@kyro-cms/core 0.13.5 → 0.13.6

package/dist/chunk-5RBGM5N5.js

@@ -0,0 +1,3 @@
+import {e,h}from'./chunk-3N34WXBS.js';import {a}from'./chunk-O4RKZQYQ.js';import {GraphQLScalarType,Kind,GraphQLObjectType,GraphQLString,GraphQLInputObjectType,GraphQLBoolean,GraphQLInt,GraphQLList,GraphQLNonNull,GraphQLSchema,GraphQLUnionType,GraphQLFloat}from'graphql';export{printSchema as e}from'graphql';if (typeof window === "undefined") { const { createRequire } = await import(/* @vite-ignore */ 'module'); createRequire(import.meta.url); }
+var N=class{db;tenantId;user;caches=new Map;pending=new Map;waiting=new Map;flushScheduled=false;constructor(t){this.db=t.db,this.tenantId=t.tenantId,this.user=t.user;}getCacheKey(t){return t}async load(t,e){let d=this.getCacheKey(t),y=this.caches.get(d);if(y||(y=new Map,this.caches.set(d,y)),y.has(e)&&!this.pending.get(d)?.has(e))return y.get(e);let s=this.pending.get(d);return s||(s=new Set,this.pending.set(d,s)),s.add(e),this.flushScheduled||(this.flushScheduled=true,queueMicrotask(()=>{this.flushScheduled=false,this.flushAll();})),new Promise(i=>{let o=this.waiting.get(`${d}:${e}`);o||(o=[],this.waiting.set(`${d}:${e}`,o)),o.push(i);})}async flushAll(){for(let[t,e]of this.pending){if(e.size===0)continue;let d=t,y=Array.from(e);this.pending.delete(t);try{let s=await this.db.find({collection:d,where:{id:{in:y}},limit:y.length,tenantId:this.tenantId}),i=this.caches.get(t)||new Map,o=new Map;for(let l of s.docs)o.set(l.id,l),i.set(l.id,l);for(let l of y){let w=this.waiting.get(`${t}:${l}`);if(w){let I=o.get(l);for(let m of w)m(I);this.waiting.delete(`${t}:${l}`);}}}catch(s){console.error(`[RelationLoader] Failed to batch load ${d}:`,s);for(let i of y){let o=this.waiting.get(`${t}:${i}`);if(o){for(let l of o)l(void 0);this.waiting.delete(`${t}:${i}`);}}}}}async loadMany(t,e){return Promise.all(e.map(d=>this.load(t,d)))}resolveOne(t,e){return this.caches.get(this.getCacheKey(t))?.get(e)}};var q=new GraphQLScalarType({name:"JSON",description:"Arbitrary JSON value",serialize(n){return n},parseValue(n){return n},parseLiteral(n){switch(n.kind){case Kind.STRING:return n.value;case Kind.INT:case Kind.FLOAT:return parseFloat(n.value);case Kind.BOOLEAN:return n.value;case Kind.OBJECT:{let t={};for(let e of n.fields)t[e.name.value]=q.parseLiteral(e.value);return t}case Kind.LIST:return n.values.map(t=>q.parseLiteral(t));case Kind.NULL:return null;default:return null}}});function oe(n){return t=>{let e=0;return {Field(){e++,e>n&&t.reportError(new Error(`Query exceeds max depth of ${n}`));},leaveField(){e--;}}}}function L(n){return n.split(/[-_]/).map(t=>t.charAt(0).toUpperCase()+t.slice(1)).join("")}function Z(n){let t=L(n);return t.charAt(0).toLowerCase()+t.slice(1)}function O(n){return n.endsWith("s")&&n.length>1?n.slice(0,-1):n}async function P(n,t,e$1){let d=n.access?.[t];if(e$1.apiKey){if(e$1.apiKey.permissions?.length>0){let s=n.slug,o=`${s}:${t==="read"?"read":t==="create"?"create":"update"}`;return !e(e$1.apiKey.permissions,o)&&!e(e$1.apiKey.permissions,`${s}:admin`)?{allowed:false}:{allowed:true}}if(d){let s=await h(d,{req:e$1.req,user:e$1.user,tenantId:e$1.tenantId});return typeof s=="boolean"?{allowed:s}:{allowed:true,extraWhere:s}}return {allowed:true}}if(e$1.user){let s=n.slug,o=`${s}:${t==="read"?"read":t==="create"?"create":t==="update"?"update":"delete"}`;if(!a({id:e$1.user.id,email:e$1.user.email,role:e$1.user.role},o)&&!a({id:e$1.user.id,email:e$1.user.email,role:e$1.user.role},`${s}:admin`)&&!d)return {allowed:false}}if(!d)return e$1.user?{allowed:true}:{allowed:false};let y=await h(d,{req:e$1.req,user:e$1.user,tenantId:e$1.tenantId});return typeof y=="boolean"?{allowed:y}:{allowed:true,extraWhere:y}}async function ee(n,t,e$1){let d=n.access?.[t];if(e$1.apiKey){if(e$1.apiKey.permissions?.length>0){let s=n.slug,i=`${s}:${t}`;return !e(e$1.apiKey.permissions,i)&&!e(e$1.apiKey.permissions,`${s}:admin`)&&!e(e$1.apiKey.permissions,`${s}:*`)?{allowed:false}:{allowed:true}}if(d){let s=await h(d,{req:e$1.req,user:e$1.user,tenantId:e$1.tenantId});return {allowed:typeof s=="boolean"?s:true}}return {allowed:true}}if(!d){if(!e$1.user)return {allowed:false};let s=e$1.user.role;return s==="super_admin"||s==="admin"?{allowed:true}:{allowed:false}}let y=await h(d,{req:e$1.req,user:e$1.user,tenantId:e$1.tenantId});return typeof y=="boolean"?{allowed:y}:{allowed:true}}function ne(n,t){return n?n.startsWith("http://")||n.startsWith("https://")||n.startsWith("blob:")||n.startsWith("data:")?n:`${(process.env.KYRO_BASE_URL||t||"http://localhost:4321").replace(/\/+$/,"")}${n.startsWith("/")?"":"/"}${n}`:null}function K(n,t){return n&&(n.url&&(n.url=ne(n.url,t)),n.thumbnailUrl&&(n.thumbnailUrl=ne(n.thumbnailUrl,t)),n)}function U(n,t,e,d=false,y="Root",s=new Map){switch(n.type){case "text":case "email":case "password":case "textarea":case "color":case "code":case "markdown":case "date":case "select":case "radio":return n.hasMany?new GraphQLList(GraphQLString):GraphQLString;case "list":return new GraphQLList(GraphQLString);case "upload":{let i=n;if(d)return i.hasMany?new GraphQLList(GraphQLString):GraphQLString;if(i.relationTo&&e?.[i.relationTo]){let o=e[i.relationTo];return i.hasMany?new GraphQLList(o):o}return q}case "image":{if(d)return GraphQLString;let i=n;return i.relationTo&&e?.[i.relationTo]?e[i.relationTo]:q}case "number":{let i=n.integer?GraphQLInt:GraphQLFloat;return n.hasMany?new GraphQLList(i):i}case "checkbox":return GraphQLBoolean;case "json":case "richtext":return q;case "blocks":{if(d)return q;let i=n,o=(i.blocks||[]).map(I=>{let m=`Block_${L(I.slug)}`,u=s.get(m);return u||(u=new GraphQLObjectType({name:m,fields:()=>{let f=k(I.fields||[],t,e,m,s);return f.blockType={type:GraphQLString},f.name={type:GraphQLString},f}}),s.set(m,u)),u});if(o.length===0)return q;let l=`${y}_${L(i.name)}_Blocks`,w=s.get(l);return w||(w=new GraphQLUnionType({name:l,types:o,resolveType:I=>`Block_${L(I.blockType||I.type)}`}),s.set(l,w)),new GraphQLList(w)}case "tabs":{if(d)return q;let i=n,o=`${y}_${L(i.name)}_Tabs`,l=s.get(o);return l||(l=new GraphQLObjectType({name:o,fields:()=>k(i.tabs?.flatMap(w=>w.fields||[])||[],t,e,o,s)}),s.set(o,l)),l}case "relationship":{let i=n.relationTo;if((i==="*"||Array.isArray(i)&&i.includes("*"))&&(i=t.getCollections().map(o=>o.slug)),typeof i=="string"){if(d)return n.hasMany?new GraphQLList(GraphQLString):GraphQLString;if(e?.[i])return n.hasMany?new GraphQLList(e[i]):e[i];let o=t.getCollection(i);if(o)return new GraphQLObjectType({name:`${L(i)}Ref`,fields:()=>({id:{type:GraphQLString},...J(o,t,e,s)})})}else if(Array.isArray(i)){if(d)return n.hasMany?new GraphQLList(q):q;let o=i.map(u=>{if(e?.[u])return e[u];let f=t.getCollection(u);if(f){let c=s.get(`${L(u)}Ref`);return c||(c=new GraphQLObjectType({name:`${L(u)}Ref`,fields:()=>({id:{type:GraphQLString},...J(f,t,e,s)})}),s.set(`${L(u)}Ref`,c)),c}return null}).filter(Boolean);if(o.length===0)return q;let l=`${y}_${L(n.name||"Ref")}_PolyUnion`,w=s.get(l);w||(w=new GraphQLUnionType({name:l,types:o,resolveType:u=>{if(u.__collection&&u.__collection!=="*")return e?.[u.__collection]?e[u.__collection].name:`${L(u.__collection)}Ref`}}),s.set(l,w));let I=`${y}_${L(n.name||"Ref")}_PolyWrapper`,m=s.get(I);return m||(m=new GraphQLObjectType({name:I,fields:{relationTo:{type:GraphQLString},value:{type:w}}}),s.set(I,m)),n.hasMany?new GraphQLList(m):m}return q}case "array":{if(d)return new GraphQLList(q);let i=n,o=`${y}_${L(i.name)}_ArrayItem`,l=s.get(o);return l||(l=new GraphQLObjectType({name:o,fields:()=>{let w=k(i.fields||[],t,e,o,s);return w.id={type:GraphQLString},w}}),s.set(o,l)),new GraphQLList(l)}case "group":{if(d)return q;let i=n,o=`${y}_${L(i.name)}_Group`,l=s.get(o);return l||(l=new GraphQLObjectType({name:o,fields:()=>k(i.fields||[],t,e,o,s)}),s.set(o,l)),l}default:return GraphQLString}}function k(n,t,e,d,y=new Map){let s={};for(let i of n){if(i.type==="tabs"&&!i.name){for(let o of i.tabs||[]){let l=k(o.fields||[],t,e,d,y);Object.assign(s,l);}continue}if(i.type==="row"||i.type==="collapsible"){let o=k(i.fields||[],t,e,d,y);Object.assign(s,o);continue}if(i.name&&i.admin?.hidden!==true){let o=le(i,t,e,d,y);o&&(s[i.name]=o);}}return s}function J(n,t,e,d=new Map){return k(n.fields,t,e,L(O(n.slug)),d)}function le(n,t,e,d,y=new Map){if(!n.name)return null;let s=n.deprecated||void 0;if(n.type==="upload"){let o=U(n,t,e,false,d,y),l=n;return {type:o,description:n.admin?.description||n.label,deprecationReason:s,resolve:async(w,I,m)=>{let u=m?.relationLoader,f=w?.[l.name],c=m?.req?.url?new URL(m.req.url).origin:void 0;if(!f)return null;if(l.hasMany){let T=Array.isArray(f)?f:[];return Promise.all(T.map(async g=>{let G=typeof g=="string"?g:g?.id;if(!G||typeof g=="object"&&g?.url)return K(g,c);if(u){let S=u.resolveOne(l.relationTo,G);if(S)return K(S,c);let r=await u.load(l.relationTo,G);return r?K(r,c):null}return {id:G}}))}let b=typeof f=="string"?f:f?.id;if(!b||typeof f=="object"&&f?.url)return K(f,c);if(u){let T=u.resolveOne(l.relationTo,b);if(T)return K(T,c);let g=await u.load(l.relationTo,b);return g?K(g,c):null}return {id:b}}}}return n.type==="relationship"&&!n.hasMany?{type:U(n,t,e,false,d,y),description:n.admin?.description||n.label,deprecationReason:s,resolve:async(l,w,I)=>{let m=I?.relationLoader,u=n,f=l?.[u.name];if(!f)return null;let c=Array.isArray(u.relationTo)||u.relationTo==="*",b=c?f?.relationTo:u.relationTo,T=c?f?.value:f;if(c&&typeof f=="string"&&(b=u.relationTo[0],T=f),c&&b==="*")return null;if(m&&typeof T=="string"&&typeof b=="string"&&b!=="*"){let G=m.resolveOne(b,T);if(G)return c?{relationTo:b,value:{...G,__collection:b}}:G;let S=await m.load(b,T);return S?c?{relationTo:b,value:{...S,__collection:b}}:S:null}let g=typeof T=="object"&&T!==null?T:{id:T};return c?{relationTo:b,value:{...g,__collection:b}}:g}}:n.type==="relationship"&&n.hasMany?{type:U(n,t,e,false,d,y),description:n.admin?.description||n.label,deprecationReason:s,resolve:async(l,w,I)=>{let m=I?.relationLoader,u=n,f=l?.[u.name]||[];if(typeof f=="string")try{f=JSON.parse(f);}catch{}if(Array.isArray(f)||(f=[]),!f.length)return [];let c=Array.isArray(u.relationTo)||u.relationTo==="*";if(m){let b=[];for(let T of f){let g=c?T?.relationTo:u.relationTo,G=c?T?.value:T;if(c&&typeof T=="string"&&(g=u.relationTo[0],G=T),c&&g==="*")continue;if(typeof G=="string"&&typeof g=="string"&&g!=="*"){let r=m.resolveOne(g,G);if(r){b.push(c?{relationTo:g,value:{...r,__collection:g}}:r);continue}let $=await m.load(g,G);if($){b.push(c?{relationTo:g,value:{...$,__collection:g}}:$);continue}continue}let S=typeof G=="object"&&G!==null?G:{id:G};b.push(c?{relationTo:g,value:{...S,__collection:g}}:S);}return b}return f.map(b=>{let T=c?b?.relationTo:u.relationTo,g=c?b?.value:b;c&&typeof b=="string"&&(T=u.relationTo[0],g=b);let G=typeof g=="object"&&g!==null?g:{id:g};return c?{relationTo:T,value:{...G,__collection:T}}:G})}}:n.type==="blocks"?{type:U(n,t,e,false,d,y),description:n.admin?.description||n.label,deprecationReason:s,resolve:l=>{let w=l?.[n.name];if(typeof w=="string")try{w=JSON.parse(w);}catch{}return Array.isArray(w)?w.map(I=>I&&I.data&&I.type?{...I.data,id:I.id,type:I.type,blockType:I.type,name:I.name}:I):w}}:{type:U(n,t,e,false,d,y),description:n.admin?.description||n.label,deprecationReason:s,resolve:o=>{let l=o?.[n.name];if(typeof l=="string"&&["array","group","tabs","blocks","json","richtext","list"].includes(n.type))try{l=JSON.parse(l);}catch{}return l}}}function te(n){let{registry:t,db:e,user:d,req:y,tenantId:s,apiKey:i,settings:o}=n;if(o?.access?.apiAccess?.graphqlEnabled===false)throw new Error("GraphQL API is disabled");let w=t.getCollections(),I=t.getGlobals(),m={},u={},f=new Map;for(let r of w){m[r.slug]=new GraphQLObjectType({name:L(O(r.slug)),fields:()=>({id:{type:GraphQLString},...J(r,t,m,f),...r.timestamps?{createdAt:{type:GraphQLString},updatedAt:{type:GraphQLString}}:{},...r.tenantScoped?{tenantId:{type:GraphQLString}}:{}})});let $={};for(let A of r.fields)A.name&&A.name!=="id"&&($[A.name]={type:U(A,t,m,true)});u[r.slug]=new GraphQLInputObjectType({name:`${L(O(r.slug))}Input`,fields:()=>$});}let c={},b={};for(let r of I)c[r.slug]=new GraphQLObjectType({name:`${L(r.slug)}Global`,fields:()=>({id:{type:GraphQLString},...J({slug:r.slug,fields:r.fields},t,m)})}),b[r.slug]=new GraphQLInputObjectType({name:`${L(r.slug)}GlobalInput`,fields:()=>{let $={};for(let A of r.fields)A.name&&A.name!=="id"&&($[A.name]={type:U(A,t,m,true)});return $}});let T={};for(let r of w){let $=m[r.slug];$&&(T[Z(r.slug)]={type:new GraphQLObjectType({name:`${L(O(r.slug))}FindResult`,fields:{docs:{type:new GraphQLList($)},totalDocs:{type:GraphQLInt},page:{type:GraphQLInt},totalPages:{type:GraphQLInt},hasNextPage:{type:GraphQLBoolean},hasPrevPage:{type:GraphQLBoolean}}}),args:{where:{type:GraphQLString},sort:{type:GraphQLString},limit:{type:GraphQLInt},page:{type:GraphQLInt},draft:{type:GraphQLBoolean}},resolve:async(A,_,a)=>{let p=await P(r,"read",{user:a.user,req:a.req,tenantId:a.tenantId,apiKey:a.apiKey});if(!p.allowed)throw new Error("Access denied");a.tenantId&&e.setTenantContext({tenantId:a.tenantId,userId:a.user?.id??"",role:a.user?.role,isSuperAdmin:a.user?.role==="super_admin"});let R={};if(_.where)try{R=JSON.parse(_.where);}catch{}p.extraWhere&&(R={...R,...p.extraWhere});let F=_.draft??!!a.user;return e.find({collection:r.slug,where:R,sort:_.sort,limit:_.limit||10,page:_.page||1,tenantId:a.tenantId,draft:F})}},T[Z(O(r.slug))]={type:$,args:{id:{type:GraphQLString},slug:{type:GraphQLString},draft:{type:GraphQLBoolean}},resolve:async(A,_,a)=>{if(!_.id&&!_.slug)throw new Error("Either id or slug is required");if(!(await P(r,"read",{user:a.user,req:a.req,tenantId:a.tenantId,apiKey:a.apiKey})).allowed)throw new Error("Access denied");a.tenantId&&e.setTenantContext({tenantId:a.tenantId,userId:a.user?.id??"",role:a.user?.role,isSuperAdmin:a.user?.role==="super_admin"});let R=_.draft??!!a.user;return _.id?e.findByID({collection:r.slug,id:_.id,tenantId:a.tenantId,draft:R}):(await e.find({collection:r.slug,where:{slug:{equals:_.slug}},limit:1,page:1,tenantId:a.tenantId,draft:R})).docs?.[0]||null}},T[`count${L(r.slug)}`]={type:new GraphQLObjectType({name:`${L(O(r.slug))}Count`,fields:{totalDocs:{type:GraphQLInt}}}),args:{where:{type:GraphQLString}},resolve:async(A,_,a)=>{if(!(await P(r,"read",{user:a.user,req:a.req,tenantId:a.tenantId,apiKey:a.apiKey})).allowed)return {totalDocs:0};let R={};if(_.where)try{R=JSON.parse(_.where);}catch{}return {totalDocs:await e.count({collection:r.slug,where:R,tenantId:a.tenantId})}}});}for(let r of I){let $=c[r.slug];$&&(T[Z(O(r.slug))]={type:$,resolve:async(A,_,a)=>{if(!(await ee(r,"read",{user:a.user,req:a.req,tenantId:a.tenantId,apiKey:a.apiKey})).allowed)throw new Error("Access denied: cannot read global");return a.tenantId&&e.setTenantContext({tenantId:a.tenantId,userId:a.user?.id??"",role:a.user?.role,isSuperAdmin:a.user?.role==="super_admin"}),e.findOne({collection:`_globals_${r.slug}`,where:{},tenantId:a.tenantId})}});}let g=new GraphQLObjectType({name:"Query",fields:T}),G={};for(let r of w){let $=m[r.slug],A=u[r.slug];!$||!A||(G[`create${L(O(r.slug))}`]={type:new GraphQLObjectType({name:`${L(O(r.slug))}CreateResult`,fields:{doc:{type:$},message:{type:GraphQLString}}}),args:{data:{type:new GraphQLNonNull(A)}},resolve:async(_,a,p)=>{if(!(await P(r,"create",{user:p.user,req:p.req,tenantId:p.tenantId,apiKey:p.apiKey})).allowed)throw new Error("Access denied: cannot create");p.tenantId&&e.setTenantContext({tenantId:p.tenantId,userId:p.user?.id??"",role:p.user?.role,isSuperAdmin:p.user?.role==="super_admin"});let z=t.getCreateZodSchema(r.slug).parse(a.data);return {doc:await e.create({collection:r.slug,data:z,tenantId:p.tenantId}),message:"Created successfully"}}},G[`update${L(O(r.slug))}`]={type:new GraphQLObjectType({name:`${L(O(r.slug))}UpdateResult`,fields:{doc:{type:$},message:{type:GraphQLString}}}),args:{id:{type:new GraphQLNonNull(GraphQLString)},data:{type:new GraphQLNonNull(A)},baseUpdatedAt:{type:GraphQLString}},resolve:async(_,a,p)=>{if(!(await P(r,"update",{user:p.user,req:p.req,tenantId:p.tenantId,apiKey:p.apiKey})).allowed)throw new Error("Access denied: cannot update");if(p.tenantId&&e.setTenantContext({tenantId:p.tenantId,userId:p.user?.id??"",role:p.user?.role,isSuperAdmin:p.user?.role==="super_admin"}),a.baseUpdatedAt){let D=await e.findByID({collection:r.slug,id:a.id,tenantId:p.tenantId,draft:true});if(D&&D.updatedAt&&a.baseUpdatedAt!==D.updatedAt)throw new Error(`Revision conflict: document has changed since ${a.baseUpdatedAt}. Current updatedAt: ${D.updatedAt}`)}let z=t.getUpdateZodSchema(r.slug).parse(a.data);return {doc:await e.update({collection:r.slug,id:a.id,data:z,tenantId:p.tenantId}),message:"Updated successfully"}}},G[`delete${L(O(r.slug))}`]={type:new GraphQLObjectType({name:`${L(O(r.slug))}DeleteResult`,fields:{doc:{type:$},message:{type:GraphQLString}}}),args:{id:{type:new GraphQLNonNull(GraphQLString)}},resolve:async(_,a,p)=>{if(!(await P(r,"delete",{user:p.user,req:p.req,tenantId:p.tenantId,apiKey:p.apiKey})).allowed)throw new Error("Access denied: cannot delete");return p.tenantId&&e.setTenantContext({tenantId:p.tenantId,userId:p.user?.id??"",role:p.user?.role,isSuperAdmin:p.user?.role==="super_admin"}),{doc:await e.delete({collection:r.slug,id:a.id,tenantId:p.tenantId}),message:"Deleted successfully"}}});}for(let r of I){let $=b[r.slug];$&&(G[`update${L(r.slug)}`]={type:new GraphQLObjectType({name:`${L(r.slug)}UpdateResult`,fields:{doc:{type:c[r.slug]||GraphQLString},message:{type:GraphQLString}}}),args:{data:{type:new GraphQLNonNull($)}},resolve:async(A,_,a)=>{if(!(await ee(r,"update",{user:a.user,req:a.req,tenantId:a.tenantId,apiKey:a.apiKey})).allowed)throw new Error("Access denied: cannot update global");a.tenantId&&e.setTenantContext({tenantId:a.tenantId,userId:a.user?.id??"",role:a.user?.role,isSuperAdmin:a.user?.role==="super_admin"});let R=await e.findOne({collection:`_globals_${r.slug}`,where:{},tenantId:a.tenantId}),F;return R?F=await e.update({collection:`_globals_${r.slug}`,id:R.id,data:_.data,tenantId:a.tenantId}):F=await e.create({collection:`_globals_${r.slug}`,data:_.data,tenantId:a.tenantId}),{doc:F,message:"Updated successfully"}}});}let S=new GraphQLObjectType({name:"Mutation",fields:G});return new GraphQLSchema({query:g,mutation:S})}function de(n,t,e){return te({registry:n,db:t,user:e?.user,req:e?.req,tenantId:e?.tenantId,apiKey:e?.apiKey})}
+export{N as a,oe as b,te as c,de as d};

package/dist/chunk-7EY3GXRA.js

@@ -0,0 +1,2 @@
+import {pgTable,timestamp,jsonb,integer,boolean,varchar,uuid,uniqueIndex,index,text}from'drizzle-orm/pg-core';if (typeof window === "undefined") { const { createRequire } = await import(/* @vite-ignore */ 'module'); createRequire(import.meta.url); }
+var d=pgTable("users",{id:uuid("id").primaryKey().defaultRandom(),name:varchar("name",{length:255}),email:varchar("email",{length:255}).notNull(),passwordHash:varchar("password_hash",{length:255}),role:varchar("role",{length:50}).notNull().default("customer"),tenantId:uuid("tenant_id"),emailVerified:boolean("email_verified").default(false),avatar:varchar("avatar",{length:255}),locked:boolean("locked").default(false),lastLogin:timestamp("last_login"),failedLoginAttempts:integer("failed_login_attempts").default(0),metadata:jsonb("metadata").$type(),createdAt:timestamp("created_at").defaultNow().notNull(),updatedAt:timestamp("updated_at").defaultNow().notNull()},e=>[uniqueIndex("users_email_idx").on(e.email),index("users_tenant_idx").on(e.tenantId),index("users_role_idx").on(e.role)]),c=pgTable("roles",{id:uuid("id").primaryKey().defaultRandom(),name:varchar("name",{length:100}).notNull().unique(),level:integer("level").notNull().default(0),inherits:text("inherits").array(),description:text("description"),permissions:jsonb("permissions").$type().default([]),isSystem:boolean("is_system").default(false),createdAt:timestamp("created_at").defaultNow().notNull(),updatedAt:timestamp("updated_at").defaultNow().notNull()},e=>[index("roles_level_idx").on(e.level)]),m=pgTable("permissions",{id:uuid("id").primaryKey().defaultRandom(),roleId:uuid("role_id").references(()=>c.id,{onDelete:"cascade"}),resource:varchar("resource",{length:100}).notNull(),action:varchar("action",{length:50}).notNull(),conditions:jsonb("conditions").$type(),createdAt:timestamp("created_at").defaultNow().notNull()},e=>[index("permissions_role_idx").on(e.roleId),index("permissions_resource_idx").on(e.resource)]),x=pgTable("sessions",{id:uuid("id").primaryKey().defaultRandom(),userId:uuid("user_id").notNull().references(()=>d.id,{onDelete:"cascade"}),token:varchar("token",{length:512}).notNull().unique(),refreshToken:varchar("refresh_token",{length:512}),ipAddress:varchar("ip_address",{length:45}),userAgent:text("user_agent"),expiresAt:timestamp("expires_at").notNull(),createdAt:timestamp("created_at").defaultNow().notNull()},e=>[index("sessions_user_idx").on(e.userId),index("sessions_token_idx").on(e.token),index("sessions_expires_idx").on(e.expiresAt)]),g=pgTable("audit_logs",{id:uuid("id").primaryKey().defaultRandom(),action:varchar("action",{length:100}).notNull(),userId:uuid("user_id").references(()=>d.id,{onDelete:"set null"}),userEmail:varchar("user_email",{length:255}),role:varchar("role",{length:50}),resource:varchar("resource",{length:100}).notNull(),resourceId:varchar("resource_id",{length:255}),changes:jsonb("changes").$type(),ipAddress:varchar("ip_address",{length:45}),userAgent:text("user_agent"),success:boolean("success").notNull().default(true),error:text("error"),metadata:jsonb("metadata").$type(),timestamp:timestamp("timestamp").defaultNow().notNull()},e=>[index("audit_logs_user_idx").on(e.userId),index("audit_logs_action_idx").on(e.action),index("audit_logs_resource_idx").on(e.resource),index("audit_logs_timestamp_idx").on(e.timestamp)]),N=pgTable("tenants",{id:uuid("id").primaryKey().defaultRandom(),name:varchar("name",{length:255}).notNull(),slug:varchar("slug",{length:100}).notNull().unique(),settings:jsonb("settings").$type().default({}),isActive:boolean("is_active").default(true),createdAt:timestamp("created_at").defaultNow().notNull(),updatedAt:timestamp("updated_at").defaultNow().notNull()},e=>[uniqueIndex("tenants_slug_idx").on(e.slug)]),h=pgTable("api_keys",{id:uuid("id").primaryKey().defaultRandom(),userId:uuid("user_id").notNull().references(()=>d.id,{onDelete:"cascade"}),name:varchar("name",{length:255}).notNull(),key:varchar("key",{length:64}).notNull().unique(),keyPrefix:varchar("key_prefix",{length:8}).notNull(),permissions:jsonb("permissions").$type().default([]),lastUsedAt:timestamp("last_used_at"),expiresAt:timestamp("expires_at"),createdAt:timestamp("created_at").defaultNow().notNull()},e=>[index("api_keys_user_idx").on(e.userId),index("api_keys_key_idx").on(e.key)]),A=pgTable("email_verifications",{id:uuid("id").primaryKey().defaultRandom(),userId:uuid("user_id").notNull().references(()=>d.id,{onDelete:"cascade"}),token:varchar("token",{length:64}).notNull().unique(),expiresAt:timestamp("expires_at").notNull(),createdAt:timestamp("created_at").defaultNow().notNull()},e=>[index("email_verifications_token_idx").on(e.token),index("email_verifications_user_idx").on(e.userId)]),k=pgTable("password_resets",{id:uuid("id").primaryKey().defaultRandom(),userId:uuid("user_id").notNull().references(()=>d.id,{onDelete:"cascade"}),token:varchar("token",{length:64}).notNull().unique(),expiresAt:timestamp("expires_at").notNull(),usedAt:timestamp("used_at"),createdAt:timestamp("created_at").defaultNow().notNull()},e=>[index("password_resets_token_idx").on(e.token),index("password_resets_user_idx").on(e.userId)]),w=pgTable("password_history",{id:uuid("id").primaryKey().defaultRandom(),userId:uuid("user_id").notNull().references(()=>d.id,{onDelete:"cascade"}),passwordHash:varchar("password_hash",{length:255}).notNull(),createdAt:timestamp("created_at").defaultNow().notNull()},e=>[index("password_history_user_idx").on(e.userId)]),I=pgTable("lockouts",{id:uuid("id").primaryKey().defaultRandom(),userId:uuid("user_id").notNull().references(()=>d.id,{onDelete:"cascade"}),ipAddress:varchar("ip_address",{length:45}),reason:varchar("reason",{length:255}),lockedUntil:timestamp("locked_until").notNull(),releasedAt:timestamp("released_at"),createdAt:timestamp("created_at").defaultNow().notNull()},e=>[index("lockouts_user_idx").on(e.userId),index("lockouts_ip_idx").on(e.ipAddress),index("lockouts_locked_until_idx").on(e.lockedUntil)]);export{d as a,c as b,m as c,x as d,g as e,N as f,h as g,A as h,k as i,w as j,I as k};

package/dist/chunk-7KTPBTH5.cjs

@@ -0,0 +1 @@
+'use strict';var chunkOJBL4CXK_cjs=require('./chunk-OJBL4CXK.cjs'),chunkDCFOVCJX_cjs=require('./chunk-DCFOVCJX.cjs'),chunkOXEJCIOA_cjs=require('./chunk-OXEJCIOA.cjs');async function O(e){let a=chunkOJBL4CXK_cjs.n(e.db),t={db:e.db,registry:e.registry,req:e.req,user:e.user,tenantId:e.tenantId,webhookService:a,settings:e.settings},n=chunkDCFOVCJX_cjs.c(e.req);if(n){let r=await chunkDCFOVCJX_cjs.b(n,e.db,async o=>{try{return await e.db.findByID({collection:"users",id:o})||null}catch{return null}});r.valid&&(t.user=r.user||e.user,t.tenantId=r.tenantId||e.tenantId,t.apiKey=chunkDCFOVCJX_cjs.d(r));}return t}var V={_media:{create:chunkOJBL4CXK_cjs.c.MEDIA_UPLOAD,update:chunkOJBL4CXK_cjs.c.MEDIA_UPLOAD,delete:chunkOJBL4CXK_cjs.c.MEDIA_DELETE}};function D(e,a){let t=V[e];return t?t[a]:`collection.${a}`}async function R(e,a,t){if(e.webhookService)try{await e.webhookService.trigger(a,{collection:t.collection,operation:t.operation,data:t.data,previousData:t.previousData,user:e.user?{id:e.user.id,email:e.user.email,role:e.user.role}:void 0,tenantId:e.tenantId});}catch(n){console.error(`[Webhook] Failed to trigger ${a}:`,n);}}function m(e,a){if(!(!e||typeof e!="object"))for(let t of a){if(t.type==="tabs"&&Array.isArray(t.tabs)){let r=t.name?e[t.name]:e;if(r&&typeof r=="object")for(let o of t.tabs)Array.isArray(o.fields)&&m(r,o.fields);continue}if(!t.name||!(t.name in e))continue;if(e[t.name]===""&&(t.type==="text"||t.type==="textarea"||t.type==="code"||t.type==="markdown"||t.type==="email"||t.type==="password"||t.type==="color"||(e[t.name]=null)),(t.type==="group"||t.type==="collapsible")&&t.name&&Array.isArray(t.fields)&&e[t.name]&&typeof e[t.name]=="object")m(e[t.name],t.fields);else if(t.type==="array"&&t.name&&Array.isArray(t.fields)&&Array.isArray(e[t.name]))for(let r of e[t.name])r&&typeof r=="object"&&m(r,t.fields);else if(t.type==="blocks"&&t.name&&Array.isArray(t.blocks)&&Array.isArray(e[t.name]))for(let r of e[t.name]){if(!r||typeof r!="object")continue;let o=r.type||r.blockType;if(!o)continue;let s=t.blocks.find(i=>i.slug===o);if(!s||!Array.isArray(s.fields))continue;let u=r.data&&typeof r.data=="object"?r.data:r;m(u,s.fields);}}}async function g(e,a,t){let n=await chunkOJBL4CXK_cjs.a(e,a,{user:t.user,req:t.req,tenantId:t.tenantId,apiKey:t.apiKey});if(!n.allowed)throw new Error(n.error||"Access denied");t.tenantId&&t.db.setTenantContext({tenantId:t.tenantId,userId:t.user?.id??"",role:t.user?.role,isSuperAdmin:t.user?.role==="super_admin"});}function q(e){return async a=>{let{collection:t,where:n,sort:r,limit:o,page:s,depth:u,select:i,draft:d}=a,l=e.registry.getCollection(t);if(await g(l,"read",e),l.hooks?.beforeRead)for(let y of l.hooks.beforeRead)await y({collection:t,req:e.req,user:e.user,tenantId:e.tenantId,operation:"read",where:n});let c=d??!!e.user,b=await e.db.find({collection:t,where:n||{},sort:r,limit:o||10,page:s||1,depth:u||0,tenantId:e.tenantId,select:i,draft:c});if(l.hooks?.afterRead)for(let y of b.docs)for(let w of l.hooks.afterRead)await w({collection:t,doc:y,req:e.req,user:e.user,tenantId:e.tenantId,operation:"read"});return await chunkOJBL4CXK_cjs.o(b.docs,l.fields,e.db,e.registry,1,u||0),chunkOXEJCIOA_cjs.a(b)}}function P(e){return async a=>{let{collection:t,id:n,depth:r,select:o,draft:s}=a,u=e.registry.getCollection(t);await g(u,"read",e);let i=s??!!e.user,d=await e.db.findByID({collection:t,id:n,depth:r||0,tenantId:e.tenantId,select:o,draft:i});if(!d)throw new Error(`Document not found: ${t}/${n}`);if(u.hooks?.afterRead)for(let l of u.hooks.afterRead)await l({collection:t,doc:d,req:e.req,user:e.user,tenantId:e.tenantId,operation:"read",id:n});return await chunkOJBL4CXK_cjs.o([d],u.fields,e.db,e.registry,1,r||0),chunkOXEJCIOA_cjs.a(d)}}function v(e){return async a=>{let{collection:t,data:n,depth:r,select:o}=a,s=e.registry.getCollection(t);await g(s,"create",e);let i=e.registry.getCreateZodSchema(t).parse(n);if(s.tenantScoped&&e.tenantId&&(i.tenantId=e.tenantId),s.hooks?.beforeValidate)for(let l of s.hooks.beforeValidate){let c=await l({collection:t,data:i,req:e.req,user:e.user,tenantId:e.tenantId,operation:"create"});c&&typeof c=="object"&&!Array.isArray(c)&&Object.assign(i,c);}if(s.hooks?.beforeChange)for(let l of s.hooks.beforeChange){let c=await l({collection:t,data:i,req:e.req,user:e.user,tenantId:e.tenantId,operation:"create"});c&&typeof c=="object"&&!Array.isArray(c)&&Object.assign(i,c);}let d=await e.db.create({collection:t,data:i,depth:r||0,tenantId:e.tenantId,select:o});if(s.hooks?.afterChange)for(let l of s.hooks.afterChange)await l({collection:t,doc:d,data:i,req:e.req,user:e.user,tenantId:e.tenantId,operation:"create"});return await R(e,D(t,"create"),{collection:t,data:d,operation:"create"}),{doc:d}}}function K(e){return async a=>{let{collection:t,id:n,data:r,depth:o,select:s,baseUpdatedAt:u}=a,i=e.registry.getCollection(t);await g(i,"update",e);let d=await e.db.findByID({collection:t,id:n,tenantId:e.tenantId,draft:true});if(!d)throw new Error(`Document not found: ${t}/${n}`);if(u&&d.updatedAt&&u!==d.updatedAt)throw new Error(`Revision conflict: document has changed since ${u}. Current updatedAt: ${d.updatedAt}`);m(r,i.fields);let c=e.registry.getUpdateZodSchema(t).parse(r);if(i.tenantScoped&&e.tenantId&&(c.tenantId=e.tenantId),i.hooks?.beforeValidate)for(let h of i.hooks.beforeValidate){let f=await h({collection:t,data:c,originalDoc:d,req:e.req,user:e.user,tenantId:e.tenantId,operation:"update",id:n});f&&typeof f=="object"&&!Array.isArray(f)&&Object.assign(c,f);}if(i.hooks?.beforeChange)for(let h of i.hooks.beforeChange){let f=await h({collection:t,data:c,originalDoc:d,req:e.req,user:e.user,tenantId:e.tenantId,operation:"update",id:n});f&&typeof f=="object"&&!Array.isArray(f)&&Object.assign(c,f);}let b=e.req&&typeof e.req.headers?.get=="function"&&e.req.headers.get("x-draft")==="true"||a.draft===true,y=i.versions?.drafts===true,w=e.req?.query?.autosave==="true"||e.req?.url?.includes("autosave=true")||a.autosave===true,p;if(y&&b?(await e.db.createVersion({collection:t,documentId:n,data:c,status:"draft",autosave:w,createdBy:e.user?.id,tenantId:e.tenantId}),p=await e.db.findByID({collection:t,id:n,tenantId:e.tenantId,draft:true})):y?(p=await e.db.update({collection:t,id:n,data:{...c,status:"published"},depth:o||0,tenantId:e.tenantId,select:s}),await e.db.createVersion({collection:t,documentId:n,data:c,status:"published",createdBy:e.user?.id,tenantId:e.tenantId})):p=await e.db.update({collection:t,id:n,data:c,depth:o||0,tenantId:e.tenantId,select:s}),i.hooks?.afterChange)for(let h of i.hooks.afterChange)await h({collection:t,doc:p,data:c,originalDoc:d,req:e.req,user:e.user,tenantId:e.tenantId,operation:"update",id:n});return await R(e,D(t,"update"),{collection:t,data:p,previousData:d,operation:"update"}),{doc:p}}}function E(e){return async a=>{let{collection:t,id:n}=a,r=e.registry.getCollection(t);await g(r,"delete",e);let o=await e.db.findByID({collection:t,id:n,tenantId:e.tenantId,draft:true});if(!o)throw new Error(`Document not found: ${t}/${n}`);if(r.hooks?.beforeDelete)for(let u of r.hooks.beforeDelete)await u({collection:t,doc:o,req:e.req,user:e.user,tenantId:e.tenantId,operation:"delete",id:n});let s=await e.db.delete({collection:t,id:n,tenantId:e.tenantId});if(r.hooks?.afterDelete)for(let u of r.hooks.afterDelete)await u({collection:t,doc:s,req:e.req,user:e.user,tenantId:e.tenantId,operation:"delete",id:n});return await R(e,D(t,"delete"),{collection:t,data:s,previousData:o,operation:"delete"}),{doc:s,message:"Deleted successfully"}}}function j(e){return async a=>{let{collection:t,where:n}=a,r=e.registry.getCollection(t);return await g(r,"read",e),{totalDocs:await e.db.count({collection:t,where:n||{},tenantId:e.tenantId})}}}async function T(e,a,t){let n=await chunkOJBL4CXK_cjs.b(e,a,{user:t.user,req:t.req,tenantId:t.tenantId});if(!n.allowed)throw new Error(n.error||"Access denied");t.tenantId&&t.db.setTenantContext({tenantId:t.tenantId,userId:t.user?.id??"",role:t.user?.role,isSuperAdmin:t.user?.role==="super_admin"});}function W(e){let a={},t=e.registry.getCollections();for(let r of t){let o=r.slug;a[o]={find:q(e),findByID:P(e),create:v(e),update:K(e),delete:E(e),count:j(e)};}let n=e.registry.getGlobals();for(let r of n){let o=r.slug;a[`_globals_${o}`]={get:async s=>(await T(r,"read",e),await e.db.findOne({collection:`_globals_${o}`,where:{},tenantId:e.tenantId,depth:s?.depth,draft:s?.draft,select:s?.select})),update:async s=>{await T(r,"update",e);let i=e.registry.getZodSchema(o).parse(s.data),d=await e.db.findOne({collection:`_globals_${o}`,where:{},tenantId:e.tenantId,draft:true}),l;return d?l=await e.db.update({collection:`_globals_${o}`,id:d.id,data:i,tenantId:e.tenantId}):l=await e.db.create({collection:`_globals_${o}`,data:{...i,id:o},tenantId:e.tenantId}),l}};}return a}function G(e){if(e.settings?.access?.apiAccess?.trpcEnabled===false)throw new Error("tRPC API is disabled");return W(e)}exports.a=O;exports.b=q;exports.c=P;exports.d=v;exports.e=K;exports.f=E;exports.g=j;exports.h=W;exports.i=G;

package/dist/chunk-A4XM33WO.js

@@ -0,0 +1,109 @@
+import {a}from'./chunk-FAG2645P.js';import {a as a$8}from'./chunk-IIVBEZC2.js';import {a as a$3}from'./chunk-I22MSXGL.js';import {k,i,g,s,o,j,n,q,r,m}from'./chunk-SBFVITY2.js';import {p,q as q$1}from'./chunk-5I3BM5TV.js';import {c,a as a$9,o as o$1,b as b$1}from'./chunk-OPKZYQV7.js';import {a as a$5,f,g as g$1,c as c$1,b as b$2,d}from'./chunk-3N34WXBS.js';import {a as a$1}from'./chunk-JXJTFBHG.js';import {a as a$6}from'./chunk-IIPSXKNV.js';import {a as a$2,b}from'./chunk-WLSVS3NC.js';import {a as a$7}from'./chunk-CIWLQXB2.js';import {a as a$a}from'./chunk-NGNXOXI5.js';import {a as a$4}from'./chunk-O4RKZQYQ.js';import {Hono}from'hono';import Te,{join,resolve,basename,extname}from'path';import {randomBytes,createHmac,createHash}from'crypto';import {verify,sign}from'hono/jwt';import {existsSync,readFileSync}from'fs';import {mkdir,readdir,stat,rename,unlink,writeFile}from'fs/promises';import ar from'process';import {S3Client,ListObjectsV2Command,DeleteObjectsCommand,DeleteObjectCommand,PutObjectCommand,HeadObjectCommand,CopyObjectCommand}from'@aws-sdk/client-s3';import {NodeHttpHandler}from'@smithy/node-http-handler';import'stream';import {zodToJsonSchema}from'zod-to-json-schema';import Wt from'bcryptjs';import {sql}from'drizzle-orm';if (typeof window === "undefined") { const { createRequire } = await import(/* @vite-ignore */ 'module'); createRequire(import.meta.url); }
+function wt(i){let{db:t,userLookup:s$1}=i;return async function(a){let n=c$1(a);if(n&&t){let p=await b$2(n,t,s$1);if(p.valid&&p.user)return {user:p.user,tenantContext:yt(p.user),apiKeyContext:d(p),status:200,authType:"apikey"};if(p.error)return {status:401,error:p.error}}let c=g(a);if(c)try{let p=await m(c);if(!p.valid)return {status:401,error:p.reason||"Session invalid"};let o=await s(a);if(o){let u=s$1?await s$1(o.userId):null;if(u)return {user:u,tenantContext:yt(u),status:200,authType:"session"}}}catch(p){console.error("Session validation error:",p);}return {status:401,error:"Authentication required"}}}function yt(i){return {tenantId:i.tenantId||"default",userId:i.id||"anonymous",role:i.role||"guest",roles:[i.role||"guest"],permissions:[],isSuperAdmin:i.role==="super_admin"}}var he=class{storage=new Map;userStorage=new Map;limits;userLimits;constructor(e,t){this.limits={...Vt,...e},this.userLimits=t||{"user:api":{window:6e4,max:500},"user:write":{window:36e5,max:100}};}getKey(e,t){return `${e}:${t}`}getUserKey(e,t,s){return `user:${e}:${t}:${s}`}cleanupOldEntries(e,t){let r=Date.now()-t;for(;e.length>0&&e[0].timestamp<r;)e.shift();}async check(e,t){let s=this.limits[e]||this.limits["api:general"],r=this.getKey(e,t),a=this.storage.get(r);a||(a=[],this.storage.set(r,a)),this.cleanupOldEntries(a,s.window);let n=Date.now(),c=a.reduce((p,o)=>p+o.count,0);if(a.push({timestamp:n,count:1}),c>=s.max){let o=a.reduce((u,d)=>u.timestamp<d.timestamp?u:d,a[0]).timestamp+s.window;return {allowed:false,remaining:0,resetAt:o,retryAfter:Math.ceil((o-n)/1e3)}}return {allowed:true,remaining:s.max-c-1,resetAt:n+s.window}}async checkUser(e,t,s){let r=this.userLimits[e]||this.userLimits["user:api"],a=this.userStorage.get(t),n=[];a?n=a.get(this.getKey(e,s))||[]:(this.userStorage.has(t)||this.userStorage.set(t,new Map),this.userStorage.get(t).set(this.getKey(e,s),n)),this.cleanupOldEntries(n,r.window);let c=Date.now(),p=n.reduce((o,u)=>o+u.count,0);if(n.push({timestamp:c,count:1}),p>=r.max){let u=n.reduce((d,m)=>d.timestamp<m.timestamp?d:m,n[0]).timestamp+r.window;return {allowed:false,remaining:0,resetAt:u,retryAfter:Math.ceil((u-c)/1e3)}}return {allowed:true,remaining:r.max-p-1,resetAt:c+r.window}}async reset(e,t){let s=this.getKey(e,t);this.storage.delete(s);}async resetUser(e,t,s){let r=this.userStorage.get(t);if(r){let a=this.getKey(e,s);r.delete(a);}}async getStatus(e,t){let s=this.limits[e]||this.limits["api:general"],r=this.getKey(e,t),a=this.storage.get(r);a||(a=[],this.storage.set(r,a)),this.cleanupOldEntries(a,s.window);let n=Date.now(),c=a.reduce((p,o)=>p+o.count,0);return {count:c,limit:s.max,remaining:Math.max(0,s.max-c),resetAt:n+s.window}}setLimit(e,t){this.limits[e]=t;}setUserLimit(e,t){this.userLimits[e]=t;}},Vt={"auth:login":{window:9e5,max:5},"auth:register":{window:36e5,max:3},"auth:forgot":{window:36e5,max:3},"auth:reset":{window:36e5,max:5},"auth:verify":{window:36e5,max:5},"api:general":{window:6e4,max:100},"api:authenticated":{window:6e4,max:200}};var ke={retentionDays:30};var bt=class{redis;prefix;retentionDays;constructor(e,t=30,s="kyro:audit:"){this.redis=e,this.prefix=s,this.retentionDays=t;}async log(e){let t=randomBytes(16).toString("hex"),s=new Date,r={...e,id:t,timestamp:s},a=this.getKeyForDate(s),n=`${this.prefix}log:${t}`;await this.redis.hset(n,this.serializeLog(r)),await this.redis.expire(n,this.retentionDays*24*60*60+3600),await this.redis.zadd(a,s.getTime(),t),await this.redis.expire(a,this.retentionDays*24*60*60+3600);let c=e.userId?`${this.prefix}user:${e.userId}`:null;return c&&(await this.redis.zadd(c,s.getTime(),t),await this.redis.expire(c,this.retentionDays*24*60*60+3600)),t}async get(e){let t=`${this.prefix}log:${e}`,s=await this.redis.hgetall(t);return !s||Object.keys(s).length===0?null:this.deserializeLog(s)}async query(e={}){let{limit:t=50,offset:s=0}=e,r=[];if(e.userId)r.push(`${this.prefix}user:${e.userId}`);else if(e.startDate||e.endDate)r=this.getKeysForDateRange(e.startDate,e.endDate);else {let p=new Date;r=this.getKeysForDateRange(new Date(p.getTime()-this.retentionDays*24*60*60*1e3),p);}let a=[];for(let p of r){let o=await this.redis.zrange(p,0,-1,"WITHSCORES");for(let u=0;u<o.length;u+=2)a.push([o[u],parseInt(o[u+1],10)]);}a.sort((p,o)=>o[1]-p[1]);let n=a.length;a=a.slice(s,s+t);let c=[];for(let[p]of a){let o=await this.get(p);o&&this.matchesFilter(o,e)&&c.push(o);}return {logs:c,total:n}}async getRecent(e=50){let t=[],s=new Date,r=this.getKeysForDateRange(new Date(s.getTime()-10080*60*1e3),s),a=[];for(let n of r){let c=await this.redis.zrange(n,0,-1,"WITHSCORES");for(let p=0;p<c.length;p+=2)a.push([c[p],parseInt(c[p+1],10)]);}a.sort((n,c)=>c[1]-n[1]);for(let[n]of a.slice(0,e)){let c=await this.get(n);c&&t.push(c);}return t}async getUserActivity(e,t=50){let s=`${this.prefix}user:${e}`,r=await this.redis.zrange(s,0,t-1),a=[];for(let n of r){let c=await this.get(n);c&&a.push(c);}return a}async getStats(e,t){let s=this.getKeysForDateRange(e||new Date(Date.now()-2592e6),t||new Date),r={},a=0,n=0,c=0,p=new Set;for(let o of s){let u=await this.redis.zrange(o,0,-1);for(let d of u){let m=await this.get(d);m&&(a++,r[m.action]=(r[m.action]||0)+1,m.success&&c++,m.action==="login_failed"&&n++,m.userId&&p.add(m.userId));}}return {totalEvents:a,byAction:r,successRate:a>0?c/a:1,failedLogins:n,uniqueUsers:p}}async cleanup(){let e=Date.now()-this.retentionDays*24*60*60*1e3,t=await this.redis.keys(`${this.prefix}date:*`),s=0;for(let r of t){let a=await this.redis.zrangebyscore(r,0,e);for(let n of a)await this.redis.del(`${this.prefix}log:${n}`),s++;await this.redis.zremrangebyscore(r,0,e);}return s}getKeyForDate(e){let t=e.getFullYear(),s=String(e.getMonth()+1).padStart(2,"0"),r=String(e.getDate()).padStart(2,"0");return `${this.prefix}date:${t}-${s}-${r}`}getKeysForDateRange(e,t){let s=[],r=e||new Date(Date.now()-this.retentionDays*24*60*60*1e3),a=t||new Date,n=new Date(r);for(;n<=a;)s.push(this.getKeyForDate(n)),n.setDate(n.getDate()+1);return s}matchesFilter(e,t){return !(t.action&&!(Array.isArray(t.action)?t.action:[t.action]).includes(e.action)||t.resource&&e.resource!==t.resource||t.resourceId&&e.resourceId!==t.resourceId||t.success!==void 0&&e.success!==t.success)}serializeLog(e){let t={id:e.id,timestamp:new Date(e.timestamp).toISOString(),action:e.action,resource:e.resource,success:e.success?"1":"0"};return e.userId&&(t.userId=e.userId),e.userEmail&&(t.userEmail=e.userEmail),e.role&&(t.role=e.role),e.resourceId&&(t.resourceId=e.resourceId),e.ipAddress&&(t.ipAddress=e.ipAddress),e.userAgent&&(t.userAgent=e.userAgent),e.error&&(t.error=e.error),e.changes&&(t.changes=JSON.stringify(e.changes)),e.metadata&&(t.metadata=JSON.stringify(e.metadata)),t}deserializeLog(e){return {id:e.id,timestamp:new Date(e.timestamp),action:e.action,userId:e.userId,userEmail:e.userEmail,role:e.role,resource:e.resource,resourceId:e.resourceId,ipAddress:e.ipAddress,userAgent:e.userAgent,success:e.success==="1",error:e.error,changes:e.changes?JSON.parse(e.changes):void 0,metadata:e.metadata?JSON.parse(e.metadata):void 0}}};function $r(i){return {ipAddress:i.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||i.headers.get("x-real-ip")||"unknown",userAgent:i.headers.get("user-agent")||"unknown"}}function te(i){return {ipAddress:i.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||i.headers.get("x-real-ip")||"unknown",userAgent:i.headers.get("user-agent")||"unknown"}}var At=class{logs=[];retentionDays;constructor(e=ke.retentionDays){this.retentionDays=e;}async log(e){let t=randomBytes(16).toString("hex"),r={...e,id:t,timestamp:new Date};return this.logs.push(r),this.cleanupOldLogs(),t}async get(e){return this.logs.find(t=>t.id===e)||null}async query(e={}){let{limit:t=50,offset:s=0}=e,r=[...this.logs];if(e.userId&&(r=r.filter(o=>o.userId===e.userId)),e.action){let o=Array.isArray(e.action)?e.action:[e.action];r=r.filter(u=>o.includes(u.action));}e.resource&&(r=r.filter(o=>o.resource===e.resource)),e.resourceId&&(r=r.filter(o=>o.resourceId===e.resourceId)),e.success!==void 0&&(r=r.filter(o=>o.success===e.success));let a=e.startDate,n=e.endDate;a!==void 0&&(r=r.filter(o=>o.timestamp>=a)),n!==void 0&&(r=r.filter(o=>o.timestamp<=n)),r.sort((o,u)=>u.timestamp.getTime()-o.timestamp.getTime());let c=r.length;return {logs:r.slice(s,s+t),total:c}}async getRecent(e=50){let t=new Date(Date.now()-6048e5);return this.logs.filter(r=>r.timestamp>=t).sort((r,a)=>a.timestamp.getTime()-r.timestamp.getTime()).slice(0,e)}async getUserActivity(e,t=50){return this.logs.filter(r=>r.userId===e).sort((r,a)=>a.timestamp.getTime()-r.timestamp.getTime()).slice(0,t)}async getStats(e,t){let s=e||new Date(Date.now()-2592e6),r=t||new Date,a=this.logs.filter(d=>d.timestamp>=s&&d.timestamp<=r),n={},c=0,p=0,o=0,u=new Set;for(let d of a){c++;let m=d.action;n[m]=(n[m]||0)+1,d.success&&o++,d.action==="login_failed"&&p++,d.userId&&u.add(d.userId);}return {totalEvents:c,byAction:n,successRate:c>0?o/c:1,failedLogins:p,uniqueUsers:u}}async cleanup(){let e=new Date(Date.now()-this.retentionDays*24*60*60*1e3),t=this.logs.length;return this.logs=this.logs.filter(s=>s.timestamp>=e),t-this.logs.length}cleanupOldLogs(){let e=new Date(Date.now()-this.retentionDays*24*60*60*1e3);this.logs.length;this.logs=this.logs.filter(s=>s.timestamp>=e);}};var ye=class{authAdapter;email;passwordPolicy;lockout;rateLimiter;auditLogger;baseUrl;emailVerificationRequired;jwtSecret;constructor(e){this.authAdapter=e.redis,this.email=e.email,this.passwordPolicy=e.passwordPolicy||new a,this.lockout=e.lockout,this.rateLimiter=e.rateLimiter,this.auditLogger=e.auditLogger,this.baseUrl=e.baseUrl||"http://localhost:4321",this.emailVerificationRequired=e.emailVerificationRequired??true,this.jwtSecret=e.jwtSecret||"kyro-default-secret-key-change-me-in-production";}getBaseUrl(e){if(e)try{let t=e.headers.get("x-forwarded-proto")||(e.url.startsWith("https")?"https":"http"),s=e.headers.get("x-forwarded-host")||e.headers.get("host");return s?`${t}://${s}`:new URL(e.url).origin}catch{}return process.env.KYRO_BASE_URL||process.env.SERVER_URL||process.env.PUBLIC_URL||process.env.SITE_URL||this.baseUrl||"http://localhost:4321"}async register(e){let{ipAddress:t,userAgent:s}=te(e);if(this.rateLimiter){let r=await this.rateLimiter.check("auth:register",t);if(!r.allowed)return this.rateLimitResponse(r)}try{let r=await e.json();if(!r.email||!r.password)return this.errorResponse("Email and password are required",400);if(r.password!==r.confirmPassword)return this.errorResponse("Passwords do not match",400);let a=this.passwordPolicy.validate(r.password);if(!a.valid)return this.errorResponse(a.errors.join(". "),400);let n=await this.authAdapter.findUserByEmail(r.email);if(n){if(!n.emailVerified&&this.emailVerificationRequired&&this.email){let o=(await this.authAdapter.createEmailVerificationToken?.(n.id))?.token||randomBytes(32).toString("hex"),d=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${o}`,m=this.email.getTemplates().verifyEmail(d,r.email);return await this.email.send({to:r.email,...m}),this.jsonResponse({success:!0,message:"An unverified account already exists with this email. We have resent the confirmation link to your inbox.",requiresVerification:!0},200)}return this.errorResponse("Email already registered",400)}let c=await this.authAdapter.createUser({email:r.email,password:r.password,role:r.role||"customer",tenantId:r.tenantId});if(this.emailVerificationRequired&&this.email){let p=randomBytes(32).toString("hex"),u=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${p}`;await this.authAdapter.createSession(c.id,{ipAddress:t,userAgent:s});let d=this.email.getTemplates().verifyEmail(u,r.email);await this.email.send({to:r.email,...d});}return this.auditLogger&&await this.auditLogger.log({action:"register",userId:c.id,userEmail:c.email,resource:"auth",ipAddress:t,userAgent:s,success:!0}),this.jsonResponse({success:!0,message:"Registration successful",user:this.sanitizeUser(c),requiresVerification:this.emailVerificationRequired&&!!this.email},201)}catch(r){return console.error("[AuthRoutes.register] Registration error:",r),this.errorResponse("Registration failed",500)}}async login(e){let{ipAddress:t,userAgent:s}=te(e);if(this.rateLimiter){let r=await this.rateLimiter.check("auth:login",t);if(!r.allowed)return this.rateLimitResponse(r)}try{let r=await e.json();if(!r.email||!r.password)return this.errorResponse("Email and password are required",400);let a=await this.authAdapter.findUserByEmail(r.email);if(!a)return await this.recordFailedLogin(t,s),this.errorResponse("Invalid credentials",401);if(a.locked)return this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:a.id,userEmail:a.email,resource:"auth",ipAddress:t,userAgent:s,success:!1,error:"Account locked"}),this.errorResponse("Account locked. Contact an administrator.",403);if(this.lockout){let u=await this.lockout.checkLockout(a.id);if(u.locked)return this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:a.id,userEmail:a.email,resource:"auth",ipAddress:t,userAgent:s,success:!1,error:"Account locked"}),this.errorResponse(`Account locked. Try again in ${Math.ceil((u.lockedUntil.getTime()-Date.now())/6e4)} minutes`,423)}let n=await this.authAdapter.verifyPassword(r.email,r.password);if(!n)return await this.recordFailedLogin(t,s,a.id,a.email),this.errorResponse("Invalid credentials",401);if(this.emailVerificationRequired&&n.emailVerified===!1){if(this.email){let d=(await this.authAdapter.createEmailVerificationToken?.(n.id))?.token||randomBytes(32).toString("hex"),y=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${d}`,l=this.email.getTemplates().verifyEmail(y,n.email);await this.email.send({to:n.email,...l});}return this.errorResponse("Your email address is not verified yet. We have sent a new confirmation link to your email inbox.",403)}this.lockout&&await this.lockout.resetAttempts(a.id),this.auditLogger&&await this.auditLogger.log({action:"login",userId:a.id,userEmail:a.email,role:a.role,resource:"auth",ipAddress:t,userAgent:s,success:!0}),await this.authAdapter.updateUser(a.id,{lastLogin:new Date().toISOString()});let c=await k({id:a.id,email:a.email,role:a.role,tenantId:a.tenantId});if(this.email&&a.email){let u=new Date().toLocaleString(),d=this.email.getTemplates().newLogin(t,u,a.email,void 0,s);this.email.send({to:a.email,...d}).catch(m=>console.error("Failed to send newLogin email:",m));}let p={success:!0,user:this.sanitizeUser(a)},o=this.jsonResponse(p);return i(o,c)}catch(r){return console.error("[Auth] Login error:",r),this.errorResponse("Login failed",500)}}async logout(e){let t=g(e);if(!t)return this.errorResponse("No session to logout",401);let{ipAddress:s$1,userAgent:r}=te(e);try{let a=await s(e);a&&(await o(t),this.auditLogger&&await this.auditLogger.log({action:"logout",userId:a.userId,userEmail:a.email,resource:"auth",ipAddress:s$1,userAgent:r,success:!0}));let n=this.jsonResponse({success:!0,message:"Logged out successfully"});return j(n)}catch{return this.errorResponse("Logout failed",500)}}async refresh(e){try{let t=g(e);if(!t)return this.errorResponse("Not authenticated",401);let s=await n(t,e);return s?this.jsonResponse({success:!0,expiresAt:s.expiresAt}):this.errorResponse("Session not found",404)}catch(t){return console.error("[Auth] Session refresh error:",t),this.errorResponse("Session refresh failed",500)}}async me(e){let t=await s(e);return t?this.jsonResponse({success:true,user:{id:t.userId,email:t.email,role:t.role,tenantId:t.tenantId}}):this.errorResponse("Not authenticated",401)}async changePassword(e){let t=await s(e);if(!t)return this.errorResponse("Not authenticated",401);let{ipAddress:s$1,userAgent:r}=te(e);try{let a=await e.json(),{currentPassword:n,newPassword:c,confirmPassword:p}=a;if(!n||!c)return this.errorResponse("Current and new password required",400);if(c!==p)return this.errorResponse("Passwords do not match",400);let o=this.passwordPolicy.validate(c);if(!o.valid)return this.errorResponse(o.errors.join(". "),400);let u=await this.authAdapter.findUserById(t.userId);if(!u)return this.errorResponse("User not found",404);if(!(u.passwordHash?await this.authAdapter.verifyPassword(n,u.passwordHash):!1))return this.errorResponse("Current password is incorrect",401);let m=await this.authAdapter.getPasswordHistory?.(u.id,5);if(await this.authAdapter.isPasswordInHistory?.(c,u.id,5))return this.errorResponse("Password was recently used. Please choose a different password",400);let l=await this.authAdapter.hashPassword(c);if(u.passwordHash&&await this.authAdapter.addPasswordToHistory?.(u.id,u.passwordHash),await this.authAdapter.updateUser(u.id,{passwordHash:l}),await this.authAdapter.deleteUserSessions(u.id),this.email&&this.email.getTemplates){let g=this.email.getTemplates().passwordChanged(u.email,void 0,s$1,r);await this.email.send({to:u.email,...g});}return this.auditLogger&&await this.auditLogger.log({action:"password_change",userId:u.id,userEmail:u.email,resource:"auth",ipAddress:s$1,userAgent:r,success:!0}),this.jsonResponse({success:!0,message:"Password changed successfully"})}catch{return this.errorResponse("Password change failed",500)}}async forgotPassword(e){let{ipAddress:t,userAgent:s}=te(e);if(this.rateLimiter){let r=await this.rateLimiter.check("auth:forgot",t);if(!r.allowed)return this.rateLimitResponse(r)}try{let r=await e.json(),{email:a}=r;if(!a)return this.errorResponse("Email required",400);let n=await this.authAdapter.findUserByEmail(a);if(!n)return this.jsonResponse({success:!0,message:"If the email exists, a reset link has been sent"});if(this.email){let c=randomBytes(32).toString("hex");if(this.authAdapter.createPasswordResetToken){let d=await this.authAdapter.createPasswordResetToken(n.email);d.token&&(c=d.token);}let o=`${this.getBaseUrl(e)}/admin/auth/reset-password?token=${c}`,u=this.email.getTemplates().resetPassword(o,n.email);await this.email.send({to:n.email,...u});}return this.auditLogger&&await this.auditLogger.log({action:"password_reset",userId:n.id,userEmail:n.email,resource:"auth",ipAddress:t,userAgent:s,success:!0}),this.jsonResponse({success:!0,message:"If the email exists, a reset link has been sent"})}catch{return this.errorResponse("Password reset request failed",500)}}async resetPassword(e){let{ipAddress:t}=te(e);if(this.rateLimiter){let r=await this.rateLimiter.check("auth:reset",t);if(!r.allowed)return this.rateLimitResponse(r)}try{let r=await e.json(),{token:a,newPassword:n,confirmPassword:c}=r;if(!a||!n)return this.errorResponse("Reset token and new password are required",400);if(n!==c)return this.errorResponse("Passwords do not match",400);let p=this.passwordPolicy.validate(n);if(!p.valid)return this.errorResponse(p.errors.join(". "),400);if(this.authAdapter.resetPasswordWithToken){let o=await this.authAdapter.resetPasswordWithToken(a,n);if(!o.success)return this.errorResponse(o.error||"Password reset failed or token expired",400)}return this.jsonResponse({success:!0,message:"Password reset successful. You can now log in with your new password."})}catch(r){return console.error("[AuthRoutes.resetPassword] Error:",r),this.errorResponse("Password reset failed",500)}}async verifyEmail(e){let s=new URL(e.url).searchParams.get("token");if(!s)return this.errorResponse("Verification token required",400);try{if(this.authAdapter.verifyEmailToken){let r=await this.authAdapter.verifyEmailToken(s);if(!r.success)return this.errorResponse(r.error||"Invalid or expired verification token",400);if(r.userId&&this.email){let a=await this.authAdapter.findUserById(r.userId);if(a){let n=this.email.getTemplates().welcome(a.email);await this.email.send({to:a.email,...n});}}}return this.jsonResponse({success:!0,message:"Email address verified successfully"})}catch(r){return console.error("[AuthRoutes.verifyEmail] Error:",r),this.errorResponse("Email verification failed",500)}}async recordFailedLogin(e,t,s,r){if(this.lockout){let a=await this.lockout.recordFailedAttempt(s||e);if(a.locked&&a.totalAttempts===this.lockout.getConfig().maxAttempts&&this.email&&r){let n=Math.ceil(this.lockout.getConfig().lockDuration/6e4),c=this.email.getTemplates().accountLocked(a.totalAttempts,n,r,void 0,e,t);this.email.send({to:r,...c}).catch(p=>console.error("Failed to send accountLocked email:",p));}}this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:s,userEmail:r,resource:"auth",ipAddress:e,userAgent:t,success:false,error:"Invalid credentials"});}sanitizeUser(e){let{passwordHash:t,...s}=e;return s}jsonResponse(e,t=200){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":"application/json","Cache-Control":"no-store, no-cache, must-revalidate, max-age=0"}})}async listSessions(e){let t=await s(e);if(!t)return this.errorResponse("Not authenticated",401);try{let s=await q(t.userId,g(e)??void 0);return this.jsonResponse({sessions:s})}catch(s){return console.error("[AuthRoutes.listSessions] Error:",s),this.errorResponse("Failed to list sessions",500)}}async revokeSession(e,t){let s$1=await s(e);if(!s$1)return this.errorResponse("Not authenticated",401);try{let a=(await q(s$1.userId)).find(n=>n.id===t);return a?a.currentSession?this.errorResponse("Cannot revoke current session",400):(await o(t),this.jsonResponse({success:!0,message:"Session revoked"})):this.errorResponse("Session not found",404)}catch(r){return console.error("[AuthRoutes.revokeSession] Error:",r),this.errorResponse("Failed to revoke session",500)}}async revokeOtherSessions(e){let t=await s(e);if(!t)return this.errorResponse("Not authenticated",401);try{let s=await q(t.userId),r=g(e);for(let a of s)a.currentSession||await o(a.id);return this.jsonResponse({success:!0,message:"Other sessions revoked"})}catch(s){return console.error("[AuthRoutes.revokeOtherSessions] Error:",s),this.errorResponse("Failed to revoke sessions",500)}}async renameSession(e,t){let s$1=await s(e);if(!s$1)return this.errorResponse("Not authenticated",401);try{if(!(await q(s$1.userId)).find(p=>p.id===t))return this.errorResponse("Session not found",404);let n=await e.json(),{name:c}=n;return !c||typeof c!="string"||c.trim().length===0?this.errorResponse("Invalid session name",400):(await r(t,c.trim()),this.jsonResponse({success:!0,message:"Session renamed"}))}catch(r){return console.error("[AuthRoutes.renameSession] Error:",r),this.errorResponse("Failed to rename session",500)}}async refreshSession(e){let t=g(e);if(!t)return this.errorResponse("No session",401);try{let{refreshSession:s}=await import('./auth-session-4WJUKESW.js'),r=await s(t,e);return r?this.jsonResponse({success:!0,expiresAt:r.expiresAt}):this.errorResponse("Session not found",404)}catch(s){return console.error("[AuthRoutes.refreshSession] Error:",s),this.errorResponse("Failed to refresh session",500)}}errorResponse(e,t){return new Response(JSON.stringify({success:false,error:e}),{status:t,headers:{"Content-Type":"application/json"}})}async rateLimitResponse(e){return new Response(JSON.stringify({error:"Too many requests. Please try again later."}),{status:429,headers:{"Content-Type":"application/json",...e.retryAfter?{"Retry-After":e.retryAfter.toString()}:{}}})}async requestMagicLink(e){te(e);try{let r=await e.json();if(!r.email)return this.errorResponse("Email required",400);let a=await this.authAdapter.findUserByEmail(r.email);if(!a)return this.jsonResponse({success:!0,message:"If an account exists, a link was sent."});if(this.email){let n=Buffer.from(JSON.stringify({email:a.email,exp:Date.now()+6e5})).toString("base64url"),c=createHmac("sha256",this.jwtSecret).update(n).digest("hex"),p=`${n}.${c}`,u=`${this.getBaseUrl(e)}/admin/auth/magic-link?token=${p}`,d=this.email.getTemplates().magicLink(u,void 0,a.email);this.email.send({to:a.email,...d}).catch(m=>console.error("Magic link err:",m));}return this.jsonResponse({success:!0,message:"If an account exists, a link was sent."})}catch{return this.errorResponse("Failed to process request",500)}}async verifyMagicLink(e){let{ipAddress:t,userAgent:s}=te(e),a=new URL(e.url).searchParams.get("token");if(!a)return this.errorResponse("Token required",400);try{let[n,c]=a.split(".");if(!n||!c)return this.errorResponse("Invalid token",400);let p=createHmac("sha256",this.jwtSecret).update(n).digest("hex");if(c!==p)return this.errorResponse("Invalid token",400);let o=JSON.parse(Buffer.from(n,"base64url").toString());if(Date.now()>o.exp)return this.errorResponse("Token expired",400);let u=await this.authAdapter.findUserByEmail(o.email);if(!u)return this.errorResponse("User not found",404);if(u.locked)return this.errorResponse("Account locked",403);let d=await k({id:u.id,email:u.email,role:u.role,tenantId:u.tenantId});this.auditLogger&&await this.auditLogger.log({action:"login",userId:u.id,userEmail:u.email,resource:"auth",ipAddress:t,userAgent:s,success:!0});let m=this.jsonResponse({success:!0,user:this.sanitizeUser(u)});return i(m,d)}catch{return this.errorResponse("Invalid token",400)}}async inviteUser(e){try{let t=await e.json();if(!t.email||!t.role)return this.errorResponse("Email and role required",400);let s=await this.authAdapter.findUserByEmail(t.email);if(s)return this.errorResponse("User already exists",409);if(s=await this.authAdapter.createUser({email:t.email,password:randomBytes(16).toString("hex"),role:t.role}),this.email){let r=await this.authAdapter.createPasswordResetToken(s.email),n=`${this.getBaseUrl(e)}/admin/auth/reset-password?token=${r.token}`,c=this.email.getTemplates().userInvite(n,t.role,t.inviterName||"An administrator");this.email.send({to:s.email,...c}).catch(p=>console.error("Invite email err:",p));}return this.jsonResponse({success:!0,message:"User invited successfully"})}catch{return this.errorResponse("Failed to invite user",500)}}};var I=class extends Error{constructor(t,s,r){super(s);this.statusCode=t;this.message=s;this.metadata=r;this.name="ApiError";}statusCode;message;metadata};function vt(i,e){if(e instanceof I)return i.json({error:e.message},e.statusCode);let t=e instanceof Error?e.message:"Internal Server Error";return i.json({error:t},500)}({_media:{create:c.MEDIA_UPLOAD,update:c.MEDIA_UPLOAD,delete:c.MEDIA_DELETE}});var ce=new WeakMap;async function z(i,e,t,s,r,a,n=true,c="none"){let p=t&&typeof t=="object"?t:null,o=p?`col:${i.slug}:${e}:${s?.id||"anon"}:${r||""}:${a?.apiKeyId||""}`:null;if(p&&o){let d=ce.get(p);if(d&&d.has(o))return d.get(o)}let u=await a$9(i,e,{user:s,req:t,tenantId:r,apiKey:a},{enablePublicAccess:n,defaultAccess:c});if(p&&o){let d=ce.get(p);d||(d=new Map,ce.set(p,d)),d.set(o,u);}return u}async function we(i,e,t,s,r,a=true){let n=t&&typeof t=="object"?t:null,c=n?`gbl:${i.slug}:${e}:${s?.id||"anon"}:${r||""}`:null;if(n&&c){let o=ce.get(n);if(o&&o.has(c))return o.get(c)}let p=await b$1(i,e,{user:s,req:t,tenantId:r},{enablePublicAccess:a});if(n&&c){let o=ce.get(n);o||(o=new Map,ce.set(n,o)),o.set(c,p);}return p}async function ae(i,e,t,s,r,a=true){let n=await we(i,e,t,s,r,a);if(!n.allowed)throw new I(n.status||403,n.error||"Access denied");return n}async function $(i,e,t,s){if(t)return {user:t,tenantId:s,apiKeyContext:void 0,authType:"static"};if(e){let r=await e(i);if(r.status===200&&r.user)return {user:r.user,tenantId:r.tenantContext?.tenantId,apiKeyContext:r.apiKeyContext,authType:r.authType}}return {user:void 0,tenantId:void 0,apiKeyContext:void 0,authType:void 0}}var ne=class i{hooks=[];constructor(e=[]){this.hooks=[...e];}pipe(e){return this.hooks.push(e),this}async execute(e){let t=e.data;for(let s of this.hooks)try{let r=await s({...e,data:t});r!==void 0&&(t=r);}catch(r){throw new Error(`[Kyro CMS HookPipeline Error] Failed during ${e.operation} on collection "${e.collection||"global"}": ${r instanceof Error?r.message:String(r)}`)}return t}static async run(e,t){return !e||e.length===0?t.data:new i(e).execute(t)}};function Pe(i,e,t){let{registry:s,db:r,authSecret:a,user:n,tenantId:c,settings:p}=e,o=p?.access?.enablePublicAccess??true,u=p?.access?.defaultCollectionAccess??"none";for(let d of s.getCollections()){let m=d.slug,y=`/api/${m}`;i.post(`${y}/dynamic-options/:fieldName`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await z(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("fieldName"),A=d.fields.find(_=>_.name===w);if(!A||A.type!=="relationship"||!A.relationTo)throw new I(400,"Invalid field for dynamic options");let b=Array.isArray(A.relationTo)?A.relationTo[0]:A.relationTo,E=await l.req.json(),U=await r.find({collection:b,where:E.where,limit:20,tenantId:h}),O=s.getCollection(b)?.admin?.useAsTitle||"id",R=(U.docs||[]).map(_=>({label:_[O]||_.id,value:_.id}));return l.json({data:R})}),i.all(`${y}/semantic-search`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await z(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=[],A="",b$1=10,E=.4;if(l.req.method==="POST"){let P=await l.req.json().catch(()=>({}));w=P.vector||[],A=P.q||P.query||"",b$1=P.limit?parseInt(String(P.limit)):10,E=P.threshold?parseFloat(String(P.threshold)):.4;}else {let P=new URL(l.req.url);A=P.searchParams.get("q")||P.searchParams.get("query")||"",b$1=parseInt(P.searchParams.get("limit")||"10"),E=parseFloat(P.searchParams.get("threshold")||"0.4");}let v=(await r.find({collection:m,limit:200,tenantId:h})).docs||[],R=d.fields.filter(P=>P.type==="embedding")[0]?.name||"embedding",_=v.map(P=>{let W=P[R],H=0;if(Array.isArray(W)&&Array.isArray(w)&&w.length>0){let f=0,k=0,L=0;for(let q=0;q<Math.min(W.length,w.length);q++)f+=W[q]*w[q],k+=W[q]*W[q],L+=w[q]*w[q];H=k&&L?f/(Math.sqrt(k)*Math.sqrt(L)):0;}else if(A){let f=String(P.title||P.name||"").toLowerCase(),k=String(P.content||P.description||"").toLowerCase(),L=A.toLowerCase();f.includes(L)?H=.9:k.includes(L)?H=.7:H=.1;}return {doc:P,score:H}}),D=await Promise.all(_.filter(P=>P.score>=E).sort((P,W)=>W.score-P.score).slice(0,b$1).map(async P=>({...await b(P.doc,d.fields,g,l.req.raw,"read"),_similarity:Math.round(P.score*1e3)/1e3})));return l.json({docs:D,totalDocs:D.length,query:A||void 0})}),i.get(y,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=new URL(l.req.url),w=S.searchParams.get("draft"),A=S.searchParams.get("kyroToken"),b=false,E=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";if(w==="true"&&A&&E)try{let q=await verify(A,E,"HS256");q&&q.type==="preview"&&q.collection===d.slug&&(b=!0);}catch(q){console.warn("Invalid preview token",q);}if(!b){let q=await z(d,"read",l.req.raw,g,h,T,o,u);if(!q.allowed)throw new I(q.status||403,q.error||"Access denied")}let U=parseInt(S.searchParams.get("limit")||"10"),v=parseInt(S.searchParams.get("page")||"1"),O=S.searchParams.get("sort")||void 0,R=parseInt(S.searchParams.get("depth")||"0"),_=S.searchParams.get("select")?.split(",")||void 0,D=S.searchParams.get("where"),P;if(D)try{P=JSON.parse(decodeURIComponent(D));}catch{throw new I(400,"Invalid JSON in where clause")}let W=S.searchParams.get("search")||S.searchParams.get("q");if(W&&W.trim()){let q=W.trim(),C=(d.fields||[]).filter(x=>x.name&&x.name!=="id"&&(x.type==="text"||x.type==="email"||x.type==="textarea"||x.type==="select"||x.type==="radio"||x.indexed)&&!x.admin?.hidden).map(x=>x.name);if(C.length>0){let x=C.map(K=>({[K]:{contains:q}}));P?P={AND:[P,{OR:x}]}:P={OR:x};}}let H=w==="true"?true:w==="false"?false:!!g,f=await r.find({collection:m,where:P,limit:U,page:v,sort:O,tenantId:h,select:_,draft:H}),k=await r.count({collection:m,where:P,tenantId:h});await o$1(f.docs||[],d.fields,r,s,1,R);let L=(f.docs||[]).map(a$a);return l.json({docs:L,totalDocs:k,limit:U,page:v,totalPages:Math.ceil(k/U),data:L,meta:{total:k,page:v,limit:U,totalPages:Math.ceil(k/U)}})}),i.get(`${y}/:id/versions`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await z(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id"),A=parseInt(l.req.query("page")||"1"),b=Math.min(parseInt(l.req.query("limit")||"30"),100),E=l.req.query("compareA"),U=l.req.query("compareB");if(E&&U&&typeof r.findVersionByID=="function")try{let R=await r.findVersionByID({collection:m,versionId:E,tenantId:h}),_=await r.findVersionByID({collection:m,versionId:U,tenantId:h});if(!R||!_)throw new I(404,"One or both comparison versions were not found");let D=typeof R.data=="string"?JSON.parse(R.data):R.data||{},P=typeof _.data=="string"?JSON.parse(_.data):_.data||{},W=[],H=new Set([...Object.keys(D),...Object.keys(P)]);for(let f of H)["id","createdAt","updatedAt","publishedAt"].includes(f)||JSON.stringify(D[f])!==JSON.stringify(P[f])&&W.push({field:f,oldValue:D[f]??null,newValue:P[f]??null});return l.json({diffs:W,versionA:R,versionB:_})}catch(R){if(R instanceof I)throw R;return console.warn(`[compareVersions] Error comparing versions for ${m}/${w}:`,R),l.json({diffs:[]})}let v=[],O=0;if(typeof r.findVersions=="function")try{let R=await r.findVersions({collection:m,documentId:w,page:A,limit:b,tenantId:h});v=R.docs||[],O=R.totalDocs||v.length;}catch(R){console.warn(`[findVersions] Error fetching versions for ${m}/${w}:`,R);}return l.json({docs:v,totalDocs:O,page:A,limit:b,totalPages:Math.ceil(O/b)||1,data:v,meta:{total:O,page:A,limit:b,totalPages:Math.ceil(O/b)||1}})}),i.post(`${y}/:id/versions`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await z(d,"update",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id"),A=await l.req.json().catch(()=>({})),b=A.versionId;if(A.action==="restore"&&b&&typeof r.findVersionByID=="function"){let E=await r.findVersionByID({collection:m,versionId:b,tenantId:h});if(!E)throw new I(404,`Version '${b}' not found`);let U=typeof E.data=="string"?JSON.parse(E.data):E.data,{id:v,createdAt:O,updatedAt:R,..._}=U;d.versions&&typeof r.createVersion=="function"&&await r.createVersion({collection:m,documentId:w,data:_,status:_.status||"published",autosave:false,createdBy:g?.id,changeDescription:`Restored from version ${E.version||b}`,tenantId:h});let D=await r.update({collection:m,id:w,data:_,tenantId:h}),P=a$a(D);return l.json({doc:P,data:P,message:"Version restored successfully"})}throw new I(400,"Invalid action for version management")}),i.get(`${y}/:id/versions/:versionId`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await z(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("versionId"),A=null;if(typeof r.findVersionByID=="function"&&(A=await r.findVersionByID({collection:m,versionId:w,tenantId:h})),!A)throw new I(404,`Version '${w}' not found`);return l.json({doc:A,data:A})}),i.post(`${y}/:id/versions/:versionId/restore`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await z(d,"update",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id"),A=l.req.param("versionId");if(typeof r.restoreVersion=="function")try{let b=await r.restoreVersion({collection:m,documentId:w,versionId:A,tenantId:h});return l.json({doc:b,data:b,message:"Version restored successfully"})}catch(b){console.warn("[restoreVersion] Adapter restore failed, falling back to manual restore:",b);}if(typeof r.findVersionByID=="function"){let b=await r.findVersionByID({collection:m,versionId:A,tenantId:h});if(!b)throw new I(404,`Version '${A}' not found`);let E=typeof b.data=="string"?JSON.parse(b.data):b.data,{id:U,createdAt:v,updatedAt:O,...R}=E;d.versions&&typeof r.createVersion=="function"&&await r.createVersion({collection:m,documentId:w,data:R,status:R.status||"published",autosave:false,createdBy:g?.id,changeDescription:`Restored from version ${b.version||A}`,tenantId:h});let _=await r.update({collection:m,id:w,data:R,tenantId:h}),D=a$a(_);return l.json({doc:D,data:D,message:"Version restored successfully"})}throw new I(501,"Version restoration not supported by database adapter")}),i.post(`${y}/preview-url`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await z(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let A=await l.req.json().catch(()=>({}))||{};if(A.id&&!A.slug)try{let v=await r.findByID({collection:d.slug,id:A.id,tenantId:h});v&&(A={...v,...A});}catch{}let b,E=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";try{b=await sign({type:"preview",collection:d.slug,id:A.id,exp:Math.floor(Date.now()/1e3)+3600},E,"HS256");}catch(v){console.warn("Failed to sign preview token:",v);}let U="";if(typeof d.admin?.preview=="function")try{U=await d.admin.preview(A,{req:l.req.raw,token:b});}catch(v){console.error(`[Kyro Preview] Error in custom preview function for ${d.slug}:`,v);}if(!U){let v=A.slug||A.id||"";if(U=v?`/${d.slug}/${v}`:`/${d.slug}`,b){let O=U.includes("?")?"&":"?";U+=`${O}draft=true&kyroToken=${b}`;}}return l.json({url:U})}),i.get(`${y}/:id`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=new URL(l.req.url),w=S.searchParams.get("draft"),A=S.searchParams.get("kyroToken"),b=false,E=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";if(w==="true"&&A&&E)try{let D=await verify(A,E,"HS256");D&&D.type==="preview"&&D.collection===d.slug&&(b=!0);}catch(D){console.warn("Invalid preview token",D);}if(!b){let D=await z(d,"read",l.req.raw,g,h,T,o,u);if(!D.allowed)throw new I(D.status||403,D.error||"Access denied")}let U=l.req.param("id"),v=parseInt(S.searchParams.get("depth")||"1"),O=w==="true"?true:w==="false"?false:!!g,R=await r.findByID({collection:m,id:U,tenantId:h,draft:O});if(!R)throw new I(404,`Document '${U}' not found in '${m}'`);await o$1([R],d.fields,r,s,1,v);let _=a$a(R);return l.json({doc:_,data:_})}),i.post(y,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await z(d,"create",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=await l.req.json();d.hooks?.beforeChange&&d.hooks.beforeChange.length>0&&(w=await new ne(d.hooks.beforeChange).execute({data:w,collection:m,operation:"create",req:l.req.raw,user:g}));let A=await r.create({collection:m,data:w,tenantId:h});if(d.versions&&typeof r.createVersion=="function")try{await r.createVersion({collection:m,documentId:A?.id||w.id,data:A,status:w.status||"published",autosave:!1,createdBy:g?.id,changeDescription:w.changeDescription||"Initial version",tenantId:h});}catch(E){console.warn(`[createVersion] Failed creating initial version for ${m}:`,E);}d.hooks?.afterChange&&d.hooks.afterChange.length>0&&await new ne(d.hooks.afterChange).execute({data:A,collection:m,operation:"create",req:l.req.raw,user:g});let b=a$a(A);return l.json({doc:b,data:b,message:"Document created successfully"},201)}),i.patch(`${y}/:id`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await z(d,"update",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id"),A=await l.req.json(),b=new URL(l.req.url),E=b.searchParams.get("autosave")==="true"||l.req.header("x-autosave")==="true"||A.autosave===true,U=b.searchParams.get("draft")==="true"||l.req.header("x-draft")==="true"||A.draft===true,v=d.versions?.drafts===true;if(d.hooks?.beforeChange&&d.hooks.beforeChange.length>0){let _=await r.findByID({collection:m,id:w,tenantId:h});A=await new ne(d.hooks.beforeChange).execute({data:A,originalDoc:_||void 0,collection:m,operation:"update",req:l.req.raw,user:g});}let O;if(v&&U)typeof r.createVersion=="function"&&await r.createVersion({collection:m,documentId:w,data:A,status:"draft",autosave:E,createdBy:g?.id,changeDescription:A.changeDescription||(E?"Auto-saved draft":"Draft snapshot"),tenantId:h}),O=await r.findByID({collection:m,id:w,tenantId:h,draft:true});else {let _=await r.findByID({collection:m,id:w,tenantId:h,draft:true});if(!_)throw new I(404,`Document '${w}' not found in '${m}'`);let D={..._,...A};if(d.versions&&typeof r.createVersion=="function")try{await r.createVersion({collection:m,documentId:w,data:D,status:A.status||_.status||"published",autosave:E,createdBy:g?.id,changeDescription:A.changeDescription||(E?"Auto-saved":"Updated snapshot"),tenantId:h});}catch(P){console.warn(`[createVersion] Failed creating version for ${m}/${w}:`,P);}if(O=await r.update({collection:m,id:w,data:A,tenantId:h}),!O)throw new I(404,`Document '${w}' not found in '${m}'`)}d.hooks?.afterChange&&d.hooks.afterChange.length>0&&await new ne(d.hooks.afterChange).execute({data:O,collection:m,operation:"update",req:l.req.raw,user:g});let R=a$a(O);return l.json({doc:R,data:R,message:"Document updated successfully"})}),i.delete(`${y}/:id`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await z(d,"delete",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id");if(!await r.delete({collection:m,id:w,tenantId:h}))throw new I(404,`Document '${w}' not found in '${m}'`);return l.json({success:true,message:`Document '${w}' deleted successfully`})});}}function Le(i,e,t){let{registry:s,db:r,authSecret:a,user:n,tenantId:c,settings:p}=e,o=p?.access?.enablePublicAccess??true;for(let u of s.getGlobals()){let d=u.slug,m=`/api/globals/${d}`;i.get(m,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c),T=new URL(l.req.url),S=T.searchParams.get("draft"),w=T.searchParams.get("kyroToken"),A=false,b=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";if(S==="true"&&w&&b)try{let R=await verify(w,b,"HS256");R&&R.type==="preview"&&R.collection===`_globals_${u.slug}`&&(A=!0);}catch(R){console.warn("Invalid preview token",R);}A||await ae(u,"read",l.req.raw,g,h,o);let E=parseInt(T.searchParams.get("depth")||"0"),U=`_globals_${d}`,v=await r.findOne({collection:U,where:{},depth:E,tenantId:h,draft:S==="true"?true:S==="false"?false:!!g});v||(v={id:d}),await o$1([v],u.fields,r,s,1,E);let O=a$a(v);return l.json({doc:O,data:O})}),i.post(`${m}/preview-url`,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ae(u,"read",l.req.raw,g,h,o);let S=await l.req.json().catch(()=>({}))||{},w,A=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";try{w=await sign({type:"preview",collection:`_globals_${u.slug}`,exp:Math.floor(Date.now()/1e3)+3600},A,"HS256");}catch(E){console.warn("Failed to sign global preview token:",E);}let b="";if(typeof u.admin?.preview=="function")try{b=await u.admin.preview(S,{req:l.req.raw,token:w});}catch(E){console.error(`[Kyro Preview] Error in custom preview function for global ${u.slug}:`,E);}if(!b&&(b=`/${u.slug}`,w)){let E=b.includes("?")?"&":"?";b+=`${E}draft=true&kyroToken=${w}`;}return l.json({url:b})}),i.get(`${m}/versions`,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ae(u,"read",l.req.raw,g,h,o);let T=`_globals_${d}`,S=parseInt(l.req.query("page")||"1"),w=Math.min(parseInt(l.req.query("limit")||"30"),100),A=l.req.query("compareA"),b=l.req.query("compareB");if(A&&b&&typeof r.findVersionByID=="function")try{let v=await r.findVersionByID({collection:T,versionId:A,tenantId:h}),O=await r.findVersionByID({collection:T,versionId:b,tenantId:h});if(!v||!O)return l.json({error:"One or both comparison versions were not found"},404);let R=typeof v.data=="string"?JSON.parse(v.data):v.data||{},_=typeof O.data=="string"?JSON.parse(O.data):O.data||{},D=[],P=new Set([...Object.keys(R),...Object.keys(_)]);for(let W of P)["id","createdAt","updatedAt","publishedAt"].includes(W)||JSON.stringify(R[W])!==JSON.stringify(_[W])&&D.push({field:W,oldValue:R[W]??null,newValue:_[W]??null});return l.json({diffs:D,versionA:v,versionB:O})}catch(v){return console.warn(`[compareVersions] Error comparing global versions for ${d}:`,v),l.json({diffs:[]})}let E=[],U=0;if(typeof r.findVersions=="function")try{let v=await r.findVersions({collection:T,documentId:d,page:S,limit:w,tenantId:h});E=v.docs||[],U=v.totalDocs||E.length;}catch(v){console.warn(`[findVersions] Error fetching global versions for ${d}:`,v);}return l.json({docs:E,totalDocs:U,page:S,limit:w,totalPages:Math.ceil(U/w)||1,data:E,meta:{total:U,page:S,limit:w,totalPages:Math.ceil(U/w)||1}})}),i.get(`${m}/versions/:versionId`,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ae(u,"read",l.req.raw,g,h,o);let T=`_globals_${d}`,S=l.req.param("versionId"),w=null;return typeof r.findVersionByID=="function"&&(w=await r.findVersionByID({collection:T,versionId:S,tenantId:h})),w?l.json({doc:w,data:w}):l.json({error:`Global version '${S}' not found`},404)}),i.post(`${m}/versions/:versionId/restore`,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ae(u,"update",l.req.raw,g,h,o);let T=`_globals_${d}`,S=l.req.param("versionId");if(typeof r.findVersionByID=="function"){let w=await r.findVersionByID({collection:T,versionId:S,tenantId:h});if(!w)return l.json({error:`Global version '${S}' not found`},404);let A=typeof w.data=="string"?JSON.parse(w.data):w.data,{id:b,createdAt:E,updatedAt:U,...v}=A,O=await r.findOne({collection:T,where:{},tenantId:h}),R;O?R=await r.update({collection:T,id:O.id,data:v,tenantId:h}):R=await r.create({collection:T,data:{id:d,...v},tenantId:h}),u.versions&&typeof r.createVersion=="function"&&await r.createVersion({collection:T,documentId:d,data:R||v,status:"published",autosave:false,createdBy:g?.id,changeDescription:`Restored from version ${w.version||S}`,tenantId:h});let _=a$a(R);return l.json({doc:_,data:_,message:"Global version restored successfully"})}return l.json({error:"Version restoration not supported by database adapter"},501)});let y=async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ae(u,"update",l.req.raw,g,h,o);let T=await l.req.json(),S=new URL(l.req.url),w=S.searchParams.get("autosave")==="true"||l.req.header("x-autosave")==="true"||T.autosave===true,A=S.searchParams.get("draft")==="true"||l.req.header("x-draft")==="true"||T.draft===true,b=`_globals_${d}`,E=await r.findOne({collection:b,where:{},tenantId:h}),U;if(E?U=await r.update({collection:b,id:E.id,data:T,tenantId:h}):U=await r.create({collection:b,data:{id:d,...T},tenantId:h}),u.versions&&typeof r.createVersion=="function")try{await r.createVersion({collection:b,documentId:d,data:U||T,status:A?"draft":"published",autosave:w,createdBy:g?.id,changeDescription:T.changeDescription||(w?"Auto-saved":"Updated snapshot"),tenantId:h});}catch(O){console.warn(`[createVersion] Failed creating version for global ${d}:`,O);}let v=a$a(U);return l.json({doc:v,data:v,message:"Global updated successfully"})};i.post(m,y),i.patch(m,y),i.put(m,y);}}function oe(i){let{uploadDir:e=join(ar.cwd(),"public","uploads"),baseUrl:t="/uploads"}=i;async function s(n){existsSync(n)||await mkdir(n,{recursive:true});}function r(n){let c=extname(n).toLowerCase();return {".jpg":"image/jpeg",".jpeg":"image/jpeg",".png":"image/png",".gif":"image/gif",".webp":"image/webp",".avif":"image/avif",".svg":"image/svg+xml",".mp4":"video/mp4",".webm":"video/webm",".mov":"video/quicktime",".avi":"video/x-msvideo",".mp3":"audio/mpeg",".wav":"audio/wav",".ogg":"audio/ogg",".pdf":"application/pdf",".doc":"application/msword",".docx":"application/vnd.openxmlformats-officedocument.wordprocessingml.document",".xls":"application/vnd.ms-excel",".xlsx":"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",".zip":"application/zip",".tar":"application/x-tar",".gz":"application/gzip",".rar":"application/vnd.rar",".7z":"application/x-7z-compressed"}[c]||"application/octet-stream"}async function a(n){try{let c=n.toString("hex",0,8);if(c.startsWith("89504e47")){let p=n.readUInt32BE(16),o=n.readUInt32BE(20);return {width:p,height:o}}if(c.startsWith("ffd8")){let p=2;for(;p<n.length&&n[p]===255;){let o=n[p+1];if(o===192||o===194){let u=n.readUInt16BE(p+5);return {width:n.readUInt16BE(p+7),height:u}}p+=2+n.readUInt16BE(p+2);}}}catch{}return {}}return re({name:"local",displayName:"Local Storage",supportsDynamicResize:true,async upload(n,c){await s(e);let p=Buffer.from(await n.arrayBuffer()),o=createHash("md5").update(p).digest("hex"),u=extname(n.name),d=c?.filename||`${o}${u}`,m=c?.folder||"",y=m?join(e,m):e;await s(y);let l=join(y,d);await writeFile(l,p);let g=n.type.startsWith("image/")?await a(p):{},h=t||"/uploads",T=m?`/${m}/${d}`:`/${d}`,S=h+T;return {id:o,filename:d,originalName:n.name,mimeType:n.type||r(n.name),size:p.length,url:S,thumbnailUrl:n.type.startsWith("image/")?S:void 0,folder:m||void 0,provider:"local",metadata:{...g,...c?.metadata},createdAt:new Date().toISOString()}},async uploadFromUrl(n,c){let p=await fetch(n);if(!p.ok)throw new Error(`Failed to fetch file: ${p.statusText}`);let o=await p.blob(),u=p.headers.get("content-disposition"),d=c?.filename;if(!d&&u){let y=u.match(/filename[^;=\n]*=((['"]).*?\2|[^;\n]*)/);y&&(d=y[1].replace(/['"]/g,""));}d||(d=basename(new URL(n).pathname));let m=new File([o],d,{type:o.type||r(d)});return this.upload(m,c)},async delete(n){let c=join(e,n.replace(t+"/",""));try{await unlink(c);}catch{}},async rename(n,c){let p=join(e,n.replace(t+"/","")),o=join(e,c);return await rename(p,o),`${t}/${c}`},async list(n){let c=n?join(e,n):e;if(!existsSync(c))return [];let p=[],o=await readdir(c,{withFileTypes:true});for(let u of o)if(u.isFile()){let d=join(c,u.name),m=await stat(d),y=`${t}${n?`/${n}`:""}/${u.name}`;p.push({id:createHash("md5").update(u.name).digest("hex"),filename:u.name,originalName:u.name,mimeType:r(u.name),size:m.size,url:y,provider:"local",createdAt:m.birthtime.toISOString()});}return p},async exists(n){let c=join(e,n.replace(t+"/",""));return existsSync(c)},async createFolder(n){let c=join(e,n);await mkdir(c,{recursive:true});},async deleteFolder(n){let c=join(e,n);if(existsSync(c)){let{rm:p}=await import('fs/promises');await p(c,{recursive:true,force:true});}}})}function qe(i){let e=(t,s)=>{if(!i.signKey)return t;let r=createHmac("sha256",i.signKey).update(t+s.toString()).digest("hex");return s.set("s",r),t};return {name:"imgix",displayName:"Imgix",supportsDynamicResize:true,async upload(t,s){throw new Error("Imgix is a transformation service. Use another provider for uploads.")},async uploadFromUrl(t,s){let r=s?.filename||t.split("/").pop()||"file",a=await fetch(t);if(!a.ok)throw new Error(`Failed to fetch: ${a.statusText}`);let n=await a.blob();new File([n],r,{type:n.type});return {id:Buffer.from(t).toString("base64").slice(0,20),filename:r,originalName:r,mimeType:n.type,size:n.size,url:this.getImageUrl(t),thumbnailUrl:this.getImageUrl(t,{width:200,height:200,fit:"crop"}),provider:"imgix",createdAt:new Date().toISOString()}},async delete(t){},async rename(t,s){return `https://${i.domain}/${s}`},getImageUrl(t,s){let r=new URL(t),a=new URLSearchParams(r.search);i.defaultParameters&&Object.entries(i.defaultParameters).forEach(([c,p])=>{a.has(c)||a.set(c,p);}),s&&(s.width&&a.set("w",String(s.width)),s.height&&a.set("h",String(s.height)),s.quality&&a.set("q",String(s.quality)),s.format&&a.set("fm",s.format),s.fit&&a.set("fit",s.fit),s.blur&&a.set("blur",String(s.blur)),s.sharpen&&a.set("sharp",String(s.sharpen))),a.set("auto","compress,format");r.pathname+"?"+a.toString();return i.signKey&&(e(r.pathname+a.toString(),a)),`https://${i.domain}${r.pathname}${a.toString()?"?"+a.toString():""}`},async generateThumbnail(t){return this.getImageUrl(t.url,{width:200,height:200,fit:"crop"})},async list(){return []},async exists(t){try{return (await fetch(t,{method:"HEAD"})).ok}catch{return  false}},async createFolder(){},async deleteFolder(){}}}function Ae(i,e){return e.cdnUrl?`${e.cdnUrl.replace(/\/$/,"")}/${i}`:`https://${e.storageZone}.b-cdn.net/${i}`}function De(i){return i.cdnUrl?i.cdnUrl.replace(/\/$/,"")+"/":`https://${i.storageZone}.b-cdn.net/`}function Ce(i){let e=`https://storage.bunnycdn.com/${i.storageZone}`,t=s=>`${i.prefix?`${i.prefix}/`:""}${s}`.replace(/\/+/g,"/");return re({name:"bunny",displayName:"Bunny.net Storage",supportsDynamicResize:true,async upload(s,r){let a=t(`${r?.folder?`${r.folder}/`:""}${r?.filename||s.name}`),n=Buffer.from(await s.arrayBuffer()),c=await fetch(`${e}/${a}`,{method:"PUT",headers:{AccessKey:i.apiKey,"Content-Type":s.type},body:n});if(!c.ok){let p=await c.text();throw new Error(`Bunny.net upload failed: ${c.status} ${p}`)}return {id:Buffer.from(a).toString("base64url"),filename:r?.filename||s.name,originalName:s.name,mimeType:s.type,size:n.length,url:Ae(a,i),thumbnailUrl:s.type.startsWith("image/")?Ae(a,i):void 0,folder:r?.folder,provider:"bunny",metadata:r?.metadata,createdAt:new Date().toISOString()}},async delete(s){let r=s.replace(De(i),""),a=await fetch(`${e}/${r}`,{method:"DELETE",headers:{AccessKey:i.apiKey}});if(!a.ok&&a.status!==404){let n=await a.text();throw new Error(`Bunny.net delete failed: ${a.status} ${n}`)}},async rename(s,r){let a=s.replace(De(i),""),n=i.prefix?`${i.prefix}/${r}`:r,c=await fetch(`${e}/${a}`,{method:"GET",headers:{AccessKey:i.apiKey}});if(!c.ok)throw new Error("Bunny.net rename failed: could not read old file");let p=await c.arrayBuffer();return await fetch(`${e}/${n}`,{method:"PUT",headers:{AccessKey:i.apiKey,"Content-Type":c.headers.get("Content-Type")||"application/octet-stream"},body:p}),await this.delete(s),Ae(n,i)},async list(s){let r=t(s||""),a=await fetch(`${e}/${r}`,{method:"GET",headers:{AccessKey:i.apiKey}});if(!a.ok){let c=await a.text();throw new Error(`Bunny.net list failed: ${a.status} ${c}`)}return (await a.json()).map(c=>({id:Buffer.from(c.ObjectName||"").toString("base64url"),filename:c.ObjectName?.split("/").pop()||"",originalName:c.ObjectName?.split("/").pop()||"",mimeType:"application/octet-stream",size:c.Length||0,url:Ae(c.ObjectName||"",i),provider:"bunny",createdAt:c.LastChanged||new Date().toISOString()}))},async exists(s){let r=s.replace(De(i),"");return (await fetch(`${e}/${r}`,{method:"HEAD",headers:{AccessKey:i.apiKey}})).ok},async createFolder(s){let r=t(`${s}/`);await fetch(`${e}/${r}`,{method:"PUT",headers:{AccessKey:i.apiKey,"Content-Length":"0"},body:""});},async deleteFolder(s){let r=t(`${s}/`);await fetch(`${e}/${r}`,{method:"DELETE",headers:{AccessKey:i.apiKey}});}})}function $e(){let i=()=>{let s=globalThis.STORAGE_BUCKET;if(!s)throw new Error("Cloudflare R2 native binding 'STORAGE_BUCKET' not found in global scope.");return s},e=s=>`/api/media/file/${s}`,t=s=>s.replace(/\/+/g,"/").replace(/^\/+/,"");return re({name:"cloudflare_r2",displayName:"Cloudflare R2 (Native)",supportsDynamicResize:true,async upload(s,r){let a=i(),n=t(`${r?.folder?`${r.folder}/`:""}${r?.filename||s.name}`),c=await s.arrayBuffer(),p=await a.put(n,c,{httpMetadata:{contentType:s.type},customMetadata:r?.metadata||{}});return {id:Buffer.from(n).toString("base64url"),filename:r?.filename||s.name,originalName:s.name,mimeType:s.type,size:p.size,url:e(n),thumbnailUrl:s.type.startsWith("image/")?e(n):void 0,folder:r?.folder,provider:"cloudflare_r2",metadata:{...r?.metadata,etag:p.etag},createdAt:new Date().toISOString()}},async delete(s){let r=i(),a=s.replace(/^\/api\/media\/file\//,"");await r.delete(a);},async rename(s,r){let a=i(),n=s.replace(/^\/api\/media\/file\//,""),c=t(r),p=await a.get(n);if(!p)throw new Error("File not found");return await a.put(c,p.body,{httpMetadata:p.httpMetadata,customMetadata:p.customMetadata}),await a.delete(n),e(c)},async list(s){let r=i(),a=t(s||"");return (await r.list({prefix:a})).objects.map(c=>({id:Buffer.from(c.key).toString("base64url"),filename:c.key.split("/").pop()||"",originalName:c.key.split("/").pop()||"",mimeType:c.httpMetadata?.contentType||"application/octet-stream",size:c.size,url:e(c.key),provider:"cloudflare_r2",createdAt:c.uploaded.toISOString()}))},async exists(s){try{let r=i(),a=s.replace(/^\/api\/media\/file\//,"");return await r.head(a)!==null}catch{return  false}}})}var Oe=class{providers=new Map;providerToPlugin=new Map;disabledPlugins=new Set;constructor(){this.registerLocal(),this.registerImgix(),this.registerBunny(),this.registerCloudflareR2(),this.registerCloudflareS3();}registerLocal(){this.register({type:"local",displayName:"Local Server",configKey:"local",configFields:[{name:"uploadDir",type:"text",label:"Upload Directory",defaultValue:"./public/uploads"},{name:"baseUrl",type:"text",label:"Base URL",defaultValue:"/uploads"}],extractConfig:(e,t)=>e[t]||{},extractRawConfig:e=>{let t=e?.local||e,s=(t?.uploadDir||"").trim(),r;s?Te.isAbsolute(s)?r=s:s.includes("/")||s.includes("\\")?r=Te.resolve(process.cwd(),s):r=Te.join(process.cwd(),"public",s):r=Te.join(process.cwd(),"public","uploads");let a=(t?.baseUrl||"").trim(),n;return a?n=a.startsWith("/")?a:`/${a}`:n="/uploads",{uploadDir:r,baseUrl:n}},factory:e=>oe(e)});}registerImgix(){this.register({type:"imgix",displayName:"Imgix",configKey:"imgix",configFields:[{name:"domain",type:"text",label:"Domain",required:true},{name:"signKey",type:"password",label:"Sign Key"}],extractConfig:(e,t)=>e[t]||{},extractRawConfig:e=>e?.imgix||e,factory:e=>qe(e)});}registerBunny(){this.register({type:"bunny",displayName:"Bunny.net",configKey:"bunny",configFields:[{name:"storageZone",type:"text",label:"Storage Zone",required:true},{name:"apiKey",type:"password",label:"API Key",required:true},{name:"cdnUrl",type:"text",label:"CDN URL"},{name:"prefix",type:"text",label:"Path Prefix"}],extractConfig:(e,t)=>e[t]||{},extractRawConfig:e=>e?.bunny||e,factory:e=>Ce(e)});}registerCloudflareR2(){this.register({type:"cloudflare_r2",displayName:"Cloudflare R2 (Native)",configKey:"cloudflareR2",configFields:[],extractConfig:()=>({}),extractRawConfig:()=>({}),factory:()=>$e()});}registerCloudflareS3(){this.register({type:"cloudflare_s3",displayName:"Cloudflare R2 (S3 Compat)",configKey:"cloudflareR2",configFields:[],extractConfig:()=>(console.warn('[StorageRegistry] "cloudflare_s3" is deprecated; use "cloudflare_r2" instead.'),{}),extractRawConfig:()=>({}),factory:()=>$e()});}register(e){if(this.providers.has(e.type)){console.warn(`[StorageRegistry] Provider "${e.type}" already registered, skipping`);return}e.pluginName&&this.providerToPlugin.set(e.type,e.pluginName),this.providers.set(e.type,e);}unregister(e){this.providers.delete(e),this.providerToPlugin.delete(e);}get(e){return this.providers.get(e)}getAll(){return Array.from(this.providers.values())}getAllAvailable(e){let t=this.getAll();return e?t.filter(s=>s.pluginName?e(s.pluginName):true):t}has(e){return this.providers.has(e)}async resolve(e,t){let s=this.providers.get(e);if(!s)throw new Error(`Unknown storage provider type: "${e}". Is the plugin that provides it enabled?`);if(s.pluginName&&this.disabledPlugins.has(s.pluginName))throw new Error(`Storage provider "${e}" is not available (plugin "${s.pluginName}" is disabled)`);let r=s.configKey||e,a=s.extractConfig(t,r);return s.factory(a)}async resolveWithConfig(e,t){let s=this.providers.get(e);if(!s)throw new Error(`Unknown storage provider type: "${e}". Is the plugin that provides it enabled?`);if(s.pluginName&&this.disabledPlugins.has(s.pluginName))throw new Error(`Storage provider "${e}" is not available (plugin "${s.pluginName}" is disabled)`);let r=s.extractRawConfig(t);return s.factory(r)}getProviderPluginName(e){return this.providerToPlugin.get(e)}getAllPluginNames(){return Array.from(new Set(this.providerToPlugin.values()))}setPluginEnabled(e,t){t?this.disabledPlugins.delete(e):this.disabledPlugins.add(e);}isPluginEnabled(e){return !this.disabledPlugins.has(e)}},_e=null;function Ne(){return _e||(_e=new Oe),_e}function Pt(i){if(!i)return "";if(i.startsWith("pub-"))return i;let e=i.match(/pub-[a-zA-Z0-9]+/i);return e?e[0]:""}function ur(i,e){let t=i.startsWith("/")?i.slice(1):i;if(e.cdnUrl)return `${e.cdnUrl.replace(/\/$/,"")}/${t}`;switch(e.provider){case "r2":{let s=Pt(e.publicDevUrl);return s?`https://${s}.r2.dev/${t}`:`https://${e.bucket}.${e.accountId}.r2.cloudflarestorage.com/${t}`}case "gcs":return `https://storage.googleapis.com/${e.bucket}/${t}`;case "digitalocean":return `https://${e.bucket}.${e.region}.cdn.digitaloceanspaces.com/${t}`;case "backblaze":return `https://${e.bucket}.s3.backblazeb2.com/${t}`;case "wasabi":return `https://${e.bucket}.s3.wasabisys.com/${t}`;default:return `https://${e.bucket}.s3.${e.region}.amazonaws.com/${t}`}}function je(i){if(i.cdnUrl)return i.cdnUrl.replace(/\/$/,"")+"/";switch(i.provider){case "r2":{let e=Pt(i.publicDevUrl);return e?`https://${e}.r2.dev/`:`https://${i.bucket}.${i.accountId}.r2.cloudflarestorage.com/`}case "gcs":return `https://storage.googleapis.com/${i.bucket}/`;case "digitalocean":return `https://${i.bucket}.${i.region}.cdn.digitaloceanspaces.com/`;case "backblaze":return `https://${i.bucket}.s3.backblazeb2.com/`;case "wasabi":return `https://${i.bucket}.s3.wasabisys.com/`;default:return `https://${i.bucket}.s3.${i.region}.amazonaws.com/`}}function pr(i){switch(i){case "r2":return "Cloudflare R2";case "gcs":return "Google Cloud Storage";case "digitalocean":return "DigitalOcean Spaces";case "backblaze":return "Backblaze B2";case "wasabi":return "Wasabi";default:return "AWS S3"}}function mr(i){let e=new S3Client({region:i.region||"auto",endpoint:i.endpoint,credentials:{accessKeyId:i.accessKeyId,secretAccessKey:i.secretAccessKey},forcePathStyle:true,tls:true,...i.provider==="r2"&&{requestHandler:new NodeHttpHandler}}),t=r=>`${i.prefix?`${i.prefix}/`:""}${r}`.replace(/\/+/g,"/"),s=r=>ur(r,i);return re({name:i.provider,displayName:pr(i.provider),supportsDynamicResize:true,async upload(r,a){let n=t(`${a?.folder?`${a.folder}/`:""}${a?.filename||r.name}`),c=Buffer.from(await r.arrayBuffer());await e.send(new PutObjectCommand({Bucket:i.bucket,Key:n,Body:c,ContentType:r.type,Metadata:a?.metadata}));let p=await e.send(new HeadObjectCommand({Bucket:i.bucket,Key:n}));return {id:Buffer.from(n).toString("base64url"),filename:a?.filename||r.name,originalName:r.name,mimeType:r.type,size:c.length,url:s(n),thumbnailUrl:r.type.startsWith("image/")?s(n):void 0,folder:a?.folder,provider:i.provider,metadata:{...a?.metadata,etag:p.ETag},createdAt:new Date().toISOString()}},async delete(r){let a=r.replace(je(i),"");await e.send(new DeleteObjectCommand({Bucket:i.bucket,Key:a}));},async rename(r,a){let n=r.replace(je(i),""),c=i.prefix?`${i.prefix}/${a}`:a;return await e.send(new CopyObjectCommand({Bucket:i.bucket,CopySource:`${i.bucket}/${n}`,Key:c})),await e.send(new DeleteObjectCommand({Bucket:i.bucket,Key:n})),s(c)},async list(r){let a=t(r||"");return ((await e.send(new ListObjectsV2Command({Bucket:i.bucket,Prefix:a}))).Contents||[]).map(c=>({id:Buffer.from(c.Key||"").toString("base64url"),filename:c.Key?.split("/").pop()||"",originalName:c.Key?.split("/").pop()||"",mimeType:"application/octet-stream",size:c.Size||0,url:s(c.Key||""),provider:i.provider,createdAt:c.LastModified?.toISOString()||new Date().toISOString()}))},async exists(r){try{let a=r.replace(je(i),"");return await e.send(new HeadObjectCommand({Bucket:i.bucket,Key:a})),!0}catch{return  false}},async createFolder(r){let a=t(`${r}/`);await e.send(new PutObjectCommand({Bucket:i.bucket,Key:a,Body:""}));},async deleteFolder(r){let a=t(`${r}/`),n;do{let c=await e.send(new ListObjectsV2Command({Bucket:i.bucket,Prefix:a,ContinuationToken:n}));if(c.Contents?.length){let p=c.Contents.map(o=>({Key:o.Key}));await e.send(new DeleteObjectsCommand({Bucket:i.bucket,Delete:{Objects:p}}));}n=c.IsTruncated?c.NextContinuationToken:void 0;}while(n);await e.send(new DeleteObjectCommand({Bucket:i.bucket,Key:a}));}})}function gr(i){let e=()=>`https://api.cloudinary.com/v1_1/${i.cloudName}/upload`,t=async s=>{let r=await import('crypto'),a=Object.keys(s).sort().map(n=>`${n}=${s[n]}`).join("&");return r.createHash("sha256").update(a+i.apiSecret).digest("hex")};return {name:"cloudinary",displayName:"Cloudinary",supportsDynamicResize:true,async upload(s,r){let a=new FormData;if(a.append("file",s),i.uploadPreset)a.append("upload_preset",i.uploadPreset);else {let p=Math.round(Date.now()/1e3),o={timestamp:String(p)};(r?.folder||i.folder)&&(o.folder=r?.folder||i.folder||"");let u=await t(o);a.append("timestamp",String(p)),a.append("signature",u),a.append("api_key",i.apiKey);}(r?.folder||i.folder)&&a.append("folder",r?.folder||i.folder||"");let n=await fetch(e(),{method:"POST",body:a});if(!n.ok){let p=await n.json();throw new Error(`Cloudinary upload failed: ${p.error?.message||n.statusText}`)}let c=await n.json();return {id:c.public_id,filename:`${c.public_id}.${c.format}`,originalName:c.original_filename||s.name,mimeType:s.type||`image/${c.format}`,size:c.bytes,url:c.secure_url,thumbnailUrl:this.getImageUrl(c.secure_url,{width:200,height:200,fit:"crop"}),width:c.width,height:c.height,folder:r?.folder||i.folder,provider:"cloudinary",createdAt:new Date().toISOString()}},async uploadFromUrl(s,r){let a=new FormData;a.append("file",s),a.append("upload_preset","ml_default"),(r?.folder||i.folder)&&a.append("folder",r?.folder||i.folder||"");let n=await fetch(e(),{method:"POST",body:a});if(!n.ok)throw new Error("Cloudinary upload failed");let c=await n.json();return {id:c.public_id,filename:`${c.public_id}.${c.format}`,originalName:c.original_filename||s.split("/").pop()||"file",mimeType:`image/${c.format}`,size:c.bytes,url:c.secure_url,thumbnailUrl:this.getImageUrl(c.secure_url,{width:200,height:200,fit:"crop"}),width:c.width,height:c.height,provider:"cloudinary",createdAt:new Date().toISOString()}},async delete(s){try{let r=s.split("/image/upload/");if(r.length!==2){console.warn("[Cloudinary delete] Could not parse URL:",s);return}let a=r[1].replace(/^v\d+\//,"").replace(/\.[^.]+$/,""),n=Math.round(Date.now()/1e3),c={timestamp:String(n),public_id:a},p=Object.keys(c).sort().map(l=>`${l}=${c[l]}`).join("&"),u=(await import('crypto')).createHash("sha256").update(p+i.apiSecret).digest("hex"),d=`https://api.cloudinary.com/v1_1/${i.cloudName}/image/destroy`,m=new FormData;m.append("public_id",a),m.append("timestamp",String(n)),m.append("signature",u),m.append("api_key",i.apiKey);let y=await fetch(d,{method:"POST",body:m});if(!y.ok){let l=await y.json();console.warn("[Cloudinary delete] Failed:",l);}}catch(r){console.warn("[Cloudinary delete] Error:",r.message);}},async rename(s,r){let a="",n=r.replace(/\.[^.]+$/,""),c="";try{let p=s.split("/image/upload/");if(p.length!==2)return console.warn("[Cloudinary rename] Could not parse old URL:",s),s;let o=p[1],u=o.match(/^(v\d+)\//);a=u?u[1]:"";let d=o.replace(/^v\d+\//,"").replace(/\.[^.]+$/,""),m=d.split("/");c=m.length>1?m.slice(0,-1).join("/"):"";let y=r.replace(/\.[^.]+$/,"");n=c?`${c}/${y}`:y;let l=Math.round(Date.now()/1e3),g={from_public_id:d,to_public_id:n,timestamp:String(l)},h=Object.keys(g).sort().map(b=>`${b}=${g[b]}`).join("&"),S=(await import('crypto')).createHash("sha256").update(h+i.apiSecret).digest("hex"),w=new FormData;w.append("from_public_id",d),w.append("to_public_id",n),w.append("timestamp",String(l)),w.append("signature",S),w.append("api_key",i.apiKey);let A=await fetch(`https://api.cloudinary.com/v1_1/${i.cloudName}/image/rename`,{method:"POST",body:w});if(A.ok)return (await A.json()).secure_url;{let b=await A.json();console.warn("[Cloudinary rename] Failed:",b);let E=a?`/${a}/`:"/";return `https://res.cloudinary.com/${i.cloudName}/image/upload${E}${n}.${r.split(".").pop()}`}}catch(p){console.warn("[Cloudinary rename] Error:",p.message);let o=a?`/${a}/`:"/";return `https://res.cloudinary.com/${i.cloudName}/image/upload${o}${n}.${r.split(".").pop()}`}},getImageUrl(s,r){if(!r)return s;let a=s.split("/upload/");if(a.length!==2)return s;let n=[];if(r.width&&n.push(`w_${r.width}`),r.height&&n.push(`h_${r.height}`),r.fit){let p={crop:"c_fill",clip:"c_fit",scale:"c_scale",fill:"c_fill"};n.push(p[r.fit]||"c_limit");}r.quality&&n.push(`q_${r.quality}`),r.format&&n.push(`f_${r.format}`);let c=n.join(",");return `${a[0]}/upload/${c}/${a[1]}`},async generateThumbnail(s){return this.getImageUrl(s.url,{width:200,height:200,fit:"crop"})},async list(){return []},async exists(s){return (await fetch(s,{method:"HEAD"})).ok},async createFolder(){},async deleteFolder(){}}}async function Lt(i){let e=i.getStorageConfig(),t=Ne();try{return await t.resolve(e.type,e)}catch(s){return console.warn(`[resolveProvider] ${s.message} \u2014 falling back to local storage`),oe({uploadDir:Te.join(process.cwd(),"public","uploads"),baseUrl:"/uploads"})}}function re(i){return {async uploadFromUrl(e,t){let s=await fetch(e);if(!s.ok)throw new Error(`Failed to fetch: ${s.statusText}`);let r=await s.blob(),a=e.split("/").pop()||"file",n=new File([r],a,{type:r.type});return this.upload(n,t)},getImageUrl(e,t){if(!t||Object.keys(t).length===0)return e;let s=new URLSearchParams({url:e});return t.width&&s.set("w",String(t.width)),t.height&&s.set("h",String(t.height)),t.quality&&s.set("q",String(t.quality)),t.format&&s.set("f",t.format),t.cropWidth&&t.cropHeight&&(s.set("cx",String(t.cropX??0)),s.set("cy",String(t.cropY??0)),s.set("cw",String(t.cropWidth)),s.set("ch",String(t.cropHeight))),`/api/media/resize?${s.toString()}`},async generateThumbnail(e){return this.getImageUrl(e.url,{width:400,height:400})},...i}}async function qt(i){if(!i)return console.warn("[resolveProviderWithConfig] No config, using local"),oe({uploadDir:Te.join(process.cwd(),"public","uploads"),baseUrl:"/uploads"});let e=i.type||"local",t=Ne();try{return await t.resolveWithConfig(e,i)}catch(s){return console.warn(`[resolveProviderWithConfig] ${s.message} \u2014 falling back to local storage`),oe({uploadDir:Te.join(process.cwd(),"public","uploads"),baseUrl:"/uploads"})}}function Dt(){return typeof globalThis>"u"?false:typeof globalThis.EdgeRuntime=="string"||typeof globalThis.WebSocketPair<"u"||typeof globalThis.Deno<"u"||typeof process<"u"&&process.env?.NEXT_RUNTIME==="edge"}async function Ct(i,e){let t=e?.format||"webp",s=(t==="avif"?80:85);if(!Dt())try{let{default:r}=await import('sharp'),a=await r(i).metadata(),n=r(i),c=r(i).resize({width:500,withoutEnlargement:!0});return t==="avif"?(n=n.avif({quality:s}),c=c.avif({quality:Math.min(s,75)})):t==="png"?(n=n.png({compressionLevel:8}),c=c.png({compressionLevel:8})):t==="jpeg"||t==="jpg"?(n=n.jpeg({quality:s}),c=c.jpeg({quality:Math.min(s,80)})):(n=n.webp({quality:s}),c=c.webp({quality:Math.min(s,80)})),{buffer:await n.toBuffer(),thumbnailBuffer:await c.toBuffer(),width:a.width,height:a.height,format:t}}catch{}return {buffer:i,thumbnailBuffer:i,format:"passthrough"}}var $t=`
+  CREATE TABLE IF NOT EXISTS media (
+    id TEXT PRIMARY KEY,
+    filename TEXT NOT NULL UNIQUE,
+    title TEXT,
+    original_name TEXT NOT NULL,
+    mime_type TEXT NOT NULL,
+    file_size INTEGER NOT NULL,
+    width INTEGER,
+    height INTEGER,
+    url TEXT NOT NULL UNIQUE,
+    thumbnail_url TEXT,
+    folder TEXT,
+    provider TEXT NOT NULL,
+    alt TEXT,
+    caption TEXT,
+    metadata TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS idx_media_folder ON media(folder);
+  CREATE INDEX IF NOT EXISTS idx_media_provider ON media(provider);
+  CREATE INDEX IF NOT EXISTS idx_media_filename ON media(filename);
+
+  CREATE TABLE IF NOT EXISTS media_folders (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    path TEXT NOT NULL,
+    parent_path TEXT,
+    created_at TEXT
+  );
+  CREATE INDEX IF NOT EXISTS idx_media_folders_path ON media_folders(path);
+`;function le(i){if(typeof i!="string")return i;let e=i.replace(/-/g,"").toLowerCase();return e.length===32?`${e.slice(0,8)}-${e.slice(8,12)}-${e.slice(12,16)}-${e.slice(16,20)}-${e.slice(20)}`:i}var Me=false,ve=class i{db;storage;dialect;genId;mediaTable="media";foldersTable="media_folders";constructor(e,t,s){this.db=e,this.storage=t,this.dialect=s?.dialect||"sqlite",this.genId=s?.genId||a$1;}static async init(e,t){let s;if(t?.storageConfig)s=await qt(t.storageConfig);else {let a=new p(e);await a.load(),s=await Lt(a);}let r=new i(e,s,t);return await r.ensureTables(),r}async ensureTables(){if(this.dialect==="mongodb"){let e=this.db.db;await e.collection(this.mediaTable).createIndex({filename:1},{unique:true}),await e.collection(this.foldersTable).createIndex({path:1},{unique:true}),Me=true;return}if(this.dialect==="sqlite"){this.db.exec($t);try{let e=this.db.prepare("PRAGMA table_info(media)").all(),t=new Set(e.map(r=>r.name)),s=(r,a)=>{t.has(r)||this.db.exec(`ALTER TABLE media ADD COLUMN ${r} ${a}`);};s("created_at","TEXT"),s("updated_at","TEXT"),s("original_name","TEXT"),s("mime_type","TEXT"),s("file_size","INTEGER"),s("thumbnail_url","TEXT"),t.has("createdAt")&&this.db.exec("UPDATE media SET created_at = createdAt WHERE created_at IS NULL AND createdAt IS NOT NULL"),t.has("updatedAt")&&this.db.exec("UPDATE media SET updated_at = updatedAt WHERE updated_at IS NULL AND updatedAt IS NOT NULL"),t.has("originalName")&&this.db.exec("UPDATE media SET original_name = originalName WHERE original_name IS NULL AND originalName IS NOT NULL"),t.has("mimeType")&&this.db.exec("UPDATE media SET mime_type = mimeType WHERE mime_type IS NULL AND mimeType IS NOT NULL"),t.has("fileSize")&&this.db.exec("UPDATE media SET file_size = fileSize WHERE file_size IS NULL AND fileSize IS NOT NULL"),t.has("thumbnailUrl")&&this.db.exec("UPDATE media SET thumbnail_url = thumbnailUrl WHERE thumbnail_url IS NULL AND thumbnailUrl IS NOT NULL");}catch{}}else if(this.dialect==="postgres"){if(Me)return;let{sql:e}=await import('drizzle-orm');await this.db.execute(e`
+        CREATE TABLE IF NOT EXISTS "media" (
+          "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+          "filename" VARCHAR(255) NOT NULL UNIQUE,
+          "title" VARCHAR(255),
+          "original_name" VARCHAR(255) NOT NULL,
+          "mime_type" VARCHAR(100),
+          "file_size" INTEGER,
+          "width" INTEGER,
+          "height" INTEGER,
+          "url" TEXT NOT NULL UNIQUE,
+          "thumbnail_url" TEXT,
+          "folder" VARCHAR(255),
+          "provider" VARCHAR(50) NOT NULL,
+          "alt" TEXT,
+          "caption" TEXT,
+          "metadata" JSONB,
+          "created_at" TIMESTAMP NOT NULL DEFAULT NOW(),
+          "updated_at" TIMESTAMP NOT NULL DEFAULT NOW()
+        )
+      `),await this.db.execute(e`CREATE INDEX IF NOT EXISTS "idx_media_folder" ON "media" ("folder")`),await this.db.execute(e`CREATE INDEX IF NOT EXISTS "idx_media_provider" ON "media" ("provider")`),await this.db.execute(e`CREATE INDEX IF NOT EXISTS "idx_media_filename" ON "media" ("filename")`),await this.db.execute(e`
+        CREATE TABLE IF NOT EXISTS "media_folders" (
+          "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+          "name" VARCHAR(255) NOT NULL,
+          "path" TEXT NOT NULL,
+          "parent_path" TEXT,
+          "created_at" TIMESTAMP NOT NULL DEFAULT NOW()
+        )
+      `),await this.db.execute(e`CREATE INDEX IF NOT EXISTS "idx_media_folders_path" ON "media_folders" ("path")`),Me=true;}}now(){return new Date().toISOString()}buildFindConditions(e){let t=[],s=[],r=e.sortBy==="name"?"title":e.sortBy==="createdAt"?"created_at":e.sortBy==="updatedAt"?"updated_at":e.sortBy||"created_at",a=e.sortDir==="asc"?"ASC":"DESC";if(e.search){t.push("(title LIKE ? OR filename LIKE ? OR original_name LIKE ? OR alt LIKE ?)");let c=`%${e.search}%`;s.push(c,c,c,c);}return e.type&&e.type!=="all"&&(t.push("mime_type LIKE ?"),s.push(`${e.type}/%`)),e.folder&&(t.push("(folder = ? OR folder LIKE ?)"),s.push(e.folder,`${e.folder}/%`)),{where:t.length>0?`WHERE ${t.join(" AND ")}`:"",params:s,orderBy:a,sortCol:r}}rowToMedia(e,t){return {id:e.id,filename:e.filename,title:e.title??null,originalName:e.original_name??e.originalName,mimeType:e.mime_type??e.mimeType,fileSize:e.file_size??e.fileSize,width:e.width??null,height:e.height??null,url:i.resolveMediaUrl(e.url,t),thumbnailUrl:i.resolveMediaUrl(e.thumbnail_url??e.thumbnailUrl??null,t),folder:e.folder??null,provider:e.provider,alt:e.alt??null,caption:e.caption??null,metadata:typeof e.metadata=="string"?JSON.parse(e.metadata):e.metadata??null,createdAt:e.created_at??e.createdAt,updatedAt:e.updated_at??e.updatedAt}}static resolveMediaUrl(e,t){return e?e.startsWith("http://")||e.startsWith("https://")||e.startsWith("blob:")||e.startsWith("data:")?e:`${(process.env.KYRO_BASE_URL||t||"http://localhost:4321").replace(/\/+$/,"")}${e.startsWith("/")?"":"/"}${e}`:null}async sqliteRun(e,t=[]){let s=this.db.prepare(e),r=e.trim().toLowerCase();return r.startsWith("insert")||r.startsWith("update")||r.startsWith("delete")?s.run(...t):s.all(...t)}sqliteGet(e,t=[]){return this.db.prepare(e).get(...t)}async upload(e,t="",s){let r=e.type.startsWith("image/"),a,n=e,c=e.name,p=null,o=null;if(r&&!e.type.includes("svg")){let l=Buffer.from(await e.arrayBuffer());a=await Ct(l),c=`${e.name.replace(/\.[^/.]+$/,"").toLowerCase().replace(/[^a-z0-9]/g,"-").replace(/-+/g,"-").substring(0,50)}.webp`,p=a.width??null,o=a.height??null,n=new File([a.buffer],c,{type:"image/webp"});}let u=await this.storage.upload(n,{folder:t,filename:c}),d=await this.storage.generateThumbnail({...u,id:"",provider:this.storage.name,createdAt:this.now()},{width:400,height:400}),m=this.genId(),y=this.now();if(this.dialect==="mongodb"){let l=u.mimeType,g=l.startsWith("image/")?"image":l.startsWith("video/")?"video":l.startsWith("audio/")?"audio":l.startsWith("application/pdf")?"document":["application/zip","application/x-zip","application/x-tar","application/gzip","application/x-7z"].includes(l)?"archive":"other";return await this.db.db.collection(this.mediaTable).insertOne({_id:m,id:m,filename:u.filename,title:e.name.replace(/\.[^/.]+$/,""),originalName:e.name,mimeType:l,fileSize:u.size,width:p,height:o,url:u.url,thumbnailUrl:d,folder:t||"",provider:this.storage.name,type:g,status:"active",alt:null,caption:null,createdAt:new Date,updatedAt:new Date}),this.rowToMedia({id:m,filename:u.filename,title:e.name.replace(/\.[^/.]+$/,""),originalName:e.name,mimeType:l,fileSize:u.size,width:p,height:o,url:u.url,thumbnailUrl:d,folder:t||"",provider:this.storage.name,type:g,status:"active",alt:null,caption:null,createdAt:new Date,updatedAt:new Date},s)}if(this.dialect==="sqlite")await this.sqliteRun(`INSERT INTO ${this.mediaTable}
+          (id, filename, title, original_name, mime_type, file_size, width, height, url, thumbnail_url, folder, provider, alt, caption, metadata, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[m,u.filename,e.name.replace(/\.[^/.]+$/,""),e.name,u.mimeType,u.size,p,o,u.url,d,t||null,this.storage.name,null,null,null,y,y]);else {let{media:l}=await import('./media-WYEILC6K.js'),g=u.mimeType,h=g.startsWith("image/")?"image":g.startsWith("video/")?"video":g.startsWith("audio/")?"audio":g.startsWith("application/pdf")?"document":["application/zip","application/x-zip","application/x-tar","application/gzip","application/x-7z"].includes(g)?"archive":"other",T=await this.db.insert(l).values({id:m,filename:u.filename,title:e.name.replace(/\.[^/.]+$/,""),originalName:e.name,mimeType:g,fileSize:u.size,width:p,height:o,url:u.url,thumbnailUrl:d,folder:t||"",provider:this.storage.name,type:h,status:"active",alt:null,caption:null,createdAt:new Date,updatedAt:new Date}).returning();T&&T[0]&&(m=T[0].id);}return {id:m,filename:u.filename,title:e.name.replace(/\.[^/.]+$/,""),originalName:e.name,mimeType:u.mimeType,fileSize:u.size,width:p,height:o,url:u.url,thumbnailUrl:d,folder:t||null,provider:this.storage.name,alt:null,caption:null,metadata:null,createdAt:y,updatedAt:y}}async uploadFromUrl(e,t="",s){let r=await fetch(e);if(!r.ok)throw new Error(`Failed to fetch URL: ${r.status}`);let a=await r.blob(),n=e.split("/").pop()||"url-image",c=r.headers.get("content-type")||a.type||"application/octet-stream",p=new File([a],n,{type:c});return this.upload(p,t,s)}async delete(e,t){this.dialect==="postgres"&&(e=le(e));let s=await this.findById(e,t);if(s){if(await this.deleteFile(s.url),s.thumbnailUrl&&s.thumbnailUrl!==s.url&&s.thumbnailUrl!==s.url+"?thumb")try{await this.deleteFile(s.thumbnailUrl);}catch{}if(this.dialect==="mongodb"){await this.db.db.collection(this.mediaTable).deleteOne({id:e});return}if(this.dialect==="sqlite")await this.sqliteRun(`DELETE FROM ${this.mediaTable} WHERE id = ?`,[e]);else {let{media:r}=await import('./media-WYEILC6K.js'),{eq:a}=await import('drizzle-orm');await this.db.delete(r).where(a(r.id,e));}}}async deleteFile(e){await this.storage.delete(e);}async rename(e,t,s){this.dialect==="postgres"&&(e=le(e));let r=await this.findById(e,s);if(!r)return null;let a=await this.storage.rename(r.url,t),n;if(r.thumbnailUrl||this.storage.name==="cloudinary"){let u=a.match(/\/upload\/(v\d+)\//),d=u?u[1]+"/":"",m=a.match(/(.+?)\/upload\//);n=`${m?m[1]:"https://res.cloudinary.com/"+this.storage.config?.cloudName||"unknown"}/upload/w_200,h_200,c_fill/${d}${t}`;}let c=r.filename.split(".").pop(),p=t.includes(".")?t:`${t}.${c}`,o={url:a,filename:p,thumbnailUrl:n};if(this.dialect==="mongodb")return await this.db.db.collection(this.mediaTable).updateOne({id:e},{$set:{url:a,thumbnailUrl:n||null,updatedAt:new Date}}),this.findById(e,s);if(this.dialect==="sqlite"){let u={...o};"thumbnailUrl"in u&&(u.thumbnail_url=u.thumbnailUrl,delete u.thumbnailUrl);let d=Object.keys(u).map(y=>`${y} = ?`).join(", "),m=Object.values(u);await this.sqliteRun(`UPDATE ${this.mediaTable} SET ${d}, updated_at = ? WHERE id = ?`,[...m,this.now(),e]);}else {let{media:u}=await import('./media-WYEILC6K.js'),{eq:d}=await import('drizzle-orm');await this.db.update(u).set({...o,updatedAt:this.now()}).where(d(u.id,e));}return {...r,...o,updatedAt:this.now(),thumbnailUrl:o.thumbnailUrl??null}}async findById(e,t){if(this.dialect==="postgres"&&(e=le(e)),this.dialect==="mongodb"){let n=await this.db.db.collection(this.mediaTable).findOne({id:e});return n?this.rowToMedia(n,t):null}if(this.dialect==="sqlite"){let n=this.sqliteGet(`SELECT * FROM ${this.mediaTable} WHERE id = ?`,[e]);return n?this.rowToMedia(n,t):null}let{media:s}=await import('./media-WYEILC6K.js'),{eq:r}=await import('drizzle-orm'),[a]=await this.db.select().from(s).where(r(s.id,e));return a?this.rowToMedia(a,t):null}async find(e={},t){let{page:s=1,limit:r=30,search:a="",type:n="",folder:c="",sortBy:p="createdAt",sortDir:o="desc"}=e,{where:u,params:d,orderBy:m,sortCol:y}=this.buildFindConditions({page:s,limit:r,search:a,type:n,folder:c,sortBy:p,sortDir:o}),l=(s-1)*r;if(this.dialect==="mongodb"){let H={},{search:f,type:k,folder:L,sortBy:q="createdAt",sortDir:C="desc"}=e;f&&(H.$or=[{title:{$regex:f,$options:"i"}},{filename:{$regex:f,$options:"i"}},{originalName:{$regex:f,$options:"i"}},{alt:{$regex:f,$options:"i"}}]),k&&k!=="all"&&(H.mimeType={$regex:`^${k}/`}),L&&(H.$or=[{folder:L},{folder:{$regex:`^${L}/`}}]);let K={[q==="name"?"title":q]:C==="asc"?1:-1},N=await this.db.db.collection(this.mediaTable).countDocuments(H);return {docs:(await this.db.db.collection(this.mediaTable).find(H).sort(K).skip(l).limit(r).toArray()).map(M=>this.rowToMedia(M,t)),totalDocs:N,page:s,limit:r,totalPages:Math.ceil(N/r)}}if(this.dialect==="sqlite"){let f=this.sqliteGet(`SELECT COUNT(*) as cnt FROM ${this.mediaTable} ${u}`,d)?.cnt??0;return {docs:(await this.sqliteRun(`SELECT * FROM ${this.mediaTable} ${u} ORDER BY ${y} ${m} LIMIT ? OFFSET ?`,[...d,r,l])).map(L=>this.rowToMedia(L,t)),totalDocs:f,page:s,limit:r,totalPages:Math.ceil(f/r)}}let{media:g}=await import('./media-WYEILC6K.js'),{like:h,or:T,and:S,asc:w,desc:A,eq:b,sql:E}=await import('drizzle-orm'),U=[];a&&U.push(T(h(g.title,`%${a}%`),h(g.filename,`%${a}%`),h(g.originalName,`%${a}%`),h(g.alt,`%${a}%`))),n&&n!=="all"&&U.push(h(g.mimeType,`${n}/%`)),c&&U.push(T(b(g.folder,c),h(g.folder,`${c}/%`)));let v=U.length>0?S(...U):void 0,R=g[{created_at:"createdAt",updated_at:"updatedAt",title:"title",filename:"filename",file_size:"fileSize",mime_type:"mimeType",original_name:"originalName"}[y]||"createdAt"],_=o==="asc"?w(R):A(R),D=await this.db.select().from(g).where(v).orderBy(_).limit(r).offset(l),[{count:P}]=await this.db.select({count:E`count(*)`}).from(g).where(v),W=Number(P);return {docs:D.map(H=>this.rowToMedia(H,t)),totalDocs:W,page:s,limit:r,totalPages:Math.ceil(W/r)}}async update(e,t,s){this.dialect==="postgres"&&(e=le(e));let r=this.now();if(this.dialect==="mongodb")return await this.db.db.collection(this.mediaTable).updateOne({id:e},{$set:{...t,updatedAt:new Date}}),this.findById(e,s);if(this.dialect==="sqlite"){let p=["updated_at = ?"],o=[r];t.title!==void 0&&(p.push("title = ?"),o.push(t.title)),t.alt!==void 0&&(p.push("alt = ?"),o.push(t.alt)),t.caption!==void 0&&(p.push("caption = ?"),o.push(t.caption)),t.folder!==void 0&&(p.push("folder = ?"),o.push(t.folder)),t.metadata!==void 0&&(p.push("metadata = ?"),o.push(t.metadata===null?null:JSON.stringify(t.metadata))),t.originalName!==void 0&&(p.push("original_name = ?"),o.push(t.originalName)),o.push(e),await this.sqliteRun(`UPDATE ${this.mediaTable} SET ${p.join(", ")} WHERE id = ?`,o);let u=this.sqliteGet(`SELECT * FROM ${this.mediaTable} WHERE id = ?`,[e]);return u?this.rowToMedia(u,s):null}let{media:a}=await import('./media-WYEILC6K.js'),{eq:n}=await import('drizzle-orm'),[c]=await this.db.update(a).set({...t,updatedAt:new Date}).where(n(a.id,e)).returning();return c?this.rowToMedia(c,s):null}async updateMany(e,t){this.dialect==="postgres"&&(e=e.map(le));let s=this.now();if(this.dialect==="mongodb"){for(let r of e)await this.db.db.collection(this.mediaTable).updateOne({id:r},{$set:{...t,updatedAt:new Date}});return}if(this.dialect==="sqlite")for(let r of e){let a=["updated_at = ?"],n=[s];t.folder!==void 0&&(a.push("folder = ?"),n.push(t.folder||null)),n.push(r),await this.sqliteRun(`UPDATE ${this.mediaTable} SET ${a.join(", ")} WHERE id = ?`,n);}else {let{media:r}=await import('./media-WYEILC6K.js'),{eq:a}=await import('drizzle-orm');for(let n of e)await this.db.update(r).set({...t,updatedAt:new Date}).where(a(r.id,n));}}async listFolders(){if(this.dialect==="mongodb"){let p=await this.db.db.collection(this.foldersTable).find({},{projection:{path:1}}).toArray(),o=await this.db.db.collection(this.mediaTable).distinct("folder"),u=new Set([...p.map(d=>d.path),...o]);return Array.from(u).filter(d=>d&&d!=="").sort()}if(this.dialect==="sqlite")return (await this.sqliteRun(`SELECT path FROM ${this.foldersTable} UNION
+         SELECT folder as path FROM ${this.mediaTable} WHERE folder IS NOT NULL AND folder != ''`)).map(o=>o.path).filter(o=>o&&o!=="").sort();let{media:e,mediaFolders:t}=await import('./media-WYEILC6K.js'),{eq:s,sql:r}=await import('drizzle-orm'),a=await this.db.select({folder:e.folder}).from(e).groupBy(e.folder),n=await this.db.select({path:t.path}).from(t),c=new Set([...a.map(p=>p.folder),...n.map(p=>p.path)]);return Array.from(c).filter(p=>p&&p!=="").sort()}async createFolder(e,t=""){let s=t?`${t}/${e}`:e;await this.storage.createFolder?.(s);let r=this.now();if(this.dialect==="mongodb"){await this.db.db.collection(this.foldersTable).findOne({path:s})||await this.db.db.collection(this.foldersTable).insertOne({_id:this.genId(),name:e,path:s,parentPath:t||null,createdAt:new Date});return}if(this.dialect==="sqlite")await this.sqliteRun(`INSERT OR IGNORE INTO ${this.foldersTable} (path, name, parent_path, created_at) VALUES (?, ?, ?, ?)`,[s,e,t||null,r]);else {let{mediaFolders:a}=await import('./media-WYEILC6K.js');await this.db.insert(a).values({path:s,name:e,parentPath:t||null,createdAt:new Date}).onConflictDoNothing();}}async deleteFolder(e){let t=await this.find({folder:e,limit:1e4});for(let s of t.docs)await this.delete(s.id);if(await this.storage.deleteFolder?.(e),this.dialect==="mongodb"){await this.db.db.collection(this.foldersTable).deleteMany({$or:[{path:e},{path:{$regex:`^${e}/`}}]});return}if(this.dialect==="sqlite")await this.sqliteRun(`DELETE FROM ${this.foldersTable} WHERE path = ? OR path LIKE ?`,[e,`${e}/%`]);else {let{mediaFolders:s}=await import('./media-WYEILC6K.js'),{like:r,or:a,eq:n}=await import('drizzle-orm');await this.db.delete(s).where(a(n(s.path,e),r(s.path,`${e}/%`)));}}};var _t=join(process.cwd(),"public","uploads"),Ot="/uploads";function Ke(i,e,t){let {db:s,user:r,tenantId:a}=e,n=null,p=async()=>{if(!n)try{typeof s?.connect=="function"&&await s.connect();let o="sqlite";"dialect"in s&&s.dialect==="postgres"?o="postgres":"dialect"in s&&s.dialect==="mongodb"&&(o="mongodb");let u=o==="postgres"&&s.client||s;n=await ve.init(u,{dialect:o});}catch(o){throw console.error("[getMedia] Init error:",o),o}return n};i.get("/api/media",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let d=await p(),m=new URL(o.req.url).origin,y=parseInt(o.req.query("page")||"1"),l=parseInt(o.req.query("limit")||"30"),g=o.req.query("search")||"",h=o.req.query("type")||"",T=o.req.query("folder")||"",S=await d.find({page:y,limit:l,search:g,type:h,folder:T},m);return o.json(S)}),i.post("/api/media/upload",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let d=await p(),m=o.req.header("content-type")||"",y=new URL(o.req.url).origin;if(m.includes("multipart/form-data")){let S=await o.req.formData(),w=S.get("file"),A=S.get("folder")||"";if(!w)throw new I(400,"No file uploaded");let b=await d.upload(w,A,y);return o.json(b)}let l=await o.req.json(),{url:g}=l,h=l.folder||"";if(!g)throw new I(400,"No URL provided");let T=await d.uploadFromUrl(g,h,y);return o.json(T)}),i.get("/api/media/folders",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let m=await(await p()).listFolders();return o.json(m)}),i.post("/api/media/folders",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let d=await p(),m=await o.req.json(),{name:y,parentPath:l}=m;if(!y)throw new I(400,"Folder name is required");return await d.createFolder(y,l||""),o.json({message:"Folder created",path:l?`${l}/${y}`:y})}),i.delete("/api/media/folders",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let d=await p(),m=o.req.query("path");if(!m)throw new I(400,"Path is required");return await d.deleteFolder(m),o.json({message:"Folder deleted"})}),i.get("/api/media/resize",async o=>{let u=o.req.query("url"),d=parseInt(o.req.query("w")||"0"),m=parseInt(o.req.query("h")||"0"),y=o.req.query("fit")||"cover",l=(o.req.query("fmt")||o.req.query("format")||"").toLowerCase(),g=parseInt(o.req.query("q")||o.req.query("quality")||"80"),h=parseFloat(o.req.query("cx")||"0"),T=parseFloat(o.req.query("cy")||"0"),S=parseFloat(o.req.query("cw")||"0"),w=parseFloat(o.req.query("ch")||"0");if(!u)throw new I(400,"URL is required");let b=(await p()).storage;if(!b||b.name!=="local")return o.redirect(u);let E=b.config?.uploadDir||_t,U=b.config?.baseUrl||Ot;if(!u.startsWith(U))return o.redirect(u);let v=u.replace(U,""),O=join(E,v);if(!existsSync(O))throw new I(404,"File not found");let R=readFileSync(O),{default:_}=await import('sharp'),D=_(R);if(S>0&&w>0){let H=await _(R).metadata(),f=H.width||0,k=H.height||0;if(f>0&&k>0){let L=Math.max(0,Math.min(Math.round(h/100*f),f-1)),q=Math.max(0,Math.min(Math.round(T/100*k),k-1)),C=Math.max(1,Math.min(Math.round(S/100*f),f-L)),x=Math.max(1,Math.min(Math.round(w/100*k),k-q));D=D.extract({left:L,top:q,width:C,height:x});}}(d>0||m>0)&&(D=D.resize({width:d>0?d:void 0,height:m>0?m:void 0,fit:y}));let P="webp";l==="avif"?(D=D.avif({quality:g}),P="avif"):l==="png"?(D=D.png({compressionLevel:8}),P="png"):l==="jpeg"||l==="jpg"?(D=D.jpeg({quality:g}),P="jpeg"):l==="webp"?(D=D.webp({quality:g}),P="webp"):P=(await _(R).metadata()).format||"webp";let W=await D.toBuffer();return o.header("Content-Type",`image/${P}`),o.header("Cache-Control","public, max-age=31536000, immutable"),o.body(W)}),i.get("/api/media/file/:key{.+$}",async o=>{let u=o.req.param("key"),d=globalThis.STORAGE_BUCKET;if(d){let m=await d.get(u);if(!m)return o.notFound();let y=new Headers;return m.writeHttpMetadata(y),y.set("etag",m.httpEtag),new Response(m.body,{headers:y})}return o.notFound()}),i.get("/api/media/test",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let d=await p();return o.json({status:d?"initialized":"failed",serviceType:d?.constructor?.name})}),i.get("/api/media/:id",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let d=await p(),m=o.req.param("id"),y=new URL(o.req.url).origin,l=await d.findById(m,y);if(!l)throw new I(404,"Media not found");return o.json(l)}),i.patch("/api/media/:id",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let d=await p(),m=o.req.param("id"),y=await o.req.json(),l=new URL(o.req.url).origin,g=["folder","metadata","title","alt","caption","originalName"],h={};for(let T of g)y[T]!==void 0&&(h[T]=y[T]);if(Object.keys(h).length>0){let T=await d.update(m,h,l);return o.json({doc:T})}throw new I(400,"No valid fields to update")}),i.delete("/api/media/:id",async o=>{let{user:u}=await $(o.req.raw,t,r,a);if(!u)throw new I(401,"Authentication required");let d=await p(),m=o.req.param("id"),y=new URL(o.req.url).origin;return await d.delete(m,y),o.json({success:true})});}function We(i,e,t){let{db:s,user:r,tenantId:a,authAdapter:n}=e;i.get("/api/keys",async c=>{let{user:p,tenantId:o}=await $(c.req.raw,t,r,a);if(!p||!a$4(p,"users:read"))throw new I(403,"Forbidden");let u=parseInt(c.req.query("page")||"1"),d=Math.min(parseInt(c.req.query("limit")||"50"),100),m=await s.find({collection:a$5,where:{},page:u,limit:d,tenantId:o}),y=(m.docs||[]).map(l=>({id:l.id,name:l.name,keyPrefix:l.keyPrefix,permissions:l.permissions||[],lastUsed:l.lastUsedAt,createdAt:l.createdAt}));return c.json({docs:y,totalDocs:m.totalDocs||y.length,totalPages:m.totalPages||1})}),i.post("/api/keys",async c=>{let{user:p}=await $(c.req.raw,t,r,a);if(!p||!a$4(p,"users:admin"))throw new I(403,"Forbidden");let o=await c.req.json();if(!o.name||typeof o.name!="string")throw new I(400,"name is required");let u=f(),d=await s.create({collection:a$5,data:{userId:p.id,name:o.name,key:u,keyPrefix:g$1(u),permissions:Array.isArray(o.permissions)?o.permissions:["*"],expiresAt:o.expiresAt||null,createdAt:new Date().toISOString()}});return await n?.createAuditLog({action:"api_key_create",userId:p.id,resource:"api_key",resourceId:d.id,success:true,metadata:{keyName:o.name}}),c.json({...d,key:u,permissions:Array.isArray(o.permissions)?o.permissions:["*"]},201)}),i.delete("/api/keys/:id",async c=>{let{user:p}=await $(c.req.raw,t,r,a);if(!p||!a$4(p,"users:admin"))throw new I(403,"Forbidden");let o=c.req.param("id"),u=await s.findByID({collection:a$5,id:o});if(!u)throw new I(404,"API key not found");return await s.delete({collection:a$5,id:o}),await n?.createAuditLog({action:"api_key_delete",userId:p.id,resource:"api_key",resourceId:o,success:true,metadata:{keyName:u.name}}),c.json({message:"API key deleted"})}),i.patch("/api/keys/:id",async c=>{let{user:p}=await $(c.req.raw,t,r,a);if(!p||!a$4(p,"users:admin"))throw new I(403,"Forbidden");let o=c.req.param("id"),u=await c.req.json(),d=await s.findByID({collection:a$5,id:o});if(!d)throw new I(404,"API key not found");let m={};if(typeof u.name=="string"&&u.name.trim()&&(m.name=u.name.trim()),Array.isArray(u.permissions)&&(m.permissions=u.permissions),u.expiresAt!==void 0&&(m.expiresAt=u.expiresAt||null),Object.keys(m).length===0)throw new I(400,"Nothing to update");let y=await s.update({collection:a$5,id:o,data:m});return c.json({...y,keyPrefix:d.keyPrefix})}),i.post("/api/keys/:id/rotate",async c=>{let{user:p}=await $(c.req.raw,t,r,a);if(!p||!a$4(p,"users:admin"))throw new I(403,"Forbidden");let o=c.req.param("id"),u=await s.findByID({collection:a$5,id:o});if(!u)throw new I(404,"API key not found");let d=f(),m=await s.update({collection:a$5,id:o,data:{key:d,keyPrefix:g$1(d),lastUsedAt:null}});return await n?.createAuditLog({action:"api_key_rotate",userId:p.id,resource:"api_key",resourceId:o,success:true,metadata:{keyName:u.name}}),c.json({...m,key:d,permissions:u.permissions,expiresAt:u.expiresAt})});}function Nt(i){if(!i||typeof i!="string")return [];let e=[],t=/<a\s+(?:[^>]*?\s+)?href=["']([^"']*)["']/gi,s;for(;(s=t.exec(i))!==null;)s[1]&&e.push(s[1].trim());let r=/\[(?:[^\]]*)\]\(([^)\s]+)(?:\s+["'][^"']*["'])?\)/g;for(;(s=r.exec(i))!==null;)s[1]&&e.push(s[1].trim());return e}function br(i){if(!i)return [];if(typeof i=="string"){if(i.startsWith("{")||i.startsWith("["))try{let e=JSON.parse(i);return He(e)}catch{return Nt(i)}return Nt(i)}return typeof i=="object"?He(i):[]}function He(i){let e=[];if(!i||typeof i!="object")return e;if(i.marks&&Array.isArray(i.marks))for(let t of i.marks)t.type==="link"&&t.attrs?.href&&e.push(String(t.attrs.href).trim());if(i.type==="link"&&i.attrs?.href&&e.push(String(i.attrs.href).trim()),i.content&&Array.isArray(i.content))for(let t of i.content)e.push(...He(t));return e}function Ft(i){if(!i)return {valid:false,reason:"URL is empty"};if(i.startsWith("/")||i.startsWith("#")||i.startsWith("mailto:")||i.startsWith("tel:"))return {valid:true};if(/^(htp:\/\/|https\/\/|http\/\/|htps:\/\/)/i.test(i))return {valid:false,reason:"Malformed URL protocol prefix"};if(/\s/.test(i))return {valid:false,reason:"URL contains unencoded whitespace"};try{let e=new URL(i);return ["http:","https:"].includes(e.protocol)?!e.hostname||e.hostname.length<2?{valid:!1,reason:"Missing or invalid hostname"}:{valid:!0}:{valid:!1,reason:`Unsupported protocol: ${e.protocol}`}}catch{return {valid:false,reason:"Invalid URL format"}}}function jt(i,e){let t=[],s=0,r=new Map,a={};for(let d of i){let m=d.slug,y=d.label||m.charAt(0).toUpperCase()+m.slice(1),l=e[m]||[];s+=l.length;let g=0,h=d.admin?.useAsTitle||"title",T=d.seo||d.fields.some(A=>A.name==="seo"||A.name==="metaTitle");for(let A of l){let b=String(A.id||A._id||""),E=A[h]||A.name||A.slug||b,U=false;if(T){let v=A.seo||{},O=v.title||A.metaTitle,R=v.description||A.metaDescription;O||(t.push({id:`${m}-${b}-missing-title`,type:"seo",severity:"warning",collection:m,documentId:b,documentTitle:E,field:"seo.title",message:"Missing SEO meta title",recommendation:"Add a concise 50-60 character title for search engines."}),U=true,g++),R||(t.push({id:`${m}-${b}-missing-desc`,type:"seo",severity:"warning",collection:m,documentId:b,documentTitle:E,field:"seo.description",message:"Missing SEO meta description",recommendation:"Add a descriptive 120-160 character summary."}),U=true,g++);}for(let v of d.fields){if(!v.name)continue;if(v.type==="image"||v.type==="upload"){let R=A[v.name];if(typeof R=="string"&&R.startsWith("{"))try{R=JSON.parse(R);}catch{}let _=R!=null&&R!=="",D=typeof R=="object"&&R!==null&&!!R.alt||!!A[`${v.name}Alt`]||!!A.alt;_&&!D&&(t.push({id:`${m}-${b}-${v.name}-missing-alt`,type:"accessibility",severity:"warning",collection:m,documentId:b,documentTitle:E,field:v.name,message:`Image in '${v.name}' is missing descriptive alt text`,recommendation:"Add alt text for screen readers and SEO."}),U=true,g++);}if(v.required&&(A[v.name]===void 0||A[v.name]===null||A[v.name]==="")&&(t.push({id:`${m}-${b}-${v.name}-empty-required`,type:"validation",severity:"critical",collection:m,documentId:b,documentTitle:E,field:v.name,message:`Required field '${v.name}' is empty`,recommendation:"Populate this required field to avoid render errors."}),U=true,g++),v.type==="url"||v.type==="text"&&(v.name.toLowerCase().includes("url")||v.name.toLowerCase().includes("link")||v.format==="url")){let R=A[v.name];if(R&&typeof R=="string"){let _=Ft(R.trim());_.valid||(t.push({id:`${m}-${b}-${v.name}-invalid-url`,type:"link",severity:"warning",collection:m,documentId:b,documentTitle:E,field:v.name,message:`Malformed URL in '${v.name}': ${_.reason||"Invalid address"}`,recommendation:"Check that URL has a valid protocol (e.g. https://) and hostname."}),U=true,g++);}}if(v.type==="richtext"||v.type==="textarea"){let R=br(A[v.name]);for(let _ of R){let D=Ft(_);D.valid||(t.push({id:`${m}-${b}-${v.name}-broken-link-${encodeURIComponent(_.slice(0,16))}`,type:"link",severity:"warning",collection:m,documentId:b,documentTitle:E,field:v.name,message:`Embedded link '${_.slice(0,32)}...' is invalid: ${D.reason}`,recommendation:"Update or remove broken hyperlink in rich text content."}),U=true,g++);}}}U&&r.set(`${m}:${b}`,1);}let S=l.length,w=S>0?Math.max(0,Math.round(100-g/(S*2)*100)):100;a[m]={slug:m,label:y,score:w,docCount:S,issueCount:g,hasDocs:S>0};}let n=t.filter(d=>d.severity==="critical").length,c=t.filter(d=>d.severity==="warning").length,p=t.filter(d=>d.severity==="info").length,o=s-r.size;return {score:s>0?Math.max(0,Math.round(o/s*100)):100,totalDocuments:s,healthyDocuments:o,issuesCount:{critical:n,warning:c,info:p},issues:t,collectionScores:a}}function ze(i,e,t){let{registry:s,db:r,user:a,tenantId:n,webhookService:c,settings:p,authAdapter:o}=e,u=p?.access?.enablePublicAccess??false,d=p?.access?.defaultCollectionAccess??"none";i.get("/api/webhooks/actions",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l||!a$4(l,"users:read"))throw new I(403,"Forbidden");let g={generic:{label:"Custom URL",description:"POST to any endpoint with Kyro payload",configFields:[],envVars:[]},"github-push":{label:"GitHub Push",description:"Push an empty commit to simulate a push event",configFields:[{name:"githubOwner",label:"Owner",required:true,placeholder:"e.g., kyro-dev"},{name:"githubRepo",label:"Repository",required:true,placeholder:"e.g., my-website"},{name:"githubBranch",label:"Branch",required:false,placeholder:"main"}],envVars:["GITHUB_TOKEN"]}};return y.json({actions:g})}),i.get("/api/webhooks",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l||!a$4(l,"users:read"))throw new I(403,"Forbidden");if(!c)throw new I(503,"Webhook service not available");let g=await c.getWebhooks();return y.json({docs:g})}),i.post("/api/webhooks",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l||!a$4(l,"users:admin"))throw new I(403,"Forbidden");if(!c)throw new I(503,"Webhook service not available");let g=await y.req.json(),h=await c.createWebhook(g);return await o?.createAuditLog({action:"webhook_create",userId:l.id,resource:"webhook",resourceId:h.id,success:true,metadata:{name:h.name,url:h.url}}),y.json(h,201)}),i.get("/api/webhooks/:id",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l||!a$4(l,"users:read"))throw new I(403,"Forbidden");if(!c)throw new I(503,"Webhook service not available");let g=y.req.param("id"),h=await c.getWebhookById(g);if(!h)throw new I(404,"Webhook not found");return y.json(h)}),i.patch("/api/webhooks/:id",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l||!a$4(l,"users:admin"))throw new I(403,"Forbidden");if(!c)throw new I(503,"Webhook service not available");let g=y.req.param("id"),h=await y.req.json(),T=await c.updateWebhook(g,h);if(!T)throw new I(404,"Webhook not found");return await o?.createAuditLog({action:"webhook_update",userId:l.id,resource:"webhook",resourceId:g,success:true,metadata:{name:T.name}}),y.json(T)}),i.delete("/api/webhooks/:id",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l||!a$4(l,"users:admin"))throw new I(403,"Forbidden");if(!c)throw new I(503,"Webhook service not available");let g=y.req.param("id"),h=await c.getWebhookById(g);if(!h)throw new I(404,"Webhook not found");return await c.deleteWebhook(g),await o?.createAuditLog({action:"webhook_delete",userId:l.id,resource:"webhook",resourceId:g,success:true,metadata:{name:h.name}}),y.json({message:"Webhook deleted"})}),i.post("/api/webhooks/:id/test",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l||!a$4(l,"users:admin"))throw new I(403,"Forbidden");if(!c)throw new I(503,"Webhook service not available");let g=y.req.param("id"),h=await c.testWebhook(g);if(!h)throw new I(404,"Webhook not found");return y.json(h)}),i.get("/api/webhooks/:id/history",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l||!a$4(l,"users:read"))throw new I(403,"Forbidden");if(!c)throw new I(503,"Webhook service not available");let g=y.req.param("id"),h=Math.min(parseInt(y.req.query("limit")||"50"),100),T=await c.getDeliveryHistory(g,h);return y.json({docs:T})}),i.get("/api/analytics",async y=>{let{user:l,tenantId:g}=await $(y.req.raw,t,a,n);if(!l)throw new I(401,"Authentication required");if(!(l.role==="admin"||l.role==="super_admin"))throw new I(403,"Unauthorized");let S=(await r.find({collection:"orders",where:{},limit:1e3,page:1,tenantId:g})).docs||[],w=await r.findOne({collection:"_globals_store-settings",where:{},tenantId:g}),A=w?.currency?.code||w?.currency||"USD",b={},E={},U={};S.forEach(R=>{let _=R.createdAt||R.updatedAt,D=_?new Date(_).toISOString().split("T")[0]:new Date().toISOString().split("T")[0];b[D]||(b[D]=0),E[D]||(E[D]=0);let P=typeof R.total=="number"?R.total:parseFloat(String(R.total||0));b[D]+=isNaN(P)?0:P,E[D]+=1;let W=R.orderStatus||R.status||"pending";U[W]=(U[W]||0)+1;});let v=Object.keys(b).sort().map(R=>({date:R,revenue:Math.round(b[R]*100)/100,orders:E[R]})),O=Math.round(v.reduce((R,_)=>R+_.revenue,0)*100)/100;return y.json({chartData:v,totalRevenue:O,totalOrders:S.length,ordersByStatus:U,currencyCode:typeof A=="string"?A:"USD"})}),i.get("/api/search",async y=>{let l=y.req.query("q")||"",g=y.req.query("collections")||"",h=Math.min(parseInt(y.req.query("limit")||"10"),50);if(!l||l.length<2)return y.json({results:[],message:"Query too short"});let{user:T,tenantId:S}=await $(y.req.raw,t,a,n),w=g?g.split(",").filter(Boolean):s.getCollectionSlugs(),A=[];for(let b of s.getCollections()){if(!w.includes(b.slug)||!(await z(b,"read",y.req.raw,T,S,void 0,u,d)).allowed)continue;let U=b.fields.filter(v=>v.name&&v.name!=="id"&&(v.type==="text"||v.type==="email"||v.type==="textarea"||v.type==="richtext"||v.indexed)&&!v.admin?.hidden).map(v=>v.name);if(U.length!==0)try{let v=U.map(R=>({[R]:{contains:l}})),O=await r.find({collection:b.slug,where:{OR:v},limit:h,tenantId:S});await o$1(O.docs,b.fields,r,s,1,0);for(let R of O.docs){let _=b.admin?.useAsTitle||U.find(P=>P==="title"||P==="name"||P==="label"||P==="heading"||P==="email"||P==="fullName"||P==="username"||P==="slug"||P==="filename"),D=_?Bt(b.fields,R,_):null;(!D||D===R.id||/^[0-9a-fA-F-]{20,}$/.test(String(D)))&&(D=R.name||R.label||R.title||R.email||R.fullName||R.username||R.heading||R.slug||R.filename||D||R.id),A.push({collection:b.slug,label:b.label||b.slug,id:R.id,title:String(D||"Untitled"),doc:R});}}catch(v){console.error(`Search error for ${b.slug}:`,v);}}return A.sort((b,E)=>b.label.localeCompare(E.label)),y.json({results:A})}),i.get("/api/kyro/schema",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l)throw new I(401,"Authentication required");let g={collections:{},globals:{}};for(let h of s.getCollections()){let T=h.slug;try{g.collections[T]={slug:T,label:h.label||T,fields:de(h.fields),jsonSchema:zodToJsonSchema(s.getZodSchema(T),{target:"openApi3"}),createSchema:zodToJsonSchema(s.getCreateZodSchema(T),{target:"openApi3"}),updateSchema:zodToJsonSchema(s.getUpdateZodSchema(T),{target:"openApi3"}),procedures:{find:{collection:T,where:"Record<string,any>",sort:"string",limit:"number",page:"number",depth:"number",select:"string[]",draft:"boolean"},findByID:{collection:T,id:"string",depth:"number",select:"string[]",draft:"boolean"},create:{collection:T,data:"Record<string,any>",depth:"number",select:"string[]"},update:{collection:T,id:"string",data:"Record<string,any>",depth:"number",select:"string[]",baseUpdatedAt:"string"},delete:{collection:T,id:"string"},count:{collection:T,where:"Record<string,any>"}}};}catch{}}for(let h of s.getGlobals()){let T=h.slug,S=h.fields;if(T==="storage-settings"){let w=s.storageProviders,A=w.getAll(),b=new Set(w.getAllAvailable(U=>w.isPluginEnabled(U)).map(U=>U.type));b.add("local");let E=new Set(A.map(U=>U.type));S=S.filter(U=>U.type==="group"&&U.name&&E.has(U.name)?b.has(U.name):true).map(U=>U.name==="provider"&&U.type==="select"?{...U,options:U.options.filter(v=>b.has(v.value))}:U);}try{g.globals[T]={slug:T,label:h.label||T,fields:de(S),jsonSchema:zodToJsonSchema(s.getZodSchema(T),{target:"openApi3"}),procedures:{get:{},update:{data:"Record<string,any>"}}};}catch{}}return y.json(g)}),i.get("/api/collections",async y=>{let{user:l}=await $(y.req.raw,t,a,n);if(!l)throw new I(401,"Authentication required");let g=s.getCollections().map(h=>({slug:h.slug,label:h.label||h.slug,fields:h.fields.filter(T=>T.name).map(T=>({name:T.name,type:T.type,required:T.required,label:T.label}))}));return y.json(g)});let m=async y=>{let{user:l,tenantId:g}=await $(y.req.raw,t,a,n);if(!l)throw new I(401,"Authentication required");let h=s.getCollections().filter(w=>!w.slug.startsWith("_")),T={};for(let w of h)try{let A=await r.find({collection:w.slug,where:{},limit:500,page:1,tenantId:g});T[w.slug]=A.docs||[];}catch{T[w.slug]=[];}let S=jt(h,T);return y.json(S)};i.get("/api/content-health",m),i.get("/api/audit/content-health",m);}function Bt(i,e,t){if(t in e)return e[t];for(let s of i)if(s.name){if(s.type==="tabs"&&s.tabs){let r=e[s.name];if(r&&typeof r=="object"&&t in r)return r[t]}if((s.type==="group"||s.type==="collapsible")&&s.fields){let r=e[s.name];if(r&&typeof r=="object"){if(t in r)return r[t];let a=Bt(s.fields,r,t);if(a!==void 0)return a}}}}function de(i){return i.map(e=>{let t={name:e.name,type:e.type,label:e.label,required:e.required??false,unique:e.unique??false,indexed:e.indexed??false,defaultValue:e.defaultValue,admin:e.admin?{...e.admin}:void 0};return e.minLength!==void 0&&(t.minLength=e.minLength),e.maxLength!==void 0&&(t.maxLength=e.maxLength),e.pattern!==void 0&&(t.pattern=e.pattern),e.variant!==void 0&&(t.variant=e.variant),e.hasMany!==void 0&&(t.hasMany=e.hasMany),e.min!==void 0&&(t.min=e.min),e.max!==void 0&&(t.max=e.max),e.step!==void 0&&(t.step=e.step),e.integer!==void 0&&(t.integer=e.integer),e.options&&(t.options=e.options),e.relationTo&&(t.relationTo=e.relationTo),e.maxDepth!==void 0&&(t.maxDepth=e.maxDepth),e.minRows!==void 0&&(t.minRows=e.minRows),e.maxRows!==void 0&&(t.maxRows=e.maxRows),e.localized!==void 0&&(t.localized=e.localized),e.language&&(t.language=e.language),e.format&&(t.format=e.format),e.allowedTypes&&(t.allowedTypes=e.allowedTypes),e.maxSize&&(t.maxSize=e.maxSize),(e.type==="group"||e.type==="row"||e.type==="collapsible")&&e.fields&&(t.fields=de(e.fields)),e.type==="array"&&e.fields&&(t.fields=de(e.fields)),e.type==="blocks"&&e.blocks&&(t.blocks=e.blocks.map(s=>({slug:s.slug,label:s.label,fields:de(s.fields)}))),e.type==="tabs"&&e.tabs&&(t.tabs=e.tabs.map(s=>({label:s.label,name:s.name,fields:de(s.fields)}))),t})}function Ve(i,e,t,s,r,a,n,c,p){i.post("/api/auth/login",async o=>e.login(o.req.raw)),i.post("/api/auth/register",async o=>{try{let u=await t.findOne({collection:"_globals_system",where:{}});if(u&&u.enableRegistration===!1)throw new I(403,"User registration is currently disabled by administrator.");if(u?.defaultRegistrationRole){let d=o.req.raw;if((d.headers.get("content-type")||"").includes("application/json")){let y=await o.req.json();y.role||(y.role=u.defaultRegistrationRole);let l=new Request(d.url,{method:d.method,headers:d.headers,body:JSON.stringify(y)});return e.register(l)}}}catch{}return e.register(o.req.raw)}),i.post("/api/auth/logout",async o=>e.logout(o.req.raw)),i.post("/api/auth/refresh",async o=>e.refresh(o.req.raw)),i.get("/api/auth/me",async o=>e.me(o.req.raw)),i.post("/api/auth/forgot-password",async o=>e.forgotPassword(o.req.raw)),i.post("/api/auth/reset-password",async o=>e.resetPassword(o.req.raw)),i.post("/api/auth/change-password",async o=>e.changePassword(o.req.raw)),i.get("/api/auth/verify-email",async o=>e.verifyEmail(o.req.raw)),i.post("/api/auth/verify-email",async o=>e.verifyEmail(o.req.raw)),i.get("/api/auth/verify",async o=>e.verifyEmail(o.req.raw)),i.post("/api/auth/verify",async o=>e.verifyEmail(o.req.raw)),i.post("/api/auth/magic-link",async o=>e.requestMagicLink(o.req.raw)),i.get("/api/auth/magic-link",async o=>e.verifyMagicLink(o.req.raw)),i.post("/api/auth/invite",async o=>e.inviteUser(o.req.raw)),i.get("/api/auth/sessions",async o=>e.listSessions(o.req.raw)),i.post("/api/auth/sessions/refresh",async o=>e.refreshSession(o.req.raw)),i.delete("/api/auth/sessions",async o=>e.revokeOtherSessions(o.req.raw)),i.delete("/api/auth/sessions/:id",async o=>e.revokeSession(o.req.raw,o.req.param("id"))),i.put("/api/auth/sessions/:id/name",async o=>e.renameSession(o.req.raw,o.req.param("id"))),i.get("/api/auth/access",async o=>{try{let{user:u,tenantId:d}=await $(o.req.raw,r,a,n);if(!u)throw new I(401,"Not authenticated");let m={},y={};for(let l of s.getCollections()){let g={read:(await z(l,"read",o.req.raw,u,d,void 0,c,p)).allowed,create:(await z(l,"create",o.req.raw,u,d,void 0,c,p)).allowed,update:(await z(l,"update",o.req.raw,u,d,void 0,c,p)).allowed,delete:(await z(l,"delete",o.req.raw,u,d,void 0,c,p)).allowed};m[l.slug]=g;}for(let l of s.getGlobals()){let g={read:(await we(l,"read",o.req.raw,u,d,c)).allowed,update:(await we(l,"update",o.req.raw,u,d,c)).allowed};y[l.slug]=g;}return o.json({collections:m,globals:y})}catch(u){return vt(o,u)}});}function Xe(i){return {colors:{primary:i?.colors?.primary||"#10b981",secondary:i?.colors?.secondary||"#64748b",accent:i?.colors?.accent||"#3b82f6",background:i?.colors?.background||"#ffffff",surface:i?.colors?.surface||"#f8fafc",text:i?.colors?.text||"#0f172a",textMuted:i?.colors?.textMuted||"#94a3b8",border:i?.colors?.border||"#e2e8f0",error:i?.colors?.error||"#ef4444",warning:i?.colors?.warning||"#f59e0b",success:i?.colors?.success||"#10b981",info:i?.colors?.info||"#06b6d4"},fonts:{sans:i?.fonts?.sans||"system-ui, -apple-system, sans-serif",serif:i?.fonts?.serif||"Georgia, serif",mono:i?.fonts?.mono||"monospace"},spacing:{xs:i?.spacing?.xs||"0.25rem",sm:i?.spacing?.sm||"0.5rem",md:i?.spacing?.md||"1rem",lg:i?.spacing?.lg||"1.5rem",xl:i?.spacing?.xl||"2rem"},borderRadius:{sm:i?.borderRadius?.sm||"0.25rem",md:i?.borderRadius?.md||"0.5rem",lg:i?.borderRadius?.lg||"0.75rem",xl:i?.borderRadius?.xl||"1rem",full:i?.borderRadius?.full||"9999px"},shadows:{sm:i?.shadows?.sm||"0 1px 2px 0 rgb(0 0 0 / 0.05)",md:i?.shadows?.md||"0 4px 6px -1px rgb(0 0 0 / 0.1)",lg:i?.shadows?.lg||"0 10px 15px -3px rgb(0 0 0 / 0.1)"}}}function Mt(i){let e=[":root {"];for(let[t,s]of Object.entries(i.colors))e.push(`  --kyro-color-${t}: ${s};`);for(let[t,s]of Object.entries(i.fonts))e.push(`  --kyro-font-${t}: ${s};`);for(let[t,s]of Object.entries(i.spacing))e.push(`  --kyro-spacing-${t}: ${s};`);for(let[t,s]of Object.entries(i.borderRadius))e.push(`  --kyro-radius-${t}: ${s};`);for(let[t,s]of Object.entries(i.shadows))e.push(`  --kyro-shadow-${t}: ${s};`);return e.push("}"),e.join(`
+`)}function Kt(i){return {theme:{extend:{colors:{kyro:i.colors},fontFamily:i.fonts,spacing:i.spacing,borderRadius:i.borderRadius,boxShadow:i.shadows}}}}function Ge(i,e){let{registry:t}=e;i.get("/api/tokens",async s=>{let r=s.req.query("format"),a=t.getGlobal("branding")||t.getGlobal("site_settings"),n=a?a.theme:void 0,c=Xe(n);return r==="tailwind"?s.json(Kt(c)):s.json({data:c})}),i.get("/api/tokens.css",async s=>{let r=t.getGlobal("branding")||t.getGlobal("site_settings"),a=r?r.theme:void 0,n=Xe(a),c=Mt(n);return s.header("Content-Type","text/css; charset=utf-8"),s.header("Cache-Control","public, max-age=3600"),s.body(c)});}var Re=class{db;sessionTTL;constructor(e){this.db=e.db?.client||e.db,this.sessionTTL=e.sessionTTL||86400;}async executeSql(e,t=[]){try{if(this.db&&typeof this.db.prepare=="function"){let s=this.db.prepare(e);return (await(t.length>0?s.bind(...t):s).all()).results||[]}else if(this.db&&typeof this.db.run=="function"){let s=await this.db.run(sql.raw(this.replaceParams(e,t)));return s.rows||s.results||(Array.isArray(s)?s:[])}else if(this.db&&typeof this.db.all=="function"){let s=await this.db.all(sql.raw(this.replaceParams(e,t)));return Array.isArray(s)?s:s.results||[]}else if(this.db&&typeof this.db.execute=="function"){let s=await this.db.execute(sql.raw(this.replaceParams(e,t)));return s.rows||s.results||(Array.isArray(s)?s:[])}}catch(s){console.warn("[D1AuthAdapter] SQL execution note:",s.message);}return []}async getOne(e,t=[]){try{if(this.db&&typeof this.db.prepare=="function"){let r=this.db.prepare(e);return await(t.length>0?r.bind(...t):r).first()||null}}catch{}let s=await this.executeSql(e,t);return s.length>0?s[0]:null}replaceParams(e,t){let s=0;return e.replace(/\?/g,()=>{let r=t[s++];return r==null?"NULL":typeof r=="number"||typeof r=="boolean"?String(r):`'${String(r).replace(/'/g,"''")}'`})}async connect(){await this.executeSql(`
+      CREATE TABLE IF NOT EXISTS users (
+        id TEXT PRIMARY KEY,
+        email TEXT UNIQUE NOT NULL,
+        password_hash TEXT,
+        name TEXT,
+        role TEXT DEFAULT 'customer',
+        avatar TEXT,
+        tenant_id TEXT,
+        email_verified INTEGER DEFAULT 1,
+        locked INTEGER DEFAULT 0,
+        last_login TEXT,
+        failed_login_attempts INTEGER DEFAULT 0,
+        metadata TEXT,
+        created_at TEXT DEFAULT CURRENT_TIMESTAMP,
+        updated_at TEXT DEFAULT CURRENT_TIMESTAMP
+      );
+    `),await this.executeSql("ALTER TABLE users ADD COLUMN metadata TEXT;"),await this.executeSql("ALTER TABLE users ADD COLUMN avatar TEXT;"),await this.executeSql("ALTER TABLE audit_logs ADD COLUMN metadata TEXT;"),await this.executeSql("ALTER TABLE audit_logs ADD COLUMN resource_id TEXT;"),await this.executeSql(`
+      CREATE TABLE IF NOT EXISTS sessions (
+        id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        token TEXT UNIQUE NOT NULL,
+        refresh_token TEXT,
+        ip_address TEXT,
+        user_agent TEXT,
+        expires_at TEXT NOT NULL,
+        created_at TEXT DEFAULT CURRENT_TIMESTAMP
+      );
+    `),await this.executeSql(`
+      CREATE TABLE IF NOT EXISTS audit_logs (
+        id TEXT PRIMARY KEY,
+        action TEXT NOT NULL,
+        user_id TEXT,
+        user_email TEXT,
+        role TEXT,
+        resource TEXT NOT NULL,
+        details TEXT,
+        ip_address TEXT,
+        status TEXT,
+        timestamp TEXT DEFAULT CURRENT_TIMESTAMP
+      );
+    `);}async hashPassword(e){return Wt.hashSync(e,10)}async verifyPassword(e,t){let s=await this.findUserByEmail(e);return !s||!s.passwordHash?null:Wt.compareSync(t,s.passwordHash)?s:null}async findUserByEmail(e){let t=await this.getOne("SELECT * FROM users WHERE LOWER(email) = LOWER(?) LIMIT 1",[e]);return t?this.mapUser(t):null}async findUserById(e){let t=await this.getOne("SELECT * FROM users WHERE id = ? LIMIT 1",[e]);return t?this.mapUser(t):null}async createUser(e){let t=`user-${Date.now()}-${Math.random().toString(36).substring(2,9)}`,s=await this.hashPassword(e.password),r=e.email.toLowerCase(),a=e.role||"customer",n=new Date().toISOString();await this.executeSql("INSERT INTO users (id, email, password_hash, name, role, avatar, tenant_id, metadata, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[t,r,s,e.name||null,a,e.avatar||null,e.tenantId||null,e.metadata?JSON.stringify(e.metadata):null,n,n]);let c=await this.findUserById(t);if(!c)throw new Error("Failed to create user in D1");return c}async updateUser(e,t){if(!await this.findUserById(e))return null;let r=["updated_at = ?"],a=[new Date().toISOString()];return t.email&&(r.push("email = ?"),a.push(t.email.toLowerCase())),t.name!==void 0&&(r.push("name = ?"),a.push(t.name)),t.password&&(r.push("password_hash = ?"),a.push(await this.hashPassword(t.password))),t.passwordHash&&(r.push("password_hash = ?"),a.push(t.passwordHash)),t.role&&(r.push("role = ?"),a.push(t.role)),t.avatar!==void 0&&(r.push("avatar = ?"),a.push(t.avatar)),t.tenantId!==void 0&&(r.push("tenant_id = ?"),a.push(t.tenantId)),t.metadata!==void 0&&(r.push("metadata = ?"),a.push(t.metadata?JSON.stringify(t.metadata):null)),a.push(e),await this.executeSql(`UPDATE users SET ${r.join(", ")} WHERE id = ?`,a),this.findUserById(e)}async deleteUser(e){return await this.executeSql("DELETE FROM users WHERE id = ?",[e]),true}async createSession(e,t){let s=`sess-${Date.now()}-${Math.random().toString(36).substring(2,9)}`,r=`token-${Date.now()}-${Math.random().toString(36).substring(2,16)}`,a=new Date(Date.now()+this.sessionTTL*1e3).toISOString(),n=new Date().toISOString();return await this.executeSql("INSERT INTO sessions (id, user_id, token, expires_at, created_at, ip_address, user_agent) VALUES (?, ?, ?, ?, ?, ?, ?)",[s,e,r,a,n,t?.ipAddress||null,t?.userAgent||null]),{id:s,userId:e,token:r,expiresAt:a,createdAt:n,ipAddress:t?.ipAddress,userAgent:t?.userAgent}}async findSessionByToken(e){let t=await this.getOne("SELECT * FROM sessions WHERE token = ? LIMIT 1",[e]);return t?{id:t.id,userId:t.user_id||t.userId,token:t.token,expiresAt:t.expires_at||t.expiresAt,createdAt:t.created_at||t.createdAt,ipAddress:t.ip_address||t.ipAddress,userAgent:t.user_agent||t.userAgent}:null}async findSessionByRefreshToken(e){let t=await this.getOne("SELECT * FROM sessions WHERE refresh_token = ? LIMIT 1",[e]);return t?{id:t.id,userId:t.user_id||t.userId,token:t.token,refreshToken:t.refresh_token,expiresAt:t.expires_at||t.expiresAt,createdAt:t.created_at||t.createdAt}:null}async deleteSession(e){return await this.executeSql("DELETE FROM sessions WHERE id = ?",[e]),true}async deleteUserSessions(e){return await this.executeSql("DELETE FROM sessions WHERE user_id = ?",[e]),1}async hasAnyUsers(){return ((await this.getOne("SELECT COUNT(*) as count FROM users"))?.count||0)>0}async createEmailVerificationToken(e){return {token:`verify-${Date.now()}`,expiresAt:new Date(Date.now()+864e5)}}async verifyEmailToken(e){return {success:true}}async createPasswordResetToken(e){return {token:`reset-${Date.now()}`,expiresAt:new Date(Date.now()+36e5)}}async resetPasswordWithToken(e,t){return {success:true}}async findAuditLogs(e){let s=(await this.executeSql("SELECT * FROM audit_logs ORDER BY timestamp DESC LIMIT ?",[e.limit||50])).map(r=>({id:r.id,action:r.action,userId:r.user_id||r.userId,userEmail:r.user_email||r.userEmail,role:r.role,resource:r.resource,resourceId:r.resource_id||r.resourceId,ipAddress:r.ip_address||r.ipAddress,userAgent:r.user_agent||r.userAgent,success:!!(r.success??true),error:r.error||void 0,metadata:r.details?JSON.parse(r.details):void 0,timestamp:new Date(r.timestamp||Date.now())}));return {logs:s,total:s.length}}async createAuditLog(e){let t=`audit-${Date.now()}-${Math.random().toString(36).substring(2,9)}`,s=new Date;return await this.executeSql("INSERT INTO audit_logs (id, action, user_id, user_email, role, resource, details, ip_address, status, timestamp) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[t,e.action,e.userId||null,e.userEmail||null,e.role||null,e.resource,e.metadata?JSON.stringify(e.metadata):null,e.ipAddress||null,e.success?"success":"failed",s.toISOString()]),{id:t,timestamp:s,...e}}mapUser(e){return {id:e.id,email:e.email,name:e.name||void 0,passwordHash:e.password_hash||e.passwordHash||void 0,role:e.role,avatar:e.avatar||void 0,tenantId:e.tenant_id||e.tenantId||void 0,metadata:e.metadata?typeof e.metadata=="string"?JSON.parse(e.metadata):e.metadata:void 0,emailVerified:!!(e.email_verified||e.emailVerified),locked:!!e.locked,lastLogin:e.last_login||e.lastLogin||void 0,failedLoginAttempts:Number(e.failed_login_attempts||e.failedLoginAttempts||0),createdAt:e.created_at||e.createdAt||new Date().toISOString(),updatedAt:e.updated_at||e.updatedAt||new Date().toISOString()}}};async function Tr(i,e){if("dialect"in i&&i.dialect==="postgres")return new a$6({db:i.client});if("dialect"in i&&i.dialect==="sqlite")return new Re({db:i.client});if("dialect"in i&&i.dialect==="mongodb"){let s=i;return new a$7({db:()=>s.db,adapter:s})}let t=resolve(e,"data","auth.db");return new a$8({path:process.env.KYRO_AUTH_DB_PATH||t})}async function zt(i){let{registry:e,db:t,authSecret:s,authAdapter:r,checkSession:a,user:n,tenantId:c,cors:p,webhookService:o,settings:u}=i,d=new Hono;function m(f){if(Array.isArray(f))return f.map(m);if(f!==null&&typeof f=="object"){let k={};for(let L in f)L!=="attrs"&&(k[L]=m(f[L]));return k}return f}d.use("*",async(f,k)=>{await k();let L=f.req.header("referer")||"";if(!(f.req.header("x-kyro-admin")==="true"||L.includes("/admin"))&&f.res.status<400){let C=f.res.headers.get("Content-Type");if(C&&C.includes("application/json"))try{let K=await f.res.clone().json(),N=m(K);f.res=f.json(N,f.res.status);}catch{}}}),d.onError((f,k)=>{if(f instanceof I||f&&typeof f.statusCode=="number")return k.json({error:f.message,...f.metadata},f.statusCode||f.status||500);if(f.name==="ZodError")return k.json({error:`Validation failed: ${a$2(f.errors)}`,details:f.errors},400);console.error("[Kyro API Error]",f);let L=process.env.NODE_ENV==="production";return k.json({error:L?"Internal Server Error":f.message||"Internal Server Error"},500)});for(let f of e.getPlugins())typeof f.serverMiddleware=="function"&&f.serverMiddleware(d);let y=u?.access?.apiAccess,l=u?.access?.enablePublicAccess??false,g=u?.access?.defaultCollectionAccess??"none";y?.requireAuth;let T=process.cwd(),S=T.endsWith("admin")?resolve(T,".."):T,w=r||await Tr(t,S),E=wt({db:t,userLookup:async f=>await w.findUserById(f)||null}),U=y?.cors?.allowedOrigins,v=p?.origins,O=Array.isArray(U)?U:typeof U=="string"&&U?U.split(`
+`).map(f=>f.trim()).filter(Boolean):[],R=O.length>0?O:v||[];(R.length>0||p)&&d.use("*",async(f,k)=>{let L=f.req.header("Origin")||"*";if(R.length>0&&!R.includes(L))throw new I(403,"Origin not allowed");let q=R.length>0?L:"*";if(f.header("Access-Control-Allow-Origin",q),f.header("Access-Control-Allow-Methods","GET, POST, PATCH, DELETE, OPTIONS"),f.header("Access-Control-Allow-Headers","Content-Type, Authorization, X-API-Key"),p?.credentials&&f.header("Access-Control-Allow-Credentials","true"),f.req.method==="OPTIONS")return f.text("");await k();});let D=u?.access?.rateLimiting,P;if(D?.enabled){let f=D.maxRequests||100,k=D.windowMs||6e4;P=new he({"api:general":{window:k,max:f}}),d.use("/api/*",async(L,q)=>{if(!P)return q();let C=L.req.header("CF-Connecting-IP")||L.req.header("X-Forwarded-For")?.split(",")[0]?.trim()||L.req.header("X-Real-IP")||"unknown",x=await P.check("api:general",C);if(L.header("X-RateLimit-Limit",String(f)),L.header("X-RateLimit-Remaining",String(x.remaining)),L.header("X-RateLimit-Reset",String(x.resetAt)),!x.allowed)return L.json({error:"Too many requests",retryAfter:x.retryAfter},429);await q();});}let W=new ye({redis:w,jwtSecret:s||"change-me",baseUrl:process.env.KYRO_BASE_URL||"http://localhost:4321",rateLimiter:P});q$1.fromConfig(t).then(f=>{f&&(W.email=f);}).catch(f=>{console.error("[Email] Failed to initialize transport from config:",f);}),Ve(d,W,t,e,E,n,c,l,g);let H=typeof e.hasCollection=="function"&&e.hasCollection("users")?e.getCollection("users"):(()=>{try{return e.getCollection("users")}catch{return a$3}})();return d.get("/api/users",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=await z(H,"read",f.req.raw,k,L,void 0,l,g);if(!q.allowed)throw new I(q.status||403,q.error||"Access denied");let C=parseInt(f.req.query("page")||"1"),x=Math.min(parseInt(f.req.query("limit")||"10"),100),K=f.req.query("search")||void 0,N=[],F=0;if(typeof w.findUsers=="function"){let M=await w.findUsers({page:C,limit:x,search:K});N=M.users||[],F=M.total||0;}else {let M=await t.find({collection:"users",page:C,limit:x,where:K?{email:{contains:K}}:{},tenantId:L});N=M.docs||[],F=M.totalDocs||0;}return f.json({docs:N,totalDocs:F,limit:x,totalPages:Math.ceil(F/x)||1,page:C,pagingCounter:(C-1)*x+1,hasPrevPage:C>1,hasNextPage:C<Math.ceil(F/x),prevPage:C>1?C-1:null,nextPage:C<Math.ceil(F/x)?C+1:null})}),d.get("/api/users/:id",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=f.req.param("id"),C=await w.findUserById(q);if(!C)throw new I(404,"User not found");return f.json({data:C})}),d.post("/api/users",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=await z(H,"create",f.req.raw,k,L,void 0,l,g);if(!q.allowed)throw new I(q.status||403,q.error||"Access denied");let C=await f.req.json();if(!C.email||!C.password)throw new I(400,"Email and password are required");if(await w.findUserByEmail(C.email))throw new I(400,"Email already in use");let K=C.role||"customer";if(K!=="customer"&&k?.role!=="super_admin")throw new I(403,"Forbidden: Only super_admin can assign administrative roles");let N=await w.createUser({email:C.email,password:C.password,name:C.name,role:K,avatar:C.avatar,tenantId:C.tenantId});return k&&w?.createAuditLog({action:"user_create",userId:k.id,resource:"users",resourceId:N.id,success:true}),f.json({data:N,message:"User created successfully"},201)}),d.patch("/api/users/:id",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=await z(H,"update",f.req.raw,k,L,void 0,l,g);if(!q.allowed)throw new I(q.status||403,q.error||"Access denied");let C=f.req.param("id"),x=await f.req.json(),K=await w.findUserById(C);if(!K)throw new I(404,"User not found");let N={};if(x.name!==void 0&&(N.name=x.name),x.email!==void 0&&(N.email=x.email),x.role!==void 0&&x.role!==K.role){if(k?.role!=="super_admin")throw new I(403,"Forbidden: Only super_admin can modify user roles");N.role=x.role;}x.avatar!==void 0&&(N.avatar=typeof x.avatar=="object"&&x.avatar!==null?x.avatar.id||String(x.avatar):x.avatar),x.tenantId!==void 0&&(N.tenantId=x.tenantId),x.emailVerified!==void 0&&(N.emailVerified=x.emailVerified),x.locked!==void 0&&(N.locked=x.locked),x.failedLoginAttempts!==void 0&&(N.failedLoginAttempts=x.failedLoginAttempts),x.lastLogin!==void 0&&(N.lastLogin=x.lastLogin);let F=await w.updateUser(C,N);if(!F)throw new I(500,"User update failed");return k&&(w?.createAuditLog({action:"user_update",userId:k.id,resource:"users",resourceId:C,success:true}),x.role&&K.role!==x.role&&w?.createAuditLog({action:"role_change",userId:k.id,resource:"users",resourceId:C,success:true,metadata:{oldRole:K.role,newRole:x.role}})),f.json({data:F,message:"User updated successfully"})}),d.delete("/api/users/:id",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=await z(H,"delete",f.req.raw,k,L,void 0,l,g);if(!q.allowed)throw new I(q.status||403,q.error||"Access denied");let C=f.req.param("id");if(k&&k.id===C)throw new I(403,"You cannot delete your own account");let x=await w.findUserById(C);if(!x)throw new I(404,"User not found");if(!await w.deleteUser(C))throw new I(500,"User deletion failed");return k&&w?.createAuditLog({action:"user_delete",userId:k.id,resource:"users",resourceId:C,success:true}),f.json({data:x,message:"User deleted successfully"})}),d.get("/api/auth/audit-logs",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=e.getCollection("audit_logs");if(q){let X=await z(q,"read",f.req.raw,k,L,void 0,l,g);if(!X.allowed)throw new I(X.status||403,X.error||"Access denied")}else if(!k)throw new I(401,"Authentication required");let C=parseInt(f.req.query("page")||"1"),x=Math.min(parseInt(f.req.query("limit")||"50"),100),K=f.req.query("action")||void 0,N=f.req.query("userId")||void 0,F=f.req.query("resource")||void 0,M=await w.findAuditLogs({action:K,userId:N,resource:F,limit:x,offset:(C-1)*x});return f.json({docs:M.logs,totalDocs:M.total,limit:x,totalPages:Math.ceil(M.total/x),page:C,pagingCounter:(C-1)*x+1,hasPrevPage:C>1,hasNextPage:C<Math.ceil(M.total/x),prevPage:C>1?C-1:null,nextPage:C<Math.ceil(M.total/x)?C+1:null})}),Ke(d,i,E),d.get("/api/storage-status",async f=>{let{user:k}=await $(f.req.raw,E,n,c);if(!k)throw new I(401,"Authentication required");let L=typeof globalThis.STORAGE_BUCKET<"u"||typeof f.env?.STORAGE_BUCKET<"u",q=L,C=L?"cloudflare_r2":"local";if(t)try{let x=t.prepare('SELECT provider FROM "_globals_storage-settings" LIMIT 1').get();x&&x.provider&&(q=!0,C=x.provider==="aws"?"s3":x.provider);}catch{try{let x=await t.findOne({collection:"_globals_storage-settings",where:{},draft:!0});x&&x.provider&&(q=!0,C=x.provider==="aws"?"s3":x.provider);}catch{}}return f.json({provider:C,configured:q,usage:0,limit:"unlimited"})}),d.get("/api/plugins",async f=>{let{user:k}=await $(f.req.raw,E,n,c);if(!k)throw new I(401,"Authentication required");let L=e.getPlugins(),q=e.storageProviders,C=await Promise.all(L.map(async x=>{let K=true,N=x.name,F={};try{let G=await t.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});G&&G.states&&(F=G.states);}catch{}F[N]!==void 0&&(K=F[N]),q.setPluginEnabled(N,K);let M=N.replace(/^@[^/]+\//,"");M=M.replace(/^(plugin|kyro)-/,"");let X={ai:"AI",seo:"SEO",s3:"S3",aws:"AWS",api:"API",ui:"UI",ftp:"FTP"};if(M=M.split("-").map(G=>{let me=G.toLowerCase();return X[me]?X[me]:G.charAt(0).toUpperCase()+G.slice(1)}).join(" "),M.toLowerCase().startsWith("storage ")){let G=M.split(" ");G.length===2&&(M=`${G[1]} Storage`);}return {id:N,name:x.displayName||M,version:x.version||"1.0.0",description:x.description||"",enabled:K,status:K?"active":"disabled"}}));return f.json(C)}),d.put("/api/plugins/:name/toggle",async f=>{let{user:k}=await $(f.req.raw,E,n,c);if(!k)throw new I(401,"Authentication required");let L=f.req.param("name"),q=e.storageProviders,x=!q.isPluginEnabled(L),K=[];if(!x)for(let F of q.getAll())F.pluginName===L&&K.push(F.type);if(!(f.req.query("force")==="1")&&!x&&K.length>0){let F="local";try{let M=t?.prepare?.('SELECT provider FROM "_globals_storage-settings" LIMIT 1')?.get();M?.provider&&(F=M.provider);}catch{try{let M=await t?.findOne?.({collection:"_globals_storage-settings",where:{},draft:!0});M?.provider&&(F=M.provider);}catch{}}if(K.includes(F))return f.json({error:`Cannot disable "${L}" \u2014 storage provider "${F}" is currently active. Switch to Local storage first.`,requiresAction:true,activeProvider:F},409)}try{let F={},M="global",X=await t.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});X&&(F=X.states||{},M=X.id),F[L]=x,X?await t.update({collection:"_globals_plugin-settings",id:M,data:{states:F}}):await t.create({collection:"_globals_plugin-settings",data:{states:F,id:"global"}});}catch(F){console.warn(`[Plugins] Could not persist state for "${L}":`,F);}return q.setPluginEnabled(L,x),f.json({name:L,enabled:x})}),d.get("/api/health",f=>f.json({status:"ok",version:"0.13.0",collections:e.getCollectionSlugs(),timestamp:new Date().toISOString()})),d.get("/api/metrics",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c);if(!k)throw new I(401,"Authentication required");let q=k.role==="admin"||k.role==="super_admin",x=e.getCollectionSlugs().filter(J=>!["users","audit_logs","media","_globals_access-settings","_globals_brand-settings"].includes(J)&&!J.startsWith("_globals_")).filter(J=>q||a$4(k,`${J}:read`)),K=0,N={};await Promise.all(x.map(async J=>{try{let Ye=(await t.find({collection:J,where:{},limit:1,page:1,tenantId:L})).totalDocs??0;K+=Ye,N[J]=Ye;}catch{}}));let F=0;try{F=(await t.find({collection:"media",where:{},limit:1,page:1,tenantId:L})).totalDocs??0;}catch{}let M=0;try{M=(await t.find({collection:"users",where:{},limit:1,page:1,tenantId:L})).totalDocs??0;}catch{}let X=0;try{if(o){let J=await o.getWebhooks();X=Array.isArray(J)?J.length:0;}}catch{}let G=0;try{G=(await t.find({collection:a$5,where:{},limit:1,page:1,tenantId:L})).totalDocs??0;}catch{}let me=K+F+M;return f.json({totalDocuments:K,totalMedia:q||a$4(k,"media:read")?F:void 0,totalUsers:q||a$4(k,"users:read")?M:void 0,totalWebhooks:q?X:void 0,totalApiKeys:q?G:void 0,totalStoredRecords:me,collectionCounts:N,collections:x.length,timestamp:new Date().toISOString()})}),We(d,i,E),ze(d,i,E),Pe(d,i,E),Le(d,i,E),Ge(d,i),d.onError((f,k)=>{let L=Number(f?.statusCode||f?.status||500);return L>=500&&console.error(`[API Error] ${k.req.method} ${k.req.path}:`,f),k.json({error:f.message||"Internal server error",code:L>=500?"INTERNAL_ERROR":"BAD_REQUEST"},L)}),d}async function vr(i,e,t){return zt({registry:i,db:e,authSecret:t?.authSecret,user:t?.user,req:t?.req,tenantId:t?.tenantId,cors:t?.cors,webhookService:t?.webhookService})}
+export{mr as a,gr as b,Lt as c,oe as d,Ne as e,he as f,bt as g,$r as h,At as i,ye as j,Dt as k,ve as l,Re as m,zt as n,vr as o};