@kyro-cms/core 0.12.56 → 0.12.57
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/api-handler-graphql.cjs +1 -1
- package/dist/api-handler-graphql.js +1 -1
- package/dist/api-handler-trpc.cjs +1 -1
- package/dist/api-handler-trpc.js +1 -1
- package/dist/api-handler.cjs +1 -1
- package/dist/api-handler.js +1 -1
- package/dist/{chunk-5BIZIO6T.js → chunk-5VGYVQPY.js} +1 -1
- package/dist/{chunk-3I6T73A5.cjs → chunk-LBYY3W2D.cjs} +1 -1
- package/dist/{chunk-VV47TO2O.cjs → chunk-Q4B2IRX7.cjs} +1 -1
- package/dist/{chunk-UZEDY2UL.js → chunk-R3KFYDRS.js} +1 -1
- package/dist/{chunk-KJ3I35YV.cjs → chunk-T63QLFLZ.cjs} +3 -3
- package/dist/{chunk-E555R77V.js → chunk-WDDKRBSY.js} +1 -1
- package/dist/index.cjs +3 -3
- package/dist/index.js +1 -1
- package/dist/rest/index.cjs +1 -1
- package/dist/rest/index.js +1 -1
- package/package.json +2 -2
|
@@ -1 +1 @@
|
|
|
1
|
-
'use strict';var
|
|
1
|
+
'use strict';var chunkQ4B2IRX7_cjs=require('./chunk-Q4B2IRX7.cjs');require('./chunk-T63QLFLZ.cjs'),require('./chunk-ECFZEY5B.cjs'),require('./chunk-7GGZA5YU.cjs'),require('./chunk-5LPNEYK5.cjs'),require('./chunk-MP5VC5ER.cjs'),require('./chunk-VOQUO2EZ.cjs'),require('./chunk-LBYY3W2D.cjs'),require('./chunk-VKXWJOWI.cjs'),require('./chunk-HPYH7GTS.cjs'),require('./chunk-BHR7OAU4.cjs'),require('./chunk-O4YE57OS.cjs'),require('./chunk-MCIZG4A3.cjs'),require('./chunk-35PGCW3S.cjs'),require('./chunk-UNYXWPLZ.cjs'),require('./chunk-PITMDQYN.cjs'),require('./chunk-GIS6X43A.cjs'),require('./chunk-LEBM6ZSZ.cjs'),require('./chunk-GNEVCEJU.cjs'),require('./chunk-ZO3YB5DK.cjs'),require('./chunk-3VXEK5ZW.cjs'),require('./chunk-EZIDQBXI.cjs'),require('./chunk-LQ3YZTPU.cjs'),require('./chunk-MVX2PYJJ.cjs'),require('./chunk-AK754S3T.cjs'),require('./chunk-DUO523BH.cjs'),require('./chunk-WCFHS7EZ.cjs'),require('./chunk-73D2PNHD.cjs'),require('./chunk-AMGJ5AFH.cjs'),require('./chunk-TDGSIF5H.cjs'),require('./chunk-XBQ6HV3T.cjs'),require('./chunk-7JWQ2PZP.cjs'),require('./chunk-NGNJSUGL.cjs'),require('./chunk-KCHPADCH.cjs'),require('./chunk-BAVN7VDR.cjs'),require('./chunk-LY7N3UHH.cjs'),require('./chunk-7ACHOBWY.cjs'),require('./chunk-GNOSG3PK.cjs'),require('./chunk-BCEE4NBZ.cjs'),require('./chunk-VRZC4TTF.cjs'),require('./chunk-6KERPHAL.cjs'),require('./chunk-7DUKWHRN.cjs'),require('./chunk-VQ53TFYA.cjs'),require('./chunk-F4ITQ6XQ.cjs'),require('./chunk-HTYVI2HK.cjs'),require('./chunk-ZOVH6QT5.cjs'),require('./chunk-7WMMKGEO.cjs');var chunkBUNLC3II_cjs=require('./chunk-BUNLC3II.cjs');chunkBUNLC3II_cjs.h();function n(e){return new Response(e.body,e)}var i={graphqlEnabled:false,trpcEnabled:false,wsEnabled:false,requireAuth:false};function o(){return new Response(JSON.stringify({error:"GraphQL is disabled"}),{status:503,headers:{"Content-Type":"application/json"}})}async function c(){try{return (await chunkQ4B2IRX7_cjs.a.db.findOne({collection:"_globals_access-settings",where:{},draft:!0}))?.apiAccess?.graphqlEnabled??i.graphqlEnabled}catch{return true}}var d=async e=>{if(await chunkQ4B2IRX7_cjs.b(e),!await c())return o();let s=await chunkQ4B2IRX7_cjs.a.getGraphQL().fetch(e.request,e.locals);return n(s)},f=async e=>{if(await chunkQ4B2IRX7_cjs.b(e),!await c())return o();let s=await chunkQ4B2IRX7_cjs.a.getGraphQL().fetch(e.request,e.locals);return n(s)};exports.GET=f;exports.POST=d;
|
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
import {b,a}from'./chunk-
|
|
1
|
+
import {b,a}from'./chunk-WDDKRBSY.js';import'./chunk-R3KFYDRS.js';import'./chunk-BAXBE4JD.js';import'./chunk-LWM4WABU.js';import'./chunk-SQBTIMWF.js';import'./chunk-PA4ZZREG.js';import'./chunk-ZMG7Z3KF.js';import'./chunk-5VGYVQPY.js';import'./chunk-XP56DE7A.js';import'./chunk-OLRCZ6E3.js';import'./chunk-R25WLKX4.js';import'./chunk-6TPICJ2L.js';import'./chunk-YENNL5HG.js';import'./chunk-W45TLOOT.js';import'./chunk-IKGVPXMK.js';import'./chunk-YUUXFD73.js';import'./chunk-LVBHOZZF.js';import'./chunk-OBYAIJVU.js';import'./chunk-JRUQ5ABB.js';import'./chunk-CIVA6SKW.js';import'./chunk-WPM6LFCY.js';import'./chunk-U6KFONKM.js';import'./chunk-TYQYKKWJ.js';import'./chunk-L2QXP26Q.js';import'./chunk-YZEMLLD2.js';import'./chunk-RTHJ6SS5.js';import'./chunk-5M3FKE2V.js';import'./chunk-7MNDQU6K.js';import'./chunk-QDBGBDCT.js';import'./chunk-KNOFTUQV.js';import'./chunk-ZWDBPEXL.js';import'./chunk-47CXBWMA.js';import'./chunk-EML5FDUU.js';import'./chunk-OXGJOYEO.js';import'./chunk-FLMUMPDE.js';import'./chunk-2HA6EKXX.js';import'./chunk-JV4HJBXW.js';import'./chunk-N5POANYV.js';import'./chunk-HRAY65XH.js';import'./chunk-3NSZZCOJ.js';import'./chunk-LVHWORV4.js';import'./chunk-5ZEYOFAK.js';import'./chunk-SLMIYECU.js';import'./chunk-P6JITOFF.js';import'./chunk-7NH7H3WA.js';import'./chunk-VVVCCB6R.js';import'./chunk-TBHNE4VV.js';import {g}from'./chunk-Y2YAKDEQ.js';if (typeof window === "undefined") { const { createRequire } = await import(/* @vite-ignore */ 'module'); createRequire(import.meta.url); }
|
|
2
2
|
g();function n(e){return new Response(e.body,e)}var i={graphqlEnabled:false,trpcEnabled:false,wsEnabled:false,requireAuth:false};function o(){return new Response(JSON.stringify({error:"GraphQL is disabled"}),{status:503,headers:{"Content-Type":"application/json"}})}async function c(){try{return (await a.db.findOne({collection:"_globals_access-settings",where:{},draft:!0}))?.apiAccess?.graphqlEnabled??i.graphqlEnabled}catch{return true}}var f=async e=>{if(await b(e),!await c())return o();let s=await a.getGraphQL().fetch(e.request,e.locals);return n(s)},h=async e=>{if(await b(e),!await c())return o();let s=await a.getGraphQL().fetch(e.request,e.locals);return n(s)};export{h as GET,f as POST};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
'use strict';var
|
|
1
|
+
'use strict';var chunkQ4B2IRX7_cjs=require('./chunk-Q4B2IRX7.cjs');require('./chunk-T63QLFLZ.cjs'),require('./chunk-ECFZEY5B.cjs'),require('./chunk-7GGZA5YU.cjs'),require('./chunk-5LPNEYK5.cjs'),require('./chunk-MP5VC5ER.cjs'),require('./chunk-VOQUO2EZ.cjs'),require('./chunk-LBYY3W2D.cjs'),require('./chunk-VKXWJOWI.cjs'),require('./chunk-HPYH7GTS.cjs'),require('./chunk-BHR7OAU4.cjs'),require('./chunk-O4YE57OS.cjs'),require('./chunk-MCIZG4A3.cjs'),require('./chunk-35PGCW3S.cjs'),require('./chunk-UNYXWPLZ.cjs'),require('./chunk-PITMDQYN.cjs'),require('./chunk-GIS6X43A.cjs'),require('./chunk-LEBM6ZSZ.cjs'),require('./chunk-GNEVCEJU.cjs'),require('./chunk-ZO3YB5DK.cjs'),require('./chunk-3VXEK5ZW.cjs'),require('./chunk-EZIDQBXI.cjs'),require('./chunk-LQ3YZTPU.cjs'),require('./chunk-MVX2PYJJ.cjs'),require('./chunk-AK754S3T.cjs'),require('./chunk-DUO523BH.cjs'),require('./chunk-WCFHS7EZ.cjs'),require('./chunk-73D2PNHD.cjs'),require('./chunk-AMGJ5AFH.cjs'),require('./chunk-TDGSIF5H.cjs'),require('./chunk-XBQ6HV3T.cjs'),require('./chunk-7JWQ2PZP.cjs'),require('./chunk-NGNJSUGL.cjs'),require('./chunk-KCHPADCH.cjs'),require('./chunk-BAVN7VDR.cjs'),require('./chunk-LY7N3UHH.cjs'),require('./chunk-7ACHOBWY.cjs'),require('./chunk-GNOSG3PK.cjs'),require('./chunk-BCEE4NBZ.cjs'),require('./chunk-VRZC4TTF.cjs'),require('./chunk-6KERPHAL.cjs'),require('./chunk-7DUKWHRN.cjs'),require('./chunk-VQ53TFYA.cjs'),require('./chunk-F4ITQ6XQ.cjs'),require('./chunk-HTYVI2HK.cjs'),require('./chunk-ZOVH6QT5.cjs'),require('./chunk-7WMMKGEO.cjs');var chunkBUNLC3II_cjs=require('./chunk-BUNLC3II.cjs');chunkBUNLC3II_cjs.h();function n(){return new Response(JSON.stringify({error:"tRPC is disabled"}),{status:503,headers:{"Content-Type":"application/json"}})}var s={graphqlEnabled:false,trpcEnabled:false,wsEnabled:false,requireAuth:false};async function o(){try{return (await chunkQ4B2IRX7_cjs.a.db.findOne({collection:"_globals_access-settings",where:{},draft:!0}))?.apiAccess?.trpcEnabled??s.trpcEnabled}catch{return true}}var p=async e=>(await chunkQ4B2IRX7_cjs.b(e),await o()?chunkQ4B2IRX7_cjs.a.getTRPC().fetch(e.request,e.locals):n());exports.ALL=p;
|
package/dist/api-handler-trpc.js
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
import {b,a}from'./chunk-
|
|
1
|
+
import {b,a}from'./chunk-WDDKRBSY.js';import'./chunk-R3KFYDRS.js';import'./chunk-BAXBE4JD.js';import'./chunk-LWM4WABU.js';import'./chunk-SQBTIMWF.js';import'./chunk-PA4ZZREG.js';import'./chunk-ZMG7Z3KF.js';import'./chunk-5VGYVQPY.js';import'./chunk-XP56DE7A.js';import'./chunk-OLRCZ6E3.js';import'./chunk-R25WLKX4.js';import'./chunk-6TPICJ2L.js';import'./chunk-YENNL5HG.js';import'./chunk-W45TLOOT.js';import'./chunk-IKGVPXMK.js';import'./chunk-YUUXFD73.js';import'./chunk-LVBHOZZF.js';import'./chunk-OBYAIJVU.js';import'./chunk-JRUQ5ABB.js';import'./chunk-CIVA6SKW.js';import'./chunk-WPM6LFCY.js';import'./chunk-U6KFONKM.js';import'./chunk-TYQYKKWJ.js';import'./chunk-L2QXP26Q.js';import'./chunk-YZEMLLD2.js';import'./chunk-RTHJ6SS5.js';import'./chunk-5M3FKE2V.js';import'./chunk-7MNDQU6K.js';import'./chunk-QDBGBDCT.js';import'./chunk-KNOFTUQV.js';import'./chunk-ZWDBPEXL.js';import'./chunk-47CXBWMA.js';import'./chunk-EML5FDUU.js';import'./chunk-OXGJOYEO.js';import'./chunk-FLMUMPDE.js';import'./chunk-2HA6EKXX.js';import'./chunk-JV4HJBXW.js';import'./chunk-N5POANYV.js';import'./chunk-HRAY65XH.js';import'./chunk-3NSZZCOJ.js';import'./chunk-LVHWORV4.js';import'./chunk-5ZEYOFAK.js';import'./chunk-SLMIYECU.js';import'./chunk-P6JITOFF.js';import'./chunk-7NH7H3WA.js';import'./chunk-VVVCCB6R.js';import'./chunk-TBHNE4VV.js';import {g}from'./chunk-Y2YAKDEQ.js';if (typeof window === "undefined") { const { createRequire } = await import(/* @vite-ignore */ 'module'); createRequire(import.meta.url); }
|
|
2
2
|
g();function n(){return new Response(JSON.stringify({error:"tRPC is disabled"}),{status:503,headers:{"Content-Type":"application/json"}})}var s={graphqlEnabled:false,trpcEnabled:false,wsEnabled:false,requireAuth:false};async function o(){try{return (await a.db.findOne({collection:"_globals_access-settings",where:{},draft:!0}))?.apiAccess?.trpcEnabled??s.trpcEnabled}catch{return true}}var d=async e=>(await b(e),await o()?a.getTRPC().fetch(e.request,e.locals):n());export{d as ALL};
|
package/dist/api-handler.cjs
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
'use strict';var
|
|
1
|
+
'use strict';var chunkQ4B2IRX7_cjs=require('./chunk-Q4B2IRX7.cjs');require('./chunk-T63QLFLZ.cjs'),require('./chunk-ECFZEY5B.cjs'),require('./chunk-7GGZA5YU.cjs'),require('./chunk-5LPNEYK5.cjs'),require('./chunk-MP5VC5ER.cjs'),require('./chunk-VOQUO2EZ.cjs'),require('./chunk-LBYY3W2D.cjs'),require('./chunk-VKXWJOWI.cjs'),require('./chunk-HPYH7GTS.cjs'),require('./chunk-BHR7OAU4.cjs'),require('./chunk-O4YE57OS.cjs'),require('./chunk-MCIZG4A3.cjs'),require('./chunk-35PGCW3S.cjs'),require('./chunk-UNYXWPLZ.cjs'),require('./chunk-PITMDQYN.cjs'),require('./chunk-GIS6X43A.cjs'),require('./chunk-LEBM6ZSZ.cjs'),require('./chunk-GNEVCEJU.cjs'),require('./chunk-ZO3YB5DK.cjs'),require('./chunk-3VXEK5ZW.cjs'),require('./chunk-EZIDQBXI.cjs'),require('./chunk-LQ3YZTPU.cjs'),require('./chunk-MVX2PYJJ.cjs'),require('./chunk-AK754S3T.cjs'),require('./chunk-DUO523BH.cjs'),require('./chunk-WCFHS7EZ.cjs'),require('./chunk-73D2PNHD.cjs'),require('./chunk-AMGJ5AFH.cjs'),require('./chunk-TDGSIF5H.cjs'),require('./chunk-XBQ6HV3T.cjs'),require('./chunk-7JWQ2PZP.cjs'),require('./chunk-NGNJSUGL.cjs'),require('./chunk-KCHPADCH.cjs'),require('./chunk-BAVN7VDR.cjs'),require('./chunk-LY7N3UHH.cjs'),require('./chunk-7ACHOBWY.cjs'),require('./chunk-GNOSG3PK.cjs'),require('./chunk-BCEE4NBZ.cjs'),require('./chunk-VRZC4TTF.cjs'),require('./chunk-6KERPHAL.cjs'),require('./chunk-7DUKWHRN.cjs'),require('./chunk-VQ53TFYA.cjs'),require('./chunk-F4ITQ6XQ.cjs'),require('./chunk-HTYVI2HK.cjs'),require('./chunk-ZOVH6QT5.cjs'),require('./chunk-7WMMKGEO.cjs'),require('./chunk-BUNLC3II.cjs');Object.defineProperty(exports,"ALL",{enumerable:true,get:function(){return chunkQ4B2IRX7_cjs.c}});Object.defineProperty(exports,"createKyroHandler",{enumerable:true,get:function(){return chunkQ4B2IRX7_cjs.d}});Object.defineProperty(exports,"kyroInstance",{enumerable:true,get:function(){return chunkQ4B2IRX7_cjs.a}});Object.defineProperty(exports,"warmKyroInstance",{enumerable:true,get:function(){return chunkQ4B2IRX7_cjs.b}});
|
package/dist/api-handler.js
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
export{c as ALL,d as createKyroHandler,a as kyroInstance,b as warmKyroInstance}from'./chunk-
|
|
1
|
+
export{c as ALL,d as createKyroHandler,a as kyroInstance,b as warmKyroInstance}from'./chunk-WDDKRBSY.js';import'./chunk-R3KFYDRS.js';import'./chunk-BAXBE4JD.js';import'./chunk-LWM4WABU.js';import'./chunk-SQBTIMWF.js';import'./chunk-PA4ZZREG.js';import'./chunk-ZMG7Z3KF.js';import'./chunk-5VGYVQPY.js';import'./chunk-XP56DE7A.js';import'./chunk-OLRCZ6E3.js';import'./chunk-R25WLKX4.js';import'./chunk-6TPICJ2L.js';import'./chunk-YENNL5HG.js';import'./chunk-W45TLOOT.js';import'./chunk-IKGVPXMK.js';import'./chunk-YUUXFD73.js';import'./chunk-LVBHOZZF.js';import'./chunk-OBYAIJVU.js';import'./chunk-JRUQ5ABB.js';import'./chunk-CIVA6SKW.js';import'./chunk-WPM6LFCY.js';import'./chunk-U6KFONKM.js';import'./chunk-TYQYKKWJ.js';import'./chunk-L2QXP26Q.js';import'./chunk-YZEMLLD2.js';import'./chunk-RTHJ6SS5.js';import'./chunk-5M3FKE2V.js';import'./chunk-7MNDQU6K.js';import'./chunk-QDBGBDCT.js';import'./chunk-KNOFTUQV.js';import'./chunk-ZWDBPEXL.js';import'./chunk-47CXBWMA.js';import'./chunk-EML5FDUU.js';import'./chunk-OXGJOYEO.js';import'./chunk-FLMUMPDE.js';import'./chunk-2HA6EKXX.js';import'./chunk-JV4HJBXW.js';import'./chunk-N5POANYV.js';import'./chunk-HRAY65XH.js';import'./chunk-3NSZZCOJ.js';import'./chunk-LVHWORV4.js';import'./chunk-5ZEYOFAK.js';import'./chunk-SLMIYECU.js';import'./chunk-P6JITOFF.js';import'./chunk-7NH7H3WA.js';import'./chunk-VVVCCB6R.js';import'./chunk-TBHNE4VV.js';import'./chunk-Y2YAKDEQ.js';if (typeof window === "undefined") { const { createRequire } = await import(/* @vite-ignore */ 'module'); createRequire(import.meta.url); }
|
|
@@ -117,7 +117,7 @@ g();g();g();g();g();g();var Tc=(r,e,t)=>(s,n)=>{let a=-1;return i(0);async funct
|
|
|
117
117
|
]))`;continue}}if(t.s&&s[d]==="."){n+=i?`${s[d]}\r
|
|
118
118
|
`:`[${s[d]}\r
|
|
119
119
|
]`;continue}n+=s[d],s[d]==="\\"?a=true:i&&s[d]==="]"?i=false:!i&&s[d]==="["&&(i=true);}try{new RegExp(n);}catch{return console.warn(`Could not convert regex pattern at ${e.currentPath.join("/")} to a flag-independent form! Falling back to the flag-ignorant source`),r.source}return n}function _c(r,e){if(e.target==="openAi"&&console.warn("Warning: OpenAI may not support records in schemas! Try an array of key-value pairs instead."),e.target==="openApi3"&&r.keyType?._def.typeName===U.ZodEnum)return {type:"object",required:r.keyType._def.values,properties:r.keyType._def.values.reduce((s,n)=>({...s,[n]:re(r.valueType._def,{...e,currentPath:[...e.currentPath,"properties",n]})??$e(e)}),{}),additionalProperties:e.rejectedAdditionalProperties};let t={type:"object",additionalProperties:re(r.valueType._def,{...e,currentPath:[...e.currentPath,"additionalProperties"]})??e.allowedAdditionalProperties};if(e.target==="openApi3")return t;if(r.keyType?._def.typeName===U.ZodString&&r.keyType._def.checks?.length){let{type:s,...n}=xc(r.keyType._def,e);return {...t,propertyNames:n}}else {if(r.keyType?._def.typeName===U.ZodEnum)return {...t,propertyNames:{enum:r.keyType._def.values}};if(r.keyType?._def.typeName===U.ZodBranded&&r.keyType._def.type._def.typeName===U.ZodString&&r.keyType._def.type._def.checks?.length){let{type:s,...n}=yc(r.keyType._def,e);return {...t,propertyNames:n}}}return t}function O_(r,e){if(e.mapStrategy==="record")return _c(r,e);let t=re(r.keyType._def,{...e,currentPath:[...e.currentPath,"items","items","0"]})||$e(e),s=re(r.valueType._def,{...e,currentPath:[...e.currentPath,"items","items","1"]})||$e(e);return {type:"array",maxItems:125,items:{type:"array",items:[t,s],minItems:2,maxItems:2}}}g();function P_(r){let e=r.values,s=Object.keys(r.values).filter(a=>typeof e[e[a]]!="number").map(a=>e[a]),n=Array.from(new Set(s.map(a=>typeof a)));return {type:n.length===1?n[0]==="string"?"string":"number":["string","number"],enum:s}}g();function I_(r){return r.target==="openAi"?void 0:{not:$e({...r,currentPath:[...r.currentPath,"not"]})}}g();function D_(r){return r.target==="openApi3"?{enum:["null"],nullable:true}:{type:"null"}}g();g();var Ja={ZodString:"string",ZodNumber:"number",ZodBigInt:"integer",ZodBoolean:"boolean",ZodNull:"null"};function $_(r,e){if(e.target==="openApi3")return L_(r,e);let t=r.options instanceof Map?Array.from(r.options.values()):r.options;if(t.every(s=>s._def.typeName in Ja&&(!s._def.checks||!s._def.checks.length))){let s=t.reduce((n,a)=>{let i=Ja[a._def.typeName];return i&&!n.includes(i)?[...n,i]:n},[]);return {type:s.length>1?s:s[0]}}else if(t.every(s=>s._def.typeName==="ZodLiteral"&&!s.description)){let s=t.reduce((n,a)=>{let i=typeof a._def.value;switch(i){case "string":case "number":case "boolean":return [...n,i];case "bigint":return [...n,"integer"];case "object":if(a._def.value===null)return [...n,"null"];default:return n}},[]);if(s.length===t.length){let n=s.filter((a,i,c)=>c.indexOf(a)===i);return {type:n.length>1?n:n[0],enum:t.reduce((a,i)=>a.includes(i._def.value)?a:[...a,i._def.value],[])}}}else if(t.every(s=>s._def.typeName==="ZodEnum"))return {type:"string",enum:t.reduce((s,n)=>[...s,...n._def.values.filter(a=>!s.includes(a))],[])};return L_(r,e)}var L_=(r,e)=>{let t=(r.options instanceof Map?Array.from(r.options.values()):r.options).map((s,n)=>re(s._def,{...e,currentPath:[...e.currentPath,"anyOf",`${n}`]})).filter(s=>!!s&&(!e.strictUnions||typeof s=="object"&&Object.keys(s).length>0));return t.length?{anyOf:t}:void 0};function B_(r,e){if(["ZodString","ZodNumber","ZodBigInt","ZodBoolean","ZodNull"].includes(r.innerType._def.typeName)&&(!r.innerType._def.checks||!r.innerType._def.checks.length))return e.target==="openApi3"?{type:Ja[r.innerType._def.typeName],nullable:true}:{type:[Ja[r.innerType._def.typeName],"null"]};if(e.target==="openApi3"){let s=re(r.innerType._def,{...e,currentPath:[...e.currentPath]});return s&&"$ref"in s?{allOf:[s],nullable:true}:s&&{...s,nullable:true}}let t=re(r.innerType._def,{...e,currentPath:[...e.currentPath,"anyOf","0"]});return t&&{anyOf:[t,{type:"null"}]}}g();function j_(r,e){let t={type:"number"};if(!r.checks)return t;for(let s of r.checks)switch(s.kind){case "int":t.type="integer",od(t,"type",s.message,e);break;case "min":e.target==="jsonSchema7"?s.inclusive?he(t,"minimum",s.value,s.message,e):he(t,"exclusiveMinimum",s.value,s.message,e):(s.inclusive||(t.exclusiveMinimum=true),he(t,"minimum",s.value,s.message,e));break;case "max":e.target==="jsonSchema7"?s.inclusive?he(t,"maximum",s.value,s.message,e):he(t,"exclusiveMaximum",s.value,s.message,e):(s.inclusive||(t.exclusiveMaximum=true),he(t,"maximum",s.value,s.message,e));break;case "multipleOf":he(t,"multipleOf",s.value,s.message,e);break}return t}g();function N_(r,e){let t=e.target==="openAi",s={type:"object",properties:{}},n=[],a=r.shape();for(let c in a){let d=a[c];if(d===void 0||d._def===void 0)continue;let g=$B(d);g&&t&&(d._def.typeName==="ZodOptional"&&(d=d._def.innerType),d.isNullable()||(d=d.nullable()),g=false);let x=re(d._def,{...e,currentPath:[...e.currentPath,"properties",c],propertyPath:[...e.currentPath,"properties",c]});x!==void 0&&(s.properties[c]=x,g||n.push(c));}n.length&&(s.required=n);let i=LB(r,e);return i!==void 0&&(s.additionalProperties=i),s}function LB(r,e){if(r.catchall._def.typeName!=="ZodNever")return re(r.catchall._def,{...e,currentPath:[...e.currentPath,"additionalProperties"]});switch(r.unknownKeys){case "passthrough":return e.allowedAdditionalProperties;case "strict":return e.rejectedAdditionalProperties;case "strip":return e.removeAdditionalStrategy==="strict"?e.allowedAdditionalProperties:e.rejectedAdditionalProperties}}function $B(r){try{return r.isOptional()}catch{return true}}g();var M_=(r,e)=>{if(e.currentPath.toString()===e.propertyPath?.toString())return re(r.innerType._def,e);let t=re(r.innerType._def,{...e,currentPath:[...e.currentPath,"anyOf","1"]});return t?{anyOf:[{not:$e(e)},t]}:$e(e)};g();var U_=(r,e)=>{if(e.pipeStrategy==="input")return re(r.in._def,e);if(e.pipeStrategy==="output")return re(r.out._def,e);let t=re(r.in._def,{...e,currentPath:[...e.currentPath,"allOf","0"]}),s=re(r.out._def,{...e,currentPath:[...e.currentPath,"allOf",t?"1":"0"]});return {allOf:[t,s].filter(n=>n!==void 0)}};g();function q_(r,e){return re(r.type._def,e)}g();function F_(r,e){let s={type:"array",uniqueItems:true,items:re(r.valueType._def,{...e,currentPath:[...e.currentPath,"items"]})};return r.minSize&&he(s,"minItems",r.minSize.value,r.minSize.message,e),r.maxSize&&he(s,"maxItems",r.maxSize.value,r.maxSize.message,e),s}g();function H_(r,e){return r.rest?{type:"array",minItems:r.items.length,items:r.items.map((t,s)=>re(t._def,{...e,currentPath:[...e.currentPath,"items",`${s}`]})).reduce((t,s)=>s===void 0?t:[...t,s],[]),additionalItems:re(r.rest._def,{...e,currentPath:[...e.currentPath,"additionalItems"]})}:{type:"array",minItems:r.items.length,maxItems:r.items.length,items:r.items.map((t,s)=>re(t._def,{...e,currentPath:[...e.currentPath,"items",`${s}`]})).reduce((t,s)=>s===void 0?t:[...t,s],[])}}g();function G_(r){return {not:$e(r)}}g();function z_(r){return $e(r)}g();var K_=(r,e)=>re(r.innerType._def,e);var V_=(r,e,t)=>{switch(e){case U.ZodString:return xc(r,t);case U.ZodNumber:return j_(r,t);case U.ZodObject:return N_(r,t);case U.ZodBigInt:return b_(r,t);case U.ZodBoolean:return v_();case U.ZodDate:return fd(r,t);case U.ZodUndefined:return G_(t);case U.ZodNull:return D_(t);case U.ZodArray:return w_(r,t);case U.ZodUnion:case U.ZodDiscriminatedUnion:return $_(r,t);case U.ZodIntersection:return C_(r,t);case U.ZodTuple:return H_(r,t);case U.ZodRecord:return _c(r,t);case U.ZodLiteral:return E_(r,t);case U.ZodEnum:return k_(r);case U.ZodNativeEnum:return P_(r);case U.ZodNullable:return B_(r,t);case U.ZodOptional:return M_(r,t);case U.ZodMap:return O_(r,t);case U.ZodSet:return F_(r,t);case U.ZodLazy:return ()=>r.getter()._def;case U.ZodPromise:return q_(r,t);case U.ZodNaN:case U.ZodNever:return I_(t);case U.ZodEffects:return R_(r,t);case U.ZodAny:return $e(t);case U.ZodUnknown:return z_(t);case U.ZodDefault:return A_(r,t);case U.ZodBranded:return yc(r,t);case U.ZodReadonly:return K_(r,t);case U.ZodCatch:return S_(r,t);case U.ZodPipeline:return U_(r,t);case U.ZodFunction:case U.ZodVoid:case U.ZodSymbol:return;default:return (s=>{})()}};function re(r,e,t=false){let s=e.seen.get(r);if(e.override){let c=e.override?.(r,e,s,t);if(c!==l_)return c}if(s&&!t){let c=BB(s,e);if(c!==void 0)return c}let n={def:r,path:e.currentPath,jsonSchema:void 0};e.seen.set(r,n);let a=V_(r,r.typeName,e),i=typeof a=="function"?re(a(),e):a;if(i&&jB(r,e,i),e.postProcess){let c=e.postProcess(i,r,e);return n.jsonSchema=i,c}return n.jsonSchema=i,i}var BB=(r,e)=>{switch(e.$refStrategy){case "root":return {$ref:r.path.join("/")};case "relative":return {$ref:mc(e.currentPath,r.path)};case "none":case "seen":return r.path.length<e.currentPath.length&&r.path.every((t,s)=>e.currentPath[s]===t)?(console.warn(`Recursive reference detected at ${e.currentPath.join("/")}! Defaulting to any`),$e(e)):e.$refStrategy==="seen"?$e(e):void 0}},jB=(r,e,t)=>(r.description&&(t.description=r.description,e.markdownDescription&&(t.markdownDescription=r.description)),t);g();g();var Kn=(r,e)=>{let t=p_(e),s=typeof e=="object"&&e.definitions?Object.entries(e.definitions).reduce((d,[g,x])=>({...d,[g]:re(x._def,{...t,currentPath:[...t.basePath,t.definitionPath,g]},true)??$e(t)}),{}):void 0,n=typeof e=="string"?e:e?.nameStrategy==="title"?void 0:e?.name,a=re(r._def,n===void 0?t:{...t,currentPath:[...t.basePath,t.definitionPath,n]},false)??$e(t),i=typeof e=="object"&&e.name!==void 0&&e.nameStrategy==="title"?e.name:void 0;i!==void 0&&(a.title=i),t.flags.hasReferencedOpenAiAnyType&&(s||(s={}),s[t.openAiAnyTypeName]||(s[t.openAiAnyTypeName]={type:["string","number","integer","boolean","array","null"],items:{$ref:t.$refStrategy==="relative"?"1":[...t.basePath,t.definitionPath,t.openAiAnyTypeName].join("/")}}));let c=n===void 0?s?{...a,[t.definitionPath]:s}:a:{$ref:[...t.$refStrategy==="relative"?[]:t.basePath,t.definitionPath,n].join("/"),[t.definitionPath]:{...s,[n]:a}};return t.target==="jsonSchema7"?c.$schema="http://json-schema.org/draft-07/schema#":(t.target==="jsonSchema2019-09"||t.target==="openAi")&&(c.$schema="https://json-schema.org/draft/2019-09/schema#"),t.target==="openAi"&&("anyOf"in c||"oneOf"in c||"allOf"in c||"type"in c&&Array.isArray(c.type))&&console.warn("Warning: OpenAI may not support schemas with unions as roots! Try wrapping it in an object property."),c};var qB={_media:{create:d.MEDIA_UPLOAD,update:d.MEDIA_UPLOAD,delete:d.MEDIA_DELETE}};function Qa(r,e){let t=qB[r];return t?t[e]:`collection.${e}`}function FB(r){let e=r.headers.get("x-forwarded-for");return e?e.split(",")[0].trim():r.headers.get("x-real-ip")||"unknown"}function wc(r,e,t,s,n){e?.apiKeyId&&r&&r.createAuditLog({action:"api_request",userId:e.userId||"",resource:"api_key",resourceId:e.apiKeyId,success:true,metadata:{endpoint:t,method:s,ip:FB(n)}});}function bc(r){return r.baseUpdatedAt??r._baseUpdatedAt}function yd(r){let{baseUpdatedAt:e,_baseUpdatedAt:t,...s}=r;return s}function xd(r,e){return {error:"Document has changed since you started editing",code:"REVISION_CONFLICT",conflict:{expectedUpdatedAt:r??null,actualUpdatedAt:e.updatedAt??null,current:e}}}async function De(r,e,t,s,n,a,i=true,c="none"){return await b$1(r,e,{user:s,req:t,tenantId:n,apiKey:a},{enablePublicAccess:i,defaultAccess:c})}async function er(r,e,t,s,n,a=true){return await c$3(r,e,{user:s,req:t,tenantId:n},{enablePublicAccess:a})}async function W(r,e,t,s){if(t)return {user:t,tenantId:s,apiKeyContext:void 0,authType:"static"};if(e){let n=await e(r);if(n.status===200&&n.user)return {user:n.user,tenantId:n.tenantContext?.tenantId,apiKeyContext:n.apiKeyContext,authType:n.authType}}return {user:void 0,tenantId:void 0,apiKeyContext:void 0,authType:void 0}}async function HB(r,e){if("dialect"in r&&r.dialect==="postgres")return new a$8({db:r.client});if("dialect"in r&&r.dialect==="sqlite")return new Ao({db:r.client});if("dialect"in r&&r.dialect==="mongodb"){let s=r;return new a$9({db:()=>s.db,adapter:s})}let t=resolve(e,"data","auth.db");return new a$a({path:process.env.KYRO_AUTH_DB_PATH||t})}async function X_(r){let{registry:e,db:t,authSecret:s,authAdapter:n,checkSession:a,user:i,tenantId:c,cors:d,webhookService:g,settings:x}=r,_=new Uc;function P(l){if(Array.isArray(l))return l.map(P);if(l!==null&&typeof l=="object"){let y={};for(let b in l)b!=="attrs"&&(y[b]=P(l[b]));return y}return l}_.use("*",async(l,y)=>{await y();let b=l.req.header("referer")||"";if(!(l.req.header("x-kyro-admin")==="true"||b.includes("/admin"))){let f=l.res.headers.get("Content-Type");if(f&&f.includes("application/json"))try{let w=await l.res.clone().json(),C=P(w);l.res=l.json(C,l.res.status);}catch{}}});for(let l of e.getPlugins())typeof l.serverMiddleware=="function"&&l.serverMiddleware(_);let G=x?.access?.apiAccess,q=x?.access?.enablePublicAccess??false,H=x?.access?.defaultCollectionAccess??"none";G?.requireAuth;let se=process.cwd(),Pe=se.endsWith("admin")?resolve(se,".."):se,Z=n||await HB(t,Pe),F=Jm({db:t,userLookup:async l=>await Z.findUserById(l)||null}),Lt=G?.cors?.allowedOrigins,ds=d?.origins,Dr=Array.isArray(Lt)?Lt:typeof Lt=="string"&&Lt?Lt.split(`
|
|
120
|
-
`).map(l=>l.trim()).filter(Boolean):[],He=Dr.length>0?Dr:ds||[];(He.length>0||d)&&_.use("*",async(l,y)=>{let b=l.req.header("Origin")||"*";if(He.length>0&&!He.includes(b))return l.json({error:"Origin not allowed"},403);let R=He.length>0?b:"*";if(l.header("Access-Control-Allow-Origin",R),l.header("Access-Control-Allow-Methods","GET, POST, PATCH, DELETE, OPTIONS"),l.header("Access-Control-Allow-Headers","Content-Type, Authorization, X-API-Key"),d?.credentials&&l.header("Access-Control-Allow-Credentials","true"),l.req.method==="OPTIONS")return l.text("");await y();});let fr=x?.access?.rateLimiting,tr;if(fr?.enabled){let l=fr.maxRequests||100,y=fr.windowMs||6e4;tr=new vo({"api:general":{window:y,max:l}}),_.use("/api/*",async(b,R)=>{if(!tr)return R();let f=b.req.header("CF-Connecting-IP")||b.req.header("X-Forwarded-For")?.split(",")[0]?.trim()||b.req.header("X-Real-IP")||"unknown",p=await tr.check("api:general",f);if(b.header("X-RateLimit-Limit",String(l)),b.header("X-RateLimit-Remaining",String(p.remaining)),b.header("X-RateLimit-Reset",String(p.resetAt)),!p.allowed)return b.json({error:"Too many requests",retryAfter:p.retryAfter},429);await R();});}let we=new So({redis:Z,jwtSecret:s||"change-me",baseUrl:process.env.KYRO_BASE_URL||"http://localhost:4321",rateLimiter:tr});q$1.fromConfig(t).then(l=>{l&&(we.email=l);}).catch(l=>{console.error("[Email] Failed to initialize transport from config:",l);}),_.post("/api/auth/login",async l=>we.login(l.req.raw)),_.post("/api/auth/register",async l=>{try{let y=await t.findOne({collection:"_globals_system",where:{}});if(y&&y.enableRegistration===!1)return l.json({error:"User registration is currently disabled by administrator."},403);if(y?.defaultRegistrationRole){let b=l.req.raw;if((b.headers.get("content-type")||"").includes("application/json")){let f=await l.req.json();f.role||(f.role=y.defaultRegistrationRole);let p=new Request(b.url,{method:b.method,headers:b.headers,body:JSON.stringify(f)});return we.register(p)}}}catch{}return we.register(l.req.raw)}),_.post("/api/auth/logout",async l=>we.logout(l.req.raw)),_.post("/api/auth/refresh",async l=>we.refresh(l.req.raw)),_.get("/api/auth/me",async l=>we.me(l.req.raw)),_.post("/api/auth/forgot-password",async l=>we.forgotPassword(l.req.raw)),_.post("/api/auth/reset-password",async l=>we.resetPassword(l.req.raw)),_.post("/api/auth/change-password",async l=>we.changePassword(l.req.raw)),_.get("/api/auth/verify-email",async l=>we.verifyEmail(l.req.raw)),_.post("/api/auth/verify-email",async l=>we.verifyEmail(l.req.raw)),_.get("/api/auth/verify",async l=>we.verifyEmail(l.req.raw)),_.post("/api/auth/verify",async l=>we.verifyEmail(l.req.raw)),_.post("/api/auth/magic-link",async l=>we.requestMagicLink(l.req.raw)),_.get("/api/auth/magic-link",async l=>we.verifyMagicLink(l.req.raw)),_.post("/api/auth/invite",async l=>we.inviteUser(l.req.raw)),_.get("/api/auth/sessions",async l=>we.listSessions(l.req.raw)),_.post("/api/auth/sessions/refresh",async l=>we.refreshSession(l.req.raw)),_.delete("/api/auth/sessions",async l=>we.revokeOtherSessions(l.req.raw)),_.delete("/api/auth/sessions/:id",async l=>we.revokeSession(l.req.raw,l.req.param("id"))),_.put("/api/auth/sessions/:id/name",async l=>we.renameSession(l.req.raw,l.req.param("id"))),_.get("/api/auth/access",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Not authenticated"},401);let R={},f={};for(let p of e.getCollections()){let w={read:(await De(p,"read",l.req.raw,y,b,void 0,q,H)).allowed,create:(await De(p,"create",l.req.raw,y,b,void 0,q,H)).allowed,update:(await De(p,"update",l.req.raw,y,b,void 0,q,H)).allowed,delete:(await De(p,"delete",l.req.raw,y,b,void 0,q,H)).allowed};R[p.slug]=w;}for(let p of e.getGlobals()){let w={read:(await er(p,"read",l.req.raw,y,b,q)).allowed,update:(await er(p,"update",l.req.raw,y,b,q)).allowed};f[p.slug]=w;}return l.json({collections:R,globals:f})}catch(y){return l.json({error:y.message},500)}});let $t=typeof e.hasCollection=="function"&&e.hasCollection("users")?e.getCollection("users"):(()=>{try{return e.getCollection("users")}catch{return a$4}})();_.get("/api/users",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=await De($t,"read",l.req.raw,y,b,void 0,q,H);if(!R.allowed)return l.json({error:R.error},R.status||403);let f=parseInt(l.req.query("page")||"1"),p=Math.min(parseInt(l.req.query("limit")||"10"),100),w=l.req.query("search")||void 0,C=[],v=0;if(typeof Z.findUsers=="function"){let k=await Z.findUsers({page:f,limit:p,search:w});C=k.users||[],v=k.total||0;}else {let k=await t.find({collection:"users",page:f,limit:p,where:w?{email:{contains:w}}:{},tenantId:b});C=k.docs||[],v=k.totalDocs||0;}return l.json({docs:C,totalDocs:v,limit:p,totalPages:Math.ceil(v/p)||1,page:f,pagingCounter:(f-1)*p+1,hasPrevPage:f>1,hasNextPage:f<Math.ceil(v/p),prevPage:f>1?f-1:null,nextPage:f<Math.ceil(v/p)?f+1:null})}catch(y){return console.error("[API] Error listing users:",y),l.json({error:y.message},500)}}),_.get("/api/users/:id",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=l.req.param("id"),f=await Z.findUserById(R);return f?l.json({data:f}):l.json({error:"User not found"},404)}catch(y){return l.json({error:y.message},500)}}),_.post("/api/users",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=await De($t,"create",l.req.raw,y,b,void 0,q,H);if(!R.allowed)return l.json({error:R.error},R.status||403);let f=await l.req.json();if(!f.email||!f.password)return l.json({error:"Email and password are required"},400);if(await Z.findUserByEmail(f.email))return l.json({error:"Email already in use"},400);let w=f.role||"customer";if(w!=="customer"&&y?.role!=="super_admin")return l.json({error:"Forbidden: Only super_admin can assign administrative roles"},403);let C=await Z.createUser({email:f.email,password:f.password,name:f.name,role:w,avatar:f.avatar,tenantId:f.tenantId});return y&&Z?.createAuditLog({action:"user_create",userId:y.id,resource:"users",resourceId:C.id,success:!0}),l.json({data:C,message:"User created successfully"},201)}catch(y){return l.json({error:y.message},500)}}),_.patch("/api/users/:id",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=await De($t,"update",l.req.raw,y,b,void 0,q,H);if(!R.allowed)return l.json({error:R.error},R.status||403);let f=l.req.param("id"),p=await l.req.json(),w=await Z.findUserById(f);if(!w)return l.json({error:"User not found"},404);let C={};if(p.name!==void 0&&(C.name=p.name),p.email!==void 0&&(C.email=p.email),p.role!==void 0&&p.role!==w.role){if(y?.role!=="super_admin")return l.json({error:"Forbidden: Only super_admin can modify user roles"},403);C.role=p.role;}p.avatar!==void 0&&(C.avatar=typeof p.avatar=="object"&&p.avatar!==null?p.avatar.id||String(p.avatar):p.avatar),p.tenantId!==void 0&&(C.tenantId=p.tenantId),p.emailVerified!==void 0&&(C.emailVerified=p.emailVerified),p.locked!==void 0&&(C.locked=p.locked),p.failedLoginAttempts!==void 0&&(C.failedLoginAttempts=p.failedLoginAttempts),p.lastLogin!==void 0&&(C.lastLogin=p.lastLogin);let v=await Z.updateUser(f,C);return v?(y&&(Z?.createAuditLog({action:"user_update",userId:y.id,resource:"users",resourceId:f,success:!0}),p.role&&w.role!==p.role&&Z?.createAuditLog({action:"role_change",userId:y.id,resource:"users",resourceId:f,success:!0,metadata:{oldRole:w.role,newRole:p.role}})),l.json({data:v,message:"User updated successfully"})):l.json({error:"User update failed"},500)}catch(y){return l.json({error:y.message},500)}}),_.delete("/api/users/:id",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=await De($t,"delete",l.req.raw,y,b,void 0,q,H);if(!R.allowed)return l.json({error:R.error},R.status||403);let f=l.req.param("id");if(y&&y.id===f)return l.json({error:"You cannot delete your own account"},403);let p=await Z.findUserById(f);return p?await Z.deleteUser(f)?(y&&Z?.createAuditLog({action:"user_delete",userId:y.id,resource:"users",resourceId:f,success:!0}),l.json({data:p,message:"User deleted successfully"})):l.json({error:"User deletion failed"},500):l.json({error:"User not found"},404)}catch(y){return l.json({error:y.message},500)}}),_.get("/api/auth/audit-logs",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=e.getCollection("audit_logs");if(R){let D=await De(R,"read",l.req.raw,y,b,void 0,q,H);if(!D.allowed)return l.json({error:D.error},D.status||403)}else if(!y)return l.json({error:"Authentication required"},401);let f=parseInt(l.req.query("page")||"1"),p=Math.min(parseInt(l.req.query("limit")||"50"),100),w=l.req.query("action")||void 0,C=l.req.query("userId")||void 0,v=l.req.query("resource")||void 0,k=await Z.findAuditLogs({action:w,userId:C,resource:v,limit:p,offset:(f-1)*p});return l.json({docs:k.logs,totalDocs:k.total,limit:p,totalPages:Math.ceil(k.total/p),page:f,pagingCounter:(f-1)*p+1,hasPrevPage:f>1,hasNextPage:f<Math.ceil(k.total/p),prevPage:f>1?f-1:null,nextPage:f<Math.ceil(k.total/p)?f+1:null})}catch(y){return console.error("[API] Error listing audit logs:",y),l.json({error:y.message},500)}});let Bt=null,Lr=null,ht=async()=>{if(Lr)throw Lr;if(!Bt)try{let l="sqlite";"dialect"in t&&t.dialect==="postgres"&&t instanceof c$1?l=t.dialect:"dialect"in t&&t.dialect==="mongodb"&&(l="mongodb");let y=l==="postgres"&&t instanceof c$1?t.client:t;Bt=await pc.init(y,{dialect:l});}catch(l){throw console.error("[getMedia] Init error:",l),Lr=l,l}return Bt};_.get("/api/media",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=new URL(l.req.url).origin,f=parseInt(l.req.query("page")||"1"),p=parseInt(l.req.query("limit")||"30"),w=l.req.query("search")||"",C=l.req.query("type")||"",v=l.req.query("folder")||"",k=await b.find({page:f,limit:p,search:w,type:C,folder:v},R);return l.json(k)}catch(y){return console.error("[Media] find error:",y),l.json({error:y.message},500)}}),_.post("/api/media/upload",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.header("content-type")||"",f=new URL(l.req.url).origin;if(R.includes("multipart/form-data")){let k=await l.req.formData(),D=k.get("file"),O=k.get("folder")||"";if(!D)return l.json({error:"No file uploaded"},400);let N=await b.upload(D,O,f);return l.json(N)}let p=await l.req.json(),{url:w}=p,C=p.folder||"";if(!w)return l.json({error:"No URL provided"},400);let v=await b.uploadFromUrl(w,C,f);return l.json(v)}catch(y){return console.error("[Media] upload error:",y),l.json({error:y.message},500)}}),_.get("/api/media/folders",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let R=await(await ht()).listFolders();return l.json(R)}catch(y){return console.error("[Media] folders error:",y),l.json({error:y.message},500)}}),_.post("/api/media/folders",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=await l.req.json(),{name:f,parentPath:p}=R;return f?(await b.createFolder(f,p||""),l.json({message:"Folder created",path:p?`${p}/${f}`:f})):l.json({error:"Folder name is required"},400)}catch(y){return console.error("[Media] create folder error:",y),l.json({error:y.message},500)}}),_.delete("/api/media/folders",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.query("path");return R?(await b.deleteFolder(R),l.json({message:"Folder deleted"})):l.json({error:"Path is required"},400)}catch(y){return console.error("[Media] delete folder error:",y),l.json({error:y.message},500)}}),_.delete("/api/media/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.param("id"),f=new URL(l.req.url).origin;return await b.delete(R,f),l.json({success:!0})}catch(y){return console.error("[Media] delete error:",y),l.json({error:y.message},500)}}),_.get("/api/media/file/:key{.+$}",async l=>{let y=l.req.param("key"),b=globalThis.STORAGE_BUCKET;if(b){let R=await b.get(y);if(!R)return l.notFound();let f=new Headers;return R.writeHttpMetadata(f),f.set("etag",R.httpEtag),new Response(R.body,{headers:f})}return l.notFound()}),_.get("/api/media/resize",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=l.req.query("url"),R=parseInt(l.req.query("w")||"0"),f=parseInt(l.req.query("h")||"0"),p=l.req.query("fit")||"cover",w=parseFloat(l.req.query("cx")||"0"),C=parseFloat(l.req.query("cy")||"0"),v=parseFloat(l.req.query("cw")||"0"),k=parseFloat(l.req.query("ch")||"0");if(!b)return l.json({error:"URL is required"},400);let O=(await ht()).storage;if(O.name!=="local")return l.redirect(b);let N=O.config?.uploadDir||join(process.cwd(),"public","uploads"),B=O.config?.baseUrl||"/uploads";if(!b.startsWith(B))return l.redirect(b);let K=b.replace(B,""),Y=join(N,K);if(!existsSync(Y))return l.json({error:"File not found"},404);let le=readFileSync(Y),{default:J}=await import('sharp'),xe=J(le);if(v>0&&k>0){let Qe=await J(le).metadata(),Zr=Qe.width||0,At=Qe.height||0;if(Zr>0&&At>0){let It=Math.max(0,Math.min(Math.round(w/100*Zr),Zr-1)),Ds=Math.max(0,Math.min(Math.round(C/100*At),At-1)),J_=Math.max(1,Math.min(Math.round(v/100*Zr),Zr-It)),Q_=Math.max(1,Math.min(Math.round(k/100*At),At-Ds));xe=xe.extract({left:It,top:Ds,width:J_,height:Q_});}}(R>0||f>0)&&(xe=xe.resize({width:R>0?R:void 0,height:f>0?f:void 0,fit:p}));let Xe=await xe.toBuffer(),Je=await J(le).metadata();return l.header("Content-Type",`image/${Je.format||"webp"}`),l.header("Cache-Control","public, max-age=31536000, immutable"),l.body(Xe)}catch(y){return console.error("[Media] resize error:",y),l.json({error:y.message},500)}}),_.get("/api/media/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.param("id"),f=new URL(l.req.url).origin,p=await b.findById(R,f);return p?l.json(p):l.json({error:"Media not found"},404)}catch(y){return console.error("[Media] get error:",y),l.json({error:y.message},500)}}),_.patch("/api/media/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.param("id"),f=await l.req.json(),p=new URL(l.req.url).origin,w=["folder","metadata","title","alt","caption","originalName"],C={};for(let v of w)f[v]!==void 0&&(C[v]=f[v]);if(Object.keys(C).length>0){let v=await b.update(R,C,p);return l.json({doc:v})}return l.json({error:"No valid fields to update"},400)}catch(y){return console.error("[Media] update error:",y),l.json({error:y.message},500)}}),_.get("/api/media/test",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht();return l.json({status:b?"initialized":"failed",serviceType:b?.constructor?.name})}catch(y){return console.error("[test] Error:",y),l.json({error:y.message,type:y.constructor?.name,stack:y.stack},500)}}),_.get("/api/storage-status",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=typeof globalThis.STORAGE_BUCKET<"u"||typeof l.env?.STORAGE_BUCKET<"u",R=b,f=b?"cloudflare_r2":"local";if(t)try{let p=t.prepare('SELECT provider FROM "_globals_storage-settings" LIMIT 1').get();p&&p.provider&&(R=!0,f=p.provider==="aws"?"s3":p.provider);}catch{try{let p=await t.findOne({collection:"_globals_storage-settings",where:{},draft:!0});p&&p.provider&&(R=!0,f=p.provider==="aws"?"s3":p.provider);}catch{}}return l.json({provider:f,configured:R,usage:0,limit:"unlimited"})}catch(y){return console.error("[Storage] status error:",y),l.json({error:y.message},500)}}),_.get("/api/plugins",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=e.getPlugins(),R=e.storageProviders,f=await Promise.all(b.map(async p=>{let w=!0,C=p.name,v={};try{let O=await t.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});O&&O.states&&(v=O.states);}catch{}v[C]!==void 0&&(w=v[C]),R.setPluginEnabled(C,w);let k=C.replace(/^@[^/]+\//,"");k=k.replace(/^(plugin|kyro)-/,"");let D={ai:"AI",seo:"SEO",s3:"S3",aws:"AWS",api:"API",ui:"UI",ftp:"FTP"};if(k=k.split("-").map(O=>{let N=O.toLowerCase();return D[N]?D[N]:O.charAt(0).toUpperCase()+O.slice(1)}).join(" "),k.toLowerCase().startsWith("storage ")){let O=k.split(" ");O.length===2&&(k=`${O[1]} Storage`);}return {id:C,name:p.displayName||k,version:p.version||"1.0.0",description:p.description||"",enabled:w,status:w?"active":"disabled"}}));return l.json(f)}catch(y){return console.error("[Plugins] list error:",y),l.json({error:y.message},500)}}),_.put("/api/plugins/:name/toggle",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=l.req.param("name"),R=e.storageProviders,p=!R.isPluginEnabled(b),w=[];if(!p)for(let v of R.getAll())v.pluginName===b&&w.push(v.type);if(!(l.req.query("force")==="1")&&!p&&w.length>0){let v="local";try{let k=t?.prepare?.('SELECT provider FROM "_globals_storage-settings" LIMIT 1')?.get();k?.provider&&(v=k.provider);}catch{try{let k=await t?.findOne?.({collection:"_globals_storage-settings",where:{},draft:!0});k?.provider&&(v=k.provider);}catch{}}if(w.includes(v))return l.json({error:`Cannot disable "${b}" \u2014 storage provider "${v}" is currently active. Switch to Local storage first.`,requiresAction:!0,activeProvider:v},409)}try{let v={},k="global",D=await t.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});D&&(v=D.states||{},k=D.id),v[b]=p,D?await t.update({collection:"_globals_plugin-settings",id:k,data:{states:v}}):await t.create({collection:"_globals_plugin-settings",data:{states:v,id:"global"}});}catch(v){console.warn(`[Plugins] Could not persist state for "${b}":`,v);}return R.setPluginEnabled(b,p),l.json({name:b,enabled:p})}catch(y){return console.error("[Plugins] toggle error:",y),l.json({error:y.message},500)}}),_.get("/api/health",l=>l.json({status:"ok",version:"0.12.56",collections:e.getCollectionSlugs(),timestamp:new Date().toISOString()})),_.get("/api/metrics",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let R=y.role==="admin"||y.role==="super_admin",p=e.getCollectionSlugs().filter(B=>!["users","audit_logs","media","_globals_access-settings","_globals_brand-settings"].includes(B)&&!B.startsWith("_globals_")).filter(B=>R||a$5(y,`${B}:read`)),w=0,C={};await Promise.all(p.map(async B=>{try{let Y=(await t.find({collection:B,where:{},limit:1,page:1,tenantId:b})).totalDocs??0;w+=Y,C[B]=Y;}catch{}}));let v=0;try{v=(await t.find({collection:"media",where:{},limit:1,page:1,tenantId:b})).totalDocs??0;}catch{}let k=0;try{k=(await t.find({collection:"users",where:{},limit:1,page:1,tenantId:b})).totalDocs??0;}catch{}let D=0;try{if(g){let B=await g.getWebhooks();D=Array.isArray(B)?B.length:0;}}catch{}let O=0;try{O=(await t.find({collection:d$1,where:{},limit:1,page:1,tenantId:b})).totalDocs??0;}catch{}let N=w+v+k;return l.json({totalDocuments:w,totalMedia:R||a$5(y,"media:read")?v:void 0,totalUsers:R||a$5(y,"users:read")?k:void 0,totalWebhooks:R?D:void 0,totalApiKeys:R?O:void 0,totalStoredRecords:N,collectionCounts:C,collections:p.length,timestamp:new Date().toISOString()})}catch(y){return console.error("[API] Metrics error:",y),l.json({error:y.message},500)}}),_.get("/api/analytics",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);if(!(y.role==="admin"||y.role==="super_admin"))return l.json({error:"Unauthorized"},403);let p=(await t.find({collection:"orders",where:{},limit:1e3,page:1,tenantId:b})).docs||[],w=await t.findOne({collection:"_globals_store-settings",where:{},tenantId:b}),C=w?.currency?.code||w?.currency||"USD",v={},k={},D={};p.forEach(B=>{let K=B.createdAt||B.updatedAt,Y=K?new Date(K).toISOString().split("T")[0]:new Date().toISOString().split("T")[0];v[Y]||(v[Y]=0),k[Y]||(k[Y]=0);let le=typeof B.total=="number"?B.total:parseFloat(String(B.total||0));v[Y]+=isNaN(le)?0:le,k[Y]+=1;let J=B.orderStatus||B.status||"pending";D[J]=(D[J]||0)+1;});let O=Object.keys(v).sort().map(B=>({date:B,revenue:Math.round(v[B]*100)/100,orders:k[B]})),N=Math.round(O.reduce((B,K)=>B+K.revenue,0)*100)/100;return l.json({chartData:O,totalRevenue:N,totalOrders:p.length,ordersByStatus:D,currencyCode:typeof C=="string"?C:"USD"})}catch(y){return l.json({error:y.message},500)}}),_.get("/api/kyro/schema",async l=>{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=f=>f.map(p=>{let w={name:p.name,type:p.type,label:p.label,required:p.required??false,unique:p.unique??false,indexed:p.indexed??false,defaultValue:p.defaultValue,admin:p.admin?{...p.admin}:void 0};return p.minLength!==void 0&&(w.minLength=p.minLength),p.maxLength!==void 0&&(w.maxLength=p.maxLength),p.pattern!==void 0&&(w.pattern=p.pattern),p.variant!==void 0&&(w.variant=p.variant),p.hasMany!==void 0&&(w.hasMany=p.hasMany),p.min!==void 0&&(w.min=p.min),p.max!==void 0&&(w.max=p.max),p.step!==void 0&&(w.step=p.step),p.integer!==void 0&&(w.integer=p.integer),p.options&&(w.options=p.options),p.relationTo&&(w.relationTo=p.relationTo),p.maxDepth!==void 0&&(w.maxDepth=p.maxDepth),p.minRows!==void 0&&(w.minRows=p.minRows),p.maxRows!==void 0&&(w.maxRows=p.maxRows),p.localized!==void 0&&(w.localized=p.localized),p.language&&(w.language=p.language),p.format&&(w.format=p.format),p.allowedTypes&&(w.allowedTypes=p.allowedTypes),p.maxSize&&(w.maxSize=p.maxSize),(p.type==="group"||p.type==="row"||p.type==="collapsible"&&p.fields)&&(w.fields=b(p.fields)),p.type==="array"&&p.fields&&(w.fields=b(p.fields)),p.type==="blocks"&&p.blocks&&(w.blocks=p.blocks.map(C=>({slug:C.slug,label:C.label,fields:b(C.fields)}))),p.type==="tabs"&&p.tabs&&(w.tabs=p.tabs.map(C=>({label:C.label,name:C.name,fields:b(C.fields)}))),w}),R={collections:{},globals:{}};for(let f of e.getCollections()){let p=f.slug;try{R.collections[p]={slug:p,label:f.label||p,fields:b(f.fields),jsonSchema:Kn(e.getZodSchema(p),{target:"openApi3"}),createSchema:Kn(e.getCreateZodSchema(p),{target:"openApi3"}),updateSchema:Kn(e.getUpdateZodSchema(p),{target:"openApi3"}),procedures:{find:{collection:p,where:"Record<string,any>",sort:"string",limit:"number",page:"number",depth:"number",select:"string[]",draft:"boolean"},findByID:{collection:p,id:"string",depth:"number",select:"string[]",draft:"boolean"},create:{collection:p,data:"Record<string,any>",depth:"number",select:"string[]"},update:{collection:p,id:"string",data:"Record<string,any>",depth:"number",select:"string[]",baseUpdatedAt:"string"},delete:{collection:p,id:"string"},count:{collection:p,where:"Record<string,any>"}}};}catch{}}for(let f of e.getGlobals()){let p=f.slug,w=f.fields;if(p==="storage-settings"){let C=e.storageProviders,v=C.getAll(),k=new Set(C.getAllAvailable(O=>C.isPluginEnabled(O)).map(O=>O.type));k.add("local");let D=new Set(v.map(O=>O.type));w=w.filter(O=>O.type==="group"&&O.name&&D.has(O.name)?k.has(O.name):true).map(O=>O.name==="provider"&&O.type==="select"?{...O,options:O.options.filter(N=>k.has(N.value))}:O);}try{R.globals[p]={slug:p,label:f.label||p,fields:b(w),jsonSchema:Kn(e.getZodSchema(p),{target:"openApi3"}),procedures:{get:{},update:{data:"Record<string,any>"}}};}catch{}}return l.json(R)}),_.get("/api/collections",async l=>{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=e.getCollections().map(R=>({slug:R.slug,label:R.label||R.slug,fields:R.fields.filter(f=>f.name).map(f=>({name:f.name,type:f.type,required:f.required,label:f.label}))}));return l.json(b)});function Vn(l,y,b){if(b in y)return y[b];for(let R of l)if(R.name){if(R.type==="tabs"&&R.tabs){let f=y[R.name];if(f&&typeof f=="object"&&b in f)return f[b]}if((R.type==="group"||R.type==="collapsible")&&R.fields){let f=y[R.name];if(f&&typeof f=="object"){if(b in f)return f[b];let p=Vn(R.fields,f,b);if(p!==void 0)return p}}}}_.get("/api/search",async l=>{try{let y=l.req.query("q")||"",b=l.req.query("collections")||"",R=Math.min(parseInt(l.req.query("limit")||"10"),50);if(!y||y.length<2)return l.json({results:[],message:"Query too short"});let{user:f,tenantId:p}=await W(l.req.raw,F,i,c),w=b?b.split(",").filter(Boolean):e.getCollectionSlugs(),C=[],v=new RegExp(y.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),"i");for(let k of e.getCollections()){if(!w.includes(k.slug)||!(await De(k,"read",l.req.raw,f,p,void 0,q,H)).allowed)continue;let O=k.fields.filter(N=>N.name&&N.name!=="id"&&(N.type==="text"||N.type==="email"||N.type==="textarea"||N.type==="richtext"||N.indexed)&&!N.admin?.hidden).map(N=>N.name);if(O.length!==0)try{let N=O.map(K=>{let Y={};return Y[K]={like:`%${y}%`},Y}),B=await t.find({collection:k.slug,where:{OR:N},limit:R,tenantId:p});await a$6(B.docs,k.fields,t,e,1,0);for(let K of B.docs){let Y=k.admin?.useAsTitle||O.find(J=>J==="title"||J==="name"||J==="heading"||J==="slug"),le=Y?Vn(k.fields,K,Y)??K.id:K.id;C.push({collection:k.slug,label:k.label||k.slug,id:K.id,title:String(le||"Untitled"),doc:K});}}catch(N){console.error(`Search error for ${k.slug}:`,N);}}return C.sort((k,D)=>k.label.localeCompare(D.label)),l.json({results:C})}catch(y){return l.json({error:y.message,results:[]},500)}}),_.get("/api/keys",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);let R=parseInt(l.req.query("page")||"1"),f=Math.min(parseInt(l.req.query("limit")||"50"),100),p=await t.find({collection:d$1,where:{},page:R,limit:f,tenantId:b}),w=(p.docs||[]).map(C=>({id:C.id,name:C.name,keyPrefix:C.keyPrefix,permissions:C.permissions||[],lastUsed:C.lastUsedAt,createdAt:C.createdAt}));return l.json({docs:w,totalDocs:p.totalDocs||w.length,totalPages:p.totalPages||1})}catch(y){return console.error("[ApiKeys] GET error:",y),l.json({error:y.message},500)}}),_.post("/api/keys",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);let b=await l.req.json();if(!b.name||typeof b.name!="string")return l.json({error:"name is required"},400);let R=i$1(),f=await t.create({collection:d$1,data:{userId:y.id,name:b.name,key:R,keyPrefix:j$2(R),permissions:Array.isArray(b.permissions)?b.permissions:["*"],expiresAt:b.expiresAt||null,createdAt:new Date().toISOString()}});return await Z?.createAuditLog({action:"api_key_create",userId:y.id,resource:"api_key",resourceId:f.id,success:!0,metadata:{keyName:b.name}}),l.json({...f,key:R,permissions:Array.isArray(b.permissions)?b.permissions:["*"]},201)}catch(y){return console.error("[ApiKeys] POST error:",y),l.json({error:y.message},500)}}),_.delete("/api/keys/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);let b=l.req.param("id"),R=await t.findByID({collection:d$1,id:b});return R?(await t.delete({collection:d$1,id:b}),await Z?.createAuditLog({action:"api_key_delete",userId:y.id,resource:"api_key",resourceId:b,success:!0,metadata:{keyName:R.name}}),l.json({message:"API key deleted"})):l.json({error:"API key not found"},404)}catch(y){return console.error("[ApiKeys] DELETE error:",y),l.json({error:y.message},500)}}),_.patch("/api/keys/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);let b=l.req.param("id"),R=await l.req.json(),f=await t.findByID({collection:d$1,id:b});if(!f)return l.json({error:"API key not found"},404);let p={};if(typeof R.name=="string"&&R.name.trim()&&(p.name=R.name.trim()),Array.isArray(R.permissions)&&(p.permissions=R.permissions),R.expiresAt!==void 0&&(p.expiresAt=R.expiresAt||null),Object.keys(p).length===0)return l.json({error:"Nothing to update"},400);let w=await t.update({collection:d$1,id:b,data:p});return l.json({...w,keyPrefix:f.keyPrefix})}catch(y){return console.error("[ApiKeys] PATCH error:",y),l.json({error:y.message},500)}}),_.post("/api/keys/:id/rotate",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);let b=l.req.param("id"),R=await t.findByID({collection:d$1,id:b});if(!R)return l.json({error:"API key not found"},404);let f=i$1(),p=await t.update({collection:d$1,id:b,data:{key:f,keyPrefix:j$2(f),lastUsedAt:null}});return await Z?.createAuditLog({action:"api_key_rotate",userId:y.id,resource:"api_key",resourceId:b,success:!0,metadata:{keyName:R.name}}),l.json({...p,key:f,permissions:R.permissions,expiresAt:R.expiresAt})}catch(y){return console.error("[ApiKeys] rotate error:",y),l.json({error:y.message},500)}}),_.get("/api/webhooks/actions",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);let b={generic:{label:"Custom URL",description:"POST to any endpoint with Kyro payload",configFields:[],envVars:[]},"github-push":{label:"GitHub Push",description:"Push an empty commit to simulate a push event",configFields:[{name:"githubOwner",label:"Owner",required:!0,placeholder:"e.g., kyro-dev"},{name:"githubRepo",label:"Repository",required:!0,placeholder:"e.g., my-website"},{name:"githubBranch",label:"Branch",required:!1,placeholder:"main"}],envVars:["GITHUB_TOKEN"]}};return l.json({actions:b})}catch(y){return console.error("[Webhooks] actions error:",y),l.json({error:y.message},500)}}),_.get("/api/webhooks",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=await g.getWebhooks();return l.json({docs:b})}catch(y){return console.error("[Webhooks] GET error:",y),l.json({error:y.message},500)}}),_.post("/api/webhooks",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=await l.req.json(),R=await g.createWebhook(b);return await Z?.createAuditLog({action:"webhook_create",userId:y.id,resource:"webhook",resourceId:R.id,success:!0,metadata:{name:R.name,url:R.url}}),l.json(R,201)}catch(y){return console.error("[Webhooks] POST error:",y),l.json({error:y.message},500)}}),_.get("/api/webhooks/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=await g.getWebhookById(b);return R?l.json(R):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] GET :id error:",y),l.json({error:y.message},500)}}),_.patch("/api/webhooks/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=await l.req.json(),f=await g.updateWebhook(b,R);return f?(await Z?.createAuditLog({action:"webhook_update",userId:y.id,resource:"webhook",resourceId:b,success:!0,metadata:{name:f.name}}),l.json(f)):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] PATCH error:",y),l.json({error:y.message},500)}}),_.delete("/api/webhooks/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=await g.getWebhookById(b);return R?(await g.deleteWebhook(b),await Z?.createAuditLog({action:"webhook_delete",userId:y.id,resource:"webhook",resourceId:b,success:!0,metadata:{name:R.name}}),l.json({message:"Webhook deleted"})):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] DELETE error:",y),l.json({error:y.message},500)}}),_.post("/api/webhooks/:id/test",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=await g.testWebhook(b);return R?l.json(R):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] test error:",y),l.json({error:y.message},500)}}),_.get("/api/webhooks/:id/history",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=Math.min(parseInt(l.req.query("limit")||"50"),100),f=await g.getDeliveryHistory(b,R);return l.json({docs:f})}catch(y){return console.error("[Webhooks] history error:",y),l.json({error:y.message},500)}});function Wn(l){let y={},b=["name","type","required","hasMany","relationTo","options","min","max","minLength","maxLength","defaultValue","label","localized","admin","unique","index","hidden","readOnly","deprecated"];for(let R of b)R in l&&(y[R]=l[R]);return l.fields&&(y.fields=l.fields.map(Wn)),l.tabs&&(y.tabs=l.tabs.map(R=>({label:R.label,name:R.name,fields:R.fields.map(Wn)}))),y}_.get("/api/__schema",async l=>{try{let{user:y,apiKeyContext:b}=await W(l.req.raw,F,i,c);if(!y&&!b)return l.json({error:"Unauthorized"},401);let f=e.getCollections().filter(p=>p.slug!=="users"&&p.slug!=="audit_logs").map(p=>({slug:p.slug,label:p.label,labelPlural:p.labelPlural,singularLabel:p.singularLabel,timestamps:p.timestamps,auth:!!p.auth,tenantScoped:!!p.tenantScoped,upload:p.upload?{staticDir:p.upload.staticDir,imageSizes:p.upload.imageSizes,mimeTypes:p.upload.mimeTypes}:void 0,fields:p.fields.map(Wn)}));return l.json(f)}catch(y){return console.error("[Schema] error:",y),l.json({error:y.message},500)}});let _d=e.getCollections();for(let l of _d){let R=function(f,p){let w=[],C=new Set([...Object.keys(f),...Object.keys(p)]);for(let v of C)v==="id"||v==="createdAt"||v==="updatedAt"||JSON.stringify(f[v])!==JSON.stringify(p[v])&&w.push({field:v,oldValue:v in f?f[v]:void 0,newValue:v in p?p[v]:void 0});return w};let y=l.slug;if(y==="users"||y==="audit_logs")continue;let b=`/api/${y}`;_.post(`${b}/dynamic-options/:fieldName`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"read",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("fieldName"),D=await f.req.json(),{data:O,siblingData:N}=D,B=gs(l.fields,k);if(!B)return f.json({error:"Field not found"},404);if(B.type!=="select")return f.json({error:"Field is not a select field"},400);let K=[];return typeof B.options=="function"?K=await B.options({data:O||{},siblingData:N||{}}):Array.isArray(B.options)&&(K=B.options),f.json({options:K})}catch(p){return f.json({error:p.message},500)}}),_.get(b,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"read",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);w&&t.setTenantContext({tenantId:w,userId:p?.id??"",role:p?.role,isSuperAdmin:p?.role==="super_admin"});let k=new URL(f.req.url),D=parseInt(k.searchParams.get("page")||"1"),O=Math.min(parseInt(k.searchParams.get("limit")||"10"),100),N=k.searchParams.get("sort")||void 0,B=parseInt(k.searchParams.get("depth")||"0"),K=k.searchParams.get("select")?.split(",")||void 0,Y=k.searchParams.get("draft"),le=Y==="true"?!0:Y==="false"?!1:!!p,J={},xe=k.searchParams.get("where");if(xe)try{J=JSON.parse(xe);}catch{return f.json({error:"Invalid JSON in where parameter"},400)}let Xe=await t.find({collection:y,where:J,sort:N,limit:O,page:D,depth:B,tenantId:w,select:K,draft:le});return await a$6(Xe.docs,l.fields,t,e,1,B),f.json(a$7(Xe))}catch(p){return console.error("[API] list error:",p),f.json({error:p.message},500)}}),_.get(`${b}/:id/versions`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"read",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id");if(!k)return f.json({error:"Missing document ID"},400);let D=new URL(f.req.url),O=D.searchParams.get("compareA"),N=D.searchParams.get("compareB");if(wc(Z,C,`${b}/${k}/versions`,"GET",f.req.raw),O&&N){let[le,J]=await Promise.all([t.findVersionByID({collection:y,versionId:O,tenantId:w}),t.findVersionByID({collection:y,versionId:N,tenantId:w})]);if(!le||!J)return f.json({error:"Version not found"},404);let xe=R(le.data,J.data);return f.json({diffs:xe})}let B=parseInt(D.searchParams.get("page")||"1"),K=Math.min(parseInt(D.searchParams.get("limit")||"10"),100),Y=await t.findVersions({collection:y,documentId:k,page:B,limit:K,tenantId:w});return f.json(Y)}catch(p){return console.error("[API] versions error:",p),f.json({error:p.message},500)}}),_.put(`${b}/:id/draft`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id"),D=await f.req.json(),O=bc(D),N=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!N)return f.json({error:"Document not found"},404);let B;D.delta?B={...N,...D.delta}:B=D.data??yd(D);let K=await t.updateLatestVersion({collection:y,documentId:k,data:B,status:"draft",tenantId:w});return p&&Z?.createAuditLog({action:"document_update",userId:p.id,resource:y,resourceId:k,success:!0,metadata:{type:"draft_save"}}),f.json({data:K,message:"Draft saved successfully"})}catch(p){return f.json({error:p.message},500)}}),_.delete(`${b}/:id/draft`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);return v.allowed?(p&&Z?.createAuditLog({action:"document_update",userId:p.id,resource:y,resourceId:f.req.param("id"),success:!0,metadata:{type:"draft_discard"}}),f.json({message:"Draft discarded successfully"})):f.json({error:v.error},v.status||403)}catch(p){return f.json({error:p.message},500)}}),_.get(`${b}/:id`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=new URL(f.req.url),k=v.searchParams.get("draft"),D=v.searchParams.get("kyroToken"),O=!1;if(k==="true"&&D&&s)try{let J=await wo(D,s,"HS256");J&&J.type==="preview"&&J.collection===l.slug&&(O=!0);}catch(J){console.warn("Invalid preview token",J);}if(!O){let J=await De(l,"read",f.req.raw,p,w,C,q,H);if(!J.allowed)return f.json({error:J.error},J.status||403)}let N=f.req.param("id"),B=parseInt(v.searchParams.get("depth")||"0"),K=v.searchParams.get("select")?.split(",")||void 0,Y=k==="true"?!0:k==="false"?!1:!!p,le=await t.findByID({collection:y,id:N,depth:B,tenantId:w,select:K,draft:Y});return !le&&l.fields.some(J=>J.name==="slug")&&(le=await t.findOne({collection:y,where:{slug:N},tenantId:w,draft:Y})),le?(await a$6([le],l.fields,t,e,1,B),f.json({data:a$7(le)})):f.json({error:"Document not found"},404)}catch(p){return f.json({error:p.message},500)}}),_.post(`${b}/preview-url`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await De(l,"read",f.req.raw,p,w);if(!C.allowed)return f.json({error:C.error||"Forbidden"},C.status||403);let v=await f.req.json().catch(()=>({})),k="";s&&(k=await bo({type:"preview",collection:l.slug,id:v.id,exp:Math.floor(Date.now()/1e3)+3600},s,"HS256"));let D="";if(l.admin?.preview){D=await l.admin.preview(v,{req:f.req.raw,token:k});try{let O=new URL(D,"http://localhost");O.searchParams.has("preview")||O.searchParams.set("preview","true"),!O.searchParams.has("kyroToken")&&k&&O.searchParams.set("kyroToken",k),D=D.startsWith("http")?O.toString():`${O.pathname}${O.search}`;}catch{}}else {let O="";try{let B=await t.findOne({collection:"_globals_site-settings",where:{}});B?.siteUrl&&(O=B.siteUrl);}catch{}if(!O)return f.json({error:"No site URL configured in settings, and no custom preview function defined for this collection."},400);O=O.replace(/\/$/,"");let N=v.slug||v.id||"";D=`${O}/${l.slug}/${N}?preview=true&kyroToken=${k}`;}return f.json({url:D})}catch(p){return f.json({error:p.message},500)}}),_.post(b,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"create",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);w&&t.setTenantContext({tenantId:w,userId:p?.id??"",role:p?.role,isSuperAdmin:p?.role==="super_admin"}),wc(Z,C,b,"POST",f.req.raw);let D=await f.req.json();Qr(D,l.fields),Yr(l.fields,D);let O=f.req.raw;if(l.hooks?.beforeValidate)for(let J of l.hooks.beforeValidate){let xe=await J({collection:y,data:D,req:O,user:p,tenantId:w,operation:"create"});xe&&typeof xe=="object"&&!Array.isArray(xe)&&Object.assign(D,xe);}let N=e.getCreateZodSchema(y);try{D=N.parse(D);}catch(J){return f.json({error:`Validation failed: ${sa(J.errors)}`,details:J.errors},400)}l.tenantScoped&&w&&(D.tenantId=w);let B=l.versions?.drafts===!0,K=l.fields.find(J=>J.name==="status"),Y=K?.type==="select"&&Array.isArray(K.options)&&K.options.some(J=>J.value==="published");if(B?D.status="draft":Y&&!D.status&&(D.status="published"),l.hooks?.beforeChange)for(let J of l.hooks.beforeChange){let xe=await J({collection:y,data:D,req:O,user:p,tenantId:w,operation:"create"});xe&&typeof xe=="object"&&!Array.isArray(xe)&&Object.assign(D,xe);}let le=await t.create({collection:y,data:D,tenantId:w});if(B&&await t.createVersion({collection:y,documentId:le.id,data:D,status:"draft",createdBy:p?.id,changeDescription:"Created",tenantId:w}),l.hooks?.afterChange)for(let J of l.hooks.afterChange)await J({collection:y,doc:le,data:D,req:O,user:p,tenantId:w,operation:"create"});return g&&g.trigger(Qa(y,"create"),{collection:y,operation:"create",data:le,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(J=>console.error("[Webhook] Failed to trigger:",J)),p&&Z?.createAuditLog({action:"document_create",userId:p.id,resource:y,resourceId:le.id,success:!0}),f.json({data:le,message:"Created successfully"},201)}catch(p){return p.name==="ZodError"?f.json({error:`Validation failed: ${sa(p.errors)}`,details:p.errors},400):f.json({error:p.message},500)}}),_.patch(`${b}/:id`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id"),D=await f.req.json(),O=bc(D),N=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!N)return f.json({error:"Document not found"},404);if(O&&N.updatedAt&&O!==N.updatedAt)return f.json(xd(O,N),409);let B=Object.fromEntries(Object.entries(yd(D)).filter(([Je,Qe])=>Qe!=="null"&&Qe!==void 0));Qr(B,l.fields),Yr(l.fields,B);let K=f.req.raw;if(l.hooks?.beforeValidate)for(let Je of l.hooks.beforeValidate){let Qe=await Je({collection:y,data:B,originalDoc:N,req:K,user:p,tenantId:w,operation:"update"});Qe&&typeof Qe=="object"&&!Array.isArray(Qe)&&Object.assign(B,Qe);}if(B=e.getUpdateZodSchema(y).parse(B),l.hooks?.beforeChange)for(let Je of l.hooks.beforeChange){let Qe=await Je({collection:y,data:B,originalDoc:N,req:K,user:p,tenantId:w,operation:"update"});Qe&&typeof Qe=="object"&&!Array.isArray(Qe)&&Object.assign(B,Qe);}let le=f.req.header("X-Draft")==="true",J=l.versions?.drafts===!0,xe=f.req.query("autosave")==="true",Xe;if(J&&le)await t.createVersion({collection:y,documentId:k,data:B,status:"draft",autosave:xe,createdBy:p?.id,changeDescription:xe?"Autosave":"Draft saved",tenantId:w});else if(J){let Je=D.status==="draft"?"draft":"published";await t.update({collection:y,id:k,data:{...B,status:Je},tenantId:w}),await t.createVersion({collection:y,documentId:k,data:{...B,status:Je},status:Je,createdBy:p?.id,changeDescription:Je==="published"?"Published":"Unpublished",tenantId:w});}else await t.update({collection:y,id:k,data:B,tenantId:w});if(Xe=await t.findByID({collection:y,id:k,tenantId:w,draft:!0}),l.hooks?.afterChange)for(let Je of l.hooks.afterChange)await Je({collection:y,doc:Xe,data:B,originalDoc:N,req:K,user:p,tenantId:w,operation:"update"});return g&&!xe&&g.trigger(Qa(y,"update"),{collection:y,operation:"update",data:Xe,previousData:N,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(Je=>console.error("[Webhook] Failed to trigger:",Je)),wc(Z,C,`${b}/${k}`,"PATCH",f.req.raw),p&&Z?.createAuditLog({action:"document_update",userId:p.id,resource:y,resourceId:k,success:!0}),f.json({data:Xe,message:J?"Draft saved":"Updated successfully"})}catch(p){return p.name==="ZodError"?(console.error(`[PATCH ${b}/:id] Validation failed:`,p.errors),f.json({error:`Validation failed: ${sa(p.errors)}`,details:p.errors},400)):(console.error(`[PATCH ${b}/:id] ERROR:`,p.message,"CAUSE:",p.cause?.message||p.cause,"QUERY:",p.query),f.json({error:p.message},500))}}),_.delete(`${b}/:id`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"delete",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);w&&t.setTenantContext({tenantId:w,userId:p?.id??"",role:p?.role,isSuperAdmin:p?.role==="super_admin"});let k=f.req.param("id"),D=f.req.raw,O=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!O)return f.json({error:"Document not found"},404);if(l.hooks?.beforeDelete)for(let B of l.hooks.beforeDelete)await B({collection:y,doc:O,req:D,user:p,tenantId:w,operation:"delete"});let N=await t.delete({collection:y,id:k,tenantId:w});if(l.hooks?.afterDelete)for(let B of l.hooks.afterDelete)await B({collection:y,doc:N,originalDoc:O,req:D,user:p,tenantId:w,operation:"delete"});return g&&g.trigger(Qa(y,"delete"),{collection:y,operation:"delete",data:N,previousData:O,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(B=>console.error("[Webhook] Failed to trigger:",B)),wc(Z,C,`${b}/${k}`,"DELETE",f.req.raw),p&&Z?.createAuditLog({action:"document_delete",userId:p.id,resource:y,resourceId:k,success:!0}),f.json({data:N,message:"Deleted successfully"})}catch(p){return console.error(`[DELETE] Error deleting ${y}:`,p),f.json({error:p.message||String(p)},500)}}),_.post(`${b}/:id/duplicate`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"create",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id"),D=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!D)return f.json({error:"Document not found"},404);let{id:O,createdAt:N,updatedAt:B,...K}=D;qs(l.fields,K);let Y=Date.now().toString(36);"slug"in K&&typeof K.slug=="string"&&(K.slug=`${K.slug||"document"}-copy-${Y}`),"title"in K&&typeof K.title=="string"?K.title=`${K.title||"Copy"} (Copy)`:"name"in K&&typeof K.name=="string"&&(K.name=`${K.name||"Copy"} (Copy)`);let le=await t.create({collection:y,data:{...K,status:"draft"},tenantId:w});return f.json({data:le,message:"Document duplicated successfully"})}catch(p){return console.error("[Duplicate] Error:",p),f.json({error:p.message||String(p)},500)}}),_.post(`${b}/:id/versions/:versionId/restore`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id"),D=f.req.param("versionId"),O=await t.findVersionByID({collection:y,versionId:D,tenantId:w});if(!O)return f.json({error:"Version not found"},404);let N=await t.update({collection:y,id:k,data:{...O.data,status:"draft"},tenantId:w});return f.json({data:N,message:"Version restored successfully"})}catch(p){return f.json({error:p.message},500)}}),_.post(`${b}/:id/versions`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=await f.req.json(),{versionId:D,action:O}=k;if(O==="restore"&&D){let N=await t.findVersionByID({collection:y,versionId:D,tenantId:w});if(!N)return f.json({error:"Version not found"},404);let B=await t.update({collection:y,id:f.req.param("id"),data:{...N.data,status:"draft"},tenantId:w});return f.json({data:B,message:"Version restored successfully"})}return f.json({error:"Invalid action"},400)}catch(p){return f.json({error:p.message},500)}}),_.post(`${b}/:id/publish`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);w&&t.setTenantContext({tenantId:w,userId:p?.id??"",role:p?.role,isSuperAdmin:p?.role==="super_admin"});let k=f.req.param("id"),D=await f.req.json().catch(()=>({})),O=bc(D),N=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!N)return f.json({error:"Document not found"},404);if(O&&N.updatedAt&&O!==N.updatedAt)return f.json(xd(O,N),409);let B={status:"published"},K=N;if(l.versions?.drafts){let le=await t.findVersions({collection:y,documentId:k,limit:1,sort:"-createdAt",tenantId:w});if(le.docs.length>0){let J=le.docs[0];K={...N,...J.data},B={...J.data,...B};}}let Y=await t.update({collection:y,id:k,data:B,tenantId:w});return l.versions?.drafts&&await t.createVersion({collection:y,documentId:k,data:{...K,status:"published"},status:"published",createdBy:p?.id,changeDescription:"Published",tenantId:w}),g&&g.trigger(Qa(y,"update"),{collection:y,operation:"update",data:Y,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(le=>console.error("[Webhook] Failed to trigger:",le)),f.json({data:Y,message:"Published successfully"})}catch(p){return f.json({error:p.message},500)}}),_.post(`${b}/:id/unpublish`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id");if(!await t.findByID({collection:y,id:k,tenantId:w,draft:!0}))return f.json({error:"Document not found"},404);let O=await t.update({collection:y,id:k,data:{status:"draft"},tenantId:w});return g&&g.trigger(Qa(y,"update"),{collection:y,operation:"update",data:O,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(N=>console.error("[Webhook] Failed to trigger:",N)),f.json({data:O,message:"Unpublished successfully"})}catch(p){return f.json({error:p.message},500)}});}for(let l of e.getGlobals()){let y=l.slug,b$1=`/api/globals/${y}`;_.post(`${b$1}/dynamic-options/:fieldName`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"read",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},C.status||403);let v=f.req.param("fieldName"),k=await f.req.json(),{data:D,siblingData:O}=k,N=gs(l.fields,v);if(!N)return f.json({error:"Field not found"},404);if(N.type!=="select")return f.json({error:"Field is not a select field"},400);let B=[];return typeof N.options=="function"?B=await N.options({data:D||{},siblingData:O||{}}):Array.isArray(N.options)&&(B=N.options),f.json({options:B})}catch(p){return f.json({error:p.message},500)}}),_.get(b$1,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=new URL(f.req.url),v=C.searchParams.get("kyroToken"),k=C.searchParams.get("draft"),D=!1;if(k==="true"&&v&&s)try{let Y=await wo(v,s,"HS256");Y&&Y.type==="preview"&&Y.collection===`_globals_${l.slug}`&&(D=!0);}catch(Y){console.warn("Invalid preview token",Y);}if(!D){let Y=await er(l,"read",f.req.raw,p,w,q);if(!Y.allowed)return f.json({error:Y.error},Y.status||403)}let O=k==="true"?!0:k==="false"?!1:!!p,N=parseInt(C.searchParams.get("depth")||"0"),K=(await t.find({collection:`_globals_${y}`,where:{},tenantId:w,draft:O,depth:N,limit:1})).docs[0];if(K&&N>0&&await a$6([K],l.fields,t,e,1,N),y==="storage-settings"&&(typeof globalThis.STORAGE_BUCKET<"u"||typeof f.env?.STORAGE_BUCKET<"u")&&(K?K.provider||(K.provider="cloudflare_r2"):K={id:y,provider:"cloudflare_r2"}),y==="system"){let Y=NB.randomBytes(32).toString("hex");K?K.appSecret||(await t.update({collection:`_globals_${y}`,id:y,data:{appSecret:Y},tenantId:w}),K.appSecret=Y):K=await t.create({collection:`_globals_${y}`,data:{id:y,appSecret:Y},tenantId:w});}return f.json({data:K||{}})}catch(p){return f.json({error:p.message},500)}});let R=async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"update",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},C.status||403);let v=new URL(f.req.url),k=parseInt(v.searchParams.get("depth")||"0"),D=await f.req.json(),O=bc(D),N=yd(D),B=Object.fromEntries(Object.entries(N).filter(([It,Ds])=>Ds!==null&&Ds!=="null"&&Ds!==void 0));Qr(B,l.fields),Yr(l.fields,B);let K=e.getUpdateZodSchema(y),Y;try{Y=K.parse(B);}catch(It){return f.json({error:`Validation failed: ${sa(It.errors)}`,details:It.errors},400)}let le=new Set(["id","createdAt","updatedAt","status","baseUpdatedAt","_baseUpdatedAt"]),J=Object.fromEntries(Object.entries(Y).filter(([It])=>!le.has(It))),xe=`_globals_${y}`,Xe=await t.findOne({collection:xe,where:{},tenantId:w,draft:!0});if(Xe&&O&&Xe.updatedAt&&O!==Xe.updatedAt)return f.json(xd(O,Xe),409);let Je=f.req.header("X-Draft")==="true",Qe=l.versions?.drafts===!0,Zr=f.req.query("autosave")==="true",At;if(Qe&&Je)await t.createVersion({collection:xe,documentId:y,data:J,status:"draft",autosave:Zr,createdBy:p?.id,changeDescription:Zr?"Autosave":"Manual save",tenantId:w}),Xe?At=Xe:At=await t.create({collection:xe,data:{...J,id:y,status:"draft"},tenantId:w});else if(Qe&&!Je){let It="published";Xe?At=await t.update({collection:xe,id:y,data:{...J,status:It},tenantId:w}):At=await t.create({collection:xe,data:{...J,id:y,status:It},tenantId:w}),await t.createVersion({collection:xe,documentId:y,data:J,status:It,autosave:!1,createdBy:p?.id,changeDescription:"Published",tenantId:w});}else Xe?At=await t.update({collection:xe,id:y,data:J,tenantId:w}):At=await t.create({collection:xe,data:{...J,id:y},tenantId:w});if(y==="storage-settings"&&(Bt=null,Lr=null),y==="email-settings"){let It=await q$1.fromConfig(t);we.email=It||void 0;}return y==="system"&&await b(),p&&Z?.createAuditLog({action:"settings_change",userId:p.id,resource:`global:${y}`,resourceId:y,success:!0}),At&&k>0&&await a$6([At],l.fields,t,e,1,k),f.json({data:At,message:"Updated successfully"})}catch(p){return console.error(`[API] Save global "${y}" failed:`,p),f.json({error:p.message||"Save failed",stack:process.env.NODE_ENV==="development"?p.stack:void 0},500)}};_.post(b$1,R),_.patch(b$1,R),_.post(`${b$1}/preview-url`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"read",f.req.raw,p,w);if(!C.allowed)return f.json({error:C.error||"Forbidden"},C.status||403);let v=await f.req.json().catch(()=>({})),k="";s&&(k=await bo({type:"preview",collection:`_globals_${l.slug}`,exp:Math.floor(Date.now()/1e3)+3600},s,"HS256"));let D="";if(l.admin?.preview)D=await l.admin.preview(v,{req:f.req.raw,token:k});else {let O="";try{let N=await t.findOne({collection:"_globals_site-settings",where:{}});N?.siteUrl&&(O=N.siteUrl);}catch{}if(!O)return f.json({error:"No site URL configured in settings, and no custom preview function defined."},400);O=O.replace(/\/$/,""),D=`${O}/?preview=true&kyroToken=${k}`;}return f.json({url:D})}catch(p){return f.json({error:p.message},500)}}),_.post(`${b$1}/publish`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"update",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},403);let v=`_globals_${y}`,k=await t.findOne({collection:v,where:{},tenantId:w,draft:!0});if(!k)return f.json({error:"Global not found"},404);let D={status:"published"},O=k;if(l.versions?.drafts){let B=await t.findVersions({collection:v,documentId:y,limit:1,sort:"-createdAt",tenantId:w});B.docs.length>0&&(O={...k,...B.docs[0].data},D={...B.docs[0].data,...D});}let N=await t.update({collection:v,id:y,data:D,tenantId:w});return l.versions?.drafts&&await t.createVersion({collection:v,documentId:y,data:{...O,status:"published"},status:"published",createdBy:p?.id,changeDescription:"Published",tenantId:w}),f.json({data:N,message:"Published successfully"})}catch(p){return f.json({error:p.message},500)}}),_.post(`${b$1}/unpublish`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"update",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},403);let v=await t.update({collection:`_globals_${y}`,id:y,data:{status:"draft"},tenantId:w});return f.json({data:v,message:"Unpublished successfully"})}catch(p){return f.json({error:p.message},500)}}),_.get(`${b$1}/versions`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"read",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},403);let v=parseInt(f.req.query("limit")||"10"),k=parseInt(f.req.query("page")||"1"),D=await t.findVersions({collection:`_globals_${y}`,documentId:y,limit:v,page:k,tenantId:w});return f.json(D)}catch(p){return f.json({error:p.message},500)}}),_.get(`${b$1}/versions/:versionId`,async f=>{try{let p=f.req.param("versionId"),{user:w,tenantId:C}=await W(f.req.raw,F,i,c),v=await er(l,"read",f.req.raw,w,C,q);if(!v.allowed)return f.json({error:v.error},403);let k=await t.findVersionByID({collection:`_globals_${y}`,versionId:p,tenantId:C});return k?f.json({data:k}):f.json({error:"Version not found"},404)}catch(p){return f.json({error:p.message},500)}}),_.post(`${b$1}/versions/:versionId/restore`,async f=>{try{let p=f.req.param("versionId"),{user:w,tenantId:C}=await W(f.req.raw,F,i,c),v=await er(l,"update",f.req.raw,w,C,q);if(!v.allowed)return f.json({error:v.error},403);let k=`_globals_${y}`,D=await t.findVersionByID({collection:k,versionId:p,tenantId:C});if(!D)return f.json({error:"Version not found"},404);let O=await t.update({collection:k,id:y,data:{...D.data,status:"draft"},tenantId:C});return f.json({data:O,message:"Version restored successfully"})}catch(p){return f.json({error:p.message},500)}}),y==="email-settings"&&_.post(`${b$1}/test`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"update",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},C.status||403);let v=await f.req.json(),k={provider:v.provider,from:v.fromEmail||v.from,fromName:v.fromName,replyTo:v.replyTo,smtp:v.smtp?{host:v.smtp.host,port:v.smtp.port,secure:v.smtp.secure,auth:{user:v.smtp.username||v.smtp.user,pass:v.smtp.password||v.smtp.pass}}:void 0,resend:v.resend,sendgrid:v.sendgrid,mailgun:v.mailgun,ses:v.ses},D=new q$1(k),O=v.email||v.testEmail||v.testEmailSection&&v.testEmailSection.testEmail;if(!O)return f.json({error:"No test recipient email provided"},400);let N=v.provider?v.provider.charAt(0).toUpperCase()+v.provider.slice(1):"SMTP",B=v.fromName?`${v.fromName} <${v.fromEmail||v.from||"default"}>`:v.fromEmail||v.from||"Configured Sender",K=new Date().toUTCString();return await D.send({to:O,subject:"Kyro CMS \u2014 Email Connection Test",html:`<!DOCTYPE html>
|
|
120
|
+
`).map(l=>l.trim()).filter(Boolean):[],He=Dr.length>0?Dr:ds||[];(He.length>0||d)&&_.use("*",async(l,y)=>{let b=l.req.header("Origin")||"*";if(He.length>0&&!He.includes(b))return l.json({error:"Origin not allowed"},403);let R=He.length>0?b:"*";if(l.header("Access-Control-Allow-Origin",R),l.header("Access-Control-Allow-Methods","GET, POST, PATCH, DELETE, OPTIONS"),l.header("Access-Control-Allow-Headers","Content-Type, Authorization, X-API-Key"),d?.credentials&&l.header("Access-Control-Allow-Credentials","true"),l.req.method==="OPTIONS")return l.text("");await y();});let fr=x?.access?.rateLimiting,tr;if(fr?.enabled){let l=fr.maxRequests||100,y=fr.windowMs||6e4;tr=new vo({"api:general":{window:y,max:l}}),_.use("/api/*",async(b,R)=>{if(!tr)return R();let f=b.req.header("CF-Connecting-IP")||b.req.header("X-Forwarded-For")?.split(",")[0]?.trim()||b.req.header("X-Real-IP")||"unknown",p=await tr.check("api:general",f);if(b.header("X-RateLimit-Limit",String(l)),b.header("X-RateLimit-Remaining",String(p.remaining)),b.header("X-RateLimit-Reset",String(p.resetAt)),!p.allowed)return b.json({error:"Too many requests",retryAfter:p.retryAfter},429);await R();});}let we=new So({redis:Z,jwtSecret:s||"change-me",baseUrl:process.env.KYRO_BASE_URL||"http://localhost:4321",rateLimiter:tr});q$1.fromConfig(t).then(l=>{l&&(we.email=l);}).catch(l=>{console.error("[Email] Failed to initialize transport from config:",l);}),_.post("/api/auth/login",async l=>we.login(l.req.raw)),_.post("/api/auth/register",async l=>{try{let y=await t.findOne({collection:"_globals_system",where:{}});if(y&&y.enableRegistration===!1)return l.json({error:"User registration is currently disabled by administrator."},403);if(y?.defaultRegistrationRole){let b=l.req.raw;if((b.headers.get("content-type")||"").includes("application/json")){let f=await l.req.json();f.role||(f.role=y.defaultRegistrationRole);let p=new Request(b.url,{method:b.method,headers:b.headers,body:JSON.stringify(f)});return we.register(p)}}}catch{}return we.register(l.req.raw)}),_.post("/api/auth/logout",async l=>we.logout(l.req.raw)),_.post("/api/auth/refresh",async l=>we.refresh(l.req.raw)),_.get("/api/auth/me",async l=>we.me(l.req.raw)),_.post("/api/auth/forgot-password",async l=>we.forgotPassword(l.req.raw)),_.post("/api/auth/reset-password",async l=>we.resetPassword(l.req.raw)),_.post("/api/auth/change-password",async l=>we.changePassword(l.req.raw)),_.get("/api/auth/verify-email",async l=>we.verifyEmail(l.req.raw)),_.post("/api/auth/verify-email",async l=>we.verifyEmail(l.req.raw)),_.get("/api/auth/verify",async l=>we.verifyEmail(l.req.raw)),_.post("/api/auth/verify",async l=>we.verifyEmail(l.req.raw)),_.post("/api/auth/magic-link",async l=>we.requestMagicLink(l.req.raw)),_.get("/api/auth/magic-link",async l=>we.verifyMagicLink(l.req.raw)),_.post("/api/auth/invite",async l=>we.inviteUser(l.req.raw)),_.get("/api/auth/sessions",async l=>we.listSessions(l.req.raw)),_.post("/api/auth/sessions/refresh",async l=>we.refreshSession(l.req.raw)),_.delete("/api/auth/sessions",async l=>we.revokeOtherSessions(l.req.raw)),_.delete("/api/auth/sessions/:id",async l=>we.revokeSession(l.req.raw,l.req.param("id"))),_.put("/api/auth/sessions/:id/name",async l=>we.renameSession(l.req.raw,l.req.param("id"))),_.get("/api/auth/access",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Not authenticated"},401);let R={},f={};for(let p of e.getCollections()){let w={read:(await De(p,"read",l.req.raw,y,b,void 0,q,H)).allowed,create:(await De(p,"create",l.req.raw,y,b,void 0,q,H)).allowed,update:(await De(p,"update",l.req.raw,y,b,void 0,q,H)).allowed,delete:(await De(p,"delete",l.req.raw,y,b,void 0,q,H)).allowed};R[p.slug]=w;}for(let p of e.getGlobals()){let w={read:(await er(p,"read",l.req.raw,y,b,q)).allowed,update:(await er(p,"update",l.req.raw,y,b,q)).allowed};f[p.slug]=w;}return l.json({collections:R,globals:f})}catch(y){return l.json({error:y.message},500)}});let $t=typeof e.hasCollection=="function"&&e.hasCollection("users")?e.getCollection("users"):(()=>{try{return e.getCollection("users")}catch{return a$4}})();_.get("/api/users",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=await De($t,"read",l.req.raw,y,b,void 0,q,H);if(!R.allowed)return l.json({error:R.error},R.status||403);let f=parseInt(l.req.query("page")||"1"),p=Math.min(parseInt(l.req.query("limit")||"10"),100),w=l.req.query("search")||void 0,C=[],v=0;if(typeof Z.findUsers=="function"){let k=await Z.findUsers({page:f,limit:p,search:w});C=k.users||[],v=k.total||0;}else {let k=await t.find({collection:"users",page:f,limit:p,where:w?{email:{contains:w}}:{},tenantId:b});C=k.docs||[],v=k.totalDocs||0;}return l.json({docs:C,totalDocs:v,limit:p,totalPages:Math.ceil(v/p)||1,page:f,pagingCounter:(f-1)*p+1,hasPrevPage:f>1,hasNextPage:f<Math.ceil(v/p),prevPage:f>1?f-1:null,nextPage:f<Math.ceil(v/p)?f+1:null})}catch(y){return console.error("[API] Error listing users:",y),l.json({error:y.message},500)}}),_.get("/api/users/:id",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=l.req.param("id"),f=await Z.findUserById(R);return f?l.json({data:f}):l.json({error:"User not found"},404)}catch(y){return l.json({error:y.message},500)}}),_.post("/api/users",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=await De($t,"create",l.req.raw,y,b,void 0,q,H);if(!R.allowed)return l.json({error:R.error},R.status||403);let f=await l.req.json();if(!f.email||!f.password)return l.json({error:"Email and password are required"},400);if(await Z.findUserByEmail(f.email))return l.json({error:"Email already in use"},400);let w=f.role||"customer";if(w!=="customer"&&y?.role!=="super_admin")return l.json({error:"Forbidden: Only super_admin can assign administrative roles"},403);let C=await Z.createUser({email:f.email,password:f.password,name:f.name,role:w,avatar:f.avatar,tenantId:f.tenantId});return y&&Z?.createAuditLog({action:"user_create",userId:y.id,resource:"users",resourceId:C.id,success:!0}),l.json({data:C,message:"User created successfully"},201)}catch(y){return l.json({error:y.message},500)}}),_.patch("/api/users/:id",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=await De($t,"update",l.req.raw,y,b,void 0,q,H);if(!R.allowed)return l.json({error:R.error},R.status||403);let f=l.req.param("id"),p=await l.req.json(),w=await Z.findUserById(f);if(!w)return l.json({error:"User not found"},404);let C={};if(p.name!==void 0&&(C.name=p.name),p.email!==void 0&&(C.email=p.email),p.role!==void 0&&p.role!==w.role){if(y?.role!=="super_admin")return l.json({error:"Forbidden: Only super_admin can modify user roles"},403);C.role=p.role;}p.avatar!==void 0&&(C.avatar=typeof p.avatar=="object"&&p.avatar!==null?p.avatar.id||String(p.avatar):p.avatar),p.tenantId!==void 0&&(C.tenantId=p.tenantId),p.emailVerified!==void 0&&(C.emailVerified=p.emailVerified),p.locked!==void 0&&(C.locked=p.locked),p.failedLoginAttempts!==void 0&&(C.failedLoginAttempts=p.failedLoginAttempts),p.lastLogin!==void 0&&(C.lastLogin=p.lastLogin);let v=await Z.updateUser(f,C);return v?(y&&(Z?.createAuditLog({action:"user_update",userId:y.id,resource:"users",resourceId:f,success:!0}),p.role&&w.role!==p.role&&Z?.createAuditLog({action:"role_change",userId:y.id,resource:"users",resourceId:f,success:!0,metadata:{oldRole:w.role,newRole:p.role}})),l.json({data:v,message:"User updated successfully"})):l.json({error:"User update failed"},500)}catch(y){return l.json({error:y.message},500)}}),_.delete("/api/users/:id",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=await De($t,"delete",l.req.raw,y,b,void 0,q,H);if(!R.allowed)return l.json({error:R.error},R.status||403);let f=l.req.param("id");if(y&&y.id===f)return l.json({error:"You cannot delete your own account"},403);let p=await Z.findUserById(f);return p?await Z.deleteUser(f)?(y&&Z?.createAuditLog({action:"user_delete",userId:y.id,resource:"users",resourceId:f,success:!0}),l.json({data:p,message:"User deleted successfully"})):l.json({error:"User deletion failed"},500):l.json({error:"User not found"},404)}catch(y){return l.json({error:y.message},500)}}),_.get("/api/auth/audit-logs",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=e.getCollection("audit_logs");if(R){let D=await De(R,"read",l.req.raw,y,b,void 0,q,H);if(!D.allowed)return l.json({error:D.error},D.status||403)}else if(!y)return l.json({error:"Authentication required"},401);let f=parseInt(l.req.query("page")||"1"),p=Math.min(parseInt(l.req.query("limit")||"50"),100),w=l.req.query("action")||void 0,C=l.req.query("userId")||void 0,v=l.req.query("resource")||void 0,k=await Z.findAuditLogs({action:w,userId:C,resource:v,limit:p,offset:(f-1)*p});return l.json({docs:k.logs,totalDocs:k.total,limit:p,totalPages:Math.ceil(k.total/p),page:f,pagingCounter:(f-1)*p+1,hasPrevPage:f>1,hasNextPage:f<Math.ceil(k.total/p),prevPage:f>1?f-1:null,nextPage:f<Math.ceil(k.total/p)?f+1:null})}catch(y){return console.error("[API] Error listing audit logs:",y),l.json({error:y.message},500)}});let Bt=null,Lr=null,ht=async()=>{if(Lr)throw Lr;if(!Bt)try{let l="sqlite";"dialect"in t&&t.dialect==="postgres"&&t instanceof c$1?l=t.dialect:"dialect"in t&&t.dialect==="mongodb"&&(l="mongodb");let y=l==="postgres"&&t instanceof c$1?t.client:t;Bt=await pc.init(y,{dialect:l});}catch(l){throw console.error("[getMedia] Init error:",l),Lr=l,l}return Bt};_.get("/api/media",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=new URL(l.req.url).origin,f=parseInt(l.req.query("page")||"1"),p=parseInt(l.req.query("limit")||"30"),w=l.req.query("search")||"",C=l.req.query("type")||"",v=l.req.query("folder")||"",k=await b.find({page:f,limit:p,search:w,type:C,folder:v},R);return l.json(k)}catch(y){return console.error("[Media] find error:",y),l.json({error:y.message},500)}}),_.post("/api/media/upload",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.header("content-type")||"",f=new URL(l.req.url).origin;if(R.includes("multipart/form-data")){let k=await l.req.formData(),D=k.get("file"),O=k.get("folder")||"";if(!D)return l.json({error:"No file uploaded"},400);let N=await b.upload(D,O,f);return l.json(N)}let p=await l.req.json(),{url:w}=p,C=p.folder||"";if(!w)return l.json({error:"No URL provided"},400);let v=await b.uploadFromUrl(w,C,f);return l.json(v)}catch(y){return console.error("[Media] upload error:",y),l.json({error:y.message},500)}}),_.get("/api/media/folders",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let R=await(await ht()).listFolders();return l.json(R)}catch(y){return console.error("[Media] folders error:",y),l.json({error:y.message},500)}}),_.post("/api/media/folders",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=await l.req.json(),{name:f,parentPath:p}=R;return f?(await b.createFolder(f,p||""),l.json({message:"Folder created",path:p?`${p}/${f}`:f})):l.json({error:"Folder name is required"},400)}catch(y){return console.error("[Media] create folder error:",y),l.json({error:y.message},500)}}),_.delete("/api/media/folders",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.query("path");return R?(await b.deleteFolder(R),l.json({message:"Folder deleted"})):l.json({error:"Path is required"},400)}catch(y){return console.error("[Media] delete folder error:",y),l.json({error:y.message},500)}}),_.delete("/api/media/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.param("id"),f=new URL(l.req.url).origin;return await b.delete(R,f),l.json({success:!0})}catch(y){return console.error("[Media] delete error:",y),l.json({error:y.message},500)}}),_.get("/api/media/file/:key{.+$}",async l=>{let y=l.req.param("key"),b=globalThis.STORAGE_BUCKET;if(b){let R=await b.get(y);if(!R)return l.notFound();let f=new Headers;return R.writeHttpMetadata(f),f.set("etag",R.httpEtag),new Response(R.body,{headers:f})}return l.notFound()}),_.get("/api/media/resize",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=l.req.query("url"),R=parseInt(l.req.query("w")||"0"),f=parseInt(l.req.query("h")||"0"),p=l.req.query("fit")||"cover",w=parseFloat(l.req.query("cx")||"0"),C=parseFloat(l.req.query("cy")||"0"),v=parseFloat(l.req.query("cw")||"0"),k=parseFloat(l.req.query("ch")||"0");if(!b)return l.json({error:"URL is required"},400);let O=(await ht()).storage;if(O.name!=="local")return l.redirect(b);let N=O.config?.uploadDir||join(process.cwd(),"public","uploads"),B=O.config?.baseUrl||"/uploads";if(!b.startsWith(B))return l.redirect(b);let K=b.replace(B,""),Y=join(N,K);if(!existsSync(Y))return l.json({error:"File not found"},404);let le=readFileSync(Y),{default:J}=await import('sharp'),xe=J(le);if(v>0&&k>0){let Qe=await J(le).metadata(),Zr=Qe.width||0,At=Qe.height||0;if(Zr>0&&At>0){let It=Math.max(0,Math.min(Math.round(w/100*Zr),Zr-1)),Ds=Math.max(0,Math.min(Math.round(C/100*At),At-1)),J_=Math.max(1,Math.min(Math.round(v/100*Zr),Zr-It)),Q_=Math.max(1,Math.min(Math.round(k/100*At),At-Ds));xe=xe.extract({left:It,top:Ds,width:J_,height:Q_});}}(R>0||f>0)&&(xe=xe.resize({width:R>0?R:void 0,height:f>0?f:void 0,fit:p}));let Xe=await xe.toBuffer(),Je=await J(le).metadata();return l.header("Content-Type",`image/${Je.format||"webp"}`),l.header("Cache-Control","public, max-age=31536000, immutable"),l.body(Xe)}catch(y){return console.error("[Media] resize error:",y),l.json({error:y.message},500)}}),_.get("/api/media/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.param("id"),f=new URL(l.req.url).origin,p=await b.findById(R,f);return p?l.json(p):l.json({error:"Media not found"},404)}catch(y){return console.error("[Media] get error:",y),l.json({error:y.message},500)}}),_.patch("/api/media/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.param("id"),f=await l.req.json(),p=new URL(l.req.url).origin,w=["folder","metadata","title","alt","caption","originalName"],C={};for(let v of w)f[v]!==void 0&&(C[v]=f[v]);if(Object.keys(C).length>0){let v=await b.update(R,C,p);return l.json({doc:v})}return l.json({error:"No valid fields to update"},400)}catch(y){return console.error("[Media] update error:",y),l.json({error:y.message},500)}}),_.get("/api/media/test",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht();return l.json({status:b?"initialized":"failed",serviceType:b?.constructor?.name})}catch(y){return console.error("[test] Error:",y),l.json({error:y.message,type:y.constructor?.name,stack:y.stack},500)}}),_.get("/api/storage-status",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=typeof globalThis.STORAGE_BUCKET<"u"||typeof l.env?.STORAGE_BUCKET<"u",R=b,f=b?"cloudflare_r2":"local";if(t)try{let p=t.prepare('SELECT provider FROM "_globals_storage-settings" LIMIT 1').get();p&&p.provider&&(R=!0,f=p.provider==="aws"?"s3":p.provider);}catch{try{let p=await t.findOne({collection:"_globals_storage-settings",where:{},draft:!0});p&&p.provider&&(R=!0,f=p.provider==="aws"?"s3":p.provider);}catch{}}return l.json({provider:f,configured:R,usage:0,limit:"unlimited"})}catch(y){return console.error("[Storage] status error:",y),l.json({error:y.message},500)}}),_.get("/api/plugins",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=e.getPlugins(),R=e.storageProviders,f=await Promise.all(b.map(async p=>{let w=!0,C=p.name,v={};try{let O=await t.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});O&&O.states&&(v=O.states);}catch{}v[C]!==void 0&&(w=v[C]),R.setPluginEnabled(C,w);let k=C.replace(/^@[^/]+\//,"");k=k.replace(/^(plugin|kyro)-/,"");let D={ai:"AI",seo:"SEO",s3:"S3",aws:"AWS",api:"API",ui:"UI",ftp:"FTP"};if(k=k.split("-").map(O=>{let N=O.toLowerCase();return D[N]?D[N]:O.charAt(0).toUpperCase()+O.slice(1)}).join(" "),k.toLowerCase().startsWith("storage ")){let O=k.split(" ");O.length===2&&(k=`${O[1]} Storage`);}return {id:C,name:p.displayName||k,version:p.version||"1.0.0",description:p.description||"",enabled:w,status:w?"active":"disabled"}}));return l.json(f)}catch(y){return console.error("[Plugins] list error:",y),l.json({error:y.message},500)}}),_.put("/api/plugins/:name/toggle",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=l.req.param("name"),R=e.storageProviders,p=!R.isPluginEnabled(b),w=[];if(!p)for(let v of R.getAll())v.pluginName===b&&w.push(v.type);if(!(l.req.query("force")==="1")&&!p&&w.length>0){let v="local";try{let k=t?.prepare?.('SELECT provider FROM "_globals_storage-settings" LIMIT 1')?.get();k?.provider&&(v=k.provider);}catch{try{let k=await t?.findOne?.({collection:"_globals_storage-settings",where:{},draft:!0});k?.provider&&(v=k.provider);}catch{}}if(w.includes(v))return l.json({error:`Cannot disable "${b}" \u2014 storage provider "${v}" is currently active. Switch to Local storage first.`,requiresAction:!0,activeProvider:v},409)}try{let v={},k="global",D=await t.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});D&&(v=D.states||{},k=D.id),v[b]=p,D?await t.update({collection:"_globals_plugin-settings",id:k,data:{states:v}}):await t.create({collection:"_globals_plugin-settings",data:{states:v,id:"global"}});}catch(v){console.warn(`[Plugins] Could not persist state for "${b}":`,v);}return R.setPluginEnabled(b,p),l.json({name:b,enabled:p})}catch(y){return console.error("[Plugins] toggle error:",y),l.json({error:y.message},500)}}),_.get("/api/health",l=>l.json({status:"ok",version:"0.12.57",collections:e.getCollectionSlugs(),timestamp:new Date().toISOString()})),_.get("/api/metrics",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let R=y.role==="admin"||y.role==="super_admin",p=e.getCollectionSlugs().filter(B=>!["users","audit_logs","media","_globals_access-settings","_globals_brand-settings"].includes(B)&&!B.startsWith("_globals_")).filter(B=>R||a$5(y,`${B}:read`)),w=0,C={};await Promise.all(p.map(async B=>{try{let Y=(await t.find({collection:B,where:{},limit:1,page:1,tenantId:b})).totalDocs??0;w+=Y,C[B]=Y;}catch{}}));let v=0;try{v=(await t.find({collection:"media",where:{},limit:1,page:1,tenantId:b})).totalDocs??0;}catch{}let k=0;try{k=(await t.find({collection:"users",where:{},limit:1,page:1,tenantId:b})).totalDocs??0;}catch{}let D=0;try{if(g){let B=await g.getWebhooks();D=Array.isArray(B)?B.length:0;}}catch{}let O=0;try{O=(await t.find({collection:d$1,where:{},limit:1,page:1,tenantId:b})).totalDocs??0;}catch{}let N=w+v+k;return l.json({totalDocuments:w,totalMedia:R||a$5(y,"media:read")?v:void 0,totalUsers:R||a$5(y,"users:read")?k:void 0,totalWebhooks:R?D:void 0,totalApiKeys:R?O:void 0,totalStoredRecords:N,collectionCounts:C,collections:p.length,timestamp:new Date().toISOString()})}catch(y){return console.error("[API] Metrics error:",y),l.json({error:y.message},500)}}),_.get("/api/analytics",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);if(!(y.role==="admin"||y.role==="super_admin"))return l.json({error:"Unauthorized"},403);let p=(await t.find({collection:"orders",where:{},limit:1e3,page:1,tenantId:b})).docs||[],w=await t.findOne({collection:"_globals_store-settings",where:{},tenantId:b}),C=w?.currency?.code||w?.currency||"USD",v={},k={},D={};p.forEach(B=>{let K=B.createdAt||B.updatedAt,Y=K?new Date(K).toISOString().split("T")[0]:new Date().toISOString().split("T")[0];v[Y]||(v[Y]=0),k[Y]||(k[Y]=0);let le=typeof B.total=="number"?B.total:parseFloat(String(B.total||0));v[Y]+=isNaN(le)?0:le,k[Y]+=1;let J=B.orderStatus||B.status||"pending";D[J]=(D[J]||0)+1;});let O=Object.keys(v).sort().map(B=>({date:B,revenue:Math.round(v[B]*100)/100,orders:k[B]})),N=Math.round(O.reduce((B,K)=>B+K.revenue,0)*100)/100;return l.json({chartData:O,totalRevenue:N,totalOrders:p.length,ordersByStatus:D,currencyCode:typeof C=="string"?C:"USD"})}catch(y){return l.json({error:y.message},500)}}),_.get("/api/kyro/schema",async l=>{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=f=>f.map(p=>{let w={name:p.name,type:p.type,label:p.label,required:p.required??false,unique:p.unique??false,indexed:p.indexed??false,defaultValue:p.defaultValue,admin:p.admin?{...p.admin}:void 0};return p.minLength!==void 0&&(w.minLength=p.minLength),p.maxLength!==void 0&&(w.maxLength=p.maxLength),p.pattern!==void 0&&(w.pattern=p.pattern),p.variant!==void 0&&(w.variant=p.variant),p.hasMany!==void 0&&(w.hasMany=p.hasMany),p.min!==void 0&&(w.min=p.min),p.max!==void 0&&(w.max=p.max),p.step!==void 0&&(w.step=p.step),p.integer!==void 0&&(w.integer=p.integer),p.options&&(w.options=p.options),p.relationTo&&(w.relationTo=p.relationTo),p.maxDepth!==void 0&&(w.maxDepth=p.maxDepth),p.minRows!==void 0&&(w.minRows=p.minRows),p.maxRows!==void 0&&(w.maxRows=p.maxRows),p.localized!==void 0&&(w.localized=p.localized),p.language&&(w.language=p.language),p.format&&(w.format=p.format),p.allowedTypes&&(w.allowedTypes=p.allowedTypes),p.maxSize&&(w.maxSize=p.maxSize),(p.type==="group"||p.type==="row"||p.type==="collapsible"&&p.fields)&&(w.fields=b(p.fields)),p.type==="array"&&p.fields&&(w.fields=b(p.fields)),p.type==="blocks"&&p.blocks&&(w.blocks=p.blocks.map(C=>({slug:C.slug,label:C.label,fields:b(C.fields)}))),p.type==="tabs"&&p.tabs&&(w.tabs=p.tabs.map(C=>({label:C.label,name:C.name,fields:b(C.fields)}))),w}),R={collections:{},globals:{}};for(let f of e.getCollections()){let p=f.slug;try{R.collections[p]={slug:p,label:f.label||p,fields:b(f.fields),jsonSchema:Kn(e.getZodSchema(p),{target:"openApi3"}),createSchema:Kn(e.getCreateZodSchema(p),{target:"openApi3"}),updateSchema:Kn(e.getUpdateZodSchema(p),{target:"openApi3"}),procedures:{find:{collection:p,where:"Record<string,any>",sort:"string",limit:"number",page:"number",depth:"number",select:"string[]",draft:"boolean"},findByID:{collection:p,id:"string",depth:"number",select:"string[]",draft:"boolean"},create:{collection:p,data:"Record<string,any>",depth:"number",select:"string[]"},update:{collection:p,id:"string",data:"Record<string,any>",depth:"number",select:"string[]",baseUpdatedAt:"string"},delete:{collection:p,id:"string"},count:{collection:p,where:"Record<string,any>"}}};}catch{}}for(let f of e.getGlobals()){let p=f.slug,w=f.fields;if(p==="storage-settings"){let C=e.storageProviders,v=C.getAll(),k=new Set(C.getAllAvailable(O=>C.isPluginEnabled(O)).map(O=>O.type));k.add("local");let D=new Set(v.map(O=>O.type));w=w.filter(O=>O.type==="group"&&O.name&&D.has(O.name)?k.has(O.name):true).map(O=>O.name==="provider"&&O.type==="select"?{...O,options:O.options.filter(N=>k.has(N.value))}:O);}try{R.globals[p]={slug:p,label:f.label||p,fields:b(w),jsonSchema:Kn(e.getZodSchema(p),{target:"openApi3"}),procedures:{get:{},update:{data:"Record<string,any>"}}};}catch{}}return l.json(R)}),_.get("/api/collections",async l=>{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=e.getCollections().map(R=>({slug:R.slug,label:R.label||R.slug,fields:R.fields.filter(f=>f.name).map(f=>({name:f.name,type:f.type,required:f.required,label:f.label}))}));return l.json(b)});function Vn(l,y,b){if(b in y)return y[b];for(let R of l)if(R.name){if(R.type==="tabs"&&R.tabs){let f=y[R.name];if(f&&typeof f=="object"&&b in f)return f[b]}if((R.type==="group"||R.type==="collapsible")&&R.fields){let f=y[R.name];if(f&&typeof f=="object"){if(b in f)return f[b];let p=Vn(R.fields,f,b);if(p!==void 0)return p}}}}_.get("/api/search",async l=>{try{let y=l.req.query("q")||"",b=l.req.query("collections")||"",R=Math.min(parseInt(l.req.query("limit")||"10"),50);if(!y||y.length<2)return l.json({results:[],message:"Query too short"});let{user:f,tenantId:p}=await W(l.req.raw,F,i,c),w=b?b.split(",").filter(Boolean):e.getCollectionSlugs(),C=[],v=new RegExp(y.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),"i");for(let k of e.getCollections()){if(!w.includes(k.slug)||!(await De(k,"read",l.req.raw,f,p,void 0,q,H)).allowed)continue;let O=k.fields.filter(N=>N.name&&N.name!=="id"&&(N.type==="text"||N.type==="email"||N.type==="textarea"||N.type==="richtext"||N.indexed)&&!N.admin?.hidden).map(N=>N.name);if(O.length!==0)try{let N=O.map(K=>{let Y={};return Y[K]={like:`%${y}%`},Y}),B=await t.find({collection:k.slug,where:{OR:N},limit:R,tenantId:p});await a$6(B.docs,k.fields,t,e,1,0);for(let K of B.docs){let Y=k.admin?.useAsTitle||O.find(J=>J==="title"||J==="name"||J==="heading"||J==="slug"),le=Y?Vn(k.fields,K,Y)??K.id:K.id;C.push({collection:k.slug,label:k.label||k.slug,id:K.id,title:String(le||"Untitled"),doc:K});}}catch(N){console.error(`Search error for ${k.slug}:`,N);}}return C.sort((k,D)=>k.label.localeCompare(D.label)),l.json({results:C})}catch(y){return l.json({error:y.message,results:[]},500)}}),_.get("/api/keys",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);let R=parseInt(l.req.query("page")||"1"),f=Math.min(parseInt(l.req.query("limit")||"50"),100),p=await t.find({collection:d$1,where:{},page:R,limit:f,tenantId:b}),w=(p.docs||[]).map(C=>({id:C.id,name:C.name,keyPrefix:C.keyPrefix,permissions:C.permissions||[],lastUsed:C.lastUsedAt,createdAt:C.createdAt}));return l.json({docs:w,totalDocs:p.totalDocs||w.length,totalPages:p.totalPages||1})}catch(y){return console.error("[ApiKeys] GET error:",y),l.json({error:y.message},500)}}),_.post("/api/keys",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);let b=await l.req.json();if(!b.name||typeof b.name!="string")return l.json({error:"name is required"},400);let R=i$1(),f=await t.create({collection:d$1,data:{userId:y.id,name:b.name,key:R,keyPrefix:j$2(R),permissions:Array.isArray(b.permissions)?b.permissions:["*"],expiresAt:b.expiresAt||null,createdAt:new Date().toISOString()}});return await Z?.createAuditLog({action:"api_key_create",userId:y.id,resource:"api_key",resourceId:f.id,success:!0,metadata:{keyName:b.name}}),l.json({...f,key:R,permissions:Array.isArray(b.permissions)?b.permissions:["*"]},201)}catch(y){return console.error("[ApiKeys] POST error:",y),l.json({error:y.message},500)}}),_.delete("/api/keys/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);let b=l.req.param("id"),R=await t.findByID({collection:d$1,id:b});return R?(await t.delete({collection:d$1,id:b}),await Z?.createAuditLog({action:"api_key_delete",userId:y.id,resource:"api_key",resourceId:b,success:!0,metadata:{keyName:R.name}}),l.json({message:"API key deleted"})):l.json({error:"API key not found"},404)}catch(y){return console.error("[ApiKeys] DELETE error:",y),l.json({error:y.message},500)}}),_.patch("/api/keys/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);let b=l.req.param("id"),R=await l.req.json(),f=await t.findByID({collection:d$1,id:b});if(!f)return l.json({error:"API key not found"},404);let p={};if(typeof R.name=="string"&&R.name.trim()&&(p.name=R.name.trim()),Array.isArray(R.permissions)&&(p.permissions=R.permissions),R.expiresAt!==void 0&&(p.expiresAt=R.expiresAt||null),Object.keys(p).length===0)return l.json({error:"Nothing to update"},400);let w=await t.update({collection:d$1,id:b,data:p});return l.json({...w,keyPrefix:f.keyPrefix})}catch(y){return console.error("[ApiKeys] PATCH error:",y),l.json({error:y.message},500)}}),_.post("/api/keys/:id/rotate",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);let b=l.req.param("id"),R=await t.findByID({collection:d$1,id:b});if(!R)return l.json({error:"API key not found"},404);let f=i$1(),p=await t.update({collection:d$1,id:b,data:{key:f,keyPrefix:j$2(f),lastUsedAt:null}});return await Z?.createAuditLog({action:"api_key_rotate",userId:y.id,resource:"api_key",resourceId:b,success:!0,metadata:{keyName:R.name}}),l.json({...p,key:f,permissions:R.permissions,expiresAt:R.expiresAt})}catch(y){return console.error("[ApiKeys] rotate error:",y),l.json({error:y.message},500)}}),_.get("/api/webhooks/actions",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);let b={generic:{label:"Custom URL",description:"POST to any endpoint with Kyro payload",configFields:[],envVars:[]},"github-push":{label:"GitHub Push",description:"Push an empty commit to simulate a push event",configFields:[{name:"githubOwner",label:"Owner",required:!0,placeholder:"e.g., kyro-dev"},{name:"githubRepo",label:"Repository",required:!0,placeholder:"e.g., my-website"},{name:"githubBranch",label:"Branch",required:!1,placeholder:"main"}],envVars:["GITHUB_TOKEN"]}};return l.json({actions:b})}catch(y){return console.error("[Webhooks] actions error:",y),l.json({error:y.message},500)}}),_.get("/api/webhooks",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=await g.getWebhooks();return l.json({docs:b})}catch(y){return console.error("[Webhooks] GET error:",y),l.json({error:y.message},500)}}),_.post("/api/webhooks",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=await l.req.json(),R=await g.createWebhook(b);return await Z?.createAuditLog({action:"webhook_create",userId:y.id,resource:"webhook",resourceId:R.id,success:!0,metadata:{name:R.name,url:R.url}}),l.json(R,201)}catch(y){return console.error("[Webhooks] POST error:",y),l.json({error:y.message},500)}}),_.get("/api/webhooks/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=await g.getWebhookById(b);return R?l.json(R):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] GET :id error:",y),l.json({error:y.message},500)}}),_.patch("/api/webhooks/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=await l.req.json(),f=await g.updateWebhook(b,R);return f?(await Z?.createAuditLog({action:"webhook_update",userId:y.id,resource:"webhook",resourceId:b,success:!0,metadata:{name:f.name}}),l.json(f)):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] PATCH error:",y),l.json({error:y.message},500)}}),_.delete("/api/webhooks/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=await g.getWebhookById(b);return R?(await g.deleteWebhook(b),await Z?.createAuditLog({action:"webhook_delete",userId:y.id,resource:"webhook",resourceId:b,success:!0,metadata:{name:R.name}}),l.json({message:"Webhook deleted"})):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] DELETE error:",y),l.json({error:y.message},500)}}),_.post("/api/webhooks/:id/test",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=await g.testWebhook(b);return R?l.json(R):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] test error:",y),l.json({error:y.message},500)}}),_.get("/api/webhooks/:id/history",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=Math.min(parseInt(l.req.query("limit")||"50"),100),f=await g.getDeliveryHistory(b,R);return l.json({docs:f})}catch(y){return console.error("[Webhooks] history error:",y),l.json({error:y.message},500)}});function Wn(l){let y={},b=["name","type","required","hasMany","relationTo","options","min","max","minLength","maxLength","defaultValue","label","localized","admin","unique","index","hidden","readOnly","deprecated"];for(let R of b)R in l&&(y[R]=l[R]);return l.fields&&(y.fields=l.fields.map(Wn)),l.tabs&&(y.tabs=l.tabs.map(R=>({label:R.label,name:R.name,fields:R.fields.map(Wn)}))),y}_.get("/api/__schema",async l=>{try{let{user:y,apiKeyContext:b}=await W(l.req.raw,F,i,c);if(!y&&!b)return l.json({error:"Unauthorized"},401);let f=e.getCollections().filter(p=>p.slug!=="users"&&p.slug!=="audit_logs").map(p=>({slug:p.slug,label:p.label,labelPlural:p.labelPlural,singularLabel:p.singularLabel,timestamps:p.timestamps,auth:!!p.auth,tenantScoped:!!p.tenantScoped,upload:p.upload?{staticDir:p.upload.staticDir,imageSizes:p.upload.imageSizes,mimeTypes:p.upload.mimeTypes}:void 0,fields:p.fields.map(Wn)}));return l.json(f)}catch(y){return console.error("[Schema] error:",y),l.json({error:y.message},500)}});let _d=e.getCollections();for(let l of _d){let R=function(f,p){let w=[],C=new Set([...Object.keys(f),...Object.keys(p)]);for(let v of C)v==="id"||v==="createdAt"||v==="updatedAt"||JSON.stringify(f[v])!==JSON.stringify(p[v])&&w.push({field:v,oldValue:v in f?f[v]:void 0,newValue:v in p?p[v]:void 0});return w};let y=l.slug;if(y==="users"||y==="audit_logs")continue;let b=`/api/${y}`;_.post(`${b}/dynamic-options/:fieldName`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"read",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("fieldName"),D=await f.req.json(),{data:O,siblingData:N}=D,B=gs(l.fields,k);if(!B)return f.json({error:"Field not found"},404);if(B.type!=="select")return f.json({error:"Field is not a select field"},400);let K=[];return typeof B.options=="function"?K=await B.options({data:O||{},siblingData:N||{}}):Array.isArray(B.options)&&(K=B.options),f.json({options:K})}catch(p){return f.json({error:p.message},500)}}),_.get(b,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"read",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);w&&t.setTenantContext({tenantId:w,userId:p?.id??"",role:p?.role,isSuperAdmin:p?.role==="super_admin"});let k=new URL(f.req.url),D=parseInt(k.searchParams.get("page")||"1"),O=Math.min(parseInt(k.searchParams.get("limit")||"10"),100),N=k.searchParams.get("sort")||void 0,B=parseInt(k.searchParams.get("depth")||"0"),K=k.searchParams.get("select")?.split(",")||void 0,Y=k.searchParams.get("draft"),le=Y==="true"?!0:Y==="false"?!1:!!p,J={},xe=k.searchParams.get("where");if(xe)try{J=JSON.parse(xe);}catch{return f.json({error:"Invalid JSON in where parameter"},400)}let Xe=await t.find({collection:y,where:J,sort:N,limit:O,page:D,depth:B,tenantId:w,select:K,draft:le});return await a$6(Xe.docs,l.fields,t,e,1,B),f.json(a$7(Xe))}catch(p){return console.error("[API] list error:",p),f.json({error:p.message},500)}}),_.get(`${b}/:id/versions`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"read",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id");if(!k)return f.json({error:"Missing document ID"},400);let D=new URL(f.req.url),O=D.searchParams.get("compareA"),N=D.searchParams.get("compareB");if(wc(Z,C,`${b}/${k}/versions`,"GET",f.req.raw),O&&N){let[le,J]=await Promise.all([t.findVersionByID({collection:y,versionId:O,tenantId:w}),t.findVersionByID({collection:y,versionId:N,tenantId:w})]);if(!le||!J)return f.json({error:"Version not found"},404);let xe=R(le.data,J.data);return f.json({diffs:xe})}let B=parseInt(D.searchParams.get("page")||"1"),K=Math.min(parseInt(D.searchParams.get("limit")||"10"),100),Y=await t.findVersions({collection:y,documentId:k,page:B,limit:K,tenantId:w});return f.json(Y)}catch(p){return console.error("[API] versions error:",p),f.json({error:p.message},500)}}),_.put(`${b}/:id/draft`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id"),D=await f.req.json(),O=bc(D),N=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!N)return f.json({error:"Document not found"},404);let B;D.delta?B={...N,...D.delta}:B=D.data??yd(D);let K=await t.updateLatestVersion({collection:y,documentId:k,data:B,status:"draft",tenantId:w});return p&&Z?.createAuditLog({action:"document_update",userId:p.id,resource:y,resourceId:k,success:!0,metadata:{type:"draft_save"}}),f.json({data:K,message:"Draft saved successfully"})}catch(p){return f.json({error:p.message},500)}}),_.delete(`${b}/:id/draft`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);return v.allowed?(p&&Z?.createAuditLog({action:"document_update",userId:p.id,resource:y,resourceId:f.req.param("id"),success:!0,metadata:{type:"draft_discard"}}),f.json({message:"Draft discarded successfully"})):f.json({error:v.error},v.status||403)}catch(p){return f.json({error:p.message},500)}}),_.get(`${b}/:id`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=new URL(f.req.url),k=v.searchParams.get("draft"),D=v.searchParams.get("kyroToken"),O=!1;if(k==="true"&&D&&s)try{let J=await wo(D,s,"HS256");J&&J.type==="preview"&&J.collection===l.slug&&(O=!0);}catch(J){console.warn("Invalid preview token",J);}if(!O){let J=await De(l,"read",f.req.raw,p,w,C,q,H);if(!J.allowed)return f.json({error:J.error},J.status||403)}let N=f.req.param("id"),B=parseInt(v.searchParams.get("depth")||"0"),K=v.searchParams.get("select")?.split(",")||void 0,Y=k==="true"?!0:k==="false"?!1:!!p,le=await t.findByID({collection:y,id:N,depth:B,tenantId:w,select:K,draft:Y});return !le&&l.fields.some(J=>J.name==="slug")&&(le=await t.findOne({collection:y,where:{slug:N},tenantId:w,draft:Y})),le?(await a$6([le],l.fields,t,e,1,B),f.json({data:a$7(le)})):f.json({error:"Document not found"},404)}catch(p){return f.json({error:p.message},500)}}),_.post(`${b}/preview-url`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await De(l,"read",f.req.raw,p,w);if(!C.allowed)return f.json({error:C.error||"Forbidden"},C.status||403);let v=await f.req.json().catch(()=>({})),k="";s&&(k=await bo({type:"preview",collection:l.slug,id:v.id,exp:Math.floor(Date.now()/1e3)+3600},s,"HS256"));let D="";if(l.admin?.preview){D=await l.admin.preview(v,{req:f.req.raw,token:k});try{let O=new URL(D,"http://localhost");O.searchParams.has("preview")||O.searchParams.set("preview","true"),!O.searchParams.has("kyroToken")&&k&&O.searchParams.set("kyroToken",k),D=D.startsWith("http")?O.toString():`${O.pathname}${O.search}`;}catch{}}else {let O="";try{let B=await t.findOne({collection:"_globals_site-settings",where:{}});B?.siteUrl&&(O=B.siteUrl);}catch{}if(!O)return f.json({error:"No site URL configured in settings, and no custom preview function defined for this collection."},400);O=O.replace(/\/$/,"");let N=v.slug||v.id||"";D=`${O}/${l.slug}/${N}?preview=true&kyroToken=${k}`;}return f.json({url:D})}catch(p){return f.json({error:p.message},500)}}),_.post(b,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"create",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);w&&t.setTenantContext({tenantId:w,userId:p?.id??"",role:p?.role,isSuperAdmin:p?.role==="super_admin"}),wc(Z,C,b,"POST",f.req.raw);let D=await f.req.json();Qr(D,l.fields),Yr(l.fields,D);let O=f.req.raw;if(l.hooks?.beforeValidate)for(let J of l.hooks.beforeValidate){let xe=await J({collection:y,data:D,req:O,user:p,tenantId:w,operation:"create"});xe&&typeof xe=="object"&&!Array.isArray(xe)&&Object.assign(D,xe);}let N=e.getCreateZodSchema(y);try{D=N.parse(D);}catch(J){return f.json({error:`Validation failed: ${sa(J.errors)}`,details:J.errors},400)}l.tenantScoped&&w&&(D.tenantId=w);let B=l.versions?.drafts===!0,K=l.fields.find(J=>J.name==="status"),Y=K?.type==="select"&&Array.isArray(K.options)&&K.options.some(J=>J.value==="published");if(B?D.status="draft":Y&&!D.status&&(D.status="published"),l.hooks?.beforeChange)for(let J of l.hooks.beforeChange){let xe=await J({collection:y,data:D,req:O,user:p,tenantId:w,operation:"create"});xe&&typeof xe=="object"&&!Array.isArray(xe)&&Object.assign(D,xe);}let le=await t.create({collection:y,data:D,tenantId:w});if(B&&await t.createVersion({collection:y,documentId:le.id,data:D,status:"draft",createdBy:p?.id,changeDescription:"Created",tenantId:w}),l.hooks?.afterChange)for(let J of l.hooks.afterChange)await J({collection:y,doc:le,data:D,req:O,user:p,tenantId:w,operation:"create"});return g&&g.trigger(Qa(y,"create"),{collection:y,operation:"create",data:le,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(J=>console.error("[Webhook] Failed to trigger:",J)),p&&Z?.createAuditLog({action:"document_create",userId:p.id,resource:y,resourceId:le.id,success:!0}),f.json({data:le,message:"Created successfully"},201)}catch(p){return p.name==="ZodError"?f.json({error:`Validation failed: ${sa(p.errors)}`,details:p.errors},400):f.json({error:p.message},500)}}),_.patch(`${b}/:id`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id"),D=await f.req.json(),O=bc(D),N=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!N)return f.json({error:"Document not found"},404);if(O&&N.updatedAt&&O!==N.updatedAt)return f.json(xd(O,N),409);let B=Object.fromEntries(Object.entries(yd(D)).filter(([Je,Qe])=>Qe!=="null"&&Qe!==void 0));Qr(B,l.fields),Yr(l.fields,B);let K=f.req.raw;if(l.hooks?.beforeValidate)for(let Je of l.hooks.beforeValidate){let Qe=await Je({collection:y,data:B,originalDoc:N,req:K,user:p,tenantId:w,operation:"update"});Qe&&typeof Qe=="object"&&!Array.isArray(Qe)&&Object.assign(B,Qe);}if(B=e.getUpdateZodSchema(y).parse(B),l.hooks?.beforeChange)for(let Je of l.hooks.beforeChange){let Qe=await Je({collection:y,data:B,originalDoc:N,req:K,user:p,tenantId:w,operation:"update"});Qe&&typeof Qe=="object"&&!Array.isArray(Qe)&&Object.assign(B,Qe);}let le=f.req.header("X-Draft")==="true",J=l.versions?.drafts===!0,xe=f.req.query("autosave")==="true",Xe;if(J&&le)await t.createVersion({collection:y,documentId:k,data:B,status:"draft",autosave:xe,createdBy:p?.id,changeDescription:xe?"Autosave":"Draft saved",tenantId:w});else if(J){let Je=D.status==="draft"?"draft":"published";await t.update({collection:y,id:k,data:{...B,status:Je},tenantId:w}),await t.createVersion({collection:y,documentId:k,data:{...B,status:Je},status:Je,createdBy:p?.id,changeDescription:Je==="published"?"Published":"Unpublished",tenantId:w});}else await t.update({collection:y,id:k,data:B,tenantId:w});if(Xe=await t.findByID({collection:y,id:k,tenantId:w,draft:!0}),l.hooks?.afterChange)for(let Je of l.hooks.afterChange)await Je({collection:y,doc:Xe,data:B,originalDoc:N,req:K,user:p,tenantId:w,operation:"update"});return g&&!xe&&g.trigger(Qa(y,"update"),{collection:y,operation:"update",data:Xe,previousData:N,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(Je=>console.error("[Webhook] Failed to trigger:",Je)),wc(Z,C,`${b}/${k}`,"PATCH",f.req.raw),p&&Z?.createAuditLog({action:"document_update",userId:p.id,resource:y,resourceId:k,success:!0}),f.json({data:Xe,message:J?"Draft saved":"Updated successfully"})}catch(p){return p.name==="ZodError"?(console.error(`[PATCH ${b}/:id] Validation failed:`,p.errors),f.json({error:`Validation failed: ${sa(p.errors)}`,details:p.errors},400)):(console.error(`[PATCH ${b}/:id] ERROR:`,p.message,"CAUSE:",p.cause?.message||p.cause,"QUERY:",p.query),f.json({error:p.message},500))}}),_.delete(`${b}/:id`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"delete",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);w&&t.setTenantContext({tenantId:w,userId:p?.id??"",role:p?.role,isSuperAdmin:p?.role==="super_admin"});let k=f.req.param("id"),D=f.req.raw,O=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!O)return f.json({error:"Document not found"},404);if(l.hooks?.beforeDelete)for(let B of l.hooks.beforeDelete)await B({collection:y,doc:O,req:D,user:p,tenantId:w,operation:"delete"});let N=await t.delete({collection:y,id:k,tenantId:w});if(l.hooks?.afterDelete)for(let B of l.hooks.afterDelete)await B({collection:y,doc:N,originalDoc:O,req:D,user:p,tenantId:w,operation:"delete"});return g&&g.trigger(Qa(y,"delete"),{collection:y,operation:"delete",data:N,previousData:O,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(B=>console.error("[Webhook] Failed to trigger:",B)),wc(Z,C,`${b}/${k}`,"DELETE",f.req.raw),p&&Z?.createAuditLog({action:"document_delete",userId:p.id,resource:y,resourceId:k,success:!0}),f.json({data:N,message:"Deleted successfully"})}catch(p){return console.error(`[DELETE] Error deleting ${y}:`,p),f.json({error:p.message||String(p)},500)}}),_.post(`${b}/:id/duplicate`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"create",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id"),D=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!D)return f.json({error:"Document not found"},404);let{id:O,createdAt:N,updatedAt:B,...K}=D;qs(l.fields,K);let Y=Date.now().toString(36);"slug"in K&&typeof K.slug=="string"&&(K.slug=`${K.slug||"document"}-copy-${Y}`),"title"in K&&typeof K.title=="string"?K.title=`${K.title||"Copy"} (Copy)`:"name"in K&&typeof K.name=="string"&&(K.name=`${K.name||"Copy"} (Copy)`);let le=await t.create({collection:y,data:{...K,status:"draft"},tenantId:w});return f.json({data:le,message:"Document duplicated successfully"})}catch(p){return console.error("[Duplicate] Error:",p),f.json({error:p.message||String(p)},500)}}),_.post(`${b}/:id/versions/:versionId/restore`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id"),D=f.req.param("versionId"),O=await t.findVersionByID({collection:y,versionId:D,tenantId:w});if(!O)return f.json({error:"Version not found"},404);let N=await t.update({collection:y,id:k,data:{...O.data,status:"draft"},tenantId:w});return f.json({data:N,message:"Version restored successfully"})}catch(p){return f.json({error:p.message},500)}}),_.post(`${b}/:id/versions`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=await f.req.json(),{versionId:D,action:O}=k;if(O==="restore"&&D){let N=await t.findVersionByID({collection:y,versionId:D,tenantId:w});if(!N)return f.json({error:"Version not found"},404);let B=await t.update({collection:y,id:f.req.param("id"),data:{...N.data,status:"draft"},tenantId:w});return f.json({data:B,message:"Version restored successfully"})}return f.json({error:"Invalid action"},400)}catch(p){return f.json({error:p.message},500)}}),_.post(`${b}/:id/publish`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);w&&t.setTenantContext({tenantId:w,userId:p?.id??"",role:p?.role,isSuperAdmin:p?.role==="super_admin"});let k=f.req.param("id"),D=await f.req.json().catch(()=>({})),O=bc(D),N=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!N)return f.json({error:"Document not found"},404);if(O&&N.updatedAt&&O!==N.updatedAt)return f.json(xd(O,N),409);let B={status:"published"},K=N;if(l.versions?.drafts){let le=await t.findVersions({collection:y,documentId:k,limit:1,sort:"-createdAt",tenantId:w});if(le.docs.length>0){let J=le.docs[0];K={...N,...J.data},B={...J.data,...B};}}let Y=await t.update({collection:y,id:k,data:B,tenantId:w});return l.versions?.drafts&&await t.createVersion({collection:y,documentId:k,data:{...K,status:"published"},status:"published",createdBy:p?.id,changeDescription:"Published",tenantId:w}),g&&g.trigger(Qa(y,"update"),{collection:y,operation:"update",data:Y,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(le=>console.error("[Webhook] Failed to trigger:",le)),f.json({data:Y,message:"Published successfully"})}catch(p){return f.json({error:p.message},500)}}),_.post(`${b}/:id/unpublish`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id");if(!await t.findByID({collection:y,id:k,tenantId:w,draft:!0}))return f.json({error:"Document not found"},404);let O=await t.update({collection:y,id:k,data:{status:"draft"},tenantId:w});return g&&g.trigger(Qa(y,"update"),{collection:y,operation:"update",data:O,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(N=>console.error("[Webhook] Failed to trigger:",N)),f.json({data:O,message:"Unpublished successfully"})}catch(p){return f.json({error:p.message},500)}});}for(let l of e.getGlobals()){let y=l.slug,b$1=`/api/globals/${y}`;_.post(`${b$1}/dynamic-options/:fieldName`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"read",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},C.status||403);let v=f.req.param("fieldName"),k=await f.req.json(),{data:D,siblingData:O}=k,N=gs(l.fields,v);if(!N)return f.json({error:"Field not found"},404);if(N.type!=="select")return f.json({error:"Field is not a select field"},400);let B=[];return typeof N.options=="function"?B=await N.options({data:D||{},siblingData:O||{}}):Array.isArray(N.options)&&(B=N.options),f.json({options:B})}catch(p){return f.json({error:p.message},500)}}),_.get(b$1,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=new URL(f.req.url),v=C.searchParams.get("kyroToken"),k=C.searchParams.get("draft"),D=!1;if(k==="true"&&v&&s)try{let Y=await wo(v,s,"HS256");Y&&Y.type==="preview"&&Y.collection===`_globals_${l.slug}`&&(D=!0);}catch(Y){console.warn("Invalid preview token",Y);}if(!D){let Y=await er(l,"read",f.req.raw,p,w,q);if(!Y.allowed)return f.json({error:Y.error},Y.status||403)}let O=k==="true"?!0:k==="false"?!1:!!p,N=parseInt(C.searchParams.get("depth")||"0"),K=(await t.find({collection:`_globals_${y}`,where:{},tenantId:w,draft:O,depth:N,limit:1})).docs[0];if(K&&N>0&&await a$6([K],l.fields,t,e,1,N),y==="storage-settings"&&(typeof globalThis.STORAGE_BUCKET<"u"||typeof f.env?.STORAGE_BUCKET<"u")&&(K?K.provider||(K.provider="cloudflare_r2"):K={id:y,provider:"cloudflare_r2"}),y==="system"){let Y=NB.randomBytes(32).toString("hex");K?K.appSecret||(await t.update({collection:`_globals_${y}`,id:y,data:{appSecret:Y},tenantId:w}),K.appSecret=Y):K=await t.create({collection:`_globals_${y}`,data:{id:y,appSecret:Y},tenantId:w});}return f.json({data:K||{}})}catch(p){return f.json({error:p.message},500)}});let R=async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"update",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},C.status||403);let v=new URL(f.req.url),k=parseInt(v.searchParams.get("depth")||"0"),D=await f.req.json(),O=bc(D),N=yd(D),B=Object.fromEntries(Object.entries(N).filter(([It,Ds])=>Ds!==null&&Ds!=="null"&&Ds!==void 0));Qr(B,l.fields),Yr(l.fields,B);let K=e.getUpdateZodSchema(y),Y;try{Y=K.parse(B);}catch(It){return f.json({error:`Validation failed: ${sa(It.errors)}`,details:It.errors},400)}let le=new Set(["id","createdAt","updatedAt","status","baseUpdatedAt","_baseUpdatedAt"]),J=Object.fromEntries(Object.entries(Y).filter(([It])=>!le.has(It))),xe=`_globals_${y}`,Xe=await t.findOne({collection:xe,where:{},tenantId:w,draft:!0});if(Xe&&O&&Xe.updatedAt&&O!==Xe.updatedAt)return f.json(xd(O,Xe),409);let Je=f.req.header("X-Draft")==="true",Qe=l.versions?.drafts===!0,Zr=f.req.query("autosave")==="true",At;if(Qe&&Je)await t.createVersion({collection:xe,documentId:y,data:J,status:"draft",autosave:Zr,createdBy:p?.id,changeDescription:Zr?"Autosave":"Manual save",tenantId:w}),Xe?At=Xe:At=await t.create({collection:xe,data:{...J,id:y,status:"draft"},tenantId:w});else if(Qe&&!Je){let It="published";Xe?At=await t.update({collection:xe,id:y,data:{...J,status:It},tenantId:w}):At=await t.create({collection:xe,data:{...J,id:y,status:It},tenantId:w}),await t.createVersion({collection:xe,documentId:y,data:J,status:It,autosave:!1,createdBy:p?.id,changeDescription:"Published",tenantId:w});}else Xe?At=await t.update({collection:xe,id:y,data:J,tenantId:w}):At=await t.create({collection:xe,data:{...J,id:y},tenantId:w});if(y==="storage-settings"&&(Bt=null,Lr=null),y==="email-settings"){let It=await q$1.fromConfig(t);we.email=It||void 0;}return y==="system"&&await b(),p&&Z?.createAuditLog({action:"settings_change",userId:p.id,resource:`global:${y}`,resourceId:y,success:!0}),At&&k>0&&await a$6([At],l.fields,t,e,1,k),f.json({data:At,message:"Updated successfully"})}catch(p){return console.error(`[API] Save global "${y}" failed:`,p),f.json({error:p.message||"Save failed",stack:process.env.NODE_ENV==="development"?p.stack:void 0},500)}};_.post(b$1,R),_.patch(b$1,R),_.post(`${b$1}/preview-url`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"read",f.req.raw,p,w);if(!C.allowed)return f.json({error:C.error||"Forbidden"},C.status||403);let v=await f.req.json().catch(()=>({})),k="";s&&(k=await bo({type:"preview",collection:`_globals_${l.slug}`,exp:Math.floor(Date.now()/1e3)+3600},s,"HS256"));let D="";if(l.admin?.preview)D=await l.admin.preview(v,{req:f.req.raw,token:k});else {let O="";try{let N=await t.findOne({collection:"_globals_site-settings",where:{}});N?.siteUrl&&(O=N.siteUrl);}catch{}if(!O)return f.json({error:"No site URL configured in settings, and no custom preview function defined."},400);O=O.replace(/\/$/,""),D=`${O}/?preview=true&kyroToken=${k}`;}return f.json({url:D})}catch(p){return f.json({error:p.message},500)}}),_.post(`${b$1}/publish`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"update",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},403);let v=`_globals_${y}`,k=await t.findOne({collection:v,where:{},tenantId:w,draft:!0});if(!k)return f.json({error:"Global not found"},404);let D={status:"published"},O=k;if(l.versions?.drafts){let B=await t.findVersions({collection:v,documentId:y,limit:1,sort:"-createdAt",tenantId:w});B.docs.length>0&&(O={...k,...B.docs[0].data},D={...B.docs[0].data,...D});}let N=await t.update({collection:v,id:y,data:D,tenantId:w});return l.versions?.drafts&&await t.createVersion({collection:v,documentId:y,data:{...O,status:"published"},status:"published",createdBy:p?.id,changeDescription:"Published",tenantId:w}),f.json({data:N,message:"Published successfully"})}catch(p){return f.json({error:p.message},500)}}),_.post(`${b$1}/unpublish`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"update",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},403);let v=await t.update({collection:`_globals_${y}`,id:y,data:{status:"draft"},tenantId:w});return f.json({data:v,message:"Unpublished successfully"})}catch(p){return f.json({error:p.message},500)}}),_.get(`${b$1}/versions`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"read",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},403);let v=parseInt(f.req.query("limit")||"10"),k=parseInt(f.req.query("page")||"1"),D=await t.findVersions({collection:`_globals_${y}`,documentId:y,limit:v,page:k,tenantId:w});return f.json(D)}catch(p){return f.json({error:p.message},500)}}),_.get(`${b$1}/versions/:versionId`,async f=>{try{let p=f.req.param("versionId"),{user:w,tenantId:C}=await W(f.req.raw,F,i,c),v=await er(l,"read",f.req.raw,w,C,q);if(!v.allowed)return f.json({error:v.error},403);let k=await t.findVersionByID({collection:`_globals_${y}`,versionId:p,tenantId:C});return k?f.json({data:k}):f.json({error:"Version not found"},404)}catch(p){return f.json({error:p.message},500)}}),_.post(`${b$1}/versions/:versionId/restore`,async f=>{try{let p=f.req.param("versionId"),{user:w,tenantId:C}=await W(f.req.raw,F,i,c),v=await er(l,"update",f.req.raw,w,C,q);if(!v.allowed)return f.json({error:v.error},403);let k=`_globals_${y}`,D=await t.findVersionByID({collection:k,versionId:p,tenantId:C});if(!D)return f.json({error:"Version not found"},404);let O=await t.update({collection:k,id:y,data:{...D.data,status:"draft"},tenantId:C});return f.json({data:O,message:"Version restored successfully"})}catch(p){return f.json({error:p.message},500)}}),y==="email-settings"&&_.post(`${b$1}/test`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"update",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},C.status||403);let v=await f.req.json(),k={provider:v.provider,from:v.fromEmail||v.from,fromName:v.fromName,replyTo:v.replyTo,smtp:v.smtp?{host:v.smtp.host,port:v.smtp.port,secure:v.smtp.secure,auth:{user:v.smtp.username||v.smtp.user,pass:v.smtp.password||v.smtp.pass}}:void 0,resend:v.resend,sendgrid:v.sendgrid,mailgun:v.mailgun,ses:v.ses},D=new q$1(k),O=v.email||v.testEmail||v.testEmailSection&&v.testEmailSection.testEmail;if(!O)return f.json({error:"No test recipient email provided"},400);let N=v.provider?v.provider.charAt(0).toUpperCase()+v.provider.slice(1):"SMTP",B=v.fromName?`${v.fromName} <${v.fromEmail||v.from||"default"}>`:v.fromEmail||v.from||"Configured Sender",K=new Date().toUTCString();return await D.send({to:O,subject:"Kyro CMS \u2014 Email Connection Test",html:`<!DOCTYPE html>
|
|
121
121
|
<html lang="en">
|
|
122
122
|
<head>
|
|
123
123
|
<meta charset="UTF-8">
|