@kyro-cms/core 0.12.57 → 0.12.60

package/dist/{chunk-5VGYVQPY.js → chunk-T4TSELDS.js}

@@ -1,5 +1,5 @@
-import {r as r$1,p as p$2,q as q$1}from'./chunk-XP56DE7A.js';import {a as a$a}from'./chunk-R25WLKX4.js';import {l,j as j$1,h,t,p as p$1,k,o as o$1,r as r$2,s,b,n as n$2}from'./chunk-6TPICJ2L.js';import {a as a$e,b as b$4,g as g$3}from'./chunk-W45TLOOT.js';import {a as a$d}from'./chunk-IKGVPXMK.js';import {j as j$3,h as h$1,k as k$1,i as i$3,f as f$3,g as g$2,e as e$5}from'./chunk-YUUXFD73.js';import {a as a$3}from'./chunk-LVBHOZZF.js';import {p,q,R,r,n,u as u$1,f,A,m as m$1,c as c$2,N,x as x$1,t as t$1,O,z as z$1,B,C,D,E as E$1,I as I$1,G,i as i$2,a as a$b,Q as Q$1,v as v$1,y,w as w$1,P,T as T$2,j as j$4,U as U$1,k as k$2,F as F$1,h as h$3,o as o$2,s as s$2}from'./chunk-OBYAIJVU.js';import {n as n$1,f as f$1,e as e$1,H,l as l$1,T as T$1,I as I$2,C as C$1,E as E$2,D as D$1,F,G as G$1,h as h$2,R as R$1,S,i as i$4,s as s$1,t as t$2,d as d$4,m as m$2,u as u$3,p as p$3,r as r$3}from'./chunk-JRUQ5ABB.js';import {a as a$4}from'./chunk-CIVA6SKW.js';import {q as q$2,n as n$3}from'./chunk-WPM6LFCY.js';import {c,a as a$c,d as d$2,b as b$2}from'./chunk-U6KFONKM.js';import {x,i,a as a$1,v,w,z as z$2,u as u$2,e as e$4,c as c$4,A as A$1,y as y$1,d as d$3,b as b$3}from'./chunk-TYQYKKWJ.js';import {a as a$2}from'./chunk-L2QXP26Q.js';import {d,a as a$6,b as b$1,c as c$3}from'./chunk-YZEMLLD2.js';import {d as d$1,i as i$1,j as j$2,f as f$2,e as e$3,g as g$1}from'./chunk-RTHJ6SS5.js';import {e as e$2,c as c$1}from'./chunk-KNOFTUQV.js';import {a as a$8}from'./chunk-ZWDBPEXL.js';import {J}from'./chunk-3NSZZCOJ.js';import {a as a$9}from'./chunk-5ZEYOFAK.js';import {a}from'./chunk-7NH7H3WA.js';import {a as a$7}from'./chunk-VVVCCB6R.js';import {a as a$5}from'./chunk-TBHNE4VV.js';import {g,e}from'./chunk-Y2YAKDEQ.js';import NB,{createHash,randomBytes,createHmac}from'crypto';import Co,{join,resolve,basename,extname}from'path';import {existsSync,readFileSync}from'fs';import {mkdir,readdir,stat,rename,unlink,writeFile}from'fs/promises';import Bw from'process';import {Readable}from'stream';if (typeof window === "undefined") { const { createRequire } = await import(/* @vite-ignore */ 'module'); createRequire(import.meta.url); }
-g();g();g();g();g();g();var Tc=(r,e,t)=>(s,n)=>{let a=-1;return i(0);async function i(c){if(c<=a)throw new Error("next() called multiple times");a=c;let d,g=false,x;if(r[c]?(x=r[c][0][0],s.req.routeIndex=c):x=c===r.length&&n||void 0,x)try{d=await x(s,()=>i(c+1));}catch(_){if(_ instanceof Error&&e)s.error=_,d=await e(_,s),g=true;else throw _}else s.finalized===false&&t&&(d=await t(s));return d&&(s.finalized===false||g)&&(s.res=d),s}};g();g();g();g();var am=Symbol();g();g();g();var om=(r,e)=>new Response(r,{headers:{"Content-Type":e.replace(/^[^;]+/,s=>s.toLowerCase())}}).formData();var uo=r=>"headers"in r,cm=async(r,e=Object.create(null))=>{let{all:t=false,dot:s=false}=e,i=(uo(r)?r.headers:r.raw.headers).get("Content-Type")?.split(";")[0].trim().toLowerCase();return i==="multipart/form-data"||i==="application/x-www-form-urlencoded"?tw(r,{all:t,dot:s}):{}};async function tw(r,e){if(!uo(r)&&r.bodyCache.formData)return im(await r.bodyCache.formData,e);let t=uo(r)?r.headers:r.raw.headers,s=await r.arrayBuffer(),n=om(s,t.get("Content-Type")||"");uo(r)||(r.bodyCache.formData=n);let a=await n;return a?im(a,e):{}}function im(r,e){let t=Object.create(null);return r.forEach((s,n)=>{e.all||n.endsWith("[]")?rw(t,n,s):t[n]=s;}),e.dot&&Object.entries(t).forEach(([s,n])=>{s.includes(".")&&(sw(t,s,n),delete t[s]);}),t}var rw=(r,e,t)=>{r[e]!==void 0?Array.isArray(r[e])?r[e].push(t):r[e]=[r[e],t]:e.endsWith("[]")?r[e]=[t]:r[e]=t;},sw=(r,e,t)=>{if(/(?:^|\.)__proto__\./.test(e))return;let s=r,n=e.split(".");n.forEach((a,i)=>{i===n.length-1?s[a]=t:((!s[a]||typeof s[a]!="object"||Array.isArray(s[a])||s[a]instanceof File)&&(s[a]=Object.create(null)),s=s[a]);});};g();var Pc=r=>{let e=r.split("/");return e[0]===""&&e.shift(),e},um=r=>{let{groups:e,path:t}=nw(r),s=Pc(t);return aw(s,e)},nw=r=>{let e=[];return r=r.replace(/\{[^}]+\}/g,(t,s)=>{let n=`@${s}`;return e.push([n,t]),n}),{groups:e,path:r}},aw=(r,e)=>{for(let t=e.length-1;t>=0;t--){let[s]=e[t];for(let n=r.length-1;n>=0;n--)if(r[n].includes(s)){r[n]=r[n].replace(s,e[t][1]);break}}return r},lo={},lm=(r,e)=>{if(r==="*")return "*";let t=r.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(t){let s=`${r}#${e}`;return lo[s]||(t[2]?lo[s]=e&&e[0]!==":"&&e[0]!=="*"?[s,t[1],new RegExp(`^${t[2]}(?=/${e})`)]:[r,t[1],new RegExp(`^${t[2]}$`)]:lo[s]=[r,t[1],true]),lo[s]}return null},Jn=(r,e)=>{try{return e(r)}catch{return r.replace(/(?:%[0-9A-Fa-f]{2})+/g,t=>{try{return e(t)}catch{return t}})}},ow=r=>Jn(r,decodeURI),Ic=r=>{let e=r.url,t=e.indexOf("/",e.indexOf(":")+4),s=t;for(;s<e.length;s++){let n=e.charCodeAt(s);if(n===37){let a=e.indexOf("?",s),i=e.indexOf("#",s),c=a===-1?i===-1?void 0:i:i===-1?a:Math.min(a,i),d=e.slice(t,c);return ow(d.includes("%25")?d.replace(/%25/g,"%2525"):d)}else if(n===63||n===35)break}return e.slice(t,s)};var dm=r=>{let e=Ic(r);return e.length>1&&e.at(-1)==="/"?e.slice(0,-1):e},Jr=(r,e,...t)=>(t.length&&(e=Jr(e,...t)),`${r?.[0]==="/"?"":"/"}${r}${e==="/"?"":`${r?.at(-1)==="/"?"":"/"}${e?.[0]==="/"?e.slice(1):e}`}`),po=r=>{if(r.charCodeAt(r.length-1)!==63||!r.includes(":"))return null;let e=r.split("/"),t=[],s="";return e.forEach(n=>{if(n!==""&&!/\:/.test(n))s+="/"+n;else if(/\:/.test(n))if(/\?/.test(n)){t.length===0&&s===""?t.push("/"):t.push(s);let a=n.replace("?","");s+="/"+a,t.push(s);}else s+="/"+n;}),t.filter((n,a,i)=>i.indexOf(n)===a)},Oc=r=>/[%+]/.test(r)?(r.indexOf("+")!==-1&&(r=r.replace(/\+/g," ")),r.indexOf("%")!==-1?Jn(r,mo):r):r,pm=(r,e,t)=>{let s;if(!t&&e&&!/[%+]/.test(e)){let i=r.indexOf("?",8);if(i===-1)return;for(r.startsWith(e,i+1)||(i=r.indexOf(`&${e}`,i+1));i!==-1;){let c=r.charCodeAt(i+e.length+1);if(c===61){let d=i+e.length+2,g=r.indexOf("&",d);return Oc(r.slice(d,g===-1?void 0:g))}else if(c==38||isNaN(c))return "";i=r.indexOf(`&${e}`,i+1);}if(s=/[%+]/.test(r),!s)return}let n={};s??=/[%+]/.test(r);let a=r.indexOf("?",8);for(;a!==-1;){let i=r.indexOf("&",a+1),c=r.indexOf("=",a);c>i&&i!==-1&&(c=-1);let d=r.slice(a+1,c===-1?i===-1?void 0:i:c);if(s&&(d=Oc(d)),a=i,d==="")continue;let g;c===-1?g="":(g=r.slice(c+1,i===-1?void 0:i),s&&(g=Oc(g))),t?(n[d]&&Array.isArray(n[d])||(n[d]=[]),n[d].push(g)):n[d]??=g;}return e?n[e]:n},mm=pm,fm=(r,e)=>pm(r,e,true),mo=decodeURIComponent;var hm=r=>Jn(r,mo),gm=class{raw;#t;#e;routeIndex=0;path;bodyCache={};constructor(r,e="/",t=[[]]){this.raw=r,this.path=e,this.#e=t,this.#t={};}param(r){return r?this.#r(r):this.#a()}#r(r){let e=this.#e[0][this.routeIndex][1][r],t=this.#n(e);return t&&/\%/.test(t)?hm(t):t}#a(){let r={},e=Object.keys(this.#e[0][this.routeIndex][1]);for(let t of e){let s=this.#n(this.#e[0][this.routeIndex][1][t]);s!==void 0&&(r[t]=/\%/.test(s)?hm(s):s);}return r}#n(r){return this.#e[1]?this.#e[1][r]:r}query(r){return mm(this.url,r)}queries(r){return fm(this.url,r)}header(r){if(r)return this.raw.headers.get(r)??void 0;let e={};return this.raw.headers.forEach((t,s)=>{e[s]=t;}),e}async parseBody(r){return cm(this,r)}#s=r=>{let{bodyCache:e,raw:t}=this,s=e[r];if(s)return s;let n=Object.keys(e)[0];return n?e[n].then(a=>(n==="json"&&(a=JSON.stringify(a)),new Response(a)[r]())):e[r]=t[r]()};json(){return this.#s("text").then(r=>JSON.parse(r))}text(){return this.#s("text")}arrayBuffer(){return this.#s("arrayBuffer")}bytes(){return this.#s("arrayBuffer").then(r=>new Uint8Array(r))}blob(){return this.#s("blob")}formData(){return this.#s("formData")}addValidatedData(r,e){this.#t[r]=e;}valid(r){return this.#t[r]}get url(){return this.raw.url}get method(){return this.raw.method}get[am](){return this.#e}get matchedRoutes(){return this.#e[0].map(([[,r]])=>r)}get routePath(){return this.#e[0].map(([[,r]])=>r)[this.routeIndex].path}};g();var ym={Stringify:1},cw=(r,e)=>{let t=new String(r);return t.isEscaped=true,t.callbacks=e,t};var Dc=async(r,e,t,s,n)=>{typeof r=="object"&&!(r instanceof String)&&(r instanceof Promise||(r=r.toString()),r instanceof Promise&&(r=await r));let a=r.callbacks;if(!a?.length)return Promise.resolve(r);n?n[0]+=r:n=[r];let i=Promise.all(a.map(c=>c({phase:e,buffer:n,context:s}))).then(c=>Promise.all(c.filter(Boolean).map(d=>Dc(d,e,false,s,n))).then(()=>n[0]));return t?cw(await i,a):i};var uw="text/plain; charset=UTF-8",Lc=(r,e)=>({"Content-Type":r,...e}),Qn=(r,e)=>new Response(r,e),$c=class{#t;#e;env={};#r;finalized=false;error;#a;#n;#s;#l;#c;#u;#i;#d;#p;constructor(r,e){this.#t=r,e&&(this.#n=e.executionCtx,this.env=e.env,this.#u=e.notFoundHandler,this.#p=e.path,this.#d=e.matchResult);}get req(){return this.#e??=new gm(this.#t,this.#p,this.#d),this.#e}get event(){if(this.#n&&"respondWith"in this.#n)return this.#n;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#n)return this.#n;throw Error("This context has no ExecutionContext")}get res(){return this.#s||=Qn(null,{headers:this.#i??=new Headers})}set res(r){if(this.#s&&r){r=Qn(r.body,r);for(let[e,t]of this.#s.headers.entries())if(e!=="content-type")if(e==="set-cookie"){let s=this.#s.headers.getSetCookie();r.headers.delete("set-cookie");for(let n of s)r.headers.append("set-cookie",n);}else r.headers.set(e,t);}this.#s=r,this.finalized=true;}render=(...r)=>(this.#c??=e=>this.html(e),this.#c(...r));setLayout=r=>this.#l=r;getLayout=()=>this.#l;setRenderer=r=>{this.#c=r;};header=(r,e,t)=>{this.finalized&&(this.#s=Qn(this.#s.body,this.#s));let s=this.#s?this.#s.headers:this.#i??=new Headers;e===void 0?s.delete(r):t?.append?s.append(r,e):s.set(r,e);};status=r=>{this.#a=r;};set=(r,e)=>{this.#r??=new Map,this.#r.set(r,e);};get=r=>this.#r?this.#r.get(r):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#o(r,e,t){let s=this.#s?new Headers(this.#s.headers):this.#i??new Headers;if(typeof e=="object"&&"headers"in e){let a=e.headers instanceof Headers?e.headers:new Headers(e.headers);for(let[i,c]of a)i.toLowerCase()==="set-cookie"?s.append(i,c):s.set(i,c);}if(t)for(let[a,i]of Object.entries(t))if(typeof i=="string")s.set(a,i);else {s.delete(a);for(let c of i)s.append(a,c);}let n=typeof e=="number"?e:e?.status??this.#a;return Qn(r,{status:n,headers:s})}newResponse=(...r)=>this.#o(...r);body=(r,e,t)=>this.#o(r,e,t);text=(r,e,t)=>!this.#i&&!this.#a&&!e&&!t&&!this.finalized?new Response(r):this.#o(r,e,Lc(uw,t));json=(r,e,t)=>this.#o(JSON.stringify(r),e,Lc("application/json",t));html=(r,e,t)=>{let s=n=>this.#o(n,e,Lc("text/html; charset=UTF-8",t));return typeof r=="object"?Dc(r,ym.Stringify,false,{}).then(s):s(r)};redirect=(r,e)=>{let t=String(r);return this.header("Location",/[^\x00-\xFF]/.test(t)?encodeURI(t):t),this.newResponse(null,e??302)};notFound=()=>(this.#u??=()=>Qn(),this.#u(this))};g();var Le="ALL",xm="all",_m=["get","post","put","delete","options","patch"],fo="Can not add a route since the matcher is already built.",ho=class extends Error{};g();var wm="__COMPOSED_HANDLER";var lw=r=>r.text("404 Not Found",404),bm=(r,e)=>{if("getResponse"in r){let t=r.getResponse();return e.newResponse(t.body,t)}return console.error(r),e.text("Internal Server Error",500)},vm=class Sm{get;post;put;delete;options;patch;all;on;use;router;getPath;_basePath="/";#t="/";routes=[];constructor(e={}){[..._m,xm].forEach(a=>{this[a]=(i,...c)=>(typeof i=="string"?this.#t=i:this.#a(a,this.#t,i),c.forEach(d=>{this.#a(a,this.#t,d);}),this);}),this.on=(a,i,...c)=>{for(let d of [i].flat()){this.#t=d;for(let g of [a].flat())c.map(x=>{this.#a(g.toUpperCase(),this.#t,x);});}return this},this.use=(a,...i)=>(typeof a=="string"?this.#t=a:(this.#t="*",i.unshift(a)),i.forEach(c=>{this.#a(Le,this.#t,c);}),this);let{strict:s,...n}=e;Object.assign(this,n),this.getPath=s??true?e.getPath??Ic:dm;}#e(){let e=new Sm({router:this.router,getPath:this.getPath});return e.errorHandler=this.errorHandler,e.#r=this.#r,e.routes=this.routes,e}#r=lw;errorHandler=bm;route(e,t){let s=this.basePath(e);return t.routes.map(n=>{let a;t.errorHandler===bm?a=n.handler:(a=async(i,c)=>(await Tc([],t.errorHandler)(i,()=>n.handler(i,c))).res,a[wm]=n.handler),s.#a(n.method,n.path,a,n.basePath);}),this}basePath(e){let t=this.#e();return t._basePath=Jr(this._basePath,e),t}onError=e=>(this.errorHandler=e,this);notFound=e=>(this.#r=e,this);mount(e,t,s){let n,a;s&&(typeof s=="function"?a=s:(a=s.optionHandler,s.replaceRequest===false?n=d=>d:n=s.replaceRequest));let i=a?d=>{let g=a(d);return Array.isArray(g)?g:[g]}:d=>{let g;try{g=d.executionCtx;}catch{}return [d.env,g]};n||=(()=>{let d=Jr(this._basePath,e),g=d==="/"?0:d.length;return x=>{let _=new URL(x.url);return _.pathname=this.getPath(x).slice(g)||"/",new Request(_,x)}})();let c=async(d,g)=>{let x=await t(n(d.req.raw),...i(d));if(x)return x;await g();};return this.#a(Le,Jr(e,"*"),c),this}#a(e,t,s,n){e=e.toUpperCase(),t=Jr(this._basePath,t);let a={basePath:n!==void 0?Jr(this._basePath,n):this._basePath,path:t,method:e,handler:s};this.router.add(e,t,[s,a]),this.routes.push(a);}#n(e,t){if(e instanceof Error)return this.errorHandler(e,t);throw e}#s(e,t,s,n){if(n==="HEAD")return (async()=>new Response(null,await this.#s(e,t,s,"GET")))();let a=this.getPath(e,{env:s}),i=this.router.match(n,a),c=new $c(e,{path:a,matchResult:i,env:s,executionCtx:t,notFoundHandler:this.#r});if(i[0].length===1){let g;try{g=i[0][0][0][0](c,async()=>{c.res=await this.#r(c);});}catch(x){return this.#n(x,c)}return g instanceof Promise?g.then(x=>x||(c.finalized?c.res:this.#r(c))).catch(x=>this.#n(x,c)):g??this.#r(c)}let d=Tc(i[0],this.errorHandler,this.#r);return (async()=>{try{let g=await d(c);if(!g.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return g.res}catch(g){return this.#n(g,c)}})()}fetch=(e,...t)=>this.#s(e,t[1],t[0],e.method);request=(e,t,s,n)=>e instanceof Request?this.fetch(t?new Request(e,t):e,s,n):(e=e.toString(),this.fetch(new Request(/^https?:\/\//.test(e)?e:`http://localhost${Jr("/",e)}`,t),s,n));fire=()=>{addEventListener("fetch",e=>{e.respondWith(this.#s(e.request,e,void 0,e.request.method));});}};g();g();g();var go=[];function Bc(r,e){let t=this.buildAllMatchers(),s=((n,a)=>{let i=t[n]||t[Le],c=i[2][a];if(c)return c;let d=a.match(i[0]);if(!d)return [[],go];let g=d.indexOf("",1);return [i[1][g],d]});return this.match=s,s(r,e)}g();var yo="[^/]+",Yn=".*",ea="(?:|/.*)",ps=Symbol(),dw=new Set(".\\+*[^]$()");function pw(r,e){return r.length===1?e.length===1?r<e?-1:1:-1:e.length===1||r===Yn||r===ea?1:e===Yn||e===ea?-1:r===yo?1:e===yo?-1:r.length===e.length?r<e?-1:1:e.length-r.length}var Am=class jc{#t;#e;#r=Object.create(null);insert(e,t,s,n,a){if(e.length===0){if(this.#t!==void 0)throw ps;if(a)return;this.#t=t;return}let[i,...c]=e,d=i==="*"?c.length===0?["","",Yn]:["","",yo]:i==="/*"?["","",ea]:i.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),g;if(d){let x=d[1],_=d[2]||yo;if(x&&d[2]&&(_===".*"||(_=_.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(_))))throw ps;if(g=this.#r[_],!g){if(Object.keys(this.#r).some(P=>P!==Yn&&P!==ea))throw ps;if(a)return;g=this.#r[_]=new jc,x!==""&&(g.#e=n.varIndex++);}!a&&x!==""&&s.push([x,g.#e]);}else if(g=this.#r[i],!g){if(Object.keys(this.#r).some(x=>x.length>1&&x!==Yn&&x!==ea))throw ps;if(a)return;g=this.#r[i]=new jc;}g.insert(c,t,s,n,a);}buildRegExpStr(){let t=Object.keys(this.#r).sort(pw).map(s=>{let n=this.#r[s];return (typeof n.#e=="number"?`(${s})@${n.#e}`:dw.has(s)?`\\${s}`:s)+n.buildRegExpStr()});return typeof this.#t=="number"&&t.unshift(`#${this.#t}`),t.length===0?"":t.length===1?t[0]:"(?:"+t.join("|")+")"}};g();var Rm=class{#t={varIndex:0};#e=new Am;insert(r,e,t){let s=[],n=[];for(let i=0;;){let c=false;if(r=r.replace(/\{[^}]+\}/g,d=>{let g=`@\\${i}`;return n[i]=[g,d],i++,c=true,g}),!c)break}let a=r.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let i=n.length-1;i>=0;i--){let[c]=n[i];for(let d=a.length-1;d>=0;d--)if(a[d].indexOf(c)!==-1){a[d]=a[d].replace(c,n[i][1]);break}}return this.#e.insert(a,e,s,this.#t,t),s}buildRegExp(){let r=this.#e.buildRegExpStr();if(r==="")return [/^$/,[],[]];let e=0,t=[],s=[];return r=r.replace(/#(\d+)|@(\d+)|\.\*\$/g,(n,a,i)=>a!==void 0?(t[++e]=Number(a),"$()"):(i!==void 0&&(s[Number(i)]=++e),"")),[new RegExp(`^${r}`),t,s]}};var mw=[/^$/,[],Object.create(null)],km=Object.create(null);function Cm(r){return km[r]??=new RegExp(r==="*"?"":`^${r.replace(/\/\*$|([.\\+*[^\]$()])/g,(e,t)=>t?`\\${t}`:"(?:|/.*)")}$`)}function fw(){km=Object.create(null);}function hw(r){let e=new Rm,t=[];if(r.length===0)return mw;let s=r.map(g=>[!/\*|\/:/.test(g[0]),...g]).sort(([g,x],[_,P])=>g?1:_?-1:x.length-P.length),n=Object.create(null);for(let g=0,x=-1,_=s.length;g<_;g++){let[P,G,q]=s[g];P?n[G]=[q.map(([ue])=>[ue,Object.create(null)]),go]:x++;let H;try{H=e.insert(G,x,P);}catch(ue){throw ue===ps?new ho(G):ue}P||(t[x]=q.map(([ue,se])=>{let Pe=Object.create(null);for(se-=1;se>=0;se--){let[Z,St]=H[se];Pe[Z]=St;}return [ue,Pe]}));}let[a,i,c]=e.buildRegExp();for(let g=0,x=t.length;g<x;g++)for(let _=0,P=t[g].length;_<P;_++){let G=t[g][_]?.[1];if(!G)continue;let q=Object.keys(G);for(let H=0,ue=q.length;H<ue;H++)G[q[H]]=c[G[q[H]]];}let d=[];for(let g in i)d[g]=t[i[g]];return [a,d,n]}function Ms(r,e){if(r){for(let t of Object.keys(r).sort((s,n)=>n.length-s.length))if(Cm(t).test(e))return [...r[t]]}}var xo=class{name="RegExpRouter";#t;#e;constructor(){this.#t={[Le]:Object.create(null)},this.#e={[Le]:Object.create(null)};}add(r,e,t){let s=this.#t,n=this.#e;if(!s||!n)throw new Error(fo);s[r]||[s,n].forEach(c=>{c[r]=Object.create(null),Object.keys(c[Le]).forEach(d=>{c[r][d]=[...c[Le][d]];});}),e==="/*"&&(e="*");let a=(e.match(/\/:/g)||[]).length;if(/\*$/.test(e)){let c=Cm(e);r===Le?Object.keys(s).forEach(d=>{s[d][e]||=Ms(s[d],e)||Ms(s[Le],e)||[];}):s[r][e]||=Ms(s[r],e)||Ms(s[Le],e)||[],Object.keys(s).forEach(d=>{(r===Le||r===d)&&Object.keys(s[d]).forEach(g=>{c.test(g)&&s[d][g].push([t,a]);});}),Object.keys(n).forEach(d=>{(r===Le||r===d)&&Object.keys(n[d]).forEach(g=>c.test(g)&&n[d][g].push([t,a]));});return}let i=po(e)||[e];for(let c=0,d=i.length;c<d;c++){let g=i[c];Object.keys(n).forEach(x=>{(r===Le||r===x)&&(n[x][g]||=[...Ms(s[x],g)||Ms(s[Le],g)||[]],n[x][g].push([t,a-d+c+1]));});}}match=Bc;buildAllMatchers(){let r=Object.create(null);return Object.keys(this.#e).concat(Object.keys(this.#t)).forEach(e=>{r[e]||=this.#r(e);}),this.#t=this.#e=void 0,fw(),r}#r(r){let e=[],t=r===Le;return [this.#t,this.#e].forEach(s=>{let n=s[r]?Object.keys(s[r]).map(a=>[a,s[r][a]]):[];n.length!==0?(t||=true,e.push(...n)):r!==Le&&e.push(...Object.keys(s[Le]).map(a=>[a,s[Le][a]]));}),t?hw(e):null}};g();g();g();var Nc=class{name="SmartRouter";#t=[];#e=[];constructor(r){this.#t=r.routers;}add(r,e,t){if(!this.#e)throw new Error(fo);this.#e.push([r,e,t]);}match(r,e){if(!this.#e)throw new Error("Fatal error");let t=this.#t,s=this.#e,n=t.length,a=0,i;for(;a<n;a++){let c=t[a];try{for(let d=0,g=s.length;d<g;d++)c.add(...s[d]);i=c.match(r,e);}catch(d){if(d instanceof ho)continue;throw d}this.match=c.match.bind(c),this.#t=[c],this.#e=void 0;break}if(a===n)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,i}get activeRouter(){if(this.#e||this.#t.length!==1)throw new Error("No active router has been determined yet.");return this.#t[0]}};g();g();g();var ta=Object.create(null),gw=r=>{for(let e in r)return  true;return  false},Em=class Tm{#t;#e;#r;#a=0;#n=ta;constructor(e,t,s){if(this.#e=s||Object.create(null),this.#t=[],e&&t){let n=Object.create(null);n[e]={handler:t,possibleKeys:[],score:0},this.#t=[n];}this.#r=[];}insert(e,t,s){this.#a=++this.#a;let n=this,a=um(t),i=[];for(let c=0,d=a.length;c<d;c++){let g=a[c],x=a[c+1],_=lm(g,x),P=Array.isArray(_)?_[0]:g;if(P in n.#e){n=n.#e[P],_&&i.push(_[1]);continue}n.#e[P]=new Tm,_&&(n.#r.push(_),i.push(_[1])),n=n.#e[P];}return n.#t.push({[e]:{handler:s,possibleKeys:i.filter((c,d,g)=>g.indexOf(c)===d),score:this.#a}}),n}#s(e,t,s,n,a){for(let i=0,c=t.#t.length;i<c;i++){let d=t.#t[i],g=d[s]||d[Le],x={};if(g!==void 0&&(g.params=Object.create(null),e.push(g),n!==ta||a&&a!==ta))for(let _=0,P=g.possibleKeys.length;_<P;_++){let G=g.possibleKeys[_],q=x[g.score];g.params[G]=a?.[G]&&!q?a[G]:n[G]??a?.[G],x[g.score]=true;}}}search(e,t){let s=[];this.#n=ta;let a=[this],i=Pc(t),c=[],d=i.length,g=null;for(let x=0;x<d;x++){let _=i[x],P=x===d-1,G=[];for(let H=0,ue=a.length;H<ue;H++){let se=a[H],Pe=se.#e[_];Pe&&(Pe.#n=se.#n,P?(Pe.#e["*"]&&this.#s(s,Pe.#e["*"],e,se.#n),this.#s(s,Pe,e,se.#n)):G.push(Pe));for(let Z=0,St=se.#r.length;Z<St;Z++){let Ze=se.#r[Z],F=se.#n===ta?{}:{...se.#n};if(Ze==="*"){let mr=se.#e["*"];mr&&(this.#s(s,mr,e,se.#n),mr.#n=F,G.push(mr));continue}let[Lt,ds,Dr]=Ze;if(!_&&!(Dr instanceof RegExp))continue;let He=se.#e[Lt];if(Dr instanceof RegExp){if(g===null){g=new Array(d);let tr=t[0]==="/"?1:0;for(let we=0;we<d;we++)g[we]=tr,tr+=i[we].length+1;}let mr=t.substring(g[x]),fr=Dr.exec(mr);if(fr){if(F[ds]=fr[0],this.#s(s,He,e,se.#n,F),fr[0].length===mr.length&&He.#e["*"]&&this.#s(s,He.#e["*"],e,se.#n,F),gw(He.#e)){He.#n=F;let tr=fr[0].match(/\//)?.length??0;(c[tr]||=[]).push(He);}continue}}(Dr===true||Dr.test(_))&&(F[ds]=_,P?(this.#s(s,He,e,F,se.#n),He.#e["*"]&&this.#s(s,He.#e["*"],e,F,se.#n)):(He.#n=F,G.push(He)));}}let q=c.shift();a=q?G.concat(q):G;}return s.length>1&&s.sort((x,_)=>x.score-_.score),[s.map(({handler:x,params:_})=>[x,_])]}};var Mc=class{name="TrieRouter";#t;constructor(){this.#t=new Em;}add(r,e,t){let s=po(e);if(s){for(let n=0,a=s.length;n<a;n++)this.#t.insert(r,s[n],t);return}this.#t.insert(r,e,t);}match(r,e){return this.#t.search(r,e)}};var Uc=class extends vm{constructor(r={}){super(r),this.router=r.router??new Nc({routers:[new xo,new Mc]});}};g();g();g();g();g();g();g();var qc=r=>Hc(r.replace(/_|-/g,e=>({_:"/","-":"+"})[e]??e)),Fc=r=>yw(r).replace(/\/|\+/g,e=>({"/":"_","+":"-"})[e]??e),yw=r=>{let e="",t=new Uint8Array(r);for(let s=0,n=t.length;s<n;s++)e+=String.fromCharCode(t[s]);return btoa(e)},Hc=r=>{let e=atob(r),t=new Uint8Array(new ArrayBuffer(e.length)),s=e.length/2;for(let n=0,a=e.length-1;n<=s;n++,a--)t[n]=e.charCodeAt(n),t[a]=e.charCodeAt(a);return t};g();var ms=(r=>(r.HS256="HS256",r.HS384="HS384",r.HS512="HS512",r.RS256="RS256",r.RS384="RS384",r.RS512="RS512",r.PS256="PS256",r.PS384="PS384",r.PS512="PS512",r.ES256="ES256",r.ES384="ES384",r.ES512="ES512",r.EdDSA="EdDSA",r))(ms||{});g();g();var xw={deno:"Deno",bun:"Bun",workerd:"Cloudflare-Workers",node:"Node.js"},Om=()=>{let r=globalThis;if(typeof navigator<"u"&&typeof navigator.userAgent=="string"){for(let[t,s]of Object.entries(xw))if(_w(s))return t}return typeof r?.EdgeRuntime=="string"?"edge-light":r?.fastly!==void 0?"fastly":r?.process?.release?.name==="node"?"node":"other"},_w=r=>navigator.userAgent.startsWith(r);g();var Pm=class extends Error{constructor(r){super(`${r} is not an implemented algorithm`),this.name="JwtAlgorithmNotImplemented";}},Gc=class extends Error{constructor(){super('JWT verification requires "alg" option to be specified'),this.name="JwtAlgorithmRequired";}},zc=class extends Error{constructor(r,e){super(`JWT algorithm mismatch: expected "${r}", got "${e}"`),this.name="JwtAlgorithmMismatch";}},fs=class extends Error{constructor(r){super(`invalid JWT token: ${r}`),this.name="JwtTokenInvalid";}},Im=class extends Error{constructor(r){super(`token (${r}) is being used before it's valid`),this.name="JwtTokenNotBefore";}},Dm=class extends Error{constructor(r){super(`token (${r}) expired`),this.name="JwtTokenExpired";}},Lm=class extends Error{constructor(r,e){super(`Invalid "iat" claim, must be a valid number lower than "${r}" (iat: "${e}")`),this.name="JwtTokenIssuedAt";}},_o=class extends Error{constructor(r,e){super(`expected issuer "${r}", got ${e?`"${e}"`:"none"} `),this.name="JwtTokenIssuer";}},Kc=class extends Error{constructor(r){super(`jwt header is invalid: ${JSON.stringify(r)}`),this.name="JwtHeaderInvalid";}},Nm=class extends Error{constructor(r){super(`token(${r}) signature mismatched`),this.name="JwtTokenSignatureMismatched";}},Mm=class extends Error{constructor(r){super(`required "aud" in jwt payload: ${JSON.stringify(r)}`),this.name="JwtPayloadRequiresAud";}},Um=class extends Error{constructor(r,e){super(`expected audience "${Array.isArray(r)?r.join(", "):r}", got "${e}"`),this.name="JwtTokenAudience";}},Us=(r=>(r.Encrypt="encrypt",r.Decrypt="decrypt",r.Sign="sign",r.Verify="verify",r.DeriveKey="deriveKey",r.DeriveBits="deriveBits",r.WrapKey="wrapKey",r.UnwrapKey="unwrapKey",r))(Us||{});g();var hs=new TextEncoder,qm=new TextDecoder;async function Hm(r,e,t){let s=zm(e),n=await ww(r,s);return await crypto.subtle.sign(s,n,t)}async function Gm(r,e,t,s){let n=zm(e),a=await bw(r,n);return await crypto.subtle.verify(n,a,t,s)}function Vc(r){return Hc(r.replace(/-+(BEGIN|END).*?-+/g,"").replace(/\s/g,""))}async function ww(r,e){if(!crypto.subtle||!crypto.subtle.importKey)throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");if(Km(r)){if(r.type!=="private"&&r.type!=="secret")throw new Error(`unexpected key type: CryptoKey.type is ${r.type}, expected private or secret`);return r}let t=[Us.Sign];return typeof r=="object"?await crypto.subtle.importKey("jwk",r,e,false,t):r.includes("PRIVATE")?await crypto.subtle.importKey("pkcs8",Vc(r),e,false,t):await crypto.subtle.importKey("raw",hs.encode(r),e,false,t)}async function bw(r,e){if(!crypto.subtle||!crypto.subtle.importKey)throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");if(Km(r)){if(r.type==="public"||r.type==="secret")return r;r=await Fm(r);}if(typeof r=="string"&&r.includes("PRIVATE")){let s=await crypto.subtle.importKey("pkcs8",Vc(r),e,true,[Us.Sign]);r=await Fm(s);}let t=[Us.Verify];return typeof r=="object"?await crypto.subtle.importKey("jwk",r,e,false,t):r.includes("PUBLIC")?await crypto.subtle.importKey("spki",Vc(r),e,false,t):await crypto.subtle.importKey("raw",hs.encode(r),e,false,t)}async function Fm(r){if(r.type!=="private")throw new Error(`unexpected key type: ${r.type}`);if(!r.extractable)throw new Error("unexpected private key is unextractable");let e=await crypto.subtle.exportKey("jwk",r),{kty:t}=e,{alg:s,e:n,n:a}=e,{crv:i,x:c,y:d}=e;return {kty:t,alg:s,e:n,n:a,crv:i,x:c,y:d,key_ops:[Us.Verify]}}function zm(r){switch(r){case "HS256":return {name:"HMAC",hash:{name:"SHA-256"}};case "HS384":return {name:"HMAC",hash:{name:"SHA-384"}};case "HS512":return {name:"HMAC",hash:{name:"SHA-512"}};case "RS256":return {name:"RSASSA-PKCS1-v1_5",hash:{name:"SHA-256"}};case "RS384":return {name:"RSASSA-PKCS1-v1_5",hash:{name:"SHA-384"}};case "RS512":return {name:"RSASSA-PKCS1-v1_5",hash:{name:"SHA-512"}};case "PS256":return {name:"RSA-PSS",hash:{name:"SHA-256"},saltLength:32};case "PS384":return {name:"RSA-PSS",hash:{name:"SHA-384"},saltLength:48};case "PS512":return {name:"RSA-PSS",hash:{name:"SHA-512"},saltLength:64};case "ES256":return {name:"ECDSA",hash:{name:"SHA-256"},namedCurve:"P-256"};case "ES384":return {name:"ECDSA",hash:{name:"SHA-384"},namedCurve:"P-384"};case "ES512":return {name:"ECDSA",hash:{name:"SHA-512"},namedCurve:"P-521"};case "EdDSA":return {name:"Ed25519",namedCurve:"Ed25519"};default:throw new Pm(r)}}function Km(r){return Om()==="node"&&crypto.webcrypto?r instanceof crypto.webcrypto.CryptoKey:r instanceof CryptoKey}var Wc=r=>Fc(hs.encode(JSON.stringify(r)).buffer).replace(/=/g,""),vw=r=>Fc(r).replace(/=/g,""),Zc=r=>JSON.parse(qm.decode(qc(r)));function Vm(r){if(typeof r=="object"&&r!==null){let e=r;return "alg"in e&&Object.values(ms).includes(e.alg)&&(!("typ"in e)||e.typ==="JWT")}return  false}var Wm=async(r,e,t="HS256")=>{let s=Wc(r),n;typeof e=="object"&&"alg"in e?(t=e.alg,n=Wc({alg:t,typ:"JWT",kid:e.kid})):n=Wc({alg:t,typ:"JWT"});let a=`${n}.${s}`,i=await Hm(e,t,hs.encode(a)),c=vw(i);return `${a}.${c}`},Xc=async(r,e,t)=>{if(!t)throw new Gc;let{alg:s,iss:n,nbf:a=true,exp:i=true,iat:c=true,aud:d}=typeof t=="string"?{alg:t}:t;if(!s)throw new Gc;let g=r.split(".");if(g.length!==3)throw new fs(r);let{header:x,payload:_}=Jc(r);if(!Vm(x))throw new Kc(x);if(x.alg!==s)throw new zc(s,x.alg);let P=Math.floor(Date.now()/1e3);if(a&&_.nbf!==void 0&&(typeof _.nbf!="number"||!Number.isFinite(_.nbf)||_.nbf>P))throw new Im(r);if(i&&_.exp!==void 0&&(typeof _.exp!="number"||!Number.isFinite(_.exp)||_.exp<=P))throw new Dm(r);if(c&&_.iat!==void 0&&(typeof _.iat!="number"||!Number.isFinite(_.iat)||P<_.iat))throw new Lm(P,_.iat);if(n){if(!_.iss)throw new _o(n,null);if(typeof n=="string"&&_.iss!==n)throw new _o(n,_.iss);if(n instanceof RegExp&&!n.test(_.iss))throw new _o(n,_.iss)}if(d){if(!_.aud)throw new Mm(_);if(!(Array.isArray(_.aud)?_.aud:[_.aud]).some(se=>d instanceof RegExp?d.test(se):typeof d=="string"?se===d:Array.isArray(d)&&d.includes(se)))throw new Um(d,_.aud)}let G=r.substring(0,r.lastIndexOf("."));if(!await Gm(e,s,qc(g[2]),hs.encode(G)))throw new Nm(r);return _};[ms.HS256,ms.HS384,ms.HS512];var Jc=r=>{let e=r.split(".");if(e.length!==3)throw new fs(r);try{let t=Zc(e[0]),s=Zc(e[1]);return {header:t,payload:s}}catch{throw new fs(r)}};var ra={sign:Wm,verify:Xc};var wo=ra.verify,bo=ra.sign;g();function gs(r,e){for(let t of r){if(t.name===e)return t;if(t.type==="group"||t.type==="array"){let s=gs(t.fields||[],e);if(s)return s}if(t.type==="blocks")for(let s of t.blocks||[]){let n=gs(s.fields||[],e);if(n)return n}if(t.type==="tabs")for(let s of t.tabs||[]){let n=gs(s.fields||[],e);if(n)return n}if(t.type==="collapsible"||t.type==="row"){let s=gs(t.fields||[],e);if(s)return s}}return null}function sa(r){return r.map(e=>`${e.path.join(".")}: ${e.message}`).join(", ")}function Qr(r,e){if(!(!r||typeof r!="object"))for(let t of e){if(t.type==="tabs"&&Array.isArray(t.tabs)){let n=t.name?r[t.name]:r;if(n&&typeof n=="object")for(let a of t.tabs)Array.isArray(a.fields)&&Qr(n,a.fields);continue}if(!t.name||!(t.name in r))continue;if(r[t.name]===""&&(t.type==="text"||t.type==="textarea"||t.type==="code"||t.type==="markdown"||(r[t.name]=null)),(t.type==="group"||t.type==="collapsible")&&t.name&&Array.isArray(t.fields)&&r[t.name]&&typeof r[t.name]=="object")Qr(r[t.name],t.fields);else if(t.type==="array"&&t.name&&Array.isArray(t.fields)&&Array.isArray(r[t.name]))for(let n of r[t.name])n&&typeof n=="object"&&Qr(n,t.fields);else if(t.type==="blocks"&&t.name&&Array.isArray(t.blocks)&&Array.isArray(r[t.name]))for(let n of r[t.name]){if(!n||typeof n!="object")continue;let a=n.type||n.blockType;if(!a)continue;let i=t.blocks.find(d=>d.slug===a);if(!i||!Array.isArray(i.fields))continue;let c=n.data&&typeof n.data=="object"?n.data:n;Qr(c,i.fields);}}}function Yr(r,e){if(!(!e||typeof e!="object"))for(let t of r){if(t.type==="tabs"&&Array.isArray(t.tabs)){let s=t.name?e[t.name]:e;if(s&&typeof s=="object")for(let n of t.tabs)Array.isArray(n.fields)&&Yr(n.fields,s);}if(t.type==="richtext"&&t.name){let s=e[t.name];typeof s=="string"?e[t.name]=[{type:"paragraph",children:[{text:s}]}]:s&&typeof s=="object"&&!Array.isArray(s)&&s.type==="doc"&&Array.isArray(s.content)&&(e[t.name]=s.content);}if((t.type==="group"||t.type==="collapsible")&&t.name&&Array.isArray(t.fields)&&e[t.name]&&typeof e[t.name]=="object")Yr(t.fields,e[t.name]);else if(t.type==="array"&&t.name&&Array.isArray(t.fields)&&Array.isArray(e[t.name]))for(let s of e[t.name])s&&typeof s=="object"&&Yr(t.fields,s);else if(t.type==="blocks"&&t.name&&Array.isArray(t.blocks)&&Array.isArray(e[t.name]))for(let s of e[t.name]){if(!s||typeof s!="object")continue;let n=s.type||s.blockType;if(!n)continue;let a=t.blocks.find(c=>c.slug===n);if(!a||!Array.isArray(a.fields))continue;let i=s.data&&typeof s.data=="object"?s.data:s;Yr(a.fields,i);}}}function qs(r,e){if(!(!e||typeof e!="object")){for(let t of r)if(!(!t.name||!(t.name in e))){if(t.unique&&(t.type==="text"||t.type==="email"?e[t.name]=`${e[t.name]||t.name}-copy-${Date.now().toString(36)}`:delete e[t.name]),t.type==="tabs"&&t.name&&Array.isArray(t.tabs)&&e[t.name]&&typeof e[t.name]=="object")for(let s of t.tabs)Array.isArray(s.fields)&&qs(s.fields,e[t.name]);else if((t.type==="group"||t.type==="collapsible")&&t.name&&Array.isArray(t.fields)&&e[t.name]&&typeof e[t.name]=="object")qs(t.fields,e[t.name]);else if(t.type==="array"&&t.name&&Array.isArray(t.fields)&&Array.isArray(e[t.name]))for(let s of e[t.name])s&&typeof s=="object"&&(delete s.id,qs(t.fields,s));else if(t.type==="blocks"&&t.name&&Array.isArray(t.blocks)&&Array.isArray(e[t.name]))for(let s of e[t.name]){if(!s||typeof s!="object")continue;delete s.id;let n=s.type||s.blockType;if(!n)continue;let a=t.blocks.find(c=>c.slug===n);if(!a||!Array.isArray(a.fields))continue;let i=s.data&&typeof s.data=="object"?s.data:s;qs(a.fields,i);}}}}g();function Jm(r){let{db:t$1,userLookup:s}=r;return async function(a){let i=f$2(a);if(i&&t$1){let d=await e$3(i,t$1,s);if(d.valid&&d.user)return {user:d.user,tenantContext:Xm(d.user),apiKeyContext:g$1(d),status:200,authType:"apikey"};if(d.error)return {status:401,error:d.error}}let c=h(a);if(c)try{let d=await n$2(c);if(!d.valid)return {status:401,error:d.reason||"Session invalid"};let g=await t(a);if(g){let x=s?await s(g.userId):null;if(x)return {user:x,tenantContext:Xm(x),status:200,authType:"session"}}}catch(d){console.error("Session validation error:",d);}return {status:401,error:"Authentication required"}}}function Xm(r){return {tenantId:r.tenantId||"default",userId:r.id||"anonymous",role:r.role||"guest",roles:[r.role||"guest"],permissions:[],isSuperAdmin:r.role==="super_admin"}}g();var vo=class{storage=new Map;userStorage=new Map;limits;userLimits;constructor(e,t){this.limits={...Cw,...e},this.userLimits=t||{"user:api":{window:6e4,max:500},"user:write":{window:36e5,max:100}};}getKey(e,t){return `${e}:${t}`}getUserKey(e,t,s){return `user:${e}:${t}:${s}`}cleanupOldEntries(e,t){let n=Date.now()-t;for(;e.length>0&&e[0].timestamp<n;)e.shift();}async check(e,t){let s=this.limits[e]||this.limits["api:general"],n=this.getKey(e,t),a=this.storage.get(n);a||(a=[],this.storage.set(n,a)),this.cleanupOldEntries(a,s.window);let i=Date.now(),c=a.reduce((d,g)=>d+g.count,0);if(a.push({timestamp:i,count:1}),c>=s.max){let g=a.reduce((x,_)=>x.timestamp<_.timestamp?x:_,a[0]).timestamp+s.window;return {allowed:false,remaining:0,resetAt:g,retryAfter:Math.ceil((g-i)/1e3)}}return {allowed:true,remaining:s.max-c-1,resetAt:i+s.window}}async checkUser(e,t,s){let n=this.userLimits[e]||this.userLimits["user:api"],a=this.userStorage.get(t),i=[];a?i=a.get(this.getKey(e,s))||[]:(this.userStorage.has(t)||this.userStorage.set(t,new Map),this.userStorage.get(t).set(this.getKey(e,s),i)),this.cleanupOldEntries(i,n.window);let c=Date.now(),d=i.reduce((g,x)=>g+x.count,0);if(i.push({timestamp:c,count:1}),d>=n.max){let x=i.reduce((_,P)=>_.timestamp<P.timestamp?_:P,i[0]).timestamp+n.window;return {allowed:false,remaining:0,resetAt:x,retryAfter:Math.ceil((x-c)/1e3)}}return {allowed:true,remaining:n.max-d-1,resetAt:c+n.window}}async reset(e,t){let s=this.getKey(e,t);this.storage.delete(s);}async resetUser(e,t,s){let n=this.userStorage.get(t);if(n){let a=this.getKey(e,s);n.delete(a);}}async getStatus(e,t){let s=this.limits[e]||this.limits["api:general"],n=this.getKey(e,t),a=this.storage.get(n);a||(a=[],this.storage.set(n,a)),this.cleanupOldEntries(a,s.window);let i=Date.now(),c=a.reduce((d,g)=>d+g.count,0);return {count:c,limit:s.max,remaining:Math.max(0,s.max-c),resetAt:i+s.window}}setLimit(e,t){this.limits[e]=t;}setUserLimit(e,t){this.userLimits[e]=t;}},Cw={"auth:login":{window:9e5,max:5},"auth:register":{window:36e5,max:3},"auth:forgot":{window:36e5,max:3},"auth:reset":{window:36e5,max:5},"auth:verify":{window:36e5,max:5},"api:general":{window:6e4,max:100},"api:authenticated":{window:6e4,max:200}};g();g();g();g();var Qc={retentionDays:30};var Qm=class{redis;prefix;retentionDays;constructor(e,t=30,s="kyro:audit:"){this.redis=e,this.prefix=s,this.retentionDays=t;}async log(e){let t=randomBytes(16).toString("hex"),s=new Date,n={...e,id:t,timestamp:s},a=this.getKeyForDate(s),i=`${this.prefix}log:${t}`;await this.redis.hset(i,this.serializeLog(n)),await this.redis.expire(i,this.retentionDays*24*60*60+3600),await this.redis.zadd(a,s.getTime(),t),await this.redis.expire(a,this.retentionDays*24*60*60+3600);let c=e.userId?`${this.prefix}user:${e.userId}`:null;return c&&(await this.redis.zadd(c,s.getTime(),t),await this.redis.expire(c,this.retentionDays*24*60*60+3600)),t}async get(e){let t=`${this.prefix}log:${e}`,s=await this.redis.hgetall(t);return !s||Object.keys(s).length===0?null:this.deserializeLog(s)}async query(e={}){let{limit:t=50,offset:s=0}=e,n=[];if(e.userId)n.push(`${this.prefix}user:${e.userId}`);else if(e.startDate||e.endDate)n=this.getKeysForDateRange(e.startDate,e.endDate);else {let d=new Date;n=this.getKeysForDateRange(new Date(d.getTime()-this.retentionDays*24*60*60*1e3),d);}let a=[];for(let d of n){let g=await this.redis.zrange(d,0,-1,"WITHSCORES");for(let x=0;x<g.length;x+=2)a.push([g[x],parseInt(g[x+1],10)]);}a.sort((d,g)=>g[1]-d[1]);let i=a.length;a=a.slice(s,s+t);let c=[];for(let[d]of a){let g=await this.get(d);g&&this.matchesFilter(g,e)&&c.push(g);}return {logs:c,total:i}}async getRecent(e=50){let t=[],s=new Date,n=this.getKeysForDateRange(new Date(s.getTime()-10080*60*1e3),s),a=[];for(let i of n){let c=await this.redis.zrange(i,0,-1,"WITHSCORES");for(let d=0;d<c.length;d+=2)a.push([c[d],parseInt(c[d+1],10)]);}a.sort((i,c)=>c[1]-i[1]);for(let[i]of a.slice(0,e)){let c=await this.get(i);c&&t.push(c);}return t}async getUserActivity(e,t=50){let s=`${this.prefix}user:${e}`,n=await this.redis.zrange(s,0,t-1),a=[];for(let i of n){let c=await this.get(i);c&&a.push(c);}return a}async getStats(e,t){let s=this.getKeysForDateRange(e||new Date(Date.now()-2592e6),t||new Date),n={},a=0,i=0,c=0,d=new Set;for(let g of s){let x=await this.redis.zrange(g,0,-1);for(let _ of x){let P=await this.get(_);P&&(a++,n[P.action]=(n[P.action]||0)+1,P.success&&c++,P.action==="login_failed"&&i++,P.userId&&d.add(P.userId));}}return {totalEvents:a,byAction:n,successRate:a>0?c/a:1,failedLogins:i,uniqueUsers:d}}async cleanup(){let e=Date.now()-this.retentionDays*24*60*60*1e3,t=await this.redis.keys(`${this.prefix}date:*`),s=0;for(let n of t){let a=await this.redis.zrangebyscore(n,0,e);for(let i of a)await this.redis.del(`${this.prefix}log:${i}`),s++;await this.redis.zremrangebyscore(n,0,e);}return s}getKeyForDate(e){let t=e.getFullYear(),s=String(e.getMonth()+1).padStart(2,"0"),n=String(e.getDate()).padStart(2,"0");return `${this.prefix}date:${t}-${s}-${n}`}getKeysForDateRange(e,t){let s=[],n=e||new Date(Date.now()-this.retentionDays*24*60*60*1e3),a=t||new Date,i=new Date(n);for(;i<=a;)s.push(this.getKeyForDate(i)),i.setDate(i.getDate()+1);return s}matchesFilter(e,t){return !(t.action&&!(Array.isArray(t.action)?t.action:[t.action]).includes(e.action)||t.resource&&e.resource!==t.resource||t.resourceId&&e.resourceId!==t.resourceId||t.success!==void 0&&e.success!==t.success)}serializeLog(e){let t={id:e.id,timestamp:new Date(e.timestamp).toISOString(),action:e.action,resource:e.resource,success:e.success?"1":"0"};return e.userId&&(t.userId=e.userId),e.userEmail&&(t.userEmail=e.userEmail),e.role&&(t.role=e.role),e.resourceId&&(t.resourceId=e.resourceId),e.ipAddress&&(t.ipAddress=e.ipAddress),e.userAgent&&(t.userAgent=e.userAgent),e.error&&(t.error=e.error),e.changes&&(t.changes=JSON.stringify(e.changes)),e.metadata&&(t.metadata=JSON.stringify(e.metadata)),t}deserializeLog(e){return {id:e.id,timestamp:new Date(e.timestamp),action:e.action,userId:e.userId,userEmail:e.userEmail,role:e.role,resource:e.resource,resourceId:e.resourceId,ipAddress:e.ipAddress,userAgent:e.userAgent,success:e.success==="1",error:e.error,changes:e.changes?JSON.parse(e.changes):void 0,metadata:e.metadata?JSON.parse(e.metadata):void 0}}};function cU(r){return {ipAddress:r.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||r.headers.get("x-real-ip")||"unknown",userAgent:r.headers.get("user-agent")||"unknown"}}var Ym=class{logs=[];retentionDays;constructor(e=Qc.retentionDays){this.retentionDays=e;}async log(e){let t=randomBytes(16).toString("hex"),n={...e,id:t,timestamp:new Date};return this.logs.push(n),this.cleanupOldLogs(),t}async get(e){return this.logs.find(t=>t.id===e)||null}async query(e={}){let{limit:t=50,offset:s=0}=e,n=[...this.logs];if(e.userId&&(n=n.filter(g=>g.userId===e.userId)),e.action){let g=Array.isArray(e.action)?e.action:[e.action];n=n.filter(x=>g.includes(x.action));}e.resource&&(n=n.filter(g=>g.resource===e.resource)),e.resourceId&&(n=n.filter(g=>g.resourceId===e.resourceId)),e.success!==void 0&&(n=n.filter(g=>g.success===e.success));let a=e.startDate,i=e.endDate;a!==void 0&&(n=n.filter(g=>g.timestamp>=a)),i!==void 0&&(n=n.filter(g=>g.timestamp<=i)),n.sort((g,x)=>x.timestamp.getTime()-g.timestamp.getTime());let c=n.length;return {logs:n.slice(s,s+t),total:c}}async getRecent(e=50){let t=new Date(Date.now()-6048e5);return this.logs.filter(n=>n.timestamp>=t).sort((n,a)=>a.timestamp.getTime()-n.timestamp.getTime()).slice(0,e)}async getUserActivity(e,t=50){return this.logs.filter(n=>n.userId===e).sort((n,a)=>a.timestamp.getTime()-n.timestamp.getTime()).slice(0,t)}async getStats(e,t){let s=e||new Date(Date.now()-2592e6),n=t||new Date,a=this.logs.filter(_=>_.timestamp>=s&&_.timestamp<=n),i={},c=0,d=0,g=0,x=new Set;for(let _ of a){c++;let P=_.action;i[P]=(i[P]||0)+1,_.success&&g++,_.action==="login_failed"&&d++,_.userId&&x.add(_.userId);}return {totalEvents:c,byAction:i,successRate:c>0?g/c:1,failedLogins:d,uniqueUsers:x}}async cleanup(){let e=new Date(Date.now()-this.retentionDays*24*60*60*1e3),t=this.logs.length;return this.logs=this.logs.filter(s=>s.timestamp>=e),t-this.logs.length}cleanupOldLogs(){let e=new Date(Date.now()-this.retentionDays*24*60*60*1e3);this.logs.length;this.logs=this.logs.filter(s=>s.timestamp>=e);}};var So=class{authAdapter;email;passwordPolicy;lockout;rateLimiter;auditLogger;baseUrl;emailVerificationRequired;jwtSecret;constructor(e){this.authAdapter=e.redis,this.email=e.email,this.passwordPolicy=e.passwordPolicy||new r$1,this.lockout=e.lockout,this.rateLimiter=e.rateLimiter,this.auditLogger=e.auditLogger,this.baseUrl=e.baseUrl||"http://localhost:4321",this.emailVerificationRequired=e.emailVerificationRequired??true,this.jwtSecret=e.jwtSecret||"kyro-default-secret-key-change-me-in-production";}getBaseUrl(e){if(e)try{let t=e.headers.get("x-forwarded-proto")||(e.url.startsWith("https")?"https":"http"),s=e.headers.get("x-forwarded-host")||e.headers.get("host");return s?`${t}://${s}`:new URL(e.url).origin}catch{}return process.env.KYRO_BASE_URL||process.env.SERVER_URL||process.env.PUBLIC_URL||process.env.SITE_URL||this.baseUrl||"http://localhost:4321"}async register(e){let{ipAddress:t,userAgent:s}=a$2(e);if(this.rateLimiter){let n=await this.rateLimiter.check("auth:register",t);if(!n.allowed)return this.rateLimitResponse(n)}try{let n=await e.json();if(!n.email||!n.password)return this.errorResponse("Email and password are required",400);if(n.password!==n.confirmPassword)return this.errorResponse("Passwords do not match",400);let a=this.passwordPolicy.validate(n.password);if(!a.valid)return this.errorResponse(a.errors.join(". "),400);let i=await this.authAdapter.findUserByEmail(n.email);if(i){if(!i.emailVerified&&this.emailVerificationRequired&&this.email){let g=(await this.authAdapter.createEmailVerificationToken?.(i.id))?.token||randomBytes(32).toString("hex"),_=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${g}`,P=this.email.getTemplates().verifyEmail(_,n.email);return await this.email.send({to:n.email,...P}),this.jsonResponse({success:!0,message:"An unverified account already exists with this email. We have resent the confirmation link to your inbox.",requiresVerification:!0},200)}return this.errorResponse("Email already registered",400)}let c=await this.authAdapter.createUser({email:n.email,password:n.password,role:n.role||"customer",tenantId:n.tenantId});if(this.emailVerificationRequired&&this.email){let d=randomBytes(32).toString("hex"),x=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${d}`;await this.authAdapter.createSession(c.id,{ipAddress:t,userAgent:s});let _=this.email.getTemplates().verifyEmail(x,n.email);await this.email.send({to:n.email,..._});}return this.auditLogger&&await this.auditLogger.log({action:"register",userId:c.id,userEmail:c.email,resource:"auth",ipAddress:t,userAgent:s,success:!0}),this.jsonResponse({success:!0,message:"Registration successful",user:this.sanitizeUser(c),requiresVerification:this.emailVerificationRequired&&!!this.email},201)}catch(n){return console.error("[AuthRoutes.register] Registration error:",n),this.errorResponse("Registration failed",500)}}async login(e){let{ipAddress:t,userAgent:s}=a$2(e);if(this.rateLimiter){let n=await this.rateLimiter.check("auth:login",t);if(!n.allowed)return this.rateLimitResponse(n)}try{let n=await e.json();if(!n.email||!n.password)return this.errorResponse("Email and password are required",400);let a=await this.authAdapter.findUserByEmail(n.email);if(!a)return await this.recordFailedLogin(t,s),this.errorResponse("Invalid credentials",401);if(a.locked)return this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:a.id,userEmail:a.email,resource:"auth",ipAddress:t,userAgent:s,success:!1,error:"Account locked"}),this.errorResponse("Account locked. Contact an administrator.",403);if(this.lockout){let x=await this.lockout.checkLockout(a.id);if(x.locked)return this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:a.id,userEmail:a.email,resource:"auth",ipAddress:t,userAgent:s,success:!1,error:"Account locked"}),this.errorResponse(`Account locked. Try again in ${Math.ceil((x.lockedUntil.getTime()-Date.now())/6e4)} minutes`,423)}let i=await this.authAdapter.verifyPassword(n.email,n.password);if(!i)return await this.recordFailedLogin(t,s,a.id,a.email),this.errorResponse("Invalid credentials",401);if(this.emailVerificationRequired&&i.emailVerified===!1){if(this.email){let _=(await this.authAdapter.createEmailVerificationToken?.(i.id))?.token||randomBytes(32).toString("hex"),G=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${_}`,q=this.email.getTemplates().verifyEmail(G,i.email);await this.email.send({to:i.email,...q});}return this.errorResponse("Your email address is not verified yet. We have sent a new confirmation link to your email inbox.",403)}this.lockout&&await this.lockout.resetAttempts(a.id),this.auditLogger&&await this.auditLogger.log({action:"login",userId:a.id,userEmail:a.email,role:a.role,resource:"auth",ipAddress:t,userAgent:s,success:!0}),await this.authAdapter.updateUser(a.id,{lastLogin:new Date().toISOString()});let c=await l({id:a.id,email:a.email,role:a.role,tenantId:a.tenantId});if(this.email&&a.email){let x=new Date().toLocaleString(),_=this.email.getTemplates().newLogin(t,x,a.email);this.email.send({to:a.email,..._}).catch(P=>console.error("Failed to send newLogin email:",P));}let d={success:!0,user:this.sanitizeUser(a)},g=this.jsonResponse(d);return j$1(g,c)}catch(n){return console.error("[Auth] Login error:",n),this.errorResponse("Login failed",500)}}async logout(e){let t$1=h(e);if(!t$1)return this.errorResponse("No session to logout",401);let{ipAddress:s,userAgent:n}=a$2(e);try{let a=await t(e);a&&(await p$1(t$1),this.auditLogger&&await this.auditLogger.log({action:"logout",userId:a.userId,userEmail:a.email,resource:"auth",ipAddress:s,userAgent:n,success:!0}));let i=this.jsonResponse({success:!0,message:"Logged out successfully"});return k(i)}catch{return this.errorResponse("Logout failed",500)}}async refresh(e){try{let t=h(e);if(!t)return this.errorResponse("Not authenticated",401);let s=await o$1(t,e);return s?this.jsonResponse({success:!0,expiresAt:s.expiresAt}):this.errorResponse("Session not found",404)}catch(t){return console.error("[Auth] Session refresh error:",t),this.errorResponse("Session refresh failed",500)}}async me(e){let t$1=await t(e);return t$1?this.jsonResponse({success:true,user:{id:t$1.userId,email:t$1.email,role:t$1.role,tenantId:t$1.tenantId}}):this.errorResponse("Not authenticated",401)}async changePassword(e){let t$1=await t(e);if(!t$1)return this.errorResponse("Not authenticated",401);let{ipAddress:s,userAgent:n}=a$2(e);try{let a=await e.json(),{currentPassword:i,newPassword:c,confirmPassword:d}=a;if(!i||!c)return this.errorResponse("Current and new password required",400);if(c!==d)return this.errorResponse("Passwords do not match",400);let g=this.passwordPolicy.validate(c);if(!g.valid)return this.errorResponse(g.errors.join(". "),400);let x=await this.authAdapter.findUserById(t$1.userId);if(!x)return this.errorResponse("User not found",404);if(!(x.passwordHash?await this.authAdapter.verifyPassword(i,x.passwordHash):!1))return this.errorResponse("Current password is incorrect",401);let P=await this.authAdapter.getPasswordHistory?.(x.id,5);if(await this.authAdapter.isPasswordInHistory?.(c,x.id,5))return this.errorResponse("Password was recently used. Please choose a different password",400);let q=await this.authAdapter.hashPassword(c);if(x.passwordHash&&await this.authAdapter.addPasswordToHistory?.(x.id,x.passwordHash),await this.authAdapter.updateUser(x.id,{passwordHash:q}),await this.authAdapter.deleteUserSessions(x.id),this.email&&this.email.getTemplates){let H=this.email.getTemplates().passwordChanged(x.email);await this.email.send({to:x.email,...H});}return this.auditLogger&&await this.auditLogger.log({action:"password_change",userId:x.id,userEmail:x.email,resource:"auth",ipAddress:s,userAgent:n,success:!0}),this.jsonResponse({success:!0,message:"Password changed successfully"})}catch{return this.errorResponse("Password change failed",500)}}async forgotPassword(e){let{ipAddress:t,userAgent:s}=a$2(e);if(this.rateLimiter){let n=await this.rateLimiter.check("auth:forgot",t);if(!n.allowed)return this.rateLimitResponse(n)}try{let n=await e.json(),{email:a}=n;if(!a)return this.errorResponse("Email required",400);let i=await this.authAdapter.findUserByEmail(a);if(!i)return this.jsonResponse({success:!0,message:"If the email exists, a reset link has been sent"});if(this.email){let c=randomBytes(32).toString("hex");if(this.authAdapter.createPasswordResetToken){let _=await this.authAdapter.createPasswordResetToken(i.email);_.token&&(c=_.token);}let g=`${this.getBaseUrl(e)}/admin/auth/reset-password?token=${c}`,x=this.email.getTemplates().resetPassword(g,i.email);await this.email.send({to:i.email,...x});}return this.auditLogger&&await this.auditLogger.log({action:"password_reset",userId:i.id,userEmail:i.email,resource:"auth",ipAddress:t,userAgent:s,success:!0}),this.jsonResponse({success:!0,message:"If the email exists, a reset link has been sent"})}catch{return this.errorResponse("Password reset request failed",500)}}async resetPassword(e){let{ipAddress:t,userAgent:s}=a$2(e);if(this.rateLimiter){let n=await this.rateLimiter.check("auth:reset",t);if(!n.allowed)return this.rateLimitResponse(n)}try{let n=await e.json(),{token:a,newPassword:i,confirmPassword:c}=n;if(!a||!i)return this.errorResponse("Reset token and new password are required",400);if(i!==c)return this.errorResponse("Passwords do not match",400);let d=this.passwordPolicy.validate(i);if(!d.valid)return this.errorResponse(d.errors.join(". "),400);if(this.authAdapter.resetPasswordWithToken){let g=await this.authAdapter.resetPasswordWithToken(a,i);if(!g.success)return this.errorResponse(g.error||"Password reset failed or token expired",400)}return this.jsonResponse({success:!0,message:"Password reset successful. You can now log in with your new password."})}catch(n){return console.error("[AuthRoutes.resetPassword] Error:",n),this.errorResponse("Password reset failed",500)}}async verifyEmail(e){let s=new URL(e.url).searchParams.get("token");if(!s)return this.errorResponse("Verification token required",400);try{if(this.authAdapter.verifyEmailToken){let n=await this.authAdapter.verifyEmailToken(s);if(!n.success)return this.errorResponse(n.error||"Invalid or expired verification token",400);if(n.userId&&this.email){let a=await this.authAdapter.findUserById(n.userId);if(a){let i=this.email.getTemplates().welcome(a.email);await this.email.send({to:a.email,...i});}}}return this.jsonResponse({success:!0,message:"Email address verified successfully"})}catch(n){return console.error("[AuthRoutes.verifyEmail] Error:",n),this.errorResponse("Email verification failed",500)}}async recordFailedLogin(e,t,s,n){if(this.lockout){let a=await this.lockout.recordFailedAttempt(s||e);if(a.locked&&a.totalAttempts===this.lockout.getConfig().maxAttempts&&this.email&&n){let i=Math.ceil(this.lockout.getConfig().lockDuration/6e4),c=this.email.getTemplates().accountLocked(a.totalAttempts,i,n);this.email.send({to:n,...c}).catch(d=>console.error("Failed to send accountLocked email:",d));}}this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:s,userEmail:n,resource:"auth",ipAddress:e,userAgent:t,success:false,error:"Invalid credentials"});}sanitizeUser(e){let{passwordHash:t,...s}=e;return s}jsonResponse(e,t=200){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":"application/json","Cache-Control":"no-store, no-cache, must-revalidate, max-age=0"}})}async listSessions(e){let t$1=await t(e);if(!t$1)return this.errorResponse("Not authenticated",401);try{let s=await r$2(t$1.userId,h(e)??void 0);return this.jsonResponse({sessions:s})}catch(s){return console.error("[AuthRoutes.listSessions] Error:",s),this.errorResponse("Failed to list sessions",500)}}async revokeSession(e,t$1){let s=await t(e);if(!s)return this.errorResponse("Not authenticated",401);try{let a=(await r$2(s.userId)).find(i=>i.id===t$1);return a?a.currentSession?this.errorResponse("Cannot revoke current session",400):(await p$1(t$1),this.jsonResponse({success:!0,message:"Session revoked"})):this.errorResponse("Session not found",404)}catch(n){return console.error("[AuthRoutes.revokeSession] Error:",n),this.errorResponse("Failed to revoke session",500)}}async revokeOtherSessions(e){let t$1=await t(e);if(!t$1)return this.errorResponse("Not authenticated",401);try{let s=await r$2(t$1.userId),n=h(e);for(let a of s)a.currentSession||await p$1(a.id);return this.jsonResponse({success:!0,message:"Other sessions revoked"})}catch(s){return console.error("[AuthRoutes.revokeOtherSessions] Error:",s),this.errorResponse("Failed to revoke sessions",500)}}async renameSession(e,t$1){let s$1=await t(e);if(!s$1)return this.errorResponse("Not authenticated",401);try{if(!(await r$2(s$1.userId)).find(d=>d.id===t$1))return this.errorResponse("Session not found",404);let i=await e.json(),{name:c}=i;return !c||typeof c!="string"||c.trim().length===0?this.errorResponse("Invalid session name",400):(await s(t$1,c.trim()),this.jsonResponse({success:!0,message:"Session renamed"}))}catch(n){return console.error("[AuthRoutes.renameSession] Error:",n),this.errorResponse("Failed to rename session",500)}}async refreshSession(e){let t=h(e);if(!t)return this.errorResponse("No session",401);try{let{refreshSession:s}=await import('./auth-session-O7IIH7EP.js'),n=await s(t,e);return n?this.jsonResponse({success:!0,expiresAt:n.expiresAt}):this.errorResponse("Session not found",404)}catch(s){return console.error("[AuthRoutes.refreshSession] Error:",s),this.errorResponse("Failed to refresh session",500)}}errorResponse(e,t){return new Response(JSON.stringify({success:false,error:e}),{status:t,headers:{"Content-Type":"application/json"}})}async rateLimitResponse(e){return new Response(JSON.stringify({error:"Too many requests. Please try again later."}),{status:429,headers:{"Content-Type":"application/json",...e.retryAfter?{"Retry-After":e.retryAfter.toString()}:{}}})}async requestMagicLink(e){let{ipAddress:t,userAgent:s}=a$2(e);try{let n=await e.json();if(!n.email)return this.errorResponse("Email required",400);let a=await this.authAdapter.findUserByEmail(n.email);if(!a)return this.jsonResponse({success:!0,message:"If an account exists, a link was sent."});if(this.email){let i=Buffer.from(JSON.stringify({email:a.email,exp:Date.now()+6e5})).toString("base64url"),c=createHmac("sha256",this.jwtSecret).update(i).digest("hex"),d=`${i}.${c}`,x=`${this.getBaseUrl(e)}/admin/auth/magic-link?token=${d}`,_=this.email.getTemplates().magicLink(x,void 0,a.email);this.email.send({to:a.email,..._}).catch(P=>console.error("Magic link err:",P));}return this.jsonResponse({success:!0,message:"If an account exists, a link was sent."})}catch{return this.errorResponse("Failed to process request",500)}}async verifyMagicLink(e){let{ipAddress:t,userAgent:s}=a$2(e),a=new URL(e.url).searchParams.get("token");if(!a)return this.errorResponse("Token required",400);try{let[i,c]=a.split(".");if(!i||!c)return this.errorResponse("Invalid token",400);let d=createHmac("sha256",this.jwtSecret).update(i).digest("hex");if(c!==d)return this.errorResponse("Invalid token",400);let g=JSON.parse(Buffer.from(i,"base64url").toString());if(Date.now()>g.exp)return this.errorResponse("Token expired",400);let x=await this.authAdapter.findUserByEmail(g.email);if(!x)return this.errorResponse("User not found",404);if(x.locked)return this.errorResponse("Account locked",403);let _=await l({id:x.id,email:x.email,role:x.role,tenantId:x.tenantId});this.auditLogger&&await this.auditLogger.log({action:"login",userId:x.id,userEmail:x.email,resource:"auth",ipAddress:t,userAgent:s,success:!0});let P=this.jsonResponse({success:!0,user:this.sanitizeUser(x)});return j$1(P,_)}catch{return this.errorResponse("Invalid token",400)}}async inviteUser(e){try{let t=await e.json();if(!t.email||!t.role)return this.errorResponse("Email and role required",400);let s=await this.authAdapter.findUserByEmail(t.email);if(s)return this.errorResponse("User already exists",409);if(s=await this.authAdapter.createUser({email:t.email,password:randomBytes(16).toString("hex"),role:t.role}),this.email){let n=await this.authAdapter.createPasswordResetToken(s.email),i=`${this.getBaseUrl(e)}/admin/auth/reset-password?token=${n.token}`,c=this.email.getTemplates().userInvite(i,t.role,t.inviterName||"An administrator");this.email.send({to:s.email,...c}).catch(d=>console.error("Invite email err:",d));}return this.jsonResponse({success:!0,message:"User invited successfully"})}catch{return this.errorResponse("Failed to invite user",500)}}};g();var Yc=e(a(),1);var Ao=class{db;sessionTTL;constructor(e){this.db=e.db?.client||e.db,this.sessionTTL=e.sessionTTL||86400;}async executeSql(e,t=[]){try{if(this.db&&typeof this.db.prepare=="function"){let s=this.db.prepare(e);return (await(t.length>0?s.bind(...t):s).all()).results||[]}else if(this.db&&typeof this.db.run=="function"){let s=await this.db.run(J.raw(this.replaceParams(e,t)));return s.rows||s.results||(Array.isArray(s)?s:[])}else if(this.db&&typeof this.db.all=="function"){let s=await this.db.all(J.raw(this.replaceParams(e,t)));return Array.isArray(s)?s:s.results||[]}else if(this.db&&typeof this.db.execute=="function"){let s=await this.db.execute(J.raw(this.replaceParams(e,t)));return s.rows||s.results||(Array.isArray(s)?s:[])}}catch(s){console.warn("[D1AuthAdapter] SQL execution note:",s.message);}return []}async getOne(e,t=[]){try{if(this.db&&typeof this.db.prepare=="function"){let n=this.db.prepare(e);return await(t.length>0?n.bind(...t):n).first()||null}}catch{}let s=await this.executeSql(e,t);return s.length>0?s[0]:null}replaceParams(e,t){let s=0;return e.replace(/\?/g,()=>{let n=t[s++];return n==null?"NULL":typeof n=="number"||typeof n=="boolean"?String(n):`'${String(n).replace(/'/g,"''")}'`})}async connect(){await this.executeSql(`
+import {r as r$1,p as p$2,q as q$1}from'./chunk-KWGB3YNI.js';import {a as a$a}from'./chunk-R25WLKX4.js';import {l,j as j$1,h,t,p as p$1,k,o as o$1,r as r$2,s,b,n as n$2}from'./chunk-6TPICJ2L.js';import {a as a$e,b as b$4,g as g$3}from'./chunk-W45TLOOT.js';import {a as a$d}from'./chunk-IKGVPXMK.js';import {j as j$3,h as h$1,k as k$1,i as i$3,f as f$3,g as g$2,e as e$5}from'./chunk-YUUXFD73.js';import {a as a$3}from'./chunk-LVBHOZZF.js';import {p,q,R,r,n,u as u$1,f,A,m as m$1,c as c$2,N,x as x$1,t as t$1,O,z as z$1,B,C,D,E as E$1,I as I$1,G,i as i$2,a as a$b,Q as Q$1,v as v$1,y,w as w$1,P,T as T$2,j as j$4,U as U$1,k as k$2,F as F$1,h as h$3,o as o$2,s as s$2}from'./chunk-OBYAIJVU.js';import {n as n$1,f as f$1,e as e$1,H,l as l$1,T as T$1,I as I$2,C as C$1,E as E$2,D as D$1,F,G as G$1,h as h$2,R as R$1,S,i as i$4,s as s$1,t as t$2,d as d$4,m as m$2,u as u$3,p as p$3,r as r$3}from'./chunk-JRUQ5ABB.js';import {a as a$4}from'./chunk-CIVA6SKW.js';import {q as q$2,n as n$3}from'./chunk-WPM6LFCY.js';import {c,a as a$c,d as d$2,b as b$2}from'./chunk-U6KFONKM.js';import {x,i,a as a$1,v,w,z as z$2,u as u$2,e as e$4,c as c$4,A as A$1,y as y$1,d as d$3,b as b$3}from'./chunk-TYQYKKWJ.js';import {a as a$2}from'./chunk-L2QXP26Q.js';import {d,a as a$6,b as b$1,c as c$3}from'./chunk-YZEMLLD2.js';import {d as d$1,i as i$1,j as j$2,f as f$2,e as e$3,g as g$1}from'./chunk-RTHJ6SS5.js';import {e as e$2,c as c$1}from'./chunk-KNOFTUQV.js';import {a as a$8}from'./chunk-ZWDBPEXL.js';import {J}from'./chunk-3NSZZCOJ.js';import {a as a$9}from'./chunk-5ZEYOFAK.js';import {a}from'./chunk-7NH7H3WA.js';import {a as a$7}from'./chunk-VVVCCB6R.js';import {a as a$5}from'./chunk-TBHNE4VV.js';import {g,e}from'./chunk-Y2YAKDEQ.js';import NB,{createHash,randomBytes,createHmac}from'crypto';import Co,{join,resolve,basename,extname}from'path';import {existsSync,readFileSync}from'fs';import {mkdir,readdir,stat,rename,unlink,writeFile}from'fs/promises';import Bw from'process';import {Readable}from'stream';if (typeof window === "undefined") { const { createRequire } = await import(/* @vite-ignore */ 'module'); createRequire(import.meta.url); }
+g();g();g();g();g();g();var Tc=(r,e,t)=>(s,n)=>{let a=-1;return i(0);async function i(c){if(c<=a)throw new Error("next() called multiple times");a=c;let d,g=false,x;if(r[c]?(x=r[c][0][0],s.req.routeIndex=c):x=c===r.length&&n||void 0,x)try{d=await x(s,()=>i(c+1));}catch(_){if(_ instanceof Error&&e)s.error=_,d=await e(_,s),g=true;else throw _}else s.finalized===false&&t&&(d=await t(s));return d&&(s.finalized===false||g)&&(s.res=d),s}};g();g();g();g();var am=Symbol();g();g();g();var om=(r,e)=>new Response(r,{headers:{"Content-Type":e.replace(/^[^;]+/,s=>s.toLowerCase())}}).formData();var uo=r=>"headers"in r,cm=async(r,e=Object.create(null))=>{let{all:t=false,dot:s=false}=e,i=(uo(r)?r.headers:r.raw.headers).get("Content-Type")?.split(";")[0].trim().toLowerCase();return i==="multipart/form-data"||i==="application/x-www-form-urlencoded"?tw(r,{all:t,dot:s}):{}};async function tw(r,e){if(!uo(r)&&r.bodyCache.formData)return im(await r.bodyCache.formData,e);let t=uo(r)?r.headers:r.raw.headers,s=await r.arrayBuffer(),n=om(s,t.get("Content-Type")||"");uo(r)||(r.bodyCache.formData=n);let a=await n;return a?im(a,e):{}}function im(r,e){let t=Object.create(null);return r.forEach((s,n)=>{e.all||n.endsWith("[]")?rw(t,n,s):t[n]=s;}),e.dot&&Object.entries(t).forEach(([s,n])=>{s.includes(".")&&(sw(t,s,n),delete t[s]);}),t}var rw=(r,e,t)=>{r[e]!==void 0?Array.isArray(r[e])?r[e].push(t):r[e]=[r[e],t]:e.endsWith("[]")?r[e]=[t]:r[e]=t;},sw=(r,e,t)=>{if(/(?:^|\.)__proto__\./.test(e))return;let s=r,n=e.split(".");n.forEach((a,i)=>{i===n.length-1?s[a]=t:((!s[a]||typeof s[a]!="object"||Array.isArray(s[a])||s[a]instanceof File)&&(s[a]=Object.create(null)),s=s[a]);});};g();var Pc=r=>{let e=r.split("/");return e[0]===""&&e.shift(),e},um=r=>{let{groups:e,path:t}=nw(r),s=Pc(t);return aw(s,e)},nw=r=>{let e=[];return r=r.replace(/\{[^}]+\}/g,(t,s)=>{let n=`@${s}`;return e.push([n,t]),n}),{groups:e,path:r}},aw=(r,e)=>{for(let t=e.length-1;t>=0;t--){let[s]=e[t];for(let n=r.length-1;n>=0;n--)if(r[n].includes(s)){r[n]=r[n].replace(s,e[t][1]);break}}return r},lo={},lm=(r,e)=>{if(r==="*")return "*";let t=r.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(t){let s=`${r}#${e}`;return lo[s]||(t[2]?lo[s]=e&&e[0]!==":"&&e[0]!=="*"?[s,t[1],new RegExp(`^${t[2]}(?=/${e})`)]:[r,t[1],new RegExp(`^${t[2]}$`)]:lo[s]=[r,t[1],true]),lo[s]}return null},Jn=(r,e)=>{try{return e(r)}catch{return r.replace(/(?:%[0-9A-Fa-f]{2})+/g,t=>{try{return e(t)}catch{return t}})}},ow=r=>Jn(r,decodeURI),Ic=r=>{let e=r.url,t=e.indexOf("/",e.indexOf(":")+4),s=t;for(;s<e.length;s++){let n=e.charCodeAt(s);if(n===37){let a=e.indexOf("?",s),i=e.indexOf("#",s),c=a===-1?i===-1?void 0:i:i===-1?a:Math.min(a,i),d=e.slice(t,c);return ow(d.includes("%25")?d.replace(/%25/g,"%2525"):d)}else if(n===63||n===35)break}return e.slice(t,s)};var dm=r=>{let e=Ic(r);return e.length>1&&e.at(-1)==="/"?e.slice(0,-1):e},Jr=(r,e,...t)=>(t.length&&(e=Jr(e,...t)),`${r?.[0]==="/"?"":"/"}${r}${e==="/"?"":`${r?.at(-1)==="/"?"":"/"}${e?.[0]==="/"?e.slice(1):e}`}`),po=r=>{if(r.charCodeAt(r.length-1)!==63||!r.includes(":"))return null;let e=r.split("/"),t=[],s="";return e.forEach(n=>{if(n!==""&&!/\:/.test(n))s+="/"+n;else if(/\:/.test(n))if(/\?/.test(n)){t.length===0&&s===""?t.push("/"):t.push(s);let a=n.replace("?","");s+="/"+a,t.push(s);}else s+="/"+n;}),t.filter((n,a,i)=>i.indexOf(n)===a)},Oc=r=>/[%+]/.test(r)?(r.indexOf("+")!==-1&&(r=r.replace(/\+/g," ")),r.indexOf("%")!==-1?Jn(r,mo):r):r,pm=(r,e,t)=>{let s;if(!t&&e&&!/[%+]/.test(e)){let i=r.indexOf("?",8);if(i===-1)return;for(r.startsWith(e,i+1)||(i=r.indexOf(`&${e}`,i+1));i!==-1;){let c=r.charCodeAt(i+e.length+1);if(c===61){let d=i+e.length+2,g=r.indexOf("&",d);return Oc(r.slice(d,g===-1?void 0:g))}else if(c==38||isNaN(c))return "";i=r.indexOf(`&${e}`,i+1);}if(s=/[%+]/.test(r),!s)return}let n={};s??=/[%+]/.test(r);let a=r.indexOf("?",8);for(;a!==-1;){let i=r.indexOf("&",a+1),c=r.indexOf("=",a);c>i&&i!==-1&&(c=-1);let d=r.slice(a+1,c===-1?i===-1?void 0:i:c);if(s&&(d=Oc(d)),a=i,d==="")continue;let g;c===-1?g="":(g=r.slice(c+1,i===-1?void 0:i),s&&(g=Oc(g))),t?(n[d]&&Array.isArray(n[d])||(n[d]=[]),n[d].push(g)):n[d]??=g;}return e?n[e]:n},mm=pm,fm=(r,e)=>pm(r,e,true),mo=decodeURIComponent;var hm=r=>Jn(r,mo),gm=class{raw;#t;#e;routeIndex=0;path;bodyCache={};constructor(r,e="/",t=[[]]){this.raw=r,this.path=e,this.#e=t,this.#t={};}param(r){return r?this.#r(r):this.#a()}#r(r){let e=this.#e[0][this.routeIndex][1][r],t=this.#n(e);return t&&/\%/.test(t)?hm(t):t}#a(){let r={},e=Object.keys(this.#e[0][this.routeIndex][1]);for(let t of e){let s=this.#n(this.#e[0][this.routeIndex][1][t]);s!==void 0&&(r[t]=/\%/.test(s)?hm(s):s);}return r}#n(r){return this.#e[1]?this.#e[1][r]:r}query(r){return mm(this.url,r)}queries(r){return fm(this.url,r)}header(r){if(r)return this.raw.headers.get(r)??void 0;let e={};return this.raw.headers.forEach((t,s)=>{e[s]=t;}),e}async parseBody(r){return cm(this,r)}#s=r=>{let{bodyCache:e,raw:t}=this,s=e[r];if(s)return s;let n=Object.keys(e)[0];return n?e[n].then(a=>(n==="json"&&(a=JSON.stringify(a)),new Response(a)[r]())):e[r]=t[r]()};json(){return this.#s("text").then(r=>JSON.parse(r))}text(){return this.#s("text")}arrayBuffer(){return this.#s("arrayBuffer")}bytes(){return this.#s("arrayBuffer").then(r=>new Uint8Array(r))}blob(){return this.#s("blob")}formData(){return this.#s("formData")}addValidatedData(r,e){this.#t[r]=e;}valid(r){return this.#t[r]}get url(){return this.raw.url}get method(){return this.raw.method}get[am](){return this.#e}get matchedRoutes(){return this.#e[0].map(([[,r]])=>r)}get routePath(){return this.#e[0].map(([[,r]])=>r)[this.routeIndex].path}};g();var ym={Stringify:1},cw=(r,e)=>{let t=new String(r);return t.isEscaped=true,t.callbacks=e,t};var Dc=async(r,e,t,s,n)=>{typeof r=="object"&&!(r instanceof String)&&(r instanceof Promise||(r=r.toString()),r instanceof Promise&&(r=await r));let a=r.callbacks;if(!a?.length)return Promise.resolve(r);n?n[0]+=r:n=[r];let i=Promise.all(a.map(c=>c({phase:e,buffer:n,context:s}))).then(c=>Promise.all(c.filter(Boolean).map(d=>Dc(d,e,false,s,n))).then(()=>n[0]));return t?cw(await i,a):i};var uw="text/plain; charset=UTF-8",Lc=(r,e)=>({"Content-Type":r,...e}),Qn=(r,e)=>new Response(r,e),$c=class{#t;#e;env={};#r;finalized=false;error;#a;#n;#s;#l;#c;#u;#i;#d;#p;constructor(r,e){this.#t=r,e&&(this.#n=e.executionCtx,this.env=e.env,this.#u=e.notFoundHandler,this.#p=e.path,this.#d=e.matchResult);}get req(){return this.#e??=new gm(this.#t,this.#p,this.#d),this.#e}get event(){if(this.#n&&"respondWith"in this.#n)return this.#n;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#n)return this.#n;throw Error("This context has no ExecutionContext")}get res(){return this.#s||=Qn(null,{headers:this.#i??=new Headers})}set res(r){if(this.#s&&r){r=Qn(r.body,r);for(let[e,t]of this.#s.headers.entries())if(e!=="content-type")if(e==="set-cookie"){let s=this.#s.headers.getSetCookie();r.headers.delete("set-cookie");for(let n of s)r.headers.append("set-cookie",n);}else r.headers.set(e,t);}this.#s=r,this.finalized=true;}render=(...r)=>(this.#c??=e=>this.html(e),this.#c(...r));setLayout=r=>this.#l=r;getLayout=()=>this.#l;setRenderer=r=>{this.#c=r;};header=(r,e,t)=>{this.finalized&&(this.#s=Qn(this.#s.body,this.#s));let s=this.#s?this.#s.headers:this.#i??=new Headers;e===void 0?s.delete(r):t?.append?s.append(r,e):s.set(r,e);};status=r=>{this.#a=r;};set=(r,e)=>{this.#r??=new Map,this.#r.set(r,e);};get=r=>this.#r?this.#r.get(r):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#o(r,e,t){let s=this.#s?new Headers(this.#s.headers):this.#i??new Headers;if(typeof e=="object"&&"headers"in e){let a=e.headers instanceof Headers?e.headers:new Headers(e.headers);for(let[i,c]of a)i.toLowerCase()==="set-cookie"?s.append(i,c):s.set(i,c);}if(t)for(let[a,i]of Object.entries(t))if(typeof i=="string")s.set(a,i);else {s.delete(a);for(let c of i)s.append(a,c);}let n=typeof e=="number"?e:e?.status??this.#a;return Qn(r,{status:n,headers:s})}newResponse=(...r)=>this.#o(...r);body=(r,e,t)=>this.#o(r,e,t);text=(r,e,t)=>!this.#i&&!this.#a&&!e&&!t&&!this.finalized?new Response(r):this.#o(r,e,Lc(uw,t));json=(r,e,t)=>this.#o(JSON.stringify(r),e,Lc("application/json",t));html=(r,e,t)=>{let s=n=>this.#o(n,e,Lc("text/html; charset=UTF-8",t));return typeof r=="object"?Dc(r,ym.Stringify,false,{}).then(s):s(r)};redirect=(r,e)=>{let t=String(r);return this.header("Location",/[^\x00-\xFF]/.test(t)?encodeURI(t):t),this.newResponse(null,e??302)};notFound=()=>(this.#u??=()=>Qn(),this.#u(this))};g();var Le="ALL",xm="all",_m=["get","post","put","delete","options","patch"],fo="Can not add a route since the matcher is already built.",ho=class extends Error{};g();var wm="__COMPOSED_HANDLER";var lw=r=>r.text("404 Not Found",404),bm=(r,e)=>{if("getResponse"in r){let t=r.getResponse();return e.newResponse(t.body,t)}return console.error(r),e.text("Internal Server Error",500)},vm=class Sm{get;post;put;delete;options;patch;all;on;use;router;getPath;_basePath="/";#t="/";routes=[];constructor(e={}){[..._m,xm].forEach(a=>{this[a]=(i,...c)=>(typeof i=="string"?this.#t=i:this.#a(a,this.#t,i),c.forEach(d=>{this.#a(a,this.#t,d);}),this);}),this.on=(a,i,...c)=>{for(let d of [i].flat()){this.#t=d;for(let g of [a].flat())c.map(x=>{this.#a(g.toUpperCase(),this.#t,x);});}return this},this.use=(a,...i)=>(typeof a=="string"?this.#t=a:(this.#t="*",i.unshift(a)),i.forEach(c=>{this.#a(Le,this.#t,c);}),this);let{strict:s,...n}=e;Object.assign(this,n),this.getPath=s??true?e.getPath??Ic:dm;}#e(){let e=new Sm({router:this.router,getPath:this.getPath});return e.errorHandler=this.errorHandler,e.#r=this.#r,e.routes=this.routes,e}#r=lw;errorHandler=bm;route(e,t){let s=this.basePath(e);return t.routes.map(n=>{let a;t.errorHandler===bm?a=n.handler:(a=async(i,c)=>(await Tc([],t.errorHandler)(i,()=>n.handler(i,c))).res,a[wm]=n.handler),s.#a(n.method,n.path,a,n.basePath);}),this}basePath(e){let t=this.#e();return t._basePath=Jr(this._basePath,e),t}onError=e=>(this.errorHandler=e,this);notFound=e=>(this.#r=e,this);mount(e,t,s){let n,a;s&&(typeof s=="function"?a=s:(a=s.optionHandler,s.replaceRequest===false?n=d=>d:n=s.replaceRequest));let i=a?d=>{let g=a(d);return Array.isArray(g)?g:[g]}:d=>{let g;try{g=d.executionCtx;}catch{}return [d.env,g]};n||=(()=>{let d=Jr(this._basePath,e),g=d==="/"?0:d.length;return x=>{let _=new URL(x.url);return _.pathname=this.getPath(x).slice(g)||"/",new Request(_,x)}})();let c=async(d,g)=>{let x=await t(n(d.req.raw),...i(d));if(x)return x;await g();};return this.#a(Le,Jr(e,"*"),c),this}#a(e,t,s,n){e=e.toUpperCase(),t=Jr(this._basePath,t);let a={basePath:n!==void 0?Jr(this._basePath,n):this._basePath,path:t,method:e,handler:s};this.router.add(e,t,[s,a]),this.routes.push(a);}#n(e,t){if(e instanceof Error)return this.errorHandler(e,t);throw e}#s(e,t,s,n){if(n==="HEAD")return (async()=>new Response(null,await this.#s(e,t,s,"GET")))();let a=this.getPath(e,{env:s}),i=this.router.match(n,a),c=new $c(e,{path:a,matchResult:i,env:s,executionCtx:t,notFoundHandler:this.#r});if(i[0].length===1){let g;try{g=i[0][0][0][0](c,async()=>{c.res=await this.#r(c);});}catch(x){return this.#n(x,c)}return g instanceof Promise?g.then(x=>x||(c.finalized?c.res:this.#r(c))).catch(x=>this.#n(x,c)):g??this.#r(c)}let d=Tc(i[0],this.errorHandler,this.#r);return (async()=>{try{let g=await d(c);if(!g.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return g.res}catch(g){return this.#n(g,c)}})()}fetch=(e,...t)=>this.#s(e,t[1],t[0],e.method);request=(e,t,s,n)=>e instanceof Request?this.fetch(t?new Request(e,t):e,s,n):(e=e.toString(),this.fetch(new Request(/^https?:\/\//.test(e)?e:`http://localhost${Jr("/",e)}`,t),s,n));fire=()=>{addEventListener("fetch",e=>{e.respondWith(this.#s(e.request,e,void 0,e.request.method));});}};g();g();g();var go=[];function Bc(r,e){let t=this.buildAllMatchers(),s=((n,a)=>{let i=t[n]||t[Le],c=i[2][a];if(c)return c;let d=a.match(i[0]);if(!d)return [[],go];let g=d.indexOf("",1);return [i[1][g],d]});return this.match=s,s(r,e)}g();var yo="[^/]+",Yn=".*",ea="(?:|/.*)",ps=Symbol(),dw=new Set(".\\+*[^]$()");function pw(r,e){return r.length===1?e.length===1?r<e?-1:1:-1:e.length===1||r===Yn||r===ea?1:e===Yn||e===ea?-1:r===yo?1:e===yo?-1:r.length===e.length?r<e?-1:1:e.length-r.length}var Am=class jc{#t;#e;#r=Object.create(null);insert(e,t,s,n,a){if(e.length===0){if(this.#t!==void 0)throw ps;if(a)return;this.#t=t;return}let[i,...c]=e,d=i==="*"?c.length===0?["","",Yn]:["","",yo]:i==="/*"?["","",ea]:i.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),g;if(d){let x=d[1],_=d[2]||yo;if(x&&d[2]&&(_===".*"||(_=_.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(_))))throw ps;if(g=this.#r[_],!g){if(Object.keys(this.#r).some(P=>P!==Yn&&P!==ea))throw ps;if(a)return;g=this.#r[_]=new jc,x!==""&&(g.#e=n.varIndex++);}!a&&x!==""&&s.push([x,g.#e]);}else if(g=this.#r[i],!g){if(Object.keys(this.#r).some(x=>x.length>1&&x!==Yn&&x!==ea))throw ps;if(a)return;g=this.#r[i]=new jc;}g.insert(c,t,s,n,a);}buildRegExpStr(){let t=Object.keys(this.#r).sort(pw).map(s=>{let n=this.#r[s];return (typeof n.#e=="number"?`(${s})@${n.#e}`:dw.has(s)?`\\${s}`:s)+n.buildRegExpStr()});return typeof this.#t=="number"&&t.unshift(`#${this.#t}`),t.length===0?"":t.length===1?t[0]:"(?:"+t.join("|")+")"}};g();var Rm=class{#t={varIndex:0};#e=new Am;insert(r,e,t){let s=[],n=[];for(let i=0;;){let c=false;if(r=r.replace(/\{[^}]+\}/g,d=>{let g=`@\\${i}`;return n[i]=[g,d],i++,c=true,g}),!c)break}let a=r.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let i=n.length-1;i>=0;i--){let[c]=n[i];for(let d=a.length-1;d>=0;d--)if(a[d].indexOf(c)!==-1){a[d]=a[d].replace(c,n[i][1]);break}}return this.#e.insert(a,e,s,this.#t,t),s}buildRegExp(){let r=this.#e.buildRegExpStr();if(r==="")return [/^$/,[],[]];let e=0,t=[],s=[];return r=r.replace(/#(\d+)|@(\d+)|\.\*\$/g,(n,a,i)=>a!==void 0?(t[++e]=Number(a),"$()"):(i!==void 0&&(s[Number(i)]=++e),"")),[new RegExp(`^${r}`),t,s]}};var mw=[/^$/,[],Object.create(null)],km=Object.create(null);function Cm(r){return km[r]??=new RegExp(r==="*"?"":`^${r.replace(/\/\*$|([.\\+*[^\]$()])/g,(e,t)=>t?`\\${t}`:"(?:|/.*)")}$`)}function fw(){km=Object.create(null);}function hw(r){let e=new Rm,t=[];if(r.length===0)return mw;let s=r.map(g=>[!/\*|\/:/.test(g[0]),...g]).sort(([g,x],[_,P])=>g?1:_?-1:x.length-P.length),n=Object.create(null);for(let g=0,x=-1,_=s.length;g<_;g++){let[P,G,q]=s[g];P?n[G]=[q.map(([ue])=>[ue,Object.create(null)]),go]:x++;let H;try{H=e.insert(G,x,P);}catch(ue){throw ue===ps?new ho(G):ue}P||(t[x]=q.map(([ue,se])=>{let Pe=Object.create(null);for(se-=1;se>=0;se--){let[Z,St]=H[se];Pe[Z]=St;}return [ue,Pe]}));}let[a,i,c]=e.buildRegExp();for(let g=0,x=t.length;g<x;g++)for(let _=0,P=t[g].length;_<P;_++){let G=t[g][_]?.[1];if(!G)continue;let q=Object.keys(G);for(let H=0,ue=q.length;H<ue;H++)G[q[H]]=c[G[q[H]]];}let d=[];for(let g in i)d[g]=t[i[g]];return [a,d,n]}function Ms(r,e){if(r){for(let t of Object.keys(r).sort((s,n)=>n.length-s.length))if(Cm(t).test(e))return [...r[t]]}}var xo=class{name="RegExpRouter";#t;#e;constructor(){this.#t={[Le]:Object.create(null)},this.#e={[Le]:Object.create(null)};}add(r,e,t){let s=this.#t,n=this.#e;if(!s||!n)throw new Error(fo);s[r]||[s,n].forEach(c=>{c[r]=Object.create(null),Object.keys(c[Le]).forEach(d=>{c[r][d]=[...c[Le][d]];});}),e==="/*"&&(e="*");let a=(e.match(/\/:/g)||[]).length;if(/\*$/.test(e)){let c=Cm(e);r===Le?Object.keys(s).forEach(d=>{s[d][e]||=Ms(s[d],e)||Ms(s[Le],e)||[];}):s[r][e]||=Ms(s[r],e)||Ms(s[Le],e)||[],Object.keys(s).forEach(d=>{(r===Le||r===d)&&Object.keys(s[d]).forEach(g=>{c.test(g)&&s[d][g].push([t,a]);});}),Object.keys(n).forEach(d=>{(r===Le||r===d)&&Object.keys(n[d]).forEach(g=>c.test(g)&&n[d][g].push([t,a]));});return}let i=po(e)||[e];for(let c=0,d=i.length;c<d;c++){let g=i[c];Object.keys(n).forEach(x=>{(r===Le||r===x)&&(n[x][g]||=[...Ms(s[x],g)||Ms(s[Le],g)||[]],n[x][g].push([t,a-d+c+1]));});}}match=Bc;buildAllMatchers(){let r=Object.create(null);return Object.keys(this.#e).concat(Object.keys(this.#t)).forEach(e=>{r[e]||=this.#r(e);}),this.#t=this.#e=void 0,fw(),r}#r(r){let e=[],t=r===Le;return [this.#t,this.#e].forEach(s=>{let n=s[r]?Object.keys(s[r]).map(a=>[a,s[r][a]]):[];n.length!==0?(t||=true,e.push(...n)):r!==Le&&e.push(...Object.keys(s[Le]).map(a=>[a,s[Le][a]]));}),t?hw(e):null}};g();g();g();var Nc=class{name="SmartRouter";#t=[];#e=[];constructor(r){this.#t=r.routers;}add(r,e,t){if(!this.#e)throw new Error(fo);this.#e.push([r,e,t]);}match(r,e){if(!this.#e)throw new Error("Fatal error");let t=this.#t,s=this.#e,n=t.length,a=0,i;for(;a<n;a++){let c=t[a];try{for(let d=0,g=s.length;d<g;d++)c.add(...s[d]);i=c.match(r,e);}catch(d){if(d instanceof ho)continue;throw d}this.match=c.match.bind(c),this.#t=[c],this.#e=void 0;break}if(a===n)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,i}get activeRouter(){if(this.#e||this.#t.length!==1)throw new Error("No active router has been determined yet.");return this.#t[0]}};g();g();g();var ta=Object.create(null),gw=r=>{for(let e in r)return  true;return  false},Em=class Tm{#t;#e;#r;#a=0;#n=ta;constructor(e,t,s){if(this.#e=s||Object.create(null),this.#t=[],e&&t){let n=Object.create(null);n[e]={handler:t,possibleKeys:[],score:0},this.#t=[n];}this.#r=[];}insert(e,t,s){this.#a=++this.#a;let n=this,a=um(t),i=[];for(let c=0,d=a.length;c<d;c++){let g=a[c],x=a[c+1],_=lm(g,x),P=Array.isArray(_)?_[0]:g;if(P in n.#e){n=n.#e[P],_&&i.push(_[1]);continue}n.#e[P]=new Tm,_&&(n.#r.push(_),i.push(_[1])),n=n.#e[P];}return n.#t.push({[e]:{handler:s,possibleKeys:i.filter((c,d,g)=>g.indexOf(c)===d),score:this.#a}}),n}#s(e,t,s,n,a){for(let i=0,c=t.#t.length;i<c;i++){let d=t.#t[i],g=d[s]||d[Le],x={};if(g!==void 0&&(g.params=Object.create(null),e.push(g),n!==ta||a&&a!==ta))for(let _=0,P=g.possibleKeys.length;_<P;_++){let G=g.possibleKeys[_],q=x[g.score];g.params[G]=a?.[G]&&!q?a[G]:n[G]??a?.[G],x[g.score]=true;}}}search(e,t){let s=[];this.#n=ta;let a=[this],i=Pc(t),c=[],d=i.length,g=null;for(let x=0;x<d;x++){let _=i[x],P=x===d-1,G=[];for(let H=0,ue=a.length;H<ue;H++){let se=a[H],Pe=se.#e[_];Pe&&(Pe.#n=se.#n,P?(Pe.#e["*"]&&this.#s(s,Pe.#e["*"],e,se.#n),this.#s(s,Pe,e,se.#n)):G.push(Pe));for(let Z=0,St=se.#r.length;Z<St;Z++){let Ze=se.#r[Z],F=se.#n===ta?{}:{...se.#n};if(Ze==="*"){let mr=se.#e["*"];mr&&(this.#s(s,mr,e,se.#n),mr.#n=F,G.push(mr));continue}let[Lt,ds,Dr]=Ze;if(!_&&!(Dr instanceof RegExp))continue;let He=se.#e[Lt];if(Dr instanceof RegExp){if(g===null){g=new Array(d);let tr=t[0]==="/"?1:0;for(let we=0;we<d;we++)g[we]=tr,tr+=i[we].length+1;}let mr=t.substring(g[x]),fr=Dr.exec(mr);if(fr){if(F[ds]=fr[0],this.#s(s,He,e,se.#n,F),fr[0].length===mr.length&&He.#e["*"]&&this.#s(s,He.#e["*"],e,se.#n,F),gw(He.#e)){He.#n=F;let tr=fr[0].match(/\//)?.length??0;(c[tr]||=[]).push(He);}continue}}(Dr===true||Dr.test(_))&&(F[ds]=_,P?(this.#s(s,He,e,F,se.#n),He.#e["*"]&&this.#s(s,He.#e["*"],e,F,se.#n)):(He.#n=F,G.push(He)));}}let q=c.shift();a=q?G.concat(q):G;}return s.length>1&&s.sort((x,_)=>x.score-_.score),[s.map(({handler:x,params:_})=>[x,_])]}};var Mc=class{name="TrieRouter";#t;constructor(){this.#t=new Em;}add(r,e,t){let s=po(e);if(s){for(let n=0,a=s.length;n<a;n++)this.#t.insert(r,s[n],t);return}this.#t.insert(r,e,t);}match(r,e){return this.#t.search(r,e)}};var Uc=class extends vm{constructor(r={}){super(r),this.router=r.router??new Nc({routers:[new xo,new Mc]});}};g();g();g();g();g();g();g();var qc=r=>Hc(r.replace(/_|-/g,e=>({_:"/","-":"+"})[e]??e)),Fc=r=>yw(r).replace(/\/|\+/g,e=>({"/":"_","+":"-"})[e]??e),yw=r=>{let e="",t=new Uint8Array(r);for(let s=0,n=t.length;s<n;s++)e+=String.fromCharCode(t[s]);return btoa(e)},Hc=r=>{let e=atob(r),t=new Uint8Array(new ArrayBuffer(e.length)),s=e.length/2;for(let n=0,a=e.length-1;n<=s;n++,a--)t[n]=e.charCodeAt(n),t[a]=e.charCodeAt(a);return t};g();var ms=(r=>(r.HS256="HS256",r.HS384="HS384",r.HS512="HS512",r.RS256="RS256",r.RS384="RS384",r.RS512="RS512",r.PS256="PS256",r.PS384="PS384",r.PS512="PS512",r.ES256="ES256",r.ES384="ES384",r.ES512="ES512",r.EdDSA="EdDSA",r))(ms||{});g();g();var xw={deno:"Deno",bun:"Bun",workerd:"Cloudflare-Workers",node:"Node.js"},Om=()=>{let r=globalThis;if(typeof navigator<"u"&&typeof navigator.userAgent=="string"){for(let[t,s]of Object.entries(xw))if(_w(s))return t}return typeof r?.EdgeRuntime=="string"?"edge-light":r?.fastly!==void 0?"fastly":r?.process?.release?.name==="node"?"node":"other"},_w=r=>navigator.userAgent.startsWith(r);g();var Pm=class extends Error{constructor(r){super(`${r} is not an implemented algorithm`),this.name="JwtAlgorithmNotImplemented";}},Gc=class extends Error{constructor(){super('JWT verification requires "alg" option to be specified'),this.name="JwtAlgorithmRequired";}},zc=class extends Error{constructor(r,e){super(`JWT algorithm mismatch: expected "${r}", got "${e}"`),this.name="JwtAlgorithmMismatch";}},fs=class extends Error{constructor(r){super(`invalid JWT token: ${r}`),this.name="JwtTokenInvalid";}},Im=class extends Error{constructor(r){super(`token (${r}) is being used before it's valid`),this.name="JwtTokenNotBefore";}},Dm=class extends Error{constructor(r){super(`token (${r}) expired`),this.name="JwtTokenExpired";}},Lm=class extends Error{constructor(r,e){super(`Invalid "iat" claim, must be a valid number lower than "${r}" (iat: "${e}")`),this.name="JwtTokenIssuedAt";}},_o=class extends Error{constructor(r,e){super(`expected issuer "${r}", got ${e?`"${e}"`:"none"} `),this.name="JwtTokenIssuer";}},Kc=class extends Error{constructor(r){super(`jwt header is invalid: ${JSON.stringify(r)}`),this.name="JwtHeaderInvalid";}},Nm=class extends Error{constructor(r){super(`token(${r}) signature mismatched`),this.name="JwtTokenSignatureMismatched";}},Mm=class extends Error{constructor(r){super(`required "aud" in jwt payload: ${JSON.stringify(r)}`),this.name="JwtPayloadRequiresAud";}},Um=class extends Error{constructor(r,e){super(`expected audience "${Array.isArray(r)?r.join(", "):r}", got "${e}"`),this.name="JwtTokenAudience";}},Us=(r=>(r.Encrypt="encrypt",r.Decrypt="decrypt",r.Sign="sign",r.Verify="verify",r.DeriveKey="deriveKey",r.DeriveBits="deriveBits",r.WrapKey="wrapKey",r.UnwrapKey="unwrapKey",r))(Us||{});g();var hs=new TextEncoder,qm=new TextDecoder;async function Hm(r,e,t){let s=zm(e),n=await ww(r,s);return await crypto.subtle.sign(s,n,t)}async function Gm(r,e,t,s){let n=zm(e),a=await bw(r,n);return await crypto.subtle.verify(n,a,t,s)}function Vc(r){return Hc(r.replace(/-+(BEGIN|END).*?-+/g,"").replace(/\s/g,""))}async function ww(r,e){if(!crypto.subtle||!crypto.subtle.importKey)throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");if(Km(r)){if(r.type!=="private"&&r.type!=="secret")throw new Error(`unexpected key type: CryptoKey.type is ${r.type}, expected private or secret`);return r}let t=[Us.Sign];return typeof r=="object"?await crypto.subtle.importKey("jwk",r,e,false,t):r.includes("PRIVATE")?await crypto.subtle.importKey("pkcs8",Vc(r),e,false,t):await crypto.subtle.importKey("raw",hs.encode(r),e,false,t)}async function bw(r,e){if(!crypto.subtle||!crypto.subtle.importKey)throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");if(Km(r)){if(r.type==="public"||r.type==="secret")return r;r=await Fm(r);}if(typeof r=="string"&&r.includes("PRIVATE")){let s=await crypto.subtle.importKey("pkcs8",Vc(r),e,true,[Us.Sign]);r=await Fm(s);}let t=[Us.Verify];return typeof r=="object"?await crypto.subtle.importKey("jwk",r,e,false,t):r.includes("PUBLIC")?await crypto.subtle.importKey("spki",Vc(r),e,false,t):await crypto.subtle.importKey("raw",hs.encode(r),e,false,t)}async function Fm(r){if(r.type!=="private")throw new Error(`unexpected key type: ${r.type}`);if(!r.extractable)throw new Error("unexpected private key is unextractable");let e=await crypto.subtle.exportKey("jwk",r),{kty:t}=e,{alg:s,e:n,n:a}=e,{crv:i,x:c,y:d}=e;return {kty:t,alg:s,e:n,n:a,crv:i,x:c,y:d,key_ops:[Us.Verify]}}function zm(r){switch(r){case "HS256":return {name:"HMAC",hash:{name:"SHA-256"}};case "HS384":return {name:"HMAC",hash:{name:"SHA-384"}};case "HS512":return {name:"HMAC",hash:{name:"SHA-512"}};case "RS256":return {name:"RSASSA-PKCS1-v1_5",hash:{name:"SHA-256"}};case "RS384":return {name:"RSASSA-PKCS1-v1_5",hash:{name:"SHA-384"}};case "RS512":return {name:"RSASSA-PKCS1-v1_5",hash:{name:"SHA-512"}};case "PS256":return {name:"RSA-PSS",hash:{name:"SHA-256"},saltLength:32};case "PS384":return {name:"RSA-PSS",hash:{name:"SHA-384"},saltLength:48};case "PS512":return {name:"RSA-PSS",hash:{name:"SHA-512"},saltLength:64};case "ES256":return {name:"ECDSA",hash:{name:"SHA-256"},namedCurve:"P-256"};case "ES384":return {name:"ECDSA",hash:{name:"SHA-384"},namedCurve:"P-384"};case "ES512":return {name:"ECDSA",hash:{name:"SHA-512"},namedCurve:"P-521"};case "EdDSA":return {name:"Ed25519",namedCurve:"Ed25519"};default:throw new Pm(r)}}function Km(r){return Om()==="node"&&crypto.webcrypto?r instanceof crypto.webcrypto.CryptoKey:r instanceof CryptoKey}var Wc=r=>Fc(hs.encode(JSON.stringify(r)).buffer).replace(/=/g,""),vw=r=>Fc(r).replace(/=/g,""),Zc=r=>JSON.parse(qm.decode(qc(r)));function Vm(r){if(typeof r=="object"&&r!==null){let e=r;return "alg"in e&&Object.values(ms).includes(e.alg)&&(!("typ"in e)||e.typ==="JWT")}return  false}var Wm=async(r,e,t="HS256")=>{let s=Wc(r),n;typeof e=="object"&&"alg"in e?(t=e.alg,n=Wc({alg:t,typ:"JWT",kid:e.kid})):n=Wc({alg:t,typ:"JWT"});let a=`${n}.${s}`,i=await Hm(e,t,hs.encode(a)),c=vw(i);return `${a}.${c}`},Xc=async(r,e,t)=>{if(!t)throw new Gc;let{alg:s,iss:n,nbf:a=true,exp:i=true,iat:c=true,aud:d}=typeof t=="string"?{alg:t}:t;if(!s)throw new Gc;let g=r.split(".");if(g.length!==3)throw new fs(r);let{header:x,payload:_}=Jc(r);if(!Vm(x))throw new Kc(x);if(x.alg!==s)throw new zc(s,x.alg);let P=Math.floor(Date.now()/1e3);if(a&&_.nbf!==void 0&&(typeof _.nbf!="number"||!Number.isFinite(_.nbf)||_.nbf>P))throw new Im(r);if(i&&_.exp!==void 0&&(typeof _.exp!="number"||!Number.isFinite(_.exp)||_.exp<=P))throw new Dm(r);if(c&&_.iat!==void 0&&(typeof _.iat!="number"||!Number.isFinite(_.iat)||P<_.iat))throw new Lm(P,_.iat);if(n){if(!_.iss)throw new _o(n,null);if(typeof n=="string"&&_.iss!==n)throw new _o(n,_.iss);if(n instanceof RegExp&&!n.test(_.iss))throw new _o(n,_.iss)}if(d){if(!_.aud)throw new Mm(_);if(!(Array.isArray(_.aud)?_.aud:[_.aud]).some(se=>d instanceof RegExp?d.test(se):typeof d=="string"?se===d:Array.isArray(d)&&d.includes(se)))throw new Um(d,_.aud)}let G=r.substring(0,r.lastIndexOf("."));if(!await Gm(e,s,qc(g[2]),hs.encode(G)))throw new Nm(r);return _};[ms.HS256,ms.HS384,ms.HS512];var Jc=r=>{let e=r.split(".");if(e.length!==3)throw new fs(r);try{let t=Zc(e[0]),s=Zc(e[1]);return {header:t,payload:s}}catch{throw new fs(r)}};var ra={sign:Wm,verify:Xc};var wo=ra.verify,bo=ra.sign;g();function gs(r,e){for(let t of r){if(t.name===e)return t;if(t.type==="group"||t.type==="array"){let s=gs(t.fields||[],e);if(s)return s}if(t.type==="blocks")for(let s of t.blocks||[]){let n=gs(s.fields||[],e);if(n)return n}if(t.type==="tabs")for(let s of t.tabs||[]){let n=gs(s.fields||[],e);if(n)return n}if(t.type==="collapsible"||t.type==="row"){let s=gs(t.fields||[],e);if(s)return s}}return null}function sa(r){return r.map(e=>`${e.path.join(".")}: ${e.message}`).join(", ")}function Qr(r,e){if(!(!r||typeof r!="object"))for(let t of e){if(t.type==="tabs"&&Array.isArray(t.tabs)){let n=t.name?r[t.name]:r;if(n&&typeof n=="object")for(let a of t.tabs)Array.isArray(a.fields)&&Qr(n,a.fields);continue}if(!t.name||!(t.name in r))continue;if(r[t.name]===""&&(t.type==="text"||t.type==="textarea"||t.type==="code"||t.type==="markdown"||(r[t.name]=null)),(t.type==="group"||t.type==="collapsible")&&t.name&&Array.isArray(t.fields)&&r[t.name]&&typeof r[t.name]=="object")Qr(r[t.name],t.fields);else if(t.type==="array"&&t.name&&Array.isArray(t.fields)&&Array.isArray(r[t.name]))for(let n of r[t.name])n&&typeof n=="object"&&Qr(n,t.fields);else if(t.type==="blocks"&&t.name&&Array.isArray(t.blocks)&&Array.isArray(r[t.name]))for(let n of r[t.name]){if(!n||typeof n!="object")continue;let a=n.type||n.blockType;if(!a)continue;let i=t.blocks.find(d=>d.slug===a);if(!i||!Array.isArray(i.fields))continue;let c=n.data&&typeof n.data=="object"?n.data:n;Qr(c,i.fields);}}}function Yr(r,e){if(!(!e||typeof e!="object"))for(let t of r){if(t.type==="tabs"&&Array.isArray(t.tabs)){let s=t.name?e[t.name]:e;if(s&&typeof s=="object")for(let n of t.tabs)Array.isArray(n.fields)&&Yr(n.fields,s);}if(t.type==="richtext"&&t.name){let s=e[t.name];typeof s=="string"?e[t.name]=[{type:"paragraph",children:[{text:s}]}]:s&&typeof s=="object"&&!Array.isArray(s)&&s.type==="doc"&&Array.isArray(s.content)&&(e[t.name]=s.content);}if((t.type==="group"||t.type==="collapsible")&&t.name&&Array.isArray(t.fields)&&e[t.name]&&typeof e[t.name]=="object")Yr(t.fields,e[t.name]);else if(t.type==="array"&&t.name&&Array.isArray(t.fields)&&Array.isArray(e[t.name]))for(let s of e[t.name])s&&typeof s=="object"&&Yr(t.fields,s);else if(t.type==="blocks"&&t.name&&Array.isArray(t.blocks)&&Array.isArray(e[t.name]))for(let s of e[t.name]){if(!s||typeof s!="object")continue;let n=s.type||s.blockType;if(!n)continue;let a=t.blocks.find(c=>c.slug===n);if(!a||!Array.isArray(a.fields))continue;let i=s.data&&typeof s.data=="object"?s.data:s;Yr(a.fields,i);}}}function qs(r,e){if(!(!e||typeof e!="object")){for(let t of r)if(!(!t.name||!(t.name in e))){if(t.unique&&(t.type==="text"||t.type==="email"?e[t.name]=`${e[t.name]||t.name}-copy-${Date.now().toString(36)}`:delete e[t.name]),t.type==="tabs"&&t.name&&Array.isArray(t.tabs)&&e[t.name]&&typeof e[t.name]=="object")for(let s of t.tabs)Array.isArray(s.fields)&&qs(s.fields,e[t.name]);else if((t.type==="group"||t.type==="collapsible")&&t.name&&Array.isArray(t.fields)&&e[t.name]&&typeof e[t.name]=="object")qs(t.fields,e[t.name]);else if(t.type==="array"&&t.name&&Array.isArray(t.fields)&&Array.isArray(e[t.name]))for(let s of e[t.name])s&&typeof s=="object"&&(delete s.id,qs(t.fields,s));else if(t.type==="blocks"&&t.name&&Array.isArray(t.blocks)&&Array.isArray(e[t.name]))for(let s of e[t.name]){if(!s||typeof s!="object")continue;delete s.id;let n=s.type||s.blockType;if(!n)continue;let a=t.blocks.find(c=>c.slug===n);if(!a||!Array.isArray(a.fields))continue;let i=s.data&&typeof s.data=="object"?s.data:s;qs(a.fields,i);}}}}g();function Jm(r){let{db:t$1,userLookup:s}=r;return async function(a){let i=f$2(a);if(i&&t$1){let d=await e$3(i,t$1,s);if(d.valid&&d.user)return {user:d.user,tenantContext:Xm(d.user),apiKeyContext:g$1(d),status:200,authType:"apikey"};if(d.error)return {status:401,error:d.error}}let c=h(a);if(c)try{let d=await n$2(c);if(!d.valid)return {status:401,error:d.reason||"Session invalid"};let g=await t(a);if(g){let x=s?await s(g.userId):null;if(x)return {user:x,tenantContext:Xm(x),status:200,authType:"session"}}}catch(d){console.error("Session validation error:",d);}return {status:401,error:"Authentication required"}}}function Xm(r){return {tenantId:r.tenantId||"default",userId:r.id||"anonymous",role:r.role||"guest",roles:[r.role||"guest"],permissions:[],isSuperAdmin:r.role==="super_admin"}}g();var vo=class{storage=new Map;userStorage=new Map;limits;userLimits;constructor(e,t){this.limits={...Cw,...e},this.userLimits=t||{"user:api":{window:6e4,max:500},"user:write":{window:36e5,max:100}};}getKey(e,t){return `${e}:${t}`}getUserKey(e,t,s){return `user:${e}:${t}:${s}`}cleanupOldEntries(e,t){let n=Date.now()-t;for(;e.length>0&&e[0].timestamp<n;)e.shift();}async check(e,t){let s=this.limits[e]||this.limits["api:general"],n=this.getKey(e,t),a=this.storage.get(n);a||(a=[],this.storage.set(n,a)),this.cleanupOldEntries(a,s.window);let i=Date.now(),c=a.reduce((d,g)=>d+g.count,0);if(a.push({timestamp:i,count:1}),c>=s.max){let g=a.reduce((x,_)=>x.timestamp<_.timestamp?x:_,a[0]).timestamp+s.window;return {allowed:false,remaining:0,resetAt:g,retryAfter:Math.ceil((g-i)/1e3)}}return {allowed:true,remaining:s.max-c-1,resetAt:i+s.window}}async checkUser(e,t,s){let n=this.userLimits[e]||this.userLimits["user:api"],a=this.userStorage.get(t),i=[];a?i=a.get(this.getKey(e,s))||[]:(this.userStorage.has(t)||this.userStorage.set(t,new Map),this.userStorage.get(t).set(this.getKey(e,s),i)),this.cleanupOldEntries(i,n.window);let c=Date.now(),d=i.reduce((g,x)=>g+x.count,0);if(i.push({timestamp:c,count:1}),d>=n.max){let x=i.reduce((_,P)=>_.timestamp<P.timestamp?_:P,i[0]).timestamp+n.window;return {allowed:false,remaining:0,resetAt:x,retryAfter:Math.ceil((x-c)/1e3)}}return {allowed:true,remaining:n.max-d-1,resetAt:c+n.window}}async reset(e,t){let s=this.getKey(e,t);this.storage.delete(s);}async resetUser(e,t,s){let n=this.userStorage.get(t);if(n){let a=this.getKey(e,s);n.delete(a);}}async getStatus(e,t){let s=this.limits[e]||this.limits["api:general"],n=this.getKey(e,t),a=this.storage.get(n);a||(a=[],this.storage.set(n,a)),this.cleanupOldEntries(a,s.window);let i=Date.now(),c=a.reduce((d,g)=>d+g.count,0);return {count:c,limit:s.max,remaining:Math.max(0,s.max-c),resetAt:i+s.window}}setLimit(e,t){this.limits[e]=t;}setUserLimit(e,t){this.userLimits[e]=t;}},Cw={"auth:login":{window:9e5,max:5},"auth:register":{window:36e5,max:3},"auth:forgot":{window:36e5,max:3},"auth:reset":{window:36e5,max:5},"auth:verify":{window:36e5,max:5},"api:general":{window:6e4,max:100},"api:authenticated":{window:6e4,max:200}};g();g();g();g();var Qc={retentionDays:30};var Qm=class{redis;prefix;retentionDays;constructor(e,t=30,s="kyro:audit:"){this.redis=e,this.prefix=s,this.retentionDays=t;}async log(e){let t=randomBytes(16).toString("hex"),s=new Date,n={...e,id:t,timestamp:s},a=this.getKeyForDate(s),i=`${this.prefix}log:${t}`;await this.redis.hset(i,this.serializeLog(n)),await this.redis.expire(i,this.retentionDays*24*60*60+3600),await this.redis.zadd(a,s.getTime(),t),await this.redis.expire(a,this.retentionDays*24*60*60+3600);let c=e.userId?`${this.prefix}user:${e.userId}`:null;return c&&(await this.redis.zadd(c,s.getTime(),t),await this.redis.expire(c,this.retentionDays*24*60*60+3600)),t}async get(e){let t=`${this.prefix}log:${e}`,s=await this.redis.hgetall(t);return !s||Object.keys(s).length===0?null:this.deserializeLog(s)}async query(e={}){let{limit:t=50,offset:s=0}=e,n=[];if(e.userId)n.push(`${this.prefix}user:${e.userId}`);else if(e.startDate||e.endDate)n=this.getKeysForDateRange(e.startDate,e.endDate);else {let d=new Date;n=this.getKeysForDateRange(new Date(d.getTime()-this.retentionDays*24*60*60*1e3),d);}let a=[];for(let d of n){let g=await this.redis.zrange(d,0,-1,"WITHSCORES");for(let x=0;x<g.length;x+=2)a.push([g[x],parseInt(g[x+1],10)]);}a.sort((d,g)=>g[1]-d[1]);let i=a.length;a=a.slice(s,s+t);let c=[];for(let[d]of a){let g=await this.get(d);g&&this.matchesFilter(g,e)&&c.push(g);}return {logs:c,total:i}}async getRecent(e=50){let t=[],s=new Date,n=this.getKeysForDateRange(new Date(s.getTime()-10080*60*1e3),s),a=[];for(let i of n){let c=await this.redis.zrange(i,0,-1,"WITHSCORES");for(let d=0;d<c.length;d+=2)a.push([c[d],parseInt(c[d+1],10)]);}a.sort((i,c)=>c[1]-i[1]);for(let[i]of a.slice(0,e)){let c=await this.get(i);c&&t.push(c);}return t}async getUserActivity(e,t=50){let s=`${this.prefix}user:${e}`,n=await this.redis.zrange(s,0,t-1),a=[];for(let i of n){let c=await this.get(i);c&&a.push(c);}return a}async getStats(e,t){let s=this.getKeysForDateRange(e||new Date(Date.now()-2592e6),t||new Date),n={},a=0,i=0,c=0,d=new Set;for(let g of s){let x=await this.redis.zrange(g,0,-1);for(let _ of x){let P=await this.get(_);P&&(a++,n[P.action]=(n[P.action]||0)+1,P.success&&c++,P.action==="login_failed"&&i++,P.userId&&d.add(P.userId));}}return {totalEvents:a,byAction:n,successRate:a>0?c/a:1,failedLogins:i,uniqueUsers:d}}async cleanup(){let e=Date.now()-this.retentionDays*24*60*60*1e3,t=await this.redis.keys(`${this.prefix}date:*`),s=0;for(let n of t){let a=await this.redis.zrangebyscore(n,0,e);for(let i of a)await this.redis.del(`${this.prefix}log:${i}`),s++;await this.redis.zremrangebyscore(n,0,e);}return s}getKeyForDate(e){let t=e.getFullYear(),s=String(e.getMonth()+1).padStart(2,"0"),n=String(e.getDate()).padStart(2,"0");return `${this.prefix}date:${t}-${s}-${n}`}getKeysForDateRange(e,t){let s=[],n=e||new Date(Date.now()-this.retentionDays*24*60*60*1e3),a=t||new Date,i=new Date(n);for(;i<=a;)s.push(this.getKeyForDate(i)),i.setDate(i.getDate()+1);return s}matchesFilter(e,t){return !(t.action&&!(Array.isArray(t.action)?t.action:[t.action]).includes(e.action)||t.resource&&e.resource!==t.resource||t.resourceId&&e.resourceId!==t.resourceId||t.success!==void 0&&e.success!==t.success)}serializeLog(e){let t={id:e.id,timestamp:new Date(e.timestamp).toISOString(),action:e.action,resource:e.resource,success:e.success?"1":"0"};return e.userId&&(t.userId=e.userId),e.userEmail&&(t.userEmail=e.userEmail),e.role&&(t.role=e.role),e.resourceId&&(t.resourceId=e.resourceId),e.ipAddress&&(t.ipAddress=e.ipAddress),e.userAgent&&(t.userAgent=e.userAgent),e.error&&(t.error=e.error),e.changes&&(t.changes=JSON.stringify(e.changes)),e.metadata&&(t.metadata=JSON.stringify(e.metadata)),t}deserializeLog(e){return {id:e.id,timestamp:new Date(e.timestamp),action:e.action,userId:e.userId,userEmail:e.userEmail,role:e.role,resource:e.resource,resourceId:e.resourceId,ipAddress:e.ipAddress,userAgent:e.userAgent,success:e.success==="1",error:e.error,changes:e.changes?JSON.parse(e.changes):void 0,metadata:e.metadata?JSON.parse(e.metadata):void 0}}};function cU(r){return {ipAddress:r.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||r.headers.get("x-real-ip")||"unknown",userAgent:r.headers.get("user-agent")||"unknown"}}var Ym=class{logs=[];retentionDays;constructor(e=Qc.retentionDays){this.retentionDays=e;}async log(e){let t=randomBytes(16).toString("hex"),n={...e,id:t,timestamp:new Date};return this.logs.push(n),this.cleanupOldLogs(),t}async get(e){return this.logs.find(t=>t.id===e)||null}async query(e={}){let{limit:t=50,offset:s=0}=e,n=[...this.logs];if(e.userId&&(n=n.filter(g=>g.userId===e.userId)),e.action){let g=Array.isArray(e.action)?e.action:[e.action];n=n.filter(x=>g.includes(x.action));}e.resource&&(n=n.filter(g=>g.resource===e.resource)),e.resourceId&&(n=n.filter(g=>g.resourceId===e.resourceId)),e.success!==void 0&&(n=n.filter(g=>g.success===e.success));let a=e.startDate,i=e.endDate;a!==void 0&&(n=n.filter(g=>g.timestamp>=a)),i!==void 0&&(n=n.filter(g=>g.timestamp<=i)),n.sort((g,x)=>x.timestamp.getTime()-g.timestamp.getTime());let c=n.length;return {logs:n.slice(s,s+t),total:c}}async getRecent(e=50){let t=new Date(Date.now()-6048e5);return this.logs.filter(n=>n.timestamp>=t).sort((n,a)=>a.timestamp.getTime()-n.timestamp.getTime()).slice(0,e)}async getUserActivity(e,t=50){return this.logs.filter(n=>n.userId===e).sort((n,a)=>a.timestamp.getTime()-n.timestamp.getTime()).slice(0,t)}async getStats(e,t){let s=e||new Date(Date.now()-2592e6),n=t||new Date,a=this.logs.filter(_=>_.timestamp>=s&&_.timestamp<=n),i={},c=0,d=0,g=0,x=new Set;for(let _ of a){c++;let P=_.action;i[P]=(i[P]||0)+1,_.success&&g++,_.action==="login_failed"&&d++,_.userId&&x.add(_.userId);}return {totalEvents:c,byAction:i,successRate:c>0?g/c:1,failedLogins:d,uniqueUsers:x}}async cleanup(){let e=new Date(Date.now()-this.retentionDays*24*60*60*1e3),t=this.logs.length;return this.logs=this.logs.filter(s=>s.timestamp>=e),t-this.logs.length}cleanupOldLogs(){let e=new Date(Date.now()-this.retentionDays*24*60*60*1e3);this.logs.length;this.logs=this.logs.filter(s=>s.timestamp>=e);}};var So=class{authAdapter;email;passwordPolicy;lockout;rateLimiter;auditLogger;baseUrl;emailVerificationRequired;jwtSecret;constructor(e){this.authAdapter=e.redis,this.email=e.email,this.passwordPolicy=e.passwordPolicy||new r$1,this.lockout=e.lockout,this.rateLimiter=e.rateLimiter,this.auditLogger=e.auditLogger,this.baseUrl=e.baseUrl||"http://localhost:4321",this.emailVerificationRequired=e.emailVerificationRequired??true,this.jwtSecret=e.jwtSecret||"kyro-default-secret-key-change-me-in-production";}getBaseUrl(e){if(e)try{let t=e.headers.get("x-forwarded-proto")||(e.url.startsWith("https")?"https":"http"),s=e.headers.get("x-forwarded-host")||e.headers.get("host");return s?`${t}://${s}`:new URL(e.url).origin}catch{}return process.env.KYRO_BASE_URL||process.env.SERVER_URL||process.env.PUBLIC_URL||process.env.SITE_URL||this.baseUrl||"http://localhost:4321"}async register(e){let{ipAddress:t,userAgent:s}=a$2(e);if(this.rateLimiter){let n=await this.rateLimiter.check("auth:register",t);if(!n.allowed)return this.rateLimitResponse(n)}try{let n=await e.json();if(!n.email||!n.password)return this.errorResponse("Email and password are required",400);if(n.password!==n.confirmPassword)return this.errorResponse("Passwords do not match",400);let a=this.passwordPolicy.validate(n.password);if(!a.valid)return this.errorResponse(a.errors.join(". "),400);let i=await this.authAdapter.findUserByEmail(n.email);if(i){if(!i.emailVerified&&this.emailVerificationRequired&&this.email){let g=(await this.authAdapter.createEmailVerificationToken?.(i.id))?.token||randomBytes(32).toString("hex"),_=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${g}`,P=this.email.getTemplates().verifyEmail(_,n.email);return await this.email.send({to:n.email,...P}),this.jsonResponse({success:!0,message:"An unverified account already exists with this email. We have resent the confirmation link to your inbox.",requiresVerification:!0},200)}return this.errorResponse("Email already registered",400)}let c=await this.authAdapter.createUser({email:n.email,password:n.password,role:n.role||"customer",tenantId:n.tenantId});if(this.emailVerificationRequired&&this.email){let d=randomBytes(32).toString("hex"),x=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${d}`;await this.authAdapter.createSession(c.id,{ipAddress:t,userAgent:s});let _=this.email.getTemplates().verifyEmail(x,n.email);await this.email.send({to:n.email,..._});}return this.auditLogger&&await this.auditLogger.log({action:"register",userId:c.id,userEmail:c.email,resource:"auth",ipAddress:t,userAgent:s,success:!0}),this.jsonResponse({success:!0,message:"Registration successful",user:this.sanitizeUser(c),requiresVerification:this.emailVerificationRequired&&!!this.email},201)}catch(n){return console.error("[AuthRoutes.register] Registration error:",n),this.errorResponse("Registration failed",500)}}async login(e){let{ipAddress:t,userAgent:s}=a$2(e);if(this.rateLimiter){let n=await this.rateLimiter.check("auth:login",t);if(!n.allowed)return this.rateLimitResponse(n)}try{let n=await e.json();if(!n.email||!n.password)return this.errorResponse("Email and password are required",400);let a=await this.authAdapter.findUserByEmail(n.email);if(!a)return await this.recordFailedLogin(t,s),this.errorResponse("Invalid credentials",401);if(a.locked)return this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:a.id,userEmail:a.email,resource:"auth",ipAddress:t,userAgent:s,success:!1,error:"Account locked"}),this.errorResponse("Account locked. Contact an administrator.",403);if(this.lockout){let x=await this.lockout.checkLockout(a.id);if(x.locked)return this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:a.id,userEmail:a.email,resource:"auth",ipAddress:t,userAgent:s,success:!1,error:"Account locked"}),this.errorResponse(`Account locked. Try again in ${Math.ceil((x.lockedUntil.getTime()-Date.now())/6e4)} minutes`,423)}let i=await this.authAdapter.verifyPassword(n.email,n.password);if(!i)return await this.recordFailedLogin(t,s,a.id,a.email),this.errorResponse("Invalid credentials",401);if(this.emailVerificationRequired&&i.emailVerified===!1){if(this.email){let _=(await this.authAdapter.createEmailVerificationToken?.(i.id))?.token||randomBytes(32).toString("hex"),G=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${_}`,q=this.email.getTemplates().verifyEmail(G,i.email);await this.email.send({to:i.email,...q});}return this.errorResponse("Your email address is not verified yet. We have sent a new confirmation link to your email inbox.",403)}this.lockout&&await this.lockout.resetAttempts(a.id),this.auditLogger&&await this.auditLogger.log({action:"login",userId:a.id,userEmail:a.email,role:a.role,resource:"auth",ipAddress:t,userAgent:s,success:!0}),await this.authAdapter.updateUser(a.id,{lastLogin:new Date().toISOString()});let c=await l({id:a.id,email:a.email,role:a.role,tenantId:a.tenantId});if(this.email&&a.email){let x=new Date().toLocaleString(),_=this.email.getTemplates().newLogin(t,x,a.email,void 0,s);this.email.send({to:a.email,..._}).catch(P=>console.error("Failed to send newLogin email:",P));}let d={success:!0,user:this.sanitizeUser(a)},g=this.jsonResponse(d);return j$1(g,c)}catch(n){return console.error("[Auth] Login error:",n),this.errorResponse("Login failed",500)}}async logout(e){let t$1=h(e);if(!t$1)return this.errorResponse("No session to logout",401);let{ipAddress:s,userAgent:n}=a$2(e);try{let a=await t(e);a&&(await p$1(t$1),this.auditLogger&&await this.auditLogger.log({action:"logout",userId:a.userId,userEmail:a.email,resource:"auth",ipAddress:s,userAgent:n,success:!0}));let i=this.jsonResponse({success:!0,message:"Logged out successfully"});return k(i)}catch{return this.errorResponse("Logout failed",500)}}async refresh(e){try{let t=h(e);if(!t)return this.errorResponse("Not authenticated",401);let s=await o$1(t,e);return s?this.jsonResponse({success:!0,expiresAt:s.expiresAt}):this.errorResponse("Session not found",404)}catch(t){return console.error("[Auth] Session refresh error:",t),this.errorResponse("Session refresh failed",500)}}async me(e){let t$1=await t(e);return t$1?this.jsonResponse({success:true,user:{id:t$1.userId,email:t$1.email,role:t$1.role,tenantId:t$1.tenantId}}):this.errorResponse("Not authenticated",401)}async changePassword(e){let t$1=await t(e);if(!t$1)return this.errorResponse("Not authenticated",401);let{ipAddress:s,userAgent:n}=a$2(e);try{let a=await e.json(),{currentPassword:i,newPassword:c,confirmPassword:d}=a;if(!i||!c)return this.errorResponse("Current and new password required",400);if(c!==d)return this.errorResponse("Passwords do not match",400);let g=this.passwordPolicy.validate(c);if(!g.valid)return this.errorResponse(g.errors.join(". "),400);let x=await this.authAdapter.findUserById(t$1.userId);if(!x)return this.errorResponse("User not found",404);if(!(x.passwordHash?await this.authAdapter.verifyPassword(i,x.passwordHash):!1))return this.errorResponse("Current password is incorrect",401);let P=await this.authAdapter.getPasswordHistory?.(x.id,5);if(await this.authAdapter.isPasswordInHistory?.(c,x.id,5))return this.errorResponse("Password was recently used. Please choose a different password",400);let q=await this.authAdapter.hashPassword(c);if(x.passwordHash&&await this.authAdapter.addPasswordToHistory?.(x.id,x.passwordHash),await this.authAdapter.updateUser(x.id,{passwordHash:q}),await this.authAdapter.deleteUserSessions(x.id),this.email&&this.email.getTemplates){let H=this.email.getTemplates().passwordChanged(x.email,void 0,s,n);await this.email.send({to:x.email,...H});}return this.auditLogger&&await this.auditLogger.log({action:"password_change",userId:x.id,userEmail:x.email,resource:"auth",ipAddress:s,userAgent:n,success:!0}),this.jsonResponse({success:!0,message:"Password changed successfully"})}catch{return this.errorResponse("Password change failed",500)}}async forgotPassword(e){let{ipAddress:t,userAgent:s}=a$2(e);if(this.rateLimiter){let n=await this.rateLimiter.check("auth:forgot",t);if(!n.allowed)return this.rateLimitResponse(n)}try{let n=await e.json(),{email:a}=n;if(!a)return this.errorResponse("Email required",400);let i=await this.authAdapter.findUserByEmail(a);if(!i)return this.jsonResponse({success:!0,message:"If the email exists, a reset link has been sent"});if(this.email){let c=randomBytes(32).toString("hex");if(this.authAdapter.createPasswordResetToken){let _=await this.authAdapter.createPasswordResetToken(i.email);_.token&&(c=_.token);}let g=`${this.getBaseUrl(e)}/admin/auth/reset-password?token=${c}`,x=this.email.getTemplates().resetPassword(g,i.email);await this.email.send({to:i.email,...x});}return this.auditLogger&&await this.auditLogger.log({action:"password_reset",userId:i.id,userEmail:i.email,resource:"auth",ipAddress:t,userAgent:s,success:!0}),this.jsonResponse({success:!0,message:"If the email exists, a reset link has been sent"})}catch{return this.errorResponse("Password reset request failed",500)}}async resetPassword(e){let{ipAddress:t,userAgent:s}=a$2(e);if(this.rateLimiter){let n=await this.rateLimiter.check("auth:reset",t);if(!n.allowed)return this.rateLimitResponse(n)}try{let n=await e.json(),{token:a,newPassword:i,confirmPassword:c}=n;if(!a||!i)return this.errorResponse("Reset token and new password are required",400);if(i!==c)return this.errorResponse("Passwords do not match",400);let d=this.passwordPolicy.validate(i);if(!d.valid)return this.errorResponse(d.errors.join(". "),400);if(this.authAdapter.resetPasswordWithToken){let g=await this.authAdapter.resetPasswordWithToken(a,i);if(!g.success)return this.errorResponse(g.error||"Password reset failed or token expired",400)}return this.jsonResponse({success:!0,message:"Password reset successful. You can now log in with your new password."})}catch(n){return console.error("[AuthRoutes.resetPassword] Error:",n),this.errorResponse("Password reset failed",500)}}async verifyEmail(e){let s=new URL(e.url).searchParams.get("token");if(!s)return this.errorResponse("Verification token required",400);try{if(this.authAdapter.verifyEmailToken){let n=await this.authAdapter.verifyEmailToken(s);if(!n.success)return this.errorResponse(n.error||"Invalid or expired verification token",400);if(n.userId&&this.email){let a=await this.authAdapter.findUserById(n.userId);if(a){let i=this.email.getTemplates().welcome(a.email);await this.email.send({to:a.email,...i});}}}return this.jsonResponse({success:!0,message:"Email address verified successfully"})}catch(n){return console.error("[AuthRoutes.verifyEmail] Error:",n),this.errorResponse("Email verification failed",500)}}async recordFailedLogin(e,t,s,n){if(this.lockout){let a=await this.lockout.recordFailedAttempt(s||e);if(a.locked&&a.totalAttempts===this.lockout.getConfig().maxAttempts&&this.email&&n){let i=Math.ceil(this.lockout.getConfig().lockDuration/6e4),c=this.email.getTemplates().accountLocked(a.totalAttempts,i,n,void 0,e,t);this.email.send({to:n,...c}).catch(d=>console.error("Failed to send accountLocked email:",d));}}this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:s,userEmail:n,resource:"auth",ipAddress:e,userAgent:t,success:false,error:"Invalid credentials"});}sanitizeUser(e){let{passwordHash:t,...s}=e;return s}jsonResponse(e,t=200){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":"application/json","Cache-Control":"no-store, no-cache, must-revalidate, max-age=0"}})}async listSessions(e){let t$1=await t(e);if(!t$1)return this.errorResponse("Not authenticated",401);try{let s=await r$2(t$1.userId,h(e)??void 0);return this.jsonResponse({sessions:s})}catch(s){return console.error("[AuthRoutes.listSessions] Error:",s),this.errorResponse("Failed to list sessions",500)}}async revokeSession(e,t$1){let s=await t(e);if(!s)return this.errorResponse("Not authenticated",401);try{let a=(await r$2(s.userId)).find(i=>i.id===t$1);return a?a.currentSession?this.errorResponse("Cannot revoke current session",400):(await p$1(t$1),this.jsonResponse({success:!0,message:"Session revoked"})):this.errorResponse("Session not found",404)}catch(n){return console.error("[AuthRoutes.revokeSession] Error:",n),this.errorResponse("Failed to revoke session",500)}}async revokeOtherSessions(e){let t$1=await t(e);if(!t$1)return this.errorResponse("Not authenticated",401);try{let s=await r$2(t$1.userId),n=h(e);for(let a of s)a.currentSession||await p$1(a.id);return this.jsonResponse({success:!0,message:"Other sessions revoked"})}catch(s){return console.error("[AuthRoutes.revokeOtherSessions] Error:",s),this.errorResponse("Failed to revoke sessions",500)}}async renameSession(e,t$1){let s$1=await t(e);if(!s$1)return this.errorResponse("Not authenticated",401);try{if(!(await r$2(s$1.userId)).find(d=>d.id===t$1))return this.errorResponse("Session not found",404);let i=await e.json(),{name:c}=i;return !c||typeof c!="string"||c.trim().length===0?this.errorResponse("Invalid session name",400):(await s(t$1,c.trim()),this.jsonResponse({success:!0,message:"Session renamed"}))}catch(n){return console.error("[AuthRoutes.renameSession] Error:",n),this.errorResponse("Failed to rename session",500)}}async refreshSession(e){let t=h(e);if(!t)return this.errorResponse("No session",401);try{let{refreshSession:s}=await import('./auth-session-O7IIH7EP.js'),n=await s(t,e);return n?this.jsonResponse({success:!0,expiresAt:n.expiresAt}):this.errorResponse("Session not found",404)}catch(s){return console.error("[AuthRoutes.refreshSession] Error:",s),this.errorResponse("Failed to refresh session",500)}}errorResponse(e,t){return new Response(JSON.stringify({success:false,error:e}),{status:t,headers:{"Content-Type":"application/json"}})}async rateLimitResponse(e){return new Response(JSON.stringify({error:"Too many requests. Please try again later."}),{status:429,headers:{"Content-Type":"application/json",...e.retryAfter?{"Retry-After":e.retryAfter.toString()}:{}}})}async requestMagicLink(e){let{ipAddress:t,userAgent:s}=a$2(e);try{let n=await e.json();if(!n.email)return this.errorResponse("Email required",400);let a=await this.authAdapter.findUserByEmail(n.email);if(!a)return this.jsonResponse({success:!0,message:"If an account exists, a link was sent."});if(this.email){let i=Buffer.from(JSON.stringify({email:a.email,exp:Date.now()+6e5})).toString("base64url"),c=createHmac("sha256",this.jwtSecret).update(i).digest("hex"),d=`${i}.${c}`,x=`${this.getBaseUrl(e)}/admin/auth/magic-link?token=${d}`,_=this.email.getTemplates().magicLink(x,void 0,a.email);this.email.send({to:a.email,..._}).catch(P=>console.error("Magic link err:",P));}return this.jsonResponse({success:!0,message:"If an account exists, a link was sent."})}catch{return this.errorResponse("Failed to process request",500)}}async verifyMagicLink(e){let{ipAddress:t,userAgent:s}=a$2(e),a=new URL(e.url).searchParams.get("token");if(!a)return this.errorResponse("Token required",400);try{let[i,c]=a.split(".");if(!i||!c)return this.errorResponse("Invalid token",400);let d=createHmac("sha256",this.jwtSecret).update(i).digest("hex");if(c!==d)return this.errorResponse("Invalid token",400);let g=JSON.parse(Buffer.from(i,"base64url").toString());if(Date.now()>g.exp)return this.errorResponse("Token expired",400);let x=await this.authAdapter.findUserByEmail(g.email);if(!x)return this.errorResponse("User not found",404);if(x.locked)return this.errorResponse("Account locked",403);let _=await l({id:x.id,email:x.email,role:x.role,tenantId:x.tenantId});this.auditLogger&&await this.auditLogger.log({action:"login",userId:x.id,userEmail:x.email,resource:"auth",ipAddress:t,userAgent:s,success:!0});let P=this.jsonResponse({success:!0,user:this.sanitizeUser(x)});return j$1(P,_)}catch{return this.errorResponse("Invalid token",400)}}async inviteUser(e){try{let t=await e.json();if(!t.email||!t.role)return this.errorResponse("Email and role required",400);let s=await this.authAdapter.findUserByEmail(t.email);if(s)return this.errorResponse("User already exists",409);if(s=await this.authAdapter.createUser({email:t.email,password:randomBytes(16).toString("hex"),role:t.role}),this.email){let n=await this.authAdapter.createPasswordResetToken(s.email),i=`${this.getBaseUrl(e)}/admin/auth/reset-password?token=${n.token}`,c=this.email.getTemplates().userInvite(i,t.role,t.inviterName||"An administrator");this.email.send({to:s.email,...c}).catch(d=>console.error("Invite email err:",d));}return this.jsonResponse({success:!0,message:"User invited successfully"})}catch{return this.errorResponse("Failed to invite user",500)}}};g();var Yc=e(a(),1);var Ao=class{db;sessionTTL;constructor(e){this.db=e.db?.client||e.db,this.sessionTTL=e.sessionTTL||86400;}async executeSql(e,t=[]){try{if(this.db&&typeof this.db.prepare=="function"){let s=this.db.prepare(e);return (await(t.length>0?s.bind(...t):s).all()).results||[]}else if(this.db&&typeof this.db.run=="function"){let s=await this.db.run(J.raw(this.replaceParams(e,t)));return s.rows||s.results||(Array.isArray(s)?s:[])}else if(this.db&&typeof this.db.all=="function"){let s=await this.db.all(J.raw(this.replaceParams(e,t)));return Array.isArray(s)?s:s.results||[]}else if(this.db&&typeof this.db.execute=="function"){let s=await this.db.execute(J.raw(this.replaceParams(e,t)));return s.rows||s.results||(Array.isArray(s)?s:[])}}catch(s){console.warn("[D1AuthAdapter] SQL execution note:",s.message);}return []}async getOne(e,t=[]){try{if(this.db&&typeof this.db.prepare=="function"){let n=this.db.prepare(e);return await(t.length>0?n.bind(...t):n).first()||null}}catch{}let s=await this.executeSql(e,t);return s.length>0?s[0]:null}replaceParams(e,t){let s=0;return e.replace(/\?/g,()=>{let n=t[s++];return n==null?"NULL":typeof n=="number"||typeof n=="boolean"?String(n):`'${String(n).replace(/'/g,"''")}'`})}async connect(){await this.executeSql(`
       CREATE TABLE IF NOT EXISTS users (
         id TEXT PRIMARY KEY,
         email TEXT UNIQUE NOT NULL,
@@ -117,7 +117,7 @@ g();g();g();g();g();g();var Tc=(r,e,t)=>(s,n)=>{let a=-1;return i(0);async funct
 ]))`;continue}}if(t.s&&s[d]==="."){n+=i?`${s[d]}\r
 `:`[${s[d]}\r
 ]`;continue}n+=s[d],s[d]==="\\"?a=true:i&&s[d]==="]"?i=false:!i&&s[d]==="["&&(i=true);}try{new RegExp(n);}catch{return console.warn(`Could not convert regex pattern at ${e.currentPath.join("/")} to a flag-independent form! Falling back to the flag-ignorant source`),r.source}return n}function _c(r,e){if(e.target==="openAi"&&console.warn("Warning: OpenAI may not support records in schemas! Try an array of key-value pairs instead."),e.target==="openApi3"&&r.keyType?._def.typeName===U.ZodEnum)return {type:"object",required:r.keyType._def.values,properties:r.keyType._def.values.reduce((s,n)=>({...s,[n]:re(r.valueType._def,{...e,currentPath:[...e.currentPath,"properties",n]})??$e(e)}),{}),additionalProperties:e.rejectedAdditionalProperties};let t={type:"object",additionalProperties:re(r.valueType._def,{...e,currentPath:[...e.currentPath,"additionalProperties"]})??e.allowedAdditionalProperties};if(e.target==="openApi3")return t;if(r.keyType?._def.typeName===U.ZodString&&r.keyType._def.checks?.length){let{type:s,...n}=xc(r.keyType._def,e);return {...t,propertyNames:n}}else {if(r.keyType?._def.typeName===U.ZodEnum)return {...t,propertyNames:{enum:r.keyType._def.values}};if(r.keyType?._def.typeName===U.ZodBranded&&r.keyType._def.type._def.typeName===U.ZodString&&r.keyType._def.type._def.checks?.length){let{type:s,...n}=yc(r.keyType._def,e);return {...t,propertyNames:n}}}return t}function O_(r,e){if(e.mapStrategy==="record")return _c(r,e);let t=re(r.keyType._def,{...e,currentPath:[...e.currentPath,"items","items","0"]})||$e(e),s=re(r.valueType._def,{...e,currentPath:[...e.currentPath,"items","items","1"]})||$e(e);return {type:"array",maxItems:125,items:{type:"array",items:[t,s],minItems:2,maxItems:2}}}g();function P_(r){let e=r.values,s=Object.keys(r.values).filter(a=>typeof e[e[a]]!="number").map(a=>e[a]),n=Array.from(new Set(s.map(a=>typeof a)));return {type:n.length===1?n[0]==="string"?"string":"number":["string","number"],enum:s}}g();function I_(r){return r.target==="openAi"?void 0:{not:$e({...r,currentPath:[...r.currentPath,"not"]})}}g();function D_(r){return r.target==="openApi3"?{enum:["null"],nullable:true}:{type:"null"}}g();g();var Ja={ZodString:"string",ZodNumber:"number",ZodBigInt:"integer",ZodBoolean:"boolean",ZodNull:"null"};function $_(r,e){if(e.target==="openApi3")return L_(r,e);let t=r.options instanceof Map?Array.from(r.options.values()):r.options;if(t.every(s=>s._def.typeName in Ja&&(!s._def.checks||!s._def.checks.length))){let s=t.reduce((n,a)=>{let i=Ja[a._def.typeName];return i&&!n.includes(i)?[...n,i]:n},[]);return {type:s.length>1?s:s[0]}}else if(t.every(s=>s._def.typeName==="ZodLiteral"&&!s.description)){let s=t.reduce((n,a)=>{let i=typeof a._def.value;switch(i){case "string":case "number":case "boolean":return [...n,i];case "bigint":return [...n,"integer"];case "object":if(a._def.value===null)return [...n,"null"];default:return n}},[]);if(s.length===t.length){let n=s.filter((a,i,c)=>c.indexOf(a)===i);return {type:n.length>1?n:n[0],enum:t.reduce((a,i)=>a.includes(i._def.value)?a:[...a,i._def.value],[])}}}else if(t.every(s=>s._def.typeName==="ZodEnum"))return {type:"string",enum:t.reduce((s,n)=>[...s,...n._def.values.filter(a=>!s.includes(a))],[])};return L_(r,e)}var L_=(r,e)=>{let t=(r.options instanceof Map?Array.from(r.options.values()):r.options).map((s,n)=>re(s._def,{...e,currentPath:[...e.currentPath,"anyOf",`${n}`]})).filter(s=>!!s&&(!e.strictUnions||typeof s=="object"&&Object.keys(s).length>0));return t.length?{anyOf:t}:void 0};function B_(r,e){if(["ZodString","ZodNumber","ZodBigInt","ZodBoolean","ZodNull"].includes(r.innerType._def.typeName)&&(!r.innerType._def.checks||!r.innerType._def.checks.length))return e.target==="openApi3"?{type:Ja[r.innerType._def.typeName],nullable:true}:{type:[Ja[r.innerType._def.typeName],"null"]};if(e.target==="openApi3"){let s=re(r.innerType._def,{...e,currentPath:[...e.currentPath]});return s&&"$ref"in s?{allOf:[s],nullable:true}:s&&{...s,nullable:true}}let t=re(r.innerType._def,{...e,currentPath:[...e.currentPath,"anyOf","0"]});return t&&{anyOf:[t,{type:"null"}]}}g();function j_(r,e){let t={type:"number"};if(!r.checks)return t;for(let s of r.checks)switch(s.kind){case "int":t.type="integer",od(t,"type",s.message,e);break;case "min":e.target==="jsonSchema7"?s.inclusive?he(t,"minimum",s.value,s.message,e):he(t,"exclusiveMinimum",s.value,s.message,e):(s.inclusive||(t.exclusiveMinimum=true),he(t,"minimum",s.value,s.message,e));break;case "max":e.target==="jsonSchema7"?s.inclusive?he(t,"maximum",s.value,s.message,e):he(t,"exclusiveMaximum",s.value,s.message,e):(s.inclusive||(t.exclusiveMaximum=true),he(t,"maximum",s.value,s.message,e));break;case "multipleOf":he(t,"multipleOf",s.value,s.message,e);break}return t}g();function N_(r,e){let t=e.target==="openAi",s={type:"object",properties:{}},n=[],a=r.shape();for(let c in a){let d=a[c];if(d===void 0||d._def===void 0)continue;let g=$B(d);g&&t&&(d._def.typeName==="ZodOptional"&&(d=d._def.innerType),d.isNullable()||(d=d.nullable()),g=false);let x=re(d._def,{...e,currentPath:[...e.currentPath,"properties",c],propertyPath:[...e.currentPath,"properties",c]});x!==void 0&&(s.properties[c]=x,g||n.push(c));}n.length&&(s.required=n);let i=LB(r,e);return i!==void 0&&(s.additionalProperties=i),s}function LB(r,e){if(r.catchall._def.typeName!=="ZodNever")return re(r.catchall._def,{...e,currentPath:[...e.currentPath,"additionalProperties"]});switch(r.unknownKeys){case "passthrough":return e.allowedAdditionalProperties;case "strict":return e.rejectedAdditionalProperties;case "strip":return e.removeAdditionalStrategy==="strict"?e.allowedAdditionalProperties:e.rejectedAdditionalProperties}}function $B(r){try{return r.isOptional()}catch{return  true}}g();var M_=(r,e)=>{if(e.currentPath.toString()===e.propertyPath?.toString())return re(r.innerType._def,e);let t=re(r.innerType._def,{...e,currentPath:[...e.currentPath,"anyOf","1"]});return t?{anyOf:[{not:$e(e)},t]}:$e(e)};g();var U_=(r,e)=>{if(e.pipeStrategy==="input")return re(r.in._def,e);if(e.pipeStrategy==="output")return re(r.out._def,e);let t=re(r.in._def,{...e,currentPath:[...e.currentPath,"allOf","0"]}),s=re(r.out._def,{...e,currentPath:[...e.currentPath,"allOf",t?"1":"0"]});return {allOf:[t,s].filter(n=>n!==void 0)}};g();function q_(r,e){return re(r.type._def,e)}g();function F_(r,e){let s={type:"array",uniqueItems:true,items:re(r.valueType._def,{...e,currentPath:[...e.currentPath,"items"]})};return r.minSize&&he(s,"minItems",r.minSize.value,r.minSize.message,e),r.maxSize&&he(s,"maxItems",r.maxSize.value,r.maxSize.message,e),s}g();function H_(r,e){return r.rest?{type:"array",minItems:r.items.length,items:r.items.map((t,s)=>re(t._def,{...e,currentPath:[...e.currentPath,"items",`${s}`]})).reduce((t,s)=>s===void 0?t:[...t,s],[]),additionalItems:re(r.rest._def,{...e,currentPath:[...e.currentPath,"additionalItems"]})}:{type:"array",minItems:r.items.length,maxItems:r.items.length,items:r.items.map((t,s)=>re(t._def,{...e,currentPath:[...e.currentPath,"items",`${s}`]})).reduce((t,s)=>s===void 0?t:[...t,s],[])}}g();function G_(r){return {not:$e(r)}}g();function z_(r){return $e(r)}g();var K_=(r,e)=>re(r.innerType._def,e);var V_=(r,e,t)=>{switch(e){case U.ZodString:return xc(r,t);case U.ZodNumber:return j_(r,t);case U.ZodObject:return N_(r,t);case U.ZodBigInt:return b_(r,t);case U.ZodBoolean:return v_();case U.ZodDate:return fd(r,t);case U.ZodUndefined:return G_(t);case U.ZodNull:return D_(t);case U.ZodArray:return w_(r,t);case U.ZodUnion:case U.ZodDiscriminatedUnion:return $_(r,t);case U.ZodIntersection:return C_(r,t);case U.ZodTuple:return H_(r,t);case U.ZodRecord:return _c(r,t);case U.ZodLiteral:return E_(r,t);case U.ZodEnum:return k_(r);case U.ZodNativeEnum:return P_(r);case U.ZodNullable:return B_(r,t);case U.ZodOptional:return M_(r,t);case U.ZodMap:return O_(r,t);case U.ZodSet:return F_(r,t);case U.ZodLazy:return ()=>r.getter()._def;case U.ZodPromise:return q_(r,t);case U.ZodNaN:case U.ZodNever:return I_(t);case U.ZodEffects:return R_(r,t);case U.ZodAny:return $e(t);case U.ZodUnknown:return z_(t);case U.ZodDefault:return A_(r,t);case U.ZodBranded:return yc(r,t);case U.ZodReadonly:return K_(r,t);case U.ZodCatch:return S_(r,t);case U.ZodPipeline:return U_(r,t);case U.ZodFunction:case U.ZodVoid:case U.ZodSymbol:return;default:return (s=>{})()}};function re(r,e,t=false){let s=e.seen.get(r);if(e.override){let c=e.override?.(r,e,s,t);if(c!==l_)return c}if(s&&!t){let c=BB(s,e);if(c!==void 0)return c}let n={def:r,path:e.currentPath,jsonSchema:void 0};e.seen.set(r,n);let a=V_(r,r.typeName,e),i=typeof a=="function"?re(a(),e):a;if(i&&jB(r,e,i),e.postProcess){let c=e.postProcess(i,r,e);return n.jsonSchema=i,c}return n.jsonSchema=i,i}var BB=(r,e)=>{switch(e.$refStrategy){case "root":return {$ref:r.path.join("/")};case "relative":return {$ref:mc(e.currentPath,r.path)};case "none":case "seen":return r.path.length<e.currentPath.length&&r.path.every((t,s)=>e.currentPath[s]===t)?(console.warn(`Recursive reference detected at ${e.currentPath.join("/")}! Defaulting to any`),$e(e)):e.$refStrategy==="seen"?$e(e):void 0}},jB=(r,e,t)=>(r.description&&(t.description=r.description,e.markdownDescription&&(t.markdownDescription=r.description)),t);g();g();var Kn=(r,e)=>{let t=p_(e),s=typeof e=="object"&&e.definitions?Object.entries(e.definitions).reduce((d,[g,x])=>({...d,[g]:re(x._def,{...t,currentPath:[...t.basePath,t.definitionPath,g]},true)??$e(t)}),{}):void 0,n=typeof e=="string"?e:e?.nameStrategy==="title"?void 0:e?.name,a=re(r._def,n===void 0?t:{...t,currentPath:[...t.basePath,t.definitionPath,n]},false)??$e(t),i=typeof e=="object"&&e.name!==void 0&&e.nameStrategy==="title"?e.name:void 0;i!==void 0&&(a.title=i),t.flags.hasReferencedOpenAiAnyType&&(s||(s={}),s[t.openAiAnyTypeName]||(s[t.openAiAnyTypeName]={type:["string","number","integer","boolean","array","null"],items:{$ref:t.$refStrategy==="relative"?"1":[...t.basePath,t.definitionPath,t.openAiAnyTypeName].join("/")}}));let c=n===void 0?s?{...a,[t.definitionPath]:s}:a:{$ref:[...t.$refStrategy==="relative"?[]:t.basePath,t.definitionPath,n].join("/"),[t.definitionPath]:{...s,[n]:a}};return t.target==="jsonSchema7"?c.$schema="http://json-schema.org/draft-07/schema#":(t.target==="jsonSchema2019-09"||t.target==="openAi")&&(c.$schema="https://json-schema.org/draft/2019-09/schema#"),t.target==="openAi"&&("anyOf"in c||"oneOf"in c||"allOf"in c||"type"in c&&Array.isArray(c.type))&&console.warn("Warning: OpenAI may not support schemas with unions as roots! Try wrapping it in an object property."),c};var qB={_media:{create:d.MEDIA_UPLOAD,update:d.MEDIA_UPLOAD,delete:d.MEDIA_DELETE}};function Qa(r,e){let t=qB[r];return t?t[e]:`collection.${e}`}function FB(r){let e=r.headers.get("x-forwarded-for");return e?e.split(",")[0].trim():r.headers.get("x-real-ip")||"unknown"}function wc(r,e,t,s,n){e?.apiKeyId&&r&&r.createAuditLog({action:"api_request",userId:e.userId||"",resource:"api_key",resourceId:e.apiKeyId,success:true,metadata:{endpoint:t,method:s,ip:FB(n)}});}function bc(r){return r.baseUpdatedAt??r._baseUpdatedAt}function yd(r){let{baseUpdatedAt:e,_baseUpdatedAt:t,...s}=r;return s}function xd(r,e){return {error:"Document has changed since you started editing",code:"REVISION_CONFLICT",conflict:{expectedUpdatedAt:r??null,actualUpdatedAt:e.updatedAt??null,current:e}}}async function De(r,e,t,s,n,a,i=true,c="none"){return await b$1(r,e,{user:s,req:t,tenantId:n,apiKey:a},{enablePublicAccess:i,defaultAccess:c})}async function er(r,e,t,s,n,a=true){return await c$3(r,e,{user:s,req:t,tenantId:n},{enablePublicAccess:a})}async function W(r,e,t,s){if(t)return {user:t,tenantId:s,apiKeyContext:void 0,authType:"static"};if(e){let n=await e(r);if(n.status===200&&n.user)return {user:n.user,tenantId:n.tenantContext?.tenantId,apiKeyContext:n.apiKeyContext,authType:n.authType}}return {user:void 0,tenantId:void 0,apiKeyContext:void 0,authType:void 0}}async function HB(r,e){if("dialect"in r&&r.dialect==="postgres")return new a$8({db:r.client});if("dialect"in r&&r.dialect==="sqlite")return new Ao({db:r.client});if("dialect"in r&&r.dialect==="mongodb"){let s=r;return new a$9({db:()=>s.db,adapter:s})}let t=resolve(e,"data","auth.db");return new a$a({path:process.env.KYRO_AUTH_DB_PATH||t})}async function X_(r){let{registry:e,db:t,authSecret:s,authAdapter:n,checkSession:a,user:i,tenantId:c,cors:d,webhookService:g,settings:x}=r,_=new Uc;function P(l){if(Array.isArray(l))return l.map(P);if(l!==null&&typeof l=="object"){let y={};for(let b in l)b!=="attrs"&&(y[b]=P(l[b]));return y}return l}_.use("*",async(l,y)=>{await y();let b=l.req.header("referer")||"";if(!(l.req.header("x-kyro-admin")==="true"||b.includes("/admin"))){let f=l.res.headers.get("Content-Type");if(f&&f.includes("application/json"))try{let w=await l.res.clone().json(),C=P(w);l.res=l.json(C,l.res.status);}catch{}}});for(let l of e.getPlugins())typeof l.serverMiddleware=="function"&&l.serverMiddleware(_);let G=x?.access?.apiAccess,q=x?.access?.enablePublicAccess??false,H=x?.access?.defaultCollectionAccess??"none";G?.requireAuth;let se=process.cwd(),Pe=se.endsWith("admin")?resolve(se,".."):se,Z=n||await HB(t,Pe),F=Jm({db:t,userLookup:async l=>await Z.findUserById(l)||null}),Lt=G?.cors?.allowedOrigins,ds=d?.origins,Dr=Array.isArray(Lt)?Lt:typeof Lt=="string"&&Lt?Lt.split(`
-`).map(l=>l.trim()).filter(Boolean):[],He=Dr.length>0?Dr:ds||[];(He.length>0||d)&&_.use("*",async(l,y)=>{let b=l.req.header("Origin")||"*";if(He.length>0&&!He.includes(b))return l.json({error:"Origin not allowed"},403);let R=He.length>0?b:"*";if(l.header("Access-Control-Allow-Origin",R),l.header("Access-Control-Allow-Methods","GET, POST, PATCH, DELETE, OPTIONS"),l.header("Access-Control-Allow-Headers","Content-Type, Authorization, X-API-Key"),d?.credentials&&l.header("Access-Control-Allow-Credentials","true"),l.req.method==="OPTIONS")return l.text("");await y();});let fr=x?.access?.rateLimiting,tr;if(fr?.enabled){let l=fr.maxRequests||100,y=fr.windowMs||6e4;tr=new vo({"api:general":{window:y,max:l}}),_.use("/api/*",async(b,R)=>{if(!tr)return R();let f=b.req.header("CF-Connecting-IP")||b.req.header("X-Forwarded-For")?.split(",")[0]?.trim()||b.req.header("X-Real-IP")||"unknown",p=await tr.check("api:general",f);if(b.header("X-RateLimit-Limit",String(l)),b.header("X-RateLimit-Remaining",String(p.remaining)),b.header("X-RateLimit-Reset",String(p.resetAt)),!p.allowed)return b.json({error:"Too many requests",retryAfter:p.retryAfter},429);await R();});}let we=new So({redis:Z,jwtSecret:s||"change-me",baseUrl:process.env.KYRO_BASE_URL||"http://localhost:4321",rateLimiter:tr});q$1.fromConfig(t).then(l=>{l&&(we.email=l);}).catch(l=>{console.error("[Email] Failed to initialize transport from config:",l);}),_.post("/api/auth/login",async l=>we.login(l.req.raw)),_.post("/api/auth/register",async l=>{try{let y=await t.findOne({collection:"_globals_system",where:{}});if(y&&y.enableRegistration===!1)return l.json({error:"User registration is currently disabled by administrator."},403);if(y?.defaultRegistrationRole){let b=l.req.raw;if((b.headers.get("content-type")||"").includes("application/json")){let f=await l.req.json();f.role||(f.role=y.defaultRegistrationRole);let p=new Request(b.url,{method:b.method,headers:b.headers,body:JSON.stringify(f)});return we.register(p)}}}catch{}return we.register(l.req.raw)}),_.post("/api/auth/logout",async l=>we.logout(l.req.raw)),_.post("/api/auth/refresh",async l=>we.refresh(l.req.raw)),_.get("/api/auth/me",async l=>we.me(l.req.raw)),_.post("/api/auth/forgot-password",async l=>we.forgotPassword(l.req.raw)),_.post("/api/auth/reset-password",async l=>we.resetPassword(l.req.raw)),_.post("/api/auth/change-password",async l=>we.changePassword(l.req.raw)),_.get("/api/auth/verify-email",async l=>we.verifyEmail(l.req.raw)),_.post("/api/auth/verify-email",async l=>we.verifyEmail(l.req.raw)),_.get("/api/auth/verify",async l=>we.verifyEmail(l.req.raw)),_.post("/api/auth/verify",async l=>we.verifyEmail(l.req.raw)),_.post("/api/auth/magic-link",async l=>we.requestMagicLink(l.req.raw)),_.get("/api/auth/magic-link",async l=>we.verifyMagicLink(l.req.raw)),_.post("/api/auth/invite",async l=>we.inviteUser(l.req.raw)),_.get("/api/auth/sessions",async l=>we.listSessions(l.req.raw)),_.post("/api/auth/sessions/refresh",async l=>we.refreshSession(l.req.raw)),_.delete("/api/auth/sessions",async l=>we.revokeOtherSessions(l.req.raw)),_.delete("/api/auth/sessions/:id",async l=>we.revokeSession(l.req.raw,l.req.param("id"))),_.put("/api/auth/sessions/:id/name",async l=>we.renameSession(l.req.raw,l.req.param("id"))),_.get("/api/auth/access",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Not authenticated"},401);let R={},f={};for(let p of e.getCollections()){let w={read:(await De(p,"read",l.req.raw,y,b,void 0,q,H)).allowed,create:(await De(p,"create",l.req.raw,y,b,void 0,q,H)).allowed,update:(await De(p,"update",l.req.raw,y,b,void 0,q,H)).allowed,delete:(await De(p,"delete",l.req.raw,y,b,void 0,q,H)).allowed};R[p.slug]=w;}for(let p of e.getGlobals()){let w={read:(await er(p,"read",l.req.raw,y,b,q)).allowed,update:(await er(p,"update",l.req.raw,y,b,q)).allowed};f[p.slug]=w;}return l.json({collections:R,globals:f})}catch(y){return l.json({error:y.message},500)}});let $t=typeof e.hasCollection=="function"&&e.hasCollection("users")?e.getCollection("users"):(()=>{try{return e.getCollection("users")}catch{return a$4}})();_.get("/api/users",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=await De($t,"read",l.req.raw,y,b,void 0,q,H);if(!R.allowed)return l.json({error:R.error},R.status||403);let f=parseInt(l.req.query("page")||"1"),p=Math.min(parseInt(l.req.query("limit")||"10"),100),w=l.req.query("search")||void 0,C=[],v=0;if(typeof Z.findUsers=="function"){let k=await Z.findUsers({page:f,limit:p,search:w});C=k.users||[],v=k.total||0;}else {let k=await t.find({collection:"users",page:f,limit:p,where:w?{email:{contains:w}}:{},tenantId:b});C=k.docs||[],v=k.totalDocs||0;}return l.json({docs:C,totalDocs:v,limit:p,totalPages:Math.ceil(v/p)||1,page:f,pagingCounter:(f-1)*p+1,hasPrevPage:f>1,hasNextPage:f<Math.ceil(v/p),prevPage:f>1?f-1:null,nextPage:f<Math.ceil(v/p)?f+1:null})}catch(y){return console.error("[API] Error listing users:",y),l.json({error:y.message},500)}}),_.get("/api/users/:id",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=l.req.param("id"),f=await Z.findUserById(R);return f?l.json({data:f}):l.json({error:"User not found"},404)}catch(y){return l.json({error:y.message},500)}}),_.post("/api/users",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=await De($t,"create",l.req.raw,y,b,void 0,q,H);if(!R.allowed)return l.json({error:R.error},R.status||403);let f=await l.req.json();if(!f.email||!f.password)return l.json({error:"Email and password are required"},400);if(await Z.findUserByEmail(f.email))return l.json({error:"Email already in use"},400);let w=f.role||"customer";if(w!=="customer"&&y?.role!=="super_admin")return l.json({error:"Forbidden: Only super_admin can assign administrative roles"},403);let C=await Z.createUser({email:f.email,password:f.password,name:f.name,role:w,avatar:f.avatar,tenantId:f.tenantId});return y&&Z?.createAuditLog({action:"user_create",userId:y.id,resource:"users",resourceId:C.id,success:!0}),l.json({data:C,message:"User created successfully"},201)}catch(y){return l.json({error:y.message},500)}}),_.patch("/api/users/:id",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=await De($t,"update",l.req.raw,y,b,void 0,q,H);if(!R.allowed)return l.json({error:R.error},R.status||403);let f=l.req.param("id"),p=await l.req.json(),w=await Z.findUserById(f);if(!w)return l.json({error:"User not found"},404);let C={};if(p.name!==void 0&&(C.name=p.name),p.email!==void 0&&(C.email=p.email),p.role!==void 0&&p.role!==w.role){if(y?.role!=="super_admin")return l.json({error:"Forbidden: Only super_admin can modify user roles"},403);C.role=p.role;}p.avatar!==void 0&&(C.avatar=typeof p.avatar=="object"&&p.avatar!==null?p.avatar.id||String(p.avatar):p.avatar),p.tenantId!==void 0&&(C.tenantId=p.tenantId),p.emailVerified!==void 0&&(C.emailVerified=p.emailVerified),p.locked!==void 0&&(C.locked=p.locked),p.failedLoginAttempts!==void 0&&(C.failedLoginAttempts=p.failedLoginAttempts),p.lastLogin!==void 0&&(C.lastLogin=p.lastLogin);let v=await Z.updateUser(f,C);return v?(y&&(Z?.createAuditLog({action:"user_update",userId:y.id,resource:"users",resourceId:f,success:!0}),p.role&&w.role!==p.role&&Z?.createAuditLog({action:"role_change",userId:y.id,resource:"users",resourceId:f,success:!0,metadata:{oldRole:w.role,newRole:p.role}})),l.json({data:v,message:"User updated successfully"})):l.json({error:"User update failed"},500)}catch(y){return l.json({error:y.message},500)}}),_.delete("/api/users/:id",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=await De($t,"delete",l.req.raw,y,b,void 0,q,H);if(!R.allowed)return l.json({error:R.error},R.status||403);let f=l.req.param("id");if(y&&y.id===f)return l.json({error:"You cannot delete your own account"},403);let p=await Z.findUserById(f);return p?await Z.deleteUser(f)?(y&&Z?.createAuditLog({action:"user_delete",userId:y.id,resource:"users",resourceId:f,success:!0}),l.json({data:p,message:"User deleted successfully"})):l.json({error:"User deletion failed"},500):l.json({error:"User not found"},404)}catch(y){return l.json({error:y.message},500)}}),_.get("/api/auth/audit-logs",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=e.getCollection("audit_logs");if(R){let D=await De(R,"read",l.req.raw,y,b,void 0,q,H);if(!D.allowed)return l.json({error:D.error},D.status||403)}else if(!y)return l.json({error:"Authentication required"},401);let f=parseInt(l.req.query("page")||"1"),p=Math.min(parseInt(l.req.query("limit")||"50"),100),w=l.req.query("action")||void 0,C=l.req.query("userId")||void 0,v=l.req.query("resource")||void 0,k=await Z.findAuditLogs({action:w,userId:C,resource:v,limit:p,offset:(f-1)*p});return l.json({docs:k.logs,totalDocs:k.total,limit:p,totalPages:Math.ceil(k.total/p),page:f,pagingCounter:(f-1)*p+1,hasPrevPage:f>1,hasNextPage:f<Math.ceil(k.total/p),prevPage:f>1?f-1:null,nextPage:f<Math.ceil(k.total/p)?f+1:null})}catch(y){return console.error("[API] Error listing audit logs:",y),l.json({error:y.message},500)}});let Bt=null,Lr=null,ht=async()=>{if(Lr)throw Lr;if(!Bt)try{let l="sqlite";"dialect"in t&&t.dialect==="postgres"&&t instanceof c$1?l=t.dialect:"dialect"in t&&t.dialect==="mongodb"&&(l="mongodb");let y=l==="postgres"&&t instanceof c$1?t.client:t;Bt=await pc.init(y,{dialect:l});}catch(l){throw console.error("[getMedia] Init error:",l),Lr=l,l}return Bt};_.get("/api/media",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=new URL(l.req.url).origin,f=parseInt(l.req.query("page")||"1"),p=parseInt(l.req.query("limit")||"30"),w=l.req.query("search")||"",C=l.req.query("type")||"",v=l.req.query("folder")||"",k=await b.find({page:f,limit:p,search:w,type:C,folder:v},R);return l.json(k)}catch(y){return console.error("[Media] find error:",y),l.json({error:y.message},500)}}),_.post("/api/media/upload",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.header("content-type")||"",f=new URL(l.req.url).origin;if(R.includes("multipart/form-data")){let k=await l.req.formData(),D=k.get("file"),O=k.get("folder")||"";if(!D)return l.json({error:"No file uploaded"},400);let N=await b.upload(D,O,f);return l.json(N)}let p=await l.req.json(),{url:w}=p,C=p.folder||"";if(!w)return l.json({error:"No URL provided"},400);let v=await b.uploadFromUrl(w,C,f);return l.json(v)}catch(y){return console.error("[Media] upload error:",y),l.json({error:y.message},500)}}),_.get("/api/media/folders",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let R=await(await ht()).listFolders();return l.json(R)}catch(y){return console.error("[Media] folders error:",y),l.json({error:y.message},500)}}),_.post("/api/media/folders",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=await l.req.json(),{name:f,parentPath:p}=R;return f?(await b.createFolder(f,p||""),l.json({message:"Folder created",path:p?`${p}/${f}`:f})):l.json({error:"Folder name is required"},400)}catch(y){return console.error("[Media] create folder error:",y),l.json({error:y.message},500)}}),_.delete("/api/media/folders",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.query("path");return R?(await b.deleteFolder(R),l.json({message:"Folder deleted"})):l.json({error:"Path is required"},400)}catch(y){return console.error("[Media] delete folder error:",y),l.json({error:y.message},500)}}),_.delete("/api/media/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.param("id"),f=new URL(l.req.url).origin;return await b.delete(R,f),l.json({success:!0})}catch(y){return console.error("[Media] delete error:",y),l.json({error:y.message},500)}}),_.get("/api/media/file/:key{.+$}",async l=>{let y=l.req.param("key"),b=globalThis.STORAGE_BUCKET;if(b){let R=await b.get(y);if(!R)return l.notFound();let f=new Headers;return R.writeHttpMetadata(f),f.set("etag",R.httpEtag),new Response(R.body,{headers:f})}return l.notFound()}),_.get("/api/media/resize",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=l.req.query("url"),R=parseInt(l.req.query("w")||"0"),f=parseInt(l.req.query("h")||"0"),p=l.req.query("fit")||"cover",w=parseFloat(l.req.query("cx")||"0"),C=parseFloat(l.req.query("cy")||"0"),v=parseFloat(l.req.query("cw")||"0"),k=parseFloat(l.req.query("ch")||"0");if(!b)return l.json({error:"URL is required"},400);let O=(await ht()).storage;if(O.name!=="local")return l.redirect(b);let N=O.config?.uploadDir||join(process.cwd(),"public","uploads"),B=O.config?.baseUrl||"/uploads";if(!b.startsWith(B))return l.redirect(b);let K=b.replace(B,""),Y=join(N,K);if(!existsSync(Y))return l.json({error:"File not found"},404);let le=readFileSync(Y),{default:J}=await import('sharp'),xe=J(le);if(v>0&&k>0){let Qe=await J(le).metadata(),Zr=Qe.width||0,At=Qe.height||0;if(Zr>0&&At>0){let It=Math.max(0,Math.min(Math.round(w/100*Zr),Zr-1)),Ds=Math.max(0,Math.min(Math.round(C/100*At),At-1)),J_=Math.max(1,Math.min(Math.round(v/100*Zr),Zr-It)),Q_=Math.max(1,Math.min(Math.round(k/100*At),At-Ds));xe=xe.extract({left:It,top:Ds,width:J_,height:Q_});}}(R>0||f>0)&&(xe=xe.resize({width:R>0?R:void 0,height:f>0?f:void 0,fit:p}));let Xe=await xe.toBuffer(),Je=await J(le).metadata();return l.header("Content-Type",`image/${Je.format||"webp"}`),l.header("Cache-Control","public, max-age=31536000, immutable"),l.body(Xe)}catch(y){return console.error("[Media] resize error:",y),l.json({error:y.message},500)}}),_.get("/api/media/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.param("id"),f=new URL(l.req.url).origin,p=await b.findById(R,f);return p?l.json(p):l.json({error:"Media not found"},404)}catch(y){return console.error("[Media] get error:",y),l.json({error:y.message},500)}}),_.patch("/api/media/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.param("id"),f=await l.req.json(),p=new URL(l.req.url).origin,w=["folder","metadata","title","alt","caption","originalName"],C={};for(let v of w)f[v]!==void 0&&(C[v]=f[v]);if(Object.keys(C).length>0){let v=await b.update(R,C,p);return l.json({doc:v})}return l.json({error:"No valid fields to update"},400)}catch(y){return console.error("[Media] update error:",y),l.json({error:y.message},500)}}),_.get("/api/media/test",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht();return l.json({status:b?"initialized":"failed",serviceType:b?.constructor?.name})}catch(y){return console.error("[test] Error:",y),l.json({error:y.message,type:y.constructor?.name,stack:y.stack},500)}}),_.get("/api/storage-status",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=typeof globalThis.STORAGE_BUCKET<"u"||typeof l.env?.STORAGE_BUCKET<"u",R=b,f=b?"cloudflare_r2":"local";if(t)try{let p=t.prepare('SELECT provider FROM "_globals_storage-settings" LIMIT 1').get();p&&p.provider&&(R=!0,f=p.provider==="aws"?"s3":p.provider);}catch{try{let p=await t.findOne({collection:"_globals_storage-settings",where:{},draft:!0});p&&p.provider&&(R=!0,f=p.provider==="aws"?"s3":p.provider);}catch{}}return l.json({provider:f,configured:R,usage:0,limit:"unlimited"})}catch(y){return console.error("[Storage] status error:",y),l.json({error:y.message},500)}}),_.get("/api/plugins",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=e.getPlugins(),R=e.storageProviders,f=await Promise.all(b.map(async p=>{let w=!0,C=p.name,v={};try{let O=await t.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});O&&O.states&&(v=O.states);}catch{}v[C]!==void 0&&(w=v[C]),R.setPluginEnabled(C,w);let k=C.replace(/^@[^/]+\//,"");k=k.replace(/^(plugin|kyro)-/,"");let D={ai:"AI",seo:"SEO",s3:"S3",aws:"AWS",api:"API",ui:"UI",ftp:"FTP"};if(k=k.split("-").map(O=>{let N=O.toLowerCase();return D[N]?D[N]:O.charAt(0).toUpperCase()+O.slice(1)}).join(" "),k.toLowerCase().startsWith("storage ")){let O=k.split(" ");O.length===2&&(k=`${O[1]} Storage`);}return {id:C,name:p.displayName||k,version:p.version||"1.0.0",description:p.description||"",enabled:w,status:w?"active":"disabled"}}));return l.json(f)}catch(y){return console.error("[Plugins] list error:",y),l.json({error:y.message},500)}}),_.put("/api/plugins/:name/toggle",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=l.req.param("name"),R=e.storageProviders,p=!R.isPluginEnabled(b),w=[];if(!p)for(let v of R.getAll())v.pluginName===b&&w.push(v.type);if(!(l.req.query("force")==="1")&&!p&&w.length>0){let v="local";try{let k=t?.prepare?.('SELECT provider FROM "_globals_storage-settings" LIMIT 1')?.get();k?.provider&&(v=k.provider);}catch{try{let k=await t?.findOne?.({collection:"_globals_storage-settings",where:{},draft:!0});k?.provider&&(v=k.provider);}catch{}}if(w.includes(v))return l.json({error:`Cannot disable "${b}" \u2014 storage provider "${v}" is currently active. Switch to Local storage first.`,requiresAction:!0,activeProvider:v},409)}try{let v={},k="global",D=await t.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});D&&(v=D.states||{},k=D.id),v[b]=p,D?await t.update({collection:"_globals_plugin-settings",id:k,data:{states:v}}):await t.create({collection:"_globals_plugin-settings",data:{states:v,id:"global"}});}catch(v){console.warn(`[Plugins] Could not persist state for "${b}":`,v);}return R.setPluginEnabled(b,p),l.json({name:b,enabled:p})}catch(y){return console.error("[Plugins] toggle error:",y),l.json({error:y.message},500)}}),_.get("/api/health",l=>l.json({status:"ok",version:"0.12.57",collections:e.getCollectionSlugs(),timestamp:new Date().toISOString()})),_.get("/api/metrics",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let R=y.role==="admin"||y.role==="super_admin",p=e.getCollectionSlugs().filter(B=>!["users","audit_logs","media","_globals_access-settings","_globals_brand-settings"].includes(B)&&!B.startsWith("_globals_")).filter(B=>R||a$5(y,`${B}:read`)),w=0,C={};await Promise.all(p.map(async B=>{try{let Y=(await t.find({collection:B,where:{},limit:1,page:1,tenantId:b})).totalDocs??0;w+=Y,C[B]=Y;}catch{}}));let v=0;try{v=(await t.find({collection:"media",where:{},limit:1,page:1,tenantId:b})).totalDocs??0;}catch{}let k=0;try{k=(await t.find({collection:"users",where:{},limit:1,page:1,tenantId:b})).totalDocs??0;}catch{}let D=0;try{if(g){let B=await g.getWebhooks();D=Array.isArray(B)?B.length:0;}}catch{}let O=0;try{O=(await t.find({collection:d$1,where:{},limit:1,page:1,tenantId:b})).totalDocs??0;}catch{}let N=w+v+k;return l.json({totalDocuments:w,totalMedia:R||a$5(y,"media:read")?v:void 0,totalUsers:R||a$5(y,"users:read")?k:void 0,totalWebhooks:R?D:void 0,totalApiKeys:R?O:void 0,totalStoredRecords:N,collectionCounts:C,collections:p.length,timestamp:new Date().toISOString()})}catch(y){return console.error("[API] Metrics error:",y),l.json({error:y.message},500)}}),_.get("/api/analytics",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);if(!(y.role==="admin"||y.role==="super_admin"))return l.json({error:"Unauthorized"},403);let p=(await t.find({collection:"orders",where:{},limit:1e3,page:1,tenantId:b})).docs||[],w=await t.findOne({collection:"_globals_store-settings",where:{},tenantId:b}),C=w?.currency?.code||w?.currency||"USD",v={},k={},D={};p.forEach(B=>{let K=B.createdAt||B.updatedAt,Y=K?new Date(K).toISOString().split("T")[0]:new Date().toISOString().split("T")[0];v[Y]||(v[Y]=0),k[Y]||(k[Y]=0);let le=typeof B.total=="number"?B.total:parseFloat(String(B.total||0));v[Y]+=isNaN(le)?0:le,k[Y]+=1;let J=B.orderStatus||B.status||"pending";D[J]=(D[J]||0)+1;});let O=Object.keys(v).sort().map(B=>({date:B,revenue:Math.round(v[B]*100)/100,orders:k[B]})),N=Math.round(O.reduce((B,K)=>B+K.revenue,0)*100)/100;return l.json({chartData:O,totalRevenue:N,totalOrders:p.length,ordersByStatus:D,currencyCode:typeof C=="string"?C:"USD"})}catch(y){return l.json({error:y.message},500)}}),_.get("/api/kyro/schema",async l=>{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=f=>f.map(p=>{let w={name:p.name,type:p.type,label:p.label,required:p.required??false,unique:p.unique??false,indexed:p.indexed??false,defaultValue:p.defaultValue,admin:p.admin?{...p.admin}:void 0};return p.minLength!==void 0&&(w.minLength=p.minLength),p.maxLength!==void 0&&(w.maxLength=p.maxLength),p.pattern!==void 0&&(w.pattern=p.pattern),p.variant!==void 0&&(w.variant=p.variant),p.hasMany!==void 0&&(w.hasMany=p.hasMany),p.min!==void 0&&(w.min=p.min),p.max!==void 0&&(w.max=p.max),p.step!==void 0&&(w.step=p.step),p.integer!==void 0&&(w.integer=p.integer),p.options&&(w.options=p.options),p.relationTo&&(w.relationTo=p.relationTo),p.maxDepth!==void 0&&(w.maxDepth=p.maxDepth),p.minRows!==void 0&&(w.minRows=p.minRows),p.maxRows!==void 0&&(w.maxRows=p.maxRows),p.localized!==void 0&&(w.localized=p.localized),p.language&&(w.language=p.language),p.format&&(w.format=p.format),p.allowedTypes&&(w.allowedTypes=p.allowedTypes),p.maxSize&&(w.maxSize=p.maxSize),(p.type==="group"||p.type==="row"||p.type==="collapsible"&&p.fields)&&(w.fields=b(p.fields)),p.type==="array"&&p.fields&&(w.fields=b(p.fields)),p.type==="blocks"&&p.blocks&&(w.blocks=p.blocks.map(C=>({slug:C.slug,label:C.label,fields:b(C.fields)}))),p.type==="tabs"&&p.tabs&&(w.tabs=p.tabs.map(C=>({label:C.label,name:C.name,fields:b(C.fields)}))),w}),R={collections:{},globals:{}};for(let f of e.getCollections()){let p=f.slug;try{R.collections[p]={slug:p,label:f.label||p,fields:b(f.fields),jsonSchema:Kn(e.getZodSchema(p),{target:"openApi3"}),createSchema:Kn(e.getCreateZodSchema(p),{target:"openApi3"}),updateSchema:Kn(e.getUpdateZodSchema(p),{target:"openApi3"}),procedures:{find:{collection:p,where:"Record<string,any>",sort:"string",limit:"number",page:"number",depth:"number",select:"string[]",draft:"boolean"},findByID:{collection:p,id:"string",depth:"number",select:"string[]",draft:"boolean"},create:{collection:p,data:"Record<string,any>",depth:"number",select:"string[]"},update:{collection:p,id:"string",data:"Record<string,any>",depth:"number",select:"string[]",baseUpdatedAt:"string"},delete:{collection:p,id:"string"},count:{collection:p,where:"Record<string,any>"}}};}catch{}}for(let f of e.getGlobals()){let p=f.slug,w=f.fields;if(p==="storage-settings"){let C=e.storageProviders,v=C.getAll(),k=new Set(C.getAllAvailable(O=>C.isPluginEnabled(O)).map(O=>O.type));k.add("local");let D=new Set(v.map(O=>O.type));w=w.filter(O=>O.type==="group"&&O.name&&D.has(O.name)?k.has(O.name):true).map(O=>O.name==="provider"&&O.type==="select"?{...O,options:O.options.filter(N=>k.has(N.value))}:O);}try{R.globals[p]={slug:p,label:f.label||p,fields:b(w),jsonSchema:Kn(e.getZodSchema(p),{target:"openApi3"}),procedures:{get:{},update:{data:"Record<string,any>"}}};}catch{}}return l.json(R)}),_.get("/api/collections",async l=>{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=e.getCollections().map(R=>({slug:R.slug,label:R.label||R.slug,fields:R.fields.filter(f=>f.name).map(f=>({name:f.name,type:f.type,required:f.required,label:f.label}))}));return l.json(b)});function Vn(l,y,b){if(b in y)return y[b];for(let R of l)if(R.name){if(R.type==="tabs"&&R.tabs){let f=y[R.name];if(f&&typeof f=="object"&&b in f)return f[b]}if((R.type==="group"||R.type==="collapsible")&&R.fields){let f=y[R.name];if(f&&typeof f=="object"){if(b in f)return f[b];let p=Vn(R.fields,f,b);if(p!==void 0)return p}}}}_.get("/api/search",async l=>{try{let y=l.req.query("q")||"",b=l.req.query("collections")||"",R=Math.min(parseInt(l.req.query("limit")||"10"),50);if(!y||y.length<2)return l.json({results:[],message:"Query too short"});let{user:f,tenantId:p}=await W(l.req.raw,F,i,c),w=b?b.split(",").filter(Boolean):e.getCollectionSlugs(),C=[],v=new RegExp(y.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),"i");for(let k of e.getCollections()){if(!w.includes(k.slug)||!(await De(k,"read",l.req.raw,f,p,void 0,q,H)).allowed)continue;let O=k.fields.filter(N=>N.name&&N.name!=="id"&&(N.type==="text"||N.type==="email"||N.type==="textarea"||N.type==="richtext"||N.indexed)&&!N.admin?.hidden).map(N=>N.name);if(O.length!==0)try{let N=O.map(K=>{let Y={};return Y[K]={like:`%${y}%`},Y}),B=await t.find({collection:k.slug,where:{OR:N},limit:R,tenantId:p});await a$6(B.docs,k.fields,t,e,1,0);for(let K of B.docs){let Y=k.admin?.useAsTitle||O.find(J=>J==="title"||J==="name"||J==="heading"||J==="slug"),le=Y?Vn(k.fields,K,Y)??K.id:K.id;C.push({collection:k.slug,label:k.label||k.slug,id:K.id,title:String(le||"Untitled"),doc:K});}}catch(N){console.error(`Search error for ${k.slug}:`,N);}}return C.sort((k,D)=>k.label.localeCompare(D.label)),l.json({results:C})}catch(y){return l.json({error:y.message,results:[]},500)}}),_.get("/api/keys",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);let R=parseInt(l.req.query("page")||"1"),f=Math.min(parseInt(l.req.query("limit")||"50"),100),p=await t.find({collection:d$1,where:{},page:R,limit:f,tenantId:b}),w=(p.docs||[]).map(C=>({id:C.id,name:C.name,keyPrefix:C.keyPrefix,permissions:C.permissions||[],lastUsed:C.lastUsedAt,createdAt:C.createdAt}));return l.json({docs:w,totalDocs:p.totalDocs||w.length,totalPages:p.totalPages||1})}catch(y){return console.error("[ApiKeys] GET error:",y),l.json({error:y.message},500)}}),_.post("/api/keys",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);let b=await l.req.json();if(!b.name||typeof b.name!="string")return l.json({error:"name is required"},400);let R=i$1(),f=await t.create({collection:d$1,data:{userId:y.id,name:b.name,key:R,keyPrefix:j$2(R),permissions:Array.isArray(b.permissions)?b.permissions:["*"],expiresAt:b.expiresAt||null,createdAt:new Date().toISOString()}});return await Z?.createAuditLog({action:"api_key_create",userId:y.id,resource:"api_key",resourceId:f.id,success:!0,metadata:{keyName:b.name}}),l.json({...f,key:R,permissions:Array.isArray(b.permissions)?b.permissions:["*"]},201)}catch(y){return console.error("[ApiKeys] POST error:",y),l.json({error:y.message},500)}}),_.delete("/api/keys/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);let b=l.req.param("id"),R=await t.findByID({collection:d$1,id:b});return R?(await t.delete({collection:d$1,id:b}),await Z?.createAuditLog({action:"api_key_delete",userId:y.id,resource:"api_key",resourceId:b,success:!0,metadata:{keyName:R.name}}),l.json({message:"API key deleted"})):l.json({error:"API key not found"},404)}catch(y){return console.error("[ApiKeys] DELETE error:",y),l.json({error:y.message},500)}}),_.patch("/api/keys/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);let b=l.req.param("id"),R=await l.req.json(),f=await t.findByID({collection:d$1,id:b});if(!f)return l.json({error:"API key not found"},404);let p={};if(typeof R.name=="string"&&R.name.trim()&&(p.name=R.name.trim()),Array.isArray(R.permissions)&&(p.permissions=R.permissions),R.expiresAt!==void 0&&(p.expiresAt=R.expiresAt||null),Object.keys(p).length===0)return l.json({error:"Nothing to update"},400);let w=await t.update({collection:d$1,id:b,data:p});return l.json({...w,keyPrefix:f.keyPrefix})}catch(y){return console.error("[ApiKeys] PATCH error:",y),l.json({error:y.message},500)}}),_.post("/api/keys/:id/rotate",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);let b=l.req.param("id"),R=await t.findByID({collection:d$1,id:b});if(!R)return l.json({error:"API key not found"},404);let f=i$1(),p=await t.update({collection:d$1,id:b,data:{key:f,keyPrefix:j$2(f),lastUsedAt:null}});return await Z?.createAuditLog({action:"api_key_rotate",userId:y.id,resource:"api_key",resourceId:b,success:!0,metadata:{keyName:R.name}}),l.json({...p,key:f,permissions:R.permissions,expiresAt:R.expiresAt})}catch(y){return console.error("[ApiKeys] rotate error:",y),l.json({error:y.message},500)}}),_.get("/api/webhooks/actions",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);let b={generic:{label:"Custom URL",description:"POST to any endpoint with Kyro payload",configFields:[],envVars:[]},"github-push":{label:"GitHub Push",description:"Push an empty commit to simulate a push event",configFields:[{name:"githubOwner",label:"Owner",required:!0,placeholder:"e.g., kyro-dev"},{name:"githubRepo",label:"Repository",required:!0,placeholder:"e.g., my-website"},{name:"githubBranch",label:"Branch",required:!1,placeholder:"main"}],envVars:["GITHUB_TOKEN"]}};return l.json({actions:b})}catch(y){return console.error("[Webhooks] actions error:",y),l.json({error:y.message},500)}}),_.get("/api/webhooks",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=await g.getWebhooks();return l.json({docs:b})}catch(y){return console.error("[Webhooks] GET error:",y),l.json({error:y.message},500)}}),_.post("/api/webhooks",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=await l.req.json(),R=await g.createWebhook(b);return await Z?.createAuditLog({action:"webhook_create",userId:y.id,resource:"webhook",resourceId:R.id,success:!0,metadata:{name:R.name,url:R.url}}),l.json(R,201)}catch(y){return console.error("[Webhooks] POST error:",y),l.json({error:y.message},500)}}),_.get("/api/webhooks/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=await g.getWebhookById(b);return R?l.json(R):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] GET :id error:",y),l.json({error:y.message},500)}}),_.patch("/api/webhooks/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=await l.req.json(),f=await g.updateWebhook(b,R);return f?(await Z?.createAuditLog({action:"webhook_update",userId:y.id,resource:"webhook",resourceId:b,success:!0,metadata:{name:f.name}}),l.json(f)):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] PATCH error:",y),l.json({error:y.message},500)}}),_.delete("/api/webhooks/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=await g.getWebhookById(b);return R?(await g.deleteWebhook(b),await Z?.createAuditLog({action:"webhook_delete",userId:y.id,resource:"webhook",resourceId:b,success:!0,metadata:{name:R.name}}),l.json({message:"Webhook deleted"})):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] DELETE error:",y),l.json({error:y.message},500)}}),_.post("/api/webhooks/:id/test",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=await g.testWebhook(b);return R?l.json(R):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] test error:",y),l.json({error:y.message},500)}}),_.get("/api/webhooks/:id/history",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=Math.min(parseInt(l.req.query("limit")||"50"),100),f=await g.getDeliveryHistory(b,R);return l.json({docs:f})}catch(y){return console.error("[Webhooks] history error:",y),l.json({error:y.message},500)}});function Wn(l){let y={},b=["name","type","required","hasMany","relationTo","options","min","max","minLength","maxLength","defaultValue","label","localized","admin","unique","index","hidden","readOnly","deprecated"];for(let R of b)R in l&&(y[R]=l[R]);return l.fields&&(y.fields=l.fields.map(Wn)),l.tabs&&(y.tabs=l.tabs.map(R=>({label:R.label,name:R.name,fields:R.fields.map(Wn)}))),y}_.get("/api/__schema",async l=>{try{let{user:y,apiKeyContext:b}=await W(l.req.raw,F,i,c);if(!y&&!b)return l.json({error:"Unauthorized"},401);let f=e.getCollections().filter(p=>p.slug!=="users"&&p.slug!=="audit_logs").map(p=>({slug:p.slug,label:p.label,labelPlural:p.labelPlural,singularLabel:p.singularLabel,timestamps:p.timestamps,auth:!!p.auth,tenantScoped:!!p.tenantScoped,upload:p.upload?{staticDir:p.upload.staticDir,imageSizes:p.upload.imageSizes,mimeTypes:p.upload.mimeTypes}:void 0,fields:p.fields.map(Wn)}));return l.json(f)}catch(y){return console.error("[Schema] error:",y),l.json({error:y.message},500)}});let _d=e.getCollections();for(let l of _d){let R=function(f,p){let w=[],C=new Set([...Object.keys(f),...Object.keys(p)]);for(let v of C)v==="id"||v==="createdAt"||v==="updatedAt"||JSON.stringify(f[v])!==JSON.stringify(p[v])&&w.push({field:v,oldValue:v in f?f[v]:void 0,newValue:v in p?p[v]:void 0});return w};let y=l.slug;if(y==="users"||y==="audit_logs")continue;let b=`/api/${y}`;_.post(`${b}/dynamic-options/:fieldName`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"read",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("fieldName"),D=await f.req.json(),{data:O,siblingData:N}=D,B=gs(l.fields,k);if(!B)return f.json({error:"Field not found"},404);if(B.type!=="select")return f.json({error:"Field is not a select field"},400);let K=[];return typeof B.options=="function"?K=await B.options({data:O||{},siblingData:N||{}}):Array.isArray(B.options)&&(K=B.options),f.json({options:K})}catch(p){return f.json({error:p.message},500)}}),_.get(b,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"read",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);w&&t.setTenantContext({tenantId:w,userId:p?.id??"",role:p?.role,isSuperAdmin:p?.role==="super_admin"});let k=new URL(f.req.url),D=parseInt(k.searchParams.get("page")||"1"),O=Math.min(parseInt(k.searchParams.get("limit")||"10"),100),N=k.searchParams.get("sort")||void 0,B=parseInt(k.searchParams.get("depth")||"0"),K=k.searchParams.get("select")?.split(",")||void 0,Y=k.searchParams.get("draft"),le=Y==="true"?!0:Y==="false"?!1:!!p,J={},xe=k.searchParams.get("where");if(xe)try{J=JSON.parse(xe);}catch{return f.json({error:"Invalid JSON in where parameter"},400)}let Xe=await t.find({collection:y,where:J,sort:N,limit:O,page:D,depth:B,tenantId:w,select:K,draft:le});return await a$6(Xe.docs,l.fields,t,e,1,B),f.json(a$7(Xe))}catch(p){return console.error("[API] list error:",p),f.json({error:p.message},500)}}),_.get(`${b}/:id/versions`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"read",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id");if(!k)return f.json({error:"Missing document ID"},400);let D=new URL(f.req.url),O=D.searchParams.get("compareA"),N=D.searchParams.get("compareB");if(wc(Z,C,`${b}/${k}/versions`,"GET",f.req.raw),O&&N){let[le,J]=await Promise.all([t.findVersionByID({collection:y,versionId:O,tenantId:w}),t.findVersionByID({collection:y,versionId:N,tenantId:w})]);if(!le||!J)return f.json({error:"Version not found"},404);let xe=R(le.data,J.data);return f.json({diffs:xe})}let B=parseInt(D.searchParams.get("page")||"1"),K=Math.min(parseInt(D.searchParams.get("limit")||"10"),100),Y=await t.findVersions({collection:y,documentId:k,page:B,limit:K,tenantId:w});return f.json(Y)}catch(p){return console.error("[API] versions error:",p),f.json({error:p.message},500)}}),_.put(`${b}/:id/draft`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id"),D=await f.req.json(),O=bc(D),N=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!N)return f.json({error:"Document not found"},404);let B;D.delta?B={...N,...D.delta}:B=D.data??yd(D);let K=await t.updateLatestVersion({collection:y,documentId:k,data:B,status:"draft",tenantId:w});return p&&Z?.createAuditLog({action:"document_update",userId:p.id,resource:y,resourceId:k,success:!0,metadata:{type:"draft_save"}}),f.json({data:K,message:"Draft saved successfully"})}catch(p){return f.json({error:p.message},500)}}),_.delete(`${b}/:id/draft`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);return v.allowed?(p&&Z?.createAuditLog({action:"document_update",userId:p.id,resource:y,resourceId:f.req.param("id"),success:!0,metadata:{type:"draft_discard"}}),f.json({message:"Draft discarded successfully"})):f.json({error:v.error},v.status||403)}catch(p){return f.json({error:p.message},500)}}),_.get(`${b}/:id`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=new URL(f.req.url),k=v.searchParams.get("draft"),D=v.searchParams.get("kyroToken"),O=!1;if(k==="true"&&D&&s)try{let J=await wo(D,s,"HS256");J&&J.type==="preview"&&J.collection===l.slug&&(O=!0);}catch(J){console.warn("Invalid preview token",J);}if(!O){let J=await De(l,"read",f.req.raw,p,w,C,q,H);if(!J.allowed)return f.json({error:J.error},J.status||403)}let N=f.req.param("id"),B=parseInt(v.searchParams.get("depth")||"0"),K=v.searchParams.get("select")?.split(",")||void 0,Y=k==="true"?!0:k==="false"?!1:!!p,le=await t.findByID({collection:y,id:N,depth:B,tenantId:w,select:K,draft:Y});return !le&&l.fields.some(J=>J.name==="slug")&&(le=await t.findOne({collection:y,where:{slug:N},tenantId:w,draft:Y})),le?(await a$6([le],l.fields,t,e,1,B),f.json({data:a$7(le)})):f.json({error:"Document not found"},404)}catch(p){return f.json({error:p.message},500)}}),_.post(`${b}/preview-url`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await De(l,"read",f.req.raw,p,w);if(!C.allowed)return f.json({error:C.error||"Forbidden"},C.status||403);let v=await f.req.json().catch(()=>({})),k="";s&&(k=await bo({type:"preview",collection:l.slug,id:v.id,exp:Math.floor(Date.now()/1e3)+3600},s,"HS256"));let D="";if(l.admin?.preview){D=await l.admin.preview(v,{req:f.req.raw,token:k});try{let O=new URL(D,"http://localhost");O.searchParams.has("preview")||O.searchParams.set("preview","true"),!O.searchParams.has("kyroToken")&&k&&O.searchParams.set("kyroToken",k),D=D.startsWith("http")?O.toString():`${O.pathname}${O.search}`;}catch{}}else {let O="";try{let B=await t.findOne({collection:"_globals_site-settings",where:{}});B?.siteUrl&&(O=B.siteUrl);}catch{}if(!O)return f.json({error:"No site URL configured in settings, and no custom preview function defined for this collection."},400);O=O.replace(/\/$/,"");let N=v.slug||v.id||"";D=`${O}/${l.slug}/${N}?preview=true&kyroToken=${k}`;}return f.json({url:D})}catch(p){return f.json({error:p.message},500)}}),_.post(b,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"create",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);w&&t.setTenantContext({tenantId:w,userId:p?.id??"",role:p?.role,isSuperAdmin:p?.role==="super_admin"}),wc(Z,C,b,"POST",f.req.raw);let D=await f.req.json();Qr(D,l.fields),Yr(l.fields,D);let O=f.req.raw;if(l.hooks?.beforeValidate)for(let J of l.hooks.beforeValidate){let xe=await J({collection:y,data:D,req:O,user:p,tenantId:w,operation:"create"});xe&&typeof xe=="object"&&!Array.isArray(xe)&&Object.assign(D,xe);}let N=e.getCreateZodSchema(y);try{D=N.parse(D);}catch(J){return f.json({error:`Validation failed: ${sa(J.errors)}`,details:J.errors},400)}l.tenantScoped&&w&&(D.tenantId=w);let B=l.versions?.drafts===!0,K=l.fields.find(J=>J.name==="status"),Y=K?.type==="select"&&Array.isArray(K.options)&&K.options.some(J=>J.value==="published");if(B?D.status="draft":Y&&!D.status&&(D.status="published"),l.hooks?.beforeChange)for(let J of l.hooks.beforeChange){let xe=await J({collection:y,data:D,req:O,user:p,tenantId:w,operation:"create"});xe&&typeof xe=="object"&&!Array.isArray(xe)&&Object.assign(D,xe);}let le=await t.create({collection:y,data:D,tenantId:w});if(B&&await t.createVersion({collection:y,documentId:le.id,data:D,status:"draft",createdBy:p?.id,changeDescription:"Created",tenantId:w}),l.hooks?.afterChange)for(let J of l.hooks.afterChange)await J({collection:y,doc:le,data:D,req:O,user:p,tenantId:w,operation:"create"});return g&&g.trigger(Qa(y,"create"),{collection:y,operation:"create",data:le,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(J=>console.error("[Webhook] Failed to trigger:",J)),p&&Z?.createAuditLog({action:"document_create",userId:p.id,resource:y,resourceId:le.id,success:!0}),f.json({data:le,message:"Created successfully"},201)}catch(p){return p.name==="ZodError"?f.json({error:`Validation failed: ${sa(p.errors)}`,details:p.errors},400):f.json({error:p.message},500)}}),_.patch(`${b}/:id`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id"),D=await f.req.json(),O=bc(D),N=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!N)return f.json({error:"Document not found"},404);if(O&&N.updatedAt&&O!==N.updatedAt)return f.json(xd(O,N),409);let B=Object.fromEntries(Object.entries(yd(D)).filter(([Je,Qe])=>Qe!=="null"&&Qe!==void 0));Qr(B,l.fields),Yr(l.fields,B);let K=f.req.raw;if(l.hooks?.beforeValidate)for(let Je of l.hooks.beforeValidate){let Qe=await Je({collection:y,data:B,originalDoc:N,req:K,user:p,tenantId:w,operation:"update"});Qe&&typeof Qe=="object"&&!Array.isArray(Qe)&&Object.assign(B,Qe);}if(B=e.getUpdateZodSchema(y).parse(B),l.hooks?.beforeChange)for(let Je of l.hooks.beforeChange){let Qe=await Je({collection:y,data:B,originalDoc:N,req:K,user:p,tenantId:w,operation:"update"});Qe&&typeof Qe=="object"&&!Array.isArray(Qe)&&Object.assign(B,Qe);}let le=f.req.header("X-Draft")==="true",J=l.versions?.drafts===!0,xe=f.req.query("autosave")==="true",Xe;if(J&&le)await t.createVersion({collection:y,documentId:k,data:B,status:"draft",autosave:xe,createdBy:p?.id,changeDescription:xe?"Autosave":"Draft saved",tenantId:w});else if(J){let Je=D.status==="draft"?"draft":"published";await t.update({collection:y,id:k,data:{...B,status:Je},tenantId:w}),await t.createVersion({collection:y,documentId:k,data:{...B,status:Je},status:Je,createdBy:p?.id,changeDescription:Je==="published"?"Published":"Unpublished",tenantId:w});}else await t.update({collection:y,id:k,data:B,tenantId:w});if(Xe=await t.findByID({collection:y,id:k,tenantId:w,draft:!0}),l.hooks?.afterChange)for(let Je of l.hooks.afterChange)await Je({collection:y,doc:Xe,data:B,originalDoc:N,req:K,user:p,tenantId:w,operation:"update"});return g&&!xe&&g.trigger(Qa(y,"update"),{collection:y,operation:"update",data:Xe,previousData:N,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(Je=>console.error("[Webhook] Failed to trigger:",Je)),wc(Z,C,`${b}/${k}`,"PATCH",f.req.raw),p&&Z?.createAuditLog({action:"document_update",userId:p.id,resource:y,resourceId:k,success:!0}),f.json({data:Xe,message:J?"Draft saved":"Updated successfully"})}catch(p){return p.name==="ZodError"?(console.error(`[PATCH ${b}/:id] Validation failed:`,p.errors),f.json({error:`Validation failed: ${sa(p.errors)}`,details:p.errors},400)):(console.error(`[PATCH ${b}/:id] ERROR:`,p.message,"CAUSE:",p.cause?.message||p.cause,"QUERY:",p.query),f.json({error:p.message},500))}}),_.delete(`${b}/:id`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"delete",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);w&&t.setTenantContext({tenantId:w,userId:p?.id??"",role:p?.role,isSuperAdmin:p?.role==="super_admin"});let k=f.req.param("id"),D=f.req.raw,O=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!O)return f.json({error:"Document not found"},404);if(l.hooks?.beforeDelete)for(let B of l.hooks.beforeDelete)await B({collection:y,doc:O,req:D,user:p,tenantId:w,operation:"delete"});let N=await t.delete({collection:y,id:k,tenantId:w});if(l.hooks?.afterDelete)for(let B of l.hooks.afterDelete)await B({collection:y,doc:N,originalDoc:O,req:D,user:p,tenantId:w,operation:"delete"});return g&&g.trigger(Qa(y,"delete"),{collection:y,operation:"delete",data:N,previousData:O,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(B=>console.error("[Webhook] Failed to trigger:",B)),wc(Z,C,`${b}/${k}`,"DELETE",f.req.raw),p&&Z?.createAuditLog({action:"document_delete",userId:p.id,resource:y,resourceId:k,success:!0}),f.json({data:N,message:"Deleted successfully"})}catch(p){return console.error(`[DELETE] Error deleting ${y}:`,p),f.json({error:p.message||String(p)},500)}}),_.post(`${b}/:id/duplicate`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"create",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id"),D=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!D)return f.json({error:"Document not found"},404);let{id:O,createdAt:N,updatedAt:B,...K}=D;qs(l.fields,K);let Y=Date.now().toString(36);"slug"in K&&typeof K.slug=="string"&&(K.slug=`${K.slug||"document"}-copy-${Y}`),"title"in K&&typeof K.title=="string"?K.title=`${K.title||"Copy"} (Copy)`:"name"in K&&typeof K.name=="string"&&(K.name=`${K.name||"Copy"} (Copy)`);let le=await t.create({collection:y,data:{...K,status:"draft"},tenantId:w});return f.json({data:le,message:"Document duplicated successfully"})}catch(p){return console.error("[Duplicate] Error:",p),f.json({error:p.message||String(p)},500)}}),_.post(`${b}/:id/versions/:versionId/restore`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id"),D=f.req.param("versionId"),O=await t.findVersionByID({collection:y,versionId:D,tenantId:w});if(!O)return f.json({error:"Version not found"},404);let N=await t.update({collection:y,id:k,data:{...O.data,status:"draft"},tenantId:w});return f.json({data:N,message:"Version restored successfully"})}catch(p){return f.json({error:p.message},500)}}),_.post(`${b}/:id/versions`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=await f.req.json(),{versionId:D,action:O}=k;if(O==="restore"&&D){let N=await t.findVersionByID({collection:y,versionId:D,tenantId:w});if(!N)return f.json({error:"Version not found"},404);let B=await t.update({collection:y,id:f.req.param("id"),data:{...N.data,status:"draft"},tenantId:w});return f.json({data:B,message:"Version restored successfully"})}return f.json({error:"Invalid action"},400)}catch(p){return f.json({error:p.message},500)}}),_.post(`${b}/:id/publish`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);w&&t.setTenantContext({tenantId:w,userId:p?.id??"",role:p?.role,isSuperAdmin:p?.role==="super_admin"});let k=f.req.param("id"),D=await f.req.json().catch(()=>({})),O=bc(D),N=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!N)return f.json({error:"Document not found"},404);if(O&&N.updatedAt&&O!==N.updatedAt)return f.json(xd(O,N),409);let B={status:"published"},K=N;if(l.versions?.drafts){let le=await t.findVersions({collection:y,documentId:k,limit:1,sort:"-createdAt",tenantId:w});if(le.docs.length>0){let J=le.docs[0];K={...N,...J.data},B={...J.data,...B};}}let Y=await t.update({collection:y,id:k,data:B,tenantId:w});return l.versions?.drafts&&await t.createVersion({collection:y,documentId:k,data:{...K,status:"published"},status:"published",createdBy:p?.id,changeDescription:"Published",tenantId:w}),g&&g.trigger(Qa(y,"update"),{collection:y,operation:"update",data:Y,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(le=>console.error("[Webhook] Failed to trigger:",le)),f.json({data:Y,message:"Published successfully"})}catch(p){return f.json({error:p.message},500)}}),_.post(`${b}/:id/unpublish`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id");if(!await t.findByID({collection:y,id:k,tenantId:w,draft:!0}))return f.json({error:"Document not found"},404);let O=await t.update({collection:y,id:k,data:{status:"draft"},tenantId:w});return g&&g.trigger(Qa(y,"update"),{collection:y,operation:"update",data:O,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(N=>console.error("[Webhook] Failed to trigger:",N)),f.json({data:O,message:"Unpublished successfully"})}catch(p){return f.json({error:p.message},500)}});}for(let l of e.getGlobals()){let y=l.slug,b$1=`/api/globals/${y}`;_.post(`${b$1}/dynamic-options/:fieldName`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"read",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},C.status||403);let v=f.req.param("fieldName"),k=await f.req.json(),{data:D,siblingData:O}=k,N=gs(l.fields,v);if(!N)return f.json({error:"Field not found"},404);if(N.type!=="select")return f.json({error:"Field is not a select field"},400);let B=[];return typeof N.options=="function"?B=await N.options({data:D||{},siblingData:O||{}}):Array.isArray(N.options)&&(B=N.options),f.json({options:B})}catch(p){return f.json({error:p.message},500)}}),_.get(b$1,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=new URL(f.req.url),v=C.searchParams.get("kyroToken"),k=C.searchParams.get("draft"),D=!1;if(k==="true"&&v&&s)try{let Y=await wo(v,s,"HS256");Y&&Y.type==="preview"&&Y.collection===`_globals_${l.slug}`&&(D=!0);}catch(Y){console.warn("Invalid preview token",Y);}if(!D){let Y=await er(l,"read",f.req.raw,p,w,q);if(!Y.allowed)return f.json({error:Y.error},Y.status||403)}let O=k==="true"?!0:k==="false"?!1:!!p,N=parseInt(C.searchParams.get("depth")||"0"),K=(await t.find({collection:`_globals_${y}`,where:{},tenantId:w,draft:O,depth:N,limit:1})).docs[0];if(K&&N>0&&await a$6([K],l.fields,t,e,1,N),y==="storage-settings"&&(typeof globalThis.STORAGE_BUCKET<"u"||typeof f.env?.STORAGE_BUCKET<"u")&&(K?K.provider||(K.provider="cloudflare_r2"):K={id:y,provider:"cloudflare_r2"}),y==="system"){let Y=NB.randomBytes(32).toString("hex");K?K.appSecret||(await t.update({collection:`_globals_${y}`,id:y,data:{appSecret:Y},tenantId:w}),K.appSecret=Y):K=await t.create({collection:`_globals_${y}`,data:{id:y,appSecret:Y},tenantId:w});}return f.json({data:K||{}})}catch(p){return f.json({error:p.message},500)}});let R=async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"update",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},C.status||403);let v=new URL(f.req.url),k=parseInt(v.searchParams.get("depth")||"0"),D=await f.req.json(),O=bc(D),N=yd(D),B=Object.fromEntries(Object.entries(N).filter(([It,Ds])=>Ds!==null&&Ds!=="null"&&Ds!==void 0));Qr(B,l.fields),Yr(l.fields,B);let K=e.getUpdateZodSchema(y),Y;try{Y=K.parse(B);}catch(It){return f.json({error:`Validation failed: ${sa(It.errors)}`,details:It.errors},400)}let le=new Set(["id","createdAt","updatedAt","status","baseUpdatedAt","_baseUpdatedAt"]),J=Object.fromEntries(Object.entries(Y).filter(([It])=>!le.has(It))),xe=`_globals_${y}`,Xe=await t.findOne({collection:xe,where:{},tenantId:w,draft:!0});if(Xe&&O&&Xe.updatedAt&&O!==Xe.updatedAt)return f.json(xd(O,Xe),409);let Je=f.req.header("X-Draft")==="true",Qe=l.versions?.drafts===!0,Zr=f.req.query("autosave")==="true",At;if(Qe&&Je)await t.createVersion({collection:xe,documentId:y,data:J,status:"draft",autosave:Zr,createdBy:p?.id,changeDescription:Zr?"Autosave":"Manual save",tenantId:w}),Xe?At=Xe:At=await t.create({collection:xe,data:{...J,id:y,status:"draft"},tenantId:w});else if(Qe&&!Je){let It="published";Xe?At=await t.update({collection:xe,id:y,data:{...J,status:It},tenantId:w}):At=await t.create({collection:xe,data:{...J,id:y,status:It},tenantId:w}),await t.createVersion({collection:xe,documentId:y,data:J,status:It,autosave:!1,createdBy:p?.id,changeDescription:"Published",tenantId:w});}else Xe?At=await t.update({collection:xe,id:y,data:J,tenantId:w}):At=await t.create({collection:xe,data:{...J,id:y},tenantId:w});if(y==="storage-settings"&&(Bt=null,Lr=null),y==="email-settings"){let It=await q$1.fromConfig(t);we.email=It||void 0;}return y==="system"&&await b(),p&&Z?.createAuditLog({action:"settings_change",userId:p.id,resource:`global:${y}`,resourceId:y,success:!0}),At&&k>0&&await a$6([At],l.fields,t,e,1,k),f.json({data:At,message:"Updated successfully"})}catch(p){return console.error(`[API] Save global "${y}" failed:`,p),f.json({error:p.message||"Save failed",stack:process.env.NODE_ENV==="development"?p.stack:void 0},500)}};_.post(b$1,R),_.patch(b$1,R),_.post(`${b$1}/preview-url`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"read",f.req.raw,p,w);if(!C.allowed)return f.json({error:C.error||"Forbidden"},C.status||403);let v=await f.req.json().catch(()=>({})),k="";s&&(k=await bo({type:"preview",collection:`_globals_${l.slug}`,exp:Math.floor(Date.now()/1e3)+3600},s,"HS256"));let D="";if(l.admin?.preview)D=await l.admin.preview(v,{req:f.req.raw,token:k});else {let O="";try{let N=await t.findOne({collection:"_globals_site-settings",where:{}});N?.siteUrl&&(O=N.siteUrl);}catch{}if(!O)return f.json({error:"No site URL configured in settings, and no custom preview function defined."},400);O=O.replace(/\/$/,""),D=`${O}/?preview=true&kyroToken=${k}`;}return f.json({url:D})}catch(p){return f.json({error:p.message},500)}}),_.post(`${b$1}/publish`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"update",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},403);let v=`_globals_${y}`,k=await t.findOne({collection:v,where:{},tenantId:w,draft:!0});if(!k)return f.json({error:"Global not found"},404);let D={status:"published"},O=k;if(l.versions?.drafts){let B=await t.findVersions({collection:v,documentId:y,limit:1,sort:"-createdAt",tenantId:w});B.docs.length>0&&(O={...k,...B.docs[0].data},D={...B.docs[0].data,...D});}let N=await t.update({collection:v,id:y,data:D,tenantId:w});return l.versions?.drafts&&await t.createVersion({collection:v,documentId:y,data:{...O,status:"published"},status:"published",createdBy:p?.id,changeDescription:"Published",tenantId:w}),f.json({data:N,message:"Published successfully"})}catch(p){return f.json({error:p.message},500)}}),_.post(`${b$1}/unpublish`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"update",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},403);let v=await t.update({collection:`_globals_${y}`,id:y,data:{status:"draft"},tenantId:w});return f.json({data:v,message:"Unpublished successfully"})}catch(p){return f.json({error:p.message},500)}}),_.get(`${b$1}/versions`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"read",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},403);let v=parseInt(f.req.query("limit")||"10"),k=parseInt(f.req.query("page")||"1"),D=await t.findVersions({collection:`_globals_${y}`,documentId:y,limit:v,page:k,tenantId:w});return f.json(D)}catch(p){return f.json({error:p.message},500)}}),_.get(`${b$1}/versions/:versionId`,async f=>{try{let p=f.req.param("versionId"),{user:w,tenantId:C}=await W(f.req.raw,F,i,c),v=await er(l,"read",f.req.raw,w,C,q);if(!v.allowed)return f.json({error:v.error},403);let k=await t.findVersionByID({collection:`_globals_${y}`,versionId:p,tenantId:C});return k?f.json({data:k}):f.json({error:"Version not found"},404)}catch(p){return f.json({error:p.message},500)}}),_.post(`${b$1}/versions/:versionId/restore`,async f=>{try{let p=f.req.param("versionId"),{user:w,tenantId:C}=await W(f.req.raw,F,i,c),v=await er(l,"update",f.req.raw,w,C,q);if(!v.allowed)return f.json({error:v.error},403);let k=`_globals_${y}`,D=await t.findVersionByID({collection:k,versionId:p,tenantId:C});if(!D)return f.json({error:"Version not found"},404);let O=await t.update({collection:k,id:y,data:{...D.data,status:"draft"},tenantId:C});return f.json({data:O,message:"Version restored successfully"})}catch(p){return f.json({error:p.message},500)}}),y==="email-settings"&&_.post(`${b$1}/test`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"update",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},C.status||403);let v=await f.req.json(),k={provider:v.provider,from:v.fromEmail||v.from,fromName:v.fromName,replyTo:v.replyTo,smtp:v.smtp?{host:v.smtp.host,port:v.smtp.port,secure:v.smtp.secure,auth:{user:v.smtp.username||v.smtp.user,pass:v.smtp.password||v.smtp.pass}}:void 0,resend:v.resend,sendgrid:v.sendgrid,mailgun:v.mailgun,ses:v.ses},D=new q$1(k),O=v.email||v.testEmail||v.testEmailSection&&v.testEmailSection.testEmail;if(!O)return f.json({error:"No test recipient email provided"},400);let N=v.provider?v.provider.charAt(0).toUpperCase()+v.provider.slice(1):"SMTP",B=v.fromName?`${v.fromName} <${v.fromEmail||v.from||"default"}>`:v.fromEmail||v.from||"Configured Sender",K=new Date().toUTCString();return await D.send({to:O,subject:"Kyro CMS \u2014 Email Connection Test",html:`<!DOCTYPE html>
+`).map(l=>l.trim()).filter(Boolean):[],He=Dr.length>0?Dr:ds||[];(He.length>0||d)&&_.use("*",async(l,y)=>{let b=l.req.header("Origin")||"*";if(He.length>0&&!He.includes(b))return l.json({error:"Origin not allowed"},403);let R=He.length>0?b:"*";if(l.header("Access-Control-Allow-Origin",R),l.header("Access-Control-Allow-Methods","GET, POST, PATCH, DELETE, OPTIONS"),l.header("Access-Control-Allow-Headers","Content-Type, Authorization, X-API-Key"),d?.credentials&&l.header("Access-Control-Allow-Credentials","true"),l.req.method==="OPTIONS")return l.text("");await y();});let fr=x?.access?.rateLimiting,tr;if(fr?.enabled){let l=fr.maxRequests||100,y=fr.windowMs||6e4;tr=new vo({"api:general":{window:y,max:l}}),_.use("/api/*",async(b,R)=>{if(!tr)return R();let f=b.req.header("CF-Connecting-IP")||b.req.header("X-Forwarded-For")?.split(",")[0]?.trim()||b.req.header("X-Real-IP")||"unknown",p=await tr.check("api:general",f);if(b.header("X-RateLimit-Limit",String(l)),b.header("X-RateLimit-Remaining",String(p.remaining)),b.header("X-RateLimit-Reset",String(p.resetAt)),!p.allowed)return b.json({error:"Too many requests",retryAfter:p.retryAfter},429);await R();});}let we=new So({redis:Z,jwtSecret:s||"change-me",baseUrl:process.env.KYRO_BASE_URL||"http://localhost:4321",rateLimiter:tr});q$1.fromConfig(t).then(l=>{l&&(we.email=l);}).catch(l=>{console.error("[Email] Failed to initialize transport from config:",l);}),_.post("/api/auth/login",async l=>we.login(l.req.raw)),_.post("/api/auth/register",async l=>{try{let y=await t.findOne({collection:"_globals_system",where:{}});if(y&&y.enableRegistration===!1)return l.json({error:"User registration is currently disabled by administrator."},403);if(y?.defaultRegistrationRole){let b=l.req.raw;if((b.headers.get("content-type")||"").includes("application/json")){let f=await l.req.json();f.role||(f.role=y.defaultRegistrationRole);let p=new Request(b.url,{method:b.method,headers:b.headers,body:JSON.stringify(f)});return we.register(p)}}}catch{}return we.register(l.req.raw)}),_.post("/api/auth/logout",async l=>we.logout(l.req.raw)),_.post("/api/auth/refresh",async l=>we.refresh(l.req.raw)),_.get("/api/auth/me",async l=>we.me(l.req.raw)),_.post("/api/auth/forgot-password",async l=>we.forgotPassword(l.req.raw)),_.post("/api/auth/reset-password",async l=>we.resetPassword(l.req.raw)),_.post("/api/auth/change-password",async l=>we.changePassword(l.req.raw)),_.get("/api/auth/verify-email",async l=>we.verifyEmail(l.req.raw)),_.post("/api/auth/verify-email",async l=>we.verifyEmail(l.req.raw)),_.get("/api/auth/verify",async l=>we.verifyEmail(l.req.raw)),_.post("/api/auth/verify",async l=>we.verifyEmail(l.req.raw)),_.post("/api/auth/magic-link",async l=>we.requestMagicLink(l.req.raw)),_.get("/api/auth/magic-link",async l=>we.verifyMagicLink(l.req.raw)),_.post("/api/auth/invite",async l=>we.inviteUser(l.req.raw)),_.get("/api/auth/sessions",async l=>we.listSessions(l.req.raw)),_.post("/api/auth/sessions/refresh",async l=>we.refreshSession(l.req.raw)),_.delete("/api/auth/sessions",async l=>we.revokeOtherSessions(l.req.raw)),_.delete("/api/auth/sessions/:id",async l=>we.revokeSession(l.req.raw,l.req.param("id"))),_.put("/api/auth/sessions/:id/name",async l=>we.renameSession(l.req.raw,l.req.param("id"))),_.get("/api/auth/access",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Not authenticated"},401);let R={},f={};for(let p of e.getCollections()){let w={read:(await De(p,"read",l.req.raw,y,b,void 0,q,H)).allowed,create:(await De(p,"create",l.req.raw,y,b,void 0,q,H)).allowed,update:(await De(p,"update",l.req.raw,y,b,void 0,q,H)).allowed,delete:(await De(p,"delete",l.req.raw,y,b,void 0,q,H)).allowed};R[p.slug]=w;}for(let p of e.getGlobals()){let w={read:(await er(p,"read",l.req.raw,y,b,q)).allowed,update:(await er(p,"update",l.req.raw,y,b,q)).allowed};f[p.slug]=w;}return l.json({collections:R,globals:f})}catch(y){return l.json({error:y.message},500)}});let $t=typeof e.hasCollection=="function"&&e.hasCollection("users")?e.getCollection("users"):(()=>{try{return e.getCollection("users")}catch{return a$4}})();_.get("/api/users",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=await De($t,"read",l.req.raw,y,b,void 0,q,H);if(!R.allowed)return l.json({error:R.error},R.status||403);let f=parseInt(l.req.query("page")||"1"),p=Math.min(parseInt(l.req.query("limit")||"10"),100),w=l.req.query("search")||void 0,C=[],v=0;if(typeof Z.findUsers=="function"){let k=await Z.findUsers({page:f,limit:p,search:w});C=k.users||[],v=k.total||0;}else {let k=await t.find({collection:"users",page:f,limit:p,where:w?{email:{contains:w}}:{},tenantId:b});C=k.docs||[],v=k.totalDocs||0;}return l.json({docs:C,totalDocs:v,limit:p,totalPages:Math.ceil(v/p)||1,page:f,pagingCounter:(f-1)*p+1,hasPrevPage:f>1,hasNextPage:f<Math.ceil(v/p),prevPage:f>1?f-1:null,nextPage:f<Math.ceil(v/p)?f+1:null})}catch(y){return console.error("[API] Error listing users:",y),l.json({error:y.message},500)}}),_.get("/api/users/:id",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=l.req.param("id"),f=await Z.findUserById(R);return f?l.json({data:f}):l.json({error:"User not found"},404)}catch(y){return l.json({error:y.message},500)}}),_.post("/api/users",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=await De($t,"create",l.req.raw,y,b,void 0,q,H);if(!R.allowed)return l.json({error:R.error},R.status||403);let f=await l.req.json();if(!f.email||!f.password)return l.json({error:"Email and password are required"},400);if(await Z.findUserByEmail(f.email))return l.json({error:"Email already in use"},400);let w=f.role||"customer";if(w!=="customer"&&y?.role!=="super_admin")return l.json({error:"Forbidden: Only super_admin can assign administrative roles"},403);let C=await Z.createUser({email:f.email,password:f.password,name:f.name,role:w,avatar:f.avatar,tenantId:f.tenantId});return y&&Z?.createAuditLog({action:"user_create",userId:y.id,resource:"users",resourceId:C.id,success:!0}),l.json({data:C,message:"User created successfully"},201)}catch(y){return l.json({error:y.message},500)}}),_.patch("/api/users/:id",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=await De($t,"update",l.req.raw,y,b,void 0,q,H);if(!R.allowed)return l.json({error:R.error},R.status||403);let f=l.req.param("id"),p=await l.req.json(),w=await Z.findUserById(f);if(!w)return l.json({error:"User not found"},404);let C={};if(p.name!==void 0&&(C.name=p.name),p.email!==void 0&&(C.email=p.email),p.role!==void 0&&p.role!==w.role){if(y?.role!=="super_admin")return l.json({error:"Forbidden: Only super_admin can modify user roles"},403);C.role=p.role;}p.avatar!==void 0&&(C.avatar=typeof p.avatar=="object"&&p.avatar!==null?p.avatar.id||String(p.avatar):p.avatar),p.tenantId!==void 0&&(C.tenantId=p.tenantId),p.emailVerified!==void 0&&(C.emailVerified=p.emailVerified),p.locked!==void 0&&(C.locked=p.locked),p.failedLoginAttempts!==void 0&&(C.failedLoginAttempts=p.failedLoginAttempts),p.lastLogin!==void 0&&(C.lastLogin=p.lastLogin);let v=await Z.updateUser(f,C);return v?(y&&(Z?.createAuditLog({action:"user_update",userId:y.id,resource:"users",resourceId:f,success:!0}),p.role&&w.role!==p.role&&Z?.createAuditLog({action:"role_change",userId:y.id,resource:"users",resourceId:f,success:!0,metadata:{oldRole:w.role,newRole:p.role}})),l.json({data:v,message:"User updated successfully"})):l.json({error:"User update failed"},500)}catch(y){return l.json({error:y.message},500)}}),_.delete("/api/users/:id",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=await De($t,"delete",l.req.raw,y,b,void 0,q,H);if(!R.allowed)return l.json({error:R.error},R.status||403);let f=l.req.param("id");if(y&&y.id===f)return l.json({error:"You cannot delete your own account"},403);let p=await Z.findUserById(f);return p?await Z.deleteUser(f)?(y&&Z?.createAuditLog({action:"user_delete",userId:y.id,resource:"users",resourceId:f,success:!0}),l.json({data:p,message:"User deleted successfully"})):l.json({error:"User deletion failed"},500):l.json({error:"User not found"},404)}catch(y){return l.json({error:y.message},500)}}),_.get("/api/auth/audit-logs",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c),R=e.getCollection("audit_logs");if(R){let D=await De(R,"read",l.req.raw,y,b,void 0,q,H);if(!D.allowed)return l.json({error:D.error},D.status||403)}else if(!y)return l.json({error:"Authentication required"},401);let f=parseInt(l.req.query("page")||"1"),p=Math.min(parseInt(l.req.query("limit")||"50"),100),w=l.req.query("action")||void 0,C=l.req.query("userId")||void 0,v=l.req.query("resource")||void 0,k=await Z.findAuditLogs({action:w,userId:C,resource:v,limit:p,offset:(f-1)*p});return l.json({docs:k.logs,totalDocs:k.total,limit:p,totalPages:Math.ceil(k.total/p),page:f,pagingCounter:(f-1)*p+1,hasPrevPage:f>1,hasNextPage:f<Math.ceil(k.total/p),prevPage:f>1?f-1:null,nextPage:f<Math.ceil(k.total/p)?f+1:null})}catch(y){return console.error("[API] Error listing audit logs:",y),l.json({error:y.message},500)}});let Bt=null,Lr=null,ht=async()=>{if(Lr)throw Lr;if(!Bt)try{let l="sqlite";"dialect"in t&&t.dialect==="postgres"&&t instanceof c$1?l=t.dialect:"dialect"in t&&t.dialect==="mongodb"&&(l="mongodb");let y=l==="postgres"&&t instanceof c$1?t.client:t;Bt=await pc.init(y,{dialect:l});}catch(l){throw console.error("[getMedia] Init error:",l),Lr=l,l}return Bt};_.get("/api/media",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=new URL(l.req.url).origin,f=parseInt(l.req.query("page")||"1"),p=parseInt(l.req.query("limit")||"30"),w=l.req.query("search")||"",C=l.req.query("type")||"",v=l.req.query("folder")||"",k=await b.find({page:f,limit:p,search:w,type:C,folder:v},R);return l.json(k)}catch(y){return console.error("[Media] find error:",y),l.json({error:y.message},500)}}),_.post("/api/media/upload",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.header("content-type")||"",f=new URL(l.req.url).origin;if(R.includes("multipart/form-data")){let k=await l.req.formData(),D=k.get("file"),O=k.get("folder")||"";if(!D)return l.json({error:"No file uploaded"},400);let N=await b.upload(D,O,f);return l.json(N)}let p=await l.req.json(),{url:w}=p,C=p.folder||"";if(!w)return l.json({error:"No URL provided"},400);let v=await b.uploadFromUrl(w,C,f);return l.json(v)}catch(y){return console.error("[Media] upload error:",y),l.json({error:y.message},500)}}),_.get("/api/media/folders",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let R=await(await ht()).listFolders();return l.json(R)}catch(y){return console.error("[Media] folders error:",y),l.json({error:y.message},500)}}),_.post("/api/media/folders",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=await l.req.json(),{name:f,parentPath:p}=R;return f?(await b.createFolder(f,p||""),l.json({message:"Folder created",path:p?`${p}/${f}`:f})):l.json({error:"Folder name is required"},400)}catch(y){return console.error("[Media] create folder error:",y),l.json({error:y.message},500)}}),_.delete("/api/media/folders",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.query("path");return R?(await b.deleteFolder(R),l.json({message:"Folder deleted"})):l.json({error:"Path is required"},400)}catch(y){return console.error("[Media] delete folder error:",y),l.json({error:y.message},500)}}),_.delete("/api/media/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.param("id"),f=new URL(l.req.url).origin;return await b.delete(R,f),l.json({success:!0})}catch(y){return console.error("[Media] delete error:",y),l.json({error:y.message},500)}}),_.get("/api/media/file/:key{.+$}",async l=>{let y=l.req.param("key"),b=globalThis.STORAGE_BUCKET;if(b){let R=await b.get(y);if(!R)return l.notFound();let f=new Headers;return R.writeHttpMetadata(f),f.set("etag",R.httpEtag),new Response(R.body,{headers:f})}return l.notFound()}),_.get("/api/media/resize",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=l.req.query("url"),R=parseInt(l.req.query("w")||"0"),f=parseInt(l.req.query("h")||"0"),p=l.req.query("fit")||"cover",w=parseFloat(l.req.query("cx")||"0"),C=parseFloat(l.req.query("cy")||"0"),v=parseFloat(l.req.query("cw")||"0"),k=parseFloat(l.req.query("ch")||"0");if(!b)return l.json({error:"URL is required"},400);let O=(await ht()).storage;if(O.name!=="local")return l.redirect(b);let N=O.config?.uploadDir||join(process.cwd(),"public","uploads"),B=O.config?.baseUrl||"/uploads";if(!b.startsWith(B))return l.redirect(b);let K=b.replace(B,""),Y=join(N,K);if(!existsSync(Y))return l.json({error:"File not found"},404);let le=readFileSync(Y),{default:J}=await import('sharp'),xe=J(le);if(v>0&&k>0){let Qe=await J(le).metadata(),Zr=Qe.width||0,At=Qe.height||0;if(Zr>0&&At>0){let It=Math.max(0,Math.min(Math.round(w/100*Zr),Zr-1)),Ds=Math.max(0,Math.min(Math.round(C/100*At),At-1)),J_=Math.max(1,Math.min(Math.round(v/100*Zr),Zr-It)),Q_=Math.max(1,Math.min(Math.round(k/100*At),At-Ds));xe=xe.extract({left:It,top:Ds,width:J_,height:Q_});}}(R>0||f>0)&&(xe=xe.resize({width:R>0?R:void 0,height:f>0?f:void 0,fit:p}));let Xe=await xe.toBuffer(),Je=await J(le).metadata();return l.header("Content-Type",`image/${Je.format||"webp"}`),l.header("Cache-Control","public, max-age=31536000, immutable"),l.body(Xe)}catch(y){return console.error("[Media] resize error:",y),l.json({error:y.message},500)}}),_.get("/api/media/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.param("id"),f=new URL(l.req.url).origin,p=await b.findById(R,f);return p?l.json(p):l.json({error:"Media not found"},404)}catch(y){return console.error("[Media] get error:",y),l.json({error:y.message},500)}}),_.patch("/api/media/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht(),R=l.req.param("id"),f=await l.req.json(),p=new URL(l.req.url).origin,w=["folder","metadata","title","alt","caption","originalName"],C={};for(let v of w)f[v]!==void 0&&(C[v]=f[v]);if(Object.keys(C).length>0){let v=await b.update(R,C,p);return l.json({doc:v})}return l.json({error:"No valid fields to update"},400)}catch(y){return console.error("[Media] update error:",y),l.json({error:y.message},500)}}),_.get("/api/media/test",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=await ht();return l.json({status:b?"initialized":"failed",serviceType:b?.constructor?.name})}catch(y){return console.error("[test] Error:",y),l.json({error:y.message,type:y.constructor?.name,stack:y.stack},500)}}),_.get("/api/storage-status",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=typeof globalThis.STORAGE_BUCKET<"u"||typeof l.env?.STORAGE_BUCKET<"u",R=b,f=b?"cloudflare_r2":"local";if(t)try{let p=t.prepare('SELECT provider FROM "_globals_storage-settings" LIMIT 1').get();p&&p.provider&&(R=!0,f=p.provider==="aws"?"s3":p.provider);}catch{try{let p=await t.findOne({collection:"_globals_storage-settings",where:{},draft:!0});p&&p.provider&&(R=!0,f=p.provider==="aws"?"s3":p.provider);}catch{}}return l.json({provider:f,configured:R,usage:0,limit:"unlimited"})}catch(y){return console.error("[Storage] status error:",y),l.json({error:y.message},500)}}),_.get("/api/plugins",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=e.getPlugins(),R=e.storageProviders,f=await Promise.all(b.map(async p=>{let w=!0,C=p.name,v={};try{let O=await t.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});O&&O.states&&(v=O.states);}catch{}v[C]!==void 0&&(w=v[C]),R.setPluginEnabled(C,w);let k=C.replace(/^@[^/]+\//,"");k=k.replace(/^(plugin|kyro)-/,"");let D={ai:"AI",seo:"SEO",s3:"S3",aws:"AWS",api:"API",ui:"UI",ftp:"FTP"};if(k=k.split("-").map(O=>{let N=O.toLowerCase();return D[N]?D[N]:O.charAt(0).toUpperCase()+O.slice(1)}).join(" "),k.toLowerCase().startsWith("storage ")){let O=k.split(" ");O.length===2&&(k=`${O[1]} Storage`);}return {id:C,name:p.displayName||k,version:p.version||"1.0.0",description:p.description||"",enabled:w,status:w?"active":"disabled"}}));return l.json(f)}catch(y){return console.error("[Plugins] list error:",y),l.json({error:y.message},500)}}),_.put("/api/plugins/:name/toggle",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=l.req.param("name"),R=e.storageProviders,p=!R.isPluginEnabled(b),w=[];if(!p)for(let v of R.getAll())v.pluginName===b&&w.push(v.type);if(!(l.req.query("force")==="1")&&!p&&w.length>0){let v="local";try{let k=t?.prepare?.('SELECT provider FROM "_globals_storage-settings" LIMIT 1')?.get();k?.provider&&(v=k.provider);}catch{try{let k=await t?.findOne?.({collection:"_globals_storage-settings",where:{},draft:!0});k?.provider&&(v=k.provider);}catch{}}if(w.includes(v))return l.json({error:`Cannot disable "${b}" \u2014 storage provider "${v}" is currently active. Switch to Local storage first.`,requiresAction:!0,activeProvider:v},409)}try{let v={},k="global",D=await t.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});D&&(v=D.states||{},k=D.id),v[b]=p,D?await t.update({collection:"_globals_plugin-settings",id:k,data:{states:v}}):await t.create({collection:"_globals_plugin-settings",data:{states:v,id:"global"}});}catch(v){console.warn(`[Plugins] Could not persist state for "${b}":`,v);}return R.setPluginEnabled(b,p),l.json({name:b,enabled:p})}catch(y){return console.error("[Plugins] toggle error:",y),l.json({error:y.message},500)}}),_.get("/api/health",l=>l.json({status:"ok",version:"0.12.58",collections:e.getCollectionSlugs(),timestamp:new Date().toISOString()})),_.get("/api/metrics",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let R=y.role==="admin"||y.role==="super_admin",p=e.getCollectionSlugs().filter(B=>!["users","audit_logs","media","_globals_access-settings","_globals_brand-settings"].includes(B)&&!B.startsWith("_globals_")).filter(B=>R||a$5(y,`${B}:read`)),w=0,C={};await Promise.all(p.map(async B=>{try{let Y=(await t.find({collection:B,where:{},limit:1,page:1,tenantId:b})).totalDocs??0;w+=Y,C[B]=Y;}catch{}}));let v=0;try{v=(await t.find({collection:"media",where:{},limit:1,page:1,tenantId:b})).totalDocs??0;}catch{}let k=0;try{k=(await t.find({collection:"users",where:{},limit:1,page:1,tenantId:b})).totalDocs??0;}catch{}let D=0;try{if(g){let B=await g.getWebhooks();D=Array.isArray(B)?B.length:0;}}catch{}let O=0;try{O=(await t.find({collection:d$1,where:{},limit:1,page:1,tenantId:b})).totalDocs??0;}catch{}let N=w+v+k;return l.json({totalDocuments:w,totalMedia:R||a$5(y,"media:read")?v:void 0,totalUsers:R||a$5(y,"users:read")?k:void 0,totalWebhooks:R?D:void 0,totalApiKeys:R?O:void 0,totalStoredRecords:N,collectionCounts:C,collections:p.length,timestamp:new Date().toISOString()})}catch(y){return console.error("[API] Metrics error:",y),l.json({error:y.message},500)}}),_.get("/api/analytics",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);if(!(y.role==="admin"||y.role==="super_admin"))return l.json({error:"Unauthorized"},403);let p=(await t.find({collection:"orders",where:{},limit:1e3,page:1,tenantId:b})).docs||[],w=await t.findOne({collection:"_globals_store-settings",where:{},tenantId:b}),C=w?.currency?.code||w?.currency||"USD",v={},k={},D={};p.forEach(B=>{let K=B.createdAt||B.updatedAt,Y=K?new Date(K).toISOString().split("T")[0]:new Date().toISOString().split("T")[0];v[Y]||(v[Y]=0),k[Y]||(k[Y]=0);let le=typeof B.total=="number"?B.total:parseFloat(String(B.total||0));v[Y]+=isNaN(le)?0:le,k[Y]+=1;let J=B.orderStatus||B.status||"pending";D[J]=(D[J]||0)+1;});let O=Object.keys(v).sort().map(B=>({date:B,revenue:Math.round(v[B]*100)/100,orders:k[B]})),N=Math.round(O.reduce((B,K)=>B+K.revenue,0)*100)/100;return l.json({chartData:O,totalRevenue:N,totalOrders:p.length,ordersByStatus:D,currencyCode:typeof C=="string"?C:"USD"})}catch(y){return l.json({error:y.message},500)}}),_.get("/api/kyro/schema",async l=>{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=f=>f.map(p=>{let w={name:p.name,type:p.type,label:p.label,required:p.required??false,unique:p.unique??false,indexed:p.indexed??false,defaultValue:p.defaultValue,admin:p.admin?{...p.admin}:void 0};return p.minLength!==void 0&&(w.minLength=p.minLength),p.maxLength!==void 0&&(w.maxLength=p.maxLength),p.pattern!==void 0&&(w.pattern=p.pattern),p.variant!==void 0&&(w.variant=p.variant),p.hasMany!==void 0&&(w.hasMany=p.hasMany),p.min!==void 0&&(w.min=p.min),p.max!==void 0&&(w.max=p.max),p.step!==void 0&&(w.step=p.step),p.integer!==void 0&&(w.integer=p.integer),p.options&&(w.options=p.options),p.relationTo&&(w.relationTo=p.relationTo),p.maxDepth!==void 0&&(w.maxDepth=p.maxDepth),p.minRows!==void 0&&(w.minRows=p.minRows),p.maxRows!==void 0&&(w.maxRows=p.maxRows),p.localized!==void 0&&(w.localized=p.localized),p.language&&(w.language=p.language),p.format&&(w.format=p.format),p.allowedTypes&&(w.allowedTypes=p.allowedTypes),p.maxSize&&(w.maxSize=p.maxSize),(p.type==="group"||p.type==="row"||p.type==="collapsible"&&p.fields)&&(w.fields=b(p.fields)),p.type==="array"&&p.fields&&(w.fields=b(p.fields)),p.type==="blocks"&&p.blocks&&(w.blocks=p.blocks.map(C=>({slug:C.slug,label:C.label,fields:b(C.fields)}))),p.type==="tabs"&&p.tabs&&(w.tabs=p.tabs.map(C=>({label:C.label,name:C.name,fields:b(C.fields)}))),w}),R={collections:{},globals:{}};for(let f of e.getCollections()){let p=f.slug;try{R.collections[p]={slug:p,label:f.label||p,fields:b(f.fields),jsonSchema:Kn(e.getZodSchema(p),{target:"openApi3"}),createSchema:Kn(e.getCreateZodSchema(p),{target:"openApi3"}),updateSchema:Kn(e.getUpdateZodSchema(p),{target:"openApi3"}),procedures:{find:{collection:p,where:"Record<string,any>",sort:"string",limit:"number",page:"number",depth:"number",select:"string[]",draft:"boolean"},findByID:{collection:p,id:"string",depth:"number",select:"string[]",draft:"boolean"},create:{collection:p,data:"Record<string,any>",depth:"number",select:"string[]"},update:{collection:p,id:"string",data:"Record<string,any>",depth:"number",select:"string[]",baseUpdatedAt:"string"},delete:{collection:p,id:"string"},count:{collection:p,where:"Record<string,any>"}}};}catch{}}for(let f of e.getGlobals()){let p=f.slug,w=f.fields;if(p==="storage-settings"){let C=e.storageProviders,v=C.getAll(),k=new Set(C.getAllAvailable(O=>C.isPluginEnabled(O)).map(O=>O.type));k.add("local");let D=new Set(v.map(O=>O.type));w=w.filter(O=>O.type==="group"&&O.name&&D.has(O.name)?k.has(O.name):true).map(O=>O.name==="provider"&&O.type==="select"?{...O,options:O.options.filter(N=>k.has(N.value))}:O);}try{R.globals[p]={slug:p,label:f.label||p,fields:b(w),jsonSchema:Kn(e.getZodSchema(p),{target:"openApi3"}),procedures:{get:{},update:{data:"Record<string,any>"}}};}catch{}}return l.json(R)}),_.get("/api/collections",async l=>{let{user:y}=await W(l.req.raw,F,i,c);if(!y)return l.json({error:"Authentication required"},401);let b=e.getCollections().map(R=>({slug:R.slug,label:R.label||R.slug,fields:R.fields.filter(f=>f.name).map(f=>({name:f.name,type:f.type,required:f.required,label:f.label}))}));return l.json(b)});function Vn(l,y,b){if(b in y)return y[b];for(let R of l)if(R.name){if(R.type==="tabs"&&R.tabs){let f=y[R.name];if(f&&typeof f=="object"&&b in f)return f[b]}if((R.type==="group"||R.type==="collapsible")&&R.fields){let f=y[R.name];if(f&&typeof f=="object"){if(b in f)return f[b];let p=Vn(R.fields,f,b);if(p!==void 0)return p}}}}_.get("/api/search",async l=>{try{let y=l.req.query("q")||"",b=l.req.query("collections")||"",R=Math.min(parseInt(l.req.query("limit")||"10"),50);if(!y||y.length<2)return l.json({results:[],message:"Query too short"});let{user:f,tenantId:p}=await W(l.req.raw,F,i,c),w=b?b.split(",").filter(Boolean):e.getCollectionSlugs(),C=[],v=new RegExp(y.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),"i");for(let k of e.getCollections()){if(!w.includes(k.slug)||!(await De(k,"read",l.req.raw,f,p,void 0,q,H)).allowed)continue;let O=k.fields.filter(N=>N.name&&N.name!=="id"&&(N.type==="text"||N.type==="email"||N.type==="textarea"||N.type==="richtext"||N.indexed)&&!N.admin?.hidden).map(N=>N.name);if(O.length!==0)try{let N=O.map(K=>{let Y={};return Y[K]={like:`%${y}%`},Y}),B=await t.find({collection:k.slug,where:{OR:N},limit:R,tenantId:p});await a$6(B.docs,k.fields,t,e,1,0);for(let K of B.docs){let Y=k.admin?.useAsTitle||O.find(J=>J==="title"||J==="name"||J==="heading"||J==="slug"),le=Y?Vn(k.fields,K,Y)??K.id:K.id;C.push({collection:k.slug,label:k.label||k.slug,id:K.id,title:String(le||"Untitled"),doc:K});}}catch(N){console.error(`Search error for ${k.slug}:`,N);}}return C.sort((k,D)=>k.label.localeCompare(D.label)),l.json({results:C})}catch(y){return l.json({error:y.message,results:[]},500)}}),_.get("/api/keys",async l=>{try{let{user:y,tenantId:b}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);let R=parseInt(l.req.query("page")||"1"),f=Math.min(parseInt(l.req.query("limit")||"50"),100),p=await t.find({collection:d$1,where:{},page:R,limit:f,tenantId:b}),w=(p.docs||[]).map(C=>({id:C.id,name:C.name,keyPrefix:C.keyPrefix,permissions:C.permissions||[],lastUsed:C.lastUsedAt,createdAt:C.createdAt}));return l.json({docs:w,totalDocs:p.totalDocs||w.length,totalPages:p.totalPages||1})}catch(y){return console.error("[ApiKeys] GET error:",y),l.json({error:y.message},500)}}),_.post("/api/keys",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);let b=await l.req.json();if(!b.name||typeof b.name!="string")return l.json({error:"name is required"},400);let R=i$1(),f=await t.create({collection:d$1,data:{userId:y.id,name:b.name,key:R,keyPrefix:j$2(R),permissions:Array.isArray(b.permissions)?b.permissions:["*"],expiresAt:b.expiresAt||null,createdAt:new Date().toISOString()}});return await Z?.createAuditLog({action:"api_key_create",userId:y.id,resource:"api_key",resourceId:f.id,success:!0,metadata:{keyName:b.name}}),l.json({...f,key:R,permissions:Array.isArray(b.permissions)?b.permissions:["*"]},201)}catch(y){return console.error("[ApiKeys] POST error:",y),l.json({error:y.message},500)}}),_.delete("/api/keys/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);let b=l.req.param("id"),R=await t.findByID({collection:d$1,id:b});return R?(await t.delete({collection:d$1,id:b}),await Z?.createAuditLog({action:"api_key_delete",userId:y.id,resource:"api_key",resourceId:b,success:!0,metadata:{keyName:R.name}}),l.json({message:"API key deleted"})):l.json({error:"API key not found"},404)}catch(y){return console.error("[ApiKeys] DELETE error:",y),l.json({error:y.message},500)}}),_.patch("/api/keys/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);let b=l.req.param("id"),R=await l.req.json(),f=await t.findByID({collection:d$1,id:b});if(!f)return l.json({error:"API key not found"},404);let p={};if(typeof R.name=="string"&&R.name.trim()&&(p.name=R.name.trim()),Array.isArray(R.permissions)&&(p.permissions=R.permissions),R.expiresAt!==void 0&&(p.expiresAt=R.expiresAt||null),Object.keys(p).length===0)return l.json({error:"Nothing to update"},400);let w=await t.update({collection:d$1,id:b,data:p});return l.json({...w,keyPrefix:f.keyPrefix})}catch(y){return console.error("[ApiKeys] PATCH error:",y),l.json({error:y.message},500)}}),_.post("/api/keys/:id/rotate",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);let b=l.req.param("id"),R=await t.findByID({collection:d$1,id:b});if(!R)return l.json({error:"API key not found"},404);let f=i$1(),p=await t.update({collection:d$1,id:b,data:{key:f,keyPrefix:j$2(f),lastUsedAt:null}});return await Z?.createAuditLog({action:"api_key_rotate",userId:y.id,resource:"api_key",resourceId:b,success:!0,metadata:{keyName:R.name}}),l.json({...p,key:f,permissions:R.permissions,expiresAt:R.expiresAt})}catch(y){return console.error("[ApiKeys] rotate error:",y),l.json({error:y.message},500)}}),_.get("/api/webhooks/actions",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);let b={generic:{label:"Custom URL",description:"POST to any endpoint with Kyro payload",configFields:[],envVars:[]},"github-push":{label:"GitHub Push",description:"Push an empty commit to simulate a push event",configFields:[{name:"githubOwner",label:"Owner",required:!0,placeholder:"e.g., kyro-dev"},{name:"githubRepo",label:"Repository",required:!0,placeholder:"e.g., my-website"},{name:"githubBranch",label:"Branch",required:!1,placeholder:"main"}],envVars:["GITHUB_TOKEN"]}};return l.json({actions:b})}catch(y){return console.error("[Webhooks] actions error:",y),l.json({error:y.message},500)}}),_.get("/api/webhooks",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=await g.getWebhooks();return l.json({docs:b})}catch(y){return console.error("[Webhooks] GET error:",y),l.json({error:y.message},500)}}),_.post("/api/webhooks",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=await l.req.json(),R=await g.createWebhook(b);return await Z?.createAuditLog({action:"webhook_create",userId:y.id,resource:"webhook",resourceId:R.id,success:!0,metadata:{name:R.name,url:R.url}}),l.json(R,201)}catch(y){return console.error("[Webhooks] POST error:",y),l.json({error:y.message},500)}}),_.get("/api/webhooks/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=await g.getWebhookById(b);return R?l.json(R):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] GET :id error:",y),l.json({error:y.message},500)}}),_.patch("/api/webhooks/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=await l.req.json(),f=await g.updateWebhook(b,R);return f?(await Z?.createAuditLog({action:"webhook_update",userId:y.id,resource:"webhook",resourceId:b,success:!0,metadata:{name:f.name}}),l.json(f)):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] PATCH error:",y),l.json({error:y.message},500)}}),_.delete("/api/webhooks/:id",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=await g.getWebhookById(b);return R?(await g.deleteWebhook(b),await Z?.createAuditLog({action:"webhook_delete",userId:y.id,resource:"webhook",resourceId:b,success:!0,metadata:{name:R.name}}),l.json({message:"Webhook deleted"})):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] DELETE error:",y),l.json({error:y.message},500)}}),_.post("/api/webhooks/:id/test",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:admin"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=await g.testWebhook(b);return R?l.json(R):l.json({error:"Webhook not found"},404)}catch(y){return console.error("[Webhooks] test error:",y),l.json({error:y.message},500)}}),_.get("/api/webhooks/:id/history",async l=>{try{let{user:y}=await W(l.req.raw,F,i,c);if(!y||!a$5(y,"users:read"))return l.json({error:"Forbidden"},403);if(!g)return l.json({error:"Webhook service not available"},503);let b=l.req.param("id"),R=Math.min(parseInt(l.req.query("limit")||"50"),100),f=await g.getDeliveryHistory(b,R);return l.json({docs:f})}catch(y){return console.error("[Webhooks] history error:",y),l.json({error:y.message},500)}});function Wn(l){let y={},b=["name","type","required","hasMany","relationTo","options","min","max","minLength","maxLength","defaultValue","label","localized","admin","unique","index","hidden","readOnly","deprecated"];for(let R of b)R in l&&(y[R]=l[R]);return l.fields&&(y.fields=l.fields.map(Wn)),l.tabs&&(y.tabs=l.tabs.map(R=>({label:R.label,name:R.name,fields:R.fields.map(Wn)}))),y}_.get("/api/__schema",async l=>{try{let{user:y,apiKeyContext:b}=await W(l.req.raw,F,i,c);if(!y&&!b)return l.json({error:"Unauthorized"},401);let f=e.getCollections().filter(p=>p.slug!=="users"&&p.slug!=="audit_logs").map(p=>({slug:p.slug,label:p.label,labelPlural:p.labelPlural,singularLabel:p.singularLabel,timestamps:p.timestamps,auth:!!p.auth,tenantScoped:!!p.tenantScoped,upload:p.upload?{staticDir:p.upload.staticDir,imageSizes:p.upload.imageSizes,mimeTypes:p.upload.mimeTypes}:void 0,fields:p.fields.map(Wn)}));return l.json(f)}catch(y){return console.error("[Schema] error:",y),l.json({error:y.message},500)}});let _d=e.getCollections();for(let l of _d){let R=function(f,p){let w=[],C=new Set([...Object.keys(f),...Object.keys(p)]);for(let v of C)v==="id"||v==="createdAt"||v==="updatedAt"||JSON.stringify(f[v])!==JSON.stringify(p[v])&&w.push({field:v,oldValue:v in f?f[v]:void 0,newValue:v in p?p[v]:void 0});return w};let y=l.slug;if(y==="users"||y==="audit_logs")continue;let b=`/api/${y}`;_.post(`${b}/dynamic-options/:fieldName`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"read",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("fieldName"),D=await f.req.json(),{data:O,siblingData:N}=D,B=gs(l.fields,k);if(!B)return f.json({error:"Field not found"},404);if(B.type!=="select")return f.json({error:"Field is not a select field"},400);let K=[];return typeof B.options=="function"?K=await B.options({data:O||{},siblingData:N||{}}):Array.isArray(B.options)&&(K=B.options),f.json({options:K})}catch(p){return f.json({error:p.message},500)}}),_.get(b,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"read",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);w&&t.setTenantContext({tenantId:w,userId:p?.id??"",role:p?.role,isSuperAdmin:p?.role==="super_admin"});let k=new URL(f.req.url),D=parseInt(k.searchParams.get("page")||"1"),O=Math.min(parseInt(k.searchParams.get("limit")||"10"),100),N=k.searchParams.get("sort")||void 0,B=parseInt(k.searchParams.get("depth")||"0"),K=k.searchParams.get("select")?.split(",")||void 0,Y=k.searchParams.get("draft"),le=Y==="true"?!0:Y==="false"?!1:!!p,J={},xe=k.searchParams.get("where");if(xe)try{J=JSON.parse(xe);}catch{return f.json({error:"Invalid JSON in where parameter"},400)}let Xe=await t.find({collection:y,where:J,sort:N,limit:O,page:D,depth:B,tenantId:w,select:K,draft:le});return await a$6(Xe.docs,l.fields,t,e,1,B),f.json(a$7(Xe))}catch(p){return console.error("[API] list error:",p),f.json({error:p.message},500)}}),_.get(`${b}/:id/versions`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"read",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id");if(!k)return f.json({error:"Missing document ID"},400);let D=new URL(f.req.url),O=D.searchParams.get("compareA"),N=D.searchParams.get("compareB");if(wc(Z,C,`${b}/${k}/versions`,"GET",f.req.raw),O&&N){let[le,J]=await Promise.all([t.findVersionByID({collection:y,versionId:O,tenantId:w}),t.findVersionByID({collection:y,versionId:N,tenantId:w})]);if(!le||!J)return f.json({error:"Version not found"},404);let xe=R(le.data,J.data);return f.json({diffs:xe})}let B=parseInt(D.searchParams.get("page")||"1"),K=Math.min(parseInt(D.searchParams.get("limit")||"10"),100),Y=await t.findVersions({collection:y,documentId:k,page:B,limit:K,tenantId:w});return f.json(Y)}catch(p){return console.error("[API] versions error:",p),f.json({error:p.message},500)}}),_.put(`${b}/:id/draft`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id"),D=await f.req.json(),O=bc(D),N=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!N)return f.json({error:"Document not found"},404);let B;D.delta?B={...N,...D.delta}:B=D.data??yd(D);let K=await t.updateLatestVersion({collection:y,documentId:k,data:B,status:"draft",tenantId:w});return p&&Z?.createAuditLog({action:"document_update",userId:p.id,resource:y,resourceId:k,success:!0,metadata:{type:"draft_save"}}),f.json({data:K,message:"Draft saved successfully"})}catch(p){return f.json({error:p.message},500)}}),_.delete(`${b}/:id/draft`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);return v.allowed?(p&&Z?.createAuditLog({action:"document_update",userId:p.id,resource:y,resourceId:f.req.param("id"),success:!0,metadata:{type:"draft_discard"}}),f.json({message:"Draft discarded successfully"})):f.json({error:v.error},v.status||403)}catch(p){return f.json({error:p.message},500)}}),_.get(`${b}/:id`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=new URL(f.req.url),k=v.searchParams.get("draft"),D=v.searchParams.get("kyroToken"),O=!1;if(k==="true"&&D&&s)try{let J=await wo(D,s,"HS256");J&&J.type==="preview"&&J.collection===l.slug&&(O=!0);}catch(J){console.warn("Invalid preview token",J);}if(!O){let J=await De(l,"read",f.req.raw,p,w,C,q,H);if(!J.allowed)return f.json({error:J.error},J.status||403)}let N=f.req.param("id"),B=parseInt(v.searchParams.get("depth")||"0"),K=v.searchParams.get("select")?.split(",")||void 0,Y=k==="true"?!0:k==="false"?!1:!!p,le=await t.findByID({collection:y,id:N,depth:B,tenantId:w,select:K,draft:Y});return !le&&l.fields.some(J=>J.name==="slug")&&(le=await t.findOne({collection:y,where:{slug:N},tenantId:w,draft:Y})),le?(await a$6([le],l.fields,t,e,1,B),f.json({data:a$7(le)})):f.json({error:"Document not found"},404)}catch(p){return f.json({error:p.message},500)}}),_.post(`${b}/preview-url`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await De(l,"read",f.req.raw,p,w);if(!C.allowed)return f.json({error:C.error||"Forbidden"},C.status||403);let v=await f.req.json().catch(()=>({})),k="";s&&(k=await bo({type:"preview",collection:l.slug,id:v.id,exp:Math.floor(Date.now()/1e3)+3600},s,"HS256"));let D="";if(l.admin?.preview){D=await l.admin.preview(v,{req:f.req.raw,token:k});try{let O=new URL(D,"http://localhost");O.searchParams.has("preview")||O.searchParams.set("preview","true"),!O.searchParams.has("kyroToken")&&k&&O.searchParams.set("kyroToken",k),D=D.startsWith("http")?O.toString():`${O.pathname}${O.search}`;}catch{}}else {let O="";try{let B=await t.findOne({collection:"_globals_site-settings",where:{}});B?.siteUrl&&(O=B.siteUrl);}catch{}if(!O)return f.json({error:"No site URL configured in settings, and no custom preview function defined for this collection."},400);O=O.replace(/\/$/,"");let N=v.slug||v.id||"";D=`${O}/${l.slug}/${N}?preview=true&kyroToken=${k}`;}return f.json({url:D})}catch(p){return f.json({error:p.message},500)}}),_.post(b,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"create",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);w&&t.setTenantContext({tenantId:w,userId:p?.id??"",role:p?.role,isSuperAdmin:p?.role==="super_admin"}),wc(Z,C,b,"POST",f.req.raw);let D=await f.req.json();Qr(D,l.fields),Yr(l.fields,D);let O=f.req.raw;if(l.hooks?.beforeValidate)for(let J of l.hooks.beforeValidate){let xe=await J({collection:y,data:D,req:O,user:p,tenantId:w,operation:"create"});xe&&typeof xe=="object"&&!Array.isArray(xe)&&Object.assign(D,xe);}let N=e.getCreateZodSchema(y);try{D=N.parse(D);}catch(J){return f.json({error:`Validation failed: ${sa(J.errors)}`,details:J.errors},400)}l.tenantScoped&&w&&(D.tenantId=w);let B=l.versions?.drafts===!0,K=l.fields.find(J=>J.name==="status"),Y=K?.type==="select"&&Array.isArray(K.options)&&K.options.some(J=>J.value==="published");if(B?D.status="draft":Y&&!D.status&&(D.status="published"),l.hooks?.beforeChange)for(let J of l.hooks.beforeChange){let xe=await J({collection:y,data:D,req:O,user:p,tenantId:w,operation:"create"});xe&&typeof xe=="object"&&!Array.isArray(xe)&&Object.assign(D,xe);}let le=await t.create({collection:y,data:D,tenantId:w});if(B&&await t.createVersion({collection:y,documentId:le.id,data:D,status:"draft",createdBy:p?.id,changeDescription:"Created",tenantId:w}),l.hooks?.afterChange)for(let J of l.hooks.afterChange)await J({collection:y,doc:le,data:D,req:O,user:p,tenantId:w,operation:"create"});return g&&g.trigger(Qa(y,"create"),{collection:y,operation:"create",data:le,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(J=>console.error("[Webhook] Failed to trigger:",J)),p&&Z?.createAuditLog({action:"document_create",userId:p.id,resource:y,resourceId:le.id,success:!0}),f.json({data:le,message:"Created successfully"},201)}catch(p){return p.name==="ZodError"?f.json({error:`Validation failed: ${sa(p.errors)}`,details:p.errors},400):f.json({error:p.message},500)}}),_.patch(`${b}/:id`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id"),D=await f.req.json(),O=bc(D),N=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!N)return f.json({error:"Document not found"},404);if(O&&N.updatedAt&&O!==N.updatedAt)return f.json(xd(O,N),409);let B=Object.fromEntries(Object.entries(yd(D)).filter(([Je,Qe])=>Qe!=="null"&&Qe!==void 0));Qr(B,l.fields),Yr(l.fields,B);let K=f.req.raw;if(l.hooks?.beforeValidate)for(let Je of l.hooks.beforeValidate){let Qe=await Je({collection:y,data:B,originalDoc:N,req:K,user:p,tenantId:w,operation:"update"});Qe&&typeof Qe=="object"&&!Array.isArray(Qe)&&Object.assign(B,Qe);}if(B=e.getUpdateZodSchema(y).parse(B),l.hooks?.beforeChange)for(let Je of l.hooks.beforeChange){let Qe=await Je({collection:y,data:B,originalDoc:N,req:K,user:p,tenantId:w,operation:"update"});Qe&&typeof Qe=="object"&&!Array.isArray(Qe)&&Object.assign(B,Qe);}let le=f.req.header("X-Draft")==="true",J=l.versions?.drafts===!0,xe=f.req.query("autosave")==="true",Xe;if(J&&le)await t.createVersion({collection:y,documentId:k,data:B,status:"draft",autosave:xe,createdBy:p?.id,changeDescription:xe?"Autosave":"Draft saved",tenantId:w});else if(J){let Je=D.status==="draft"?"draft":"published";await t.update({collection:y,id:k,data:{...B,status:Je},tenantId:w}),await t.createVersion({collection:y,documentId:k,data:{...B,status:Je},status:Je,createdBy:p?.id,changeDescription:Je==="published"?"Published":"Unpublished",tenantId:w});}else await t.update({collection:y,id:k,data:B,tenantId:w});if(Xe=await t.findByID({collection:y,id:k,tenantId:w,draft:!0}),l.hooks?.afterChange)for(let Je of l.hooks.afterChange)await Je({collection:y,doc:Xe,data:B,originalDoc:N,req:K,user:p,tenantId:w,operation:"update"});return g&&!xe&&g.trigger(Qa(y,"update"),{collection:y,operation:"update",data:Xe,previousData:N,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(Je=>console.error("[Webhook] Failed to trigger:",Je)),wc(Z,C,`${b}/${k}`,"PATCH",f.req.raw),p&&Z?.createAuditLog({action:"document_update",userId:p.id,resource:y,resourceId:k,success:!0}),f.json({data:Xe,message:J?"Draft saved":"Updated successfully"})}catch(p){return p.name==="ZodError"?(console.error(`[PATCH ${b}/:id] Validation failed:`,p.errors),f.json({error:`Validation failed: ${sa(p.errors)}`,details:p.errors},400)):(console.error(`[PATCH ${b}/:id] ERROR:`,p.message,"CAUSE:",p.cause?.message||p.cause,"QUERY:",p.query),f.json({error:p.message},500))}}),_.delete(`${b}/:id`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"delete",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);w&&t.setTenantContext({tenantId:w,userId:p?.id??"",role:p?.role,isSuperAdmin:p?.role==="super_admin"});let k=f.req.param("id"),D=f.req.raw,O=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!O)return f.json({error:"Document not found"},404);if(l.hooks?.beforeDelete)for(let B of l.hooks.beforeDelete)await B({collection:y,doc:O,req:D,user:p,tenantId:w,operation:"delete"});let N=await t.delete({collection:y,id:k,tenantId:w});if(l.hooks?.afterDelete)for(let B of l.hooks.afterDelete)await B({collection:y,doc:N,originalDoc:O,req:D,user:p,tenantId:w,operation:"delete"});return g&&g.trigger(Qa(y,"delete"),{collection:y,operation:"delete",data:N,previousData:O,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(B=>console.error("[Webhook] Failed to trigger:",B)),wc(Z,C,`${b}/${k}`,"DELETE",f.req.raw),p&&Z?.createAuditLog({action:"document_delete",userId:p.id,resource:y,resourceId:k,success:!0}),f.json({data:N,message:"Deleted successfully"})}catch(p){return console.error(`[DELETE] Error deleting ${y}:`,p),f.json({error:p.message||String(p)},500)}}),_.post(`${b}/:id/duplicate`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"create",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id"),D=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!D)return f.json({error:"Document not found"},404);let{id:O,createdAt:N,updatedAt:B,...K}=D;qs(l.fields,K);let Y=Date.now().toString(36);"slug"in K&&typeof K.slug=="string"&&(K.slug=`${K.slug||"document"}-copy-${Y}`),"title"in K&&typeof K.title=="string"?K.title=`${K.title||"Copy"} (Copy)`:"name"in K&&typeof K.name=="string"&&(K.name=`${K.name||"Copy"} (Copy)`);let le=await t.create({collection:y,data:{...K,status:"draft"},tenantId:w});return f.json({data:le,message:"Document duplicated successfully"})}catch(p){return console.error("[Duplicate] Error:",p),f.json({error:p.message||String(p)},500)}}),_.post(`${b}/:id/versions/:versionId/restore`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id"),D=f.req.param("versionId"),O=await t.findVersionByID({collection:y,versionId:D,tenantId:w});if(!O)return f.json({error:"Version not found"},404);let N=await t.update({collection:y,id:k,data:{...O.data,status:"draft"},tenantId:w});return f.json({data:N,message:"Version restored successfully"})}catch(p){return f.json({error:p.message},500)}}),_.post(`${b}/:id/versions`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=await f.req.json(),{versionId:D,action:O}=k;if(O==="restore"&&D){let N=await t.findVersionByID({collection:y,versionId:D,tenantId:w});if(!N)return f.json({error:"Version not found"},404);let B=await t.update({collection:y,id:f.req.param("id"),data:{...N.data,status:"draft"},tenantId:w});return f.json({data:B,message:"Version restored successfully"})}return f.json({error:"Invalid action"},400)}catch(p){return f.json({error:p.message},500)}}),_.post(`${b}/:id/publish`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);w&&t.setTenantContext({tenantId:w,userId:p?.id??"",role:p?.role,isSuperAdmin:p?.role==="super_admin"});let k=f.req.param("id"),D=await f.req.json().catch(()=>({})),O=bc(D),N=await t.findByID({collection:y,id:k,tenantId:w,draft:!0});if(!N)return f.json({error:"Document not found"},404);if(O&&N.updatedAt&&O!==N.updatedAt)return f.json(xd(O,N),409);let B={status:"published"},K=N;if(l.versions?.drafts){let le=await t.findVersions({collection:y,documentId:k,limit:1,sort:"-createdAt",tenantId:w});if(le.docs.length>0){let J=le.docs[0];K={...N,...J.data},B={...J.data,...B};}}let Y=await t.update({collection:y,id:k,data:B,tenantId:w});return l.versions?.drafts&&await t.createVersion({collection:y,documentId:k,data:{...K,status:"published"},status:"published",createdBy:p?.id,changeDescription:"Published",tenantId:w}),g&&g.trigger(Qa(y,"update"),{collection:y,operation:"update",data:Y,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(le=>console.error("[Webhook] Failed to trigger:",le)),f.json({data:Y,message:"Published successfully"})}catch(p){return f.json({error:p.message},500)}}),_.post(`${b}/:id/unpublish`,async f=>{try{let{user:p,tenantId:w,apiKeyContext:C}=await W(f.req.raw,F,i,c),v=await De(l,"update",f.req.raw,p,w,C,q,H);if(!v.allowed)return f.json({error:v.error},v.status||403);let k=f.req.param("id");if(!await t.findByID({collection:y,id:k,tenantId:w,draft:!0}))return f.json({error:"Document not found"},404);let O=await t.update({collection:y,id:k,data:{status:"draft"},tenantId:w});return g&&g.trigger(Qa(y,"update"),{collection:y,operation:"update",data:O,user:p?{id:p.id,email:p.email,role:p.role}:void 0,tenantId:w}).catch(N=>console.error("[Webhook] Failed to trigger:",N)),f.json({data:O,message:"Unpublished successfully"})}catch(p){return f.json({error:p.message},500)}});}for(let l of e.getGlobals()){let y=l.slug,b$1=`/api/globals/${y}`;_.post(`${b$1}/dynamic-options/:fieldName`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"read",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},C.status||403);let v=f.req.param("fieldName"),k=await f.req.json(),{data:D,siblingData:O}=k,N=gs(l.fields,v);if(!N)return f.json({error:"Field not found"},404);if(N.type!=="select")return f.json({error:"Field is not a select field"},400);let B=[];return typeof N.options=="function"?B=await N.options({data:D||{},siblingData:O||{}}):Array.isArray(N.options)&&(B=N.options),f.json({options:B})}catch(p){return f.json({error:p.message},500)}}),_.get(b$1,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=new URL(f.req.url),v=C.searchParams.get("kyroToken"),k=C.searchParams.get("draft"),D=!1;if(k==="true"&&v&&s)try{let Y=await wo(v,s,"HS256");Y&&Y.type==="preview"&&Y.collection===`_globals_${l.slug}`&&(D=!0);}catch(Y){console.warn("Invalid preview token",Y);}if(!D){let Y=await er(l,"read",f.req.raw,p,w,q);if(!Y.allowed)return f.json({error:Y.error},Y.status||403)}let O=k==="true"?!0:k==="false"?!1:!!p,N=parseInt(C.searchParams.get("depth")||"0"),K=(await t.find({collection:`_globals_${y}`,where:{},tenantId:w,draft:O,depth:N,limit:1})).docs[0];if(K&&N>0&&await a$6([K],l.fields,t,e,1,N),y==="storage-settings"&&(typeof globalThis.STORAGE_BUCKET<"u"||typeof f.env?.STORAGE_BUCKET<"u")&&(K?K.provider||(K.provider="cloudflare_r2"):K={id:y,provider:"cloudflare_r2"}),y==="system"){let Y=NB.randomBytes(32).toString("hex");K?K.appSecret||(await t.update({collection:`_globals_${y}`,id:y,data:{appSecret:Y},tenantId:w}),K.appSecret=Y):K=await t.create({collection:`_globals_${y}`,data:{id:y,appSecret:Y},tenantId:w});}return f.json({data:K||{}})}catch(p){return f.json({error:p.message},500)}});let R=async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"update",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},C.status||403);let v=new URL(f.req.url),k=parseInt(v.searchParams.get("depth")||"0"),D=await f.req.json(),O=bc(D),N=yd(D),B=Object.fromEntries(Object.entries(N).filter(([It,Ds])=>Ds!==null&&Ds!=="null"&&Ds!==void 0));Qr(B,l.fields),Yr(l.fields,B);let K=e.getUpdateZodSchema(y),Y;try{Y=K.parse(B);}catch(It){return f.json({error:`Validation failed: ${sa(It.errors)}`,details:It.errors},400)}let le=new Set(["id","createdAt","updatedAt","status","baseUpdatedAt","_baseUpdatedAt"]),J=Object.fromEntries(Object.entries(Y).filter(([It])=>!le.has(It))),xe=`_globals_${y}`,Xe=await t.findOne({collection:xe,where:{},tenantId:w,draft:!0});if(Xe&&O&&Xe.updatedAt&&O!==Xe.updatedAt)return f.json(xd(O,Xe),409);let Je=f.req.header("X-Draft")==="true",Qe=l.versions?.drafts===!0,Zr=f.req.query("autosave")==="true",At;if(Qe&&Je)await t.createVersion({collection:xe,documentId:y,data:J,status:"draft",autosave:Zr,createdBy:p?.id,changeDescription:Zr?"Autosave":"Manual save",tenantId:w}),Xe?At=Xe:At=await t.create({collection:xe,data:{...J,id:y,status:"draft"},tenantId:w});else if(Qe&&!Je){let It="published";Xe?At=await t.update({collection:xe,id:y,data:{...J,status:It},tenantId:w}):At=await t.create({collection:xe,data:{...J,id:y,status:It},tenantId:w}),await t.createVersion({collection:xe,documentId:y,data:J,status:It,autosave:!1,createdBy:p?.id,changeDescription:"Published",tenantId:w});}else Xe?At=await t.update({collection:xe,id:y,data:J,tenantId:w}):At=await t.create({collection:xe,data:{...J,id:y},tenantId:w});if(y==="storage-settings"&&(Bt=null,Lr=null),y==="email-settings"){let It=await q$1.fromConfig(t);we.email=It||void 0;}return y==="system"&&await b(),p&&Z?.createAuditLog({action:"settings_change",userId:p.id,resource:`global:${y}`,resourceId:y,success:!0}),At&&k>0&&await a$6([At],l.fields,t,e,1,k),f.json({data:At,message:"Updated successfully"})}catch(p){return console.error(`[API] Save global "${y}" failed:`,p),f.json({error:p.message||"Save failed",stack:process.env.NODE_ENV==="development"?p.stack:void 0},500)}};_.post(b$1,R),_.patch(b$1,R),_.post(`${b$1}/preview-url`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"read",f.req.raw,p,w);if(!C.allowed)return f.json({error:C.error||"Forbidden"},C.status||403);let v=await f.req.json().catch(()=>({})),k="";s&&(k=await bo({type:"preview",collection:`_globals_${l.slug}`,exp:Math.floor(Date.now()/1e3)+3600},s,"HS256"));let D="";if(l.admin?.preview)D=await l.admin.preview(v,{req:f.req.raw,token:k});else {let O="";try{let N=await t.findOne({collection:"_globals_site-settings",where:{}});N?.siteUrl&&(O=N.siteUrl);}catch{}if(!O)return f.json({error:"No site URL configured in settings, and no custom preview function defined."},400);O=O.replace(/\/$/,""),D=`${O}/?preview=true&kyroToken=${k}`;}return f.json({url:D})}catch(p){return f.json({error:p.message},500)}}),_.post(`${b$1}/publish`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"update",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},403);let v=`_globals_${y}`,k=await t.findOne({collection:v,where:{},tenantId:w,draft:!0});if(!k)return f.json({error:"Global not found"},404);let D={status:"published"},O=k;if(l.versions?.drafts){let B=await t.findVersions({collection:v,documentId:y,limit:1,sort:"-createdAt",tenantId:w});B.docs.length>0&&(O={...k,...B.docs[0].data},D={...B.docs[0].data,...D});}let N=await t.update({collection:v,id:y,data:D,tenantId:w});return l.versions?.drafts&&await t.createVersion({collection:v,documentId:y,data:{...O,status:"published"},status:"published",createdBy:p?.id,changeDescription:"Published",tenantId:w}),f.json({data:N,message:"Published successfully"})}catch(p){return f.json({error:p.message},500)}}),_.post(`${b$1}/unpublish`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"update",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},403);let v=await t.update({collection:`_globals_${y}`,id:y,data:{status:"draft"},tenantId:w});return f.json({data:v,message:"Unpublished successfully"})}catch(p){return f.json({error:p.message},500)}}),_.get(`${b$1}/versions`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"read",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},403);let v=parseInt(f.req.query("limit")||"10"),k=parseInt(f.req.query("page")||"1"),D=await t.findVersions({collection:`_globals_${y}`,documentId:y,limit:v,page:k,tenantId:w});return f.json(D)}catch(p){return f.json({error:p.message},500)}}),_.get(`${b$1}/versions/:versionId`,async f=>{try{let p=f.req.param("versionId"),{user:w,tenantId:C}=await W(f.req.raw,F,i,c),v=await er(l,"read",f.req.raw,w,C,q);if(!v.allowed)return f.json({error:v.error},403);let k=await t.findVersionByID({collection:`_globals_${y}`,versionId:p,tenantId:C});return k?f.json({data:k}):f.json({error:"Version not found"},404)}catch(p){return f.json({error:p.message},500)}}),_.post(`${b$1}/versions/:versionId/restore`,async f=>{try{let p=f.req.param("versionId"),{user:w,tenantId:C}=await W(f.req.raw,F,i,c),v=await er(l,"update",f.req.raw,w,C,q);if(!v.allowed)return f.json({error:v.error},403);let k=`_globals_${y}`,D=await t.findVersionByID({collection:k,versionId:p,tenantId:C});if(!D)return f.json({error:"Version not found"},404);let O=await t.update({collection:k,id:y,data:{...D.data,status:"draft"},tenantId:C});return f.json({data:O,message:"Version restored successfully"})}catch(p){return f.json({error:p.message},500)}}),y==="email-settings"&&_.post(`${b$1}/test`,async f=>{try{let{user:p,tenantId:w}=await W(f.req.raw,F,i,c),C=await er(l,"update",f.req.raw,p,w,q);if(!C.allowed)return f.json({error:C.error},C.status||403);let v=await f.req.json(),k={provider:v.provider,from:v.fromEmail||v.from,fromName:v.fromName,replyTo:v.replyTo,smtp:v.smtp?{host:v.smtp.host,port:v.smtp.port,secure:v.smtp.secure,auth:{user:v.smtp.username||v.smtp.user,pass:v.smtp.password||v.smtp.pass}}:void 0,resend:v.resend,sendgrid:v.sendgrid,mailgun:v.mailgun,ses:v.ses},D=new q$1(k),O=v.email||v.testEmail||v.testEmailSection&&v.testEmailSection.testEmail;if(!O)return f.json({error:"No test recipient email provided"},400);let N=v.provider?v.provider.charAt(0).toUpperCase()+v.provider.slice(1):"SMTP",B=v.fromName?`${v.fromName} <${v.fromEmail||v.from||"default"}>`:v.fromEmail||v.from||"Configured Sender",K=new Date().toUTCString();return await D.send({to:O,subject:"Kyro CMS \u2014 Email Connection Test",html:`<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8">