y.message},500)}}),w.post("/api/webhooks",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!d)return l.json({error:"Webhook service not available"},503);let v=await l.req.json(),E=await d.createWebhook(v);return await W?.createAuditLog({action:"webhook_create",userId:y.id,resource:"webhook",resourceId:E.id,success:!0,metadata:{name:E.name,url:E.url}}),l.json(E,201)}catch(y){return console.error("[Webhooks] POST error:",y),l.json({error:y.message},500)}}),w.get("/api/webhooks/:id",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:read"))return l.json({error:"Forbidden"},403);if(!d)return l.json({error:"Webhook service not available"},503);let v=l.req.param("id"),E=await d.getWebhookById(v);return E?l.json(E):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] GET :id error:",y),l.json({error:y.message},500)}}),w.patch("/api/webhooks/:id",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!d)return l.json({error:"Webhook service not available"},503);let v=l.req.param("id"),E=await l.req.json(),g=await d.updateWebhook(v,E);return g?(await W?.createAuditLog({action:"webhook_update",userId:y.id,resource:"webhook",resourceId:v,success:!0,metadata:{name:g.name}}),l.json(g)):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] PATCH error:",y),l.json({error:y.message},500)}}),w.delete("/api/webhooks/:id",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!d)return l.json({error:"Webhook service not available"},503);let v=l.req.param("id"),E=await d.getWebhookById(v);return E?(await d.deleteWebhook(v),await W?.createAuditLog({action:"webhook_delete",userId:y.id,resource:"webhook",resourceId:v,success:!0,metadata:{name:E.name}}),l.json({message:"Webhook deleted"})):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] DELETE error:",y),l.json({error:y.message},500)}}),w.post("/api/webhooks/:id/test",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!d)return l.json({error:"Webhook service not available"},503);let v=l.req.param("id"),E=await d.testWebhook(v);return E?l.json(E):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] test error:",y),l.json({error:y.message},500)}}),w.get("/api/webhooks/:id/history",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:read"))return l.json({error:"Forbidden"},403);if(!d)return l.json({error:"Webhook service not available"},503);let v=l.req.param("id"),E=Math.min(parseInt(l.req.query("limit")||"50"),100),g=await d.getDeliveryHistory(v,E);return l.json({docs:g})}catch(y){return console.error("[Webhooks] history error:",y),l.json({error:y.message},500)}});function no(l){let y={},v=["name","type","required","hasMany","relationTo","options","min","max","minLength","maxLength","defaultValue","label","localized","admin","unique","index","hidden","readOnly","deprecated"];for(let E of v)E in l&&(y[E]=l[E]);return l.fields&&(y.fields=l.fields.map(no)),l.tabs&&(y.tabs=l.tabs.map(E=>({label:E.label,name:E.name,fields:E.fields.map(no)}))),y}w.get("/api/__schema",async l=>{try{let{user:y,apiKeyContext:v}=await Z(l.req.raw,G,i,c);if(!y&&!v)return l.json({error:"Unauthorized"},401);let g=e.getCollections().filter(f=>f.slug!=="users"&&f.slug!=="audit_logs").map(f=>({slug:f.slug,label:f.label,labelPlural:f.labelPlural,singularLabel:f.singularLabel,timestamps:f.timestamps,auth:!!f.auth,tenantScoped:!!f.tenantScoped,upload:f.upload?{staticDir:f.upload.staticDir,imageSizes:f.upload.imageSizes,mimeTypes:f.upload.mimeTypes}:void 0,fields:f.fields.map(no)}));return l.json(g)}catch(y){return console.error("[Schema] error:",y),l.json({error:y.message},500)}});let Gd=e.getCollections();for(let l of Gd){let E=function(g,f){let _=[],k=new Set([...Object.keys(g),...Object.keys(f)]);for(let A of k)A==="id"||A==="createdAt"||A==="updatedAt"||JSON.stringify(g[A])!==JSON.stringify(f[A])&&_.push({field:A,oldValue:A in g?g[A]:void 0,newValue:A in f?f[A]:void 0});return _};let y=l.slug;if(y==="users"||y==="audit_logs")continue;let v=`/api/${y}`;w.post(`${v}/dynamic-options/:fieldName`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"read",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);let C=g.req.param("fieldName"),L=await g.req.json(),{data:O,siblingData:U}=L,M=bs(l.fields,C);if(!M)return g.json({error:"Field not found"},404);if(M.type!=="select")return g.json({error:"Field is not a select field"},400);let K=[];return typeof M.options=="function"?K=await M.options({data:O||{},siblingData:U||{}}):Array.isArray(M.options)&&(K=M.options),g.json({options:K})}catch(f){return g.json({error:f.message},500)}}),w.get(v,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"read",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);_&&r.setTenantContext({tenantId:_,userId:f?.id??"",role:f?.role,isSuperAdmin:f?.role==="super_admin"});let C=new URL(g.req.url),L=parseInt(C.searchParams.get("page")||"1"),O=Math.min(parseInt(C.searchParams.get("limit")||"10"),100),U=C.searchParams.get("sort")||void 0,M=parseInt(C.searchParams.get("depth")||"0"),K=C.searchParams.get("select")?.split(",")||void 0,Q=C.searchParams.get("draft"),le=Q==="true"?!0:Q==="false"?!1:!!f,X={},xe=C.searchParams.get("where");if(xe)try{X=JSON.parse(xe);}catch{return g.json({error:"Invalid JSON in where parameter"},400)}let Xe=await r.find({collection:y,where:X,sort:U,limit:O,page:L,depth:M,tenantId:_,select:K,draft:le});return await a$7(Xe.docs,l.fields,r,e,1,M),g.json(a$8(Xe))}catch(f){return console.error("[API] list error:",f),g.json({error:f.message},500)}}),w.get(`${v}/:id/versions`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"read",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);let C=g.req.param("id");if(!C)return g.json({error:"Missing document ID"},400);let L=new URL(g.req.url),O=L.searchParams.get("compareA"),U=L.searchParams.get("compareB");if(Mc(W,k,`${v}/${C}/versions`,"GET",g.req.raw),O&&U){let[le,X]=await Promise.all([r.findVersionByID({collection:y,versionId:O,tenantId:_}),r.findVersionByID({collection:y,versionId:U,tenantId:_})]);if(!le||!X)return g.json({error:"Version not found"},404);let xe=E(le.data,X.data);return g.json({diffs:xe})}let M=parseInt(L.searchParams.get("page")||"1"),K=Math.min(parseInt(L.searchParams.get("limit")||"10"),100),Q=await r.findVersions({collection:y,documentId:C,page:M,limit:K,tenantId:_});return g.json(Q)}catch(f){return console.error("[API] versions error:",f),g.json({error:f.message},500)}}),w.put(`${v}/:id/draft`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"update",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);let C=g.req.param("id"),L=await g.req.json(),O=jc(L),U=await r.findByID({collection:y,id:C,tenantId:_,draft:!0});if(!U)return g.json({error:"Document not found"},404);let M;L.delta?M={...U,...L.delta}:M=L.data??Fd(L);let K=await r.updateLatestVersion({collection:y,documentId:C,data:M,status:"draft",tenantId:_});return f&&W?.createAuditLog({action:"document_update",userId:f.id,resource:y,resourceId:C,success:!0,metadata:{type:"draft_save"}}),g.json({data:K,message:"Draft saved successfully"})}catch(f){return g.json({error:f.message},500)}}),w.delete(`${v}/:id/draft`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"update",g.req.raw,f,_,k,I,H);return A.allowed?(f&&W?.createAuditLog({action:"document_update",userId:f.id,resource:y,resourceId:g.req.param("id"),success:!0,metadata:{type:"draft_discard"}}),g.json({message:"Draft discarded successfully"})):g.json({error:A.error},A.status||403)}catch(f){return g.json({error:f.message},500)}}),w.get(`${v}/:id`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=new URL(g.req.url),C=A.searchParams.get("draft"),L=A.searchParams.get("kyroToken"),O=!1;if(C==="true"&&L&&s)try{let X=await Oa(L,s,"HS256");X&&X.type==="preview"&&X.collection===l.slug&&(O=!0);}catch(X){console.warn("Invalid preview token",X);}if(!O){let X=await De(l,"read",g.req.raw,f,_,k,I,H);if(!X.allowed)return g.json({error:X.error},X.status||403)}let U=g.req.param("id"),M=parseInt(A.searchParams.get("depth")||"0"),K=A.searchParams.get("select")?.split(",")||void 0,Q=C==="true"?!0:C==="false"?!1:!!f,le=await r.findByID({collection:y,id:U,depth:M,tenantId:_,select:K,draft:Q});return !le&&l.fields.some(X=>X.name==="slug")&&(le=await r.findOne({collection:y,where:{slug:U},tenantId:_,draft:Q})),le?(await a$7([le],l.fields,r,e,1,M),g.json({data:a$8(le)})):g.json({error:"Document not found"},404)}catch(f){return g.json({error:f.message},500)}}),w.post(`${v}/preview-url`,async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k=await De(l,"read",g.req.raw,f,_);if(!k.allowed)return g.json({error:k.error||"Forbidden"},k.status||403);let A=await g.req.json().catch(()=>({})),C="";s&&(C=await Ia({type:"preview",collection:l.slug,id:A.id,exp:Math.floor(Date.now()/1e3)+3600},s,"HS256"));let L="";if(l.admin?.preview){L=await l.admin.preview(A,{req:g.req.raw,token:C});try{let O=new URL(L,"http://localhost");O.searchParams.has("preview")||O.searchParams.set("preview","true"),!O.searchParams.has("kyroToken")&&C&&O.searchParams.set("kyroToken",C),L=L.startsWith("http")?O.toString():`${O.pathname}${O.search}`;}catch{}}else {let O="";try{let M=await r.findOne({collection:"_globals_site-settings",where:{}});M?.siteUrl&&(O=M.siteUrl);}catch{}if(!O)return g.json({error:"No site URL configured in settings, and no custom preview function defined for this collection."},400);O=O.replace(/\/$/,"");let U=A.slug||A.id||"";L=`${O}/${l.slug}/${U}?preview=true&kyroToken=${C}`;}return g.json({url:L})}catch(f){return g.json({error:f.message},500)}}),w.post(v,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"create",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);_&&r.setTenantContext({tenantId:_,userId:f?.id??"",role:f?.role,isSuperAdmin:f?.role==="super_admin"}),Mc(W,k,v,"POST",g.req.raw);let L=await g.req.json();ts(L,l.fields),rs(l.fields,L);let O=g.req.raw;if(l.hooks?.beforeValidate)for(let X of l.hooks.beforeValidate){let xe=await X({collection:y,data:L,req:O,user:f,tenantId:_,operation:"create"});xe&&typeof xe=="object"&&!Array.isArray(xe)&&Object.assign(L,xe);}let U=e.getCreateZodSchema(y);try{L=U.parse(L);}catch(X){return g.json({error:`Validation failed: ${mo(X.errors)}`,details:X.errors},400)}l.tenantScoped&&_&&(L.tenantId=_);let M=l.versions?.drafts===!0,K=l.fields.find(X=>X.name==="status"),Q=K?.type==="select"&&Array.isArray(K.options)&&K.options.some(X=>X.value==="published");if(M?L.status="draft":Q&&!L.status&&(L.status="published"),l.hooks?.beforeChange)for(let X of l.hooks.beforeChange){let xe=await X({collection:y,data:L,req:O,user:f,tenantId:_,operation:"create"});xe&&typeof xe=="object"&&!Array.isArray(xe)&&Object.assign(L,xe);}let le=await r.create({collection:y,data:L,tenantId:_});if(M&&await r.createVersion({collection:y,documentId:le.id,data:L,status:"draft",createdBy:f?.id,changeDescription:"Created",tenantId:_}),l.hooks?.afterChange)for(let X of l.hooks.afterChange)await X({collection:y,doc:le,data:L,req:O,user:f,tenantId:_,operation:"create"});return d&&d.trigger(da(y,"create"),{collection:y,operation:"create",data:le,user:f?{id:f.id,email:f.email,role:f.role}:void 0,tenantId:_}).catch(X=>console.error("[Webhook] Failed to trigger:",X)),f&&W?.createAuditLog({action:"document_create",userId:f.id,resource:y,resourceId:le.id,success:!0}),g.json({data:le,message:"Created successfully"},201)}catch(f){return f.name==="ZodError"?g.json({error:`Validation failed: ${mo(f.errors)}`,details:f.errors},400):g.json({error:f.message},500)}}),w.patch(`${v}/:id`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"update",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);let C=g.req.param("id"),L=await g.req.json(),O=jc(L),U=await r.findByID({collection:y,id:C,tenantId:_,draft:!0});if(!U)return g.json({error:"Document not found"},404);if(O&&U.updatedAt&&O!==U.updatedAt)return g.json(Hd(O,U),409);let M=Object.fromEntries(Object.entries(Fd(L)).filter(([Mt,Ye])=>Ye!=="null"&&Ye!==void 0));ts(M,l.fields),rs(l.fields,M);let K=g.req.raw;if(l.hooks?.beforeValidate)for(let Mt of l.hooks.beforeValidate){let Ye=await Mt({collection:y,data:M,originalDoc:U,req:K,user:f,tenantId:_,operation:"update"});Ye&&typeof Ye=="object"&&!Array.isArray(Ye)&&Object.assign(M,Ye);}if(M=e.getUpdateZodSchema(y).parse(M),l.hooks?.beforeChange)for(let Mt of l.hooks.beforeChange){let Ye=await Mt({collection:y,data:M,originalDoc:U,req:K,user:f,tenantId:_,operation:"update"});Ye&&typeof Ye=="object"&&!Array.isArray(Ye)&&Object.assign(M,Ye);}let le=g.req.header("X-Draft")==="true",X=l.versions?.drafts===!0,xe=g.req.query("autosave")==="true",Xe;if(X&&le?await r.createVersion({collection:y,documentId:C,data:M,status:"draft",autosave:xe,createdBy:f?.id,changeDescription:xe?"Autosave":"Draft saved",tenantId:_}):X?(await r.update({collection:y,id:C,data:{...M,status:"published"},tenantId:_}),await r.createVersion({collection:y,documentId:C,data:M,status:"published",createdBy:f?.id,changeDescription:"Published",tenantId:_})):await r.update({collection:y,id:C,data:M,tenantId:_}),Xe=await r.findByID({collection:y,id:C,tenantId:_,draft:!0}),l.hooks?.afterChange)for(let Mt of l.hooks.afterChange)await Mt({collection:y,doc:Xe,data:M,originalDoc:U,req:K,user:f,tenantId:_,operation:"update"});return d&&!xe&&d.trigger(da(y,"update"),{collection:y,operation:"update",data:Xe,previousData:U,user:f?{id:f.id,email:f.email,role:f.role}:void 0,tenantId:_}).catch(Mt=>console.error("[Webhook] Failed to trigger:",Mt)),Mc(W,k,`${v}/${C}`,"PATCH",g.req.raw),f&&W?.createAuditLog({action:"document_update",userId:f.id,resource:y,resourceId:C,success:!0}),g.json({data:Xe,message:X?"Draft saved":"Updated successfully"})}catch(f){return f.name==="ZodError"?(console.error(`[PATCH ${v}/:id] Validation failed:`,f.errors),g.json({error:`Validation failed: ${mo(f.errors)}`,details:f.errors},400)):(console.error(`[PATCH ${v}/:id] ERROR:`,f.message,"CAUSE:",f.cause?.message||f.cause,"QUERY:",f.query),g.json({error:f.message},500))}}),w.delete(`${v}/:id`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"delete",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);_&&r.setTenantContext({tenantId:_,userId:f?.id??"",role:f?.role,isSuperAdmin:f?.role==="super_admin"});let C=g.req.param("id"),L=g.req.raw,O=await r.findByID({collection:y,id:C,tenantId:_,draft:!0});if(!O)return g.json({error:"Document not found"},404);if(l.hooks?.beforeDelete)for(let M of l.hooks.beforeDelete)await M({collection:y,doc:O,req:L,user:f,tenantId:_,operation:"delete"});let U=await r.delete({collection:y,id:C,tenantId:_});if(l.hooks?.afterDelete)for(let M of l.hooks.afterDelete)await M({collection:y,doc:U,originalDoc:O,req:L,user:f,tenantId:_,operation:"delete"});return d&&d.trigger(da(y,"delete"),{collection:y,operation:"delete",data:U,previousData:O,user:f?{id:f.id,email:f.email,role:f.role}:void 0,tenantId:_}).catch(M=>console.error("[Webhook] Failed to trigger:",M)),Mc(W,k,`${v}/${C}`,"DELETE",g.req.raw),f&&W?.createAuditLog({action:"document_delete",userId:f.id,resource:y,resourceId:C,success:!0}),g.json({data:U,message:"Deleted successfully"})}catch(f){return console.error(`[DELETE] Error deleting ${y}:`,f),g.json({error:f.message||String(f)},500)}}),w.post(`${v}/:id/duplicate`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"create",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);let C=g.req.param("id"),L=await r.findByID({collection:y,id:C,tenantId:_,draft:!0});if(!L)return g.json({error:"Document not found"},404);let{id:O,createdAt:U,updatedAt:M,...K}=L;Zs(l.fields,K);let Q=Date.now().toString(36);"slug"in K&&typeof K.slug=="string"&&(K.slug=`${K.slug||"document"}-copy-${Q}`),"title"in K&&typeof K.title=="string"?K.title=`${K.title||"Copy"} (Copy)`:"name"in K&&typeof K.name=="string"&&(K.name=`${K.name||"Copy"} (Copy)`);let le=await r.create({collection:y,data:{...K,status:"draft"},tenantId:_});return g.json({data:le,message:"Document duplicated successfully"})}catch(f){return console.error("[Duplicate] Error:",f),g.json({error:f.message||String(f)},500)}}),w.post(`${v}/:id/versions/:versionId/restore`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"update",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);let C=g.req.param("id"),L=g.req.param("versionId"),O=await r.findVersionByID({collection:y,versionId:L,tenantId:_});if(!O)return g.json({error:"Version not found"},404);let U=await r.update({collection:y,id:C,data:{...O.data,status:"draft"},tenantId:_});return g.json({data:U,message:"Version restored successfully"})}catch(f){return g.json({error:f.message},500)}}),w.post(`${v}/:id/versions`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"update",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);let C=await g.req.json(),{versionId:L,action:O}=C;if(O==="restore"&&L){let U=await r.findVersionByID({collection:y,versionId:L,tenantId:_});if(!U)return g.json({error:"Version not found"},404);let M=await r.update({collection:y,id:g.req.param("id"),data:{...U.data,status:"draft"},tenantId:_});return g.json({data:M,message:"Version restored successfully"})}return g.json({error:"Invalid action"},400)}catch(f){return g.json({error:f.message},500)}}),w.post(`${v}/:id/publish`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"update",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);_&&r.setTenantContext({tenantId:_,userId:f?.id??"",role:f?.role,isSuperAdmin:f?.role==="super_admin"});let C=g.req.param("id"),L=await g.req.json().catch(()=>({})),O=jc(L),U=await r.findByID({collection:y,id:C,tenantId:_,draft:!0});if(!U)return g.json({error:"Document not found"},404);if(O&&U.updatedAt&&O!==U.updatedAt)return g.json(Hd(O,U),409);let M={status:"published"},K=U;if(l.versions?.drafts){let le=await r.findVersions({collection:y,documentId:C,limit:1,sort:"-createdAt",tenantId:_});if(le.docs.length>0){let X=le.docs[0];K={...U,...X.data},M={...X.data,...M};}}let Q=await r.update({collection:y,id:C,data:M,tenantId:_});return l.versions?.drafts&&await r.createVersion({collection:y,documentId:C,data:{...K,status:"published"},status:"published",createdBy:f?.id,changeDescription:"Published",tenantId:_}),d&&d.trigger(da(y,"update"),{collection:y,operation:"update",data:Q,user:f?{id:f.id,email:f.email,role:f.role}:void 0,tenantId:_}).catch(le=>console.error("[Webhook] Failed to trigger:",le)),g.json({data:Q,message:"Published successfully"})}catch(f){return g.json({error:f.message},500)}}),w.post(`${v}/:id/unpublish`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"update",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);let C=g.req.param("id");if(!await r.findByID({collection:y,id:C,tenantId:_,draft:!0}))return g.json({error:"Document not found"},404);let O=await r.update({collection:y,id:C,data:{status:"draft"},tenantId:_});return d&&d.trigger(da(y,"update"),{collection:y,operation:"update",data:O,user:f?{id:f.id,email:f.email,role:f.role}:void 0,tenantId:_}).catch(U=>console.error("[Webhook] Failed to trigger:",U)),g.json({data:O,message:"Unpublished successfully"})}catch(f){return g.json({error:f.message},500)}});}for(let l of e.getGlobals()){let y=l.slug,v=`/api/globals/${y}`;w.post(`${v}/dynamic-options/:fieldName`,async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k=await rr(l,"read",g.req.raw,f,_,I);if(!k.allowed)return g.json({error:k.error},k.status||403);let A=g.req.param("fieldName"),C=await g.req.json(),{data:L,siblingData:O}=C,U=bs(l.fields,A);if(!U)return g.json({error:"Field not found"},404);if(U.type!=="select")return g.json({error:"Field is not a select field"},400);let M=[];return typeof U.options=="function"?M=await U.options({data:L||{},siblingData:O||{}}):Array.isArray(U.options)&&(M=U.options),g.json({options:M})}catch(f){return g.json({error:f.message},500)}}),w.get(v,async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k=new URL(g.req.url),A=k.searchParams.get("kyroToken"),C=k.searchParams.get("draft"),L=!1;if(C==="true"&&A&&s)try{let Q=await Oa(A,s,"HS256");Q&&Q.type==="preview"&&Q.collection===`_globals_${l.slug}`&&(L=!0);}catch(Q){console.warn("Invalid preview token",Q);}if(!L){let Q=await rr(l,"read",g.req.raw,f,_,I);if(!Q.allowed)return g.json({error:Q.error},Q.status||403)}let O=C==="true"?!0:C==="false"?!1:!!f,U=parseInt(k.searchParams.get("depth")||"0"),K=(await r.find({collection:`_globals_${y}`,where:{},tenantId:_,draft:O,depth:U,limit:1})).docs[0];if(K&&U>0&&await a$7([K],l.fields,r,e,1,U),y==="storage-settings"&&(typeof globalThis.STORAGE_BUCKET<"u"||typeof g.env?.STORAGE_BUCKET<"u")&&(K?K.provider||(K.provider="cloudflare_r2"):K={id:y,provider:"cloudflare_r2"}),y==="system"){let Q=dv.randomBytes(32).toString("hex");K?K.appSecret||(await r.update({collection:`_globals_${y}`,id:y,data:{appSecret:Q},tenantId:_}),K.appSecret=Q):K=await r.create({collection:`_globals_${y}`,data:{id:y,appSecret:Q},tenantId:_});}return g.json({data:K||{}})}catch(f){return g.json({error:f.message},500)}});let E=async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k$1=await rr(l,"update",g.req.raw,f,_,I);if(!k$1.allowed)return g.json({error:k$1.error},k$1.status||403);let A=new URL(g.req.url),C=parseInt(A.searchParams.get("depth")||"0"),L=await g.req.json(),O=jc(L),U=Fd(L),M=Object.fromEntries(Object.entries(U).filter(([Dt,Us])=>Us!==null&&Us!=="null"&&Us!==void 0));ts(M,l.fields),rs(l.fields,M);let K=e.getUpdateZodSchema(y),Q;try{Q=K.parse(M);}catch(Dt){return g.json({error:`Validation failed: ${mo(Dt.errors)}`,details:Dt.errors},400)}let le=new Set(["id","createdAt","updatedAt","status","baseUpdatedAt","_baseUpdatedAt"]),X=Object.fromEntries(Object.entries(Q).filter(([Dt])=>!le.has(Dt))),xe=`_globals_${y}`,Xe=await r.findOne({collection:xe,where:{},tenantId:_,draft:!0});if(Xe&&O&&Xe.updatedAt&&O!==Xe.updatedAt)return g.json(Hd(O,Xe),409);let Mt=g.req.header("X-Draft")==="true",Ye=l.versions?.drafts===!0,Yr=g.req.query("autosave")==="true",At;if(Ye&&Mt)await r.createVersion({collection:xe,documentId:y,data:X,status:"draft",autosave:Yr,createdBy:f?.id,changeDescription:Yr?"Autosave":"Manual save",tenantId:_}),Xe?At=Xe:At=await r.create({collection:xe,data:{...X,id:y,status:"draft"},tenantId:_});else if(Ye&&!Mt){let Dt="published";Xe?At=await r.update({collection:xe,id:y,data:{...X,status:Dt},tenantId:_}):At=await r.create({collection:xe,data:{...X,id:y,status:Dt},tenantId:_}),await r.createVersion({collection:xe,documentId:y,data:X,status:Dt,autosave:!1,createdBy:f?.id,changeDescription:"Published",tenantId:_});}else Xe?At=await r.update({collection:xe,id:y,data:X,tenantId:_}):At=await r.create({collection:xe,data:{...X,id:y},tenantId:_});if(y==="storage-settings"&&(Nt=null,Br=null),y==="email-settings"){let Dt=await k.fromConfig(r);Ee.email=Dt||void 0;}return y==="system"&&await ym(),f&&W?.createAuditLog({action:"settings_change",userId:f.id,resource:`global:${y}`,resourceId:y,success:!0}),At&&C>0&&await a$7([At],l.fields,r,e,1,C),g.json({data:At,message:"Updated successfully"})}catch(f){return console.error(`[API] Save global "${y}" failed:`,f),g.json({error:f.message||"Save failed",stack:process.env.NODE_ENV==="development"?f.stack:void 0},500)}};w.post(v,E),w.patch(v,E),w.post(`${v}/preview-url`,async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k=await rr(l,"read",g.req.raw,f,_);if(!k.allowed)return g.json({error:k.error||"Forbidden"},k.status||403);let A=await g.req.json().catch(()=>({})),C="";s&&(C=await Ia({type:"preview",collection:`_globals_${l.slug}`,exp:Math.floor(Date.now()/1e3)+3600},s,"HS256"));let L="";if(l.admin?.preview)L=await l.admin.preview(A,{req:g.req.raw,token:C});else {let O="";try{let U=await r.findOne({collection:"_globals_site-settings",where:{}});U?.siteUrl&&(O=U.siteUrl);}catch{}if(!O)return g.json({error:"No site URL configured in settings, and no custom preview function defined."},400);O=O.replace(/\/$/,""),L=`${O}/?preview=true&kyroToken=${C}`;}return g.json({url:L})}catch(f){return g.json({error:f.message},500)}}),w.post(`${v}/publish`,async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k=await rr(l,"update",g.req.raw,f,_,I);if(!k.allowed)return g.json({error:k.error},403);let A=`_globals_${y}`,C=await r.findOne({collection:A,where:{},tenantId:_,draft:!0});if(!C)return g.json({error:"Global not found"},404);let L={status:"published"},O=C;if(l.versions?.drafts){let M=await r.findVersions({collection:A,documentId:y,limit:1,sort:"-createdAt",tenantId:_});M.docs.length>0&&(O={...C,...M.docs[0].data},L={...M.docs[0].data,...L});}let U=await r.update({collection:A,id:y,data:L,tenantId:_});return l.versions?.drafts&&await r.createVersion({collection:A,documentId:y,data:{...O,status:"published"},status:"published",createdBy:f?.id,changeDescription:"Published",tenantId:_}),g.json({data:U,message:"Published successfully"})}catch(f){return g.json({error:f.message},500)}}),w.post(`${v}/unpublish`,async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k=await rr(l,"update",g.req.raw,f,_,I);if(!k.allowed)return g.json({error:k.error},403);let A=await r.update({collection:`_globals_${y}`,id:y,data:{status:"draft"},tenantId:_});return g.json({data:A,message:"Unpublished successfully"})}catch(f){return g.json({error:f.message},500)}}),w.get(`${v}/versions`,async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k=await rr(l,"read",g.req.raw,f,_,I);if(!k.allowed)return g.json({error:k.error},403);let A=parseInt(g.req.query("limit")||"10"),C=parseInt(g.req.query("page")||"1"),L=await r.findVersions({collection:`_globals_${y}`,documentId:y,limit:A,page:C,tenantId:_});return g.json(L)}catch(f){return g.json({error:f.message},500)}}),w.get(`${v}/versions/:versionId`,async g=>{try{let f=g.req.param("versionId"),{user:_,tenantId:k}=await Z(g.req.raw,G,i,c),A=await rr(l,"read",g.req.raw,_,k,I);if(!A.allowed)return g.json({error:A.error},403);let C=await r.findVersionByID({collection:`_globals_${y}`,versionId:f,tenantId:k});return C?g.json({data:C}):g.json({error:"Version not found"},404)}catch(f){return g.json({error:f.message},500)}}),w.post(`${v}/versions/:versionId/restore`,async g=>{try{let f=g.req.param("versionId"),{user:_,tenantId:k}=await Z(g.req.raw,G,i,c),A=await rr(l,"update",g.req.raw,_,k,I);if(!A.allowed)return g.json({error:A.error},403);let C=`_globals_${y}`,L=await r.findVersionByID({collection:C,versionId:f,tenantId:k});if(!L)return g.json({error:"Version not found"},404);let O=await r.update({collection:C,id:y,data:{...L.data,status:"draft"},tenantId:k});return g.json({data:O,message:"Version restored successfully"})}catch(f){return g.json({error:f.message},500)}}),y==="email-settings"&&w.post(`${v}/test`,async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k$1=await rr(l,"update",g.req.raw,f,_,I);if(!k$1.allowed)return g.json({error:k$1.error},k$1.status||403);let A=await g.req.json(),C={provider:A.provider,from:A.fromEmail||A.from,fromName:A.fromName,replyTo:A.replyTo,smtp:A.smtp?{host:A.smtp.host,port:A.smtp.port,secure:A.smtp.secure,auth:{user:A.smtp.username||A.smtp.user,pass:A.smtp.password||A.smtp.pass}}:void 0,resend:A.resend,sendgrid:A.sendgrid,mailgun:A.mailgun,ses:A.ses},L=new k(C),O=A.email||A.testEmail||A.testEmailSection&&A.testEmailSection.testEmail;if(!O)return g.json({error:"No test recipient email provided"},400);let U=A.provider?A.provider.charAt(0).toUpperCase()+A.provider.slice(1):"SMTP",M=A.fromName?`${A.fromName} <${A.fromEmail||A.from||"default"}>`:A.fromEmail||A.from||"Configured Sender",K=new Date().toUTCString();return await L.send({to:O,subject:"Kyro CMS \u2014 Email Connection Test",html:`<!DOCTYPE html>
|
|
125
|
+
`).map(l=>l.trim()).filter(Boolean):[],He=$r.length>0?$r:ys||[];(He.length>0||p)&&w.use("*",async(l,y)=>{let v=l.req.header("Origin")||"*";if(He.length>0&&!He.includes(v))return l.json({error:"Origin not allowed"},403);let E=He.length>0?v:"*";if(l.header("Access-Control-Allow-Origin",E),l.header("Access-Control-Allow-Methods","GET, POST, PATCH, DELETE, OPTIONS"),l.header("Access-Control-Allow-Headers","Content-Type, Authorization, X-API-Key"),p?.credentials&&l.header("Access-Control-Allow-Credentials","true"),l.req.method==="OPTIONS")return l.text("");await y();});let yr=x?.access?.rateLimiting,sr;if(yr?.enabled){let l=yr.maxRequests||100,y=yr.windowMs||6e4;sr=new ja({"api:general":{window:y,max:l}}),w.use("/api/*",async(v,E)=>{if(!sr)return E();let g=v.req.header("CF-Connecting-IP")||v.req.header("X-Forwarded-For")?.split(",")[0]?.trim()||v.req.header("X-Real-IP")||"unknown",f=await sr.check("api:general",g);if(v.header("X-RateLimit-Limit",String(l)),v.header("X-RateLimit-Remaining",String(f.remaining)),v.header("X-RateLimit-Reset",String(f.resetAt)),!f.allowed)return v.json({error:"Too many requests",retryAfter:f.retryAfter},429);await E();});}let Ee=new qa({redis:W,jwtSecret:s||"change-me",baseUrl:process.env.KYRO_BASE_URL||"http://localhost:4321",rateLimiter:sr});k.fromConfig(r).then(l=>{l&&(Ee.email=l);}).catch(l=>{console.error("[Email] Failed to initialize transport from config:",l);}),w.post("/api/auth/login",async l=>Ee.login(l.req.raw)),w.post("/api/auth/register",async l=>{try{let y=await r.findOne({collection:"_globals_system",where:{}});if(y&&y.enableRegistration===!1)return l.json({error:"User registration is currently disabled by administrator."},403);if(y?.defaultRegistrationRole){let v=l.req.raw;if((v.headers.get("content-type")||"").includes("application/json")){let g=await l.req.json();g.role||(g.role=y.defaultRegistrationRole);let f=new Request(v.url,{method:v.method,headers:v.headers,body:JSON.stringify(g)});return Ee.register(f)}}}catch{}return Ee.register(l.req.raw)}),w.post("/api/auth/logout",async l=>Ee.logout(l.req.raw)),w.post("/api/auth/refresh",async l=>Ee.refresh(l.req.raw)),w.get("/api/auth/me",async l=>Ee.me(l.req.raw)),w.post("/api/auth/forgot-password",async l=>Ee.forgotPassword(l.req.raw)),w.post("/api/auth/reset-password",async l=>Ee.resetPassword(l.req.raw)),w.post("/api/auth/change-password",async l=>Ee.changePassword(l.req.raw)),w.get("/api/auth/verify-email",async l=>Ee.verifyEmail(l.req.raw)),w.post("/api/auth/verify-email",async l=>Ee.verifyEmail(l.req.raw)),w.get("/api/auth/verify",async l=>Ee.verifyEmail(l.req.raw)),w.post("/api/auth/verify",async l=>Ee.verifyEmail(l.req.raw)),w.get("/api/auth/sessions",async l=>Ee.listSessions(l.req.raw)),w.post("/api/auth/sessions/refresh",async l=>Ee.refreshSession(l.req.raw)),w.delete("/api/auth/sessions",async l=>Ee.revokeOtherSessions(l.req.raw)),w.delete("/api/auth/sessions/:id",async l=>Ee.revokeSession(l.req.raw,l.req.param("id"))),w.put("/api/auth/sessions/:id/name",async l=>Ee.renameSession(l.req.raw,l.req.param("id"))),w.get("/api/auth/access",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Not authenticated"},401);let E={},g={};for(let f of e.getCollections()){let _={read:(await De(f,"read",l.req.raw,y,v,void 0,I,H)).allowed,create:(await De(f,"create",l.req.raw,y,v,void 0,I,H)).allowed,update:(await De(f,"update",l.req.raw,y,v,void 0,I,H)).allowed,delete:(await De(f,"delete",l.req.raw,y,v,void 0,I,H)).allowed};E[f.slug]=_;}for(let f of e.getGlobals()){let _={read:(await rr(f,"read",l.req.raw,y,v,I)).allowed,update:(await rr(f,"update",l.req.raw,y,v,I)).allowed};g[f.slug]=_;}return l.json({collections:E,globals:g})}catch(y){return l.json({error:y.message},500)}});let Bt=typeof e.hasCollection=="function"&&e.hasCollection("users")?e.getCollection("users"):(()=>{try{return e.getCollection("users")}catch{return a$5}})();w.get("/api/users",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c),E=await De(Bt,"read",l.req.raw,y,v,void 0,I,H);if(!E.allowed)return l.json({error:E.error},E.status||403);let g=parseInt(l.req.query("page")||"1"),f=Math.min(parseInt(l.req.query("limit")||"10"),100),_=l.req.query("search")||void 0,k=[],A=0;if(typeof W.findUsers=="function"){let C=await W.findUsers({page:g,limit:f,search:_});k=C.users||[],A=C.total||0;}else {let C=await r.find({collection:"users",page:g,limit:f,where:_?{email:{contains:_}}:{},tenantId:v});k=C.docs||[],A=C.totalDocs||0;}return l.json({docs:k,totalDocs:A,limit:f,totalPages:Math.ceil(A/f)||1,page:g,pagingCounter:(g-1)*f+1,hasPrevPage:g>1,hasNextPage:g<Math.ceil(A/f),prevPage:g>1?g-1:null,nextPage:g<Math.ceil(A/f)?g+1:null})}catch(y){return console.error("[API] Error listing users:",y),l.json({error:y.message},500)}}),w.get("/api/users/:id",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c),E=l.req.param("id"),g=await W.findUserById(E);return g?l.json({data:g}):l.json({error:"User not found"},404)}catch(y){return l.json({error:y.message},500)}}),w.post("/api/users",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c),E=await De(Bt,"create",l.req.raw,y,v,void 0,I,H);if(!E.allowed)return l.json({error:E.error},E.status||403);let g=await l.req.json();if(!g.email||!g.password)return l.json({error:"Email and password are required"},400);if(await W.findUserByEmail(g.email))return l.json({error:"Email already in use"},400);let _=g.role||"customer";if(_!=="customer"&&y?.role!=="super_admin")return l.json({error:"Forbidden: Only super_admin can assign administrative roles"},403);let k=await W.createUser({email:g.email,password:g.password,name:g.name,role:_,avatar:g.avatar,tenantId:g.tenantId});return y&&W?.createAuditLog({action:"user_create",userId:y.id,resource:"users",resourceId:k.id,success:!0}),l.json({data:k,message:"User created successfully"},201)}catch(y){return l.json({error:y.message},500)}}),w.patch("/api/users/:id",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c),E=await De(Bt,"update",l.req.raw,y,v,void 0,I,H);if(!E.allowed)return l.json({error:E.error},E.status||403);let g=l.req.param("id"),f=await l.req.json(),_=await W.findUserById(g);if(!_)return l.json({error:"User not found"},404);let k={};if(f.name!==void 0&&(k.name=f.name),f.email!==void 0&&(k.email=f.email),f.role!==void 0&&f.role!==_.role){if(y?.role!=="super_admin")return l.json({error:"Forbidden: Only super_admin can modify user roles"},403);k.role=f.role;}f.avatar!==void 0&&(k.avatar=typeof f.avatar=="object"&&f.avatar!==null?f.avatar.id||String(f.avatar):f.avatar),f.tenantId!==void 0&&(k.tenantId=f.tenantId),f.emailVerified!==void 0&&(k.emailVerified=f.emailVerified),f.locked!==void 0&&(k.locked=f.locked),f.failedLoginAttempts!==void 0&&(k.failedLoginAttempts=f.failedLoginAttempts),f.lastLogin!==void 0&&(k.lastLogin=f.lastLogin);let A=await W.updateUser(g,k);return A?(y&&(W?.createAuditLog({action:"user_update",userId:y.id,resource:"users",resourceId:g,success:!0}),f.role&&_.role!==f.role&&W?.createAuditLog({action:"role_change",userId:y.id,resource:"users",resourceId:g,success:!0,metadata:{oldRole:_.role,newRole:f.role}})),l.json({data:A,message:"User updated successfully"})):l.json({error:"User update failed"},500)}catch(y){return l.json({error:y.message},500)}}),w.delete("/api/users/:id",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c),E=await De(Bt,"delete",l.req.raw,y,v,void 0,I,H);if(!E.allowed)return l.json({error:E.error},E.status||403);let g=l.req.param("id");if(y&&y.id===g)return l.json({error:"You cannot delete your own account"},403);let f=await W.findUserById(g);return f?await W.deleteUser(g)?(y&&W?.createAuditLog({action:"user_delete",userId:y.id,resource:"users",resourceId:g,success:!0}),l.json({data:f,message:"User deleted successfully"})):l.json({error:"User deletion failed"},500):l.json({error:"User not found"},404)}catch(y){return l.json({error:y.message},500)}}),w.get("/api/auth/audit-logs",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c),E=e.getCollection("audit_logs");if(E){let L=await De(E,"read",l.req.raw,y,v,void 0,I,H);if(!L.allowed)return l.json({error:L.error},L.status||403)}else if(!y)return l.json({error:"Authentication required"},401);let g=parseInt(l.req.query("page")||"1"),f=Math.min(parseInt(l.req.query("limit")||"50"),100),_=l.req.query("action")||void 0,k=l.req.query("userId")||void 0,A=l.req.query("resource")||void 0,C=await W.findAuditLogs({action:_,userId:k,resource:A,limit:f,offset:(g-1)*f});return l.json({docs:C.logs,totalDocs:C.total,limit:f,totalPages:Math.ceil(C.total/f),page:g,pagingCounter:(g-1)*f+1,hasPrevPage:g>1,hasNextPage:g<Math.ceil(C.total/f),prevPage:g>1?g-1:null,nextPage:g<Math.ceil(C.total/f)?g+1:null})}catch(y){return console.error("[API] Error listing audit logs:",y),l.json({error:y.message},500)}});let Nt=null,Br=null,gt=async()=>{if(Br)throw Br;if(!Nt)try{let l="sqlite";"dialect"in r&&r.dialect==="postgres"&&r instanceof c$1?l=r.dialect:"dialect"in r&&r.dialect==="mongodb"&&(l="mongodb");let y=l==="postgres"&&r instanceof c$1?r.client:r;Nt=await Pc.init(y,{dialect:l});}catch(l){throw console.error("[getMedia] Init error:",l),Br=l,l}return Nt};w.get("/api/media",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=await gt(),E=new URL(l.req.url).origin,g=parseInt(l.req.query("page")||"1"),f=parseInt(l.req.query("limit")||"30"),_=l.req.query("search")||"",k=l.req.query("type")||"",A=l.req.query("folder")||"",C=await v.find({page:g,limit:f,search:_,type:k,folder:A},E);return l.json(C)}catch(y){return console.error("[Media] find error:",y),l.json({error:y.message},500)}}),w.post("/api/media/upload",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=await gt(),E=l.req.header("content-type")||"",g=new URL(l.req.url).origin;if(E.includes("multipart/form-data")){let C=await l.req.formData(),L=C.get("file"),O=C.get("folder")||"";if(!L)return l.json({error:"No file uploaded"},400);let U=await v.upload(L,O,g);return l.json(U)}let f=await l.req.json(),{url:_}=f,k=f.folder||"";if(!_)return l.json({error:"No URL provided"},400);let A=await v.uploadFromUrl(_,k,g);return l.json(A)}catch(y){return console.error("[Media] upload error:",y),l.json({error:y.message},500)}}),w.get("/api/media/folders",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let E=await(await gt()).listFolders();return l.json(E)}catch(y){return console.error("[Media] folders error:",y),l.json({error:y.message},500)}}),w.post("/api/media/folders",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=await gt(),E=await l.req.json(),{name:g,parentPath:f}=E;return g?(await v.createFolder(g,f||""),l.json({message:"Folder created",path:f?`${f}/${g}`:g})):l.json({error:"Folder name is required"},400)}catch(y){return console.error("[Media] create folder error:",y),l.json({error:y.message},500)}}),w.delete("/api/media/folders",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=await gt(),E=l.req.query("path");return E?(await v.deleteFolder(E),l.json({message:"Folder deleted"})):l.json({error:"Path is required"},400)}catch(y){return console.error("[Media] delete folder error:",y),l.json({error:y.message},500)}}),w.delete("/api/media/:id",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=await gt(),E=l.req.param("id"),g=new URL(l.req.url).origin;return await v.delete(E,g),l.json({success:!0})}catch(y){return console.error("[Media] delete error:",y),l.json({error:y.message},500)}}),w.get("/api/media/file/:key{.+$}",async l=>{let y=l.req.param("key"),v=globalThis.STORAGE_BUCKET;if(v){let E=await v.get(y);if(!E)return l.notFound();let g=new Headers;return E.writeHttpMetadata(g),g.set("etag",E.httpEtag),new Response(E.body,{headers:g})}return l.notFound()}),w.get("/api/media/resize",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=l.req.query("url"),E=parseInt(l.req.query("w")||"0"),g=parseInt(l.req.query("h")||"0"),f=l.req.query("fit")||"cover",_=parseFloat(l.req.query("cx")||"0"),k=parseFloat(l.req.query("cy")||"0"),A=parseFloat(l.req.query("cw")||"0"),C=parseFloat(l.req.query("ch")||"0");if(!v)return l.json({error:"URL is required"},400);let O=(await gt()).storage;if(O.name!=="local")return l.redirect(v);let U=O.config?.uploadDir||join(process.cwd(),"public","uploads"),M=O.config?.baseUrl||"/uploads";if(!v.startsWith(M))return l.redirect(v);let K=v.replace(M,""),Q=join(U,K);if(!existsSync(Q))return l.json({error:"File not found"},404);let le=readFileSync(Q),{default:X}=await import('sharp'),xe=X(le);if(A>0&&C>0){let Ye=await X(le).metadata(),Yr=Ye.width||0,At=Ye.height||0;if(Yr>0&&At>0){let Dt=Math.max(0,Math.min(Math.round(_/100*Yr),Yr-1)),Us=Math.max(0,Math.min(Math.round(k/100*At),At-1)),D_=Math.max(1,Math.min(Math.round(A/100*Yr),Yr-Dt)),L_=Math.max(1,Math.min(Math.round(C/100*At),At-Us));xe=xe.extract({left:Dt,top:Us,width:D_,height:L_});}}(E>0||g>0)&&(xe=xe.resize({width:E>0?E:void 0,height:g>0?g:void 0,fit:f}));let Xe=await xe.toBuffer(),Mt=await X(le).metadata();return l.header("Content-Type",`image/${Mt.format||"webp"}`),l.header("Cache-Control","public, max-age=31536000, immutable"),l.body(Xe)}catch(y){return console.error("[Media] resize error:",y),l.json({error:y.message},500)}}),w.get("/api/media/:id",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=await gt(),E=l.req.param("id"),g=new URL(l.req.url).origin,f=await v.findById(E,g);return f?l.json(f):l.json({error:"Media not found"},404)}catch(y){return console.error("[Media] get error:",y),l.json({error:y.message},500)}}),w.patch("/api/media/:id",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=await gt(),E=l.req.param("id"),g=await l.req.json(),f=new URL(l.req.url).origin,_=["folder","metadata","title","alt","caption","originalName"],k={};for(let A of _)g[A]!==void 0&&(k[A]=g[A]);if(Object.keys(k).length>0){let A=await v.update(E,k,f);return l.json({doc:A})}return l.json({error:"No valid fields to update"},400)}catch(y){return console.error("[Media] update error:",y),l.json({error:y.message},500)}}),w.get("/api/media/test",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=await gt();return l.json({status:v?"initialized":"failed",serviceType:v?.constructor?.name})}catch(y){return console.error("[test] Error:",y),l.json({error:y.message,type:y.constructor?.name,stack:y.stack},500)}}),w.get("/api/storage-status",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=typeof globalThis.STORAGE_BUCKET<"u"||typeof l.env?.STORAGE_BUCKET<"u",E=v,g=v?"cloudflare_r2":"local";if(r)try{let f=r.prepare('SELECT provider FROM "_globals_storage-settings" LIMIT 1').get();f&&f.provider&&(E=!0,g=f.provider==="aws"?"s3":f.provider);}catch{try{let f=await r.findOne({collection:"_globals_storage-settings",where:{},draft:!0});f&&f.provider&&(E=!0,g=f.provider==="aws"?"s3":f.provider);}catch{}}return l.json({provider:g,configured:E,usage:0,limit:"unlimited"})}catch(y){return console.error("[Storage] status error:",y),l.json({error:y.message},500)}}),w.get("/api/plugins",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=e.getPlugins(),E=e.storageProviders,g=await Promise.all(v.map(async f=>{let _=!0,k=f.name,A={};try{let O=await r.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});O&&O.states&&(A=O.states);}catch{}A[k]!==void 0&&(_=A[k]),E.setPluginEnabled(k,_);let C=k.replace(/^@[^/]+\//,"");C=C.replace(/^(plugin|kyro)-/,"");let L={ai:"AI",seo:"SEO",s3:"S3",aws:"AWS",api:"API",ui:"UI",ftp:"FTP"};if(C=C.split("-").map(O=>{let U=O.toLowerCase();return L[U]?L[U]:O.charAt(0).toUpperCase()+O.slice(1)}).join(" "),C.toLowerCase().startsWith("storage ")){let O=C.split(" ");O.length===2&&(C=`${O[1]} Storage`);}return {id:k,name:f.displayName||C,version:f.version||"1.0.0",description:f.description||"",enabled:_,status:_?"active":"disabled"}}));return l.json(g)}catch(y){return console.error("[Plugins] list error:",y),l.json({error:y.message},500)}}),w.put("/api/plugins/:name/toggle",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=l.req.param("name"),E=e.storageProviders,f=!E.isPluginEnabled(v),_=[];if(!f)for(let A of E.getAll())A.pluginName===v&&_.push(A.type);if(!(l.req.query("force")==="1")&&!f&&_.length>0){let A="local";try{let C=r?.prepare?.('SELECT provider FROM "_globals_storage-settings" LIMIT 1')?.get();C?.provider&&(A=C.provider);}catch{try{let C=await r?.findOne?.({collection:"_globals_storage-settings",where:{},draft:!0});C?.provider&&(A=C.provider);}catch{}}if(_.includes(A))return l.json({error:`Cannot disable "${v}" \u2014 storage provider "${A}" is currently active. Switch to Local storage first.`,requiresAction:!0,activeProvider:A},409)}try{let A={},C="global",L=await r.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});L&&(A=L.states||{},C=L.id),A[v]=f,L?await r.update({collection:"_globals_plugin-settings",id:C,data:{states:A}}):await r.create({collection:"_globals_plugin-settings",data:{states:A,id:"global"}});}catch(A){console.warn(`[Plugins] Could not persist state for "${v}":`,A);}return E.setPluginEnabled(v,f),l.json({name:v,enabled:f})}catch(y){return console.error("[Plugins] toggle error:",y),l.json({error:y.message},500)}}),w.get("/api/health",l=>l.json({status:"ok",version:"0.12.47",collections:e.getCollectionSlugs(),timestamp:new Date().toISOString()})),w.get("/api/metrics",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let E=y.role==="admin"||y.role==="super_admin",f=e.getCollectionSlugs().filter(M=>!["users","audit_logs","media","_globals_access-settings","_globals_brand-settings"].includes(M)&&!M.startsWith("_globals_")).filter(M=>E||a$6(y,`${M}:read`)),_=0,k={};await Promise.all(f.map(async M=>{try{let Q=(await r.find({collection:M,where:{},limit:1,page:1,tenantId:v})).totalDocs??0;_+=Q,k[M]=Q;}catch{}}));let A=0;try{A=(await r.find({collection:"media",where:{},limit:1,page:1,tenantId:v})).totalDocs??0;}catch{}let C=0;try{C=(await r.find({collection:"users",where:{},limit:1,page:1,tenantId:v})).totalDocs??0;}catch{}let L=0;try{if(d){let M=await d.getWebhooks();L=Array.isArray(M)?M.length:0;}}catch{}let O=0;try{O=(await r.find({collection:d$2,where:{},limit:1,page:1,tenantId:v})).totalDocs??0;}catch{}let U=_+A+C;return l.json({totalDocuments:_,totalMedia:E||a$6(y,"media:read")?A:void 0,totalUsers:E||a$6(y,"users:read")?C:void 0,totalWebhooks:E?L:void 0,totalApiKeys:E?O:void 0,totalStoredRecords:U,collectionCounts:k,collections:f.length,timestamp:new Date().toISOString()})}catch(y){return console.error("[API] Metrics error:",y),l.json({error:y.message},500)}}),w.get("/api/analytics",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);if(!(y.role==="admin"||y.role==="super_admin"))return l.json({error:"Unauthorized"},403);let f=(await r.find({collection:"orders",where:{},limit:1e3,page:1,tenantId:v})).docs||[],_=await r.findOne({collection:"_globals_store-settings",where:{},tenantId:v}),k=_?.currency?.code||_?.currency||"USD",A={},C={},L={};f.forEach(M=>{let K=M.createdAt||M.updatedAt,Q=K?new Date(K).toISOString().split("T")[0]:new Date().toISOString().split("T")[0];A[Q]||(A[Q]=0),C[Q]||(C[Q]=0);let le=typeof M.total=="number"?M.total:parseFloat(String(M.total||0));A[Q]+=isNaN(le)?0:le,C[Q]+=1;let X=M.orderStatus||M.status||"pending";L[X]=(L[X]||0)+1;});let O=Object.keys(A).sort().map(M=>({date:M,revenue:Math.round(A[M]*100)/100,orders:C[M]})),U=Math.round(O.reduce((M,K)=>M+K.revenue,0)*100)/100;return l.json({chartData:O,totalRevenue:U,totalOrders:f.length,ordersByStatus:L,currencyCode:typeof k=="string"?k:"USD"})}catch(y){return l.json({error:y.message},500)}}),w.get("/api/kyro/schema",async l=>{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=g=>g.map(f=>{let _={name:f.name,type:f.type,label:f.label,required:f.required??false,unique:f.unique??false,indexed:f.indexed??false,defaultValue:f.defaultValue,admin:f.admin?{...f.admin}:void 0};return f.minLength!==void 0&&(_.minLength=f.minLength),f.maxLength!==void 0&&(_.maxLength=f.maxLength),f.pattern!==void 0&&(_.pattern=f.pattern),f.variant!==void 0&&(_.variant=f.variant),f.hasMany!==void 0&&(_.hasMany=f.hasMany),f.min!==void 0&&(_.min=f.min),f.max!==void 0&&(_.max=f.max),f.step!==void 0&&(_.step=f.step),f.integer!==void 0&&(_.integer=f.integer),f.options&&(_.options=f.options),f.relationTo&&(_.relationTo=f.relationTo),f.maxDepth!==void 0&&(_.maxDepth=f.maxDepth),f.minRows!==void 0&&(_.minRows=f.minRows),f.maxRows!==void 0&&(_.maxRows=f.maxRows),f.localized!==void 0&&(_.localized=f.localized),f.language&&(_.language=f.language),f.format&&(_.format=f.format),f.allowedTypes&&(_.allowedTypes=f.allowedTypes),f.maxSize&&(_.maxSize=f.maxSize),(f.type==="group"||f.type==="row"||f.type==="collapsible"&&f.fields)&&(_.fields=v(f.fields)),f.type==="array"&&f.fields&&(_.fields=v(f.fields)),f.type==="blocks"&&f.blocks&&(_.blocks=f.blocks.map(k=>({slug:k.slug,label:k.label,fields:v(k.fields)}))),f.type==="tabs"&&f.tabs&&(_.tabs=f.tabs.map(k=>({label:k.label,name:k.name,fields:v(k.fields)}))),_}),E={collections:{},globals:{}};for(let g of e.getCollections()){let f=g.slug;try{E.collections[f]={slug:f,label:g.label||f,fields:v(g.fields),jsonSchema:ro(e.getZodSchema(f),{target:"openApi3"}),createSchema:ro(e.getCreateZodSchema(f),{target:"openApi3"}),updateSchema:ro(e.getUpdateZodSchema(f),{target:"openApi3"}),procedures:{find:{collection:f,where:"Record<string,any>",sort:"string",limit:"number",page:"number",depth:"number",select:"string[]",draft:"boolean"},findByID:{collection:f,id:"string",depth:"number",select:"string[]",draft:"boolean"},create:{collection:f,data:"Record<string,any>",depth:"number",select:"string[]"},update:{collection:f,id:"string",data:"Record<string,any>",depth:"number",select:"string[]",baseUpdatedAt:"string"},delete:{collection:f,id:"string"},count:{collection:f,where:"Record<string,any>"}}};}catch{}}for(let g of e.getGlobals()){let f=g.slug,_=g.fields;if(f==="storage-settings"){let k=e.storageProviders,A=k.getAll(),C=new Set(k.getAllAvailable(O=>k.isPluginEnabled(O)).map(O=>O.type));C.add("local");let L=new Set(A.map(O=>O.type));_=_.filter(O=>O.type==="group"&&O.name&&L.has(O.name)?C.has(O.name):true).map(O=>O.name==="provider"&&O.type==="select"?{...O,options:O.options.filter(U=>C.has(U.value))}:O);}try{E.globals[f]={slug:f,label:g.label||f,fields:v(_),jsonSchema:ro(e.getZodSchema(f),{target:"openApi3"}),procedures:{get:{},update:{data:"Record<string,any>"}}};}catch{}}return l.json(E)}),w.get("/api/collections",async l=>{let{user:y}=await Z(l.req.raw,G,i,c);if(!y)return l.json({error:"Authentication required"},401);let v=e.getCollections().map(E=>({slug:E.slug,label:E.label||E.slug,fields:E.fields.filter(g=>g.name).map(g=>({name:g.name,type:g.type,required:g.required,label:g.label}))}));return l.json(v)});function so(l,y,v){if(v in y)return y[v];for(let E of l)if(E.name){if(E.type==="tabs"&&E.tabs){let g=y[E.name];if(g&&typeof g=="object"&&v in g)return g[v]}if((E.type==="group"||E.type==="collapsible")&&E.fields){let g=y[E.name];if(g&&typeof g=="object"){if(v in g)return g[v];let f=so(E.fields,g,v);if(f!==void 0)return f}}}}w.get("/api/search",async l=>{try{let y=l.req.query("q")||"",v=l.req.query("collections")||"",E=Math.min(parseInt(l.req.query("limit")||"10"),50);if(!y||y.length<2)return l.json({results:[],message:"Query too short"});let{user:g,tenantId:f}=await Z(l.req.raw,G,i,c),_=v?v.split(",").filter(Boolean):e.getCollectionSlugs(),k=[],A=new RegExp(y.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),"i");for(let C of e.getCollections()){if(!_.includes(C.slug)||!(await De(C,"read",l.req.raw,g,f,void 0,I,H)).allowed)continue;let O=C.fields.filter(U=>U.name&&U.name!=="id"&&(U.type==="text"||U.type==="email"||U.type==="textarea"||U.type==="richtext"||U.indexed)&&!U.admin?.hidden).map(U=>U.name);if(O.length!==0)try{let U=O.map(K=>{let Q={};return Q[K]={like:`%${y}%`},Q}),M=await r.find({collection:C.slug,where:{OR:U},limit:E,tenantId:f});await a$7(M.docs,C.fields,r,e,1,0);for(let K of M.docs){let Q=C.admin?.useAsTitle||O.find(X=>X==="title"||X==="name"||X==="heading"||X==="slug"),le=Q?so(C.fields,K,Q)??K.id:K.id;k.push({collection:C.slug,label:C.label||C.slug,id:K.id,title:String(le||"Untitled"),doc:K});}}catch(U){console.error(`Search error for ${C.slug}:`,U);}}return k.sort((C,L)=>C.label.localeCompare(L.label)),l.json({results:k})}catch(y){return l.json({error:y.message,results:[]},500)}}),w.get("/api/keys",async l=>{try{let{user:y,tenantId:v}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:read"))return l.json({error:"Forbidden"},403);let E=parseInt(l.req.query("page")||"1"),g=Math.min(parseInt(l.req.query("limit")||"50"),100),f=await r.find({collection:d$2,where:{},page:E,limit:g,tenantId:v}),_=(f.docs||[]).map(k=>({id:k.id,name:k.name,keyPrefix:k.keyPrefix,permissions:k.permissions||[],lastUsed:k.lastUsedAt,createdAt:k.createdAt}));return l.json({docs:_,totalDocs:f.totalDocs||_.length,totalPages:f.totalPages||1})}catch(y){return console.error("[ApiKeys] GET error:",y),l.json({error:y.message},500)}}),w.post("/api/keys",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:admin"))return l.json({error:"Forbidden"},403);let v=await l.req.json();if(!v.name||typeof v.name!="string")return l.json({error:"name is required"},400);let E=i$1(),g=await r.create({collection:d$2,data:{userId:y.id,name:v.name,key:E,keyPrefix:j$2(E),permissions:Array.isArray(v.permissions)?v.permissions:["*"],expiresAt:v.expiresAt||null,createdAt:new Date().toISOString()}});return await W?.createAuditLog({action:"api_key_create",userId:y.id,resource:"api_key",resourceId:g.id,success:!0,metadata:{keyName:v.name}}),l.json({...g,key:E,permissions:Array.isArray(v.permissions)?v.permissions:["*"]},201)}catch(y){return console.error("[ApiKeys] POST error:",y),l.json({error:y.message},500)}}),w.delete("/api/keys/:id",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:admin"))return l.json({error:"Forbidden"},403);let v=l.req.param("id"),E=await r.findByID({collection:d$2,id:v});return E?(await r.delete({collection:d$2,id:v}),await W?.createAuditLog({action:"api_key_delete",userId:y.id,resource:"api_key",resourceId:v,success:!0,metadata:{keyName:E.name}}),l.json({message:"API key deleted"})):l.json({error:"API key not found"},404)}catch(y){return console.error("[ApiKeys] DELETE error:",y),l.json({error:y.message},500)}}),w.patch("/api/keys/:id",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:admin"))return l.json({error:"Forbidden"},403);let v=l.req.param("id"),E=await l.req.json(),g=await r.findByID({collection:d$2,id:v});if(!g)return l.json({error:"API key not found"},404);let f={};if(typeof E.name=="string"&&E.name.trim()&&(f.name=E.name.trim()),Array.isArray(E.permissions)&&(f.permissions=E.permissions),E.expiresAt!==void 0&&(f.expiresAt=E.expiresAt||null),Object.keys(f).length===0)return l.json({error:"Nothing to update"},400);let _=await r.update({collection:d$2,id:v,data:f});return l.json({..._,keyPrefix:g.keyPrefix})}catch(y){return console.error("[ApiKeys] PATCH error:",y),l.json({error:y.message},500)}}),w.post("/api/keys/:id/rotate",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:admin"))return l.json({error:"Forbidden"},403);let v=l.req.param("id"),E=await r.findByID({collection:d$2,id:v});if(!E)return l.json({error:"API key not found"},404);let g=i$1(),f=await r.update({collection:d$2,id:v,data:{key:g,keyPrefix:j$2(g),lastUsedAt:null}});return await W?.createAuditLog({action:"api_key_rotate",userId:y.id,resource:"api_key",resourceId:v,success:!0,metadata:{keyName:E.name}}),l.json({...f,key:g,permissions:E.permissions,expiresAt:E.expiresAt})}catch(y){return console.error("[ApiKeys] rotate error:",y),l.json({error:y.message},500)}}),w.get("/api/webhooks/actions",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:read"))return l.json({error:"Forbidden"},403);let v={generic:{label:"Custom URL",description:"POST to any endpoint with Kyro payload",configFields:[],envVars:[]},"github-push":{label:"GitHub Push",description:"Push an empty commit to simulate a push event",configFields:[{name:"githubOwner",label:"Owner",required:!0,placeholder:"e.g., kyro-dev"},{name:"githubRepo",label:"Repository",required:!0,placeholder:"e.g., my-website"},{name:"githubBranch",label:"Branch",required:!1,placeholder:"main"}],envVars:["GITHUB_TOKEN"]}};return l.json({actions:v})}catch(y){return console.error("[Webhooks] actions error:",y),l.json({error:y.message},500)}}),w.get("/api/webhooks",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:read"))return l.json({error:"Forbidden"},403);if(!d)return l.json({error:"Webhook service not available"},503);let v=await d.getWebhooks();return l.json({docs:v})}catch(y){return console.error("[Webhooks] GET error:",y),l.json({error:y.message},500)}}),w.post("/api/webhooks",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!d)return l.json({error:"Webhook service not available"},503);let v=await l.req.json(),E=await d.createWebhook(v);return await W?.createAuditLog({action:"webhook_create",userId:y.id,resource:"webhook",resourceId:E.id,success:!0,metadata:{name:E.name,url:E.url}}),l.json(E,201)}catch(y){return console.error("[Webhooks] POST error:",y),l.json({error:y.message},500)}}),w.get("/api/webhooks/:id",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:read"))return l.json({error:"Forbidden"},403);if(!d)return l.json({error:"Webhook service not available"},503);let v=l.req.param("id"),E=await d.getWebhookById(v);return E?l.json(E):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] GET :id error:",y),l.json({error:y.message},500)}}),w.patch("/api/webhooks/:id",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!d)return l.json({error:"Webhook service not available"},503);let v=l.req.param("id"),E=await l.req.json(),g=await d.updateWebhook(v,E);return g?(await W?.createAuditLog({action:"webhook_update",userId:y.id,resource:"webhook",resourceId:v,success:!0,metadata:{name:g.name}}),l.json(g)):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] PATCH error:",y),l.json({error:y.message},500)}}),w.delete("/api/webhooks/:id",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!d)return l.json({error:"Webhook service not available"},503);let v=l.req.param("id"),E=await d.getWebhookById(v);return E?(await d.deleteWebhook(v),await W?.createAuditLog({action:"webhook_delete",userId:y.id,resource:"webhook",resourceId:v,success:!0,metadata:{name:E.name}}),l.json({message:"Webhook deleted"})):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] DELETE error:",y),l.json({error:y.message},500)}}),w.post("/api/webhooks/:id/test",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!d)return l.json({error:"Webhook service not available"},503);let v=l.req.param("id"),E=await d.testWebhook(v);return E?l.json(E):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] test error:",y),l.json({error:y.message},500)}}),w.get("/api/webhooks/:id/history",async l=>{try{let{user:y}=await Z(l.req.raw,G,i,c);if(!y||!a$6(y,"users:read"))return l.json({error:"Forbidden"},403);if(!d)return l.json({error:"Webhook service not available"},503);let v=l.req.param("id"),E=Math.min(parseInt(l.req.query("limit")||"50"),100),g=await d.getDeliveryHistory(v,E);return l.json({docs:g})}catch(y){return console.error("[Webhooks] history error:",y),l.json({error:y.message},500)}});function no(l){let y={},v=["name","type","required","hasMany","relationTo","options","min","max","minLength","maxLength","defaultValue","label","localized","admin","unique","index","hidden","readOnly","deprecated"];for(let E of v)E in l&&(y[E]=l[E]);return l.fields&&(y.fields=l.fields.map(no)),l.tabs&&(y.tabs=l.tabs.map(E=>({label:E.label,name:E.name,fields:E.fields.map(no)}))),y}w.get("/api/__schema",async l=>{try{let{user:y,apiKeyContext:v}=await Z(l.req.raw,G,i,c);if(!y&&!v)return l.json({error:"Unauthorized"},401);let g=e.getCollections().filter(f=>f.slug!=="users"&&f.slug!=="audit_logs").map(f=>({slug:f.slug,label:f.label,labelPlural:f.labelPlural,singularLabel:f.singularLabel,timestamps:f.timestamps,auth:!!f.auth,tenantScoped:!!f.tenantScoped,upload:f.upload?{staticDir:f.upload.staticDir,imageSizes:f.upload.imageSizes,mimeTypes:f.upload.mimeTypes}:void 0,fields:f.fields.map(no)}));return l.json(g)}catch(y){return console.error("[Schema] error:",y),l.json({error:y.message},500)}});let Gd=e.getCollections();for(let l of Gd){let E=function(g,f){let _=[],k=new Set([...Object.keys(g),...Object.keys(f)]);for(let A of k)A==="id"||A==="createdAt"||A==="updatedAt"||JSON.stringify(g[A])!==JSON.stringify(f[A])&&_.push({field:A,oldValue:A in g?g[A]:void 0,newValue:A in f?f[A]:void 0});return _};let y=l.slug;if(y==="users"||y==="audit_logs")continue;let v=`/api/${y}`;w.post(`${v}/dynamic-options/:fieldName`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"read",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);let C=g.req.param("fieldName"),L=await g.req.json(),{data:O,siblingData:U}=L,M=bs(l.fields,C);if(!M)return g.json({error:"Field not found"},404);if(M.type!=="select")return g.json({error:"Field is not a select field"},400);let K=[];return typeof M.options=="function"?K=await M.options({data:O||{},siblingData:U||{}}):Array.isArray(M.options)&&(K=M.options),g.json({options:K})}catch(f){return g.json({error:f.message},500)}}),w.get(v,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"read",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);_&&r.setTenantContext({tenantId:_,userId:f?.id??"",role:f?.role,isSuperAdmin:f?.role==="super_admin"});let C=new URL(g.req.url),L=parseInt(C.searchParams.get("page")||"1"),O=Math.min(parseInt(C.searchParams.get("limit")||"10"),100),U=C.searchParams.get("sort")||void 0,M=parseInt(C.searchParams.get("depth")||"0"),K=C.searchParams.get("select")?.split(",")||void 0,Q=C.searchParams.get("draft"),le=Q==="true"?!0:Q==="false"?!1:!!f,X={},xe=C.searchParams.get("where");if(xe)try{X=JSON.parse(xe);}catch{return g.json({error:"Invalid JSON in where parameter"},400)}let Xe=await r.find({collection:y,where:X,sort:U,limit:O,page:L,depth:M,tenantId:_,select:K,draft:le});return await a$7(Xe.docs,l.fields,r,e,1,M),g.json(a$8(Xe))}catch(f){return console.error("[API] list error:",f),g.json({error:f.message},500)}}),w.get(`${v}/:id/versions`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"read",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);let C=g.req.param("id");if(!C)return g.json({error:"Missing document ID"},400);let L=new URL(g.req.url),O=L.searchParams.get("compareA"),U=L.searchParams.get("compareB");if(Mc(W,k,`${v}/${C}/versions`,"GET",g.req.raw),O&&U){let[le,X]=await Promise.all([r.findVersionByID({collection:y,versionId:O,tenantId:_}),r.findVersionByID({collection:y,versionId:U,tenantId:_})]);if(!le||!X)return g.json({error:"Version not found"},404);let xe=E(le.data,X.data);return g.json({diffs:xe})}let M=parseInt(L.searchParams.get("page")||"1"),K=Math.min(parseInt(L.searchParams.get("limit")||"10"),100),Q=await r.findVersions({collection:y,documentId:C,page:M,limit:K,tenantId:_});return g.json(Q)}catch(f){return console.error("[API] versions error:",f),g.json({error:f.message},500)}}),w.put(`${v}/:id/draft`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"update",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);let C=g.req.param("id"),L=await g.req.json(),O=jc(L),U=await r.findByID({collection:y,id:C,tenantId:_,draft:!0});if(!U)return g.json({error:"Document not found"},404);let M;L.delta?M={...U,...L.delta}:M=L.data??Fd(L);let K=await r.updateLatestVersion({collection:y,documentId:C,data:M,status:"draft",tenantId:_});return f&&W?.createAuditLog({action:"document_update",userId:f.id,resource:y,resourceId:C,success:!0,metadata:{type:"draft_save"}}),g.json({data:K,message:"Draft saved successfully"})}catch(f){return g.json({error:f.message},500)}}),w.delete(`${v}/:id/draft`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"update",g.req.raw,f,_,k,I,H);return A.allowed?(f&&W?.createAuditLog({action:"document_update",userId:f.id,resource:y,resourceId:g.req.param("id"),success:!0,metadata:{type:"draft_discard"}}),g.json({message:"Draft discarded successfully"})):g.json({error:A.error},A.status||403)}catch(f){return g.json({error:f.message},500)}}),w.get(`${v}/:id`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=new URL(g.req.url),C=A.searchParams.get("draft"),L=A.searchParams.get("kyroToken"),O=!1;if(C==="true"&&L&&s)try{let X=await Oa(L,s,"HS256");X&&X.type==="preview"&&X.collection===l.slug&&(O=!0);}catch(X){console.warn("Invalid preview token",X);}if(!O){let X=await De(l,"read",g.req.raw,f,_,k,I,H);if(!X.allowed)return g.json({error:X.error},X.status||403)}let U=g.req.param("id"),M=parseInt(A.searchParams.get("depth")||"0"),K=A.searchParams.get("select")?.split(",")||void 0,Q=C==="true"?!0:C==="false"?!1:!!f,le=await r.findByID({collection:y,id:U,depth:M,tenantId:_,select:K,draft:Q});return !le&&l.fields.some(X=>X.name==="slug")&&(le=await r.findOne({collection:y,where:{slug:U},tenantId:_,draft:Q})),le?(await a$7([le],l.fields,r,e,1,M),g.json({data:a$8(le)})):g.json({error:"Document not found"},404)}catch(f){return g.json({error:f.message},500)}}),w.post(`${v}/preview-url`,async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k=await De(l,"read",g.req.raw,f,_);if(!k.allowed)return g.json({error:k.error||"Forbidden"},k.status||403);let A=await g.req.json().catch(()=>({})),C="";s&&(C=await Ia({type:"preview",collection:l.slug,id:A.id,exp:Math.floor(Date.now()/1e3)+3600},s,"HS256"));let L="";if(l.admin?.preview){L=await l.admin.preview(A,{req:g.req.raw,token:C});try{let O=new URL(L,"http://localhost");O.searchParams.has("preview")||O.searchParams.set("preview","true"),!O.searchParams.has("kyroToken")&&C&&O.searchParams.set("kyroToken",C),L=L.startsWith("http")?O.toString():`${O.pathname}${O.search}`;}catch{}}else {let O="";try{let M=await r.findOne({collection:"_globals_site-settings",where:{}});M?.siteUrl&&(O=M.siteUrl);}catch{}if(!O)return g.json({error:"No site URL configured in settings, and no custom preview function defined for this collection."},400);O=O.replace(/\/$/,"");let U=A.slug||A.id||"";L=`${O}/${l.slug}/${U}?preview=true&kyroToken=${C}`;}return g.json({url:L})}catch(f){return g.json({error:f.message},500)}}),w.post(v,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"create",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);_&&r.setTenantContext({tenantId:_,userId:f?.id??"",role:f?.role,isSuperAdmin:f?.role==="super_admin"}),Mc(W,k,v,"POST",g.req.raw);let L=await g.req.json();ts(L,l.fields),rs(l.fields,L);let O=g.req.raw;if(l.hooks?.beforeValidate)for(let X of l.hooks.beforeValidate){let xe=await X({collection:y,data:L,req:O,user:f,tenantId:_,operation:"create"});xe&&typeof xe=="object"&&!Array.isArray(xe)&&Object.assign(L,xe);}let U=e.getCreateZodSchema(y);try{L=U.parse(L);}catch(X){return g.json({error:`Validation failed: ${mo(X.errors)}`,details:X.errors},400)}l.tenantScoped&&_&&(L.tenantId=_);let M=l.versions?.drafts===!0,K=l.fields.find(X=>X.name==="status"),Q=K?.type==="select"&&Array.isArray(K.options)&&K.options.some(X=>X.value==="published");if(M?L.status="draft":Q&&!L.status&&(L.status="published"),l.hooks?.beforeChange)for(let X of l.hooks.beforeChange){let xe=await X({collection:y,data:L,req:O,user:f,tenantId:_,operation:"create"});xe&&typeof xe=="object"&&!Array.isArray(xe)&&Object.assign(L,xe);}let le=await r.create({collection:y,data:L,tenantId:_});if(M&&await r.createVersion({collection:y,documentId:le.id,data:L,status:"draft",createdBy:f?.id,changeDescription:"Created",tenantId:_}),l.hooks?.afterChange)for(let X of l.hooks.afterChange)await X({collection:y,doc:le,data:L,req:O,user:f,tenantId:_,operation:"create"});return d&&d.trigger(da(y,"create"),{collection:y,operation:"create",data:le,user:f?{id:f.id,email:f.email,role:f.role}:void 0,tenantId:_}).catch(X=>console.error("[Webhook] Failed to trigger:",X)),f&&W?.createAuditLog({action:"document_create",userId:f.id,resource:y,resourceId:le.id,success:!0}),g.json({data:le,message:"Created successfully"},201)}catch(f){return f.name==="ZodError"?g.json({error:`Validation failed: ${mo(f.errors)}`,details:f.errors},400):g.json({error:f.message},500)}}),w.patch(`${v}/:id`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"update",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);let C=g.req.param("id"),L=await g.req.json(),O=jc(L),U=await r.findByID({collection:y,id:C,tenantId:_,draft:!0});if(!U)return g.json({error:"Document not found"},404);if(O&&U.updatedAt&&O!==U.updatedAt)return g.json(Hd(O,U),409);let M=Object.fromEntries(Object.entries(Fd(L)).filter(([Mt,Ye])=>Ye!=="null"&&Ye!==void 0));ts(M,l.fields),rs(l.fields,M);let K=g.req.raw;if(l.hooks?.beforeValidate)for(let Mt of l.hooks.beforeValidate){let Ye=await Mt({collection:y,data:M,originalDoc:U,req:K,user:f,tenantId:_,operation:"update"});Ye&&typeof Ye=="object"&&!Array.isArray(Ye)&&Object.assign(M,Ye);}if(M=e.getUpdateZodSchema(y).parse(M),l.hooks?.beforeChange)for(let Mt of l.hooks.beforeChange){let Ye=await Mt({collection:y,data:M,originalDoc:U,req:K,user:f,tenantId:_,operation:"update"});Ye&&typeof Ye=="object"&&!Array.isArray(Ye)&&Object.assign(M,Ye);}let le=g.req.header("X-Draft")==="true",X=l.versions?.drafts===!0,xe=g.req.query("autosave")==="true",Xe;if(X&&le?await r.createVersion({collection:y,documentId:C,data:M,status:"draft",autosave:xe,createdBy:f?.id,changeDescription:xe?"Autosave":"Draft saved",tenantId:_}):X?(await r.update({collection:y,id:C,data:{...M,status:"published"},tenantId:_}),await r.createVersion({collection:y,documentId:C,data:M,status:"published",createdBy:f?.id,changeDescription:"Published",tenantId:_})):await r.update({collection:y,id:C,data:M,tenantId:_}),Xe=await r.findByID({collection:y,id:C,tenantId:_,draft:!0}),l.hooks?.afterChange)for(let Mt of l.hooks.afterChange)await Mt({collection:y,doc:Xe,data:M,originalDoc:U,req:K,user:f,tenantId:_,operation:"update"});return d&&!xe&&d.trigger(da(y,"update"),{collection:y,operation:"update",data:Xe,previousData:U,user:f?{id:f.id,email:f.email,role:f.role}:void 0,tenantId:_}).catch(Mt=>console.error("[Webhook] Failed to trigger:",Mt)),Mc(W,k,`${v}/${C}`,"PATCH",g.req.raw),f&&W?.createAuditLog({action:"document_update",userId:f.id,resource:y,resourceId:C,success:!0}),g.json({data:Xe,message:X?"Draft saved":"Updated successfully"})}catch(f){return f.name==="ZodError"?(console.error(`[PATCH ${v}/:id] Validation failed:`,f.errors),g.json({error:`Validation failed: ${mo(f.errors)}`,details:f.errors},400)):(console.error(`[PATCH ${v}/:id] ERROR:`,f.message,"CAUSE:",f.cause?.message||f.cause,"QUERY:",f.query),g.json({error:f.message},500))}}),w.delete(`${v}/:id`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"delete",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);_&&r.setTenantContext({tenantId:_,userId:f?.id??"",role:f?.role,isSuperAdmin:f?.role==="super_admin"});let C=g.req.param("id"),L=g.req.raw,O=await r.findByID({collection:y,id:C,tenantId:_,draft:!0});if(!O)return g.json({error:"Document not found"},404);if(l.hooks?.beforeDelete)for(let M of l.hooks.beforeDelete)await M({collection:y,doc:O,req:L,user:f,tenantId:_,operation:"delete"});let U=await r.delete({collection:y,id:C,tenantId:_});if(l.hooks?.afterDelete)for(let M of l.hooks.afterDelete)await M({collection:y,doc:U,originalDoc:O,req:L,user:f,tenantId:_,operation:"delete"});return d&&d.trigger(da(y,"delete"),{collection:y,operation:"delete",data:U,previousData:O,user:f?{id:f.id,email:f.email,role:f.role}:void 0,tenantId:_}).catch(M=>console.error("[Webhook] Failed to trigger:",M)),Mc(W,k,`${v}/${C}`,"DELETE",g.req.raw),f&&W?.createAuditLog({action:"document_delete",userId:f.id,resource:y,resourceId:C,success:!0}),g.json({data:U,message:"Deleted successfully"})}catch(f){return console.error(`[DELETE] Error deleting ${y}:`,f),g.json({error:f.message||String(f)},500)}}),w.post(`${v}/:id/duplicate`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"create",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);let C=g.req.param("id"),L=await r.findByID({collection:y,id:C,tenantId:_,draft:!0});if(!L)return g.json({error:"Document not found"},404);let{id:O,createdAt:U,updatedAt:M,...K}=L;Zs(l.fields,K);let Q=Date.now().toString(36);"slug"in K&&typeof K.slug=="string"&&(K.slug=`${K.slug||"document"}-copy-${Q}`),"title"in K&&typeof K.title=="string"?K.title=`${K.title||"Copy"} (Copy)`:"name"in K&&typeof K.name=="string"&&(K.name=`${K.name||"Copy"} (Copy)`);let le=await r.create({collection:y,data:{...K,status:"draft"},tenantId:_});return g.json({data:le,message:"Document duplicated successfully"})}catch(f){return console.error("[Duplicate] Error:",f),g.json({error:f.message||String(f)},500)}}),w.post(`${v}/:id/versions/:versionId/restore`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"update",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);let C=g.req.param("id"),L=g.req.param("versionId"),O=await r.findVersionByID({collection:y,versionId:L,tenantId:_});if(!O)return g.json({error:"Version not found"},404);let U=await r.update({collection:y,id:C,data:{...O.data,status:"draft"},tenantId:_});return g.json({data:U,message:"Version restored successfully"})}catch(f){return g.json({error:f.message},500)}}),w.post(`${v}/:id/versions`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"update",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);let C=await g.req.json(),{versionId:L,action:O}=C;if(O==="restore"&&L){let U=await r.findVersionByID({collection:y,versionId:L,tenantId:_});if(!U)return g.json({error:"Version not found"},404);let M=await r.update({collection:y,id:g.req.param("id"),data:{...U.data,status:"draft"},tenantId:_});return g.json({data:M,message:"Version restored successfully"})}return g.json({error:"Invalid action"},400)}catch(f){return g.json({error:f.message},500)}}),w.post(`${v}/:id/publish`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"update",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);_&&r.setTenantContext({tenantId:_,userId:f?.id??"",role:f?.role,isSuperAdmin:f?.role==="super_admin"});let C=g.req.param("id"),L=await g.req.json().catch(()=>({})),O=jc(L),U=await r.findByID({collection:y,id:C,tenantId:_,draft:!0});if(!U)return g.json({error:"Document not found"},404);if(O&&U.updatedAt&&O!==U.updatedAt)return g.json(Hd(O,U),409);let M={status:"published"},K=U;if(l.versions?.drafts){let le=await r.findVersions({collection:y,documentId:C,limit:1,sort:"-createdAt",tenantId:_});if(le.docs.length>0){let X=le.docs[0];K={...U,...X.data},M={...X.data,...M};}}let Q=await r.update({collection:y,id:C,data:M,tenantId:_});return l.versions?.drafts&&await r.createVersion({collection:y,documentId:C,data:{...K,status:"published"},status:"published",createdBy:f?.id,changeDescription:"Published",tenantId:_}),d&&d.trigger(da(y,"update"),{collection:y,operation:"update",data:Q,user:f?{id:f.id,email:f.email,role:f.role}:void 0,tenantId:_}).catch(le=>console.error("[Webhook] Failed to trigger:",le)),g.json({data:Q,message:"Published successfully"})}catch(f){return g.json({error:f.message},500)}}),w.post(`${v}/:id/unpublish`,async g=>{try{let{user:f,tenantId:_,apiKeyContext:k}=await Z(g.req.raw,G,i,c),A=await De(l,"update",g.req.raw,f,_,k,I,H);if(!A.allowed)return g.json({error:A.error},A.status||403);let C=g.req.param("id");if(!await r.findByID({collection:y,id:C,tenantId:_,draft:!0}))return g.json({error:"Document not found"},404);let O=await r.update({collection:y,id:C,data:{status:"draft"},tenantId:_});return d&&d.trigger(da(y,"update"),{collection:y,operation:"update",data:O,user:f?{id:f.id,email:f.email,role:f.role}:void 0,tenantId:_}).catch(U=>console.error("[Webhook] Failed to trigger:",U)),g.json({data:O,message:"Unpublished successfully"})}catch(f){return g.json({error:f.message},500)}});}for(let l of e.getGlobals()){let y=l.slug,v=`/api/globals/${y}`;w.post(`${v}/dynamic-options/:fieldName`,async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k=await rr(l,"read",g.req.raw,f,_,I);if(!k.allowed)return g.json({error:k.error},k.status||403);let A=g.req.param("fieldName"),C=await g.req.json(),{data:L,siblingData:O}=C,U=bs(l.fields,A);if(!U)return g.json({error:"Field not found"},404);if(U.type!=="select")return g.json({error:"Field is not a select field"},400);let M=[];return typeof U.options=="function"?M=await U.options({data:L||{},siblingData:O||{}}):Array.isArray(U.options)&&(M=U.options),g.json({options:M})}catch(f){return g.json({error:f.message},500)}}),w.get(v,async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k=new URL(g.req.url),A=k.searchParams.get("kyroToken"),C=k.searchParams.get("draft"),L=!1;if(C==="true"&&A&&s)try{let Q=await Oa(A,s,"HS256");Q&&Q.type==="preview"&&Q.collection===`_globals_${l.slug}`&&(L=!0);}catch(Q){console.warn("Invalid preview token",Q);}if(!L){let Q=await rr(l,"read",g.req.raw,f,_,I);if(!Q.allowed)return g.json({error:Q.error},Q.status||403)}let O=C==="true"?!0:C==="false"?!1:!!f,U=parseInt(k.searchParams.get("depth")||"0"),K=(await r.find({collection:`_globals_${y}`,where:{},tenantId:_,draft:O,depth:U,limit:1})).docs[0];if(K&&U>0&&await a$7([K],l.fields,r,e,1,U),y==="storage-settings"&&(typeof globalThis.STORAGE_BUCKET<"u"||typeof g.env?.STORAGE_BUCKET<"u")&&(K?K.provider||(K.provider="cloudflare_r2"):K={id:y,provider:"cloudflare_r2"}),y==="system"){let Q=dv.randomBytes(32).toString("hex");K?K.appSecret||(await r.update({collection:`_globals_${y}`,id:y,data:{appSecret:Q},tenantId:_}),K.appSecret=Q):K=await r.create({collection:`_globals_${y}`,data:{id:y,appSecret:Q},tenantId:_});}return g.json({data:K||{}})}catch(f){return g.json({error:f.message},500)}});let E=async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k$1=await rr(l,"update",g.req.raw,f,_,I);if(!k$1.allowed)return g.json({error:k$1.error},k$1.status||403);let A=new URL(g.req.url),C=parseInt(A.searchParams.get("depth")||"0"),L=await g.req.json(),O=jc(L),U=Fd(L),M=Object.fromEntries(Object.entries(U).filter(([Dt,Us])=>Us!==null&&Us!=="null"&&Us!==void 0));ts(M,l.fields),rs(l.fields,M);let K=e.getUpdateZodSchema(y),Q;try{Q=K.parse(M);}catch(Dt){return g.json({error:`Validation failed: ${mo(Dt.errors)}`,details:Dt.errors},400)}let le=new Set(["id","createdAt","updatedAt","status","baseUpdatedAt","_baseUpdatedAt"]),X=Object.fromEntries(Object.entries(Q).filter(([Dt])=>!le.has(Dt))),xe=`_globals_${y}`,Xe=await r.findOne({collection:xe,where:{},tenantId:_,draft:!0});if(Xe&&O&&Xe.updatedAt&&O!==Xe.updatedAt)return g.json(Hd(O,Xe),409);let Mt=g.req.header("X-Draft")==="true",Ye=l.versions?.drafts===!0,Yr=g.req.query("autosave")==="true",At;if(Ye&&Mt)await r.createVersion({collection:xe,documentId:y,data:X,status:"draft",autosave:Yr,createdBy:f?.id,changeDescription:Yr?"Autosave":"Manual save",tenantId:_}),Xe?At=Xe:At=await r.create({collection:xe,data:{...X,id:y,status:"draft"},tenantId:_});else if(Ye&&!Mt){let Dt="published";Xe?At=await r.update({collection:xe,id:y,data:{...X,status:Dt},tenantId:_}):At=await r.create({collection:xe,data:{...X,id:y,status:Dt},tenantId:_}),await r.createVersion({collection:xe,documentId:y,data:X,status:Dt,autosave:!1,createdBy:f?.id,changeDescription:"Published",tenantId:_});}else Xe?At=await r.update({collection:xe,id:y,data:X,tenantId:_}):At=await r.create({collection:xe,data:{...X,id:y},tenantId:_});if(y==="storage-settings"&&(Nt=null,Br=null),y==="email-settings"){let Dt=await k.fromConfig(r);Ee.email=Dt||void 0;}return y==="system"&&await ym(),f&&W?.createAuditLog({action:"settings_change",userId:f.id,resource:`global:${y}`,resourceId:y,success:!0}),At&&C>0&&await a$7([At],l.fields,r,e,1,C),g.json({data:At,message:"Updated successfully"})}catch(f){return console.error(`[API] Save global "${y}" failed:`,f),g.json({error:f.message||"Save failed",stack:process.env.NODE_ENV==="development"?f.stack:void 0},500)}};w.post(v,E),w.patch(v,E),w.post(`${v}/preview-url`,async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k=await rr(l,"read",g.req.raw,f,_);if(!k.allowed)return g.json({error:k.error||"Forbidden"},k.status||403);let A=await g.req.json().catch(()=>({})),C="";s&&(C=await Ia({type:"preview",collection:`_globals_${l.slug}`,exp:Math.floor(Date.now()/1e3)+3600},s,"HS256"));let L="";if(l.admin?.preview)L=await l.admin.preview(A,{req:g.req.raw,token:C});else {let O="";try{let U=await r.findOne({collection:"_globals_site-settings",where:{}});U?.siteUrl&&(O=U.siteUrl);}catch{}if(!O)return g.json({error:"No site URL configured in settings, and no custom preview function defined."},400);O=O.replace(/\/$/,""),L=`${O}/?preview=true&kyroToken=${C}`;}return g.json({url:L})}catch(f){return g.json({error:f.message},500)}}),w.post(`${v}/publish`,async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k=await rr(l,"update",g.req.raw,f,_,I);if(!k.allowed)return g.json({error:k.error},403);let A=`_globals_${y}`,C=await r.findOne({collection:A,where:{},tenantId:_,draft:!0});if(!C)return g.json({error:"Global not found"},404);let L={status:"published"},O=C;if(l.versions?.drafts){let M=await r.findVersions({collection:A,documentId:y,limit:1,sort:"-createdAt",tenantId:_});M.docs.length>0&&(O={...C,...M.docs[0].data},L={...M.docs[0].data,...L});}let U=await r.update({collection:A,id:y,data:L,tenantId:_});return l.versions?.drafts&&await r.createVersion({collection:A,documentId:y,data:{...O,status:"published"},status:"published",createdBy:f?.id,changeDescription:"Published",tenantId:_}),g.json({data:U,message:"Published successfully"})}catch(f){return g.json({error:f.message},500)}}),w.post(`${v}/unpublish`,async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k=await rr(l,"update",g.req.raw,f,_,I);if(!k.allowed)return g.json({error:k.error},403);let A=await r.update({collection:`_globals_${y}`,id:y,data:{status:"draft"},tenantId:_});return g.json({data:A,message:"Unpublished successfully"})}catch(f){return g.json({error:f.message},500)}}),w.get(`${v}/versions`,async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k=await rr(l,"read",g.req.raw,f,_,I);if(!k.allowed)return g.json({error:k.error},403);let A=parseInt(g.req.query("limit")||"10"),C=parseInt(g.req.query("page")||"1"),L=await r.findVersions({collection:`_globals_${y}`,documentId:y,limit:A,page:C,tenantId:_});return g.json(L)}catch(f){return g.json({error:f.message},500)}}),w.get(`${v}/versions/:versionId`,async g=>{try{let f=g.req.param("versionId"),{user:_,tenantId:k}=await Z(g.req.raw,G,i,c),A=await rr(l,"read",g.req.raw,_,k,I);if(!A.allowed)return g.json({error:A.error},403);let C=await r.findVersionByID({collection:`_globals_${y}`,versionId:f,tenantId:k});return C?g.json({data:C}):g.json({error:"Version not found"},404)}catch(f){return g.json({error:f.message},500)}}),w.post(`${v}/versions/:versionId/restore`,async g=>{try{let f=g.req.param("versionId"),{user:_,tenantId:k}=await Z(g.req.raw,G,i,c),A=await rr(l,"update",g.req.raw,_,k,I);if(!A.allowed)return g.json({error:A.error},403);let C=`_globals_${y}`,L=await r.findVersionByID({collection:C,versionId:f,tenantId:k});if(!L)return g.json({error:"Version not found"},404);let O=await r.update({collection:C,id:y,data:{...L.data,status:"draft"},tenantId:k});return g.json({data:O,message:"Version restored successfully"})}catch(f){return g.json({error:f.message},500)}}),y==="email-settings"&&w.post(`${v}/test`,async g=>{try{let{user:f,tenantId:_}=await Z(g.req.raw,G,i,c),k$1=await rr(l,"update",g.req.raw,f,_,I);if(!k$1.allowed)return g.json({error:k$1.error},k$1.status||403);let A=await g.req.json(),C={provider:A.provider,from:A.fromEmail||A.from,fromName:A.fromName,replyTo:A.replyTo,smtp:A.smtp?{host:A.smtp.host,port:A.smtp.port,secure:A.smtp.secure,auth:{user:A.smtp.username||A.smtp.user,pass:A.smtp.password||A.smtp.pass}}:void 0,resend:A.resend,sendgrid:A.sendgrid,mailgun:A.mailgun,ses:A.ses},L=new k(C),O=A.email||A.testEmail||A.testEmailSection&&A.testEmailSection.testEmail;if(!O)return g.json({error:"No test recipient email provided"},400);let U=A.provider?A.provider.charAt(0).toUpperCase()+A.provider.slice(1):"SMTP",M=A.fromName?`${A.fromName} <${A.fromEmail||A.from||"default"}>`:A.fromEmail||A.from||"Configured Sender",K=new Date().toUTCString();return await L.send({to:O,subject:"Kyro CMS \u2014 Email Connection Test",html:`<!DOCTYPE html>
|
|
126
126
|
<html lang="en">
|
|
127
127
|
<head>
|
|
128
128
|
<meta charset="UTF-8">
|
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
import {createRequire}from'module';import {C,A}from'./chunk-
|
|
1
|
+
import {createRequire}from'module';import {C,A}from'./chunk-XSRISWOY.js';import {e}from'./chunk-DS5DE5BU.js';import {nb}from'./chunk-FYPEL7XW.js';import {a as a$1}from'./chunk-XBH4YMC7.js';import {c}from'./chunk-ZJE3VAAW.js';import {a}from'./chunk-SVYUTQVE.js';import {a as a$2}from'./chunk-6QWLXJ7L.js';import {g}from'./chunk-C2PXMVR5.js';import w from'kyro:config';createRequire(import.meta.url);
|
|
2
2
|
g();var r=null,l=null;async function b(){if(!r){if(globalThis.__KYRO_INSTANCE__)try{await globalThis.__KYRO_INSTANCE__.shutdown();}catch{}try{let e$1=w.default||w,t=e$1.adapter,o=t&&!t.dialect&&typeof t.connect=="function";if(globalThis.DB&&(!t||o)){let s=globalThis.DB;e$1.adapter=new c({type:"sqlite",client:s}),C.info("Hot-swapped to D1 DrizzleAdapter");}r=A(e$1);let a$3=e$1.adapter,p=a$3&&a$3.dialect&&(a$3.dialect==="postgres"||a$3.dialect==="sqlite"),c$1=a$3&&a$3.dialect==="mongodb",n;if(p)a$3.dialect==="postgres"?n=new a({db:a$3.client}):a$3.dialect==="sqlite"&&(n=new nb({db:a$3.rawClient||a$3.client}));else if(o&&!globalThis.DB){let s=process.env.KYRO_AUTH_DB_PATH||"./data/auth.db";n=new a$1({path:s});}else c$1&&(n=new a$2({db:a$3.client}));if(n?.connect)try{await n.connect();}catch(s){C.warn("Auth connect warning:",s);}await r.init();try{await r.loadSettings();}catch(s){C.warn("loadSettings warning:",s);}try{await e(n);}catch(s){C.warn("autoBootstrap warning:",s);}globalThis.__KYRO_INSTANCE__=r;}catch(e){throw r=null,l=null,C.error("Init failed, will retry:",e),e}}}async function E(e){let t=globalThis.DB?globalThis:null;try{let{env:o}=await import('cloudflare:workers');o&&(t=o);}catch{}if(e)try{t=e.locals?.cfContext?.env||e?.env||t;}catch{}if(!t)try{t=process.env;}catch{}t?.DB&&(globalThis.DB=t.DB),t?.STORAGE_BUCKET&&(globalThis.STORAGE_BUCKET=t.STORAGE_BUCKET),l||(l=b()),await l;}var _={graphqlEnabled:false,trpcEnabled:false,wsEnabled:false,requireAuth:false};function T(e){return r?r.settings?.access?.apiAccess?.[e]??_[e]??true:_[e]??true}var L=async e=>{if(!r)try{await Promise.race([E(e),new Promise((t,o)=>setTimeout(()=>o(new Error("Initialization timeout")),3e4))]);}catch(t){return console.error("[Kyro API] Warm error:",t?.stack||t?.message||t),new Response(JSON.stringify({error:"Service Unavailable",message:"Kyro CMS is still starting up. Please try again in a moment."}),{status:503,headers:{"Content-Type":"application/json","Retry-After":"5"}})}try{let o=new URL(e.request.url).pathname,a=__KYRO_API_PATH__;if(o===`${a}/graphql`&&typeof r.getGraphQL=="function"){if(!T("graphqlEnabled"))return new Response(JSON.stringify({error:"GraphQL is disabled"}),{status:503,headers:{"Content-Type":"application/json"}});let n=await r.getGraphQL().fetch(e.request,e.locals);return new Response(n.body,n)}if(o.startsWith(`${a}/trpc/`)&&typeof r.getTRPC=="function"){if(!T("trpcEnabled"))return new Response(JSON.stringify({error:"tRPC is disabled"}),{status:503,headers:{"Content-Type":"application/json"}});let n=await r.getTRPC().fetch(e.request,e.locals);return new Response(n.body,n)}return await(await r.getREST()).fetch(e.request,e.locals)}catch(t){return console.error("[Kyro API Execution Error]:",t?.stack||t?.message||t),new Response(JSON.stringify({error:"Internal Server Error",message:t?.message||String(t),stack:t?.stack}),{status:500,headers:{"Content-Type":"application/json"}})}};export{r as a,E as b,L as c};
|