@kyro-cms/core 0.12.58 → 0.12.60

package/dist/{chunk-KFEJPRC4.js → chunk-T4TSELDS.js}

@@ -1,5 +1,5 @@
-import {r as r$1,p as p$2,q as q$1}from'./chunk-XP56DE7A.js';import {a as a$a}from'./chunk-R25WLKX4.js';import {l,j as j$1,h,t,p as p$1,k,o as o$1,r as r$2,s,b,n as n$2}from'./chunk-6TPICJ2L.js';import {a as a$e,b as b$4,g as g$3}from'./chunk-W45TLOOT.js';import {a as a$d}from'./chunk-IKGVPXMK.js';import {j as j$3,h as h$1,k as k$1,i as i$3,f as f$3,g as g$2,e as e$5}from'./chunk-YUUXFD73.js';import {a as a$3}from'./chunk-LVBHOZZF.js';import {p,q,R,r,n,u as u$1,f,A,m as m$1,c as c$2,N,x as x$1,t as t$1,O,z as z$1,B,C,D,E as E$1,I as I$1,G,i as i$2,a as a$b,Q as Q$1,v as v$1,y,w as w$1,P,T as T$2,j as j$4,U as U$1,k as k$2,F as F$1,h as h$3,o as o$2,s as s$2}from'./chunk-OBYAIJVU.js';import {n as n$1,f as f$1,e as e$1,H,l as l$1,T as T$1,I as I$2,C as C$1,E as E$2,D as D$1,F,G as G$1,h as h$2,R as R$1,S,i as i$4,s as s$1,t as t$2,d as d$4,m as m$2,u as u$3,p as p$3,r as r$3}from'./chunk-JRUQ5ABB.js';import {a as a$4}from'./chunk-CIVA6SKW.js';import {q as q$2,n as n$3}from'./chunk-WPM6LFCY.js';import {c,a as a$c,d as d$2,b as b$2}from'./chunk-U6KFONKM.js';import {x,i,a as a$1,v,w,z as z$2,u as u$2,e as e$4,c as c$4,A as A$1,y as y$1,d as d$3,b as b$3}from'./chunk-TYQYKKWJ.js';import {a as a$2}from'./chunk-L2QXP26Q.js';import {d,a as a$6,b as b$1,c as c$3}from'./chunk-YZEMLLD2.js';import {d as d$1,i as i$1,j as j$2,f as f$2,e as e$3,g as g$1}from'./chunk-RTHJ6SS5.js';import {e as e$2,c as c$1}from'./chunk-KNOFTUQV.js';import {a as a$8}from'./chunk-ZWDBPEXL.js';import {J}from'./chunk-3NSZZCOJ.js';import {a as a$9}from'./chunk-5ZEYOFAK.js';import {a}from'./chunk-7NH7H3WA.js';import {a as a$7}from'./chunk-VVVCCB6R.js';import {a as a$5}from'./chunk-TBHNE4VV.js';import {g,e}from'./chunk-Y2YAKDEQ.js';import NB,{createHash,randomBytes,createHmac}from'crypto';import Co,{join,resolve,basename,extname}from'path';import {existsSync,readFileSync}from'fs';import {mkdir,readdir,stat,rename,unlink,writeFile}from'fs/promises';import Bw from'process';import {Readable}from'stream';if (typeof window === "undefined") { const { createRequire } = await import(/* @vite-ignore */ 'module'); createRequire(import.meta.url); }
-g();g();g();g();g();g();var Tc=(r,e,t)=>(s,n)=>{let a=-1;return i(0);async function i(c){if(c<=a)throw new Error("next() called multiple times");a=c;let d,g=false,x;if(r[c]?(x=r[c][0][0],s.req.routeIndex=c):x=c===r.length&&n||void 0,x)try{d=await x(s,()=>i(c+1));}catch(_){if(_ instanceof Error&&e)s.error=_,d=await e(_,s),g=true;else throw _}else s.finalized===false&&t&&(d=await t(s));return d&&(s.finalized===false||g)&&(s.res=d),s}};g();g();g();g();var am=Symbol();g();g();g();var om=(r,e)=>new Response(r,{headers:{"Content-Type":e.replace(/^[^;]+/,s=>s.toLowerCase())}}).formData();var uo=r=>"headers"in r,cm=async(r,e=Object.create(null))=>{let{all:t=false,dot:s=false}=e,i=(uo(r)?r.headers:r.raw.headers).get("Content-Type")?.split(";")[0].trim().toLowerCase();return i==="multipart/form-data"||i==="application/x-www-form-urlencoded"?tw(r,{all:t,dot:s}):{}};async function tw(r,e){if(!uo(r)&&r.bodyCache.formData)return im(await r.bodyCache.formData,e);let t=uo(r)?r.headers:r.raw.headers,s=await r.arrayBuffer(),n=om(s,t.get("Content-Type")||"");uo(r)||(r.bodyCache.formData=n);let a=await n;return a?im(a,e):{}}function im(r,e){let t=Object.create(null);return r.forEach((s,n)=>{e.all||n.endsWith("[]")?rw(t,n,s):t[n]=s;}),e.dot&&Object.entries(t).forEach(([s,n])=>{s.includes(".")&&(sw(t,s,n),delete t[s]);}),t}var rw=(r,e,t)=>{r[e]!==void 0?Array.isArray(r[e])?r[e].push(t):r[e]=[r[e],t]:e.endsWith("[]")?r[e]=[t]:r[e]=t;},sw=(r,e,t)=>{if(/(?:^|\.)__proto__\./.test(e))return;let s=r,n=e.split(".");n.forEach((a,i)=>{i===n.length-1?s[a]=t:((!s[a]||typeof s[a]!="object"||Array.isArray(s[a])||s[a]instanceof File)&&(s[a]=Object.create(null)),s=s[a]);});};g();var Pc=r=>{let e=r.split("/");return e[0]===""&&e.shift(),e},um=r=>{let{groups:e,path:t}=nw(r),s=Pc(t);return aw(s,e)},nw=r=>{let e=[];return r=r.replace(/\{[^}]+\}/g,(t,s)=>{let n=`@${s}`;return e.push([n,t]),n}),{groups:e,path:r}},aw=(r,e)=>{for(let t=e.length-1;t>=0;t--){let[s]=e[t];for(let n=r.length-1;n>=0;n--)if(r[n].includes(s)){r[n]=r[n].replace(s,e[t][1]);break}}return r},lo={},lm=(r,e)=>{if(r==="*")return "*";let t=r.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(t){let s=`${r}#${e}`;return lo[s]||(t[2]?lo[s]=e&&e[0]!==":"&&e[0]!=="*"?[s,t[1],new RegExp(`^${t[2]}(?=/${e})`)]:[r,t[1],new RegExp(`^${t[2]}$`)]:lo[s]=[r,t[1],true]),lo[s]}return null},Jn=(r,e)=>{try{return e(r)}catch{return r.replace(/(?:%[0-9A-Fa-f]{2})+/g,t=>{try{return e(t)}catch{return t}})}},ow=r=>Jn(r,decodeURI),Ic=r=>{let e=r.url,t=e.indexOf("/",e.indexOf(":")+4),s=t;for(;s<e.length;s++){let n=e.charCodeAt(s);if(n===37){let a=e.indexOf("?",s),i=e.indexOf("#",s),c=a===-1?i===-1?void 0:i:i===-1?a:Math.min(a,i),d=e.slice(t,c);return ow(d.includes("%25")?d.replace(/%25/g,"%2525"):d)}else if(n===63||n===35)break}return e.slice(t,s)};var dm=r=>{let e=Ic(r);return e.length>1&&e.at(-1)==="/"?e.slice(0,-1):e},Jr=(r,e,...t)=>(t.length&&(e=Jr(e,...t)),`${r?.[0]==="/"?"":"/"}${r}${e==="/"?"":`${r?.at(-1)==="/"?"":"/"}${e?.[0]==="/"?e.slice(1):e}`}`),po=r=>{if(r.charCodeAt(r.length-1)!==63||!r.includes(":"))return null;let e=r.split("/"),t=[],s="";return e.forEach(n=>{if(n!==""&&!/\:/.test(n))s+="/"+n;else if(/\:/.test(n))if(/\?/.test(n)){t.length===0&&s===""?t.push("/"):t.push(s);let a=n.replace("?","");s+="/"+a,t.push(s);}else s+="/"+n;}),t.filter((n,a,i)=>i.indexOf(n)===a)},Oc=r=>/[%+]/.test(r)?(r.indexOf("+")!==-1&&(r=r.replace(/\+/g," ")),r.indexOf("%")!==-1?Jn(r,mo):r):r,pm=(r,e,t)=>{let s;if(!t&&e&&!/[%+]/.test(e)){let i=r.indexOf("?",8);if(i===-1)return;for(r.startsWith(e,i+1)||(i=r.indexOf(`&${e}`,i+1));i!==-1;){let c=r.charCodeAt(i+e.length+1);if(c===61){let d=i+e.length+2,g=r.indexOf("&",d);return Oc(r.slice(d,g===-1?void 0:g))}else if(c==38||isNaN(c))return "";i=r.indexOf(`&${e}`,i+1);}if(s=/[%+]/.test(r),!s)return}let n={};s??=/[%+]/.test(r);let a=r.indexOf("?",8);for(;a!==-1;){let i=r.indexOf("&",a+1),c=r.indexOf("=",a);c>i&&i!==-1&&(c=-1);let d=r.slice(a+1,c===-1?i===-1?void 0:i:c);if(s&&(d=Oc(d)),a=i,d==="")continue;let g;c===-1?g="":(g=r.slice(c+1,i===-1?void 0:i),s&&(g=Oc(g))),t?(n[d]&&Array.isArray(n[d])||(n[d]=[]),n[d].push(g)):n[d]??=g;}return e?n[e]:n},mm=pm,fm=(r,e)=>pm(r,e,true),mo=decodeURIComponent;var hm=r=>Jn(r,mo),gm=class{raw;#t;#e;routeIndex=0;path;bodyCache={};constructor(r,e="/",t=[[]]){this.raw=r,this.path=e,this.#e=t,this.#t={};}param(r){return r?this.#r(r):this.#a()}#r(r){let e=this.#e[0][this.routeIndex][1][r],t=this.#n(e);return t&&/\%/.test(t)?hm(t):t}#a(){let r={},e=Object.keys(this.#e[0][this.routeIndex][1]);for(let t of e){let s=this.#n(this.#e[0][this.routeIndex][1][t]);s!==void 0&&(r[t]=/\%/.test(s)?hm(s):s);}return r}#n(r){return this.#e[1]?this.#e[1][r]:r}query(r){return mm(this.url,r)}queries(r){return fm(this.url,r)}header(r){if(r)return this.raw.headers.get(r)??void 0;let e={};return this.raw.headers.forEach((t,s)=>{e[s]=t;}),e}async parseBody(r){return cm(this,r)}#s=r=>{let{bodyCache:e,raw:t}=this,s=e[r];if(s)return s;let n=Object.keys(e)[0];return n?e[n].then(a=>(n==="json"&&(a=JSON.stringify(a)),new Response(a)[r]())):e[r]=t[r]()};json(){return this.#s("text").then(r=>JSON.parse(r))}text(){return this.#s("text")}arrayBuffer(){return this.#s("arrayBuffer")}bytes(){return this.#s("arrayBuffer").then(r=>new Uint8Array(r))}blob(){return this.#s("blob")}formData(){return this.#s("formData")}addValidatedData(r,e){this.#t[r]=e;}valid(r){return this.#t[r]}get url(){return this.raw.url}get method(){return this.raw.method}get[am](){return this.#e}get matchedRoutes(){return this.#e[0].map(([[,r]])=>r)}get routePath(){return this.#e[0].map(([[,r]])=>r)[this.routeIndex].path}};g();var ym={Stringify:1},cw=(r,e)=>{let t=new String(r);return t.isEscaped=true,t.callbacks=e,t};var Dc=async(r,e,t,s,n)=>{typeof r=="object"&&!(r instanceof String)&&(r instanceof Promise||(r=r.toString()),r instanceof Promise&&(r=await r));let a=r.callbacks;if(!a?.length)return Promise.resolve(r);n?n[0]+=r:n=[r];let i=Promise.all(a.map(c=>c({phase:e,buffer:n,context:s}))).then(c=>Promise.all(c.filter(Boolean).map(d=>Dc(d,e,false,s,n))).then(()=>n[0]));return t?cw(await i,a):i};var uw="text/plain; charset=UTF-8",Lc=(r,e)=>({"Content-Type":r,...e}),Qn=(r,e)=>new Response(r,e),$c=class{#t;#e;env={};#r;finalized=false;error;#a;#n;#s;#l;#c;#u;#i;#d;#p;constructor(r,e){this.#t=r,e&&(this.#n=e.executionCtx,this.env=e.env,this.#u=e.notFoundHandler,this.#p=e.path,this.#d=e.matchResult);}get req(){return this.#e??=new gm(this.#t,this.#p,this.#d),this.#e}get event(){if(this.#n&&"respondWith"in this.#n)return this.#n;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#n)return this.#n;throw Error("This context has no ExecutionContext")}get res(){return this.#s||=Qn(null,{headers:this.#i??=new Headers})}set res(r){if(this.#s&&r){r=Qn(r.body,r);for(let[e,t]of this.#s.headers.entries())if(e!=="content-type")if(e==="set-cookie"){let s=this.#s.headers.getSetCookie();r.headers.delete("set-cookie");for(let n of s)r.headers.append("set-cookie",n);}else r.headers.set(e,t);}this.#s=r,this.finalized=true;}render=(...r)=>(this.#c??=e=>this.html(e),this.#c(...r));setLayout=r=>this.#l=r;getLayout=()=>this.#l;setRenderer=r=>{this.#c=r;};header=(r,e,t)=>{this.finalized&&(this.#s=Qn(this.#s.body,this.#s));let s=this.#s?this.#s.headers:this.#i??=new Headers;e===void 0?s.delete(r):t?.append?s.append(r,e):s.set(r,e);};status=r=>{this.#a=r;};set=(r,e)=>{this.#r??=new Map,this.#r.set(r,e);};get=r=>this.#r?this.#r.get(r):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#o(r,e,t){let s=this.#s?new Headers(this.#s.headers):this.#i??new Headers;if(typeof e=="object"&&"headers"in e){let a=e.headers instanceof Headers?e.headers:new Headers(e.headers);for(let[i,c]of a)i.toLowerCase()==="set-cookie"?s.append(i,c):s.set(i,c);}if(t)for(let[a,i]of Object.entries(t))if(typeof i=="string")s.set(a,i);else {s.delete(a);for(let c of i)s.append(a,c);}let n=typeof e=="number"?e:e?.status??this.#a;return Qn(r,{status:n,headers:s})}newResponse=(...r)=>this.#o(...r);body=(r,e,t)=>this.#o(r,e,t);text=(r,e,t)=>!this.#i&&!this.#a&&!e&&!t&&!this.finalized?new Response(r):this.#o(r,e,Lc(uw,t));json=(r,e,t)=>this.#o(JSON.stringify(r),e,Lc("application/json",t));html=(r,e,t)=>{let s=n=>this.#o(n,e,Lc("text/html; charset=UTF-8",t));return typeof r=="object"?Dc(r,ym.Stringify,false,{}).then(s):s(r)};redirect=(r,e)=>{let t=String(r);return this.header("Location",/[^\x00-\xFF]/.test(t)?encodeURI(t):t),this.newResponse(null,e??302)};notFound=()=>(this.#u??=()=>Qn(),this.#u(this))};g();var Le="ALL",xm="all",_m=["get","post","put","delete","options","patch"],fo="Can not add a route since the matcher is already built.",ho=class extends Error{};g();var wm="__COMPOSED_HANDLER";var lw=r=>r.text("404 Not Found",404),bm=(r,e)=>{if("getResponse"in r){let t=r.getResponse();return e.newResponse(t.body,t)}return console.error(r),e.text("Internal Server Error",500)},vm=class Sm{get;post;put;delete;options;patch;all;on;use;router;getPath;_basePath="/";#t="/";routes=[];constructor(e={}){[..._m,xm].forEach(a=>{this[a]=(i,...c)=>(typeof i=="string"?this.#t=i:this.#a(a,this.#t,i),c.forEach(d=>{this.#a(a,this.#t,d);}),this);}),this.on=(a,i,...c)=>{for(let d of [i].flat()){this.#t=d;for(let g of [a].flat())c.map(x=>{this.#a(g.toUpperCase(),this.#t,x);});}return this},this.use=(a,...i)=>(typeof a=="string"?this.#t=a:(this.#t="*",i.unshift(a)),i.forEach(c=>{this.#a(Le,this.#t,c);}),this);let{strict:s,...n}=e;Object.assign(this,n),this.getPath=s??true?e.getPath??Ic:dm;}#e(){let e=new Sm({router:this.router,getPath:this.getPath});return e.errorHandler=this.errorHandler,e.#r=this.#r,e.routes=this.routes,e}#r=lw;errorHandler=bm;route(e,t){let s=this.basePath(e);return t.routes.map(n=>{let a;t.errorHandler===bm?a=n.handler:(a=async(i,c)=>(await Tc([],t.errorHandler)(i,()=>n.handler(i,c))).res,a[wm]=n.handler),s.#a(n.method,n.path,a,n.basePath);}),this}basePath(e){let t=this.#e();return t._basePath=Jr(this._basePath,e),t}onError=e=>(this.errorHandler=e,this);notFound=e=>(this.#r=e,this);mount(e,t,s){let n,a;s&&(typeof s=="function"?a=s:(a=s.optionHandler,s.replaceRequest===false?n=d=>d:n=s.replaceRequest));let i=a?d=>{let g=a(d);return Array.isArray(g)?g:[g]}:d=>{let g;try{g=d.executionCtx;}catch{}return [d.env,g]};n||=(()=>{let d=Jr(this._basePath,e),g=d==="/"?0:d.length;return x=>{let _=new URL(x.url);return _.pathname=this.getPath(x).slice(g)||"/",new Request(_,x)}})();let c=async(d,g)=>{let x=await t(n(d.req.raw),...i(d));if(x)return x;await g();};return this.#a(Le,Jr(e,"*"),c),this}#a(e,t,s,n){e=e.toUpperCase(),t=Jr(this._basePath,t);let a={basePath:n!==void 0?Jr(this._basePath,n):this._basePath,path:t,method:e,handler:s};this.router.add(e,t,[s,a]),this.routes.push(a);}#n(e,t){if(e instanceof Error)return this.errorHandler(e,t);throw e}#s(e,t,s,n){if(n==="HEAD")return (async()=>new Response(null,await this.#s(e,t,s,"GET")))();let a=this.getPath(e,{env:s}),i=this.router.match(n,a),c=new $c(e,{path:a,matchResult:i,env:s,executionCtx:t,notFoundHandler:this.#r});if(i[0].length===1){let g;try{g=i[0][0][0][0](c,async()=>{c.res=await this.#r(c);});}catch(x){return this.#n(x,c)}return g instanceof Promise?g.then(x=>x||(c.finalized?c.res:this.#r(c))).catch(x=>this.#n(x,c)):g??this.#r(c)}let d=Tc(i[0],this.errorHandler,this.#r);return (async()=>{try{let g=await d(c);if(!g.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return g.res}catch(g){return this.#n(g,c)}})()}fetch=(e,...t)=>this.#s(e,t[1],t[0],e.method);request=(e,t,s,n)=>e instanceof Request?this.fetch(t?new Request(e,t):e,s,n):(e=e.toString(),this.fetch(new Request(/^https?:\/\//.test(e)?e:`http://localhost${Jr("/",e)}`,t),s,n));fire=()=>{addEventListener("fetch",e=>{e.respondWith(this.#s(e.request,e,void 0,e.request.method));});}};g();g();g();var go=[];function Bc(r,e){let t=this.buildAllMatchers(),s=((n,a)=>{let i=t[n]||t[Le],c=i[2][a];if(c)return c;let d=a.match(i[0]);if(!d)return [[],go];let g=d.indexOf("",1);return [i[1][g],d]});return this.match=s,s(r,e)}g();var yo="[^/]+",Yn=".*",ea="(?:|/.*)",ps=Symbol(),dw=new Set(".\\+*[^]$()");function pw(r,e){return r.length===1?e.length===1?r<e?-1:1:-1:e.length===1||r===Yn||r===ea?1:e===Yn||e===ea?-1:r===yo?1:e===yo?-1:r.length===e.length?r<e?-1:1:e.length-r.length}var Am=class jc{#t;#e;#r=Object.create(null);insert(e,t,s,n,a){if(e.length===0){if(this.#t!==void 0)throw ps;if(a)return;this.#t=t;return}let[i,...c]=e,d=i==="*"?c.length===0?["","",Yn]:["","",yo]:i==="/*"?["","",ea]:i.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),g;if(d){let x=d[1],_=d[2]||yo;if(x&&d[2]&&(_===".*"||(_=_.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(_))))throw ps;if(g=this.#r[_],!g){if(Object.keys(this.#r).some(P=>P!==Yn&&P!==ea))throw ps;if(a)return;g=this.#r[_]=new jc,x!==""&&(g.#e=n.varIndex++);}!a&&x!==""&&s.push([x,g.#e]);}else if(g=this.#r[i],!g){if(Object.keys(this.#r).some(x=>x.length>1&&x!==Yn&&x!==ea))throw ps;if(a)return;g=this.#r[i]=new jc;}g.insert(c,t,s,n,a);}buildRegExpStr(){let t=Object.keys(this.#r).sort(pw).map(s=>{let n=this.#r[s];return (typeof n.#e=="number"?`(${s})@${n.#e}`:dw.has(s)?`\\${s}`:s)+n.buildRegExpStr()});return typeof this.#t=="number"&&t.unshift(`#${this.#t}`),t.length===0?"":t.length===1?t[0]:"(?:"+t.join("|")+")"}};g();var Rm=class{#t={varIndex:0};#e=new Am;insert(r,e,t){let s=[],n=[];for(let i=0;;){let c=false;if(r=r.replace(/\{[^}]+\}/g,d=>{let g=`@\\${i}`;return n[i]=[g,d],i++,c=true,g}),!c)break}let a=r.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let i=n.length-1;i>=0;i--){let[c]=n[i];for(let d=a.length-1;d>=0;d--)if(a[d].indexOf(c)!==-1){a[d]=a[d].replace(c,n[i][1]);break}}return this.#e.insert(a,e,s,this.#t,t),s}buildRegExp(){let r=this.#e.buildRegExpStr();if(r==="")return [/^$/,[],[]];let e=0,t=[],s=[];return r=r.replace(/#(\d+)|@(\d+)|\.\*\$/g,(n,a,i)=>a!==void 0?(t[++e]=Number(a),"$()"):(i!==void 0&&(s[Number(i)]=++e),"")),[new RegExp(`^${r}`),t,s]}};var mw=[/^$/,[],Object.create(null)],km=Object.create(null);function Cm(r){return km[r]??=new RegExp(r==="*"?"":`^${r.replace(/\/\*$|([.\\+*[^\]$()])/g,(e,t)=>t?`\\${t}`:"(?:|/.*)")}$`)}function fw(){km=Object.create(null);}function hw(r){let e=new Rm,t=[];if(r.length===0)return mw;let s=r.map(g=>[!/\*|\/:/.test(g[0]),...g]).sort(([g,x],[_,P])=>g?1:_?-1:x.length-P.length),n=Object.create(null);for(let g=0,x=-1,_=s.length;g<_;g++){let[P,G,q]=s[g];P?n[G]=[q.map(([ue])=>[ue,Object.create(null)]),go]:x++;let H;try{H=e.insert(G,x,P);}catch(ue){throw ue===ps?new ho(G):ue}P||(t[x]=q.map(([ue,se])=>{let Pe=Object.create(null);for(se-=1;se>=0;se--){let[Z,St]=H[se];Pe[Z]=St;}return [ue,Pe]}));}let[a,i,c]=e.buildRegExp();for(let g=0,x=t.length;g<x;g++)for(let _=0,P=t[g].length;_<P;_++){let G=t[g][_]?.[1];if(!G)continue;let q=Object.keys(G);for(let H=0,ue=q.length;H<ue;H++)G[q[H]]=c[G[q[H]]];}let d=[];for(let g in i)d[g]=t[i[g]];return [a,d,n]}function Ms(r,e){if(r){for(let t of Object.keys(r).sort((s,n)=>n.length-s.length))if(Cm(t).test(e))return [...r[t]]}}var xo=class{name="RegExpRouter";#t;#e;constructor(){this.#t={[Le]:Object.create(null)},this.#e={[Le]:Object.create(null)};}add(r,e,t){let s=this.#t,n=this.#e;if(!s||!n)throw new Error(fo);s[r]||[s,n].forEach(c=>{c[r]=Object.create(null),Object.keys(c[Le]).forEach(d=>{c[r][d]=[...c[Le][d]];});}),e==="/*"&&(e="*");let a=(e.match(/\/:/g)||[]).length;if(/\*$/.test(e)){let c=Cm(e);r===Le?Object.keys(s).forEach(d=>{s[d][e]||=Ms(s[d],e)||Ms(s[Le],e)||[];}):s[r][e]||=Ms(s[r],e)||Ms(s[Le],e)||[],Object.keys(s).forEach(d=>{(r===Le||r===d)&&Object.keys(s[d]).forEach(g=>{c.test(g)&&s[d][g].push([t,a]);});}),Object.keys(n).forEach(d=>{(r===Le||r===d)&&Object.keys(n[d]).forEach(g=>c.test(g)&&n[d][g].push([t,a]));});return}let i=po(e)||[e];for(let c=0,d=i.length;c<d;c++){let g=i[c];Object.keys(n).forEach(x=>{(r===Le||r===x)&&(n[x][g]||=[...Ms(s[x],g)||Ms(s[Le],g)||[]],n[x][g].push([t,a-d+c+1]));});}}match=Bc;buildAllMatchers(){let r=Object.create(null);return Object.keys(this.#e).concat(Object.keys(this.#t)).forEach(e=>{r[e]||=this.#r(e);}),this.#t=this.#e=void 0,fw(),r}#r(r){let e=[],t=r===Le;return [this.#t,this.#e].forEach(s=>{let n=s[r]?Object.keys(s[r]).map(a=>[a,s[r][a]]):[];n.length!==0?(t||=true,e.push(...n)):r!==Le&&e.push(...Object.keys(s[Le]).map(a=>[a,s[Le][a]]));}),t?hw(e):null}};g();g();g();var Nc=class{name="SmartRouter";#t=[];#e=[];constructor(r){this.#t=r.routers;}add(r,e,t){if(!this.#e)throw new Error(fo);this.#e.push([r,e,t]);}match(r,e){if(!this.#e)throw new Error("Fatal error");let t=this.#t,s=this.#e,n=t.length,a=0,i;for(;a<n;a++){let c=t[a];try{for(let d=0,g=s.length;d<g;d++)c.add(...s[d]);i=c.match(r,e);}catch(d){if(d instanceof ho)continue;throw d}this.match=c.match.bind(c),this.#t=[c],this.#e=void 0;break}if(a===n)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,i}get activeRouter(){if(this.#e||this.#t.length!==1)throw new Error("No active router has been determined yet.");return this.#t[0]}};g();g();g();var ta=Object.create(null),gw=r=>{for(let e in r)return  true;return  false},Em=class Tm{#t;#e;#r;#a=0;#n=ta;constructor(e,t,s){if(this.#e=s||Object.create(null),this.#t=[],e&&t){let n=Object.create(null);n[e]={handler:t,possibleKeys:[],score:0},this.#t=[n];}this.#r=[];}insert(e,t,s){this.#a=++this.#a;let n=this,a=um(t),i=[];for(let c=0,d=a.length;c<d;c++){let g=a[c],x=a[c+1],_=lm(g,x),P=Array.isArray(_)?_[0]:g;if(P in n.#e){n=n.#e[P],_&&i.push(_[1]);continue}n.#e[P]=new Tm,_&&(n.#r.push(_),i.push(_[1])),n=n.#e[P];}return n.#t.push({[e]:{handler:s,possibleKeys:i.filter((c,d,g)=>g.indexOf(c)===d),score:this.#a}}),n}#s(e,t,s,n,a){for(let i=0,c=t.#t.length;i<c;i++){let d=t.#t[i],g=d[s]||d[Le],x={};if(g!==void 0&&(g.params=Object.create(null),e.push(g),n!==ta||a&&a!==ta))for(let _=0,P=g.possibleKeys.length;_<P;_++){let G=g.possibleKeys[_],q=x[g.score];g.params[G]=a?.[G]&&!q?a[G]:n[G]??a?.[G],x[g.score]=true;}}}search(e,t){let s=[];this.#n=ta;let a=[this],i=Pc(t),c=[],d=i.length,g=null;for(let x=0;x<d;x++){let _=i[x],P=x===d-1,G=[];for(let H=0,ue=a.length;H<ue;H++){let se=a[H],Pe=se.#e[_];Pe&&(Pe.#n=se.#n,P?(Pe.#e["*"]&&this.#s(s,Pe.#e["*"],e,se.#n),this.#s(s,Pe,e,se.#n)):G.push(Pe));for(let Z=0,St=se.#r.length;Z<St;Z++){let Ze=se.#r[Z],F=se.#n===ta?{}:{...se.#n};if(Ze==="*"){let mr=se.#e["*"];mr&&(this.#s(s,mr,e,se.#n),mr.#n=F,G.push(mr));continue}let[Lt,ds,Dr]=Ze;if(!_&&!(Dr instanceof RegExp))continue;let He=se.#e[Lt];if(Dr instanceof RegExp){if(g===null){g=new Array(d);let tr=t[0]==="/"?1:0;for(let we=0;we<d;we++)g[we]=tr,tr+=i[we].length+1;}let mr=t.substring(g[x]),fr=Dr.exec(mr);if(fr){if(F[ds]=fr[0],this.#s(s,He,e,se.#n,F),fr[0].length===mr.length&&He.#e["*"]&&this.#s(s,He.#e["*"],e,se.#n,F),gw(He.#e)){He.#n=F;let tr=fr[0].match(/\//)?.length??0;(c[tr]||=[]).push(He);}continue}}(Dr===true||Dr.test(_))&&(F[ds]=_,P?(this.#s(s,He,e,F,se.#n),He.#e["*"]&&this.#s(s,He.#e["*"],e,F,se.#n)):(He.#n=F,G.push(He)));}}let q=c.shift();a=q?G.concat(q):G;}return s.length>1&&s.sort((x,_)=>x.score-_.score),[s.map(({handler:x,params:_})=>[x,_])]}};var Mc=class{name="TrieRouter";#t;constructor(){this.#t=new Em;}add(r,e,t){let s=po(e);if(s){for(let n=0,a=s.length;n<a;n++)this.#t.insert(r,s[n],t);return}this.#t.insert(r,e,t);}match(r,e){return this.#t.search(r,e)}};var Uc=class extends vm{constructor(r={}){super(r),this.router=r.router??new Nc({routers:[new xo,new Mc]});}};g();g();g();g();g();g();g();var qc=r=>Hc(r.replace(/_|-/g,e=>({_:"/","-":"+"})[e]??e)),Fc=r=>yw(r).replace(/\/|\+/g,e=>({"/":"_","+":"-"})[e]??e),yw=r=>{let e="",t=new Uint8Array(r);for(let s=0,n=t.length;s<n;s++)e+=String.fromCharCode(t[s]);return btoa(e)},Hc=r=>{let e=atob(r),t=new Uint8Array(new ArrayBuffer(e.length)),s=e.length/2;for(let n=0,a=e.length-1;n<=s;n++,a--)t[n]=e.charCodeAt(n),t[a]=e.charCodeAt(a);return t};g();var ms=(r=>(r.HS256="HS256",r.HS384="HS384",r.HS512="HS512",r.RS256="RS256",r.RS384="RS384",r.RS512="RS512",r.PS256="PS256",r.PS384="PS384",r.PS512="PS512",r.ES256="ES256",r.ES384="ES384",r.ES512="ES512",r.EdDSA="EdDSA",r))(ms||{});g();g();var xw={deno:"Deno",bun:"Bun",workerd:"Cloudflare-Workers",node:"Node.js"},Om=()=>{let r=globalThis;if(typeof navigator<"u"&&typeof navigator.userAgent=="string"){for(let[t,s]of Object.entries(xw))if(_w(s))return t}return typeof r?.EdgeRuntime=="string"?"edge-light":r?.fastly!==void 0?"fastly":r?.process?.release?.name==="node"?"node":"other"},_w=r=>navigator.userAgent.startsWith(r);g();var Pm=class extends Error{constructor(r){super(`${r} is not an implemented algorithm`),this.name="JwtAlgorithmNotImplemented";}},Gc=class extends Error{constructor(){super('JWT verification requires "alg" option to be specified'),this.name="JwtAlgorithmRequired";}},zc=class extends Error{constructor(r,e){super(`JWT algorithm mismatch: expected "${r}", got "${e}"`),this.name="JwtAlgorithmMismatch";}},fs=class extends Error{constructor(r){super(`invalid JWT token: ${r}`),this.name="JwtTokenInvalid";}},Im=class extends Error{constructor(r){super(`token (${r}) is being used before it's valid`),this.name="JwtTokenNotBefore";}},Dm=class extends Error{constructor(r){super(`token (${r}) expired`),this.name="JwtTokenExpired";}},Lm=class extends Error{constructor(r,e){super(`Invalid "iat" claim, must be a valid number lower than "${r}" (iat: "${e}")`),this.name="JwtTokenIssuedAt";}},_o=class extends Error{constructor(r,e){super(`expected issuer "${r}", got ${e?`"${e}"`:"none"} `),this.name="JwtTokenIssuer";}},Kc=class extends Error{constructor(r){super(`jwt header is invalid: ${JSON.stringify(r)}`),this.name="JwtHeaderInvalid";}},Nm=class extends Error{constructor(r){super(`token(${r}) signature mismatched`),this.name="JwtTokenSignatureMismatched";}},Mm=class extends Error{constructor(r){super(`required "aud" in jwt payload: ${JSON.stringify(r)}`),this.name="JwtPayloadRequiresAud";}},Um=class extends Error{constructor(r,e){super(`expected audience "${Array.isArray(r)?r.join(", "):r}", got "${e}"`),this.name="JwtTokenAudience";}},Us=(r=>(r.Encrypt="encrypt",r.Decrypt="decrypt",r.Sign="sign",r.Verify="verify",r.DeriveKey="deriveKey",r.DeriveBits="deriveBits",r.WrapKey="wrapKey",r.UnwrapKey="unwrapKey",r))(Us||{});g();var hs=new TextEncoder,qm=new TextDecoder;async function Hm(r,e,t){let s=zm(e),n=await ww(r,s);return await crypto.subtle.sign(s,n,t)}async function Gm(r,e,t,s){let n=zm(e),a=await bw(r,n);return await crypto.subtle.verify(n,a,t,s)}function Vc(r){return Hc(r.replace(/-+(BEGIN|END).*?-+/g,"").replace(/\s/g,""))}async function ww(r,e){if(!crypto.subtle||!crypto.subtle.importKey)throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");if(Km(r)){if(r.type!=="private"&&r.type!=="secret")throw new Error(`unexpected key type: CryptoKey.type is ${r.type}, expected private or secret`);return r}let t=[Us.Sign];return typeof r=="object"?await crypto.subtle.importKey("jwk",r,e,false,t):r.includes("PRIVATE")?await crypto.subtle.importKey("pkcs8",Vc(r),e,false,t):await crypto.subtle.importKey("raw",hs.encode(r),e,false,t)}async function bw(r,e){if(!crypto.subtle||!crypto.subtle.importKey)throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");if(Km(r)){if(r.type==="public"||r.type==="secret")return r;r=await Fm(r);}if(typeof r=="string"&&r.includes("PRIVATE")){let s=await crypto.subtle.importKey("pkcs8",Vc(r),e,true,[Us.Sign]);r=await Fm(s);}let t=[Us.Verify];return typeof r=="object"?await crypto.subtle.importKey("jwk",r,e,false,t):r.includes("PUBLIC")?await crypto.subtle.importKey("spki",Vc(r),e,false,t):await crypto.subtle.importKey("raw",hs.encode(r),e,false,t)}async function Fm(r){if(r.type!=="private")throw new Error(`unexpected key type: ${r.type}`);if(!r.extractable)throw new Error("unexpected private key is unextractable");let e=await crypto.subtle.exportKey("jwk",r),{kty:t}=e,{alg:s,e:n,n:a}=e,{crv:i,x:c,y:d}=e;return {kty:t,alg:s,e:n,n:a,crv:i,x:c,y:d,key_ops:[Us.Verify]}}function zm(r){switch(r){case "HS256":return {name:"HMAC",hash:{name:"SHA-256"}};case "HS384":return {name:"HMAC",hash:{name:"SHA-384"}};case "HS512":return {name:"HMAC",hash:{name:"SHA-512"}};case "RS256":return {name:"RSASSA-PKCS1-v1_5",hash:{name:"SHA-256"}};case "RS384":return {name:"RSASSA-PKCS1-v1_5",hash:{name:"SHA-384"}};case "RS512":return {name:"RSASSA-PKCS1-v1_5",hash:{name:"SHA-512"}};case "PS256":return {name:"RSA-PSS",hash:{name:"SHA-256"},saltLength:32};case "PS384":return {name:"RSA-PSS",hash:{name:"SHA-384"},saltLength:48};case "PS512":return {name:"RSA-PSS",hash:{name:"SHA-512"},saltLength:64};case "ES256":return {name:"ECDSA",hash:{name:"SHA-256"},namedCurve:"P-256"};case "ES384":return {name:"ECDSA",hash:{name:"SHA-384"},namedCurve:"P-384"};case "ES512":return {name:"ECDSA",hash:{name:"SHA-512"},namedCurve:"P-521"};case "EdDSA":return {name:"Ed25519",namedCurve:"Ed25519"};default:throw new Pm(r)}}function Km(r){return Om()==="node"&&crypto.webcrypto?r instanceof crypto.webcrypto.CryptoKey:r instanceof CryptoKey}var Wc=r=>Fc(hs.encode(JSON.stringify(r)).buffer).replace(/=/g,""),vw=r=>Fc(r).replace(/=/g,""),Zc=r=>JSON.parse(qm.decode(qc(r)));function Vm(r){if(typeof r=="object"&&r!==null){let e=r;return "alg"in e&&Object.values(ms).includes(e.alg)&&(!("typ"in e)||e.typ==="JWT")}return  false}var Wm=async(r,e,t="HS256")=>{let s=Wc(r),n;typeof e=="object"&&"alg"in e?(t=e.alg,n=Wc({alg:t,typ:"JWT",kid:e.kid})):n=Wc({alg:t,typ:"JWT"});let a=`${n}.${s}`,i=await Hm(e,t,hs.encode(a)),c=vw(i);return `${a}.${c}`},Xc=async(r,e,t)=>{if(!t)throw new Gc;let{alg:s,iss:n,nbf:a=true,exp:i=true,iat:c=true,aud:d}=typeof t=="string"?{alg:t}:t;if(!s)throw new Gc;let g=r.split(".");if(g.length!==3)throw new fs(r);let{header:x,payload:_}=Jc(r);if(!Vm(x))throw new Kc(x);if(x.alg!==s)throw new zc(s,x.alg);let P=Math.floor(Date.now()/1e3);if(a&&_.nbf!==void 0&&(typeof _.nbf!="number"||!Number.isFinite(_.nbf)||_.nbf>P))throw new Im(r);if(i&&_.exp!==void 0&&(typeof _.exp!="number"||!Number.isFinite(_.exp)||_.exp<=P))throw new Dm(r);if(c&&_.iat!==void 0&&(typeof _.iat!="number"||!Number.isFinite(_.iat)||P<_.iat))throw new Lm(P,_.iat);if(n){if(!_.iss)throw new _o(n,null);if(typeof n=="string"&&_.iss!==n)throw new _o(n,_.iss);if(n instanceof RegExp&&!n.test(_.iss))throw new _o(n,_.iss)}if(d){if(!_.aud)throw new Mm(_);if(!(Array.isArray(_.aud)?_.aud:[_.aud]).some(se=>d instanceof RegExp?d.test(se):typeof d=="string"?se===d:Array.isArray(d)&&d.includes(se)))throw new Um(d,_.aud)}let G=r.substring(0,r.lastIndexOf("."));if(!await Gm(e,s,qc(g[2]),hs.encode(G)))throw new Nm(r);return _};[ms.HS256,ms.HS384,ms.HS512];var Jc=r=>{let e=r.split(".");if(e.length!==3)throw new fs(r);try{let t=Zc(e[0]),s=Zc(e[1]);return {header:t,payload:s}}catch{throw new fs(r)}};var ra={sign:Wm,verify:Xc};var wo=ra.verify,bo=ra.sign;g();function gs(r,e){for(let t of r){if(t.name===e)return t;if(t.type==="group"||t.type==="array"){let s=gs(t.fields||[],e);if(s)return s}if(t.type==="blocks")for(let s of t.blocks||[]){let n=gs(s.fields||[],e);if(n)return n}if(t.type==="tabs")for(let s of t.tabs||[]){let n=gs(s.fields||[],e);if(n)return n}if(t.type==="collapsible"||t.type==="row"){let s=gs(t.fields||[],e);if(s)return s}}return null}function sa(r){return r.map(e=>`${e.path.join(".")}: ${e.message}`).join(", ")}function Qr(r,e){if(!(!r||typeof r!="object"))for(let t of e){if(t.type==="tabs"&&Array.isArray(t.tabs)){let n=t.name?r[t.name]:r;if(n&&typeof n=="object")for(let a of t.tabs)Array.isArray(a.fields)&&Qr(n,a.fields);continue}if(!t.name||!(t.name in r))continue;if(r[t.name]===""&&(t.type==="text"||t.type==="textarea"||t.type==="code"||t.type==="markdown"||(r[t.name]=null)),(t.type==="group"||t.type==="collapsible")&&t.name&&Array.isArray(t.fields)&&r[t.name]&&typeof r[t.name]=="object")Qr(r[t.name],t.fields);else if(t.type==="array"&&t.name&&Array.isArray(t.fields)&&Array.isArray(r[t.name]))for(let n of r[t.name])n&&typeof n=="object"&&Qr(n,t.fields);else if(t.type==="blocks"&&t.name&&Array.isArray(t.blocks)&&Array.isArray(r[t.name]))for(let n of r[t.name]){if(!n||typeof n!="object")continue;let a=n.type||n.blockType;if(!a)continue;let i=t.blocks.find(d=>d.slug===a);if(!i||!Array.isArray(i.fields))continue;let c=n.data&&typeof n.data=="object"?n.data:n;Qr(c,i.fields);}}}function Yr(r,e){if(!(!e||typeof e!="object"))for(let t of r){if(t.type==="tabs"&&Array.isArray(t.tabs)){let s=t.name?e[t.name]:e;if(s&&typeof s=="object")for(let n of t.tabs)Array.isArray(n.fields)&&Yr(n.fields,s);}if(t.type==="richtext"&&t.name){let s=e[t.name];typeof s=="string"?e[t.name]=[{type:"paragraph",children:[{text:s}]}]:s&&typeof s=="object"&&!Array.isArray(s)&&s.type==="doc"&&Array.isArray(s.content)&&(e[t.name]=s.content);}if((t.type==="group"||t.type==="collapsible")&&t.name&&Array.isArray(t.fields)&&e[t.name]&&typeof e[t.name]=="object")Yr(t.fields,e[t.name]);else if(t.type==="array"&&t.name&&Array.isArray(t.fields)&&Array.isArray(e[t.name]))for(let s of e[t.name])s&&typeof s=="object"&&Yr(t.fields,s);else if(t.type==="blocks"&&t.name&&Array.isArray(t.blocks)&&Array.isArray(e[t.name]))for(let s of e[t.name]){if(!s||typeof s!="object")continue;let n=s.type||s.blockType;if(!n)continue;let a=t.blocks.find(c=>c.slug===n);if(!a||!Array.isArray(a.fields))continue;let i=s.data&&typeof s.data=="object"?s.data:s;Yr(a.fields,i);}}}function qs(r,e){if(!(!e||typeof e!="object")){for(let t of r)if(!(!t.name||!(t.name in e))){if(t.unique&&(t.type==="text"||t.type==="email"?e[t.name]=`${e[t.name]||t.name}-copy-${Date.now().toString(36)}`:delete e[t.name]),t.type==="tabs"&&t.name&&Array.isArray(t.tabs)&&e[t.name]&&typeof e[t.name]=="object")for(let s of t.tabs)Array.isArray(s.fields)&&qs(s.fields,e[t.name]);else if((t.type==="group"||t.type==="collapsible")&&t.name&&Array.isArray(t.fields)&&e[t.name]&&typeof e[t.name]=="object")qs(t.fields,e[t.name]);else if(t.type==="array"&&t.name&&Array.isArray(t.fields)&&Array.isArray(e[t.name]))for(let s of e[t.name])s&&typeof s=="object"&&(delete s.id,qs(t.fields,s));else if(t.type==="blocks"&&t.name&&Array.isArray(t.blocks)&&Array.isArray(e[t.name]))for(let s of e[t.name]){if(!s||typeof s!="object")continue;delete s.id;let n=s.type||s.blockType;if(!n)continue;let a=t.blocks.find(c=>c.slug===n);if(!a||!Array.isArray(a.fields))continue;let i=s.data&&typeof s.data=="object"?s.data:s;qs(a.fields,i);}}}}g();function Jm(r){let{db:t$1,userLookup:s}=r;return async function(a){let i=f$2(a);if(i&&t$1){let d=await e$3(i,t$1,s);if(d.valid&&d.user)return {user:d.user,tenantContext:Xm(d.user),apiKeyContext:g$1(d),status:200,authType:"apikey"};if(d.error)return {status:401,error:d.error}}let c=h(a);if(c)try{let d=await n$2(c);if(!d.valid)return {status:401,error:d.reason||"Session invalid"};let g=await t(a);if(g){let x=s?await s(g.userId):null;if(x)return {user:x,tenantContext:Xm(x),status:200,authType:"session"}}}catch(d){console.error("Session validation error:",d);}return {status:401,error:"Authentication required"}}}function Xm(r){return {tenantId:r.tenantId||"default",userId:r.id||"anonymous",role:r.role||"guest",roles:[r.role||"guest"],permissions:[],isSuperAdmin:r.role==="super_admin"}}g();var vo=class{storage=new Map;userStorage=new Map;limits;userLimits;constructor(e,t){this.limits={...Cw,...e},this.userLimits=t||{"user:api":{window:6e4,max:500},"user:write":{window:36e5,max:100}};}getKey(e,t){return `${e}:${t}`}getUserKey(e,t,s){return `user:${e}:${t}:${s}`}cleanupOldEntries(e,t){let n=Date.now()-t;for(;e.length>0&&e[0].timestamp<n;)e.shift();}async check(e,t){let s=this.limits[e]||this.limits["api:general"],n=this.getKey(e,t),a=this.storage.get(n);a||(a=[],this.storage.set(n,a)),this.cleanupOldEntries(a,s.window);let i=Date.now(),c=a.reduce((d,g)=>d+g.count,0);if(a.push({timestamp:i,count:1}),c>=s.max){let g=a.reduce((x,_)=>x.timestamp<_.timestamp?x:_,a[0]).timestamp+s.window;return {allowed:false,remaining:0,resetAt:g,retryAfter:Math.ceil((g-i)/1e3)}}return {allowed:true,remaining:s.max-c-1,resetAt:i+s.window}}async checkUser(e,t,s){let n=this.userLimits[e]||this.userLimits["user:api"],a=this.userStorage.get(t),i=[];a?i=a.get(this.getKey(e,s))||[]:(this.userStorage.has(t)||this.userStorage.set(t,new Map),this.userStorage.get(t).set(this.getKey(e,s),i)),this.cleanupOldEntries(i,n.window);let c=Date.now(),d=i.reduce((g,x)=>g+x.count,0);if(i.push({timestamp:c,count:1}),d>=n.max){let x=i.reduce((_,P)=>_.timestamp<P.timestamp?_:P,i[0]).timestamp+n.window;return {allowed:false,remaining:0,resetAt:x,retryAfter:Math.ceil((x-c)/1e3)}}return {allowed:true,remaining:n.max-d-1,resetAt:c+n.window}}async reset(e,t){let s=this.getKey(e,t);this.storage.delete(s);}async resetUser(e,t,s){let n=this.userStorage.get(t);if(n){let a=this.getKey(e,s);n.delete(a);}}async getStatus(e,t){let s=this.limits[e]||this.limits["api:general"],n=this.getKey(e,t),a=this.storage.get(n);a||(a=[],this.storage.set(n,a)),this.cleanupOldEntries(a,s.window);let i=Date.now(),c=a.reduce((d,g)=>d+g.count,0);return {count:c,limit:s.max,remaining:Math.max(0,s.max-c),resetAt:i+s.window}}setLimit(e,t){this.limits[e]=t;}setUserLimit(e,t){this.userLimits[e]=t;}},Cw={"auth:login":{window:9e5,max:5},"auth:register":{window:36e5,max:3},"auth:forgot":{window:36e5,max:3},"auth:reset":{window:36e5,max:5},"auth:verify":{window:36e5,max:5},"api:general":{window:6e4,max:100},"api:authenticated":{window:6e4,max:200}};g();g();g();g();var Qc={retentionDays:30};var Qm=class{redis;prefix;retentionDays;constructor(e,t=30,s="kyro:audit:"){this.redis=e,this.prefix=s,this.retentionDays=t;}async log(e){let t=randomBytes(16).toString("hex"),s=new Date,n={...e,id:t,timestamp:s},a=this.getKeyForDate(s),i=`${this.prefix}log:${t}`;await this.redis.hset(i,this.serializeLog(n)),await this.redis.expire(i,this.retentionDays*24*60*60+3600),await this.redis.zadd(a,s.getTime(),t),await this.redis.expire(a,this.retentionDays*24*60*60+3600);let c=e.userId?`${this.prefix}user:${e.userId}`:null;return c&&(await this.redis.zadd(c,s.getTime(),t),await this.redis.expire(c,this.retentionDays*24*60*60+3600)),t}async get(e){let t=`${this.prefix}log:${e}`,s=await this.redis.hgetall(t);return !s||Object.keys(s).length===0?null:this.deserializeLog(s)}async query(e={}){let{limit:t=50,offset:s=0}=e,n=[];if(e.userId)n.push(`${this.prefix}user:${e.userId}`);else if(e.startDate||e.endDate)n=this.getKeysForDateRange(e.startDate,e.endDate);else {let d=new Date;n=this.getKeysForDateRange(new Date(d.getTime()-this.retentionDays*24*60*60*1e3),d);}let a=[];for(let d of n){let g=await this.redis.zrange(d,0,-1,"WITHSCORES");for(let x=0;x<g.length;x+=2)a.push([g[x],parseInt(g[x+1],10)]);}a.sort((d,g)=>g[1]-d[1]);let i=a.length;a=a.slice(s,s+t);let c=[];for(let[d]of a){let g=await this.get(d);g&&this.matchesFilter(g,e)&&c.push(g);}return {logs:c,total:i}}async getRecent(e=50){let t=[],s=new Date,n=this.getKeysForDateRange(new Date(s.getTime()-10080*60*1e3),s),a=[];for(let i of n){let c=await this.redis.zrange(i,0,-1,"WITHSCORES");for(let d=0;d<c.length;d+=2)a.push([c[d],parseInt(c[d+1],10)]);}a.sort((i,c)=>c[1]-i[1]);for(let[i]of a.slice(0,e)){let c=await this.get(i);c&&t.push(c);}return t}async getUserActivity(e,t=50){let s=`${this.prefix}user:${e}`,n=await this.redis.zrange(s,0,t-1),a=[];for(let i of n){let c=await this.get(i);c&&a.push(c);}return a}async getStats(e,t){let s=this.getKeysForDateRange(e||new Date(Date.now()-2592e6),t||new Date),n={},a=0,i=0,c=0,d=new Set;for(let g of s){let x=await this.redis.zrange(g,0,-1);for(let _ of x){let P=await this.get(_);P&&(a++,n[P.action]=(n[P.action]||0)+1,P.success&&c++,P.action==="login_failed"&&i++,P.userId&&d.add(P.userId));}}return {totalEvents:a,byAction:n,successRate:a>0?c/a:1,failedLogins:i,uniqueUsers:d}}async cleanup(){let e=Date.now()-this.retentionDays*24*60*60*1e3,t=await this.redis.keys(`${this.prefix}date:*`),s=0;for(let n of t){let a=await this.redis.zrangebyscore(n,0,e);for(let i of a)await this.redis.del(`${this.prefix}log:${i}`),s++;await this.redis.zremrangebyscore(n,0,e);}return s}getKeyForDate(e){let t=e.getFullYear(),s=String(e.getMonth()+1).padStart(2,"0"),n=String(e.getDate()).padStart(2,"0");return `${this.prefix}date:${t}-${s}-${n}`}getKeysForDateRange(e,t){let s=[],n=e||new Date(Date.now()-this.retentionDays*24*60*60*1e3),a=t||new Date,i=new Date(n);for(;i<=a;)s.push(this.getKeyForDate(i)),i.setDate(i.getDate()+1);return s}matchesFilter(e,t){return !(t.action&&!(Array.isArray(t.action)?t.action:[t.action]).includes(e.action)||t.resource&&e.resource!==t.resource||t.resourceId&&e.resourceId!==t.resourceId||t.success!==void 0&&e.success!==t.success)}serializeLog(e){let t={id:e.id,timestamp:new Date(e.timestamp).toISOString(),action:e.action,resource:e.resource,success:e.success?"1":"0"};return e.userId&&(t.userId=e.userId),e.userEmail&&(t.userEmail=e.userEmail),e.role&&(t.role=e.role),e.resourceId&&(t.resourceId=e.resourceId),e.ipAddress&&(t.ipAddress=e.ipAddress),e.userAgent&&(t.userAgent=e.userAgent),e.error&&(t.error=e.error),e.changes&&(t.changes=JSON.stringify(e.changes)),e.metadata&&(t.metadata=JSON.stringify(e.metadata)),t}deserializeLog(e){return {id:e.id,timestamp:new Date(e.timestamp),action:e.action,userId:e.userId,userEmail:e.userEmail,role:e.role,resource:e.resource,resourceId:e.resourceId,ipAddress:e.ipAddress,userAgent:e.userAgent,success:e.success==="1",error:e.error,changes:e.changes?JSON.parse(e.changes):void 0,metadata:e.metadata?JSON.parse(e.metadata):void 0}}};function cU(r){return {ipAddress:r.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||r.headers.get("x-real-ip")||"unknown",userAgent:r.headers.get("user-agent")||"unknown"}}var Ym=class{logs=[];retentionDays;constructor(e=Qc.retentionDays){this.retentionDays=e;}async log(e){let t=randomBytes(16).toString("hex"),n={...e,id:t,timestamp:new Date};return this.logs.push(n),this.cleanupOldLogs(),t}async get(e){return this.logs.find(t=>t.id===e)||null}async query(e={}){let{limit:t=50,offset:s=0}=e,n=[...this.logs];if(e.userId&&(n=n.filter(g=>g.userId===e.userId)),e.action){let g=Array.isArray(e.action)?e.action:[e.action];n=n.filter(x=>g.includes(x.action));}e.resource&&(n=n.filter(g=>g.resource===e.resource)),e.resourceId&&(n=n.filter(g=>g.resourceId===e.resourceId)),e.success!==void 0&&(n=n.filter(g=>g.success===e.success));let a=e.startDate,i=e.endDate;a!==void 0&&(n=n.filter(g=>g.timestamp>=a)),i!==void 0&&(n=n.filter(g=>g.timestamp<=i)),n.sort((g,x)=>x.timestamp.getTime()-g.timestamp.getTime());let c=n.length;return {logs:n.slice(s,s+t),total:c}}async getRecent(e=50){let t=new Date(Date.now()-6048e5);return this.logs.filter(n=>n.timestamp>=t).sort((n,a)=>a.timestamp.getTime()-n.timestamp.getTime()).slice(0,e)}async getUserActivity(e,t=50){return this.logs.filter(n=>n.userId===e).sort((n,a)=>a.timestamp.getTime()-n.timestamp.getTime()).slice(0,t)}async getStats(e,t){let s=e||new Date(Date.now()-2592e6),n=t||new Date,a=this.logs.filter(_=>_.timestamp>=s&&_.timestamp<=n),i={},c=0,d=0,g=0,x=new Set;for(let _ of a){c++;let P=_.action;i[P]=(i[P]||0)+1,_.success&&g++,_.action==="login_failed"&&d++,_.userId&&x.add(_.userId);}return {totalEvents:c,byAction:i,successRate:c>0?g/c:1,failedLogins:d,uniqueUsers:x}}async cleanup(){let e=new Date(Date.now()-this.retentionDays*24*60*60*1e3),t=this.logs.length;return this.logs=this.logs.filter(s=>s.timestamp>=e),t-this.logs.length}cleanupOldLogs(){let e=new Date(Date.now()-this.retentionDays*24*60*60*1e3);this.logs.length;this.logs=this.logs.filter(s=>s.timestamp>=e);}};var So=class{authAdapter;email;passwordPolicy;lockout;rateLimiter;auditLogger;baseUrl;emailVerificationRequired;jwtSecret;constructor(e){this.authAdapter=e.redis,this.email=e.email,this.passwordPolicy=e.passwordPolicy||new r$1,this.lockout=e.lockout,this.rateLimiter=e.rateLimiter,this.auditLogger=e.auditLogger,this.baseUrl=e.baseUrl||"http://localhost:4321",this.emailVerificationRequired=e.emailVerificationRequired??true,this.jwtSecret=e.jwtSecret||"kyro-default-secret-key-change-me-in-production";}getBaseUrl(e){if(e)try{let t=e.headers.get("x-forwarded-proto")||(e.url.startsWith("https")?"https":"http"),s=e.headers.get("x-forwarded-host")||e.headers.get("host");return s?`${t}://${s}`:new URL(e.url).origin}catch{}return process.env.KYRO_BASE_URL||process.env.SERVER_URL||process.env.PUBLIC_URL||process.env.SITE_URL||this.baseUrl||"http://localhost:4321"}async register(e){let{ipAddress:t,userAgent:s}=a$2(e);if(this.rateLimiter){let n=await this.rateLimiter.check("auth:register",t);if(!n.allowed)return this.rateLimitResponse(n)}try{let n=await e.json();if(!n.email||!n.password)return this.errorResponse("Email and password are required",400);if(n.password!==n.confirmPassword)return this.errorResponse("Passwords do not match",400);let a=this.passwordPolicy.validate(n.password);if(!a.valid)return this.errorResponse(a.errors.join(". "),400);let i=await this.authAdapter.findUserByEmail(n.email);if(i){if(!i.emailVerified&&this.emailVerificationRequired&&this.email){let g=(await this.authAdapter.createEmailVerificationToken?.(i.id))?.token||randomBytes(32).toString("hex"),_=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${g}`,P=this.email.getTemplates().verifyEmail(_,n.email);return await this.email.send({to:n.email,...P}),this.jsonResponse({success:!0,message:"An unverified account already exists with this email. We have resent the confirmation link to your inbox.",requiresVerification:!0},200)}return this.errorResponse("Email already registered",400)}let c=await this.authAdapter.createUser({email:n.email,password:n.password,role:n.role||"customer",tenantId:n.tenantId});if(this.emailVerificationRequired&&this.email){let d=randomBytes(32).toString("hex"),x=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${d}`;await this.authAdapter.createSession(c.id,{ipAddress:t,userAgent:s});let _=this.email.getTemplates().verifyEmail(x,n.email);await this.email.send({to:n.email,..._});}return this.auditLogger&&await this.auditLogger.log({action:"register",userId:c.id,userEmail:c.email,resource:"auth",ipAddress:t,userAgent:s,success:!0}),this.jsonResponse({success:!0,message:"Registration successful",user:this.sanitizeUser(c),requiresVerification:this.emailVerificationRequired&&!!this.email},201)}catch(n){return console.error("[AuthRoutes.register] Registration error:",n),this.errorResponse("Registration failed",500)}}async login(e){let{ipAddress:t,userAgent:s}=a$2(e);if(this.rateLimiter){let n=await this.rateLimiter.check("auth:login",t);if(!n.allowed)return this.rateLimitResponse(n)}try{let n=await e.json();if(!n.email||!n.password)return this.errorResponse("Email and password are required",400);let a=await this.authAdapter.findUserByEmail(n.email);if(!a)return await this.recordFailedLogin(t,s),this.errorResponse("Invalid credentials",401);if(a.locked)return this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:a.id,userEmail:a.email,resource:"auth",ipAddress:t,userAgent:s,success:!1,error:"Account locked"}),this.errorResponse("Account locked. Contact an administrator.",403);if(this.lockout){let x=await this.lockout.checkLockout(a.id);if(x.locked)return this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:a.id,userEmail:a.email,resource:"auth",ipAddress:t,userAgent:s,success:!1,error:"Account locked"}),this.errorResponse(`Account locked. Try again in ${Math.ceil((x.lockedUntil.getTime()-Date.now())/6e4)} minutes`,423)}let i=await this.authAdapter.verifyPassword(n.email,n.password);if(!i)return await this.recordFailedLogin(t,s,a.id,a.email),this.errorResponse("Invalid credentials",401);if(this.emailVerificationRequired&&i.emailVerified===!1){if(this.email){let _=(await this.authAdapter.createEmailVerificationToken?.(i.id))?.token||randomBytes(32).toString("hex"),G=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${_}`,q=this.email.getTemplates().verifyEmail(G,i.email);await this.email.send({to:i.email,...q});}return this.errorResponse("Your email address is not verified yet. We have sent a new confirmation link to your email inbox.",403)}this.lockout&&await this.lockout.resetAttempts(a.id),this.auditLogger&&await this.auditLogger.log({action:"login",userId:a.id,userEmail:a.email,role:a.role,resource:"auth",ipAddress:t,userAgent:s,success:!0}),await this.authAdapter.updateUser(a.id,{lastLogin:new Date().toISOString()});let c=await l({id:a.id,email:a.email,role:a.role,tenantId:a.tenantId});if(this.email&&a.email){let x=new Date().toLocaleString(),_=this.email.getTemplates().newLogin(t,x,a.email);this.email.send({to:a.email,..._}).catch(P=>console.error("Failed to send newLogin email:",P));}let d={success:!0,user:this.sanitizeUser(a)},g=this.jsonResponse(d);return j$1(g,c)}catch(n){return console.error("[Auth] Login error:",n),this.errorResponse("Login failed",500)}}async logout(e){let t$1=h(e);if(!t$1)return this.errorResponse("No session to logout",401);let{ipAddress:s,userAgent:n}=a$2(e);try{let a=await t(e);a&&(await p$1(t$1),this.auditLogger&&await this.auditLogger.log({action:"logout",userId:a.userId,userEmail:a.email,resource:"auth",ipAddress:s,userAgent:n,success:!0}));let i=this.jsonResponse({success:!0,message:"Logged out successfully"});return k(i)}catch{return this.errorResponse("Logout failed",500)}}async refresh(e){try{let t=h(e);if(!t)return this.errorResponse("Not authenticated",401);let s=await o$1(t,e);return s?this.jsonResponse({success:!0,expiresAt:s.expiresAt}):this.errorResponse("Session not found",404)}catch(t){return console.error("[Auth] Session refresh error:",t),this.errorResponse("Session refresh failed",500)}}async me(e){let t$1=await t(e);return t$1?this.jsonResponse({success:true,user:{id:t$1.userId,email:t$1.email,role:t$1.role,tenantId:t$1.tenantId}}):this.errorResponse("Not authenticated",401)}async changePassword(e){let t$1=await t(e);if(!t$1)return this.errorResponse("Not authenticated",401);let{ipAddress:s,userAgent:n}=a$2(e);try{let a=await e.json(),{currentPassword:i,newPassword:c,confirmPassword:d}=a;if(!i||!c)return this.errorResponse("Current and new password required",400);if(c!==d)return this.errorResponse("Passwords do not match",400);let g=this.passwordPolicy.validate(c);if(!g.valid)return this.errorResponse(g.errors.join(". "),400);let x=await this.authAdapter.findUserById(t$1.userId);if(!x)return this.errorResponse("User not found",404);if(!(x.passwordHash?await this.authAdapter.verifyPassword(i,x.passwordHash):!1))return this.errorResponse("Current password is incorrect",401);let P=await this.authAdapter.getPasswordHistory?.(x.id,5);if(await this.authAdapter.isPasswordInHistory?.(c,x.id,5))return this.errorResponse("Password was recently used. Please choose a different password",400);let q=await this.authAdapter.hashPassword(c);if(x.passwordHash&&await this.authAdapter.addPasswordToHistory?.(x.id,x.passwordHash),await this.authAdapter.updateUser(x.id,{passwordHash:q}),await this.authAdapter.deleteUserSessions(x.id),this.email&&this.email.getTemplates){let H=this.email.getTemplates().passwordChanged(x.email);await this.email.send({to:x.email,...H});}return this.auditLogger&&await this.auditLogger.log({action:"password_change",userId:x.id,userEmail:x.email,resource:"auth",ipAddress:s,userAgent:n,success:!0}),this.jsonResponse({success:!0,message:"Password changed successfully"})}catch{return this.errorResponse("Password change failed",500)}}async forgotPassword(e){let{ipAddress:t,userAgent:s}=a$2(e);if(this.rateLimiter){let n=await this.rateLimiter.check("auth:forgot",t);if(!n.allowed)return this.rateLimitResponse(n)}try{let n=await e.json(),{email:a}=n;if(!a)return this.errorResponse("Email required",400);let i=await this.authAdapter.findUserByEmail(a);if(!i)return this.jsonResponse({success:!0,message:"If the email exists, a reset link has been sent"});if(this.email){let c=randomBytes(32).toString("hex");if(this.authAdapter.createPasswordResetToken){let _=await this.authAdapter.createPasswordResetToken(i.email);_.token&&(c=_.token);}let g=`${this.getBaseUrl(e)}/admin/auth/reset-password?token=${c}`,x=this.email.getTemplates().resetPassword(g,i.email);await this.email.send({to:i.email,...x});}return this.auditLogger&&await this.auditLogger.log({action:"password_reset",userId:i.id,userEmail:i.email,resource:"auth",ipAddress:t,userAgent:s,success:!0}),this.jsonResponse({success:!0,message:"If the email exists, a reset link has been sent"})}catch{return this.errorResponse("Password reset request failed",500)}}async resetPassword(e){let{ipAddress:t,userAgent:s}=a$2(e);if(this.rateLimiter){let n=await this.rateLimiter.check("auth:reset",t);if(!n.allowed)return this.rateLimitResponse(n)}try{let n=await e.json(),{token:a,newPassword:i,confirmPassword:c}=n;if(!a||!i)return this.errorResponse("Reset token and new password are required",400);if(i!==c)return this.errorResponse("Passwords do not match",400);let d=this.passwordPolicy.validate(i);if(!d.valid)return this.errorResponse(d.errors.join(". "),400);if(this.authAdapter.resetPasswordWithToken){let g=await this.authAdapter.resetPasswordWithToken(a,i);if(!g.success)return this.errorResponse(g.error||"Password reset failed or token expired",400)}return this.jsonResponse({success:!0,message:"Password reset successful. You can now log in with your new password."})}catch(n){return console.error("[AuthRoutes.resetPassword] Error:",n),this.errorResponse("Password reset failed",500)}}async verifyEmail(e){let s=new URL(e.url).searchParams.get("token");if(!s)return this.errorResponse("Verification token required",400);try{if(this.authAdapter.verifyEmailToken){let n=await this.authAdapter.verifyEmailToken(s);if(!n.success)return this.errorResponse(n.error||"Invalid or expired verification token",400);if(n.userId&&this.email){let a=await this.authAdapter.findUserById(n.userId);if(a){let i=this.email.getTemplates().welcome(a.email);await this.email.send({to:a.email,...i});}}}return this.jsonResponse({success:!0,message:"Email address verified successfully"})}catch(n){return console.error("[AuthRoutes.verifyEmail] Error:",n),this.errorResponse("Email verification failed",500)}}async recordFailedLogin(e,t,s,n){if(this.lockout){let a=await this.lockout.recordFailedAttempt(s||e);if(a.locked&&a.totalAttempts===this.lockout.getConfig().maxAttempts&&this.email&&n){let i=Math.ceil(this.lockout.getConfig().lockDuration/6e4),c=this.email.getTemplates().accountLocked(a.totalAttempts,i,n);this.email.send({to:n,...c}).catch(d=>console.error("Failed to send accountLocked email:",d));}}this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:s,userEmail:n,resource:"auth",ipAddress:e,userAgent:t,success:false,error:"Invalid credentials"});}sanitizeUser(e){let{passwordHash:t,...s}=e;return s}jsonResponse(e,t=200){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":"application/json","Cache-Control":"no-store, no-cache, must-revalidate, max-age=0"}})}async listSessions(e){let t$1=await t(e);if(!t$1)return this.errorResponse("Not authenticated",401);try{let s=await r$2(t$1.userId,h(e)??void 0);return this.jsonResponse({sessions:s})}catch(s){return console.error("[AuthRoutes.listSessions] Error:",s),this.errorResponse("Failed to list sessions",500)}}async revokeSession(e,t$1){let s=await t(e);if(!s)return this.errorResponse("Not authenticated",401);try{let a=(await r$2(s.userId)).find(i=>i.id===t$1);return a?a.currentSession?this.errorResponse("Cannot revoke current session",400):(await p$1(t$1),this.jsonResponse({success:!0,message:"Session revoked"})):this.errorResponse("Session not found",404)}catch(n){return console.error("[AuthRoutes.revokeSession] Error:",n),this.errorResponse("Failed to revoke session",500)}}async revokeOtherSessions(e){let t$1=await t(e);if(!t$1)return this.errorResponse("Not authenticated",401);try{let s=await r$2(t$1.userId),n=h(e);for(let a of s)a.currentSession||await p$1(a.id);return this.jsonResponse({success:!0,message:"Other sessions revoked"})}catch(s){return console.error("[AuthRoutes.revokeOtherSessions] Error:",s),this.errorResponse("Failed to revoke sessions",500)}}async renameSession(e,t$1){let s$1=await t(e);if(!s$1)return this.errorResponse("Not authenticated",401);try{if(!(await r$2(s$1.userId)).find(d=>d.id===t$1))return this.errorResponse("Session not found",404);let i=await e.json(),{name:c}=i;return !c||typeof c!="string"||c.trim().length===0?this.errorResponse("Invalid session name",400):(await s(t$1,c.trim()),this.jsonResponse({success:!0,message:"Session renamed"}))}catch(n){return console.error("[AuthRoutes.renameSession] Error:",n),this.errorResponse("Failed to rename session",500)}}async refreshSession(e){let t=h(e);if(!t)return this.errorResponse("No session",401);try{let{refreshSession:s}=await import('./auth-session-O7IIH7EP.js'),n=await s(t,e);return n?this.jsonResponse({success:!0,expiresAt:n.expiresAt}):this.errorResponse("Session not found",404)}catch(s){return console.error("[AuthRoutes.refreshSession] Error:",s),this.errorResponse("Failed to refresh session",500)}}errorResponse(e,t){return new Response(JSON.stringify({success:false,error:e}),{status:t,headers:{"Content-Type":"application/json"}})}async rateLimitResponse(e){return new Response(JSON.stringify({error:"Too many requests. Please try again later."}),{status:429,headers:{"Content-Type":"application/json",...e.retryAfter?{"Retry-After":e.retryAfter.toString()}:{}}})}async requestMagicLink(e){let{ipAddress:t,userAgent:s}=a$2(e);try{let n=await e.json();if(!n.email)return this.errorResponse("Email required",400);let a=await this.authAdapter.findUserByEmail(n.email);if(!a)return this.jsonResponse({success:!0,message:"If an account exists, a link was sent."});if(this.email){let i=Buffer.from(JSON.stringify({email:a.email,exp:Date.now()+6e5})).toString("base64url"),c=createHmac("sha256",this.jwtSecret).update(i).digest("hex"),d=`${i}.${c}`,x=`${this.getBaseUrl(e)}/admin/auth/magic-link?token=${d}`,_=this.email.getTemplates().magicLink(x,void 0,a.email);this.email.send({to:a.email,..._}).catch(P=>console.error("Magic link err:",P));}return this.jsonResponse({success:!0,message:"If an account exists, a link was sent."})}catch{return this.errorResponse("Failed to process request",500)}}async verifyMagicLink(e){let{ipAddress:t,userAgent:s}=a$2(e),a=new URL(e.url).searchParams.get("token");if(!a)return this.errorResponse("Token required",400);try{let[i,c]=a.split(".");if(!i||!c)return this.errorResponse("Invalid token",400);let d=createHmac("sha256",this.jwtSecret).update(i).digest("hex");if(c!==d)return this.errorResponse("Invalid token",400);let g=JSON.parse(Buffer.from(i,"base64url").toString());if(Date.now()>g.exp)return this.errorResponse("Token expired",400);let x=await this.authAdapter.findUserByEmail(g.email);if(!x)return this.errorResponse("User not found",404);if(x.locked)return this.errorResponse("Account locked",403);let _=await l({id:x.id,email:x.email,role:x.role,tenantId:x.tenantId});this.auditLogger&&await this.auditLogger.log({action:"login",userId:x.id,userEmail:x.email,resource:"auth",ipAddress:t,userAgent:s,success:!0});let P=this.jsonResponse({success:!0,user:this.sanitizeUser(x)});return j$1(P,_)}catch{return this.errorResponse("Invalid token",400)}}async inviteUser(e){try{let t=await e.json();if(!t.email||!t.role)return this.errorResponse("Email and role required",400);let s=await this.authAdapter.findUserByEmail(t.email);if(s)return this.errorResponse("User already exists",409);if(s=await this.authAdapter.createUser({email:t.email,password:randomBytes(16).toString("hex"),role:t.role}),this.email){let n=await this.authAdapter.createPasswordResetToken(s.email),i=`${this.getBaseUrl(e)}/admin/auth/reset-password?token=${n.token}`,c=this.email.getTemplates().userInvite(i,t.role,t.inviterName||"An administrator");this.email.send({to:s.email,...c}).catch(d=>console.error("Invite email err:",d));}return this.jsonResponse({success:!0,message:"User invited successfully"})}catch{return this.errorResponse("Failed to invite user",500)}}};g();var Yc=e(a(),1);var Ao=class{db;sessionTTL;constructor(e){this.db=e.db?.client||e.db,this.sessionTTL=e.sessionTTL||86400;}async executeSql(e,t=[]){try{if(this.db&&typeof this.db.prepare=="function"){let s=this.db.prepare(e);return (await(t.length>0?s.bind(...t):s).all()).results||[]}else if(this.db&&typeof this.db.run=="function"){let s=await this.db.run(J.raw(this.replaceParams(e,t)));return s.rows||s.results||(Array.isArray(s)?s:[])}else if(this.db&&typeof this.db.all=="function"){let s=await this.db.all(J.raw(this.replaceParams(e,t)));return Array.isArray(s)?s:s.results||[]}else if(this.db&&typeof this.db.execute=="function"){let s=await this.db.execute(J.raw(this.replaceParams(e,t)));return s.rows||s.results||(Array.isArray(s)?s:[])}}catch(s){console.warn("[D1AuthAdapter] SQL execution note:",s.message);}return []}async getOne(e,t=[]){try{if(this.db&&typeof this.db.prepare=="function"){let n=this.db.prepare(e);return await(t.length>0?n.bind(...t):n).first()||null}}catch{}let s=await this.executeSql(e,t);return s.length>0?s[0]:null}replaceParams(e,t){let s=0;return e.replace(/\?/g,()=>{let n=t[s++];return n==null?"NULL":typeof n=="number"||typeof n=="boolean"?String(n):`'${String(n).replace(/'/g,"''")}'`})}async connect(){await this.executeSql(`
+import {r as r$1,p as p$2,q as q$1}from'./chunk-KWGB3YNI.js';import {a as a$a}from'./chunk-R25WLKX4.js';import {l,j as j$1,h,t,p as p$1,k,o as o$1,r as r$2,s,b,n as n$2}from'./chunk-6TPICJ2L.js';import {a as a$e,b as b$4,g as g$3}from'./chunk-W45TLOOT.js';import {a as a$d}from'./chunk-IKGVPXMK.js';import {j as j$3,h as h$1,k as k$1,i as i$3,f as f$3,g as g$2,e as e$5}from'./chunk-YUUXFD73.js';import {a as a$3}from'./chunk-LVBHOZZF.js';import {p,q,R,r,n,u as u$1,f,A,m as m$1,c as c$2,N,x as x$1,t as t$1,O,z as z$1,B,C,D,E as E$1,I as I$1,G,i as i$2,a as a$b,Q as Q$1,v as v$1,y,w as w$1,P,T as T$2,j as j$4,U as U$1,k as k$2,F as F$1,h as h$3,o as o$2,s as s$2}from'./chunk-OBYAIJVU.js';import {n as n$1,f as f$1,e as e$1,H,l as l$1,T as T$1,I as I$2,C as C$1,E as E$2,D as D$1,F,G as G$1,h as h$2,R as R$1,S,i as i$4,s as s$1,t as t$2,d as d$4,m as m$2,u as u$3,p as p$3,r as r$3}from'./chunk-JRUQ5ABB.js';import {a as a$4}from'./chunk-CIVA6SKW.js';import {q as q$2,n as n$3}from'./chunk-WPM6LFCY.js';import {c,a as a$c,d as d$2,b as b$2}from'./chunk-U6KFONKM.js';import {x,i,a as a$1,v,w,z as z$2,u as u$2,e as e$4,c as c$4,A as A$1,y as y$1,d as d$3,b as b$3}from'./chunk-TYQYKKWJ.js';import {a as a$2}from'./chunk-L2QXP26Q.js';import {d,a as a$6,b as b$1,c as c$3}from'./chunk-YZEMLLD2.js';import {d as d$1,i as i$1,j as j$2,f as f$2,e as e$3,g as g$1}from'./chunk-RTHJ6SS5.js';import {e as e$2,c as c$1}from'./chunk-KNOFTUQV.js';import {a as a$8}from'./chunk-ZWDBPEXL.js';import {J}from'./chunk-3NSZZCOJ.js';import {a as a$9}from'./chunk-5ZEYOFAK.js';import {a}from'./chunk-7NH7H3WA.js';import {a as a$7}from'./chunk-VVVCCB6R.js';import {a as a$5}from'./chunk-TBHNE4VV.js';import {g,e}from'./chunk-Y2YAKDEQ.js';import NB,{createHash,randomBytes,createHmac}from'crypto';import Co,{join,resolve,basename,extname}from'path';import {existsSync,readFileSync}from'fs';import {mkdir,readdir,stat,rename,unlink,writeFile}from'fs/promises';import Bw from'process';import {Readable}from'stream';if (typeof window === "undefined") { const { createRequire } = await import(/* @vite-ignore */ 'module'); createRequire(import.meta.url); }
+g();g();g();g();g();g();var Tc=(r,e,t)=>(s,n)=>{let a=-1;return i(0);async function i(c){if(c<=a)throw new Error("next() called multiple times");a=c;let d,g=false,x;if(r[c]?(x=r[c][0][0],s.req.routeIndex=c):x=c===r.length&&n||void 0,x)try{d=await x(s,()=>i(c+1));}catch(_){if(_ instanceof Error&&e)s.error=_,d=await e(_,s),g=true;else throw _}else s.finalized===false&&t&&(d=await t(s));return d&&(s.finalized===false||g)&&(s.res=d),s}};g();g();g();g();var am=Symbol();g();g();g();var om=(r,e)=>new Response(r,{headers:{"Content-Type":e.replace(/^[^;]+/,s=>s.toLowerCase())}}).formData();var uo=r=>"headers"in r,cm=async(r,e=Object.create(null))=>{let{all:t=false,dot:s=false}=e,i=(uo(r)?r.headers:r.raw.headers).get("Content-Type")?.split(";")[0].trim().toLowerCase();return i==="multipart/form-data"||i==="application/x-www-form-urlencoded"?tw(r,{all:t,dot:s}):{}};async function tw(r,e){if(!uo(r)&&r.bodyCache.formData)return im(await r.bodyCache.formData,e);let t=uo(r)?r.headers:r.raw.headers,s=await r.arrayBuffer(),n=om(s,t.get("Content-Type")||"");uo(r)||(r.bodyCache.formData=n);let a=await n;return a?im(a,e):{}}function im(r,e){let t=Object.create(null);return r.forEach((s,n)=>{e.all||n.endsWith("[]")?rw(t,n,s):t[n]=s;}),e.dot&&Object.entries(t).forEach(([s,n])=>{s.includes(".")&&(sw(t,s,n),delete t[s]);}),t}var rw=(r,e,t)=>{r[e]!==void 0?Array.isArray(r[e])?r[e].push(t):r[e]=[r[e],t]:e.endsWith("[]")?r[e]=[t]:r[e]=t;},sw=(r,e,t)=>{if(/(?:^|\.)__proto__\./.test(e))return;let s=r,n=e.split(".");n.forEach((a,i)=>{i===n.length-1?s[a]=t:((!s[a]||typeof s[a]!="object"||Array.isArray(s[a])||s[a]instanceof File)&&(s[a]=Object.create(null)),s=s[a]);});};g();var Pc=r=>{let e=r.split("/");return e[0]===""&&e.shift(),e},um=r=>{let{groups:e,path:t}=nw(r),s=Pc(t);return aw(s,e)},nw=r=>{let e=[];return r=r.replace(/\{[^}]+\}/g,(t,s)=>{let n=`@${s}`;return e.push([n,t]),n}),{groups:e,path:r}},aw=(r,e)=>{for(let t=e.length-1;t>=0;t--){let[s]=e[t];for(let n=r.length-1;n>=0;n--)if(r[n].includes(s)){r[n]=r[n].replace(s,e[t][1]);break}}return r},lo={},lm=(r,e)=>{if(r==="*")return "*";let t=r.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(t){let s=`${r}#${e}`;return lo[s]||(t[2]?lo[s]=e&&e[0]!==":"&&e[0]!=="*"?[s,t[1],new RegExp(`^${t[2]}(?=/${e})`)]:[r,t[1],new RegExp(`^${t[2]}$`)]:lo[s]=[r,t[1],true]),lo[s]}return null},Jn=(r,e)=>{try{return e(r)}catch{return r.replace(/(?:%[0-9A-Fa-f]{2})+/g,t=>{try{return e(t)}catch{return t}})}},ow=r=>Jn(r,decodeURI),Ic=r=>{let e=r.url,t=e.indexOf("/",e.indexOf(":")+4),s=t;for(;s<e.length;s++){let n=e.charCodeAt(s);if(n===37){let a=e.indexOf("?",s),i=e.indexOf("#",s),c=a===-1?i===-1?void 0:i:i===-1?a:Math.min(a,i),d=e.slice(t,c);return ow(d.includes("%25")?d.replace(/%25/g,"%2525"):d)}else if(n===63||n===35)break}return e.slice(t,s)};var dm=r=>{let e=Ic(r);return e.length>1&&e.at(-1)==="/"?e.slice(0,-1):e},Jr=(r,e,...t)=>(t.length&&(e=Jr(e,...t)),`${r?.[0]==="/"?"":"/"}${r}${e==="/"?"":`${r?.at(-1)==="/"?"":"/"}${e?.[0]==="/"?e.slice(1):e}`}`),po=r=>{if(r.charCodeAt(r.length-1)!==63||!r.includes(":"))return null;let e=r.split("/"),t=[],s="";return e.forEach(n=>{if(n!==""&&!/\:/.test(n))s+="/"+n;else if(/\:/.test(n))if(/\?/.test(n)){t.length===0&&s===""?t.push("/"):t.push(s);let a=n.replace("?","");s+="/"+a,t.push(s);}else s+="/"+n;}),t.filter((n,a,i)=>i.indexOf(n)===a)},Oc=r=>/[%+]/.test(r)?(r.indexOf("+")!==-1&&(r=r.replace(/\+/g," ")),r.indexOf("%")!==-1?Jn(r,mo):r):r,pm=(r,e,t)=>{let s;if(!t&&e&&!/[%+]/.test(e)){let i=r.indexOf("?",8);if(i===-1)return;for(r.startsWith(e,i+1)||(i=r.indexOf(`&${e}`,i+1));i!==-1;){let c=r.charCodeAt(i+e.length+1);if(c===61){let d=i+e.length+2,g=r.indexOf("&",d);return Oc(r.slice(d,g===-1?void 0:g))}else if(c==38||isNaN(c))return "";i=r.indexOf(`&${e}`,i+1);}if(s=/[%+]/.test(r),!s)return}let n={};s??=/[%+]/.test(r);let a=r.indexOf("?",8);for(;a!==-1;){let i=r.indexOf("&",a+1),c=r.indexOf("=",a);c>i&&i!==-1&&(c=-1);let d=r.slice(a+1,c===-1?i===-1?void 0:i:c);if(s&&(d=Oc(d)),a=i,d==="")continue;let g;c===-1?g="":(g=r.slice(c+1,i===-1?void 0:i),s&&(g=Oc(g))),t?(n[d]&&Array.isArray(n[d])||(n[d]=[]),n[d].push(g)):n[d]??=g;}return e?n[e]:n},mm=pm,fm=(r,e)=>pm(r,e,true),mo=decodeURIComponent;var hm=r=>Jn(r,mo),gm=class{raw;#t;#e;routeIndex=0;path;bodyCache={};constructor(r,e="/",t=[[]]){this.raw=r,this.path=e,this.#e=t,this.#t={};}param(r){return r?this.#r(r):this.#a()}#r(r){let e=this.#e[0][this.routeIndex][1][r],t=this.#n(e);return t&&/\%/.test(t)?hm(t):t}#a(){let r={},e=Object.keys(this.#e[0][this.routeIndex][1]);for(let t of e){let s=this.#n(this.#e[0][this.routeIndex][1][t]);s!==void 0&&(r[t]=/\%/.test(s)?hm(s):s);}return r}#n(r){return this.#e[1]?this.#e[1][r]:r}query(r){return mm(this.url,r)}queries(r){return fm(this.url,r)}header(r){if(r)return this.raw.headers.get(r)??void 0;let e={};return this.raw.headers.forEach((t,s)=>{e[s]=t;}),e}async parseBody(r){return cm(this,r)}#s=r=>{let{bodyCache:e,raw:t}=this,s=e[r];if(s)return s;let n=Object.keys(e)[0];return n?e[n].then(a=>(n==="json"&&(a=JSON.stringify(a)),new Response(a)[r]())):e[r]=t[r]()};json(){return this.#s("text").then(r=>JSON.parse(r))}text(){return this.#s("text")}arrayBuffer(){return this.#s("arrayBuffer")}bytes(){return this.#s("arrayBuffer").then(r=>new Uint8Array(r))}blob(){return this.#s("blob")}formData(){return this.#s("formData")}addValidatedData(r,e){this.#t[r]=e;}valid(r){return this.#t[r]}get url(){return this.raw.url}get method(){return this.raw.method}get[am](){return this.#e}get matchedRoutes(){return this.#e[0].map(([[,r]])=>r)}get routePath(){return this.#e[0].map(([[,r]])=>r)[this.routeIndex].path}};g();var ym={Stringify:1},cw=(r,e)=>{let t=new String(r);return t.isEscaped=true,t.callbacks=e,t};var Dc=async(r,e,t,s,n)=>{typeof r=="object"&&!(r instanceof String)&&(r instanceof Promise||(r=r.toString()),r instanceof Promise&&(r=await r));let a=r.callbacks;if(!a?.length)return Promise.resolve(r);n?n[0]+=r:n=[r];let i=Promise.all(a.map(c=>c({phase:e,buffer:n,context:s}))).then(c=>Promise.all(c.filter(Boolean).map(d=>Dc(d,e,false,s,n))).then(()=>n[0]));return t?cw(await i,a):i};var uw="text/plain; charset=UTF-8",Lc=(r,e)=>({"Content-Type":r,...e}),Qn=(r,e)=>new Response(r,e),$c=class{#t;#e;env={};#r;finalized=false;error;#a;#n;#s;#l;#c;#u;#i;#d;#p;constructor(r,e){this.#t=r,e&&(this.#n=e.executionCtx,this.env=e.env,this.#u=e.notFoundHandler,this.#p=e.path,this.#d=e.matchResult);}get req(){return this.#e??=new gm(this.#t,this.#p,this.#d),this.#e}get event(){if(this.#n&&"respondWith"in this.#n)return this.#n;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#n)return this.#n;throw Error("This context has no ExecutionContext")}get res(){return this.#s||=Qn(null,{headers:this.#i??=new Headers})}set res(r){if(this.#s&&r){r=Qn(r.body,r);for(let[e,t]of this.#s.headers.entries())if(e!=="content-type")if(e==="set-cookie"){let s=this.#s.headers.getSetCookie();r.headers.delete("set-cookie");for(let n of s)r.headers.append("set-cookie",n);}else r.headers.set(e,t);}this.#s=r,this.finalized=true;}render=(...r)=>(this.#c??=e=>this.html(e),this.#c(...r));setLayout=r=>this.#l=r;getLayout=()=>this.#l;setRenderer=r=>{this.#c=r;};header=(r,e,t)=>{this.finalized&&(this.#s=Qn(this.#s.body,this.#s));let s=this.#s?this.#s.headers:this.#i??=new Headers;e===void 0?s.delete(r):t?.append?s.append(r,e):s.set(r,e);};status=r=>{this.#a=r;};set=(r,e)=>{this.#r??=new Map,this.#r.set(r,e);};get=r=>this.#r?this.#r.get(r):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#o(r,e,t){let s=this.#s?new Headers(this.#s.headers):this.#i??new Headers;if(typeof e=="object"&&"headers"in e){let a=e.headers instanceof Headers?e.headers:new Headers(e.headers);for(let[i,c]of a)i.toLowerCase()==="set-cookie"?s.append(i,c):s.set(i,c);}if(t)for(let[a,i]of Object.entries(t))if(typeof i=="string")s.set(a,i);else {s.delete(a);for(let c of i)s.append(a,c);}let n=typeof e=="number"?e:e?.status??this.#a;return Qn(r,{status:n,headers:s})}newResponse=(...r)=>this.#o(...r);body=(r,e,t)=>this.#o(r,e,t);text=(r,e,t)=>!this.#i&&!this.#a&&!e&&!t&&!this.finalized?new Response(r):this.#o(r,e,Lc(uw,t));json=(r,e,t)=>this.#o(JSON.stringify(r),e,Lc("application/json",t));html=(r,e,t)=>{let s=n=>this.#o(n,e,Lc("text/html; charset=UTF-8",t));return typeof r=="object"?Dc(r,ym.Stringify,false,{}).then(s):s(r)};redirect=(r,e)=>{let t=String(r);return this.header("Location",/[^\x00-\xFF]/.test(t)?encodeURI(t):t),this.newResponse(null,e??302)};notFound=()=>(this.#u??=()=>Qn(),this.#u(this))};g();var Le="ALL",xm="all",_m=["get","post","put","delete","options","patch"],fo="Can not add a route since the matcher is already built.",ho=class extends Error{};g();var wm="__COMPOSED_HANDLER";var lw=r=>r.text("404 Not Found",404),bm=(r,e)=>{if("getResponse"in r){let t=r.getResponse();return e.newResponse(t.body,t)}return console.error(r),e.text("Internal Server Error",500)},vm=class Sm{get;post;put;delete;options;patch;all;on;use;router;getPath;_basePath="/";#t="/";routes=[];constructor(e={}){[..._m,xm].forEach(a=>{this[a]=(i,...c)=>(typeof i=="string"?this.#t=i:this.#a(a,this.#t,i),c.forEach(d=>{this.#a(a,this.#t,d);}),this);}),this.on=(a,i,...c)=>{for(let d of [i].flat()){this.#t=d;for(let g of [a].flat())c.map(x=>{this.#a(g.toUpperCase(),this.#t,x);});}return this},this.use=(a,...i)=>(typeof a=="string"?this.#t=a:(this.#t="*",i.unshift(a)),i.forEach(c=>{this.#a(Le,this.#t,c);}),this);let{strict:s,...n}=e;Object.assign(this,n),this.getPath=s??true?e.getPath??Ic:dm;}#e(){let e=new Sm({router:this.router,getPath:this.getPath});return e.errorHandler=this.errorHandler,e.#r=this.#r,e.routes=this.routes,e}#r=lw;errorHandler=bm;route(e,t){let s=this.basePath(e);return t.routes.map(n=>{let a;t.errorHandler===bm?a=n.handler:(a=async(i,c)=>(await Tc([],t.errorHandler)(i,()=>n.handler(i,c))).res,a[wm]=n.handler),s.#a(n.method,n.path,a,n.basePath);}),this}basePath(e){let t=this.#e();return t._basePath=Jr(this._basePath,e),t}onError=e=>(this.errorHandler=e,this);notFound=e=>(this.#r=e,this);mount(e,t,s){let n,a;s&&(typeof s=="function"?a=s:(a=s.optionHandler,s.replaceRequest===false?n=d=>d:n=s.replaceRequest));let i=a?d=>{let g=a(d);return Array.isArray(g)?g:[g]}:d=>{let g;try{g=d.executionCtx;}catch{}return [d.env,g]};n||=(()=>{let d=Jr(this._basePath,e),g=d==="/"?0:d.length;return x=>{let _=new URL(x.url);return _.pathname=this.getPath(x).slice(g)||"/",new Request(_,x)}})();let c=async(d,g)=>{let x=await t(n(d.req.raw),...i(d));if(x)return x;await g();};return this.#a(Le,Jr(e,"*"),c),this}#a(e,t,s,n){e=e.toUpperCase(),t=Jr(this._basePath,t);let a={basePath:n!==void 0?Jr(this._basePath,n):this._basePath,path:t,method:e,handler:s};this.router.add(e,t,[s,a]),this.routes.push(a);}#n(e,t){if(e instanceof Error)return this.errorHandler(e,t);throw e}#s(e,t,s,n){if(n==="HEAD")return (async()=>new Response(null,await this.#s(e,t,s,"GET")))();let a=this.getPath(e,{env:s}),i=this.router.match(n,a),c=new $c(e,{path:a,matchResult:i,env:s,executionCtx:t,notFoundHandler:this.#r});if(i[0].length===1){let g;try{g=i[0][0][0][0](c,async()=>{c.res=await this.#r(c);});}catch(x){return this.#n(x,c)}return g instanceof Promise?g.then(x=>x||(c.finalized?c.res:this.#r(c))).catch(x=>this.#n(x,c)):g??this.#r(c)}let d=Tc(i[0],this.errorHandler,this.#r);return (async()=>{try{let g=await d(c);if(!g.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return g.res}catch(g){return this.#n(g,c)}})()}fetch=(e,...t)=>this.#s(e,t[1],t[0],e.method);request=(e,t,s,n)=>e instanceof Request?this.fetch(t?new Request(e,t):e,s,n):(e=e.toString(),this.fetch(new Request(/^https?:\/\//.test(e)?e:`http://localhost${Jr("/",e)}`,t),s,n));fire=()=>{addEventListener("fetch",e=>{e.respondWith(this.#s(e.request,e,void 0,e.request.method));});}};g();g();g();var go=[];function Bc(r,e){let t=this.buildAllMatchers(),s=((n,a)=>{let i=t[n]||t[Le],c=i[2][a];if(c)return c;let d=a.match(i[0]);if(!d)return [[],go];let g=d.indexOf("",1);return [i[1][g],d]});return this.match=s,s(r,e)}g();var yo="[^/]+",Yn=".*",ea="(?:|/.*)",ps=Symbol(),dw=new Set(".\\+*[^]$()");function pw(r,e){return r.length===1?e.length===1?r<e?-1:1:-1:e.length===1||r===Yn||r===ea?1:e===Yn||e===ea?-1:r===yo?1:e===yo?-1:r.length===e.length?r<e?-1:1:e.length-r.length}var Am=class jc{#t;#e;#r=Object.create(null);insert(e,t,s,n,a){if(e.length===0){if(this.#t!==void 0)throw ps;if(a)return;this.#t=t;return}let[i,...c]=e,d=i==="*"?c.length===0?["","",Yn]:["","",yo]:i==="/*"?["","",ea]:i.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),g;if(d){let x=d[1],_=d[2]||yo;if(x&&d[2]&&(_===".*"||(_=_.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(_))))throw ps;if(g=this.#r[_],!g){if(Object.keys(this.#r).some(P=>P!==Yn&&P!==ea))throw ps;if(a)return;g=this.#r[_]=new jc,x!==""&&(g.#e=n.varIndex++);}!a&&x!==""&&s.push([x,g.#e]);}else if(g=this.#r[i],!g){if(Object.keys(this.#r).some(x=>x.length>1&&x!==Yn&&x!==ea))throw ps;if(a)return;g=this.#r[i]=new jc;}g.insert(c,t,s,n,a);}buildRegExpStr(){let t=Object.keys(this.#r).sort(pw).map(s=>{let n=this.#r[s];return (typeof n.#e=="number"?`(${s})@${n.#e}`:dw.has(s)?`\\${s}`:s)+n.buildRegExpStr()});return typeof this.#t=="number"&&t.unshift(`#${this.#t}`),t.length===0?"":t.length===1?t[0]:"(?:"+t.join("|")+")"}};g();var Rm=class{#t={varIndex:0};#e=new Am;insert(r,e,t){let s=[],n=[];for(let i=0;;){let c=false;if(r=r.replace(/\{[^}]+\}/g,d=>{let g=`@\\${i}`;return n[i]=[g,d],i++,c=true,g}),!c)break}let a=r.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let i=n.length-1;i>=0;i--){let[c]=n[i];for(let d=a.length-1;d>=0;d--)if(a[d].indexOf(c)!==-1){a[d]=a[d].replace(c,n[i][1]);break}}return this.#e.insert(a,e,s,this.#t,t),s}buildRegExp(){let r=this.#e.buildRegExpStr();if(r==="")return [/^$/,[],[]];let e=0,t=[],s=[];return r=r.replace(/#(\d+)|@(\d+)|\.\*\$/g,(n,a,i)=>a!==void 0?(t[++e]=Number(a),"$()"):(i!==void 0&&(s[Number(i)]=++e),"")),[new RegExp(`^${r}`),t,s]}};var mw=[/^$/,[],Object.create(null)],km=Object.create(null);function Cm(r){return km[r]??=new RegExp(r==="*"?"":`^${r.replace(/\/\*$|([.\\+*[^\]$()])/g,(e,t)=>t?`\\${t}`:"(?:|/.*)")}$`)}function fw(){km=Object.create(null);}function hw(r){let e=new Rm,t=[];if(r.length===0)return mw;let s=r.map(g=>[!/\*|\/:/.test(g[0]),...g]).sort(([g,x],[_,P])=>g?1:_?-1:x.length-P.length),n=Object.create(null);for(let g=0,x=-1,_=s.length;g<_;g++){let[P,G,q]=s[g];P?n[G]=[q.map(([ue])=>[ue,Object.create(null)]),go]:x++;let H;try{H=e.insert(G,x,P);}catch(ue){throw ue===ps?new ho(G):ue}P||(t[x]=q.map(([ue,se])=>{let Pe=Object.create(null);for(se-=1;se>=0;se--){let[Z,St]=H[se];Pe[Z]=St;}return [ue,Pe]}));}let[a,i,c]=e.buildRegExp();for(let g=0,x=t.length;g<x;g++)for(let _=0,P=t[g].length;_<P;_++){let G=t[g][_]?.[1];if(!G)continue;let q=Object.keys(G);for(let H=0,ue=q.length;H<ue;H++)G[q[H]]=c[G[q[H]]];}let d=[];for(let g in i)d[g]=t[i[g]];return [a,d,n]}function Ms(r,e){if(r){for(let t of Object.keys(r).sort((s,n)=>n.length-s.length))if(Cm(t).test(e))return [...r[t]]}}var xo=class{name="RegExpRouter";#t;#e;constructor(){this.#t={[Le]:Object.create(null)},this.#e={[Le]:Object.create(null)};}add(r,e,t){let s=this.#t,n=this.#e;if(!s||!n)throw new Error(fo);s[r]||[s,n].forEach(c=>{c[r]=Object.create(null),Object.keys(c[Le]).forEach(d=>{c[r][d]=[...c[Le][d]];});}),e==="/*"&&(e="*");let a=(e.match(/\/:/g)||[]).length;if(/\*$/.test(e)){let c=Cm(e);r===Le?Object.keys(s).forEach(d=>{s[d][e]||=Ms(s[d],e)||Ms(s[Le],e)||[];}):s[r][e]||=Ms(s[r],e)||Ms(s[Le],e)||[],Object.keys(s).forEach(d=>{(r===Le||r===d)&&Object.keys(s[d]).forEach(g=>{c.test(g)&&s[d][g].push([t,a]);});}),Object.keys(n).forEach(d=>{(r===Le||r===d)&&Object.keys(n[d]).forEach(g=>c.test(g)&&n[d][g].push([t,a]));});return}let i=po(e)||[e];for(let c=0,d=i.length;c<d;c++){let g=i[c];Object.keys(n).forEach(x=>{(r===Le||r===x)&&(n[x][g]||=[...Ms(s[x],g)||Ms(s[Le],g)||[]],n[x][g].push([t,a-d+c+1]));});}}match=Bc;buildAllMatchers(){let r=Object.create(null);return Object.keys(this.#e).concat(Object.keys(this.#t)).forEach(e=>{r[e]||=this.#r(e);}),this.#t=this.#e=void 0,fw(),r}#r(r){let e=[],t=r===Le;return [this.#t,this.#e].forEach(s=>{let n=s[r]?Object.keys(s[r]).map(a=>[a,s[r][a]]):[];n.length!==0?(t||=true,e.push(...n)):r!==Le&&e.push(...Object.keys(s[Le]).map(a=>[a,s[Le][a]]));}),t?hw(e):null}};g();g();g();var Nc=class{name="SmartRouter";#t=[];#e=[];constructor(r){this.#t=r.routers;}add(r,e,t){if(!this.#e)throw new Error(fo);this.#e.push([r,e,t]);}match(r,e){if(!this.#e)throw new Error("Fatal error");let t=this.#t,s=this.#e,n=t.length,a=0,i;for(;a<n;a++){let c=t[a];try{for(let d=0,g=s.length;d<g;d++)c.add(...s[d]);i=c.match(r,e);}catch(d){if(d instanceof ho)continue;throw d}this.match=c.match.bind(c),this.#t=[c],this.#e=void 0;break}if(a===n)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,i}get activeRouter(){if(this.#e||this.#t.length!==1)throw new Error("No active router has been determined yet.");return this.#t[0]}};g();g();g();var ta=Object.create(null),gw=r=>{for(let e in r)return  true;return  false},Em=class Tm{#t;#e;#r;#a=0;#n=ta;constructor(e,t,s){if(this.#e=s||Object.create(null),this.#t=[],e&&t){let n=Object.create(null);n[e]={handler:t,possibleKeys:[],score:0},this.#t=[n];}this.#r=[];}insert(e,t,s){this.#a=++this.#a;let n=this,a=um(t),i=[];for(let c=0,d=a.length;c<d;c++){let g=a[c],x=a[c+1],_=lm(g,x),P=Array.isArray(_)?_[0]:g;if(P in n.#e){n=n.#e[P],_&&i.push(_[1]);continue}n.#e[P]=new Tm,_&&(n.#r.push(_),i.push(_[1])),n=n.#e[P];}return n.#t.push({[e]:{handler:s,possibleKeys:i.filter((c,d,g)=>g.indexOf(c)===d),score:this.#a}}),n}#s(e,t,s,n,a){for(let i=0,c=t.#t.length;i<c;i++){let d=t.#t[i],g=d[s]||d[Le],x={};if(g!==void 0&&(g.params=Object.create(null),e.push(g),n!==ta||a&&a!==ta))for(let _=0,P=g.possibleKeys.length;_<P;_++){let G=g.possibleKeys[_],q=x[g.score];g.params[G]=a?.[G]&&!q?a[G]:n[G]??a?.[G],x[g.score]=true;}}}search(e,t){let s=[];this.#n=ta;let a=[this],i=Pc(t),c=[],d=i.length,g=null;for(let x=0;x<d;x++){let _=i[x],P=x===d-1,G=[];for(let H=0,ue=a.length;H<ue;H++){let se=a[H],Pe=se.#e[_];Pe&&(Pe.#n=se.#n,P?(Pe.#e["*"]&&this.#s(s,Pe.#e["*"],e,se.#n),this.#s(s,Pe,e,se.#n)):G.push(Pe));for(let Z=0,St=se.#r.length;Z<St;Z++){let Ze=se.#r[Z],F=se.#n===ta?{}:{...se.#n};if(Ze==="*"){let mr=se.#e["*"];mr&&(this.#s(s,mr,e,se.#n),mr.#n=F,G.push(mr));continue}let[Lt,ds,Dr]=Ze;if(!_&&!(Dr instanceof RegExp))continue;let He=se.#e[Lt];if(Dr instanceof RegExp){if(g===null){g=new Array(d);let tr=t[0]==="/"?1:0;for(let we=0;we<d;we++)g[we]=tr,tr+=i[we].length+1;}let mr=t.substring(g[x]),fr=Dr.exec(mr);if(fr){if(F[ds]=fr[0],this.#s(s,He,e,se.#n,F),fr[0].length===mr.length&&He.#e["*"]&&this.#s(s,He.#e["*"],e,se.#n,F),gw(He.#e)){He.#n=F;let tr=fr[0].match(/\//)?.length??0;(c[tr]||=[]).push(He);}continue}}(Dr===true||Dr.test(_))&&(F[ds]=_,P?(this.#s(s,He,e,F,se.#n),He.#e["*"]&&this.#s(s,He.#e["*"],e,F,se.#n)):(He.#n=F,G.push(He)));}}let q=c.shift();a=q?G.concat(q):G;}return s.length>1&&s.sort((x,_)=>x.score-_.score),[s.map(({handler:x,params:_})=>[x,_])]}};var Mc=class{name="TrieRouter";#t;constructor(){this.#t=new Em;}add(r,e,t){let s=po(e);if(s){for(let n=0,a=s.length;n<a;n++)this.#t.insert(r,s[n],t);return}this.#t.insert(r,e,t);}match(r,e){return this.#t.search(r,e)}};var Uc=class extends vm{constructor(r={}){super(r),this.router=r.router??new Nc({routers:[new xo,new Mc]});}};g();g();g();g();g();g();g();var qc=r=>Hc(r.replace(/_|-/g,e=>({_:"/","-":"+"})[e]??e)),Fc=r=>yw(r).replace(/\/|\+/g,e=>({"/":"_","+":"-"})[e]??e),yw=r=>{let e="",t=new Uint8Array(r);for(let s=0,n=t.length;s<n;s++)e+=String.fromCharCode(t[s]);return btoa(e)},Hc=r=>{let e=atob(r),t=new Uint8Array(new ArrayBuffer(e.length)),s=e.length/2;for(let n=0,a=e.length-1;n<=s;n++,a--)t[n]=e.charCodeAt(n),t[a]=e.charCodeAt(a);return t};g();var ms=(r=>(r.HS256="HS256",r.HS384="HS384",r.HS512="HS512",r.RS256="RS256",r.RS384="RS384",r.RS512="RS512",r.PS256="PS256",r.PS384="PS384",r.PS512="PS512",r.ES256="ES256",r.ES384="ES384",r.ES512="ES512",r.EdDSA="EdDSA",r))(ms||{});g();g();var xw={deno:"Deno",bun:"Bun",workerd:"Cloudflare-Workers",node:"Node.js"},Om=()=>{let r=globalThis;if(typeof navigator<"u"&&typeof navigator.userAgent=="string"){for(let[t,s]of Object.entries(xw))if(_w(s))return t}return typeof r?.EdgeRuntime=="string"?"edge-light":r?.fastly!==void 0?"fastly":r?.process?.release?.name==="node"?"node":"other"},_w=r=>navigator.userAgent.startsWith(r);g();var Pm=class extends Error{constructor(r){super(`${r} is not an implemented algorithm`),this.name="JwtAlgorithmNotImplemented";}},Gc=class extends Error{constructor(){super('JWT verification requires "alg" option to be specified'),this.name="JwtAlgorithmRequired";}},zc=class extends Error{constructor(r,e){super(`JWT algorithm mismatch: expected "${r}", got "${e}"`),this.name="JwtAlgorithmMismatch";}},fs=class extends Error{constructor(r){super(`invalid JWT token: ${r}`),this.name="JwtTokenInvalid";}},Im=class extends Error{constructor(r){super(`token (${r}) is being used before it's valid`),this.name="JwtTokenNotBefore";}},Dm=class extends Error{constructor(r){super(`token (${r}) expired`),this.name="JwtTokenExpired";}},Lm=class extends Error{constructor(r,e){super(`Invalid "iat" claim, must be a valid number lower than "${r}" (iat: "${e}")`),this.name="JwtTokenIssuedAt";}},_o=class extends Error{constructor(r,e){super(`expected issuer "${r}", got ${e?`"${e}"`:"none"} `),this.name="JwtTokenIssuer";}},Kc=class extends Error{constructor(r){super(`jwt header is invalid: ${JSON.stringify(r)}`),this.name="JwtHeaderInvalid";}},Nm=class extends Error{constructor(r){super(`token(${r}) signature mismatched`),this.name="JwtTokenSignatureMismatched";}},Mm=class extends Error{constructor(r){super(`required "aud" in jwt payload: ${JSON.stringify(r)}`),this.name="JwtPayloadRequiresAud";}},Um=class extends Error{constructor(r,e){super(`expected audience "${Array.isArray(r)?r.join(", "):r}", got "${e}"`),this.name="JwtTokenAudience";}},Us=(r=>(r.Encrypt="encrypt",r.Decrypt="decrypt",r.Sign="sign",r.Verify="verify",r.DeriveKey="deriveKey",r.DeriveBits="deriveBits",r.WrapKey="wrapKey",r.UnwrapKey="unwrapKey",r))(Us||{});g();var hs=new TextEncoder,qm=new TextDecoder;async function Hm(r,e,t){let s=zm(e),n=await ww(r,s);return await crypto.subtle.sign(s,n,t)}async function Gm(r,e,t,s){let n=zm(e),a=await bw(r,n);return await crypto.subtle.verify(n,a,t,s)}function Vc(r){return Hc(r.replace(/-+(BEGIN|END).*?-+/g,"").replace(/\s/g,""))}async function ww(r,e){if(!crypto.subtle||!crypto.subtle.importKey)throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");if(Km(r)){if(r.type!=="private"&&r.type!=="secret")throw new Error(`unexpected key type: CryptoKey.type is ${r.type}, expected private or secret`);return r}let t=[Us.Sign];return typeof r=="object"?await crypto.subtle.importKey("jwk",r,e,false,t):r.includes("PRIVATE")?await crypto.subtle.importKey("pkcs8",Vc(r),e,false,t):await crypto.subtle.importKey("raw",hs.encode(r),e,false,t)}async function bw(r,e){if(!crypto.subtle||!crypto.subtle.importKey)throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");if(Km(r)){if(r.type==="public"||r.type==="secret")return r;r=await Fm(r);}if(typeof r=="string"&&r.includes("PRIVATE")){let s=await crypto.subtle.importKey("pkcs8",Vc(r),e,true,[Us.Sign]);r=await Fm(s);}let t=[Us.Verify];return typeof r=="object"?await crypto.subtle.importKey("jwk",r,e,false,t):r.includes("PUBLIC")?await crypto.subtle.importKey("spki",Vc(r),e,false,t):await crypto.subtle.importKey("raw",hs.encode(r),e,false,t)}async function Fm(r){if(r.type!=="private")throw new Error(`unexpected key type: ${r.type}`);if(!r.extractable)throw new Error("unexpected private key is unextractable");let e=await crypto.subtle.exportKey("jwk",r),{kty:t}=e,{alg:s,e:n,n:a}=e,{crv:i,x:c,y:d}=e;return {kty:t,alg:s,e:n,n:a,crv:i,x:c,y:d,key_ops:[Us.Verify]}}function zm(r){switch(r){case "HS256":return {name:"HMAC",hash:{name:"SHA-256"}};case "HS384":return {name:"HMAC",hash:{name:"SHA-384"}};case "HS512":return {name:"HMAC",hash:{name:"SHA-512"}};case "RS256":return {name:"RSASSA-PKCS1-v1_5",hash:{name:"SHA-256"}};case "RS384":return {name:"RSASSA-PKCS1-v1_5",hash:{name:"SHA-384"}};case "RS512":return {name:"RSASSA-PKCS1-v1_5",hash:{name:"SHA-512"}};case "PS256":return {name:"RSA-PSS",hash:{name:"SHA-256"},saltLength:32};case "PS384":return {name:"RSA-PSS",hash:{name:"SHA-384"},saltLength:48};case "PS512":return {name:"RSA-PSS",hash:{name:"SHA-512"},saltLength:64};case "ES256":return {name:"ECDSA",hash:{name:"SHA-256"},namedCurve:"P-256"};case "ES384":return {name:"ECDSA",hash:{name:"SHA-384"},namedCurve:"P-384"};case "ES512":return {name:"ECDSA",hash:{name:"SHA-512"},namedCurve:"P-521"};case "EdDSA":return {name:"Ed25519",namedCurve:"Ed25519"};default:throw new Pm(r)}}function Km(r){return Om()==="node"&&crypto.webcrypto?r instanceof crypto.webcrypto.CryptoKey:r instanceof CryptoKey}var Wc=r=>Fc(hs.encode(JSON.stringify(r)).buffer).replace(/=/g,""),vw=r=>Fc(r).replace(/=/g,""),Zc=r=>JSON.parse(qm.decode(qc(r)));function Vm(r){if(typeof r=="object"&&r!==null){let e=r;return "alg"in e&&Object.values(ms).includes(e.alg)&&(!("typ"in e)||e.typ==="JWT")}return  false}var Wm=async(r,e,t="HS256")=>{let s=Wc(r),n;typeof e=="object"&&"alg"in e?(t=e.alg,n=Wc({alg:t,typ:"JWT",kid:e.kid})):n=Wc({alg:t,typ:"JWT"});let a=`${n}.${s}`,i=await Hm(e,t,hs.encode(a)),c=vw(i);return `${a}.${c}`},Xc=async(r,e,t)=>{if(!t)throw new Gc;let{alg:s,iss:n,nbf:a=true,exp:i=true,iat:c=true,aud:d}=typeof t=="string"?{alg:t}:t;if(!s)throw new Gc;let g=r.split(".");if(g.length!==3)throw new fs(r);let{header:x,payload:_}=Jc(r);if(!Vm(x))throw new Kc(x);if(x.alg!==s)throw new zc(s,x.alg);let P=Math.floor(Date.now()/1e3);if(a&&_.nbf!==void 0&&(typeof _.nbf!="number"||!Number.isFinite(_.nbf)||_.nbf>P))throw new Im(r);if(i&&_.exp!==void 0&&(typeof _.exp!="number"||!Number.isFinite(_.exp)||_.exp<=P))throw new Dm(r);if(c&&_.iat!==void 0&&(typeof _.iat!="number"||!Number.isFinite(_.iat)||P<_.iat))throw new Lm(P,_.iat);if(n){if(!_.iss)throw new _o(n,null);if(typeof n=="string"&&_.iss!==n)throw new _o(n,_.iss);if(n instanceof RegExp&&!n.test(_.iss))throw new _o(n,_.iss)}if(d){if(!_.aud)throw new Mm(_);if(!(Array.isArray(_.aud)?_.aud:[_.aud]).some(se=>d instanceof RegExp?d.test(se):typeof d=="string"?se===d:Array.isArray(d)&&d.includes(se)))throw new Um(d,_.aud)}let G=r.substring(0,r.lastIndexOf("."));if(!await Gm(e,s,qc(g[2]),hs.encode(G)))throw new Nm(r);return _};[ms.HS256,ms.HS384,ms.HS512];var Jc=r=>{let e=r.split(".");if(e.length!==3)throw new fs(r);try{let t=Zc(e[0]),s=Zc(e[1]);return {header:t,payload:s}}catch{throw new fs(r)}};var ra={sign:Wm,verify:Xc};var wo=ra.verify,bo=ra.sign;g();function gs(r,e){for(let t of r){if(t.name===e)return t;if(t.type==="group"||t.type==="array"){let s=gs(t.fields||[],e);if(s)return s}if(t.type==="blocks")for(let s of t.blocks||[]){let n=gs(s.fields||[],e);if(n)return n}if(t.type==="tabs")for(let s of t.tabs||[]){let n=gs(s.fields||[],e);if(n)return n}if(t.type==="collapsible"||t.type==="row"){let s=gs(t.fields||[],e);if(s)return s}}return null}function sa(r){return r.map(e=>`${e.path.join(".")}: ${e.message}`).join(", ")}function Qr(r,e){if(!(!r||typeof r!="object"))for(let t of e){if(t.type==="tabs"&&Array.isArray(t.tabs)){let n=t.name?r[t.name]:r;if(n&&typeof n=="object")for(let a of t.tabs)Array.isArray(a.fields)&&Qr(n,a.fields);continue}if(!t.name||!(t.name in r))continue;if(r[t.name]===""&&(t.type==="text"||t.type==="textarea"||t.type==="code"||t.type==="markdown"||(r[t.name]=null)),(t.type==="group"||t.type==="collapsible")&&t.name&&Array.isArray(t.fields)&&r[t.name]&&typeof r[t.name]=="object")Qr(r[t.name],t.fields);else if(t.type==="array"&&t.name&&Array.isArray(t.fields)&&Array.isArray(r[t.name]))for(let n of r[t.name])n&&typeof n=="object"&&Qr(n,t.fields);else if(t.type==="blocks"&&t.name&&Array.isArray(t.blocks)&&Array.isArray(r[t.name]))for(let n of r[t.name]){if(!n||typeof n!="object")continue;let a=n.type||n.blockType;if(!a)continue;let i=t.blocks.find(d=>d.slug===a);if(!i||!Array.isArray(i.fields))continue;let c=n.data&&typeof n.data=="object"?n.data:n;Qr(c,i.fields);}}}function Yr(r,e){if(!(!e||typeof e!="object"))for(let t of r){if(t.type==="tabs"&&Array.isArray(t.tabs)){let s=t.name?e[t.name]:e;if(s&&typeof s=="object")for(let n of t.tabs)Array.isArray(n.fields)&&Yr(n.fields,s);}if(t.type==="richtext"&&t.name){let s=e[t.name];typeof s=="string"?e[t.name]=[{type:"paragraph",children:[{text:s}]}]:s&&typeof s=="object"&&!Array.isArray(s)&&s.type==="doc"&&Array.isArray(s.content)&&(e[t.name]=s.content);}if((t.type==="group"||t.type==="collapsible")&&t.name&&Array.isArray(t.fields)&&e[t.name]&&typeof e[t.name]=="object")Yr(t.fields,e[t.name]);else if(t.type==="array"&&t.name&&Array.isArray(t.fields)&&Array.isArray(e[t.name]))for(let s of e[t.name])s&&typeof s=="object"&&Yr(t.fields,s);else if(t.type==="blocks"&&t.name&&Array.isArray(t.blocks)&&Array.isArray(e[t.name]))for(let s of e[t.name]){if(!s||typeof s!="object")continue;let n=s.type||s.blockType;if(!n)continue;let a=t.blocks.find(c=>c.slug===n);if(!a||!Array.isArray(a.fields))continue;let i=s.data&&typeof s.data=="object"?s.data:s;Yr(a.fields,i);}}}function qs(r,e){if(!(!e||typeof e!="object")){for(let t of r)if(!(!t.name||!(t.name in e))){if(t.unique&&(t.type==="text"||t.type==="email"?e[t.name]=`${e[t.name]||t.name}-copy-${Date.now().toString(36)}`:delete e[t.name]),t.type==="tabs"&&t.name&&Array.isArray(t.tabs)&&e[t.name]&&typeof e[t.name]=="object")for(let s of t.tabs)Array.isArray(s.fields)&&qs(s.fields,e[t.name]);else if((t.type==="group"||t.type==="collapsible")&&t.name&&Array.isArray(t.fields)&&e[t.name]&&typeof e[t.name]=="object")qs(t.fields,e[t.name]);else if(t.type==="array"&&t.name&&Array.isArray(t.fields)&&Array.isArray(e[t.name]))for(let s of e[t.name])s&&typeof s=="object"&&(delete s.id,qs(t.fields,s));else if(t.type==="blocks"&&t.name&&Array.isArray(t.blocks)&&Array.isArray(e[t.name]))for(let s of e[t.name]){if(!s||typeof s!="object")continue;delete s.id;let n=s.type||s.blockType;if(!n)continue;let a=t.blocks.find(c=>c.slug===n);if(!a||!Array.isArray(a.fields))continue;let i=s.data&&typeof s.data=="object"?s.data:s;qs(a.fields,i);}}}}g();function Jm(r){let{db:t$1,userLookup:s}=r;return async function(a){let i=f$2(a);if(i&&t$1){let d=await e$3(i,t$1,s);if(d.valid&&d.user)return {user:d.user,tenantContext:Xm(d.user),apiKeyContext:g$1(d),status:200,authType:"apikey"};if(d.error)return {status:401,error:d.error}}let c=h(a);if(c)try{let d=await n$2(c);if(!d.valid)return {status:401,error:d.reason||"Session invalid"};let g=await t(a);if(g){let x=s?await s(g.userId):null;if(x)return {user:x,tenantContext:Xm(x),status:200,authType:"session"}}}catch(d){console.error("Session validation error:",d);}return {status:401,error:"Authentication required"}}}function Xm(r){return {tenantId:r.tenantId||"default",userId:r.id||"anonymous",role:r.role||"guest",roles:[r.role||"guest"],permissions:[],isSuperAdmin:r.role==="super_admin"}}g();var vo=class{storage=new Map;userStorage=new Map;limits;userLimits;constructor(e,t){this.limits={...Cw,...e},this.userLimits=t||{"user:api":{window:6e4,max:500},"user:write":{window:36e5,max:100}};}getKey(e,t){return `${e}:${t}`}getUserKey(e,t,s){return `user:${e}:${t}:${s}`}cleanupOldEntries(e,t){let n=Date.now()-t;for(;e.length>0&&e[0].timestamp<n;)e.shift();}async check(e,t){let s=this.limits[e]||this.limits["api:general"],n=this.getKey(e,t),a=this.storage.get(n);a||(a=[],this.storage.set(n,a)),this.cleanupOldEntries(a,s.window);let i=Date.now(),c=a.reduce((d,g)=>d+g.count,0);if(a.push({timestamp:i,count:1}),c>=s.max){let g=a.reduce((x,_)=>x.timestamp<_.timestamp?x:_,a[0]).timestamp+s.window;return {allowed:false,remaining:0,resetAt:g,retryAfter:Math.ceil((g-i)/1e3)}}return {allowed:true,remaining:s.max-c-1,resetAt:i+s.window}}async checkUser(e,t,s){let n=this.userLimits[e]||this.userLimits["user:api"],a=this.userStorage.get(t),i=[];a?i=a.get(this.getKey(e,s))||[]:(this.userStorage.has(t)||this.userStorage.set(t,new Map),this.userStorage.get(t).set(this.getKey(e,s),i)),this.cleanupOldEntries(i,n.window);let c=Date.now(),d=i.reduce((g,x)=>g+x.count,0);if(i.push({timestamp:c,count:1}),d>=n.max){let x=i.reduce((_,P)=>_.timestamp<P.timestamp?_:P,i[0]).timestamp+n.window;return {allowed:false,remaining:0,resetAt:x,retryAfter:Math.ceil((x-c)/1e3)}}return {allowed:true,remaining:n.max-d-1,resetAt:c+n.window}}async reset(e,t){let s=this.getKey(e,t);this.storage.delete(s);}async resetUser(e,t,s){let n=this.userStorage.get(t);if(n){let a=this.getKey(e,s);n.delete(a);}}async getStatus(e,t){let s=this.limits[e]||this.limits["api:general"],n=this.getKey(e,t),a=this.storage.get(n);a||(a=[],this.storage.set(n,a)),this.cleanupOldEntries(a,s.window);let i=Date.now(),c=a.reduce((d,g)=>d+g.count,0);return {count:c,limit:s.max,remaining:Math.max(0,s.max-c),resetAt:i+s.window}}setLimit(e,t){this.limits[e]=t;}setUserLimit(e,t){this.userLimits[e]=t;}},Cw={"auth:login":{window:9e5,max:5},"auth:register":{window:36e5,max:3},"auth:forgot":{window:36e5,max:3},"auth:reset":{window:36e5,max:5},"auth:verify":{window:36e5,max:5},"api:general":{window:6e4,max:100},"api:authenticated":{window:6e4,max:200}};g();g();g();g();var Qc={retentionDays:30};var Qm=class{redis;prefix;retentionDays;constructor(e,t=30,s="kyro:audit:"){this.redis=e,this.prefix=s,this.retentionDays=t;}async log(e){let t=randomBytes(16).toString("hex"),s=new Date,n={...e,id:t,timestamp:s},a=this.getKeyForDate(s),i=`${this.prefix}log:${t}`;await this.redis.hset(i,this.serializeLog(n)),await this.redis.expire(i,this.retentionDays*24*60*60+3600),await this.redis.zadd(a,s.getTime(),t),await this.redis.expire(a,this.retentionDays*24*60*60+3600);let c=e.userId?`${this.prefix}user:${e.userId}`:null;return c&&(await this.redis.zadd(c,s.getTime(),t),await this.redis.expire(c,this.retentionDays*24*60*60+3600)),t}async get(e){let t=`${this.prefix}log:${e}`,s=await this.redis.hgetall(t);return !s||Object.keys(s).length===0?null:this.deserializeLog(s)}async query(e={}){let{limit:t=50,offset:s=0}=e,n=[];if(e.userId)n.push(`${this.prefix}user:${e.userId}`);else if(e.startDate||e.endDate)n=this.getKeysForDateRange(e.startDate,e.endDate);else {let d=new Date;n=this.getKeysForDateRange(new Date(d.getTime()-this.retentionDays*24*60*60*1e3),d);}let a=[];for(let d of n){let g=await this.redis.zrange(d,0,-1,"WITHSCORES");for(let x=0;x<g.length;x+=2)a.push([g[x],parseInt(g[x+1],10)]);}a.sort((d,g)=>g[1]-d[1]);let i=a.length;a=a.slice(s,s+t);let c=[];for(let[d]of a){let g=await this.get(d);g&&this.matchesFilter(g,e)&&c.push(g);}return {logs:c,total:i}}async getRecent(e=50){let t=[],s=new Date,n=this.getKeysForDateRange(new Date(s.getTime()-10080*60*1e3),s),a=[];for(let i of n){let c=await this.redis.zrange(i,0,-1,"WITHSCORES");for(let d=0;d<c.length;d+=2)a.push([c[d],parseInt(c[d+1],10)]);}a.sort((i,c)=>c[1]-i[1]);for(let[i]of a.slice(0,e)){let c=await this.get(i);c&&t.push(c);}return t}async getUserActivity(e,t=50){let s=`${this.prefix}user:${e}`,n=await this.redis.zrange(s,0,t-1),a=[];for(let i of n){let c=await this.get(i);c&&a.push(c);}return a}async getStats(e,t){let s=this.getKeysForDateRange(e||new Date(Date.now()-2592e6),t||new Date),n={},a=0,i=0,c=0,d=new Set;for(let g of s){let x=await this.redis.zrange(g,0,-1);for(let _ of x){let P=await this.get(_);P&&(a++,n[P.action]=(n[P.action]||0)+1,P.success&&c++,P.action==="login_failed"&&i++,P.userId&&d.add(P.userId));}}return {totalEvents:a,byAction:n,successRate:a>0?c/a:1,failedLogins:i,uniqueUsers:d}}async cleanup(){let e=Date.now()-this.retentionDays*24*60*60*1e3,t=await this.redis.keys(`${this.prefix}date:*`),s=0;for(let n of t){let a=await this.redis.zrangebyscore(n,0,e);for(let i of a)await this.redis.del(`${this.prefix}log:${i}`),s++;await this.redis.zremrangebyscore(n,0,e);}return s}getKeyForDate(e){let t=e.getFullYear(),s=String(e.getMonth()+1).padStart(2,"0"),n=String(e.getDate()).padStart(2,"0");return `${this.prefix}date:${t}-${s}-${n}`}getKeysForDateRange(e,t){let s=[],n=e||new Date(Date.now()-this.retentionDays*24*60*60*1e3),a=t||new Date,i=new Date(n);for(;i<=a;)s.push(this.getKeyForDate(i)),i.setDate(i.getDate()+1);return s}matchesFilter(e,t){return !(t.action&&!(Array.isArray(t.action)?t.action:[t.action]).includes(e.action)||t.resource&&e.resource!==t.resource||t.resourceId&&e.resourceId!==t.resourceId||t.success!==void 0&&e.success!==t.success)}serializeLog(e){let t={id:e.id,timestamp:new Date(e.timestamp).toISOString(),action:e.action,resource:e.resource,success:e.success?"1":"0"};return e.userId&&(t.userId=e.userId),e.userEmail&&(t.userEmail=e.userEmail),e.role&&(t.role=e.role),e.resourceId&&(t.resourceId=e.resourceId),e.ipAddress&&(t.ipAddress=e.ipAddress),e.userAgent&&(t.userAgent=e.userAgent),e.error&&(t.error=e.error),e.changes&&(t.changes=JSON.stringify(e.changes)),e.metadata&&(t.metadata=JSON.stringify(e.metadata)),t}deserializeLog(e){return {id:e.id,timestamp:new Date(e.timestamp),action:e.action,userId:e.userId,userEmail:e.userEmail,role:e.role,resource:e.resource,resourceId:e.resourceId,ipAddress:e.ipAddress,userAgent:e.userAgent,success:e.success==="1",error:e.error,changes:e.changes?JSON.parse(e.changes):void 0,metadata:e.metadata?JSON.parse(e.metadata):void 0}}};function cU(r){return {ipAddress:r.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||r.headers.get("x-real-ip")||"unknown",userAgent:r.headers.get("user-agent")||"unknown"}}var Ym=class{logs=[];retentionDays;constructor(e=Qc.retentionDays){this.retentionDays=e;}async log(e){let t=randomBytes(16).toString("hex"),n={...e,id:t,timestamp:new Date};return this.logs.push(n),this.cleanupOldLogs(),t}async get(e){return this.logs.find(t=>t.id===e)||null}async query(e={}){let{limit:t=50,offset:s=0}=e,n=[...this.logs];if(e.userId&&(n=n.filter(g=>g.userId===e.userId)),e.action){let g=Array.isArray(e.action)?e.action:[e.action];n=n.filter(x=>g.includes(x.action));}e.resource&&(n=n.filter(g=>g.resource===e.resource)),e.resourceId&&(n=n.filter(g=>g.resourceId===e.resourceId)),e.success!==void 0&&(n=n.filter(g=>g.success===e.success));let a=e.startDate,i=e.endDate;a!==void 0&&(n=n.filter(g=>g.timestamp>=a)),i!==void 0&&(n=n.filter(g=>g.timestamp<=i)),n.sort((g,x)=>x.timestamp.getTime()-g.timestamp.getTime());let c=n.length;return {logs:n.slice(s,s+t),total:c}}async getRecent(e=50){let t=new Date(Date.now()-6048e5);return this.logs.filter(n=>n.timestamp>=t).sort((n,a)=>a.timestamp.getTime()-n.timestamp.getTime()).slice(0,e)}async getUserActivity(e,t=50){return this.logs.filter(n=>n.userId===e).sort((n,a)=>a.timestamp.getTime()-n.timestamp.getTime()).slice(0,t)}async getStats(e,t){let s=e||new Date(Date.now()-2592e6),n=t||new Date,a=this.logs.filter(_=>_.timestamp>=s&&_.timestamp<=n),i={},c=0,d=0,g=0,x=new Set;for(let _ of a){c++;let P=_.action;i[P]=(i[P]||0)+1,_.success&&g++,_.action==="login_failed"&&d++,_.userId&&x.add(_.userId);}return {totalEvents:c,byAction:i,successRate:c>0?g/c:1,failedLogins:d,uniqueUsers:x}}async cleanup(){let e=new Date(Date.now()-this.retentionDays*24*60*60*1e3),t=this.logs.length;return this.logs=this.logs.filter(s=>s.timestamp>=e),t-this.logs.length}cleanupOldLogs(){let e=new Date(Date.now()-this.retentionDays*24*60*60*1e3);this.logs.length;this.logs=this.logs.filter(s=>s.timestamp>=e);}};var So=class{authAdapter;email;passwordPolicy;lockout;rateLimiter;auditLogger;baseUrl;emailVerificationRequired;jwtSecret;constructor(e){this.authAdapter=e.redis,this.email=e.email,this.passwordPolicy=e.passwordPolicy||new r$1,this.lockout=e.lockout,this.rateLimiter=e.rateLimiter,this.auditLogger=e.auditLogger,this.baseUrl=e.baseUrl||"http://localhost:4321",this.emailVerificationRequired=e.emailVerificationRequired??true,this.jwtSecret=e.jwtSecret||"kyro-default-secret-key-change-me-in-production";}getBaseUrl(e){if(e)try{let t=e.headers.get("x-forwarded-proto")||(e.url.startsWith("https")?"https":"http"),s=e.headers.get("x-forwarded-host")||e.headers.get("host");return s?`${t}://${s}`:new URL(e.url).origin}catch{}return process.env.KYRO_BASE_URL||process.env.SERVER_URL||process.env.PUBLIC_URL||process.env.SITE_URL||this.baseUrl||"http://localhost:4321"}async register(e){let{ipAddress:t,userAgent:s}=a$2(e);if(this.rateLimiter){let n=await this.rateLimiter.check("auth:register",t);if(!n.allowed)return this.rateLimitResponse(n)}try{let n=await e.json();if(!n.email||!n.password)return this.errorResponse("Email and password are required",400);if(n.password!==n.confirmPassword)return this.errorResponse("Passwords do not match",400);let a=this.passwordPolicy.validate(n.password);if(!a.valid)return this.errorResponse(a.errors.join(". "),400);let i=await this.authAdapter.findUserByEmail(n.email);if(i){if(!i.emailVerified&&this.emailVerificationRequired&&this.email){let g=(await this.authAdapter.createEmailVerificationToken?.(i.id))?.token||randomBytes(32).toString("hex"),_=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${g}`,P=this.email.getTemplates().verifyEmail(_,n.email);return await this.email.send({to:n.email,...P}),this.jsonResponse({success:!0,message:"An unverified account already exists with this email. We have resent the confirmation link to your inbox.",requiresVerification:!0},200)}return this.errorResponse("Email already registered",400)}let c=await this.authAdapter.createUser({email:n.email,password:n.password,role:n.role||"customer",tenantId:n.tenantId});if(this.emailVerificationRequired&&this.email){let d=randomBytes(32).toString("hex"),x=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${d}`;await this.authAdapter.createSession(c.id,{ipAddress:t,userAgent:s});let _=this.email.getTemplates().verifyEmail(x,n.email);await this.email.send({to:n.email,..._});}return this.auditLogger&&await this.auditLogger.log({action:"register",userId:c.id,userEmail:c.email,resource:"auth",ipAddress:t,userAgent:s,success:!0}),this.jsonResponse({success:!0,message:"Registration successful",user:this.sanitizeUser(c),requiresVerification:this.emailVerificationRequired&&!!this.email},201)}catch(n){return console.error("[AuthRoutes.register] Registration error:",n),this.errorResponse("Registration failed",500)}}async login(e){let{ipAddress:t,userAgent:s}=a$2(e);if(this.rateLimiter){let n=await this.rateLimiter.check("auth:login",t);if(!n.allowed)return this.rateLimitResponse(n)}try{let n=await e.json();if(!n.email||!n.password)return this.errorResponse("Email and password are required",400);let a=await this.authAdapter.findUserByEmail(n.email);if(!a)return await this.recordFailedLogin(t,s),this.errorResponse("Invalid credentials",401);if(a.locked)return this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:a.id,userEmail:a.email,resource:"auth",ipAddress:t,userAgent:s,success:!1,error:"Account locked"}),this.errorResponse("Account locked. Contact an administrator.",403);if(this.lockout){let x=await this.lockout.checkLockout(a.id);if(x.locked)return this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:a.id,userEmail:a.email,resource:"auth",ipAddress:t,userAgent:s,success:!1,error:"Account locked"}),this.errorResponse(`Account locked. Try again in ${Math.ceil((x.lockedUntil.getTime()-Date.now())/6e4)} minutes`,423)}let i=await this.authAdapter.verifyPassword(n.email,n.password);if(!i)return await this.recordFailedLogin(t,s,a.id,a.email),this.errorResponse("Invalid credentials",401);if(this.emailVerificationRequired&&i.emailVerified===!1){if(this.email){let _=(await this.authAdapter.createEmailVerificationToken?.(i.id))?.token||randomBytes(32).toString("hex"),G=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${_}`,q=this.email.getTemplates().verifyEmail(G,i.email);await this.email.send({to:i.email,...q});}return this.errorResponse("Your email address is not verified yet. We have sent a new confirmation link to your email inbox.",403)}this.lockout&&await this.lockout.resetAttempts(a.id),this.auditLogger&&await this.auditLogger.log({action:"login",userId:a.id,userEmail:a.email,role:a.role,resource:"auth",ipAddress:t,userAgent:s,success:!0}),await this.authAdapter.updateUser(a.id,{lastLogin:new Date().toISOString()});let c=await l({id:a.id,email:a.email,role:a.role,tenantId:a.tenantId});if(this.email&&a.email){let x=new Date().toLocaleString(),_=this.email.getTemplates().newLogin(t,x,a.email,void 0,s);this.email.send({to:a.email,..._}).catch(P=>console.error("Failed to send newLogin email:",P));}let d={success:!0,user:this.sanitizeUser(a)},g=this.jsonResponse(d);return j$1(g,c)}catch(n){return console.error("[Auth] Login error:",n),this.errorResponse("Login failed",500)}}async logout(e){let t$1=h(e);if(!t$1)return this.errorResponse("No session to logout",401);let{ipAddress:s,userAgent:n}=a$2(e);try{let a=await t(e);a&&(await p$1(t$1),this.auditLogger&&await this.auditLogger.log({action:"logout",userId:a.userId,userEmail:a.email,resource:"auth",ipAddress:s,userAgent:n,success:!0}));let i=this.jsonResponse({success:!0,message:"Logged out successfully"});return k(i)}catch{return this.errorResponse("Logout failed",500)}}async refresh(e){try{let t=h(e);if(!t)return this.errorResponse("Not authenticated",401);let s=await o$1(t,e);return s?this.jsonResponse({success:!0,expiresAt:s.expiresAt}):this.errorResponse("Session not found",404)}catch(t){return console.error("[Auth] Session refresh error:",t),this.errorResponse("Session refresh failed",500)}}async me(e){let t$1=await t(e);return t$1?this.jsonResponse({success:true,user:{id:t$1.userId,email:t$1.email,role:t$1.role,tenantId:t$1.tenantId}}):this.errorResponse("Not authenticated",401)}async changePassword(e){let t$1=await t(e);if(!t$1)return this.errorResponse("Not authenticated",401);let{ipAddress:s,userAgent:n}=a$2(e);try{let a=await e.json(),{currentPassword:i,newPassword:c,confirmPassword:d}=a;if(!i||!c)return this.errorResponse("Current and new password required",400);if(c!==d)return this.errorResponse("Passwords do not match",400);let g=this.passwordPolicy.validate(c);if(!g.valid)return this.errorResponse(g.errors.join(". "),400);let x=await this.authAdapter.findUserById(t$1.userId);if(!x)return this.errorResponse("User not found",404);if(!(x.passwordHash?await this.authAdapter.verifyPassword(i,x.passwordHash):!1))return this.errorResponse("Current password is incorrect",401);let P=await this.authAdapter.getPasswordHistory?.(x.id,5);if(await this.authAdapter.isPasswordInHistory?.(c,x.id,5))return this.errorResponse("Password was recently used. Please choose a different password",400);let q=await this.authAdapter.hashPassword(c);if(x.passwordHash&&await this.authAdapter.addPasswordToHistory?.(x.id,x.passwordHash),await this.authAdapter.updateUser(x.id,{passwordHash:q}),await this.authAdapter.deleteUserSessions(x.id),this.email&&this.email.getTemplates){let H=this.email.getTemplates().passwordChanged(x.email,void 0,s,n);await this.email.send({to:x.email,...H});}return this.auditLogger&&await this.auditLogger.log({action:"password_change",userId:x.id,userEmail:x.email,resource:"auth",ipAddress:s,userAgent:n,success:!0}),this.jsonResponse({success:!0,message:"Password changed successfully"})}catch{return this.errorResponse("Password change failed",500)}}async forgotPassword(e){let{ipAddress:t,userAgent:s}=a$2(e);if(this.rateLimiter){let n=await this.rateLimiter.check("auth:forgot",t);if(!n.allowed)return this.rateLimitResponse(n)}try{let n=await e.json(),{email:a}=n;if(!a)return this.errorResponse("Email required",400);let i=await this.authAdapter.findUserByEmail(a);if(!i)return this.jsonResponse({success:!0,message:"If the email exists, a reset link has been sent"});if(this.email){let c=randomBytes(32).toString("hex");if(this.authAdapter.createPasswordResetToken){let _=await this.authAdapter.createPasswordResetToken(i.email);_.token&&(c=_.token);}let g=`${this.getBaseUrl(e)}/admin/auth/reset-password?token=${c}`,x=this.email.getTemplates().resetPassword(g,i.email);await this.email.send({to:i.email,...x});}return this.auditLogger&&await this.auditLogger.log({action:"password_reset",userId:i.id,userEmail:i.email,resource:"auth",ipAddress:t,userAgent:s,success:!0}),this.jsonResponse({success:!0,message:"If the email exists, a reset link has been sent"})}catch{return this.errorResponse("Password reset request failed",500)}}async resetPassword(e){let{ipAddress:t,userAgent:s}=a$2(e);if(this.rateLimiter){let n=await this.rateLimiter.check("auth:reset",t);if(!n.allowed)return this.rateLimitResponse(n)}try{let n=await e.json(),{token:a,newPassword:i,confirmPassword:c}=n;if(!a||!i)return this.errorResponse("Reset token and new password are required",400);if(i!==c)return this.errorResponse("Passwords do not match",400);let d=this.passwordPolicy.validate(i);if(!d.valid)return this.errorResponse(d.errors.join(". "),400);if(this.authAdapter.resetPasswordWithToken){let g=await this.authAdapter.resetPasswordWithToken(a,i);if(!g.success)return this.errorResponse(g.error||"Password reset failed or token expired",400)}return this.jsonResponse({success:!0,message:"Password reset successful. You can now log in with your new password."})}catch(n){return console.error("[AuthRoutes.resetPassword] Error:",n),this.errorResponse("Password reset failed",500)}}async verifyEmail(e){let s=new URL(e.url).searchParams.get("token");if(!s)return this.errorResponse("Verification token required",400);try{if(this.authAdapter.verifyEmailToken){let n=await this.authAdapter.verifyEmailToken(s);if(!n.success)return this.errorResponse(n.error||"Invalid or expired verification token",400);if(n.userId&&this.email){let a=await this.authAdapter.findUserById(n.userId);if(a){let i=this.email.getTemplates().welcome(a.email);await this.email.send({to:a.email,...i});}}}return this.jsonResponse({success:!0,message:"Email address verified successfully"})}catch(n){return console.error("[AuthRoutes.verifyEmail] Error:",n),this.errorResponse("Email verification failed",500)}}async recordFailedLogin(e,t,s,n){if(this.lockout){let a=await this.lockout.recordFailedAttempt(s||e);if(a.locked&&a.totalAttempts===this.lockout.getConfig().maxAttempts&&this.email&&n){let i=Math.ceil(this.lockout.getConfig().lockDuration/6e4),c=this.email.getTemplates().accountLocked(a.totalAttempts,i,n,void 0,e,t);this.email.send({to:n,...c}).catch(d=>console.error("Failed to send accountLocked email:",d));}}this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:s,userEmail:n,resource:"auth",ipAddress:e,userAgent:t,success:false,error:"Invalid credentials"});}sanitizeUser(e){let{passwordHash:t,...s}=e;return s}jsonResponse(e,t=200){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":"application/json","Cache-Control":"no-store, no-cache, must-revalidate, max-age=0"}})}async listSessions(e){let t$1=await t(e);if(!t$1)return this.errorResponse("Not authenticated",401);try{let s=await r$2(t$1.userId,h(e)??void 0);return this.jsonResponse({sessions:s})}catch(s){return console.error("[AuthRoutes.listSessions] Error:",s),this.errorResponse("Failed to list sessions",500)}}async revokeSession(e,t$1){let s=await t(e);if(!s)return this.errorResponse("Not authenticated",401);try{let a=(await r$2(s.userId)).find(i=>i.id===t$1);return a?a.currentSession?this.errorResponse("Cannot revoke current session",400):(await p$1(t$1),this.jsonResponse({success:!0,message:"Session revoked"})):this.errorResponse("Session not found",404)}catch(n){return console.error("[AuthRoutes.revokeSession] Error:",n),this.errorResponse("Failed to revoke session",500)}}async revokeOtherSessions(e){let t$1=await t(e);if(!t$1)return this.errorResponse("Not authenticated",401);try{let s=await r$2(t$1.userId),n=h(e);for(let a of s)a.currentSession||await p$1(a.id);return this.jsonResponse({success:!0,message:"Other sessions revoked"})}catch(s){return console.error("[AuthRoutes.revokeOtherSessions] Error:",s),this.errorResponse("Failed to revoke sessions",500)}}async renameSession(e,t$1){let s$1=await t(e);if(!s$1)return this.errorResponse("Not authenticated",401);try{if(!(await r$2(s$1.userId)).find(d=>d.id===t$1))return this.errorResponse("Session not found",404);let i=await e.json(),{name:c}=i;return !c||typeof c!="string"||c.trim().length===0?this.errorResponse("Invalid session name",400):(await s(t$1,c.trim()),this.jsonResponse({success:!0,message:"Session renamed"}))}catch(n){return console.error("[AuthRoutes.renameSession] Error:",n),this.errorResponse("Failed to rename session",500)}}async refreshSession(e){let t=h(e);if(!t)return this.errorResponse("No session",401);try{let{refreshSession:s}=await import('./auth-session-O7IIH7EP.js'),n=await s(t,e);return n?this.jsonResponse({success:!0,expiresAt:n.expiresAt}):this.errorResponse("Session not found",404)}catch(s){return console.error("[AuthRoutes.refreshSession] Error:",s),this.errorResponse("Failed to refresh session",500)}}errorResponse(e,t){return new Response(JSON.stringify({success:false,error:e}),{status:t,headers:{"Content-Type":"application/json"}})}async rateLimitResponse(e){return new Response(JSON.stringify({error:"Too many requests. Please try again later."}),{status:429,headers:{"Content-Type":"application/json",...e.retryAfter?{"Retry-After":e.retryAfter.toString()}:{}}})}async requestMagicLink(e){let{ipAddress:t,userAgent:s}=a$2(e);try{let n=await e.json();if(!n.email)return this.errorResponse("Email required",400);let a=await this.authAdapter.findUserByEmail(n.email);if(!a)return this.jsonResponse({success:!0,message:"If an account exists, a link was sent."});if(this.email){let i=Buffer.from(JSON.stringify({email:a.email,exp:Date.now()+6e5})).toString("base64url"),c=createHmac("sha256",this.jwtSecret).update(i).digest("hex"),d=`${i}.${c}`,x=`${this.getBaseUrl(e)}/admin/auth/magic-link?token=${d}`,_=this.email.getTemplates().magicLink(x,void 0,a.email);this.email.send({to:a.email,..._}).catch(P=>console.error("Magic link err:",P));}return this.jsonResponse({success:!0,message:"If an account exists, a link was sent."})}catch{return this.errorResponse("Failed to process request",500)}}async verifyMagicLink(e){let{ipAddress:t,userAgent:s}=a$2(e),a=new URL(e.url).searchParams.get("token");if(!a)return this.errorResponse("Token required",400);try{let[i,c]=a.split(".");if(!i||!c)return this.errorResponse("Invalid token",400);let d=createHmac("sha256",this.jwtSecret).update(i).digest("hex");if(c!==d)return this.errorResponse("Invalid token",400);let g=JSON.parse(Buffer.from(i,"base64url").toString());if(Date.now()>g.exp)return this.errorResponse("Token expired",400);let x=await this.authAdapter.findUserByEmail(g.email);if(!x)return this.errorResponse("User not found",404);if(x.locked)return this.errorResponse("Account locked",403);let _=await l({id:x.id,email:x.email,role:x.role,tenantId:x.tenantId});this.auditLogger&&await this.auditLogger.log({action:"login",userId:x.id,userEmail:x.email,resource:"auth",ipAddress:t,userAgent:s,success:!0});let P=this.jsonResponse({success:!0,user:this.sanitizeUser(x)});return j$1(P,_)}catch{return this.errorResponse("Invalid token",400)}}async inviteUser(e){try{let t=await e.json();if(!t.email||!t.role)return this.errorResponse("Email and role required",400);let s=await this.authAdapter.findUserByEmail(t.email);if(s)return this.errorResponse("User already exists",409);if(s=await this.authAdapter.createUser({email:t.email,password:randomBytes(16).toString("hex"),role:t.role}),this.email){let n=await this.authAdapter.createPasswordResetToken(s.email),i=`${this.getBaseUrl(e)}/admin/auth/reset-password?token=${n.token}`,c=this.email.getTemplates().userInvite(i,t.role,t.inviterName||"An administrator");this.email.send({to:s.email,...c}).catch(d=>console.error("Invite email err:",d));}return this.jsonResponse({success:!0,message:"User invited successfully"})}catch{return this.errorResponse("Failed to invite user",500)}}};g();var Yc=e(a(),1);var Ao=class{db;sessionTTL;constructor(e){this.db=e.db?.client||e.db,this.sessionTTL=e.sessionTTL||86400;}async executeSql(e,t=[]){try{if(this.db&&typeof this.db.prepare=="function"){let s=this.db.prepare(e);return (await(t.length>0?s.bind(...t):s).all()).results||[]}else if(this.db&&typeof this.db.run=="function"){let s=await this.db.run(J.raw(this.replaceParams(e,t)));return s.rows||s.results||(Array.isArray(s)?s:[])}else if(this.db&&typeof this.db.all=="function"){let s=await this.db.all(J.raw(this.replaceParams(e,t)));return Array.isArray(s)?s:s.results||[]}else if(this.db&&typeof this.db.execute=="function"){let s=await this.db.execute(J.raw(this.replaceParams(e,t)));return s.rows||s.results||(Array.isArray(s)?s:[])}}catch(s){console.warn("[D1AuthAdapter] SQL execution note:",s.message);}return []}async getOne(e,t=[]){try{if(this.db&&typeof this.db.prepare=="function"){let n=this.db.prepare(e);return await(t.length>0?n.bind(...t):n).first()||null}}catch{}let s=await this.executeSql(e,t);return s.length>0?s[0]:null}replaceParams(e,t){let s=0;return e.replace(/\?/g,()=>{let n=t[s++];return n==null?"NULL":typeof n=="number"||typeof n=="boolean"?String(n):`'${String(n).replace(/'/g,"''")}'`})}async connect(){await this.executeSql(`
       CREATE TABLE IF NOT EXISTS users (
         id TEXT PRIMARY KEY,
         email TEXT UNIQUE NOT NULL,