@kyro-cms/core 0.13.3 → 0.13.6

package/dist/chunk-HACW42ZZ.cjs

@@ -0,0 +1,108 @@
+'use strict';var chunkH2IJDTA2_cjs=require('./chunk-H2IJDTA2.cjs'),chunkPW6Y5MQL_cjs=require('./chunk-PW6Y5MQL.cjs'),chunk34LCWI5X_cjs=require('./chunk-34LCWI5X.cjs'),chunkLXTVMP5F_cjs=require('./chunk-LXTVMP5F.cjs'),chunk2I2AXTKY_cjs=require('./chunk-2I2AXTKY.cjs'),chunkOJBL4CXK_cjs=require('./chunk-OJBL4CXK.cjs'),chunkDCFOVCJX_cjs=require('./chunk-DCFOVCJX.cjs'),chunkEG4SRTYS_cjs=require('./chunk-EG4SRTYS.cjs'),chunk3A5UO6OQ_cjs=require('./chunk-3A5UO6OQ.cjs'),chunkYOJOVQIH_cjs=require('./chunk-YOJOVQIH.cjs'),chunkNBBAMC2X_cjs=require('./chunk-NBBAMC2X.cjs'),chunkOXEJCIOA_cjs=require('./chunk-OXEJCIOA.cjs'),chunkKOSR7235_cjs=require('./chunk-KOSR7235.cjs'),hono=require('hono'),Ae=require('path'),crypto=require('crypto'),jwt=require('hono/jwt'),fs=require('fs'),promises=require('fs/promises'),ir=require('process'),clientS3=require('@aws-sdk/client-s3'),nodeHttpHandler=require('@smithy/node-http-handler');require('stream');var zodToJsonSchema=require('zod-to-json-schema'),Kt=require('bcryptjs'),drizzleOrm=require('drizzle-orm');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var Ae__default=/*#__PURE__*/_interopDefault(Ae);var ir__default=/*#__PURE__*/_interopDefault(ir);var Kt__default=/*#__PURE__*/_interopDefault(Kt);function yt(i){let{db:t,userLookup:s}=i;return async function(a){let n=chunkDCFOVCJX_cjs.c(a);if(n&&t){let p=await chunkDCFOVCJX_cjs.b(n,t,s);if(p.valid&&p.user)return {user:p.user,tenantContext:ht(p.user),apiKeyContext:chunkDCFOVCJX_cjs.d(p),status:200,authType:"apikey"};if(p.error)return {status:401,error:p.error}}let c=chunkLXTVMP5F_cjs.g(a);if(c)try{let p=await chunkLXTVMP5F_cjs.m(c);if(!p.valid)return {status:401,error:p.reason||"Session invalid"};let o=await chunkLXTVMP5F_cjs.s(a);if(o){let u=s?await s(o.userId):null;if(u)return {user:u,tenantContext:ht(u),status:200,authType:"session"}}}catch(p){console.error("Session validation error:",p);}return {status:401,error:"Authentication required"}}}function ht(i){return {tenantId:i.tenantId||"default",userId:i.id||"anonymous",role:i.role||"guest",roles:[i.role||"guest"],permissions:[],isSuperAdmin:i.role==="super_admin"}}var fe=class{storage=new Map;userStorage=new Map;limits;userLimits;constructor(e,t){this.limits={...zt,...e},this.userLimits=t||{"user:api":{window:6e4,max:500},"user:write":{window:36e5,max:100}};}getKey(e,t){return `${e}:${t}`}getUserKey(e,t,s){return `user:${e}:${t}:${s}`}cleanupOldEntries(e,t){let r=Date.now()-t;for(;e.length>0&&e[0].timestamp<r;)e.shift();}async check(e,t){let s=this.limits[e]||this.limits["api:general"],r=this.getKey(e,t),a=this.storage.get(r);a||(a=[],this.storage.set(r,a)),this.cleanupOldEntries(a,s.window);let n=Date.now(),c=a.reduce((p,o)=>p+o.count,0);if(a.push({timestamp:n,count:1}),c>=s.max){let o=a.reduce((u,d)=>u.timestamp<d.timestamp?u:d,a[0]).timestamp+s.window;return {allowed:false,remaining:0,resetAt:o,retryAfter:Math.ceil((o-n)/1e3)}}return {allowed:true,remaining:s.max-c-1,resetAt:n+s.window}}async checkUser(e,t,s){let r=this.userLimits[e]||this.userLimits["user:api"],a=this.userStorage.get(t),n=[];a?n=a.get(this.getKey(e,s))||[]:(this.userStorage.has(t)||this.userStorage.set(t,new Map),this.userStorage.get(t).set(this.getKey(e,s),n)),this.cleanupOldEntries(n,r.window);let c=Date.now(),p=n.reduce((o,u)=>o+u.count,0);if(n.push({timestamp:c,count:1}),p>=r.max){let u=n.reduce((d,m)=>d.timestamp<m.timestamp?d:m,n[0]).timestamp+r.window;return {allowed:false,remaining:0,resetAt:u,retryAfter:Math.ceil((u-c)/1e3)}}return {allowed:true,remaining:r.max-p-1,resetAt:c+r.window}}async reset(e,t){let s=this.getKey(e,t);this.storage.delete(s);}async resetUser(e,t,s){let r=this.userStorage.get(t);if(r){let a=this.getKey(e,s);r.delete(a);}}async getStatus(e,t){let s=this.limits[e]||this.limits["api:general"],r=this.getKey(e,t),a=this.storage.get(r);a||(a=[],this.storage.set(r,a)),this.cleanupOldEntries(a,s.window);let n=Date.now(),c=a.reduce((p,o)=>p+o.count,0);return {count:c,limit:s.max,remaining:Math.max(0,s.max-c),resetAt:n+s.window}}setLimit(e,t){this.limits[e]=t;}setUserLimit(e,t){this.userLimits[e]=t;}},zt={"auth:login":{window:9e5,max:5},"auth:register":{window:36e5,max:3},"auth:forgot":{window:36e5,max:3},"auth:reset":{window:36e5,max:5},"auth:verify":{window:36e5,max:5},"api:general":{window:6e4,max:100},"api:authenticated":{window:6e4,max:200}};var Ue={retentionDays:30};var wt=class{redis;prefix;retentionDays;constructor(e,t=30,s="kyro:audit:"){this.redis=e,this.prefix=s,this.retentionDays=t;}async log(e){let t=crypto.randomBytes(16).toString("hex"),s=new Date,r={...e,id:t,timestamp:s},a=this.getKeyForDate(s),n=`${this.prefix}log:${t}`;await this.redis.hset(n,this.serializeLog(r)),await this.redis.expire(n,this.retentionDays*24*60*60+3600),await this.redis.zadd(a,s.getTime(),t),await this.redis.expire(a,this.retentionDays*24*60*60+3600);let c=e.userId?`${this.prefix}user:${e.userId}`:null;return c&&(await this.redis.zadd(c,s.getTime(),t),await this.redis.expire(c,this.retentionDays*24*60*60+3600)),t}async get(e){let t=`${this.prefix}log:${e}`,s=await this.redis.hgetall(t);return !s||Object.keys(s).length===0?null:this.deserializeLog(s)}async query(e={}){let{limit:t=50,offset:s=0}=e,r=[];if(e.userId)r.push(`${this.prefix}user:${e.userId}`);else if(e.startDate||e.endDate)r=this.getKeysForDateRange(e.startDate,e.endDate);else {let p=new Date;r=this.getKeysForDateRange(new Date(p.getTime()-this.retentionDays*24*60*60*1e3),p);}let a=[];for(let p of r){let o=await this.redis.zrange(p,0,-1,"WITHSCORES");for(let u=0;u<o.length;u+=2)a.push([o[u],parseInt(o[u+1],10)]);}a.sort((p,o)=>o[1]-p[1]);let n=a.length;a=a.slice(s,s+t);let c=[];for(let[p]of a){let o=await this.get(p);o&&this.matchesFilter(o,e)&&c.push(o);}return {logs:c,total:n}}async getRecent(e=50){let t=[],s=new Date,r=this.getKeysForDateRange(new Date(s.getTime()-10080*60*1e3),s),a=[];for(let n of r){let c=await this.redis.zrange(n,0,-1,"WITHSCORES");for(let p=0;p<c.length;p+=2)a.push([c[p],parseInt(c[p+1],10)]);}a.sort((n,c)=>c[1]-n[1]);for(let[n]of a.slice(0,e)){let c=await this.get(n);c&&t.push(c);}return t}async getUserActivity(e,t=50){let s=`${this.prefix}user:${e}`,r=await this.redis.zrange(s,0,t-1),a=[];for(let n of r){let c=await this.get(n);c&&a.push(c);}return a}async getStats(e,t){let s=this.getKeysForDateRange(e||new Date(Date.now()-2592e6),t||new Date),r={},a=0,n=0,c=0,p=new Set;for(let o of s){let u=await this.redis.zrange(o,0,-1);for(let d of u){let m=await this.get(d);m&&(a++,r[m.action]=(r[m.action]||0)+1,m.success&&c++,m.action==="login_failed"&&n++,m.userId&&p.add(m.userId));}}return {totalEvents:a,byAction:r,successRate:a>0?c/a:1,failedLogins:n,uniqueUsers:p}}async cleanup(){let e=Date.now()-this.retentionDays*24*60*60*1e3,t=await this.redis.keys(`${this.prefix}date:*`),s=0;for(let r of t){let a=await this.redis.zrangebyscore(r,0,e);for(let n of a)await this.redis.del(`${this.prefix}log:${n}`),s++;await this.redis.zremrangebyscore(r,0,e);}return s}getKeyForDate(e){let t=e.getFullYear(),s=String(e.getMonth()+1).padStart(2,"0"),r=String(e.getDate()).padStart(2,"0");return `${this.prefix}date:${t}-${s}-${r}`}getKeysForDateRange(e,t){let s=[],r=e||new Date(Date.now()-this.retentionDays*24*60*60*1e3),a=t||new Date,n=new Date(r);for(;n<=a;)s.push(this.getKeyForDate(n)),n.setDate(n.getDate()+1);return s}matchesFilter(e,t){return !(t.action&&!(Array.isArray(t.action)?t.action:[t.action]).includes(e.action)||t.resource&&e.resource!==t.resource||t.resourceId&&e.resourceId!==t.resourceId||t.success!==void 0&&e.success!==t.success)}serializeLog(e){let t={id:e.id,timestamp:new Date(e.timestamp).toISOString(),action:e.action,resource:e.resource,success:e.success?"1":"0"};return e.userId&&(t.userId=e.userId),e.userEmail&&(t.userEmail=e.userEmail),e.role&&(t.role=e.role),e.resourceId&&(t.resourceId=e.resourceId),e.ipAddress&&(t.ipAddress=e.ipAddress),e.userAgent&&(t.userAgent=e.userAgent),e.error&&(t.error=e.error),e.changes&&(t.changes=JSON.stringify(e.changes)),e.metadata&&(t.metadata=JSON.stringify(e.metadata)),t}deserializeLog(e){return {id:e.id,timestamp:new Date(e.timestamp),action:e.action,userId:e.userId,userEmail:e.userEmail,role:e.role,resource:e.resource,resourceId:e.resourceId,ipAddress:e.ipAddress,userAgent:e.userAgent,success:e.success==="1",error:e.error,changes:e.changes?JSON.parse(e.changes):void 0,metadata:e.metadata?JSON.parse(e.metadata):void 0}}};function Cr(i){return {ipAddress:i.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||i.headers.get("x-real-ip")||"unknown",userAgent:i.headers.get("user-agent")||"unknown"}}function ee(i){return {ipAddress:i.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||i.headers.get("x-real-ip")||"unknown",userAgent:i.headers.get("user-agent")||"unknown"}}var bt=class{logs=[];retentionDays;constructor(e=Ue.retentionDays){this.retentionDays=e;}async log(e){let t=crypto.randomBytes(16).toString("hex"),r={...e,id:t,timestamp:new Date};return this.logs.push(r),this.cleanupOldLogs(),t}async get(e){return this.logs.find(t=>t.id===e)||null}async query(e={}){let{limit:t=50,offset:s=0}=e,r=[...this.logs];if(e.userId&&(r=r.filter(o=>o.userId===e.userId)),e.action){let o=Array.isArray(e.action)?e.action:[e.action];r=r.filter(u=>o.includes(u.action));}e.resource&&(r=r.filter(o=>o.resource===e.resource)),e.resourceId&&(r=r.filter(o=>o.resourceId===e.resourceId)),e.success!==void 0&&(r=r.filter(o=>o.success===e.success));let a=e.startDate,n=e.endDate;a!==void 0&&(r=r.filter(o=>o.timestamp>=a)),n!==void 0&&(r=r.filter(o=>o.timestamp<=n)),r.sort((o,u)=>u.timestamp.getTime()-o.timestamp.getTime());let c=r.length;return {logs:r.slice(s,s+t),total:c}}async getRecent(e=50){let t=new Date(Date.now()-6048e5);return this.logs.filter(r=>r.timestamp>=t).sort((r,a)=>a.timestamp.getTime()-r.timestamp.getTime()).slice(0,e)}async getUserActivity(e,t=50){return this.logs.filter(r=>r.userId===e).sort((r,a)=>a.timestamp.getTime()-r.timestamp.getTime()).slice(0,t)}async getStats(e,t){let s=e||new Date(Date.now()-2592e6),r=t||new Date,a=this.logs.filter(d=>d.timestamp>=s&&d.timestamp<=r),n={},c=0,p=0,o=0,u=new Set;for(let d of a){c++;let m=d.action;n[m]=(n[m]||0)+1,d.success&&o++,d.action==="login_failed"&&p++,d.userId&&u.add(d.userId);}return {totalEvents:c,byAction:n,successRate:c>0?o/c:1,failedLogins:p,uniqueUsers:u}}async cleanup(){let e=new Date(Date.now()-this.retentionDays*24*60*60*1e3),t=this.logs.length;return this.logs=this.logs.filter(s=>s.timestamp>=e),t-this.logs.length}cleanupOldLogs(){let e=new Date(Date.now()-this.retentionDays*24*60*60*1e3);this.logs.length;this.logs=this.logs.filter(s=>s.timestamp>=e);}};var he=class{authAdapter;email;passwordPolicy;lockout;rateLimiter;auditLogger;baseUrl;emailVerificationRequired;jwtSecret;constructor(e){this.authAdapter=e.redis,this.email=e.email,this.passwordPolicy=e.passwordPolicy||new chunkH2IJDTA2_cjs.a,this.lockout=e.lockout,this.rateLimiter=e.rateLimiter,this.auditLogger=e.auditLogger,this.baseUrl=e.baseUrl||"http://localhost:4321",this.emailVerificationRequired=e.emailVerificationRequired??true,this.jwtSecret=e.jwtSecret||"kyro-default-secret-key-change-me-in-production";}getBaseUrl(e){if(e)try{let t=e.headers.get("x-forwarded-proto")||(e.url.startsWith("https")?"https":"http"),s=e.headers.get("x-forwarded-host")||e.headers.get("host");return s?`${t}://${s}`:new URL(e.url).origin}catch{}return process.env.KYRO_BASE_URL||process.env.SERVER_URL||process.env.PUBLIC_URL||process.env.SITE_URL||this.baseUrl||"http://localhost:4321"}async register(e){let{ipAddress:t,userAgent:s}=ee(e);if(this.rateLimiter){let r=await this.rateLimiter.check("auth:register",t);if(!r.allowed)return this.rateLimitResponse(r)}try{let r=await e.json();if(!r.email||!r.password)return this.errorResponse("Email and password are required",400);if(r.password!==r.confirmPassword)return this.errorResponse("Passwords do not match",400);let a=this.passwordPolicy.validate(r.password);if(!a.valid)return this.errorResponse(a.errors.join(". "),400);let n=await this.authAdapter.findUserByEmail(r.email);if(n){if(!n.emailVerified&&this.emailVerificationRequired&&this.email){let o=(await this.authAdapter.createEmailVerificationToken?.(n.id))?.token||crypto.randomBytes(32).toString("hex"),d=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${o}`,m=this.email.getTemplates().verifyEmail(d,r.email);return await this.email.send({to:r.email,...m}),this.jsonResponse({success:!0,message:"An unverified account already exists with this email. We have resent the confirmation link to your inbox.",requiresVerification:!0},200)}return this.errorResponse("Email already registered",400)}let c=await this.authAdapter.createUser({email:r.email,password:r.password,role:r.role||"customer",tenantId:r.tenantId});if(this.emailVerificationRequired&&this.email){let p=crypto.randomBytes(32).toString("hex"),u=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${p}`;await this.authAdapter.createSession(c.id,{ipAddress:t,userAgent:s});let d=this.email.getTemplates().verifyEmail(u,r.email);await this.email.send({to:r.email,...d});}return this.auditLogger&&await this.auditLogger.log({action:"register",userId:c.id,userEmail:c.email,resource:"auth",ipAddress:t,userAgent:s,success:!0}),this.jsonResponse({success:!0,message:"Registration successful",user:this.sanitizeUser(c),requiresVerification:this.emailVerificationRequired&&!!this.email},201)}catch(r){return console.error("[AuthRoutes.register] Registration error:",r),this.errorResponse("Registration failed",500)}}async login(e){let{ipAddress:t,userAgent:s}=ee(e);if(this.rateLimiter){let r=await this.rateLimiter.check("auth:login",t);if(!r.allowed)return this.rateLimitResponse(r)}try{let r=await e.json();if(!r.email||!r.password)return this.errorResponse("Email and password are required",400);let a=await this.authAdapter.findUserByEmail(r.email);if(!a)return await this.recordFailedLogin(t,s),this.errorResponse("Invalid credentials",401);if(a.locked)return this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:a.id,userEmail:a.email,resource:"auth",ipAddress:t,userAgent:s,success:!1,error:"Account locked"}),this.errorResponse("Account locked. Contact an administrator.",403);if(this.lockout){let u=await this.lockout.checkLockout(a.id);if(u.locked)return this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:a.id,userEmail:a.email,resource:"auth",ipAddress:t,userAgent:s,success:!1,error:"Account locked"}),this.errorResponse(`Account locked. Try again in ${Math.ceil((u.lockedUntil.getTime()-Date.now())/6e4)} minutes`,423)}let n=await this.authAdapter.verifyPassword(r.email,r.password);if(!n)return await this.recordFailedLogin(t,s,a.id,a.email),this.errorResponse("Invalid credentials",401);if(this.emailVerificationRequired&&n.emailVerified===!1){if(this.email){let d=(await this.authAdapter.createEmailVerificationToken?.(n.id))?.token||crypto.randomBytes(32).toString("hex"),y=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${d}`,l=this.email.getTemplates().verifyEmail(y,n.email);await this.email.send({to:n.email,...l});}return this.errorResponse("Your email address is not verified yet. We have sent a new confirmation link to your email inbox.",403)}this.lockout&&await this.lockout.resetAttempts(a.id),this.auditLogger&&await this.auditLogger.log({action:"login",userId:a.id,userEmail:a.email,role:a.role,resource:"auth",ipAddress:t,userAgent:s,success:!0}),await this.authAdapter.updateUser(a.id,{lastLogin:new Date().toISOString()});let c=await chunkLXTVMP5F_cjs.k({id:a.id,email:a.email,role:a.role,tenantId:a.tenantId});if(this.email&&a.email){let u=new Date().toLocaleString(),d=this.email.getTemplates().newLogin(t,u,a.email,void 0,s);this.email.send({to:a.email,...d}).catch(m=>console.error("Failed to send newLogin email:",m));}let p={success:!0,user:this.sanitizeUser(a)},o=this.jsonResponse(p);return chunkLXTVMP5F_cjs.i(o,c)}catch(r){return console.error("[Auth] Login error:",r),this.errorResponse("Login failed",500)}}async logout(e){let t=chunkLXTVMP5F_cjs.g(e);if(!t)return this.errorResponse("No session to logout",401);let{ipAddress:s,userAgent:r}=ee(e);try{let a=await chunkLXTVMP5F_cjs.s(e);a&&(await chunkLXTVMP5F_cjs.o(t),this.auditLogger&&await this.auditLogger.log({action:"logout",userId:a.userId,userEmail:a.email,resource:"auth",ipAddress:s,userAgent:r,success:!0}));let n=this.jsonResponse({success:!0,message:"Logged out successfully"});return chunkLXTVMP5F_cjs.j(n)}catch{return this.errorResponse("Logout failed",500)}}async refresh(e){try{let t=chunkLXTVMP5F_cjs.g(e);if(!t)return this.errorResponse("Not authenticated",401);let s=await chunkLXTVMP5F_cjs.n(t,e);return s?this.jsonResponse({success:!0,expiresAt:s.expiresAt}):this.errorResponse("Session not found",404)}catch(t){return console.error("[Auth] Session refresh error:",t),this.errorResponse("Session refresh failed",500)}}async me(e){let t=await chunkLXTVMP5F_cjs.s(e);return t?this.jsonResponse({success:true,user:{id:t.userId,email:t.email,role:t.role,tenantId:t.tenantId}}):this.errorResponse("Not authenticated",401)}async changePassword(e){let t=await chunkLXTVMP5F_cjs.s(e);if(!t)return this.errorResponse("Not authenticated",401);let{ipAddress:s,userAgent:r}=ee(e);try{let a=await e.json(),{currentPassword:n,newPassword:c,confirmPassword:p}=a;if(!n||!c)return this.errorResponse("Current and new password required",400);if(c!==p)return this.errorResponse("Passwords do not match",400);let o=this.passwordPolicy.validate(c);if(!o.valid)return this.errorResponse(o.errors.join(". "),400);let u=await this.authAdapter.findUserById(t.userId);if(!u)return this.errorResponse("User not found",404);if(!(u.passwordHash?await this.authAdapter.verifyPassword(n,u.passwordHash):!1))return this.errorResponse("Current password is incorrect",401);let m=await this.authAdapter.getPasswordHistory?.(u.id,5);if(await this.authAdapter.isPasswordInHistory?.(c,u.id,5))return this.errorResponse("Password was recently used. Please choose a different password",400);let l=await this.authAdapter.hashPassword(c);if(u.passwordHash&&await this.authAdapter.addPasswordToHistory?.(u.id,u.passwordHash),await this.authAdapter.updateUser(u.id,{passwordHash:l}),await this.authAdapter.deleteUserSessions(u.id),this.email&&this.email.getTemplates){let g=this.email.getTemplates().passwordChanged(u.email,void 0,s,r);await this.email.send({to:u.email,...g});}return this.auditLogger&&await this.auditLogger.log({action:"password_change",userId:u.id,userEmail:u.email,resource:"auth",ipAddress:s,userAgent:r,success:!0}),this.jsonResponse({success:!0,message:"Password changed successfully"})}catch{return this.errorResponse("Password change failed",500)}}async forgotPassword(e){let{ipAddress:t,userAgent:s}=ee(e);if(this.rateLimiter){let r=await this.rateLimiter.check("auth:forgot",t);if(!r.allowed)return this.rateLimitResponse(r)}try{let r=await e.json(),{email:a}=r;if(!a)return this.errorResponse("Email required",400);let n=await this.authAdapter.findUserByEmail(a);if(!n)return this.jsonResponse({success:!0,message:"If the email exists, a reset link has been sent"});if(this.email){let c=crypto.randomBytes(32).toString("hex");if(this.authAdapter.createPasswordResetToken){let d=await this.authAdapter.createPasswordResetToken(n.email);d.token&&(c=d.token);}let o=`${this.getBaseUrl(e)}/admin/auth/reset-password?token=${c}`,u=this.email.getTemplates().resetPassword(o,n.email);await this.email.send({to:n.email,...u});}return this.auditLogger&&await this.auditLogger.log({action:"password_reset",userId:n.id,userEmail:n.email,resource:"auth",ipAddress:t,userAgent:s,success:!0}),this.jsonResponse({success:!0,message:"If the email exists, a reset link has been sent"})}catch{return this.errorResponse("Password reset request failed",500)}}async resetPassword(e){let{ipAddress:t}=ee(e);if(this.rateLimiter){let r=await this.rateLimiter.check("auth:reset",t);if(!r.allowed)return this.rateLimitResponse(r)}try{let r=await e.json(),{token:a,newPassword:n,confirmPassword:c}=r;if(!a||!n)return this.errorResponse("Reset token and new password are required",400);if(n!==c)return this.errorResponse("Passwords do not match",400);let p=this.passwordPolicy.validate(n);if(!p.valid)return this.errorResponse(p.errors.join(". "),400);if(this.authAdapter.resetPasswordWithToken){let o=await this.authAdapter.resetPasswordWithToken(a,n);if(!o.success)return this.errorResponse(o.error||"Password reset failed or token expired",400)}return this.jsonResponse({success:!0,message:"Password reset successful. You can now log in with your new password."})}catch(r){return console.error("[AuthRoutes.resetPassword] Error:",r),this.errorResponse("Password reset failed",500)}}async verifyEmail(e){let s=new URL(e.url).searchParams.get("token");if(!s)return this.errorResponse("Verification token required",400);try{if(this.authAdapter.verifyEmailToken){let r=await this.authAdapter.verifyEmailToken(s);if(!r.success)return this.errorResponse(r.error||"Invalid or expired verification token",400);if(r.userId&&this.email){let a=await this.authAdapter.findUserById(r.userId);if(a){let n=this.email.getTemplates().welcome(a.email);await this.email.send({to:a.email,...n});}}}return this.jsonResponse({success:!0,message:"Email address verified successfully"})}catch(r){return console.error("[AuthRoutes.verifyEmail] Error:",r),this.errorResponse("Email verification failed",500)}}async recordFailedLogin(e,t,s,r){if(this.lockout){let a=await this.lockout.recordFailedAttempt(s||e);if(a.locked&&a.totalAttempts===this.lockout.getConfig().maxAttempts&&this.email&&r){let n=Math.ceil(this.lockout.getConfig().lockDuration/6e4),c=this.email.getTemplates().accountLocked(a.totalAttempts,n,r,void 0,e,t);this.email.send({to:r,...c}).catch(p=>console.error("Failed to send accountLocked email:",p));}}this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:s,userEmail:r,resource:"auth",ipAddress:e,userAgent:t,success:false,error:"Invalid credentials"});}sanitizeUser(e){let{passwordHash:t,...s}=e;return s}jsonResponse(e,t=200){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":"application/json","Cache-Control":"no-store, no-cache, must-revalidate, max-age=0"}})}async listSessions(e){let t=await chunkLXTVMP5F_cjs.s(e);if(!t)return this.errorResponse("Not authenticated",401);try{let s=await chunkLXTVMP5F_cjs.q(t.userId,chunkLXTVMP5F_cjs.g(e)??void 0);return this.jsonResponse({sessions:s})}catch(s){return console.error("[AuthRoutes.listSessions] Error:",s),this.errorResponse("Failed to list sessions",500)}}async revokeSession(e,t){let s=await chunkLXTVMP5F_cjs.s(e);if(!s)return this.errorResponse("Not authenticated",401);try{let a=(await chunkLXTVMP5F_cjs.q(s.userId)).find(n=>n.id===t);return a?a.currentSession?this.errorResponse("Cannot revoke current session",400):(await chunkLXTVMP5F_cjs.o(t),this.jsonResponse({success:!0,message:"Session revoked"})):this.errorResponse("Session not found",404)}catch(r){return console.error("[AuthRoutes.revokeSession] Error:",r),this.errorResponse("Failed to revoke session",500)}}async revokeOtherSessions(e){let t=await chunkLXTVMP5F_cjs.s(e);if(!t)return this.errorResponse("Not authenticated",401);try{let s=await chunkLXTVMP5F_cjs.q(t.userId),r=chunkLXTVMP5F_cjs.g(e);for(let a of s)a.currentSession||await chunkLXTVMP5F_cjs.o(a.id);return this.jsonResponse({success:!0,message:"Other sessions revoked"})}catch(s){return console.error("[AuthRoutes.revokeOtherSessions] Error:",s),this.errorResponse("Failed to revoke sessions",500)}}async renameSession(e,t){let s=await chunkLXTVMP5F_cjs.s(e);if(!s)return this.errorResponse("Not authenticated",401);try{if(!(await chunkLXTVMP5F_cjs.q(s.userId)).find(p=>p.id===t))return this.errorResponse("Session not found",404);let n=await e.json(),{name:c}=n;return !c||typeof c!="string"||c.trim().length===0?this.errorResponse("Invalid session name",400):(await chunkLXTVMP5F_cjs.r(t,c.trim()),this.jsonResponse({success:!0,message:"Session renamed"}))}catch(r){return console.error("[AuthRoutes.renameSession] Error:",r),this.errorResponse("Failed to rename session",500)}}async refreshSession(e){let t=chunkLXTVMP5F_cjs.g(e);if(!t)return this.errorResponse("No session",401);try{let{refreshSession:s}=await import('./auth-session-VHUHDBCL.cjs'),r=await s(t,e);return r?this.jsonResponse({success:!0,expiresAt:r.expiresAt}):this.errorResponse("Session not found",404)}catch(s){return console.error("[AuthRoutes.refreshSession] Error:",s),this.errorResponse("Failed to refresh session",500)}}errorResponse(e,t){return new Response(JSON.stringify({success:false,error:e}),{status:t,headers:{"Content-Type":"application/json"}})}async rateLimitResponse(e){return new Response(JSON.stringify({error:"Too many requests. Please try again later."}),{status:429,headers:{"Content-Type":"application/json",...e.retryAfter?{"Retry-After":e.retryAfter.toString()}:{}}})}async requestMagicLink(e){ee(e);try{let r=await e.json();if(!r.email)return this.errorResponse("Email required",400);let a=await this.authAdapter.findUserByEmail(r.email);if(!a)return this.jsonResponse({success:!0,message:"If an account exists, a link was sent."});if(this.email){let n=Buffer.from(JSON.stringify({email:a.email,exp:Date.now()+6e5})).toString("base64url"),c=crypto.createHmac("sha256",this.jwtSecret).update(n).digest("hex"),p=`${n}.${c}`,u=`${this.getBaseUrl(e)}/admin/auth/magic-link?token=${p}`,d=this.email.getTemplates().magicLink(u,void 0,a.email);this.email.send({to:a.email,...d}).catch(m=>console.error("Magic link err:",m));}return this.jsonResponse({success:!0,message:"If an account exists, a link was sent."})}catch{return this.errorResponse("Failed to process request",500)}}async verifyMagicLink(e){let{ipAddress:t,userAgent:s}=ee(e),a=new URL(e.url).searchParams.get("token");if(!a)return this.errorResponse("Token required",400);try{let[n,c]=a.split(".");if(!n||!c)return this.errorResponse("Invalid token",400);let p=crypto.createHmac("sha256",this.jwtSecret).update(n).digest("hex");if(c!==p)return this.errorResponse("Invalid token",400);let o=JSON.parse(Buffer.from(n,"base64url").toString());if(Date.now()>o.exp)return this.errorResponse("Token expired",400);let u=await this.authAdapter.findUserByEmail(o.email);if(!u)return this.errorResponse("User not found",404);if(u.locked)return this.errorResponse("Account locked",403);let d=await chunkLXTVMP5F_cjs.k({id:u.id,email:u.email,role:u.role,tenantId:u.tenantId});this.auditLogger&&await this.auditLogger.log({action:"login",userId:u.id,userEmail:u.email,resource:"auth",ipAddress:t,userAgent:s,success:!0});let m=this.jsonResponse({success:!0,user:this.sanitizeUser(u)});return chunkLXTVMP5F_cjs.i(m,d)}catch{return this.errorResponse("Invalid token",400)}}async inviteUser(e){try{let t=await e.json();if(!t.email||!t.role)return this.errorResponse("Email and role required",400);let s=await this.authAdapter.findUserByEmail(t.email);if(s)return this.errorResponse("User already exists",409);if(s=await this.authAdapter.createUser({email:t.email,password:crypto.randomBytes(16).toString("hex"),role:t.role}),this.email){let r=await this.authAdapter.createPasswordResetToken(s.email),n=`${this.getBaseUrl(e)}/admin/auth/reset-password?token=${r.token}`,c=this.email.getTemplates().userInvite(n,t.role,t.inviterName||"An administrator");this.email.send({to:s.email,...c}).catch(p=>console.error("Invite email err:",p));}return this.jsonResponse({success:!0,message:"User invited successfully"})}catch{return this.errorResponse("Failed to invite user",500)}}};var I=class extends Error{constructor(t,s,r){super(s);this.statusCode=t;this.message=s;this.metadata=r;this.name="ApiError";}statusCode;message;metadata};function Tt(i,e){if(e instanceof I)return i.json({error:e.message},e.statusCode);let t=e instanceof Error?e.message:"Internal Server Error";return i.json({error:t},500)}({_media:{create:chunkOJBL4CXK_cjs.c.MEDIA_UPLOAD,update:chunkOJBL4CXK_cjs.c.MEDIA_UPLOAD,delete:chunkOJBL4CXK_cjs.c.MEDIA_DELETE}});var oe=new WeakMap;async function H(i,e,t,s,r,a,n=true,c="none"){let p=t&&typeof t=="object"?t:null,o=p?`col:${i.slug}:${e}:${s?.id||"anon"}:${r||""}:${a?.apiKeyId||""}`:null;if(p&&o){let d=oe.get(p);if(d&&d.has(o))return d.get(o)}let u=await chunkOJBL4CXK_cjs.a(i,e,{user:s,req:t,tenantId:r,apiKey:a},{enablePublicAccess:n,defaultAccess:c});if(p&&o){let d=oe.get(p);d||(d=new Map,oe.set(p,d)),d.set(o,u);}return u}async function ye(i,e,t,s,r,a=true){let n=t&&typeof t=="object"?t:null,c=n?`gbl:${i.slug}:${e}:${s?.id||"anon"}:${r||""}`:null;if(n&&c){let o=oe.get(n);if(o&&o.has(c))return o.get(c)}let p=await chunkOJBL4CXK_cjs.b(i,e,{user:s,req:t,tenantId:r},{enablePublicAccess:a});if(n&&c){let o=oe.get(n);o||(o=new Map,oe.set(n,o)),o.set(c,p);}return p}async function ie(i,e,t,s,r,a=true){let n=await ye(i,e,t,s,r,a);if(!n.allowed)throw new I(n.status||403,n.error||"Access denied");return n}async function $(i,e,t,s){if(t)return {user:t,tenantId:s,apiKeyContext:void 0,authType:"static"};if(e){let r=await e(i);if(r.status===200&&r.user)return {user:r.user,tenantId:r.tenantContext?.tenantId,apiKeyContext:r.apiKeyContext,authType:r.authType}}return {user:void 0,tenantId:void 0,apiKeyContext:void 0,authType:void 0}}var ae=class i{hooks=[];constructor(e=[]){this.hooks=[...e];}pipe(e){return this.hooks.push(e),this}async execute(e){let t=e.data;for(let s of this.hooks)try{let r=await s({...e,data:t});r!==void 0&&(t=r);}catch(r){throw new Error(`[Kyro CMS HookPipeline Error] Failed during ${e.operation} on collection "${e.collection||"global"}": ${r instanceof Error?r.message:String(r)}`)}return t}static async run(e,t){return !e||e.length===0?t.data:new i(e).execute(t)}};function ke(i,e,t){let{registry:s,db:r,authSecret:a,user:n,tenantId:c,settings:p}=e,o=p?.access?.enablePublicAccess??true,u=p?.access?.defaultCollectionAccess??"none";for(let d of s.getCollections()){let m=d.slug,y=`/api/${m}`;i.post(`${y}/dynamic-options/:fieldName`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("fieldName"),A=d.fields.find(_=>_.name===w);if(!A||A.type!=="relationship"||!A.relationTo)throw new I(400,"Invalid field for dynamic options");let b=Array.isArray(A.relationTo)?A.relationTo[0]:A.relationTo,E=await l.req.json(),U=await r.find({collection:b,where:E.where,limit:20,tenantId:h}),O=s.getCollection(b)?.admin?.useAsTitle||"id",R=(U.docs||[]).map(_=>({label:_[O]||_.id,value:_.id}));return l.json({data:R})}),i.all(`${y}/semantic-search`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=[],A="",b=10,E=.4;if(l.req.method==="POST"){let P=await l.req.json().catch(()=>({}));w=P.vector||[],A=P.q||P.query||"",b=P.limit?parseInt(String(P.limit)):10,E=P.threshold?parseFloat(String(P.threshold)):.4;}else {let P=new URL(l.req.url);A=P.searchParams.get("q")||P.searchParams.get("query")||"",b=parseInt(P.searchParams.get("limit")||"10"),E=parseFloat(P.searchParams.get("threshold")||"0.4");}let v=(await r.find({collection:m,limit:200,tenantId:h})).docs||[],R=d.fields.filter(P=>P.type==="embedding")[0]?.name||"embedding",_=v.map(P=>{let K=P[R],W=0;if(Array.isArray(K)&&Array.isArray(w)&&w.length>0){let f=0,k=0,L=0;for(let q=0;q<Math.min(K.length,w.length);q++)f+=K[q]*w[q],k+=K[q]*K[q],L+=w[q]*w[q];W=k&&L?f/(Math.sqrt(k)*Math.sqrt(L)):0;}else if(A){let f=String(P.title||P.name||"").toLowerCase(),k=String(P.content||P.description||"").toLowerCase(),L=A.toLowerCase();f.includes(L)?W=.9:k.includes(L)?W=.7:W=.1;}return {doc:P,score:W}}),D=await Promise.all(_.filter(P=>P.score>=E).sort((P,K)=>K.score-P.score).slice(0,b).map(async P=>({...await chunkYOJOVQIH_cjs.b(P.doc,d.fields,g,l.req.raw,"read"),_similarity:Math.round(P.score*1e3)/1e3})));return l.json({docs:D,totalDocs:D.length,query:A||void 0})}),i.get(y,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=new URL(l.req.url),w=S.searchParams.get("draft"),A=S.searchParams.get("kyroToken"),b=false,E=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";if(w==="true"&&A&&E)try{let q=await jwt.verify(A,E,"HS256");q&&q.type==="preview"&&q.collection===d.slug&&(b=!0);}catch(q){console.warn("Invalid preview token",q);}if(!b){let q=await H(d,"read",l.req.raw,g,h,T,o,u);if(!q.allowed)throw new I(q.status||403,q.error||"Access denied")}let U=parseInt(S.searchParams.get("limit")||"10"),v=parseInt(S.searchParams.get("page")||"1"),O=S.searchParams.get("sort")||void 0,R=parseInt(S.searchParams.get("depth")||"0"),_=S.searchParams.get("select")?.split(",")||void 0,D=S.searchParams.get("where"),P;if(D)try{P=JSON.parse(decodeURIComponent(D));}catch{throw new I(400,"Invalid JSON in where clause")}let K=S.searchParams.get("search")||S.searchParams.get("q");if(K&&K.trim()){let q=K.trim(),C=(d.fields||[]).filter(x=>x.name&&x.name!=="id"&&(x.type==="text"||x.type==="email"||x.type==="textarea"||x.type==="select"||x.type==="radio"||x.indexed)&&!x.admin?.hidden).map(x=>x.name);if(C.length>0){let x=C.map(M=>({[M]:{contains:q}}));P?P={AND:[P,{OR:x}]}:P={OR:x};}}let W=w==="true"?true:w==="false"?false:!!g,f=await r.find({collection:m,where:P,limit:U,page:v,sort:O,tenantId:h,select:_,draft:W}),k=await r.count({collection:m,where:P,tenantId:h});await chunkOJBL4CXK_cjs.o(f.docs||[],d.fields,r,s,1,R);let L=(f.docs||[]).map(chunkOXEJCIOA_cjs.a);return l.json({docs:L,totalDocs:k,limit:U,page:v,totalPages:Math.ceil(k/U),data:L,meta:{total:k,page:v,limit:U,totalPages:Math.ceil(k/U)}})}),i.get(`${y}/:id/versions`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id"),A=parseInt(l.req.query("page")||"1"),b=Math.min(parseInt(l.req.query("limit")||"30"),100),E=l.req.query("compareA"),U=l.req.query("compareB");if(E&&U&&typeof r.findVersionByID=="function")try{let R=await r.findVersionByID({collection:m,versionId:E,tenantId:h}),_=await r.findVersionByID({collection:m,versionId:U,tenantId:h});if(!R||!_)throw new I(404,"One or both comparison versions were not found");let D=typeof R.data=="string"?JSON.parse(R.data):R.data||{},P=typeof _.data=="string"?JSON.parse(_.data):_.data||{},K=[],W=new Set([...Object.keys(D),...Object.keys(P)]);for(let f of W)["id","createdAt","updatedAt","publishedAt"].includes(f)||JSON.stringify(D[f])!==JSON.stringify(P[f])&&K.push({field:f,oldValue:D[f]??null,newValue:P[f]??null});return l.json({diffs:K,versionA:R,versionB:_})}catch(R){if(R instanceof I)throw R;return console.warn(`[compareVersions] Error comparing versions for ${m}/${w}:`,R),l.json({diffs:[]})}let v=[],O=0;if(typeof r.findVersions=="function")try{let R=await r.findVersions({collection:m,documentId:w,page:A,limit:b,tenantId:h});v=R.docs||[],O=R.totalDocs||v.length;}catch(R){console.warn(`[findVersions] Error fetching versions for ${m}/${w}:`,R);}return l.json({docs:v,totalDocs:O,page:A,limit:b,totalPages:Math.ceil(O/b)||1,data:v,meta:{total:O,page:A,limit:b,totalPages:Math.ceil(O/b)||1}})}),i.post(`${y}/:id/versions`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"update",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id"),A=await l.req.json().catch(()=>({})),b=A.versionId;if(A.action==="restore"&&b&&typeof r.findVersionByID=="function"){let E=await r.findVersionByID({collection:m,versionId:b,tenantId:h});if(!E)throw new I(404,`Version '${b}' not found`);let U=typeof E.data=="string"?JSON.parse(E.data):E.data,{id:v,createdAt:O,updatedAt:R,..._}=U;d.versions&&typeof r.createVersion=="function"&&await r.createVersion({collection:m,documentId:w,data:_,status:_.status||"published",autosave:false,createdBy:g?.id,changeDescription:`Restored from version ${E.version||b}`,tenantId:h});let D=await r.update({collection:m,id:w,data:_,tenantId:h}),P=chunkOXEJCIOA_cjs.a(D);return l.json({doc:P,data:P,message:"Version restored successfully"})}throw new I(400,"Invalid action for version management")}),i.get(`${y}/:id/versions/:versionId`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("versionId"),A=null;if(typeof r.findVersionByID=="function"&&(A=await r.findVersionByID({collection:m,versionId:w,tenantId:h})),!A)throw new I(404,`Version '${w}' not found`);return l.json({doc:A,data:A})}),i.post(`${y}/:id/versions/:versionId/restore`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"update",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id"),A=l.req.param("versionId");if(typeof r.restoreVersion=="function")try{let b=await r.restoreVersion({collection:m,documentId:w,versionId:A,tenantId:h});return l.json({doc:b,data:b,message:"Version restored successfully"})}catch(b){console.warn("[restoreVersion] Adapter restore failed, falling back to manual restore:",b);}if(typeof r.findVersionByID=="function"){let b=await r.findVersionByID({collection:m,versionId:A,tenantId:h});if(!b)throw new I(404,`Version '${A}' not found`);let E=typeof b.data=="string"?JSON.parse(b.data):b.data,{id:U,createdAt:v,updatedAt:O,...R}=E;d.versions&&typeof r.createVersion=="function"&&await r.createVersion({collection:m,documentId:w,data:R,status:R.status||"published",autosave:false,createdBy:g?.id,changeDescription:`Restored from version ${b.version||A}`,tenantId:h});let _=await r.update({collection:m,id:w,data:R,tenantId:h}),D=chunkOXEJCIOA_cjs.a(_);return l.json({doc:D,data:D,message:"Version restored successfully"})}throw new I(501,"Version restoration not supported by database adapter")}),i.post(`${y}/preview-url`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let A=await l.req.json().catch(()=>({}))||{};if(A.id&&!A.slug)try{let v=await r.findByID({collection:d.slug,id:A.id,tenantId:h});v&&(A={...v,...A});}catch{}let b,E=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";try{b=await jwt.sign({type:"preview",collection:d.slug,id:A.id,exp:Math.floor(Date.now()/1e3)+3600},E,"HS256");}catch(v){console.warn("Failed to sign preview token:",v);}let U="";if(typeof d.admin?.preview=="function")try{U=await d.admin.preview(A,{req:l.req.raw,token:b});}catch(v){console.error(`[Kyro Preview] Error in custom preview function for ${d.slug}:`,v);}if(!U){let v=A.slug||A.id||"";if(U=v?`/${d.slug}/${v}`:`/${d.slug}`,b){let O=U.includes("?")?"&":"?";U+=`${O}draft=true&kyroToken=${b}`;}}return l.json({url:U})}),i.get(`${y}/:id`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=new URL(l.req.url),w=S.searchParams.get("draft"),A=S.searchParams.get("kyroToken"),b=false,E=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";if(w==="true"&&A&&E)try{let D=await jwt.verify(A,E,"HS256");D&&D.type==="preview"&&D.collection===d.slug&&(b=!0);}catch(D){console.warn("Invalid preview token",D);}if(!b){let D=await H(d,"read",l.req.raw,g,h,T,o,u);if(!D.allowed)throw new I(D.status||403,D.error||"Access denied")}let U=l.req.param("id"),v=parseInt(S.searchParams.get("depth")||"1"),O=w==="true"?true:w==="false"?false:!!g,R=await r.findByID({collection:m,id:U,tenantId:h,draft:O});if(!R)throw new I(404,`Document '${U}' not found in '${m}'`);await chunkOJBL4CXK_cjs.o([R],d.fields,r,s,1,v);let _=chunkOXEJCIOA_cjs.a(R);return l.json({doc:_,data:_})}),i.post(y,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"create",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=await l.req.json();d.hooks?.beforeChange&&d.hooks.beforeChange.length>0&&(w=await new ae(d.hooks.beforeChange).execute({data:w,collection:m,operation:"create",req:l.req.raw,user:g}));let A=await r.create({collection:m,data:w,tenantId:h});if(d.versions&&typeof r.createVersion=="function")try{await r.createVersion({collection:m,documentId:A?.id||w.id,data:A,status:w.status||"published",autosave:!1,createdBy:g?.id,changeDescription:w.changeDescription||"Initial version",tenantId:h});}catch(E){console.warn(`[createVersion] Failed creating initial version for ${m}:`,E);}d.hooks?.afterChange&&d.hooks.afterChange.length>0&&await new ae(d.hooks.afterChange).execute({data:A,collection:m,operation:"create",req:l.req.raw,user:g});let b=chunkOXEJCIOA_cjs.a(A);return l.json({doc:b,data:b,message:"Document created successfully"},201)}),i.patch(`${y}/:id`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"update",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id"),A=await l.req.json(),b=new URL(l.req.url),E=b.searchParams.get("autosave")==="true"||l.req.header("x-autosave")==="true"||A.autosave===true,U=b.searchParams.get("draft")==="true"||l.req.header("x-draft")==="true"||A.draft===true,v=d.versions?.drafts===true;if(d.hooks?.beforeChange&&d.hooks.beforeChange.length>0){let _=await r.findByID({collection:m,id:w,tenantId:h});A=await new ae(d.hooks.beforeChange).execute({data:A,originalDoc:_||void 0,collection:m,operation:"update",req:l.req.raw,user:g});}let O;if(v&&U)typeof r.createVersion=="function"&&await r.createVersion({collection:m,documentId:w,data:A,status:"draft",autosave:E,createdBy:g?.id,changeDescription:A.changeDescription||(E?"Auto-saved draft":"Draft snapshot"),tenantId:h}),O=await r.findByID({collection:m,id:w,tenantId:h,draft:true});else {let _=await r.findByID({collection:m,id:w,tenantId:h,draft:true});if(!_)throw new I(404,`Document '${w}' not found in '${m}'`);let D={..._,...A};if(d.versions&&typeof r.createVersion=="function")try{await r.createVersion({collection:m,documentId:w,data:D,status:A.status||_.status||"published",autosave:E,createdBy:g?.id,changeDescription:A.changeDescription||(E?"Auto-saved":"Updated snapshot"),tenantId:h});}catch(P){console.warn(`[createVersion] Failed creating version for ${m}/${w}:`,P);}if(O=await r.update({collection:m,id:w,data:A,tenantId:h}),!O)throw new I(404,`Document '${w}' not found in '${m}'`)}d.hooks?.afterChange&&d.hooks.afterChange.length>0&&await new ae(d.hooks.afterChange).execute({data:O,collection:m,operation:"update",req:l.req.raw,user:g});let R=chunkOXEJCIOA_cjs.a(O);return l.json({doc:R,data:R,message:"Document updated successfully"})}),i.delete(`${y}/:id`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"delete",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id");if(!await r.delete({collection:m,id:w,tenantId:h}))throw new I(404,`Document '${w}' not found in '${m}'`);return l.json({success:true,message:`Document '${w}' deleted successfully`})});}}function Pe(i,e,t){let{registry:s,db:r,authSecret:a,user:n,tenantId:c,settings:p}=e,o=p?.access?.enablePublicAccess??true;for(let u of s.getGlobals()){let d=u.slug,m=`/api/globals/${d}`;i.get(m,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c),T=new URL(l.req.url),S=T.searchParams.get("draft"),w=T.searchParams.get("kyroToken"),A=false,b=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";if(S==="true"&&w&&b)try{let R=await jwt.verify(w,b,"HS256");R&&R.type==="preview"&&R.collection===`_globals_${u.slug}`&&(A=!0);}catch(R){console.warn("Invalid preview token",R);}A||await ie(u,"read",l.req.raw,g,h,o);let E=parseInt(T.searchParams.get("depth")||"0"),U=`_globals_${d}`,v=await r.findOne({collection:U,where:{},depth:E,tenantId:h,draft:S==="true"?true:S==="false"?false:!!g});v||(v={id:d}),await chunkOJBL4CXK_cjs.o([v],u.fields,r,s,1,E);let O=chunkOXEJCIOA_cjs.a(v);return l.json({doc:O,data:O})}),i.post(`${m}/preview-url`,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ie(u,"read",l.req.raw,g,h,o);let S=await l.req.json().catch(()=>({}))||{},w,A=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";try{w=await jwt.sign({type:"preview",collection:`_globals_${u.slug}`,exp:Math.floor(Date.now()/1e3)+3600},A,"HS256");}catch(E){console.warn("Failed to sign global preview token:",E);}let b="";if(typeof u.admin?.preview=="function")try{b=await u.admin.preview(S,{req:l.req.raw,token:w});}catch(E){console.error(`[Kyro Preview] Error in custom preview function for global ${u.slug}:`,E);}if(!b&&(b=`/${u.slug}`,w)){let E=b.includes("?")?"&":"?";b+=`${E}draft=true&kyroToken=${w}`;}return l.json({url:b})}),i.get(`${m}/versions`,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ie(u,"read",l.req.raw,g,h,o);let T=`_globals_${d}`,S=parseInt(l.req.query("page")||"1"),w=Math.min(parseInt(l.req.query("limit")||"30"),100),A=l.req.query("compareA"),b=l.req.query("compareB");if(A&&b&&typeof r.findVersionByID=="function")try{let v=await r.findVersionByID({collection:T,versionId:A,tenantId:h}),O=await r.findVersionByID({collection:T,versionId:b,tenantId:h});if(!v||!O)return l.json({error:"One or both comparison versions were not found"},404);let R=typeof v.data=="string"?JSON.parse(v.data):v.data||{},_=typeof O.data=="string"?JSON.parse(O.data):O.data||{},D=[],P=new Set([...Object.keys(R),...Object.keys(_)]);for(let K of P)["id","createdAt","updatedAt","publishedAt"].includes(K)||JSON.stringify(R[K])!==JSON.stringify(_[K])&&D.push({field:K,oldValue:R[K]??null,newValue:_[K]??null});return l.json({diffs:D,versionA:v,versionB:O})}catch(v){return console.warn(`[compareVersions] Error comparing global versions for ${d}:`,v),l.json({diffs:[]})}let E=[],U=0;if(typeof r.findVersions=="function")try{let v=await r.findVersions({collection:T,documentId:d,page:S,limit:w,tenantId:h});E=v.docs||[],U=v.totalDocs||E.length;}catch(v){console.warn(`[findVersions] Error fetching global versions for ${d}:`,v);}return l.json({docs:E,totalDocs:U,page:S,limit:w,totalPages:Math.ceil(U/w)||1,data:E,meta:{total:U,page:S,limit:w,totalPages:Math.ceil(U/w)||1}})}),i.get(`${m}/versions/:versionId`,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ie(u,"read",l.req.raw,g,h,o);let T=`_globals_${d}`,S=l.req.param("versionId"),w=null;return typeof r.findVersionByID=="function"&&(w=await r.findVersionByID({collection:T,versionId:S,tenantId:h})),w?l.json({doc:w,data:w}):l.json({error:`Global version '${S}' not found`},404)}),i.post(`${m}/versions/:versionId/restore`,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ie(u,"update",l.req.raw,g,h,o);let T=`_globals_${d}`,S=l.req.param("versionId");if(typeof r.findVersionByID=="function"){let w=await r.findVersionByID({collection:T,versionId:S,tenantId:h});if(!w)return l.json({error:`Global version '${S}' not found`},404);let A=typeof w.data=="string"?JSON.parse(w.data):w.data,{id:b,createdAt:E,updatedAt:U,...v}=A,O=await r.findOne({collection:T,where:{},tenantId:h}),R;O?R=await r.update({collection:T,id:O.id,data:v,tenantId:h}):R=await r.create({collection:T,data:{id:d,...v},tenantId:h}),u.versions&&typeof r.createVersion=="function"&&await r.createVersion({collection:T,documentId:d,data:R||v,status:"published",autosave:false,createdBy:g?.id,changeDescription:`Restored from version ${w.version||S}`,tenantId:h});let _=chunkOXEJCIOA_cjs.a(R);return l.json({doc:_,data:_,message:"Global version restored successfully"})}return l.json({error:"Version restoration not supported by database adapter"},501)});let y=async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ie(u,"update",l.req.raw,g,h,o);let T=await l.req.json(),S=new URL(l.req.url),w=S.searchParams.get("autosave")==="true"||l.req.header("x-autosave")==="true"||T.autosave===true,A=S.searchParams.get("draft")==="true"||l.req.header("x-draft")==="true"||T.draft===true,b=`_globals_${d}`,E=await r.findOne({collection:b,where:{},tenantId:h}),U;if(E?U=await r.update({collection:b,id:E.id,data:T,tenantId:h}):U=await r.create({collection:b,data:{id:d,...T},tenantId:h}),u.versions&&typeof r.createVersion=="function")try{await r.createVersion({collection:b,documentId:d,data:U||T,status:A?"draft":"published",autosave:w,createdBy:g?.id,changeDescription:T.changeDescription||(w?"Auto-saved":"Updated snapshot"),tenantId:h});}catch(O){console.warn(`[createVersion] Failed creating version for global ${d}:`,O);}let v=chunkOXEJCIOA_cjs.a(U);return l.json({doc:v,data:v,message:"Global updated successfully"})};i.post(m,y),i.patch(m,y),i.put(m,y);}}function ne(i){let{uploadDir:e=Ae.join(ir__default.default.cwd(),"public","uploads"),baseUrl:t="/uploads"}=i;async function s(n){fs.existsSync(n)||await promises.mkdir(n,{recursive:true});}function r(n){let c=Ae.extname(n).toLowerCase();return {".jpg":"image/jpeg",".jpeg":"image/jpeg",".png":"image/png",".gif":"image/gif",".webp":"image/webp",".avif":"image/avif",".svg":"image/svg+xml",".mp4":"video/mp4",".webm":"video/webm",".mov":"video/quicktime",".avi":"video/x-msvideo",".mp3":"audio/mpeg",".wav":"audio/wav",".ogg":"audio/ogg",".pdf":"application/pdf",".doc":"application/msword",".docx":"application/vnd.openxmlformats-officedocument.wordprocessingml.document",".xls":"application/vnd.ms-excel",".xlsx":"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",".zip":"application/zip",".tar":"application/x-tar",".gz":"application/gzip",".rar":"application/vnd.rar",".7z":"application/x-7z-compressed"}[c]||"application/octet-stream"}async function a(n){try{let c=n.toString("hex",0,8);if(c.startsWith("89504e47")){let p=n.readUInt32BE(16),o=n.readUInt32BE(20);return {width:p,height:o}}if(c.startsWith("ffd8")){let p=2;for(;p<n.length&&n[p]===255;){let o=n[p+1];if(o===192||o===194){let u=n.readUInt16BE(p+5);return {width:n.readUInt16BE(p+7),height:u}}p+=2+n.readUInt16BE(p+2);}}}catch{}return {}}return te({name:"local",displayName:"Local Storage",supportsDynamicResize:true,async upload(n,c){await s(e);let p=Buffer.from(await n.arrayBuffer()),o=crypto.createHash("md5").update(p).digest("hex"),u=Ae.extname(n.name),d=c?.filename||`${o}${u}`,m=c?.folder||"",y=m?Ae.join(e,m):e;await s(y);let l=Ae.join(y,d);await promises.writeFile(l,p);let g=n.type.startsWith("image/")?await a(p):{},h=t||"/uploads",T=m?`/${m}/${d}`:`/${d}`,S=h+T;return {id:o,filename:d,originalName:n.name,mimeType:n.type||r(n.name),size:p.length,url:S,thumbnailUrl:n.type.startsWith("image/")?S:void 0,folder:m||void 0,provider:"local",metadata:{...g,...c?.metadata},createdAt:new Date().toISOString()}},async uploadFromUrl(n,c){let p=await fetch(n);if(!p.ok)throw new Error(`Failed to fetch file: ${p.statusText}`);let o=await p.blob(),u=p.headers.get("content-disposition"),d=c?.filename;if(!d&&u){let y=u.match(/filename[^;=\n]*=((['"]).*?\2|[^;\n]*)/);y&&(d=y[1].replace(/['"]/g,""));}d||(d=Ae.basename(new URL(n).pathname));let m=new File([o],d,{type:o.type||r(d)});return this.upload(m,c)},async delete(n){let c=Ae.join(e,n.replace(t+"/",""));try{await promises.unlink(c);}catch{}},async rename(n,c){let p=Ae.join(e,n.replace(t+"/","")),o=Ae.join(e,c);return await promises.rename(p,o),`${t}/${c}`},async list(n){let c=n?Ae.join(e,n):e;if(!fs.existsSync(c))return [];let p=[],o=await promises.readdir(c,{withFileTypes:true});for(let u of o)if(u.isFile()){let d=Ae.join(c,u.name),m=await promises.stat(d),y=`${t}${n?`/${n}`:""}/${u.name}`;p.push({id:crypto.createHash("md5").update(u.name).digest("hex"),filename:u.name,originalName:u.name,mimeType:r(u.name),size:m.size,url:y,provider:"local",createdAt:m.birthtime.toISOString()});}return p},async exists(n){let c=Ae.join(e,n.replace(t+"/",""));return fs.existsSync(c)},async createFolder(n){let c=Ae.join(e,n);await promises.mkdir(c,{recursive:true});},async deleteFolder(n){let c=Ae.join(e,n);if(fs.existsSync(c)){let{rm:p}=await import('fs/promises');await p(c,{recursive:true,force:true});}}})}function Le(i){let e=(t,s)=>{if(!i.signKey)return t;let r=crypto.createHmac("sha256",i.signKey).update(t+s.toString()).digest("hex");return s.set("s",r),t};return {name:"imgix",displayName:"Imgix",supportsDynamicResize:true,async upload(t,s){throw new Error("Imgix is a transformation service. Use another provider for uploads.")},async uploadFromUrl(t,s){let r=s?.filename||t.split("/").pop()||"file",a=await fetch(t);if(!a.ok)throw new Error(`Failed to fetch: ${a.statusText}`);let n=await a.blob();new File([n],r,{type:n.type});return {id:Buffer.from(t).toString("base64").slice(0,20),filename:r,originalName:r,mimeType:n.type,size:n.size,url:this.getImageUrl(t),thumbnailUrl:this.getImageUrl(t,{width:200,height:200,fit:"crop"}),provider:"imgix",createdAt:new Date().toISOString()}},async delete(t){},async rename(t,s){return `https://${i.domain}/${s}`},getImageUrl(t,s){let r=new URL(t),a=new URLSearchParams(r.search);i.defaultParameters&&Object.entries(i.defaultParameters).forEach(([c,p])=>{a.has(c)||a.set(c,p);}),s&&(s.width&&a.set("w",String(s.width)),s.height&&a.set("h",String(s.height)),s.quality&&a.set("q",String(s.quality)),s.format&&a.set("fm",s.format),s.fit&&a.set("fit",s.fit),s.blur&&a.set("blur",String(s.blur)),s.sharpen&&a.set("sharp",String(s.sharpen))),a.set("auto","compress,format");r.pathname+"?"+a.toString();return i.signKey&&(e(r.pathname+a.toString(),a)),`https://${i.domain}${r.pathname}${a.toString()?"?"+a.toString():""}`},async generateThumbnail(t){return this.getImageUrl(t.url,{width:200,height:200,fit:"crop"})},async list(){return []},async exists(t){try{return (await fetch(t,{method:"HEAD"})).ok}catch{return  false}},async createFolder(){},async deleteFolder(){}}}function be(i,e){return e.cdnUrl?`${e.cdnUrl.replace(/\/$/,"")}/${i}`:`https://${e.storageZone}.b-cdn.net/${i}`}function qe(i){return i.cdnUrl?i.cdnUrl.replace(/\/$/,"")+"/":`https://${i.storageZone}.b-cdn.net/`}function De(i){let e=`https://storage.bunnycdn.com/${i.storageZone}`,t=s=>`${i.prefix?`${i.prefix}/`:""}${s}`.replace(/\/+/g,"/");return te({name:"bunny",displayName:"Bunny.net Storage",supportsDynamicResize:true,async upload(s,r){let a=t(`${r?.folder?`${r.folder}/`:""}${r?.filename||s.name}`),n=Buffer.from(await s.arrayBuffer()),c=await fetch(`${e}/${a}`,{method:"PUT",headers:{AccessKey:i.apiKey,"Content-Type":s.type},body:n});if(!c.ok){let p=await c.text();throw new Error(`Bunny.net upload failed: ${c.status} ${p}`)}return {id:Buffer.from(a).toString("base64url"),filename:r?.filename||s.name,originalName:s.name,mimeType:s.type,size:n.length,url:be(a,i),thumbnailUrl:s.type.startsWith("image/")?be(a,i):void 0,folder:r?.folder,provider:"bunny",metadata:r?.metadata,createdAt:new Date().toISOString()}},async delete(s){let r=s.replace(qe(i),""),a=await fetch(`${e}/${r}`,{method:"DELETE",headers:{AccessKey:i.apiKey}});if(!a.ok&&a.status!==404){let n=await a.text();throw new Error(`Bunny.net delete failed: ${a.status} ${n}`)}},async rename(s,r){let a=s.replace(qe(i),""),n=i.prefix?`${i.prefix}/${r}`:r,c=await fetch(`${e}/${a}`,{method:"GET",headers:{AccessKey:i.apiKey}});if(!c.ok)throw new Error("Bunny.net rename failed: could not read old file");let p=await c.arrayBuffer();return await fetch(`${e}/${n}`,{method:"PUT",headers:{AccessKey:i.apiKey,"Content-Type":c.headers.get("Content-Type")||"application/octet-stream"},body:p}),await this.delete(s),be(n,i)},async list(s){let r=t(s||""),a=await fetch(`${e}/${r}`,{method:"GET",headers:{AccessKey:i.apiKey}});if(!a.ok){let c=await a.text();throw new Error(`Bunny.net list failed: ${a.status} ${c}`)}return (await a.json()).map(c=>({id:Buffer.from(c.ObjectName||"").toString("base64url"),filename:c.ObjectName?.split("/").pop()||"",originalName:c.ObjectName?.split("/").pop()||"",mimeType:"application/octet-stream",size:c.Length||0,url:be(c.ObjectName||"",i),provider:"bunny",createdAt:c.LastChanged||new Date().toISOString()}))},async exists(s){let r=s.replace(qe(i),"");return (await fetch(`${e}/${r}`,{method:"HEAD",headers:{AccessKey:i.apiKey}})).ok},async createFolder(s){let r=t(`${s}/`);await fetch(`${e}/${r}`,{method:"PUT",headers:{AccessKey:i.apiKey,"Content-Length":"0"},body:""});},async deleteFolder(s){let r=t(`${s}/`);await fetch(`${e}/${r}`,{method:"DELETE",headers:{AccessKey:i.apiKey}});}})}function Ce(){let i=()=>{let s=globalThis.STORAGE_BUCKET;if(!s)throw new Error("Cloudflare R2 native binding 'STORAGE_BUCKET' not found in global scope.");return s},e=s=>`/api/media/file/${s}`,t=s=>s.replace(/\/+/g,"/").replace(/^\/+/,"");return te({name:"cloudflare_r2",displayName:"Cloudflare R2 (Native)",supportsDynamicResize:true,async upload(s,r){let a=i(),n=t(`${r?.folder?`${r.folder}/`:""}${r?.filename||s.name}`),c=await s.arrayBuffer(),p=await a.put(n,c,{httpMetadata:{contentType:s.type},customMetadata:r?.metadata||{}});return {id:Buffer.from(n).toString("base64url"),filename:r?.filename||s.name,originalName:s.name,mimeType:s.type,size:p.size,url:e(n),thumbnailUrl:s.type.startsWith("image/")?e(n):void 0,folder:r?.folder,provider:"cloudflare_r2",metadata:{...r?.metadata,etag:p.etag},createdAt:new Date().toISOString()}},async delete(s){let r=i(),a=s.replace(/^\/api\/media\/file\//,"");await r.delete(a);},async rename(s,r){let a=i(),n=s.replace(/^\/api\/media\/file\//,""),c=t(r),p=await a.get(n);if(!p)throw new Error("File not found");return await a.put(c,p.body,{httpMetadata:p.httpMetadata,customMetadata:p.customMetadata}),await a.delete(n),e(c)},async list(s){let r=i(),a=t(s||"");return (await r.list({prefix:a})).objects.map(c=>({id:Buffer.from(c.key).toString("base64url"),filename:c.key.split("/").pop()||"",originalName:c.key.split("/").pop()||"",mimeType:c.httpMetadata?.contentType||"application/octet-stream",size:c.size,url:e(c.key),provider:"cloudflare_r2",createdAt:c.uploaded.toISOString()}))},async exists(s){try{let r=i(),a=s.replace(/^\/api\/media\/file\//,"");return await r.head(a)!==null}catch{return  false}}})}var _e=class{providers=new Map;providerToPlugin=new Map;disabledPlugins=new Set;constructor(){this.registerLocal(),this.registerImgix(),this.registerBunny(),this.registerCloudflareR2(),this.registerCloudflareS3();}registerLocal(){this.register({type:"local",displayName:"Local Server",configKey:"local",configFields:[{name:"uploadDir",type:"text",label:"Upload Directory",defaultValue:"./public/uploads"},{name:"baseUrl",type:"text",label:"Base URL",defaultValue:"/uploads"}],extractConfig:(e,t)=>e[t]||{},extractRawConfig:e=>{let t=e?.local||e,s=(t?.uploadDir||"").trim(),r;s?Ae__default.default.isAbsolute(s)?r=s:s.includes("/")||s.includes("\\")?r=Ae__default.default.resolve(process.cwd(),s):r=Ae__default.default.join(process.cwd(),"public",s):r=Ae__default.default.join(process.cwd(),"public","uploads");let a=(t?.baseUrl||"").trim(),n;return a?n=a.startsWith("/")?a:`/${a}`:n="/uploads",{uploadDir:r,baseUrl:n}},factory:e=>ne(e)});}registerImgix(){this.register({type:"imgix",displayName:"Imgix",configKey:"imgix",configFields:[{name:"domain",type:"text",label:"Domain",required:true},{name:"signKey",type:"password",label:"Sign Key"}],extractConfig:(e,t)=>e[t]||{},extractRawConfig:e=>e?.imgix||e,factory:e=>Le(e)});}registerBunny(){this.register({type:"bunny",displayName:"Bunny.net",configKey:"bunny",configFields:[{name:"storageZone",type:"text",label:"Storage Zone",required:true},{name:"apiKey",type:"password",label:"API Key",required:true},{name:"cdnUrl",type:"text",label:"CDN URL"},{name:"prefix",type:"text",label:"Path Prefix"}],extractConfig:(e,t)=>e[t]||{},extractRawConfig:e=>e?.bunny||e,factory:e=>De(e)});}registerCloudflareR2(){this.register({type:"cloudflare_r2",displayName:"Cloudflare R2 (Native)",configKey:"cloudflareR2",configFields:[],extractConfig:()=>({}),extractRawConfig:()=>({}),factory:()=>Ce()});}registerCloudflareS3(){this.register({type:"cloudflare_s3",displayName:"Cloudflare R2 (S3 Compat)",configKey:"cloudflareR2",configFields:[],extractConfig:()=>(console.warn('[StorageRegistry] "cloudflare_s3" is deprecated; use "cloudflare_r2" instead.'),{}),extractRawConfig:()=>({}),factory:()=>Ce()});}register(e){if(this.providers.has(e.type)){console.warn(`[StorageRegistry] Provider "${e.type}" already registered, skipping`);return}e.pluginName&&this.providerToPlugin.set(e.type,e.pluginName),this.providers.set(e.type,e);}unregister(e){this.providers.delete(e),this.providerToPlugin.delete(e);}get(e){return this.providers.get(e)}getAll(){return Array.from(this.providers.values())}getAllAvailable(e){let t=this.getAll();return e?t.filter(s=>s.pluginName?e(s.pluginName):true):t}has(e){return this.providers.has(e)}async resolve(e,t){let s=this.providers.get(e);if(!s)throw new Error(`Unknown storage provider type: "${e}". Is the plugin that provides it enabled?`);if(s.pluginName&&this.disabledPlugins.has(s.pluginName))throw new Error(`Storage provider "${e}" is not available (plugin "${s.pluginName}" is disabled)`);let r=s.configKey||e,a=s.extractConfig(t,r);return s.factory(a)}async resolveWithConfig(e,t){let s=this.providers.get(e);if(!s)throw new Error(`Unknown storage provider type: "${e}". Is the plugin that provides it enabled?`);if(s.pluginName&&this.disabledPlugins.has(s.pluginName))throw new Error(`Storage provider "${e}" is not available (plugin "${s.pluginName}" is disabled)`);let r=s.extractRawConfig(t);return s.factory(r)}getProviderPluginName(e){return this.providerToPlugin.get(e)}getAllPluginNames(){return Array.from(new Set(this.providerToPlugin.values()))}setPluginEnabled(e,t){t?this.disabledPlugins.delete(e):this.disabledPlugins.add(e);}isPluginEnabled(e){return !this.disabledPlugins.has(e)}},$e=null;function Oe(){return $e||($e=new _e),$e}function kt(i){if(!i)return "";if(i.startsWith("pub-"))return i;let e=i.match(/pub-[a-zA-Z0-9]+/i);return e?e[0]:""}function dr(i,e){let t=i.startsWith("/")?i.slice(1):i;if(e.cdnUrl)return `${e.cdnUrl.replace(/\/$/,"")}/${t}`;switch(e.provider){case "r2":{let s=kt(e.publicDevUrl);return s?`https://${s}.r2.dev/${t}`:`https://${e.bucket}.${e.accountId}.r2.cloudflarestorage.com/${t}`}case "gcs":return `https://storage.googleapis.com/${e.bucket}/${t}`;case "digitalocean":return `https://${e.bucket}.${e.region}.cdn.digitaloceanspaces.com/${t}`;case "backblaze":return `https://${e.bucket}.s3.backblazeb2.com/${t}`;case "wasabi":return `https://${e.bucket}.s3.wasabisys.com/${t}`;default:return `https://${e.bucket}.s3.${e.region}.amazonaws.com/${t}`}}function Fe(i){if(i.cdnUrl)return i.cdnUrl.replace(/\/$/,"")+"/";switch(i.provider){case "r2":{let e=kt(i.publicDevUrl);return e?`https://${e}.r2.dev/`:`https://${i.bucket}.${i.accountId}.r2.cloudflarestorage.com/`}case "gcs":return `https://storage.googleapis.com/${i.bucket}/`;case "digitalocean":return `https://${i.bucket}.${i.region}.cdn.digitaloceanspaces.com/`;case "backblaze":return `https://${i.bucket}.s3.backblazeb2.com/`;case "wasabi":return `https://${i.bucket}.s3.wasabisys.com/`;default:return `https://${i.bucket}.s3.${i.region}.amazonaws.com/`}}function ur(i){switch(i){case "r2":return "Cloudflare R2";case "gcs":return "Google Cloud Storage";case "digitalocean":return "DigitalOcean Spaces";case "backblaze":return "Backblaze B2";case "wasabi":return "Wasabi";default:return "AWS S3"}}function pr(i){let e=new clientS3.S3Client({region:i.region||"auto",endpoint:i.endpoint,credentials:{accessKeyId:i.accessKeyId,secretAccessKey:i.secretAccessKey},forcePathStyle:true,tls:true,...i.provider==="r2"&&{requestHandler:new nodeHttpHandler.NodeHttpHandler}}),t=r=>`${i.prefix?`${i.prefix}/`:""}${r}`.replace(/\/+/g,"/"),s=r=>dr(r,i);return te({name:i.provider,displayName:ur(i.provider),supportsDynamicResize:true,async upload(r,a){let n=t(`${a?.folder?`${a.folder}/`:""}${a?.filename||r.name}`),c=Buffer.from(await r.arrayBuffer());await e.send(new clientS3.PutObjectCommand({Bucket:i.bucket,Key:n,Body:c,ContentType:r.type,Metadata:a?.metadata}));let p=await e.send(new clientS3.HeadObjectCommand({Bucket:i.bucket,Key:n}));return {id:Buffer.from(n).toString("base64url"),filename:a?.filename||r.name,originalName:r.name,mimeType:r.type,size:c.length,url:s(n),thumbnailUrl:r.type.startsWith("image/")?s(n):void 0,folder:a?.folder,provider:i.provider,metadata:{...a?.metadata,etag:p.ETag},createdAt:new Date().toISOString()}},async delete(r){let a=r.replace(Fe(i),"");await e.send(new clientS3.DeleteObjectCommand({Bucket:i.bucket,Key:a}));},async rename(r,a){let n=r.replace(Fe(i),""),c=i.prefix?`${i.prefix}/${a}`:a;return await e.send(new clientS3.CopyObjectCommand({Bucket:i.bucket,CopySource:`${i.bucket}/${n}`,Key:c})),await e.send(new clientS3.DeleteObjectCommand({Bucket:i.bucket,Key:n})),s(c)},async list(r){let a=t(r||"");return ((await e.send(new clientS3.ListObjectsV2Command({Bucket:i.bucket,Prefix:a}))).Contents||[]).map(c=>({id:Buffer.from(c.Key||"").toString("base64url"),filename:c.Key?.split("/").pop()||"",originalName:c.Key?.split("/").pop()||"",mimeType:"application/octet-stream",size:c.Size||0,url:s(c.Key||""),provider:i.provider,createdAt:c.LastModified?.toISOString()||new Date().toISOString()}))},async exists(r){try{let a=r.replace(Fe(i),"");return await e.send(new clientS3.HeadObjectCommand({Bucket:i.bucket,Key:a})),!0}catch{return  false}},async createFolder(r){let a=t(`${r}/`);await e.send(new clientS3.PutObjectCommand({Bucket:i.bucket,Key:a,Body:""}));},async deleteFolder(r){let a=t(`${r}/`),n;do{let c=await e.send(new clientS3.ListObjectsV2Command({Bucket:i.bucket,Prefix:a,ContinuationToken:n}));if(c.Contents?.length){let p=c.Contents.map(o=>({Key:o.Key}));await e.send(new clientS3.DeleteObjectsCommand({Bucket:i.bucket,Delete:{Objects:p}}));}n=c.IsTruncated?c.NextContinuationToken:void 0;}while(n);await e.send(new clientS3.DeleteObjectCommand({Bucket:i.bucket,Key:a}));}})}function mr(i){let e=()=>`https://api.cloudinary.com/v1_1/${i.cloudName}/upload`,t=async s=>{let r=await import('crypto'),a=Object.keys(s).sort().map(n=>`${n}=${s[n]}`).join("&");return r.createHash("sha256").update(a+i.apiSecret).digest("hex")};return {name:"cloudinary",displayName:"Cloudinary",supportsDynamicResize:true,async upload(s,r){let a=new FormData;if(a.append("file",s),i.uploadPreset)a.append("upload_preset",i.uploadPreset);else {let p=Math.round(Date.now()/1e3),o={timestamp:String(p)};(r?.folder||i.folder)&&(o.folder=r?.folder||i.folder||"");let u=await t(o);a.append("timestamp",String(p)),a.append("signature",u),a.append("api_key",i.apiKey);}(r?.folder||i.folder)&&a.append("folder",r?.folder||i.folder||"");let n=await fetch(e(),{method:"POST",body:a});if(!n.ok){let p=await n.json();throw new Error(`Cloudinary upload failed: ${p.error?.message||n.statusText}`)}let c=await n.json();return {id:c.public_id,filename:`${c.public_id}.${c.format}`,originalName:c.original_filename||s.name,mimeType:s.type||`image/${c.format}`,size:c.bytes,url:c.secure_url,thumbnailUrl:this.getImageUrl(c.secure_url,{width:200,height:200,fit:"crop"}),width:c.width,height:c.height,folder:r?.folder||i.folder,provider:"cloudinary",createdAt:new Date().toISOString()}},async uploadFromUrl(s,r){let a=new FormData;a.append("file",s),a.append("upload_preset","ml_default"),(r?.folder||i.folder)&&a.append("folder",r?.folder||i.folder||"");let n=await fetch(e(),{method:"POST",body:a});if(!n.ok)throw new Error("Cloudinary upload failed");let c=await n.json();return {id:c.public_id,filename:`${c.public_id}.${c.format}`,originalName:c.original_filename||s.split("/").pop()||"file",mimeType:`image/${c.format}`,size:c.bytes,url:c.secure_url,thumbnailUrl:this.getImageUrl(c.secure_url,{width:200,height:200,fit:"crop"}),width:c.width,height:c.height,provider:"cloudinary",createdAt:new Date().toISOString()}},async delete(s){try{let r=s.split("/image/upload/");if(r.length!==2){console.warn("[Cloudinary delete] Could not parse URL:",s);return}let a=r[1].replace(/^v\d+\//,"").replace(/\.[^.]+$/,""),n=Math.round(Date.now()/1e3),c={timestamp:String(n),public_id:a},p=Object.keys(c).sort().map(l=>`${l}=${c[l]}`).join("&"),u=(await import('crypto')).createHash("sha256").update(p+i.apiSecret).digest("hex"),d=`https://api.cloudinary.com/v1_1/${i.cloudName}/image/destroy`,m=new FormData;m.append("public_id",a),m.append("timestamp",String(n)),m.append("signature",u),m.append("api_key",i.apiKey);let y=await fetch(d,{method:"POST",body:m});if(!y.ok){let l=await y.json();console.warn("[Cloudinary delete] Failed:",l);}}catch(r){console.warn("[Cloudinary delete] Error:",r.message);}},async rename(s,r){let a="",n=r.replace(/\.[^.]+$/,""),c="";try{let p=s.split("/image/upload/");if(p.length!==2)return console.warn("[Cloudinary rename] Could not parse old URL:",s),s;let o=p[1],u=o.match(/^(v\d+)\//);a=u?u[1]:"";let d=o.replace(/^v\d+\//,"").replace(/\.[^.]+$/,""),m=d.split("/");c=m.length>1?m.slice(0,-1).join("/"):"";let y=r.replace(/\.[^.]+$/,"");n=c?`${c}/${y}`:y;let l=Math.round(Date.now()/1e3),g={from_public_id:d,to_public_id:n,timestamp:String(l)},h=Object.keys(g).sort().map(b=>`${b}=${g[b]}`).join("&"),S=(await import('crypto')).createHash("sha256").update(h+i.apiSecret).digest("hex"),w=new FormData;w.append("from_public_id",d),w.append("to_public_id",n),w.append("timestamp",String(l)),w.append("signature",S),w.append("api_key",i.apiKey);let A=await fetch(`https://api.cloudinary.com/v1_1/${i.cloudName}/image/rename`,{method:"POST",body:w});if(A.ok)return (await A.json()).secure_url;{let b=await A.json();console.warn("[Cloudinary rename] Failed:",b);let E=a?`/${a}/`:"/";return `https://res.cloudinary.com/${i.cloudName}/image/upload${E}${n}.${r.split(".").pop()}`}}catch(p){console.warn("[Cloudinary rename] Error:",p.message);let o=a?`/${a}/`:"/";return `https://res.cloudinary.com/${i.cloudName}/image/upload${o}${n}.${r.split(".").pop()}`}},getImageUrl(s,r){if(!r)return s;let a=s.split("/upload/");if(a.length!==2)return s;let n=[];if(r.width&&n.push(`w_${r.width}`),r.height&&n.push(`h_${r.height}`),r.fit){let p={crop:"c_fill",clip:"c_fit",scale:"c_scale",fill:"c_fill"};n.push(p[r.fit]||"c_limit");}r.quality&&n.push(`q_${r.quality}`),r.format&&n.push(`f_${r.format}`);let c=n.join(",");return `${a[0]}/upload/${c}/${a[1]}`},async generateThumbnail(s){return this.getImageUrl(s.url,{width:200,height:200,fit:"crop"})},async list(){return []},async exists(s){return (await fetch(s,{method:"HEAD"})).ok},async createFolder(){},async deleteFolder(){}}}async function Pt(i){let e=i.getStorageConfig(),t=Oe();try{return await t.resolve(e.type,e)}catch(s){return console.warn(`[resolveProvider] ${s.message} \u2014 falling back to local storage`),ne({uploadDir:Ae__default.default.join(process.cwd(),"public","uploads"),baseUrl:"/uploads"})}}function te(i){return {async uploadFromUrl(e,t){let s=await fetch(e);if(!s.ok)throw new Error(`Failed to fetch: ${s.statusText}`);let r=await s.blob(),a=e.split("/").pop()||"file",n=new File([r],a,{type:r.type});return this.upload(n,t)},getImageUrl(e,t){if(!t||Object.keys(t).length===0)return e;let s=new URLSearchParams({url:e});return t.width&&s.set("w",String(t.width)),t.height&&s.set("h",String(t.height)),t.quality&&s.set("q",String(t.quality)),t.format&&s.set("f",t.format),t.cropWidth&&t.cropHeight&&(s.set("cx",String(t.cropX??0)),s.set("cy",String(t.cropY??0)),s.set("cw",String(t.cropWidth)),s.set("ch",String(t.cropHeight))),`/api/media/resize?${s.toString()}`},async generateThumbnail(e){return this.getImageUrl(e.url,{width:400,height:400})},...i}}async function Lt(i){if(!i)return console.warn("[resolveProviderWithConfig] No config, using local"),ne({uploadDir:Ae__default.default.join(process.cwd(),"public","uploads"),baseUrl:"/uploads"});let e=i.type||"local",t=Oe();try{return await t.resolveWithConfig(e,i)}catch(s){return console.warn(`[resolveProviderWithConfig] ${s.message} \u2014 falling back to local storage`),ne({uploadDir:Ae__default.default.join(process.cwd(),"public","uploads"),baseUrl:"/uploads"})}}function qt(){return typeof globalThis>"u"?false:typeof globalThis.EdgeRuntime=="string"||typeof globalThis.WebSocketPair<"u"||typeof globalThis.Deno<"u"||typeof process<"u"&&process.env?.NEXT_RUNTIME==="edge"}async function Dt(i,e){let t=e?.format||"webp",s=(t==="avif"?80:85);if(!qt())try{let{default:r}=await import('sharp'),a=await r(i).metadata(),n=r(i),c=r(i).resize({width:500,withoutEnlargement:!0});return t==="avif"?(n=n.avif({quality:s}),c=c.avif({quality:Math.min(s,75)})):t==="png"?(n=n.png({compressionLevel:8}),c=c.png({compressionLevel:8})):t==="jpeg"||t==="jpg"?(n=n.jpeg({quality:s}),c=c.jpeg({quality:Math.min(s,80)})):(n=n.webp({quality:s}),c=c.webp({quality:Math.min(s,80)})),{buffer:await n.toBuffer(),thumbnailBuffer:await c.toBuffer(),width:a.width,height:a.height,format:t}}catch{}return {buffer:i,thumbnailBuffer:i,format:"passthrough"}}var Ct=`
+  CREATE TABLE IF NOT EXISTS media (
+    id TEXT PRIMARY KEY,
+    filename TEXT NOT NULL UNIQUE,
+    title TEXT,
+    original_name TEXT NOT NULL,
+    mime_type TEXT NOT NULL,
+    file_size INTEGER NOT NULL,
+    width INTEGER,
+    height INTEGER,
+    url TEXT NOT NULL UNIQUE,
+    thumbnail_url TEXT,
+    folder TEXT,
+    provider TEXT NOT NULL,
+    alt TEXT,
+    caption TEXT,
+    metadata TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS idx_media_folder ON media(folder);
+  CREATE INDEX IF NOT EXISTS idx_media_provider ON media(provider);
+  CREATE INDEX IF NOT EXISTS idx_media_filename ON media(filename);
+
+  CREATE TABLE IF NOT EXISTS media_folders (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    path TEXT NOT NULL,
+    parent_path TEXT,
+    created_at TEXT
+  );
+  CREATE INDEX IF NOT EXISTS idx_media_folders_path ON media_folders(path);
+`;function ce(i){if(typeof i!="string")return i;let e=i.replace(/-/g,"").toLowerCase();return e.length===32?`${e.slice(0,8)}-${e.slice(8,12)}-${e.slice(12,16)}-${e.slice(16,20)}-${e.slice(20)}`:i}var Be=false,Te=class i{db;storage;dialect;genId;mediaTable="media";foldersTable="media_folders";constructor(e,t,s){this.db=e,this.storage=t,this.dialect=s?.dialect||"sqlite",this.genId=s?.genId||chunkEG4SRTYS_cjs.a;}static async init(e,t){let s;if(t?.storageConfig)s=await Lt(t.storageConfig);else {let a=new chunk2I2AXTKY_cjs.p(e);await a.load(),s=await Pt(a);}let r=new i(e,s,t);return await r.ensureTables(),r}async ensureTables(){if(this.dialect==="mongodb"){let e=this.db.db;await e.collection(this.mediaTable).createIndex({filename:1},{unique:true}),await e.collection(this.foldersTable).createIndex({path:1},{unique:true}),Be=true;return}if(this.dialect==="sqlite"){this.db.exec(Ct);try{let e=this.db.prepare("PRAGMA table_info(media)").all(),t=new Set(e.map(r=>r.name)),s=(r,a)=>{t.has(r)||this.db.exec(`ALTER TABLE media ADD COLUMN ${r} ${a}`);};s("created_at","TEXT"),s("updated_at","TEXT"),s("original_name","TEXT"),s("mime_type","TEXT"),s("file_size","INTEGER"),s("thumbnail_url","TEXT"),t.has("createdAt")&&this.db.exec("UPDATE media SET created_at = createdAt WHERE created_at IS NULL AND createdAt IS NOT NULL"),t.has("updatedAt")&&this.db.exec("UPDATE media SET updated_at = updatedAt WHERE updated_at IS NULL AND updatedAt IS NOT NULL"),t.has("originalName")&&this.db.exec("UPDATE media SET original_name = originalName WHERE original_name IS NULL AND originalName IS NOT NULL"),t.has("mimeType")&&this.db.exec("UPDATE media SET mime_type = mimeType WHERE mime_type IS NULL AND mimeType IS NOT NULL"),t.has("fileSize")&&this.db.exec("UPDATE media SET file_size = fileSize WHERE file_size IS NULL AND fileSize IS NOT NULL"),t.has("thumbnailUrl")&&this.db.exec("UPDATE media SET thumbnail_url = thumbnailUrl WHERE thumbnail_url IS NULL AND thumbnailUrl IS NOT NULL");}catch{}}else if(this.dialect==="postgres"){if(Be)return;let{sql:e}=await import('drizzle-orm');await this.db.execute(e`
+        CREATE TABLE IF NOT EXISTS "media" (
+          "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+          "filename" VARCHAR(255) NOT NULL UNIQUE,
+          "title" VARCHAR(255),
+          "original_name" VARCHAR(255) NOT NULL,
+          "mime_type" VARCHAR(100),
+          "file_size" INTEGER,
+          "width" INTEGER,
+          "height" INTEGER,
+          "url" TEXT NOT NULL UNIQUE,
+          "thumbnail_url" TEXT,
+          "folder" VARCHAR(255),
+          "provider" VARCHAR(50) NOT NULL,
+          "alt" TEXT,
+          "caption" TEXT,
+          "metadata" JSONB,
+          "created_at" TIMESTAMP NOT NULL DEFAULT NOW(),
+          "updated_at" TIMESTAMP NOT NULL DEFAULT NOW()
+        )
+      `),await this.db.execute(e`CREATE INDEX IF NOT EXISTS "idx_media_folder" ON "media" ("folder")`),await this.db.execute(e`CREATE INDEX IF NOT EXISTS "idx_media_provider" ON "media" ("provider")`),await this.db.execute(e`CREATE INDEX IF NOT EXISTS "idx_media_filename" ON "media" ("filename")`),await this.db.execute(e`
+        CREATE TABLE IF NOT EXISTS "media_folders" (
+          "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+          "name" VARCHAR(255) NOT NULL,
+          "path" TEXT NOT NULL,
+          "parent_path" TEXT,
+          "created_at" TIMESTAMP NOT NULL DEFAULT NOW()
+        )
+      `),await this.db.execute(e`CREATE INDEX IF NOT EXISTS "idx_media_folders_path" ON "media_folders" ("path")`),Be=true;}}now(){return new Date().toISOString()}buildFindConditions(e){let t=[],s=[],r=e.sortBy==="name"?"title":e.sortBy==="createdAt"?"created_at":e.sortBy==="updatedAt"?"updated_at":e.sortBy||"created_at",a=e.sortDir==="asc"?"ASC":"DESC";if(e.search){t.push("(title LIKE ? OR filename LIKE ? OR original_name LIKE ? OR alt LIKE ?)");let c=`%${e.search}%`;s.push(c,c,c,c);}return e.type&&e.type!=="all"&&(t.push("mime_type LIKE ?"),s.push(`${e.type}/%`)),e.folder&&(t.push("(folder = ? OR folder LIKE ?)"),s.push(e.folder,`${e.folder}/%`)),{where:t.length>0?`WHERE ${t.join(" AND ")}`:"",params:s,orderBy:a,sortCol:r}}rowToMedia(e,t){return {id:e.id,filename:e.filename,title:e.title??null,originalName:e.original_name??e.originalName,mimeType:e.mime_type??e.mimeType,fileSize:e.file_size??e.fileSize,width:e.width??null,height:e.height??null,url:i.resolveMediaUrl(e.url,t),thumbnailUrl:i.resolveMediaUrl(e.thumbnail_url??e.thumbnailUrl??null,t),folder:e.folder??null,provider:e.provider,alt:e.alt??null,caption:e.caption??null,metadata:typeof e.metadata=="string"?JSON.parse(e.metadata):e.metadata??null,createdAt:e.created_at??e.createdAt,updatedAt:e.updated_at??e.updatedAt}}static resolveMediaUrl(e,t){return e?e.startsWith("http://")||e.startsWith("https://")||e.startsWith("blob:")||e.startsWith("data:")?e:`${(process.env.KYRO_BASE_URL||t||"http://localhost:4321").replace(/\/+$/,"")}${e.startsWith("/")?"":"/"}${e}`:null}async sqliteRun(e,t=[]){let s=this.db.prepare(e),r=e.trim().toLowerCase();return r.startsWith("insert")||r.startsWith("update")||r.startsWith("delete")?s.run(...t):s.all(...t)}sqliteGet(e,t=[]){return this.db.prepare(e).get(...t)}async upload(e,t="",s){let r=e.type.startsWith("image/"),a,n=e,c=e.name,p=null,o=null;if(r&&!e.type.includes("svg")){let l=Buffer.from(await e.arrayBuffer());a=await Dt(l),c=`${e.name.replace(/\.[^/.]+$/,"").toLowerCase().replace(/[^a-z0-9]/g,"-").replace(/-+/g,"-").substring(0,50)}.webp`,p=a.width??null,o=a.height??null,n=new File([a.buffer],c,{type:"image/webp"});}let u=await this.storage.upload(n,{folder:t,filename:c}),d=await this.storage.generateThumbnail({...u,id:"",provider:this.storage.name,createdAt:this.now()},{width:400,height:400}),m=this.genId(),y=this.now();if(this.dialect==="mongodb"){let l=u.mimeType,g=l.startsWith("image/")?"image":l.startsWith("video/")?"video":l.startsWith("audio/")?"audio":l.startsWith("application/pdf")?"document":["application/zip","application/x-zip","application/x-tar","application/gzip","application/x-7z"].includes(l)?"archive":"other";return await this.db.db.collection(this.mediaTable).insertOne({_id:m,id:m,filename:u.filename,title:e.name.replace(/\.[^/.]+$/,""),originalName:e.name,mimeType:l,fileSize:u.size,width:p,height:o,url:u.url,thumbnailUrl:d,folder:t||"",provider:this.storage.name,type:g,status:"active",alt:null,caption:null,createdAt:new Date,updatedAt:new Date}),this.rowToMedia({id:m,filename:u.filename,title:e.name.replace(/\.[^/.]+$/,""),originalName:e.name,mimeType:l,fileSize:u.size,width:p,height:o,url:u.url,thumbnailUrl:d,folder:t||"",provider:this.storage.name,type:g,status:"active",alt:null,caption:null,createdAt:new Date,updatedAt:new Date},s)}if(this.dialect==="sqlite")await this.sqliteRun(`INSERT INTO ${this.mediaTable}
+          (id, filename, title, original_name, mime_type, file_size, width, height, url, thumbnail_url, folder, provider, alt, caption, metadata, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[m,u.filename,e.name.replace(/\.[^/.]+$/,""),e.name,u.mimeType,u.size,p,o,u.url,d,t||null,this.storage.name,null,null,null,y,y]);else {let{media:l}=await import('./media-M3EIZ4QS.cjs'),g=u.mimeType,h=g.startsWith("image/")?"image":g.startsWith("video/")?"video":g.startsWith("audio/")?"audio":g.startsWith("application/pdf")?"document":["application/zip","application/x-zip","application/x-tar","application/gzip","application/x-7z"].includes(g)?"archive":"other",T=await this.db.insert(l).values({id:m,filename:u.filename,title:e.name.replace(/\.[^/.]+$/,""),originalName:e.name,mimeType:g,fileSize:u.size,width:p,height:o,url:u.url,thumbnailUrl:d,folder:t||"",provider:this.storage.name,type:h,status:"active",alt:null,caption:null,createdAt:new Date,updatedAt:new Date}).returning();T&&T[0]&&(m=T[0].id);}return {id:m,filename:u.filename,title:e.name.replace(/\.[^/.]+$/,""),originalName:e.name,mimeType:u.mimeType,fileSize:u.size,width:p,height:o,url:u.url,thumbnailUrl:d,folder:t||null,provider:this.storage.name,alt:null,caption:null,metadata:null,createdAt:y,updatedAt:y}}async uploadFromUrl(e,t="",s){let r=await fetch(e);if(!r.ok)throw new Error(`Failed to fetch URL: ${r.status}`);let a=await r.blob(),n=e.split("/").pop()||"url-image",c=r.headers.get("content-type")||a.type||"application/octet-stream",p=new File([a],n,{type:c});return this.upload(p,t,s)}async delete(e,t){this.dialect==="postgres"&&(e=ce(e));let s=await this.findById(e,t);if(s){if(await this.deleteFile(s.url),s.thumbnailUrl&&s.thumbnailUrl!==s.url&&s.thumbnailUrl!==s.url+"?thumb")try{await this.deleteFile(s.thumbnailUrl);}catch{}if(this.dialect==="mongodb"){await this.db.db.collection(this.mediaTable).deleteOne({id:e});return}if(this.dialect==="sqlite")await this.sqliteRun(`DELETE FROM ${this.mediaTable} WHERE id = ?`,[e]);else {let{media:r}=await import('./media-M3EIZ4QS.cjs'),{eq:a}=await import('drizzle-orm');await this.db.delete(r).where(a(r.id,e));}}}async deleteFile(e){await this.storage.delete(e);}async rename(e,t,s){this.dialect==="postgres"&&(e=ce(e));let r=await this.findById(e,s);if(!r)return null;let a=await this.storage.rename(r.url,t),n;if(r.thumbnailUrl||this.storage.name==="cloudinary"){let u=a.match(/\/upload\/(v\d+)\//),d=u?u[1]+"/":"",m=a.match(/(.+?)\/upload\//);n=`${m?m[1]:"https://res.cloudinary.com/"+this.storage.config?.cloudName||"unknown"}/upload/w_200,h_200,c_fill/${d}${t}`;}let c=r.filename.split(".").pop(),p=t.includes(".")?t:`${t}.${c}`,o={url:a,filename:p,thumbnailUrl:n};if(this.dialect==="mongodb")return await this.db.db.collection(this.mediaTable).updateOne({id:e},{$set:{url:a,thumbnailUrl:n||null,updatedAt:new Date}}),this.findById(e,s);if(this.dialect==="sqlite"){let u={...o};"thumbnailUrl"in u&&(u.thumbnail_url=u.thumbnailUrl,delete u.thumbnailUrl);let d=Object.keys(u).map(y=>`${y} = ?`).join(", "),m=Object.values(u);await this.sqliteRun(`UPDATE ${this.mediaTable} SET ${d}, updated_at = ? WHERE id = ?`,[...m,this.now(),e]);}else {let{media:u}=await import('./media-M3EIZ4QS.cjs'),{eq:d}=await import('drizzle-orm');await this.db.update(u).set({...o,updatedAt:this.now()}).where(d(u.id,e));}return {...r,...o,updatedAt:this.now(),thumbnailUrl:o.thumbnailUrl??null}}async findById(e,t){if(this.dialect==="postgres"&&(e=ce(e)),this.dialect==="mongodb"){let n=await this.db.db.collection(this.mediaTable).findOne({id:e});return n?this.rowToMedia(n,t):null}if(this.dialect==="sqlite"){let n=this.sqliteGet(`SELECT * FROM ${this.mediaTable} WHERE id = ?`,[e]);return n?this.rowToMedia(n,t):null}let{media:s}=await import('./media-M3EIZ4QS.cjs'),{eq:r}=await import('drizzle-orm'),[a]=await this.db.select().from(s).where(r(s.id,e));return a?this.rowToMedia(a,t):null}async find(e={},t){let{page:s=1,limit:r=30,search:a="",type:n="",folder:c="",sortBy:p="createdAt",sortDir:o="desc"}=e,{where:u,params:d,orderBy:m,sortCol:y}=this.buildFindConditions({page:s,limit:r,search:a,type:n,folder:c,sortBy:p,sortDir:o}),l=(s-1)*r;if(this.dialect==="mongodb"){let W={},{search:f,type:k,folder:L,sortBy:q="createdAt",sortDir:C="desc"}=e;f&&(W.$or=[{title:{$regex:f,$options:"i"}},{filename:{$regex:f,$options:"i"}},{originalName:{$regex:f,$options:"i"}},{alt:{$regex:f,$options:"i"}}]),k&&k!=="all"&&(W.mimeType={$regex:`^${k}/`}),L&&(W.$or=[{folder:L},{folder:{$regex:`^${L}/`}}]);let M={[q==="name"?"title":q]:C==="asc"?1:-1},N=await this.db.db.collection(this.mediaTable).countDocuments(W);return {docs:(await this.db.db.collection(this.mediaTable).find(W).sort(M).skip(l).limit(r).toArray()).map(B=>this.rowToMedia(B,t)),totalDocs:N,page:s,limit:r,totalPages:Math.ceil(N/r)}}if(this.dialect==="sqlite"){let f=this.sqliteGet(`SELECT COUNT(*) as cnt FROM ${this.mediaTable} ${u}`,d)?.cnt??0;return {docs:(await this.sqliteRun(`SELECT * FROM ${this.mediaTable} ${u} ORDER BY ${y} ${m} LIMIT ? OFFSET ?`,[...d,r,l])).map(L=>this.rowToMedia(L,t)),totalDocs:f,page:s,limit:r,totalPages:Math.ceil(f/r)}}let{media:g}=await import('./media-M3EIZ4QS.cjs'),{like:h,or:T,and:S,asc:w,desc:A,eq:b,sql:E}=await import('drizzle-orm'),U=[];a&&U.push(T(h(g.title,`%${a}%`),h(g.filename,`%${a}%`),h(g.originalName,`%${a}%`),h(g.alt,`%${a}%`))),n&&n!=="all"&&U.push(h(g.mimeType,`${n}/%`)),c&&U.push(T(b(g.folder,c),h(g.folder,`${c}/%`)));let v=U.length>0?S(...U):void 0,R=g[{created_at:"createdAt",updated_at:"updatedAt",title:"title",filename:"filename",file_size:"fileSize",mime_type:"mimeType",original_name:"originalName"}[y]||"createdAt"],_=o==="asc"?w(R):A(R),D=await this.db.select().from(g).where(v).orderBy(_).limit(r).offset(l),[{count:P}]=await this.db.select({count:E`count(*)`}).from(g).where(v),K=Number(P);return {docs:D.map(W=>this.rowToMedia(W,t)),totalDocs:K,page:s,limit:r,totalPages:Math.ceil(K/r)}}async update(e,t,s){this.dialect==="postgres"&&(e=ce(e));let r=this.now();if(this.dialect==="mongodb")return await this.db.db.collection(this.mediaTable).updateOne({id:e},{$set:{...t,updatedAt:new Date}}),this.findById(e,s);if(this.dialect==="sqlite"){let p=["updated_at = ?"],o=[r];t.title!==void 0&&(p.push("title = ?"),o.push(t.title)),t.alt!==void 0&&(p.push("alt = ?"),o.push(t.alt)),t.caption!==void 0&&(p.push("caption = ?"),o.push(t.caption)),t.folder!==void 0&&(p.push("folder = ?"),o.push(t.folder)),t.metadata!==void 0&&(p.push("metadata = ?"),o.push(t.metadata===null?null:JSON.stringify(t.metadata))),t.originalName!==void 0&&(p.push("original_name = ?"),o.push(t.originalName)),o.push(e),await this.sqliteRun(`UPDATE ${this.mediaTable} SET ${p.join(", ")} WHERE id = ?`,o);let u=this.sqliteGet(`SELECT * FROM ${this.mediaTable} WHERE id = ?`,[e]);return u?this.rowToMedia(u,s):null}let{media:a}=await import('./media-M3EIZ4QS.cjs'),{eq:n}=await import('drizzle-orm'),[c]=await this.db.update(a).set({...t,updatedAt:new Date}).where(n(a.id,e)).returning();return c?this.rowToMedia(c,s):null}async updateMany(e,t){this.dialect==="postgres"&&(e=e.map(ce));let s=this.now();if(this.dialect==="mongodb"){for(let r of e)await this.db.db.collection(this.mediaTable).updateOne({id:r},{$set:{...t,updatedAt:new Date}});return}if(this.dialect==="sqlite")for(let r of e){let a=["updated_at = ?"],n=[s];t.folder!==void 0&&(a.push("folder = ?"),n.push(t.folder||null)),n.push(r),await this.sqliteRun(`UPDATE ${this.mediaTable} SET ${a.join(", ")} WHERE id = ?`,n);}else {let{media:r}=await import('./media-M3EIZ4QS.cjs'),{eq:a}=await import('drizzle-orm');for(let n of e)await this.db.update(r).set({...t,updatedAt:new Date}).where(a(r.id,n));}}async listFolders(){if(this.dialect==="mongodb"){let p=await this.db.db.collection(this.foldersTable).find({},{projection:{path:1}}).toArray(),o=await this.db.db.collection(this.mediaTable).distinct("folder"),u=new Set([...p.map(d=>d.path),...o]);return Array.from(u).filter(d=>d&&d!=="").sort()}if(this.dialect==="sqlite")return (await this.sqliteRun(`SELECT path FROM ${this.foldersTable} UNION
+         SELECT folder as path FROM ${this.mediaTable} WHERE folder IS NOT NULL AND folder != ''`)).map(o=>o.path).filter(o=>o&&o!=="").sort();let{media:e,mediaFolders:t}=await import('./media-M3EIZ4QS.cjs'),{eq:s,sql:r}=await import('drizzle-orm'),a=await this.db.select({folder:e.folder}).from(e).groupBy(e.folder),n=await this.db.select({path:t.path}).from(t),c=new Set([...a.map(p=>p.folder),...n.map(p=>p.path)]);return Array.from(c).filter(p=>p&&p!=="").sort()}async createFolder(e,t=""){let s=t?`${t}/${e}`:e;await this.storage.createFolder?.(s);let r=this.now();if(this.dialect==="mongodb"){await this.db.db.collection(this.foldersTable).findOne({path:s})||await this.db.db.collection(this.foldersTable).insertOne({_id:this.genId(),name:e,path:s,parentPath:t||null,createdAt:new Date});return}if(this.dialect==="sqlite")await this.sqliteRun(`INSERT OR IGNORE INTO ${this.foldersTable} (path, name, parent_path, created_at) VALUES (?, ?, ?, ?)`,[s,e,t||null,r]);else {let{mediaFolders:a}=await import('./media-M3EIZ4QS.cjs');await this.db.insert(a).values({path:s,name:e,parentPath:t||null,createdAt:new Date}).onConflictDoNothing();}}async deleteFolder(e){let t=await this.find({folder:e,limit:1e4});for(let s of t.docs)await this.delete(s.id);if(await this.storage.deleteFolder?.(e),this.dialect==="mongodb"){await this.db.db.collection(this.foldersTable).deleteMany({$or:[{path:e},{path:{$regex:`^${e}/`}}]});return}if(this.dialect==="sqlite")await this.sqliteRun(`DELETE FROM ${this.foldersTable} WHERE path = ? OR path LIKE ?`,[e,`${e}/%`]);else {let{mediaFolders:s}=await import('./media-M3EIZ4QS.cjs'),{like:r,or:a,eq:n}=await import('drizzle-orm');await this.db.delete(s).where(a(n(s.path,e),r(s.path,`${e}/%`)));}}};var $t=Ae.join(process.cwd(),"public","uploads"),_t="/uploads";function Me(i,e,t){let {db:s,user:r,tenantId:a}=e,n=null,p=async()=>{if(!n)try{typeof s?.connect=="function"&&await s.connect();let o="sqlite";"dialect"in s&&s.dialect==="postgres"?o="postgres":"dialect"in s&&s.dialect==="mongodb"&&(o="mongodb");let u=o==="postgres"&&s.client||s;n=await Te.init(u,{dialect:o});}catch(o){throw console.error("[getMedia] Init error:",o),o}return n};i.get("/api/media",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let d=await p(),m=new URL(o.req.url).origin,y=parseInt(o.req.query("page")||"1"),l=parseInt(o.req.query("limit")||"30"),g=o.req.query("search")||"",h=o.req.query("type")||"",T=o.req.query("folder")||"",S=await d.find({page:y,limit:l,search:g,type:h,folder:T},m);return o.json(S)}),i.post("/api/media/upload",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let d=await p(),m=o.req.header("content-type")||"",y=new URL(o.req.url).origin;if(m.includes("multipart/form-data")){let S=await o.req.formData(),w=S.get("file"),A=S.get("folder")||"";if(!w)throw new I(400,"No file uploaded");let b=await d.upload(w,A,y);return o.json(b)}let l=await o.req.json(),{url:g}=l,h=l.folder||"";if(!g)throw new I(400,"No URL provided");let T=await d.uploadFromUrl(g,h,y);return o.json(T)}),i.get("/api/media/folders",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let m=await(await p()).listFolders();return o.json(m)}),i.post("/api/media/folders",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let d=await p(),m=await o.req.json(),{name:y,parentPath:l}=m;if(!y)throw new I(400,"Folder name is required");return await d.createFolder(y,l||""),o.json({message:"Folder created",path:l?`${l}/${y}`:y})}),i.delete("/api/media/folders",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let d=await p(),m=o.req.query("path");if(!m)throw new I(400,"Path is required");return await d.deleteFolder(m),o.json({message:"Folder deleted"})}),i.get("/api/media/resize",async o=>{let u=o.req.query("url"),d=parseInt(o.req.query("w")||"0"),m=parseInt(o.req.query("h")||"0"),y=o.req.query("fit")||"cover",l=(o.req.query("fmt")||o.req.query("format")||"").toLowerCase(),g=parseInt(o.req.query("q")||o.req.query("quality")||"80"),h=parseFloat(o.req.query("cx")||"0"),T=parseFloat(o.req.query("cy")||"0"),S=parseFloat(o.req.query("cw")||"0"),w=parseFloat(o.req.query("ch")||"0");if(!u)throw new I(400,"URL is required");let b=(await p()).storage;if(!b||b.name!=="local")return o.redirect(u);let E=b.config?.uploadDir||$t,U=b.config?.baseUrl||_t;if(!u.startsWith(U))return o.redirect(u);let v=u.replace(U,""),O=Ae.join(E,v);if(!fs.existsSync(O))throw new I(404,"File not found");let R=fs.readFileSync(O),{default:_}=await import('sharp'),D=_(R);if(S>0&&w>0){let W=await _(R).metadata(),f=W.width||0,k=W.height||0;if(f>0&&k>0){let L=Math.max(0,Math.min(Math.round(h/100*f),f-1)),q=Math.max(0,Math.min(Math.round(T/100*k),k-1)),C=Math.max(1,Math.min(Math.round(S/100*f),f-L)),x=Math.max(1,Math.min(Math.round(w/100*k),k-q));D=D.extract({left:L,top:q,width:C,height:x});}}(d>0||m>0)&&(D=D.resize({width:d>0?d:void 0,height:m>0?m:void 0,fit:y}));let P="webp";l==="avif"?(D=D.avif({quality:g}),P="avif"):l==="png"?(D=D.png({compressionLevel:8}),P="png"):l==="jpeg"||l==="jpg"?(D=D.jpeg({quality:g}),P="jpeg"):l==="webp"?(D=D.webp({quality:g}),P="webp"):P=(await _(R).metadata()).format||"webp";let K=await D.toBuffer();return o.header("Content-Type",`image/${P}`),o.header("Cache-Control","public, max-age=31536000, immutable"),o.body(K)}),i.get("/api/media/file/:key{.+$}",async o=>{let u=o.req.param("key"),d=globalThis.STORAGE_BUCKET;if(d){let m=await d.get(u);if(!m)return o.notFound();let y=new Headers;return m.writeHttpMetadata(y),y.set("etag",m.httpEtag),new Response(m.body,{headers:y})}return o.notFound()}),i.get("/api/media/test",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let d=await p();return o.json({status:d?"initialized":"failed",serviceType:d?.constructor?.name})}),i.get("/api/media/:id",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let d=await p(),m=o.req.param("id"),y=new URL(o.req.url).origin,l=await d.findById(m,y);if(!l)throw new I(404,"Media not found");return o.json(l)}),i.patch("/api/media/:id",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let d=await p(),m=o.req.param("id"),y=await o.req.json(),l=new URL(o.req.url).origin,g=["folder","metadata","title","alt","caption","originalName"],h={};for(let T of g)y[T]!==void 0&&(h[T]=y[T]);if(Object.keys(h).length>0){let T=await d.update(m,h,l);return o.json({doc:T})}throw new I(400,"No valid fields to update")}),i.delete("/api/media/:id",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let d=await p(),m=o.req.param("id"),y=new URL(o.req.url).origin;return await d.delete(m,y),o.json({success:true})});}function Ke(i,e,t){let{db:s,user:r,tenantId:a,authAdapter:n}=e;i.get("/api/keys",async c=>{let{user:p,tenantId:o}=await $(c.req.raw,t,r,a);if(!p||!chunkKOSR7235_cjs.a(p,"users:read"))throw new I(403,"Forbidden");let u=parseInt(c.req.query("page")||"1"),d=Math.min(parseInt(c.req.query("limit")||"50"),100),m=await s.find({collection:chunkDCFOVCJX_cjs.a,where:{},page:u,limit:d,tenantId:o}),y=(m.docs||[]).map(l=>({id:l.id,name:l.name,keyPrefix:l.keyPrefix,permissions:l.permissions||[],lastUsed:l.lastUsedAt,createdAt:l.createdAt}));return c.json({docs:y,totalDocs:m.totalDocs||y.length,totalPages:m.totalPages||1})}),i.post("/api/keys",async c=>{let{user:p}=await $(c.req.raw,t,r,a);if(!p||!chunkKOSR7235_cjs.a(p,"users:admin"))throw new I(403,"Forbidden");let o=await c.req.json();if(!o.name||typeof o.name!="string")throw new I(400,"name is required");let u=chunkDCFOVCJX_cjs.f(),d=await s.create({collection:chunkDCFOVCJX_cjs.a,data:{userId:p.id,name:o.name,key:u,keyPrefix:chunkDCFOVCJX_cjs.g(u),permissions:Array.isArray(o.permissions)?o.permissions:["*"],expiresAt:o.expiresAt||null,createdAt:new Date().toISOString()}});return await n?.createAuditLog({action:"api_key_create",userId:p.id,resource:"api_key",resourceId:d.id,success:true,metadata:{keyName:o.name}}),c.json({...d,key:u,permissions:Array.isArray(o.permissions)?o.permissions:["*"]},201)}),i.delete("/api/keys/:id",async c=>{let{user:p}=await $(c.req.raw,t,r,a);if(!p||!chunkKOSR7235_cjs.a(p,"users:admin"))throw new I(403,"Forbidden");let o=c.req.param("id"),u=await s.findByID({collection:chunkDCFOVCJX_cjs.a,id:o});if(!u)throw new I(404,"API key not found");return await s.delete({collection:chunkDCFOVCJX_cjs.a,id:o}),await n?.createAuditLog({action:"api_key_delete",userId:p.id,resource:"api_key",resourceId:o,success:true,metadata:{keyName:u.name}}),c.json({message:"API key deleted"})}),i.patch("/api/keys/:id",async c=>{let{user:p}=await $(c.req.raw,t,r,a);if(!p||!chunkKOSR7235_cjs.a(p,"users:admin"))throw new I(403,"Forbidden");let o=c.req.param("id"),u=await c.req.json(),d=await s.findByID({collection:chunkDCFOVCJX_cjs.a,id:o});if(!d)throw new I(404,"API key not found");let m={};if(typeof u.name=="string"&&u.name.trim()&&(m.name=u.name.trim()),Array.isArray(u.permissions)&&(m.permissions=u.permissions),u.expiresAt!==void 0&&(m.expiresAt=u.expiresAt||null),Object.keys(m).length===0)throw new I(400,"Nothing to update");let y=await s.update({collection:chunkDCFOVCJX_cjs.a,id:o,data:m});return c.json({...y,keyPrefix:d.keyPrefix})}),i.post("/api/keys/:id/rotate",async c=>{let{user:p}=await $(c.req.raw,t,r,a);if(!p||!chunkKOSR7235_cjs.a(p,"users:admin"))throw new I(403,"Forbidden");let o=c.req.param("id"),u=await s.findByID({collection:chunkDCFOVCJX_cjs.a,id:o});if(!u)throw new I(404,"API key not found");let d=chunkDCFOVCJX_cjs.f(),m=await s.update({collection:chunkDCFOVCJX_cjs.a,id:o,data:{key:d,keyPrefix:chunkDCFOVCJX_cjs.g(d),lastUsedAt:null}});return await n?.createAuditLog({action:"api_key_rotate",userId:p.id,resource:"api_key",resourceId:o,success:true,metadata:{keyName:u.name}}),c.json({...m,key:d,permissions:u.permissions,expiresAt:u.expiresAt})});}function Ot(i){if(!i||typeof i!="string")return [];let e=[],t=/<a\s+(?:[^>]*?\s+)?href=["']([^"']*)["']/gi,s;for(;(s=t.exec(i))!==null;)s[1]&&e.push(s[1].trim());let r=/\[(?:[^\]]*)\]\(([^)\s]+)(?:\s+["'][^"']*["'])?\)/g;for(;(s=r.exec(i))!==null;)s[1]&&e.push(s[1].trim());return e}function wr(i){if(!i)return [];if(typeof i=="string"){if(i.startsWith("{")||i.startsWith("["))try{let e=JSON.parse(i);return We(e)}catch{return Ot(i)}return Ot(i)}return typeof i=="object"?We(i):[]}function We(i){let e=[];if(!i||typeof i!="object")return e;if(i.marks&&Array.isArray(i.marks))for(let t of i.marks)t.type==="link"&&t.attrs?.href&&e.push(String(t.attrs.href).trim());if(i.type==="link"&&i.attrs?.href&&e.push(String(i.attrs.href).trim()),i.content&&Array.isArray(i.content))for(let t of i.content)e.push(...We(t));return e}function Nt(i){if(!i)return {valid:false,reason:"URL is empty"};if(i.startsWith("/")||i.startsWith("#")||i.startsWith("mailto:")||i.startsWith("tel:"))return {valid:true};if(/^(htp:\/\/|https\/\/|http\/\/|htps:\/\/)/i.test(i))return {valid:false,reason:"Malformed URL protocol prefix"};if(/\s/.test(i))return {valid:false,reason:"URL contains unencoded whitespace"};try{let e=new URL(i);return ["http:","https:"].includes(e.protocol)?!e.hostname||e.hostname.length<2?{valid:!1,reason:"Missing or invalid hostname"}:{valid:!0}:{valid:!1,reason:`Unsupported protocol: ${e.protocol}`}}catch{return {valid:false,reason:"Invalid URL format"}}}function Ft(i,e){let t=[],s=0,r=new Map,a={};for(let d of i){let m=d.slug,y=d.label||m.charAt(0).toUpperCase()+m.slice(1),l=e[m]||[];s+=l.length;let g=0,h=d.admin?.useAsTitle||"title",T=d.seo||d.fields.some(A=>A.name==="seo"||A.name==="metaTitle");for(let A of l){let b=String(A.id||A._id||""),E=A[h]||A.name||A.slug||b,U=false;if(T){let v=A.seo||{},O=v.title||A.metaTitle,R=v.description||A.metaDescription;O||(t.push({id:`${m}-${b}-missing-title`,type:"seo",severity:"warning",collection:m,documentId:b,documentTitle:E,field:"seo.title",message:"Missing SEO meta title",recommendation:"Add a concise 50-60 character title for search engines."}),U=true,g++),R||(t.push({id:`${m}-${b}-missing-desc`,type:"seo",severity:"warning",collection:m,documentId:b,documentTitle:E,field:"seo.description",message:"Missing SEO meta description",recommendation:"Add a descriptive 120-160 character summary."}),U=true,g++);}for(let v of d.fields){if(!v.name)continue;if(v.type==="image"||v.type==="upload"){let R=A[v.name];if(typeof R=="string"&&R.startsWith("{"))try{R=JSON.parse(R);}catch{}let _=R!=null&&R!=="",D=typeof R=="object"&&R!==null&&!!R.alt||!!A[`${v.name}Alt`]||!!A.alt;_&&!D&&(t.push({id:`${m}-${b}-${v.name}-missing-alt`,type:"accessibility",severity:"warning",collection:m,documentId:b,documentTitle:E,field:v.name,message:`Image in '${v.name}' is missing descriptive alt text`,recommendation:"Add alt text for screen readers and SEO."}),U=true,g++);}if(v.required&&(A[v.name]===void 0||A[v.name]===null||A[v.name]==="")&&(t.push({id:`${m}-${b}-${v.name}-empty-required`,type:"validation",severity:"critical",collection:m,documentId:b,documentTitle:E,field:v.name,message:`Required field '${v.name}' is empty`,recommendation:"Populate this required field to avoid render errors."}),U=true,g++),v.type==="url"||v.type==="text"&&(v.name.toLowerCase().includes("url")||v.name.toLowerCase().includes("link")||v.format==="url")){let R=A[v.name];if(R&&typeof R=="string"){let _=Nt(R.trim());_.valid||(t.push({id:`${m}-${b}-${v.name}-invalid-url`,type:"link",severity:"warning",collection:m,documentId:b,documentTitle:E,field:v.name,message:`Malformed URL in '${v.name}': ${_.reason||"Invalid address"}`,recommendation:"Check that URL has a valid protocol (e.g. https://) and hostname."}),U=true,g++);}}if(v.type==="richtext"||v.type==="textarea"){let R=wr(A[v.name]);for(let _ of R){let D=Nt(_);D.valid||(t.push({id:`${m}-${b}-${v.name}-broken-link-${encodeURIComponent(_.slice(0,16))}`,type:"link",severity:"warning",collection:m,documentId:b,documentTitle:E,field:v.name,message:`Embedded link '${_.slice(0,32)}...' is invalid: ${D.reason}`,recommendation:"Update or remove broken hyperlink in rich text content."}),U=true,g++);}}}U&&r.set(`${m}:${b}`,1);}let S=l.length,w=S>0?Math.max(0,Math.round(100-g/(S*2)*100)):100;a[m]={slug:m,label:y,score:w,docCount:S,issueCount:g,hasDocs:S>0};}let n=t.filter(d=>d.severity==="critical").length,c=t.filter(d=>d.severity==="warning").length,p=t.filter(d=>d.severity==="info").length,o=s-r.size;return {score:s>0?Math.max(0,Math.round(o/s*100)):100,totalDocuments:s,healthyDocuments:o,issuesCount:{critical:n,warning:c,info:p},issues:t,collectionScores:a}}function He(i,e,t){let{registry:s,db:r,user:a,tenantId:n,webhookService:c,settings:p,authAdapter:o}=e,u=p?.access?.enablePublicAccess??false,d=p?.access?.defaultCollectionAccess??"none";i.get("/api/webhooks/actions",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l||!chunkKOSR7235_cjs.a(l,"users:read"))throw new I(403,"Forbidden");let g={generic:{label:"Custom URL",description:"POST to any endpoint with Kyro payload",configFields:[],envVars:[]},"github-push":{label:"GitHub Push",description:"Push an empty commit to simulate a push event",configFields:[{name:"githubOwner",label:"Owner",required:true,placeholder:"e.g., kyro-dev"},{name:"githubRepo",label:"Repository",required:true,placeholder:"e.g., my-website"},{name:"githubBranch",label:"Branch",required:false,placeholder:"main"}],envVars:["GITHUB_TOKEN"]}};return y.json({actions:g})}),i.get("/api/webhooks",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l||!chunkKOSR7235_cjs.a(l,"users:read"))throw new I(403,"Forbidden");if(!c)throw new I(503,"Webhook service not available");let g=await c.getWebhooks();return y.json({docs:g})}),i.post("/api/webhooks",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l||!chunkKOSR7235_cjs.a(l,"users:admin"))throw new I(403,"Forbidden");if(!c)throw new I(503,"Webhook service not available");let g=await y.req.json(),h=await c.createWebhook(g);return await o?.createAuditLog({action:"webhook_create",userId:l.id,resource:"webhook",resourceId:h.id,success:true,metadata:{name:h.name,url:h.url}}),y.json(h,201)}),i.get("/api/webhooks/:id",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l||!chunkKOSR7235_cjs.a(l,"users:read"))throw new I(403,"Forbidden");if(!c)throw new I(503,"Webhook service not available");let g=y.req.param("id"),h=await c.getWebhookById(g);if(!h)throw new I(404,"Webhook not found");return y.json(h)}),i.patch("/api/webhooks/:id",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l||!chunkKOSR7235_cjs.a(l,"users:admin"))throw new I(403,"Forbidden");if(!c)throw new I(503,"Webhook service not available");let g=y.req.param("id"),h=await y.req.json(),T=await c.updateWebhook(g,h);if(!T)throw new I(404,"Webhook not found");return await o?.createAuditLog({action:"webhook_update",userId:l.id,resource:"webhook",resourceId:g,success:true,metadata:{name:T.name}}),y.json(T)}),i.delete("/api/webhooks/:id",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l||!chunkKOSR7235_cjs.a(l,"users:admin"))throw new I(403,"Forbidden");if(!c)throw new I(503,"Webhook service not available");let g=y.req.param("id"),h=await c.getWebhookById(g);if(!h)throw new I(404,"Webhook not found");return await c.deleteWebhook(g),await o?.createAuditLog({action:"webhook_delete",userId:l.id,resource:"webhook",resourceId:g,success:true,metadata:{name:h.name}}),y.json({message:"Webhook deleted"})}),i.post("/api/webhooks/:id/test",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l||!chunkKOSR7235_cjs.a(l,"users:admin"))throw new I(403,"Forbidden");if(!c)throw new I(503,"Webhook service not available");let g=y.req.param("id"),h=await c.testWebhook(g);if(!h)throw new I(404,"Webhook not found");return y.json(h)}),i.get("/api/webhooks/:id/history",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l||!chunkKOSR7235_cjs.a(l,"users:read"))throw new I(403,"Forbidden");if(!c)throw new I(503,"Webhook service not available");let g=y.req.param("id"),h=Math.min(parseInt(y.req.query("limit")||"50"),100),T=await c.getDeliveryHistory(g,h);return y.json({docs:T})}),i.get("/api/analytics",async y=>{let{user:l,tenantId:g}=await $(y.req.raw,t,a,n);if(!l)throw new I(401,"Authentication required");if(!(l.role==="admin"||l.role==="super_admin"))throw new I(403,"Unauthorized");let S=(await r.find({collection:"orders",where:{},limit:1e3,page:1,tenantId:g})).docs||[],w=await r.findOne({collection:"_globals_store-settings",where:{},tenantId:g}),A=w?.currency?.code||w?.currency||"USD",b={},E={},U={};S.forEach(R=>{let _=R.createdAt||R.updatedAt,D=_?new Date(_).toISOString().split("T")[0]:new Date().toISOString().split("T")[0];b[D]||(b[D]=0),E[D]||(E[D]=0);let P=typeof R.total=="number"?R.total:parseFloat(String(R.total||0));b[D]+=isNaN(P)?0:P,E[D]+=1;let K=R.orderStatus||R.status||"pending";U[K]=(U[K]||0)+1;});let v=Object.keys(b).sort().map(R=>({date:R,revenue:Math.round(b[R]*100)/100,orders:E[R]})),O=Math.round(v.reduce((R,_)=>R+_.revenue,0)*100)/100;return y.json({chartData:v,totalRevenue:O,totalOrders:S.length,ordersByStatus:U,currencyCode:typeof A=="string"?A:"USD"})}),i.get("/api/search",async y=>{let l=y.req.query("q")||"",g=y.req.query("collections")||"",h=Math.min(parseInt(y.req.query("limit")||"10"),50);if(!l||l.length<2)return y.json({results:[],message:"Query too short"});let{user:T,tenantId:S}=await $(y.req.raw,t,a,n),w=g?g.split(",").filter(Boolean):s.getCollectionSlugs(),A=[];for(let b of s.getCollections()){if(!w.includes(b.slug)||!(await H(b,"read",y.req.raw,T,S,void 0,u,d)).allowed)continue;let U=b.fields.filter(v=>v.name&&v.name!=="id"&&(v.type==="text"||v.type==="email"||v.type==="textarea"||v.type==="richtext"||v.indexed)&&!v.admin?.hidden).map(v=>v.name);if(U.length!==0)try{let v=U.map(R=>({[R]:{contains:l}})),O=await r.find({collection:b.slug,where:{OR:v},limit:h,tenantId:S});await chunkOJBL4CXK_cjs.o(O.docs,b.fields,r,s,1,0);for(let R of O.docs){let _=b.admin?.useAsTitle||U.find(P=>P==="title"||P==="name"||P==="label"||P==="heading"||P==="email"||P==="fullName"||P==="username"||P==="slug"||P==="filename"),D=_?jt(b.fields,R,_):null;(!D||D===R.id||/^[0-9a-fA-F-]{20,}$/.test(String(D)))&&(D=R.name||R.label||R.title||R.email||R.fullName||R.username||R.heading||R.slug||R.filename||D||R.id),A.push({collection:b.slug,label:b.label||b.slug,id:R.id,title:String(D||"Untitled"),doc:R});}}catch(v){console.error(`Search error for ${b.slug}:`,v);}}return A.sort((b,E)=>b.label.localeCompare(E.label)),y.json({results:A})}),i.get("/api/kyro/schema",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l)throw new I(401,"Authentication required");let g={collections:{},globals:{}};for(let h of s.getCollections()){let T=h.slug;try{g.collections[T]={slug:T,label:h.label||T,fields:le(h.fields),jsonSchema:zodToJsonSchema.zodToJsonSchema(s.getZodSchema(T),{target:"openApi3"}),createSchema:zodToJsonSchema.zodToJsonSchema(s.getCreateZodSchema(T),{target:"openApi3"}),updateSchema:zodToJsonSchema.zodToJsonSchema(s.getUpdateZodSchema(T),{target:"openApi3"}),procedures:{find:{collection:T,where:"Record<string,any>",sort:"string",limit:"number",page:"number",depth:"number",select:"string[]",draft:"boolean"},findByID:{collection:T,id:"string",depth:"number",select:"string[]",draft:"boolean"},create:{collection:T,data:"Record<string,any>",depth:"number",select:"string[]"},update:{collection:T,id:"string",data:"Record<string,any>",depth:"number",select:"string[]",baseUpdatedAt:"string"},delete:{collection:T,id:"string"},count:{collection:T,where:"Record<string,any>"}}};}catch{}}for(let h of s.getGlobals()){let T=h.slug,S=h.fields;if(T==="storage-settings"){let w=s.storageProviders,A=w.getAll(),b=new Set(w.getAllAvailable(U=>w.isPluginEnabled(U)).map(U=>U.type));b.add("local");let E=new Set(A.map(U=>U.type));S=S.filter(U=>U.type==="group"&&U.name&&E.has(U.name)?b.has(U.name):true).map(U=>U.name==="provider"&&U.type==="select"?{...U,options:U.options.filter(v=>b.has(v.value))}:U);}try{g.globals[T]={slug:T,label:h.label||T,fields:le(S),jsonSchema:zodToJsonSchema.zodToJsonSchema(s.getZodSchema(T),{target:"openApi3"}),procedures:{get:{},update:{data:"Record<string,any>"}}};}catch{}}return y.json(g)}),i.get("/api/collections",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l)throw new I(401,"Authentication required");let g=s.getCollections().map(h=>({slug:h.slug,label:h.label||h.slug,fields:h.fields.filter(T=>T.name).map(T=>({name:T.name,type:T.type,required:T.required,label:T.label}))}));return y.json(g)});let m=async y=>{let{user:l,tenantId:g}=await $(y.req.raw,t,a,n);if(!l)throw new I(401,"Authentication required");let h=s.getCollections().filter(w=>!w.slug.startsWith("_")),T={};for(let w of h)try{let A=await r.find({collection:w.slug,where:{},limit:500,page:1,tenantId:g});T[w.slug]=A.docs||[];}catch{T[w.slug]=[];}let S=Ft(h,T);return y.json(S)};i.get("/api/content-health",m),i.get("/api/audit/content-health",m);}function jt(i,e,t){if(t in e)return e[t];for(let s of i)if(s.name){if(s.type==="tabs"&&s.tabs){let r=e[s.name];if(r&&typeof r=="object"&&t in r)return r[t]}if((s.type==="group"||s.type==="collapsible")&&s.fields){let r=e[s.name];if(r&&typeof r=="object"){if(t in r)return r[t];let a=jt(s.fields,r,t);if(a!==void 0)return a}}}}function le(i){return i.map(e=>{let t={name:e.name,type:e.type,label:e.label,required:e.required??false,unique:e.unique??false,indexed:e.indexed??false,defaultValue:e.defaultValue,admin:e.admin?{...e.admin}:void 0};return e.minLength!==void 0&&(t.minLength=e.minLength),e.maxLength!==void 0&&(t.maxLength=e.maxLength),e.pattern!==void 0&&(t.pattern=e.pattern),e.variant!==void 0&&(t.variant=e.variant),e.hasMany!==void 0&&(t.hasMany=e.hasMany),e.min!==void 0&&(t.min=e.min),e.max!==void 0&&(t.max=e.max),e.step!==void 0&&(t.step=e.step),e.integer!==void 0&&(t.integer=e.integer),e.options&&(t.options=e.options),e.relationTo&&(t.relationTo=e.relationTo),e.maxDepth!==void 0&&(t.maxDepth=e.maxDepth),e.minRows!==void 0&&(t.minRows=e.minRows),e.maxRows!==void 0&&(t.maxRows=e.maxRows),e.localized!==void 0&&(t.localized=e.localized),e.language&&(t.language=e.language),e.format&&(t.format=e.format),e.allowedTypes&&(t.allowedTypes=e.allowedTypes),e.maxSize&&(t.maxSize=e.maxSize),(e.type==="group"||e.type==="row"||e.type==="collapsible")&&e.fields&&(t.fields=le(e.fields)),e.type==="array"&&e.fields&&(t.fields=le(e.fields)),e.type==="blocks"&&e.blocks&&(t.blocks=e.blocks.map(s=>({slug:s.slug,label:s.label,fields:le(s.fields)}))),e.type==="tabs"&&e.tabs&&(t.tabs=e.tabs.map(s=>({label:s.label,name:s.name,fields:le(s.fields)}))),t})}function ze(i,e,t,s,r,a,n,c,p){i.post("/api/auth/login",async o=>e.login(o.req.raw)),i.post("/api/auth/register",async o=>{try{let u=await t.findOne({collection:"_globals_system",where:{}});if(u&&u.enableRegistration===!1)throw new I(403,"User registration is currently disabled by administrator.");if(u?.defaultRegistrationRole){let d=o.req.raw;if((d.headers.get("content-type")||"").includes("application/json")){let y=await o.req.json();y.role||(y.role=u.defaultRegistrationRole);let l=new Request(d.url,{method:d.method,headers:d.headers,body:JSON.stringify(y)});return e.register(l)}}}catch{}return e.register(o.req.raw)}),i.post("/api/auth/logout",async o=>e.logout(o.req.raw)),i.post("/api/auth/refresh",async o=>e.refresh(o.req.raw)),i.get("/api/auth/me",async o=>e.me(o.req.raw)),i.post("/api/auth/forgot-password",async o=>e.forgotPassword(o.req.raw)),i.post("/api/auth/reset-password",async o=>e.resetPassword(o.req.raw)),i.post("/api/auth/change-password",async o=>e.changePassword(o.req.raw)),i.get("/api/auth/verify-email",async o=>e.verifyEmail(o.req.raw)),i.post("/api/auth/verify-email",async o=>e.verifyEmail(o.req.raw)),i.get("/api/auth/verify",async o=>e.verifyEmail(o.req.raw)),i.post("/api/auth/verify",async o=>e.verifyEmail(o.req.raw)),i.post("/api/auth/magic-link",async o=>e.requestMagicLink(o.req.raw)),i.get("/api/auth/magic-link",async o=>e.verifyMagicLink(o.req.raw)),i.post("/api/auth/invite",async o=>e.inviteUser(o.req.raw)),i.get("/api/auth/sessions",async o=>e.listSessions(o.req.raw)),i.post("/api/auth/sessions/refresh",async o=>e.refreshSession(o.req.raw)),i.delete("/api/auth/sessions",async o=>e.revokeOtherSessions(o.req.raw)),i.delete("/api/auth/sessions/:id",async o=>e.revokeSession(o.req.raw,o.req.param("id"))),i.put("/api/auth/sessions/:id/name",async o=>e.renameSession(o.req.raw,o.req.param("id"))),i.get("/api/auth/access",async o=>{try{let{user:u,tenantId:d}=await $(o.req.raw,r,a,n);if(!u)throw new I(401,"Not authenticated");let m={},y={};for(let l of s.getCollections()){let g={read:(await H(l,"read",o.req.raw,u,d,void 0,c,p)).allowed,create:(await H(l,"create",o.req.raw,u,d,void 0,c,p)).allowed,update:(await H(l,"update",o.req.raw,u,d,void 0,c,p)).allowed,delete:(await H(l,"delete",o.req.raw,u,d,void 0,c,p)).allowed};m[l.slug]=g;}for(let l of s.getGlobals()){let g={read:(await ye(l,"read",o.req.raw,u,d,c)).allowed,update:(await ye(l,"update",o.req.raw,u,d,c)).allowed};y[l.slug]=g;}return o.json({collections:m,globals:y})}catch(u){return Tt(o,u)}});}function Ve(i){return {colors:{primary:i?.colors?.primary||"#10b981",secondary:i?.colors?.secondary||"#64748b",accent:i?.colors?.accent||"#3b82f6",background:i?.colors?.background||"#ffffff",surface:i?.colors?.surface||"#f8fafc",text:i?.colors?.text||"#0f172a",textMuted:i?.colors?.textMuted||"#94a3b8",border:i?.colors?.border||"#e2e8f0",error:i?.colors?.error||"#ef4444",warning:i?.colors?.warning||"#f59e0b",success:i?.colors?.success||"#10b981",info:i?.colors?.info||"#06b6d4"},fonts:{sans:i?.fonts?.sans||"system-ui, -apple-system, sans-serif",serif:i?.fonts?.serif||"Georgia, serif",mono:i?.fonts?.mono||"monospace"},spacing:{xs:i?.spacing?.xs||"0.25rem",sm:i?.spacing?.sm||"0.5rem",md:i?.spacing?.md||"1rem",lg:i?.spacing?.lg||"1.5rem",xl:i?.spacing?.xl||"2rem"},borderRadius:{sm:i?.borderRadius?.sm||"0.25rem",md:i?.borderRadius?.md||"0.5rem",lg:i?.borderRadius?.lg||"0.75rem",xl:i?.borderRadius?.xl||"1rem",full:i?.borderRadius?.full||"9999px"},shadows:{sm:i?.shadows?.sm||"0 1px 2px 0 rgb(0 0 0 / 0.05)",md:i?.shadows?.md||"0 4px 6px -1px rgb(0 0 0 / 0.1)",lg:i?.shadows?.lg||"0 10px 15px -3px rgb(0 0 0 / 0.1)"}}}function Bt(i){let e=[":root {"];for(let[t,s]of Object.entries(i.colors))e.push(`  --kyro-color-${t}: ${s};`);for(let[t,s]of Object.entries(i.fonts))e.push(`  --kyro-font-${t}: ${s};`);for(let[t,s]of Object.entries(i.spacing))e.push(`  --kyro-spacing-${t}: ${s};`);for(let[t,s]of Object.entries(i.borderRadius))e.push(`  --kyro-radius-${t}: ${s};`);for(let[t,s]of Object.entries(i.shadows))e.push(`  --kyro-shadow-${t}: ${s};`);return e.push("}"),e.join(`
+`)}function Mt(i){return {theme:{extend:{colors:{kyro:i.colors},fontFamily:i.fonts,spacing:i.spacing,borderRadius:i.borderRadius,boxShadow:i.shadows}}}}function Xe(i,e){let{registry:t}=e;i.get("/api/tokens",async s=>{let r=s.req.query("format"),a=t.getGlobal("branding")||t.getGlobal("site_settings"),n=a?a.theme:void 0,c=Ve(n);return r==="tailwind"?s.json(Mt(c)):s.json({data:c})}),i.get("/api/tokens.css",async s=>{let r=t.getGlobal("branding")||t.getGlobal("site_settings"),a=r?r.theme:void 0,n=Ve(a),c=Bt(n);return s.header("Content-Type","text/css; charset=utf-8"),s.header("Cache-Control","public, max-age=3600"),s.body(c)});}var Ie=class{db;sessionTTL;constructor(e){this.db=e.db?.client||e.db,this.sessionTTL=e.sessionTTL||86400;}async executeSql(e,t=[]){try{if(this.db&&typeof this.db.prepare=="function"){let s=this.db.prepare(e);return (await(t.length>0?s.bind(...t):s).all()).results||[]}else if(this.db&&typeof this.db.run=="function"){let s=await this.db.run(drizzleOrm.sql.raw(this.replaceParams(e,t)));return s.rows||s.results||(Array.isArray(s)?s:[])}else if(this.db&&typeof this.db.all=="function"){let s=await this.db.all(drizzleOrm.sql.raw(this.replaceParams(e,t)));return Array.isArray(s)?s:s.results||[]}else if(this.db&&typeof this.db.execute=="function"){let s=await this.db.execute(drizzleOrm.sql.raw(this.replaceParams(e,t)));return s.rows||s.results||(Array.isArray(s)?s:[])}}catch(s){console.warn("[D1AuthAdapter] SQL execution note:",s.message);}return []}async getOne(e,t=[]){try{if(this.db&&typeof this.db.prepare=="function"){let r=this.db.prepare(e);return await(t.length>0?r.bind(...t):r).first()||null}}catch{}let s=await this.executeSql(e,t);return s.length>0?s[0]:null}replaceParams(e,t){let s=0;return e.replace(/\?/g,()=>{let r=t[s++];return r==null?"NULL":typeof r=="number"||typeof r=="boolean"?String(r):`'${String(r).replace(/'/g,"''")}'`})}async connect(){await this.executeSql(`
+      CREATE TABLE IF NOT EXISTS users (
+        id TEXT PRIMARY KEY,
+        email TEXT UNIQUE NOT NULL,
+        password_hash TEXT,
+        name TEXT,
+        role TEXT DEFAULT 'customer',
+        avatar TEXT,
+        tenant_id TEXT,
+        email_verified INTEGER DEFAULT 1,
+        locked INTEGER DEFAULT 0,
+        last_login TEXT,
+        failed_login_attempts INTEGER DEFAULT 0,
+        metadata TEXT,
+        created_at TEXT DEFAULT CURRENT_TIMESTAMP,
+        updated_at TEXT DEFAULT CURRENT_TIMESTAMP
+      );
+    `),await this.executeSql("ALTER TABLE users ADD COLUMN metadata TEXT;"),await this.executeSql("ALTER TABLE users ADD COLUMN avatar TEXT;"),await this.executeSql("ALTER TABLE audit_logs ADD COLUMN metadata TEXT;"),await this.executeSql("ALTER TABLE audit_logs ADD COLUMN resource_id TEXT;"),await this.executeSql(`
+      CREATE TABLE IF NOT EXISTS sessions (
+        id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        token TEXT UNIQUE NOT NULL,
+        refresh_token TEXT,
+        ip_address TEXT,
+        user_agent TEXT,
+        expires_at TEXT NOT NULL,
+        created_at TEXT DEFAULT CURRENT_TIMESTAMP
+      );
+    `),await this.executeSql(`
+      CREATE TABLE IF NOT EXISTS audit_logs (
+        id TEXT PRIMARY KEY,
+        action TEXT NOT NULL,
+        user_id TEXT,
+        user_email TEXT,
+        role TEXT,
+        resource TEXT NOT NULL,
+        details TEXT,
+        ip_address TEXT,
+        status TEXT,
+        timestamp TEXT DEFAULT CURRENT_TIMESTAMP
+      );
+    `);}async hashPassword(e){return Kt__default.default.hashSync(e,10)}async verifyPassword(e,t){let s=await this.findUserByEmail(e);return !s||!s.passwordHash?null:Kt__default.default.compareSync(t,s.passwordHash)?s:null}async findUserByEmail(e){let t=await this.getOne("SELECT * FROM users WHERE LOWER(email) = LOWER(?) LIMIT 1",[e]);return t?this.mapUser(t):null}async findUserById(e){let t=await this.getOne("SELECT * FROM users WHERE id = ? LIMIT 1",[e]);return t?this.mapUser(t):null}async createUser(e){let t=`user-${Date.now()}-${Math.random().toString(36).substring(2,9)}`,s=await this.hashPassword(e.password),r=e.email.toLowerCase(),a=e.role||"customer",n=new Date().toISOString();await this.executeSql("INSERT INTO users (id, email, password_hash, name, role, avatar, tenant_id, metadata, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[t,r,s,e.name||null,a,e.avatar||null,e.tenantId||null,e.metadata?JSON.stringify(e.metadata):null,n,n]);let c=await this.findUserById(t);if(!c)throw new Error("Failed to create user in D1");return c}async updateUser(e,t){if(!await this.findUserById(e))return null;let r=["updated_at = ?"],a=[new Date().toISOString()];return t.email&&(r.push("email = ?"),a.push(t.email.toLowerCase())),t.name!==void 0&&(r.push("name = ?"),a.push(t.name)),t.password&&(r.push("password_hash = ?"),a.push(await this.hashPassword(t.password))),t.passwordHash&&(r.push("password_hash = ?"),a.push(t.passwordHash)),t.role&&(r.push("role = ?"),a.push(t.role)),t.avatar!==void 0&&(r.push("avatar = ?"),a.push(t.avatar)),t.tenantId!==void 0&&(r.push("tenant_id = ?"),a.push(t.tenantId)),t.metadata!==void 0&&(r.push("metadata = ?"),a.push(t.metadata?JSON.stringify(t.metadata):null)),a.push(e),await this.executeSql(`UPDATE users SET ${r.join(", ")} WHERE id = ?`,a),this.findUserById(e)}async deleteUser(e){return await this.executeSql("DELETE FROM users WHERE id = ?",[e]),true}async createSession(e,t){let s=`sess-${Date.now()}-${Math.random().toString(36).substring(2,9)}`,r=`token-${Date.now()}-${Math.random().toString(36).substring(2,16)}`,a=new Date(Date.now()+this.sessionTTL*1e3).toISOString(),n=new Date().toISOString();return await this.executeSql("INSERT INTO sessions (id, user_id, token, expires_at, created_at, ip_address, user_agent) VALUES (?, ?, ?, ?, ?, ?, ?)",[s,e,r,a,n,t?.ipAddress||null,t?.userAgent||null]),{id:s,userId:e,token:r,expiresAt:a,createdAt:n,ipAddress:t?.ipAddress,userAgent:t?.userAgent}}async findSessionByToken(e){let t=await this.getOne("SELECT * FROM sessions WHERE token = ? LIMIT 1",[e]);return t?{id:t.id,userId:t.user_id||t.userId,token:t.token,expiresAt:t.expires_at||t.expiresAt,createdAt:t.created_at||t.createdAt,ipAddress:t.ip_address||t.ipAddress,userAgent:t.user_agent||t.userAgent}:null}async findSessionByRefreshToken(e){let t=await this.getOne("SELECT * FROM sessions WHERE refresh_token = ? LIMIT 1",[e]);return t?{id:t.id,userId:t.user_id||t.userId,token:t.token,refreshToken:t.refresh_token,expiresAt:t.expires_at||t.expiresAt,createdAt:t.created_at||t.createdAt}:null}async deleteSession(e){return await this.executeSql("DELETE FROM sessions WHERE id = ?",[e]),true}async deleteUserSessions(e){return await this.executeSql("DELETE FROM sessions WHERE user_id = ?",[e]),1}async hasAnyUsers(){return ((await this.getOne("SELECT COUNT(*) as count FROM users"))?.count||0)>0}async createEmailVerificationToken(e){return {token:`verify-${Date.now()}`,expiresAt:new Date(Date.now()+864e5)}}async verifyEmailToken(e){return {success:true}}async createPasswordResetToken(e){return {token:`reset-${Date.now()}`,expiresAt:new Date(Date.now()+36e5)}}async resetPasswordWithToken(e,t){return {success:true}}async findAuditLogs(e){let s=(await this.executeSql("SELECT * FROM audit_logs ORDER BY timestamp DESC LIMIT ?",[e.limit||50])).map(r=>({id:r.id,action:r.action,userId:r.user_id||r.userId,userEmail:r.user_email||r.userEmail,role:r.role,resource:r.resource,resourceId:r.resource_id||r.resourceId,ipAddress:r.ip_address||r.ipAddress,userAgent:r.user_agent||r.userAgent,success:!!(r.success??true),error:r.error||void 0,metadata:r.details?JSON.parse(r.details):void 0,timestamp:new Date(r.timestamp||Date.now())}));return {logs:s,total:s.length}}async createAuditLog(e){let t=`audit-${Date.now()}-${Math.random().toString(36).substring(2,9)}`,s=new Date;return await this.executeSql("INSERT INTO audit_logs (id, action, user_id, user_email, role, resource, details, ip_address, status, timestamp) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[t,e.action,e.userId||null,e.userEmail||null,e.role||null,e.resource,e.metadata?JSON.stringify(e.metadata):null,e.ipAddress||null,e.success?"success":"failed",s.toISOString()]),{id:t,timestamp:s,...e}}mapUser(e){return {id:e.id,email:e.email,name:e.name||void 0,passwordHash:e.password_hash||e.passwordHash||void 0,role:e.role,avatar:e.avatar||void 0,tenantId:e.tenant_id||e.tenantId||void 0,metadata:e.metadata?typeof e.metadata=="string"?JSON.parse(e.metadata):e.metadata:void 0,emailVerified:!!(e.email_verified||e.emailVerified),locked:!!e.locked,lastLogin:e.last_login||e.lastLogin||void 0,failedLoginAttempts:Number(e.failed_login_attempts||e.failedLoginAttempts||0),createdAt:e.created_at||e.createdAt||new Date().toISOString(),updatedAt:e.updated_at||e.updatedAt||new Date().toISOString()}}};async function Ar(i,e){if("dialect"in i&&i.dialect==="postgres")return new chunk3A5UO6OQ_cjs.a({db:i.client});if("dialect"in i&&i.dialect==="sqlite")return new Ie({db:i.client});if("dialect"in i&&i.dialect==="mongodb"){let s=i;return new chunkNBBAMC2X_cjs.a({db:()=>s.db,adapter:s})}let t=Ae.resolve(e,"data","auth.db");return new chunkPW6Y5MQL_cjs.a({path:process.env.KYRO_AUTH_DB_PATH||t})}async function Ht(i){let{registry:e,db:t,authSecret:s,authAdapter:r,checkSession:a,user:n,tenantId:c,cors:p,webhookService:o,settings:u}=i,d=new hono.Hono;function m(f){if(Array.isArray(f))return f.map(m);if(f!==null&&typeof f=="object"){let k={};for(let L in f)L!=="attrs"&&(k[L]=m(f[L]));return k}return f}d.use("*",async(f,k)=>{await k();let L=f.req.header("referer")||"";if(!(f.req.header("x-kyro-admin")==="true"||L.includes("/admin"))&&f.res.status<400){let C=f.res.headers.get("Content-Type");if(C&&C.includes("application/json"))try{let M=await f.res.clone().json(),N=m(M);f.res=f.json(N,f.res.status);}catch{}}}),d.onError((f,k)=>{if(f instanceof I||f&&typeof f.statusCode=="number")return k.json({error:f.message,...f.metadata},f.statusCode||f.status||500);if(f.name==="ZodError")return k.json({error:`Validation failed: ${chunkYOJOVQIH_cjs.a(f.errors)}`,details:f.errors},400);console.error("[Kyro API Error]",f);let L=process.env.NODE_ENV==="production";return k.json({error:L?"Internal Server Error":f.message||"Internal Server Error"},500)});for(let f of e.getPlugins())typeof f.serverMiddleware=="function"&&f.serverMiddleware(d);let y=u?.access?.apiAccess,l=u?.access?.enablePublicAccess??false,g=u?.access?.defaultCollectionAccess??"none";y?.requireAuth;let T=process.cwd(),S=T.endsWith("admin")?Ae.resolve(T,".."):T,w=r||await Ar(t,S),E=yt({db:t,userLookup:async f=>await w.findUserById(f)||null}),U=y?.cors?.allowedOrigins,v=p?.origins,O=Array.isArray(U)?U:typeof U=="string"&&U?U.split(`
+`).map(f=>f.trim()).filter(Boolean):[],R=O.length>0?O:v||[];(R.length>0||p)&&d.use("*",async(f,k)=>{let L=f.req.header("Origin")||"*";if(R.length>0&&!R.includes(L))throw new I(403,"Origin not allowed");let q=R.length>0?L:"*";if(f.header("Access-Control-Allow-Origin",q),f.header("Access-Control-Allow-Methods","GET, POST, PATCH, DELETE, OPTIONS"),f.header("Access-Control-Allow-Headers","Content-Type, Authorization, X-API-Key"),p?.credentials&&f.header("Access-Control-Allow-Credentials","true"),f.req.method==="OPTIONS")return f.text("");await k();});let D=u?.access?.rateLimiting,P;if(D?.enabled){let f=D.maxRequests||100,k=D.windowMs||6e4;P=new fe({"api:general":{window:k,max:f}}),d.use("/api/*",async(L,q)=>{if(!P)return q();let C=L.req.header("CF-Connecting-IP")||L.req.header("X-Forwarded-For")?.split(",")[0]?.trim()||L.req.header("X-Real-IP")||"unknown",x=await P.check("api:general",C);if(L.header("X-RateLimit-Limit",String(f)),L.header("X-RateLimit-Remaining",String(x.remaining)),L.header("X-RateLimit-Reset",String(x.resetAt)),!x.allowed)return L.json({error:"Too many requests",retryAfter:x.retryAfter},429);await q();});}let K=new he({redis:w,jwtSecret:s||"change-me",baseUrl:process.env.KYRO_BASE_URL||"http://localhost:4321",rateLimiter:P});chunk2I2AXTKY_cjs.q.fromConfig(t).then(f=>{f&&(K.email=f);}).catch(f=>{console.error("[Email] Failed to initialize transport from config:",f);}),ze(d,K,t,e,E,n,c,l,g);let W=typeof e.hasCollection=="function"&&e.hasCollection("users")?e.getCollection("users"):(()=>{try{return e.getCollection("users")}catch{return chunk34LCWI5X_cjs.a}})();return d.get("/api/users",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=await H(W,"read",f.req.raw,k,L,void 0,l,g);if(!q.allowed)throw new I(q.status||403,q.error||"Access denied");let C=parseInt(f.req.query("page")||"1"),x=Math.min(parseInt(f.req.query("limit")||"10"),100),M=f.req.query("search")||void 0,N=[],F=0;if(typeof w.findUsers=="function"){let B=await w.findUsers({page:C,limit:x,search:M});N=B.users||[],F=B.total||0;}else {let B=await t.find({collection:"users",page:C,limit:x,where:M?{email:{contains:M}}:{},tenantId:L});N=B.docs||[],F=B.totalDocs||0;}return f.json({docs:N,totalDocs:F,limit:x,totalPages:Math.ceil(F/x)||1,page:C,pagingCounter:(C-1)*x+1,hasPrevPage:C>1,hasNextPage:C<Math.ceil(F/x),prevPage:C>1?C-1:null,nextPage:C<Math.ceil(F/x)?C+1:null})}),d.get("/api/users/:id",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=f.req.param("id"),C=await w.findUserById(q);if(!C)throw new I(404,"User not found");return f.json({data:C})}),d.post("/api/users",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=await H(W,"create",f.req.raw,k,L,void 0,l,g);if(!q.allowed)throw new I(q.status||403,q.error||"Access denied");let C=await f.req.json();if(!C.email||!C.password)throw new I(400,"Email and password are required");if(await w.findUserByEmail(C.email))throw new I(400,"Email already in use");let M=C.role||"customer";if(M!=="customer"&&k?.role!=="super_admin")throw new I(403,"Forbidden: Only super_admin can assign administrative roles");let N=await w.createUser({email:C.email,password:C.password,name:C.name,role:M,avatar:C.avatar,tenantId:C.tenantId});return k&&w?.createAuditLog({action:"user_create",userId:k.id,resource:"users",resourceId:N.id,success:true}),f.json({data:N,message:"User created successfully"},201)}),d.patch("/api/users/:id",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=await H(W,"update",f.req.raw,k,L,void 0,l,g);if(!q.allowed)throw new I(q.status||403,q.error||"Access denied");let C=f.req.param("id"),x=await f.req.json(),M=await w.findUserById(C);if(!M)throw new I(404,"User not found");let N={};if(x.name!==void 0&&(N.name=x.name),x.email!==void 0&&(N.email=x.email),x.role!==void 0&&x.role!==M.role){if(k?.role!=="super_admin")throw new I(403,"Forbidden: Only super_admin can modify user roles");N.role=x.role;}x.avatar!==void 0&&(N.avatar=typeof x.avatar=="object"&&x.avatar!==null?x.avatar.id||String(x.avatar):x.avatar),x.tenantId!==void 0&&(N.tenantId=x.tenantId),x.emailVerified!==void 0&&(N.emailVerified=x.emailVerified),x.locked!==void 0&&(N.locked=x.locked),x.failedLoginAttempts!==void 0&&(N.failedLoginAttempts=x.failedLoginAttempts),x.lastLogin!==void 0&&(N.lastLogin=x.lastLogin);let F=await w.updateUser(C,N);if(!F)throw new I(500,"User update failed");return k&&(w?.createAuditLog({action:"user_update",userId:k.id,resource:"users",resourceId:C,success:true}),x.role&&M.role!==x.role&&w?.createAuditLog({action:"role_change",userId:k.id,resource:"users",resourceId:C,success:true,metadata:{oldRole:M.role,newRole:x.role}})),f.json({data:F,message:"User updated successfully"})}),d.delete("/api/users/:id",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=await H(W,"delete",f.req.raw,k,L,void 0,l,g);if(!q.allowed)throw new I(q.status||403,q.error||"Access denied");let C=f.req.param("id");if(k&&k.id===C)throw new I(403,"You cannot delete your own account");let x=await w.findUserById(C);if(!x)throw new I(404,"User not found");if(!await w.deleteUser(C))throw new I(500,"User deletion failed");return k&&w?.createAuditLog({action:"user_delete",userId:k.id,resource:"users",resourceId:C,success:true}),f.json({data:x,message:"User deleted successfully"})}),d.get("/api/auth/audit-logs",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=e.getCollection("audit_logs");if(q){let V=await H(q,"read",f.req.raw,k,L,void 0,l,g);if(!V.allowed)throw new I(V.status||403,V.error||"Access denied")}else if(!k)throw new I(401,"Authentication required");let C=parseInt(f.req.query("page")||"1"),x=Math.min(parseInt(f.req.query("limit")||"50"),100),M=f.req.query("action")||void 0,N=f.req.query("userId")||void 0,F=f.req.query("resource")||void 0,B=await w.findAuditLogs({action:M,userId:N,resource:F,limit:x,offset:(C-1)*x});return f.json({docs:B.logs,totalDocs:B.total,limit:x,totalPages:Math.ceil(B.total/x),page:C,pagingCounter:(C-1)*x+1,hasPrevPage:C>1,hasNextPage:C<Math.ceil(B.total/x),prevPage:C>1?C-1:null,nextPage:C<Math.ceil(B.total/x)?C+1:null})}),Me(d,i,E),d.get("/api/storage-status",async f=>{let{user:k}=await $(f.req.raw,E,n,c);if(!k)throw new I(401,"Authentication required");let L=typeof globalThis.STORAGE_BUCKET<"u"||typeof f.env?.STORAGE_BUCKET<"u",q=L,C=L?"cloudflare_r2":"local";if(t)try{let x=t.prepare('SELECT provider FROM "_globals_storage-settings" LIMIT 1').get();x&&x.provider&&(q=!0,C=x.provider==="aws"?"s3":x.provider);}catch{try{let x=await t.findOne({collection:"_globals_storage-settings",where:{},draft:!0});x&&x.provider&&(q=!0,C=x.provider==="aws"?"s3":x.provider);}catch{}}return f.json({provider:C,configured:q,usage:0,limit:"unlimited"})}),d.get("/api/plugins",async f=>{let{user:k}=await $(f.req.raw,E,n,c);if(!k)throw new I(401,"Authentication required");let L=e.getPlugins(),q=e.storageProviders,C=await Promise.all(L.map(async x=>{let M=true,N=x.name,F={};try{let X=await t.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});X&&X.states&&(F=X.states);}catch{}F[N]!==void 0&&(M=F[N]),q.setPluginEnabled(N,M);let B=N.replace(/^@[^/]+\//,"");B=B.replace(/^(plugin|kyro)-/,"");let V={ai:"AI",seo:"SEO",s3:"S3",aws:"AWS",api:"API",ui:"UI",ftp:"FTP"};if(B=B.split("-").map(X=>{let pe=X.toLowerCase();return V[pe]?V[pe]:X.charAt(0).toUpperCase()+X.slice(1)}).join(" "),B.toLowerCase().startsWith("storage ")){let X=B.split(" ");X.length===2&&(B=`${X[1]} Storage`);}return {id:N,name:x.displayName||B,version:x.version||"1.0.0",description:x.description||"",enabled:M,status:M?"active":"disabled"}}));return f.json(C)}),d.put("/api/plugins/:name/toggle",async f=>{let{user:k}=await $(f.req.raw,E,n,c);if(!k)throw new I(401,"Authentication required");let L=f.req.param("name"),q=e.storageProviders,x=!q.isPluginEnabled(L),M=[];if(!x)for(let F of q.getAll())F.pluginName===L&&M.push(F.type);if(!(f.req.query("force")==="1")&&!x&&M.length>0){let F="local";try{let B=t?.prepare?.('SELECT provider FROM "_globals_storage-settings" LIMIT 1')?.get();B?.provider&&(F=B.provider);}catch{try{let B=await t?.findOne?.({collection:"_globals_storage-settings",where:{},draft:!0});B?.provider&&(F=B.provider);}catch{}}if(M.includes(F))return f.json({error:`Cannot disable "${L}" \u2014 storage provider "${F}" is currently active. Switch to Local storage first.`,requiresAction:true,activeProvider:F},409)}try{let F={},B="global",V=await t.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});V&&(F=V.states||{},B=V.id),F[L]=x,V?await t.update({collection:"_globals_plugin-settings",id:B,data:{states:F}}):await t.create({collection:"_globals_plugin-settings",data:{states:F,id:"global"}});}catch(F){console.warn(`[Plugins] Could not persist state for "${L}":`,F);}return q.setPluginEnabled(L,x),f.json({name:L,enabled:x})}),d.get("/api/health",f=>f.json({status:"ok",version:"0.13.0",collections:e.getCollectionSlugs(),timestamp:new Date().toISOString()})),d.get("/api/metrics",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c);if(!k)throw new I(401,"Authentication required");let q=k.role==="admin"||k.role==="super_admin",x=e.getCollectionSlugs().filter(G=>!["users","audit_logs","media","_globals_access-settings","_globals_brand-settings"].includes(G)&&!G.startsWith("_globals_")).filter(G=>q||chunkKOSR7235_cjs.a(k,`${G}:read`)),M=0,N={};await Promise.all(x.map(async G=>{try{let Je=(await t.find({collection:G,where:{},limit:1,page:1,tenantId:L})).totalDocs??0;M+=Je,N[G]=Je;}catch{}}));let F=0;try{F=(await t.find({collection:"media",where:{},limit:1,page:1,tenantId:L})).totalDocs??0;}catch{}let B=0;try{B=(await t.find({collection:"users",where:{},limit:1,page:1,tenantId:L})).totalDocs??0;}catch{}let V=0;try{if(o){let G=await o.getWebhooks();V=Array.isArray(G)?G.length:0;}}catch{}let X=0;try{X=(await t.find({collection:chunkDCFOVCJX_cjs.a,where:{},limit:1,page:1,tenantId:L})).totalDocs??0;}catch{}let pe=M+F+B;return f.json({totalDocuments:M,totalMedia:q||chunkKOSR7235_cjs.a(k,"media:read")?F:void 0,totalUsers:q||chunkKOSR7235_cjs.a(k,"users:read")?B:void 0,totalWebhooks:q?V:void 0,totalApiKeys:q?X:void 0,totalStoredRecords:pe,collectionCounts:N,collections:x.length,timestamp:new Date().toISOString()})}),Ke(d,i,E),He(d,i,E),ke(d,i,E),Pe(d,i,E),Xe(d,i),d.onError((f,k)=>{let L=Number(f?.statusCode||f?.status||500);return L>=500&&console.error(`[API Error] ${k.req.method} ${k.req.path}:`,f),k.json({error:f.message||"Internal server error",code:L>=500?"INTERNAL_ERROR":"BAD_REQUEST"},L)}),d}async function Tr(i,e,t){return Ht({registry:i,db:e,authSecret:t?.authSecret,user:t?.user,req:t?.req,tenantId:t?.tenantId,cors:t?.cors,webhookService:t?.webhookService})}
+exports.a=pr;exports.b=mr;exports.c=Pt;exports.d=ne;exports.e=Oe;exports.f=fe;exports.g=wt;exports.h=Cr;exports.i=bt;exports.j=he;exports.k=qt;exports.l=Te;exports.m=Ie;exports.n=Ht;exports.o=Tr;

package/dist/chunk-HCM2G674.cjs

@@ -0,0 +1,20 @@
+'use strict';var r=require('path'),h=require('fs');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var r__default=/*#__PURE__*/_interopDefault(r);var h__default=/*#__PURE__*/_interopDefault(h);var l=o=>{let s=r__default.default.join(process.cwd(),"node_modules","@kyro-cms","core"),e=r__default.default.resolve(s,"src",`${o}.ts`);return h__default.default.existsSync(e)?e:r__default.default.resolve(s,"dist",`${o}.js`)},g=l("api-handler"),E=l("api-handler-graphql"),A=l("api-handler-trpc"),m=["@kyro-cms/core","@kyro-cms/admin","@kyro-cms/astro","@kyro-cms/ai"],P=["@kyro-cms/connect"],x=[...m,...P],S=["better-sqlite3","pg","mongodb","ioredis","sharp","ssh2","cpu-features","ssh2-sftp-client","nodemailer","jsonwebtoken","@mapbox/node-pre-gyp","mock-aws-s3","aws-sdk","nock","cloudflare:workers"],R=["crypto","node:crypto","module","node:module","fs","node:fs","fs/promises","node:fs/promises","path","node:path","util","node:util","stream","node:stream","events","node:events","url","node:url","http","node:http","https","node:https","os","node:os","child_process","node:child_process","assert","node:assert","zlib","node:zlib","buffer","node:buffer"],f=[...m,...S],N=[...x,...R,...S];function O(o={}){let{configPath:s="./kyro.config.ts",apiPath:e="/api",adminPath:a="/admin",admin:k=true,enableGraphQL:c=false,enableTRPC:p=false,enableWebSocket:d=false}=o;return {name:"@kyro-cms/core",hooks:{"astro:config:setup":async({config:_,updateConfig:y,injectRoute:i,logger:n,addDevToolbarApp:v})=>{if(n.info(`Setting up Kyro CMS (API: ${e}, Admin: ${a})`),e===a)throw new Error(`Kyro CMS: apiPath and adminPath cannot be the same ("${e}")`);let u=r__default.default.resolve(_.root.pathname,s),b=u;h__default.default.existsSync(u)||n.warn(`Kyro config file not found at ${s}. The API will fail to boot if collections are needed.`),y({security:{checkOrigin:false},vite:{ssr:{external:N},build:{rollupOptions:{external:f}},optimizeDeps:{exclude:f},server:{watch:{ignored:["**/*.db","**/*.db-*","**/data/**","**/public/uploads/**","**/.kyro/**"]}},plugins:[{name:"use-sync-external-store-shim-fix",enforce:"pre",resolveId(t){if(t==="use-sync-external-store/shim"||t==="use-sync-external-store/shim/index.js")return "\0virtual:use-sync-external-store-shim";if(t==="use-sync-external-store/shim/with-selector"||t==="use-sync-external-store/shim/with-selector.js")return "\0virtual:use-sync-external-store-shim-with-selector"},load(t){if(t==="\0virtual:use-sync-external-store-shim")return 'export { useSyncExternalStore } from "react";';if(t==="\0virtual:use-sync-external-store-shim-with-selector")return `
+import { useSyncExternalStore, useMemo } from "react";
+export function useSyncExternalStoreWithSelector(subscribe, getSnapshot, getServerSnapshot, selector, isEqual) {
+  const memoizedSelector = useMemo(() => {
+    let last, lastSnap, hasMemo = false;
+    return (snap) => {
+      if (!hasMemo || !Object.is(lastSnap, snap)) {
+        const next = selector(snap);
+        if (!hasMemo || !(isEqual ? isEqual(last, next) : Object.is(last, next))) {
+          last = next; lastSnap = snap; hasMemo = true;
+        }
+      }
+      return last;
+    };
+  }, [selector, isEqual]);
+  const getSelection = () => memoizedSelector(getSnapshot());
+  const getServerSelection = getServerSnapshot != null ? () => memoizedSelector(getServerSnapshot()) : undefined;
+  return useSyncExternalStore(subscribe, getSelection, getServerSelection);
+}
+`}}],resolve:{alias:{debug:"debug/src/node.js","kyro:config":b}},define:{__KYRO_API_PATH__:JSON.stringify(e),__KYRO_ADMIN_PATH__:JSON.stringify(a),__KYRO_ENABLE_GRAPHQL__:JSON.stringify(c),__KYRO_ENABLE_TRPC__:JSON.stringify(p),__KYRO_ENABLE_WS__:JSON.stringify(d)}}}),i({pattern:`${e}/[...path]`,entrypoint:g}),c&&(i({pattern:`${e}/graphql`,entrypoint:E}),n.info(`GraphQL endpoint enabled at ${e}/graphql`)),p&&(i({pattern:`${e}/trpc/[...path]`,entrypoint:A}),n.info(`tRPC endpoint enabled at ${e}/trpc`)),d&&n.info("WebSocket support enabled (auto-starts at first request)");}}}}exports.a=O;

package/dist/chunk-I22MSXGL.js

@@ -0,0 +1,2 @@
+if (typeof window === "undefined") { const { createRequire } = await import(/* @vite-ignore */ 'module'); createRequire(import.meta.url); }
+var e={slug:"users",label:"Users",auth:true,fields:[{name:"name",type:"text",label:"Name"},{name:"email",type:"email",required:true},{name:"passwordHash",type:"text",label:"Password Hash",admin:{hidden:true}},{name:"role",type:"select",options:[{label:"Super Admin",value:"super_admin"},{label:"Admin",value:"admin"},{label:"Editor",value:"editor"},{label:"Author",value:"author"},{label:"Customer",value:"customer"},{label:"Guest",value:"guest"}],required:true},{name:"avatar",type:"upload",relationTo:"media",label:"Profile Picture"},{name:"tenantId",type:"text",label:"Tenant"},{name:"emailVerified",type:"checkbox",label:"Email Verified"},{name:"locked",type:"checkbox"},{name:"lastLogin",type:"date",time:true,label:"Last Login",admin:{readOnly:true}},{name:"failedLoginAttempts",type:"number",label:"Failed Login Attempts",admin:{readOnly:true}},{name:"metadata",type:"json",label:"Metadata",admin:{hidden:true}}],timestamps:true,admin:{useAsTitle:"email",defaultColumns:["email","role","tenantId","lastLogin"]}},t={slug:"audit_logs",label:"Audit Logs",access:{create:()=>false,update:()=>false,delete:()=>false},fields:[{name:"action",type:"text",required:true},{name:"userId",type:"text",label:"User ID"},{name:"userEmail",type:"email",label:"User Email"},{name:"role",type:"text"},{name:"resource",type:"text",label:"Resource",required:true},{name:"resourceId",type:"text",label:"Resource ID"},{name:"changes",type:"json",label:"Changes"},{name:"ipAddress",type:"text",label:"IP Address"},{name:"userAgent",type:"text",label:"User Agent"},{name:"success",type:"checkbox"},{name:"error",type:"text",label:"Error"},{name:"metadata",type:"json",label:"Metadata"},{name:"timestamp",type:"date",time:true,required:true,admin:{readOnly:true}}],admin:{defaultColumns:["action","userEmail","resource","success","timestamp"]}},r={users:e,audit_logs:t};export{e as a,r as b};