@kyro-cms/core 0.13.6 → 0.13.7

package/dist/{chunk-HACW42ZZ.cjs → chunk-O2SA56P2.cjs}

@@ -1,4 +1,4 @@
-'use strict';var chunkH2IJDTA2_cjs=require('./chunk-H2IJDTA2.cjs'),chunkPW6Y5MQL_cjs=require('./chunk-PW6Y5MQL.cjs'),chunk34LCWI5X_cjs=require('./chunk-34LCWI5X.cjs'),chunkLXTVMP5F_cjs=require('./chunk-LXTVMP5F.cjs'),chunk2I2AXTKY_cjs=require('./chunk-2I2AXTKY.cjs'),chunkOJBL4CXK_cjs=require('./chunk-OJBL4CXK.cjs'),chunkDCFOVCJX_cjs=require('./chunk-DCFOVCJX.cjs'),chunkEG4SRTYS_cjs=require('./chunk-EG4SRTYS.cjs'),chunk3A5UO6OQ_cjs=require('./chunk-3A5UO6OQ.cjs'),chunkYOJOVQIH_cjs=require('./chunk-YOJOVQIH.cjs'),chunkNBBAMC2X_cjs=require('./chunk-NBBAMC2X.cjs'),chunkOXEJCIOA_cjs=require('./chunk-OXEJCIOA.cjs'),chunkKOSR7235_cjs=require('./chunk-KOSR7235.cjs'),hono=require('hono'),Ae=require('path'),crypto=require('crypto'),jwt=require('hono/jwt'),fs=require('fs'),promises=require('fs/promises'),ir=require('process'),clientS3=require('@aws-sdk/client-s3'),nodeHttpHandler=require('@smithy/node-http-handler');require('stream');var zodToJsonSchema=require('zod-to-json-schema'),Kt=require('bcryptjs'),drizzleOrm=require('drizzle-orm');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var Ae__default=/*#__PURE__*/_interopDefault(Ae);var ir__default=/*#__PURE__*/_interopDefault(ir);var Kt__default=/*#__PURE__*/_interopDefault(Kt);function yt(i){let{db:t,userLookup:s}=i;return async function(a){let n=chunkDCFOVCJX_cjs.c(a);if(n&&t){let p=await chunkDCFOVCJX_cjs.b(n,t,s);if(p.valid&&p.user)return {user:p.user,tenantContext:ht(p.user),apiKeyContext:chunkDCFOVCJX_cjs.d(p),status:200,authType:"apikey"};if(p.error)return {status:401,error:p.error}}let c=chunkLXTVMP5F_cjs.g(a);if(c)try{let p=await chunkLXTVMP5F_cjs.m(c);if(!p.valid)return {status:401,error:p.reason||"Session invalid"};let o=await chunkLXTVMP5F_cjs.s(a);if(o){let u=s?await s(o.userId):null;if(u)return {user:u,tenantContext:ht(u),status:200,authType:"session"}}}catch(p){console.error("Session validation error:",p);}return {status:401,error:"Authentication required"}}}function ht(i){return {tenantId:i.tenantId||"default",userId:i.id||"anonymous",role:i.role||"guest",roles:[i.role||"guest"],permissions:[],isSuperAdmin:i.role==="super_admin"}}var fe=class{storage=new Map;userStorage=new Map;limits;userLimits;constructor(e,t){this.limits={...zt,...e},this.userLimits=t||{"user:api":{window:6e4,max:500},"user:write":{window:36e5,max:100}};}getKey(e,t){return `${e}:${t}`}getUserKey(e,t,s){return `user:${e}:${t}:${s}`}cleanupOldEntries(e,t){let r=Date.now()-t;for(;e.length>0&&e[0].timestamp<r;)e.shift();}async check(e,t){let s=this.limits[e]||this.limits["api:general"],r=this.getKey(e,t),a=this.storage.get(r);a||(a=[],this.storage.set(r,a)),this.cleanupOldEntries(a,s.window);let n=Date.now(),c=a.reduce((p,o)=>p+o.count,0);if(a.push({timestamp:n,count:1}),c>=s.max){let o=a.reduce((u,d)=>u.timestamp<d.timestamp?u:d,a[0]).timestamp+s.window;return {allowed:false,remaining:0,resetAt:o,retryAfter:Math.ceil((o-n)/1e3)}}return {allowed:true,remaining:s.max-c-1,resetAt:n+s.window}}async checkUser(e,t,s){let r=this.userLimits[e]||this.userLimits["user:api"],a=this.userStorage.get(t),n=[];a?n=a.get(this.getKey(e,s))||[]:(this.userStorage.has(t)||this.userStorage.set(t,new Map),this.userStorage.get(t).set(this.getKey(e,s),n)),this.cleanupOldEntries(n,r.window);let c=Date.now(),p=n.reduce((o,u)=>o+u.count,0);if(n.push({timestamp:c,count:1}),p>=r.max){let u=n.reduce((d,m)=>d.timestamp<m.timestamp?d:m,n[0]).timestamp+r.window;return {allowed:false,remaining:0,resetAt:u,retryAfter:Math.ceil((u-c)/1e3)}}return {allowed:true,remaining:r.max-p-1,resetAt:c+r.window}}async reset(e,t){let s=this.getKey(e,t);this.storage.delete(s);}async resetUser(e,t,s){let r=this.userStorage.get(t);if(r){let a=this.getKey(e,s);r.delete(a);}}async getStatus(e,t){let s=this.limits[e]||this.limits["api:general"],r=this.getKey(e,t),a=this.storage.get(r);a||(a=[],this.storage.set(r,a)),this.cleanupOldEntries(a,s.window);let n=Date.now(),c=a.reduce((p,o)=>p+o.count,0);return {count:c,limit:s.max,remaining:Math.max(0,s.max-c),resetAt:n+s.window}}setLimit(e,t){this.limits[e]=t;}setUserLimit(e,t){this.userLimits[e]=t;}},zt={"auth:login":{window:9e5,max:5},"auth:register":{window:36e5,max:3},"auth:forgot":{window:36e5,max:3},"auth:reset":{window:36e5,max:5},"auth:verify":{window:36e5,max:5},"api:general":{window:6e4,max:100},"api:authenticated":{window:6e4,max:200}};var Ue={retentionDays:30};var wt=class{redis;prefix;retentionDays;constructor(e,t=30,s="kyro:audit:"){this.redis=e,this.prefix=s,this.retentionDays=t;}async log(e){let t=crypto.randomBytes(16).toString("hex"),s=new Date,r={...e,id:t,timestamp:s},a=this.getKeyForDate(s),n=`${this.prefix}log:${t}`;await this.redis.hset(n,this.serializeLog(r)),await this.redis.expire(n,this.retentionDays*24*60*60+3600),await this.redis.zadd(a,s.getTime(),t),await this.redis.expire(a,this.retentionDays*24*60*60+3600);let c=e.userId?`${this.prefix}user:${e.userId}`:null;return c&&(await this.redis.zadd(c,s.getTime(),t),await this.redis.expire(c,this.retentionDays*24*60*60+3600)),t}async get(e){let t=`${this.prefix}log:${e}`,s=await this.redis.hgetall(t);return !s||Object.keys(s).length===0?null:this.deserializeLog(s)}async query(e={}){let{limit:t=50,offset:s=0}=e,r=[];if(e.userId)r.push(`${this.prefix}user:${e.userId}`);else if(e.startDate||e.endDate)r=this.getKeysForDateRange(e.startDate,e.endDate);else {let p=new Date;r=this.getKeysForDateRange(new Date(p.getTime()-this.retentionDays*24*60*60*1e3),p);}let a=[];for(let p of r){let o=await this.redis.zrange(p,0,-1,"WITHSCORES");for(let u=0;u<o.length;u+=2)a.push([o[u],parseInt(o[u+1],10)]);}a.sort((p,o)=>o[1]-p[1]);let n=a.length;a=a.slice(s,s+t);let c=[];for(let[p]of a){let o=await this.get(p);o&&this.matchesFilter(o,e)&&c.push(o);}return {logs:c,total:n}}async getRecent(e=50){let t=[],s=new Date,r=this.getKeysForDateRange(new Date(s.getTime()-10080*60*1e3),s),a=[];for(let n of r){let c=await this.redis.zrange(n,0,-1,"WITHSCORES");for(let p=0;p<c.length;p+=2)a.push([c[p],parseInt(c[p+1],10)]);}a.sort((n,c)=>c[1]-n[1]);for(let[n]of a.slice(0,e)){let c=await this.get(n);c&&t.push(c);}return t}async getUserActivity(e,t=50){let s=`${this.prefix}user:${e}`,r=await this.redis.zrange(s,0,t-1),a=[];for(let n of r){let c=await this.get(n);c&&a.push(c);}return a}async getStats(e,t){let s=this.getKeysForDateRange(e||new Date(Date.now()-2592e6),t||new Date),r={},a=0,n=0,c=0,p=new Set;for(let o of s){let u=await this.redis.zrange(o,0,-1);for(let d of u){let m=await this.get(d);m&&(a++,r[m.action]=(r[m.action]||0)+1,m.success&&c++,m.action==="login_failed"&&n++,m.userId&&p.add(m.userId));}}return {totalEvents:a,byAction:r,successRate:a>0?c/a:1,failedLogins:n,uniqueUsers:p}}async cleanup(){let e=Date.now()-this.retentionDays*24*60*60*1e3,t=await this.redis.keys(`${this.prefix}date:*`),s=0;for(let r of t){let a=await this.redis.zrangebyscore(r,0,e);for(let n of a)await this.redis.del(`${this.prefix}log:${n}`),s++;await this.redis.zremrangebyscore(r,0,e);}return s}getKeyForDate(e){let t=e.getFullYear(),s=String(e.getMonth()+1).padStart(2,"0"),r=String(e.getDate()).padStart(2,"0");return `${this.prefix}date:${t}-${s}-${r}`}getKeysForDateRange(e,t){let s=[],r=e||new Date(Date.now()-this.retentionDays*24*60*60*1e3),a=t||new Date,n=new Date(r);for(;n<=a;)s.push(this.getKeyForDate(n)),n.setDate(n.getDate()+1);return s}matchesFilter(e,t){return !(t.action&&!(Array.isArray(t.action)?t.action:[t.action]).includes(e.action)||t.resource&&e.resource!==t.resource||t.resourceId&&e.resourceId!==t.resourceId||t.success!==void 0&&e.success!==t.success)}serializeLog(e){let t={id:e.id,timestamp:new Date(e.timestamp).toISOString(),action:e.action,resource:e.resource,success:e.success?"1":"0"};return e.userId&&(t.userId=e.userId),e.userEmail&&(t.userEmail=e.userEmail),e.role&&(t.role=e.role),e.resourceId&&(t.resourceId=e.resourceId),e.ipAddress&&(t.ipAddress=e.ipAddress),e.userAgent&&(t.userAgent=e.userAgent),e.error&&(t.error=e.error),e.changes&&(t.changes=JSON.stringify(e.changes)),e.metadata&&(t.metadata=JSON.stringify(e.metadata)),t}deserializeLog(e){return {id:e.id,timestamp:new Date(e.timestamp),action:e.action,userId:e.userId,userEmail:e.userEmail,role:e.role,resource:e.resource,resourceId:e.resourceId,ipAddress:e.ipAddress,userAgent:e.userAgent,success:e.success==="1",error:e.error,changes:e.changes?JSON.parse(e.changes):void 0,metadata:e.metadata?JSON.parse(e.metadata):void 0}}};function Cr(i){return {ipAddress:i.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||i.headers.get("x-real-ip")||"unknown",userAgent:i.headers.get("user-agent")||"unknown"}}function ee(i){return {ipAddress:i.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||i.headers.get("x-real-ip")||"unknown",userAgent:i.headers.get("user-agent")||"unknown"}}var bt=class{logs=[];retentionDays;constructor(e=Ue.retentionDays){this.retentionDays=e;}async log(e){let t=crypto.randomBytes(16).toString("hex"),r={...e,id:t,timestamp:new Date};return this.logs.push(r),this.cleanupOldLogs(),t}async get(e){return this.logs.find(t=>t.id===e)||null}async query(e={}){let{limit:t=50,offset:s=0}=e,r=[...this.logs];if(e.userId&&(r=r.filter(o=>o.userId===e.userId)),e.action){let o=Array.isArray(e.action)?e.action:[e.action];r=r.filter(u=>o.includes(u.action));}e.resource&&(r=r.filter(o=>o.resource===e.resource)),e.resourceId&&(r=r.filter(o=>o.resourceId===e.resourceId)),e.success!==void 0&&(r=r.filter(o=>o.success===e.success));let a=e.startDate,n=e.endDate;a!==void 0&&(r=r.filter(o=>o.timestamp>=a)),n!==void 0&&(r=r.filter(o=>o.timestamp<=n)),r.sort((o,u)=>u.timestamp.getTime()-o.timestamp.getTime());let c=r.length;return {logs:r.slice(s,s+t),total:c}}async getRecent(e=50){let t=new Date(Date.now()-6048e5);return this.logs.filter(r=>r.timestamp>=t).sort((r,a)=>a.timestamp.getTime()-r.timestamp.getTime()).slice(0,e)}async getUserActivity(e,t=50){return this.logs.filter(r=>r.userId===e).sort((r,a)=>a.timestamp.getTime()-r.timestamp.getTime()).slice(0,t)}async getStats(e,t){let s=e||new Date(Date.now()-2592e6),r=t||new Date,a=this.logs.filter(d=>d.timestamp>=s&&d.timestamp<=r),n={},c=0,p=0,o=0,u=new Set;for(let d of a){c++;let m=d.action;n[m]=(n[m]||0)+1,d.success&&o++,d.action==="login_failed"&&p++,d.userId&&u.add(d.userId);}return {totalEvents:c,byAction:n,successRate:c>0?o/c:1,failedLogins:p,uniqueUsers:u}}async cleanup(){let e=new Date(Date.now()-this.retentionDays*24*60*60*1e3),t=this.logs.length;return this.logs=this.logs.filter(s=>s.timestamp>=e),t-this.logs.length}cleanupOldLogs(){let e=new Date(Date.now()-this.retentionDays*24*60*60*1e3);this.logs.length;this.logs=this.logs.filter(s=>s.timestamp>=e);}};var he=class{authAdapter;email;passwordPolicy;lockout;rateLimiter;auditLogger;baseUrl;emailVerificationRequired;jwtSecret;constructor(e){this.authAdapter=e.redis,this.email=e.email,this.passwordPolicy=e.passwordPolicy||new chunkH2IJDTA2_cjs.a,this.lockout=e.lockout,this.rateLimiter=e.rateLimiter,this.auditLogger=e.auditLogger,this.baseUrl=e.baseUrl||"http://localhost:4321",this.emailVerificationRequired=e.emailVerificationRequired??true,this.jwtSecret=e.jwtSecret||"kyro-default-secret-key-change-me-in-production";}getBaseUrl(e){if(e)try{let t=e.headers.get("x-forwarded-proto")||(e.url.startsWith("https")?"https":"http"),s=e.headers.get("x-forwarded-host")||e.headers.get("host");return s?`${t}://${s}`:new URL(e.url).origin}catch{}return process.env.KYRO_BASE_URL||process.env.SERVER_URL||process.env.PUBLIC_URL||process.env.SITE_URL||this.baseUrl||"http://localhost:4321"}async register(e){let{ipAddress:t,userAgent:s}=ee(e);if(this.rateLimiter){let r=await this.rateLimiter.check("auth:register",t);if(!r.allowed)return this.rateLimitResponse(r)}try{let r=await e.json();if(!r.email||!r.password)return this.errorResponse("Email and password are required",400);if(r.password!==r.confirmPassword)return this.errorResponse("Passwords do not match",400);let a=this.passwordPolicy.validate(r.password);if(!a.valid)return this.errorResponse(a.errors.join(". "),400);let n=await this.authAdapter.findUserByEmail(r.email);if(n){if(!n.emailVerified&&this.emailVerificationRequired&&this.email){let o=(await this.authAdapter.createEmailVerificationToken?.(n.id))?.token||crypto.randomBytes(32).toString("hex"),d=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${o}`,m=this.email.getTemplates().verifyEmail(d,r.email);return await this.email.send({to:r.email,...m}),this.jsonResponse({success:!0,message:"An unverified account already exists with this email. We have resent the confirmation link to your inbox.",requiresVerification:!0},200)}return this.errorResponse("Email already registered",400)}let c=await this.authAdapter.createUser({email:r.email,password:r.password,role:r.role||"customer",tenantId:r.tenantId});if(this.emailVerificationRequired&&this.email){let p=crypto.randomBytes(32).toString("hex"),u=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${p}`;await this.authAdapter.createSession(c.id,{ipAddress:t,userAgent:s});let d=this.email.getTemplates().verifyEmail(u,r.email);await this.email.send({to:r.email,...d});}return this.auditLogger&&await this.auditLogger.log({action:"register",userId:c.id,userEmail:c.email,resource:"auth",ipAddress:t,userAgent:s,success:!0}),this.jsonResponse({success:!0,message:"Registration successful",user:this.sanitizeUser(c),requiresVerification:this.emailVerificationRequired&&!!this.email},201)}catch(r){return console.error("[AuthRoutes.register] Registration error:",r),this.errorResponse("Registration failed",500)}}async login(e){let{ipAddress:t,userAgent:s}=ee(e);if(this.rateLimiter){let r=await this.rateLimiter.check("auth:login",t);if(!r.allowed)return this.rateLimitResponse(r)}try{let r=await e.json();if(!r.email||!r.password)return this.errorResponse("Email and password are required",400);let a=await this.authAdapter.findUserByEmail(r.email);if(!a)return await this.recordFailedLogin(t,s),this.errorResponse("Invalid credentials",401);if(a.locked)return this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:a.id,userEmail:a.email,resource:"auth",ipAddress:t,userAgent:s,success:!1,error:"Account locked"}),this.errorResponse("Account locked. Contact an administrator.",403);if(this.lockout){let u=await this.lockout.checkLockout(a.id);if(u.locked)return this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:a.id,userEmail:a.email,resource:"auth",ipAddress:t,userAgent:s,success:!1,error:"Account locked"}),this.errorResponse(`Account locked. Try again in ${Math.ceil((u.lockedUntil.getTime()-Date.now())/6e4)} minutes`,423)}let n=await this.authAdapter.verifyPassword(r.email,r.password);if(!n)return await this.recordFailedLogin(t,s,a.id,a.email),this.errorResponse("Invalid credentials",401);if(this.emailVerificationRequired&&n.emailVerified===!1){if(this.email){let d=(await this.authAdapter.createEmailVerificationToken?.(n.id))?.token||crypto.randomBytes(32).toString("hex"),y=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${d}`,l=this.email.getTemplates().verifyEmail(y,n.email);await this.email.send({to:n.email,...l});}return this.errorResponse("Your email address is not verified yet. We have sent a new confirmation link to your email inbox.",403)}this.lockout&&await this.lockout.resetAttempts(a.id),this.auditLogger&&await this.auditLogger.log({action:"login",userId:a.id,userEmail:a.email,role:a.role,resource:"auth",ipAddress:t,userAgent:s,success:!0}),await this.authAdapter.updateUser(a.id,{lastLogin:new Date().toISOString()});let c=await chunkLXTVMP5F_cjs.k({id:a.id,email:a.email,role:a.role,tenantId:a.tenantId});if(this.email&&a.email){let u=new Date().toLocaleString(),d=this.email.getTemplates().newLogin(t,u,a.email,void 0,s);this.email.send({to:a.email,...d}).catch(m=>console.error("Failed to send newLogin email:",m));}let p={success:!0,user:this.sanitizeUser(a)},o=this.jsonResponse(p);return chunkLXTVMP5F_cjs.i(o,c)}catch(r){return console.error("[Auth] Login error:",r),this.errorResponse("Login failed",500)}}async logout(e){let t=chunkLXTVMP5F_cjs.g(e);if(!t)return this.errorResponse("No session to logout",401);let{ipAddress:s,userAgent:r}=ee(e);try{let a=await chunkLXTVMP5F_cjs.s(e);a&&(await chunkLXTVMP5F_cjs.o(t),this.auditLogger&&await this.auditLogger.log({action:"logout",userId:a.userId,userEmail:a.email,resource:"auth",ipAddress:s,userAgent:r,success:!0}));let n=this.jsonResponse({success:!0,message:"Logged out successfully"});return chunkLXTVMP5F_cjs.j(n)}catch{return this.errorResponse("Logout failed",500)}}async refresh(e){try{let t=chunkLXTVMP5F_cjs.g(e);if(!t)return this.errorResponse("Not authenticated",401);let s=await chunkLXTVMP5F_cjs.n(t,e);return s?this.jsonResponse({success:!0,expiresAt:s.expiresAt}):this.errorResponse("Session not found",404)}catch(t){return console.error("[Auth] Session refresh error:",t),this.errorResponse("Session refresh failed",500)}}async me(e){let t=await chunkLXTVMP5F_cjs.s(e);return t?this.jsonResponse({success:true,user:{id:t.userId,email:t.email,role:t.role,tenantId:t.tenantId}}):this.errorResponse("Not authenticated",401)}async changePassword(e){let t=await chunkLXTVMP5F_cjs.s(e);if(!t)return this.errorResponse("Not authenticated",401);let{ipAddress:s,userAgent:r}=ee(e);try{let a=await e.json(),{currentPassword:n,newPassword:c,confirmPassword:p}=a;if(!n||!c)return this.errorResponse("Current and new password required",400);if(c!==p)return this.errorResponse("Passwords do not match",400);let o=this.passwordPolicy.validate(c);if(!o.valid)return this.errorResponse(o.errors.join(". "),400);let u=await this.authAdapter.findUserById(t.userId);if(!u)return this.errorResponse("User not found",404);if(!(u.passwordHash?await this.authAdapter.verifyPassword(n,u.passwordHash):!1))return this.errorResponse("Current password is incorrect",401);let m=await this.authAdapter.getPasswordHistory?.(u.id,5);if(await this.authAdapter.isPasswordInHistory?.(c,u.id,5))return this.errorResponse("Password was recently used. Please choose a different password",400);let l=await this.authAdapter.hashPassword(c);if(u.passwordHash&&await this.authAdapter.addPasswordToHistory?.(u.id,u.passwordHash),await this.authAdapter.updateUser(u.id,{passwordHash:l}),await this.authAdapter.deleteUserSessions(u.id),this.email&&this.email.getTemplates){let g=this.email.getTemplates().passwordChanged(u.email,void 0,s,r);await this.email.send({to:u.email,...g});}return this.auditLogger&&await this.auditLogger.log({action:"password_change",userId:u.id,userEmail:u.email,resource:"auth",ipAddress:s,userAgent:r,success:!0}),this.jsonResponse({success:!0,message:"Password changed successfully"})}catch{return this.errorResponse("Password change failed",500)}}async forgotPassword(e){let{ipAddress:t,userAgent:s}=ee(e);if(this.rateLimiter){let r=await this.rateLimiter.check("auth:forgot",t);if(!r.allowed)return this.rateLimitResponse(r)}try{let r=await e.json(),{email:a}=r;if(!a)return this.errorResponse("Email required",400);let n=await this.authAdapter.findUserByEmail(a);if(!n)return this.jsonResponse({success:!0,message:"If the email exists, a reset link has been sent"});if(this.email){let c=crypto.randomBytes(32).toString("hex");if(this.authAdapter.createPasswordResetToken){let d=await this.authAdapter.createPasswordResetToken(n.email);d.token&&(c=d.token);}let o=`${this.getBaseUrl(e)}/admin/auth/reset-password?token=${c}`,u=this.email.getTemplates().resetPassword(o,n.email);await this.email.send({to:n.email,...u});}return this.auditLogger&&await this.auditLogger.log({action:"password_reset",userId:n.id,userEmail:n.email,resource:"auth",ipAddress:t,userAgent:s,success:!0}),this.jsonResponse({success:!0,message:"If the email exists, a reset link has been sent"})}catch{return this.errorResponse("Password reset request failed",500)}}async resetPassword(e){let{ipAddress:t}=ee(e);if(this.rateLimiter){let r=await this.rateLimiter.check("auth:reset",t);if(!r.allowed)return this.rateLimitResponse(r)}try{let r=await e.json(),{token:a,newPassword:n,confirmPassword:c}=r;if(!a||!n)return this.errorResponse("Reset token and new password are required",400);if(n!==c)return this.errorResponse("Passwords do not match",400);let p=this.passwordPolicy.validate(n);if(!p.valid)return this.errorResponse(p.errors.join(". "),400);if(this.authAdapter.resetPasswordWithToken){let o=await this.authAdapter.resetPasswordWithToken(a,n);if(!o.success)return this.errorResponse(o.error||"Password reset failed or token expired",400)}return this.jsonResponse({success:!0,message:"Password reset successful. You can now log in with your new password."})}catch(r){return console.error("[AuthRoutes.resetPassword] Error:",r),this.errorResponse("Password reset failed",500)}}async verifyEmail(e){let s=new URL(e.url).searchParams.get("token");if(!s)return this.errorResponse("Verification token required",400);try{if(this.authAdapter.verifyEmailToken){let r=await this.authAdapter.verifyEmailToken(s);if(!r.success)return this.errorResponse(r.error||"Invalid or expired verification token",400);if(r.userId&&this.email){let a=await this.authAdapter.findUserById(r.userId);if(a){let n=this.email.getTemplates().welcome(a.email);await this.email.send({to:a.email,...n});}}}return this.jsonResponse({success:!0,message:"Email address verified successfully"})}catch(r){return console.error("[AuthRoutes.verifyEmail] Error:",r),this.errorResponse("Email verification failed",500)}}async recordFailedLogin(e,t,s,r){if(this.lockout){let a=await this.lockout.recordFailedAttempt(s||e);if(a.locked&&a.totalAttempts===this.lockout.getConfig().maxAttempts&&this.email&&r){let n=Math.ceil(this.lockout.getConfig().lockDuration/6e4),c=this.email.getTemplates().accountLocked(a.totalAttempts,n,r,void 0,e,t);this.email.send({to:r,...c}).catch(p=>console.error("Failed to send accountLocked email:",p));}}this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:s,userEmail:r,resource:"auth",ipAddress:e,userAgent:t,success:false,error:"Invalid credentials"});}sanitizeUser(e){let{passwordHash:t,...s}=e;return s}jsonResponse(e,t=200){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":"application/json","Cache-Control":"no-store, no-cache, must-revalidate, max-age=0"}})}async listSessions(e){let t=await chunkLXTVMP5F_cjs.s(e);if(!t)return this.errorResponse("Not authenticated",401);try{let s=await chunkLXTVMP5F_cjs.q(t.userId,chunkLXTVMP5F_cjs.g(e)??void 0);return this.jsonResponse({sessions:s})}catch(s){return console.error("[AuthRoutes.listSessions] Error:",s),this.errorResponse("Failed to list sessions",500)}}async revokeSession(e,t){let s=await chunkLXTVMP5F_cjs.s(e);if(!s)return this.errorResponse("Not authenticated",401);try{let a=(await chunkLXTVMP5F_cjs.q(s.userId)).find(n=>n.id===t);return a?a.currentSession?this.errorResponse("Cannot revoke current session",400):(await chunkLXTVMP5F_cjs.o(t),this.jsonResponse({success:!0,message:"Session revoked"})):this.errorResponse("Session not found",404)}catch(r){return console.error("[AuthRoutes.revokeSession] Error:",r),this.errorResponse("Failed to revoke session",500)}}async revokeOtherSessions(e){let t=await chunkLXTVMP5F_cjs.s(e);if(!t)return this.errorResponse("Not authenticated",401);try{let s=await chunkLXTVMP5F_cjs.q(t.userId),r=chunkLXTVMP5F_cjs.g(e);for(let a of s)a.currentSession||await chunkLXTVMP5F_cjs.o(a.id);return this.jsonResponse({success:!0,message:"Other sessions revoked"})}catch(s){return console.error("[AuthRoutes.revokeOtherSessions] Error:",s),this.errorResponse("Failed to revoke sessions",500)}}async renameSession(e,t){let s=await chunkLXTVMP5F_cjs.s(e);if(!s)return this.errorResponse("Not authenticated",401);try{if(!(await chunkLXTVMP5F_cjs.q(s.userId)).find(p=>p.id===t))return this.errorResponse("Session not found",404);let n=await e.json(),{name:c}=n;return !c||typeof c!="string"||c.trim().length===0?this.errorResponse("Invalid session name",400):(await chunkLXTVMP5F_cjs.r(t,c.trim()),this.jsonResponse({success:!0,message:"Session renamed"}))}catch(r){return console.error("[AuthRoutes.renameSession] Error:",r),this.errorResponse("Failed to rename session",500)}}async refreshSession(e){let t=chunkLXTVMP5F_cjs.g(e);if(!t)return this.errorResponse("No session",401);try{let{refreshSession:s}=await import('./auth-session-VHUHDBCL.cjs'),r=await s(t,e);return r?this.jsonResponse({success:!0,expiresAt:r.expiresAt}):this.errorResponse("Session not found",404)}catch(s){return console.error("[AuthRoutes.refreshSession] Error:",s),this.errorResponse("Failed to refresh session",500)}}errorResponse(e,t){return new Response(JSON.stringify({success:false,error:e}),{status:t,headers:{"Content-Type":"application/json"}})}async rateLimitResponse(e){return new Response(JSON.stringify({error:"Too many requests. Please try again later."}),{status:429,headers:{"Content-Type":"application/json",...e.retryAfter?{"Retry-After":e.retryAfter.toString()}:{}}})}async requestMagicLink(e){ee(e);try{let r=await e.json();if(!r.email)return this.errorResponse("Email required",400);let a=await this.authAdapter.findUserByEmail(r.email);if(!a)return this.jsonResponse({success:!0,message:"If an account exists, a link was sent."});if(this.email){let n=Buffer.from(JSON.stringify({email:a.email,exp:Date.now()+6e5})).toString("base64url"),c=crypto.createHmac("sha256",this.jwtSecret).update(n).digest("hex"),p=`${n}.${c}`,u=`${this.getBaseUrl(e)}/admin/auth/magic-link?token=${p}`,d=this.email.getTemplates().magicLink(u,void 0,a.email);this.email.send({to:a.email,...d}).catch(m=>console.error("Magic link err:",m));}return this.jsonResponse({success:!0,message:"If an account exists, a link was sent."})}catch{return this.errorResponse("Failed to process request",500)}}async verifyMagicLink(e){let{ipAddress:t,userAgent:s}=ee(e),a=new URL(e.url).searchParams.get("token");if(!a)return this.errorResponse("Token required",400);try{let[n,c]=a.split(".");if(!n||!c)return this.errorResponse("Invalid token",400);let p=crypto.createHmac("sha256",this.jwtSecret).update(n).digest("hex");if(c!==p)return this.errorResponse("Invalid token",400);let o=JSON.parse(Buffer.from(n,"base64url").toString());if(Date.now()>o.exp)return this.errorResponse("Token expired",400);let u=await this.authAdapter.findUserByEmail(o.email);if(!u)return this.errorResponse("User not found",404);if(u.locked)return this.errorResponse("Account locked",403);let d=await chunkLXTVMP5F_cjs.k({id:u.id,email:u.email,role:u.role,tenantId:u.tenantId});this.auditLogger&&await this.auditLogger.log({action:"login",userId:u.id,userEmail:u.email,resource:"auth",ipAddress:t,userAgent:s,success:!0});let m=this.jsonResponse({success:!0,user:this.sanitizeUser(u)});return chunkLXTVMP5F_cjs.i(m,d)}catch{return this.errorResponse("Invalid token",400)}}async inviteUser(e){try{let t=await e.json();if(!t.email||!t.role)return this.errorResponse("Email and role required",400);let s=await this.authAdapter.findUserByEmail(t.email);if(s)return this.errorResponse("User already exists",409);if(s=await this.authAdapter.createUser({email:t.email,password:crypto.randomBytes(16).toString("hex"),role:t.role}),this.email){let r=await this.authAdapter.createPasswordResetToken(s.email),n=`${this.getBaseUrl(e)}/admin/auth/reset-password?token=${r.token}`,c=this.email.getTemplates().userInvite(n,t.role,t.inviterName||"An administrator");this.email.send({to:s.email,...c}).catch(p=>console.error("Invite email err:",p));}return this.jsonResponse({success:!0,message:"User invited successfully"})}catch{return this.errorResponse("Failed to invite user",500)}}};var I=class extends Error{constructor(t,s,r){super(s);this.statusCode=t;this.message=s;this.metadata=r;this.name="ApiError";}statusCode;message;metadata};function Tt(i,e){if(e instanceof I)return i.json({error:e.message},e.statusCode);let t=e instanceof Error?e.message:"Internal Server Error";return i.json({error:t},500)}({_media:{create:chunkOJBL4CXK_cjs.c.MEDIA_UPLOAD,update:chunkOJBL4CXK_cjs.c.MEDIA_UPLOAD,delete:chunkOJBL4CXK_cjs.c.MEDIA_DELETE}});var oe=new WeakMap;async function H(i,e,t,s,r,a,n=true,c="none"){let p=t&&typeof t=="object"?t:null,o=p?`col:${i.slug}:${e}:${s?.id||"anon"}:${r||""}:${a?.apiKeyId||""}`:null;if(p&&o){let d=oe.get(p);if(d&&d.has(o))return d.get(o)}let u=await chunkOJBL4CXK_cjs.a(i,e,{user:s,req:t,tenantId:r,apiKey:a},{enablePublicAccess:n,defaultAccess:c});if(p&&o){let d=oe.get(p);d||(d=new Map,oe.set(p,d)),d.set(o,u);}return u}async function ye(i,e,t,s,r,a=true){let n=t&&typeof t=="object"?t:null,c=n?`gbl:${i.slug}:${e}:${s?.id||"anon"}:${r||""}`:null;if(n&&c){let o=oe.get(n);if(o&&o.has(c))return o.get(c)}let p=await chunkOJBL4CXK_cjs.b(i,e,{user:s,req:t,tenantId:r},{enablePublicAccess:a});if(n&&c){let o=oe.get(n);o||(o=new Map,oe.set(n,o)),o.set(c,p);}return p}async function ie(i,e,t,s,r,a=true){let n=await ye(i,e,t,s,r,a);if(!n.allowed)throw new I(n.status||403,n.error||"Access denied");return n}async function $(i,e,t,s){if(t)return {user:t,tenantId:s,apiKeyContext:void 0,authType:"static"};if(e){let r=await e(i);if(r.status===200&&r.user)return {user:r.user,tenantId:r.tenantContext?.tenantId,apiKeyContext:r.apiKeyContext,authType:r.authType}}return {user:void 0,tenantId:void 0,apiKeyContext:void 0,authType:void 0}}var ae=class i{hooks=[];constructor(e=[]){this.hooks=[...e];}pipe(e){return this.hooks.push(e),this}async execute(e){let t=e.data;for(let s of this.hooks)try{let r=await s({...e,data:t});r!==void 0&&(t=r);}catch(r){throw new Error(`[Kyro CMS HookPipeline Error] Failed during ${e.operation} on collection "${e.collection||"global"}": ${r instanceof Error?r.message:String(r)}`)}return t}static async run(e,t){return !e||e.length===0?t.data:new i(e).execute(t)}};function ke(i,e,t){let{registry:s,db:r,authSecret:a,user:n,tenantId:c,settings:p}=e,o=p?.access?.enablePublicAccess??true,u=p?.access?.defaultCollectionAccess??"none";for(let d of s.getCollections()){let m=d.slug,y=`/api/${m}`;i.post(`${y}/dynamic-options/:fieldName`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("fieldName"),A=d.fields.find(_=>_.name===w);if(!A||A.type!=="relationship"||!A.relationTo)throw new I(400,"Invalid field for dynamic options");let b=Array.isArray(A.relationTo)?A.relationTo[0]:A.relationTo,E=await l.req.json(),U=await r.find({collection:b,where:E.where,limit:20,tenantId:h}),O=s.getCollection(b)?.admin?.useAsTitle||"id",R=(U.docs||[]).map(_=>({label:_[O]||_.id,value:_.id}));return l.json({data:R})}),i.all(`${y}/semantic-search`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=[],A="",b=10,E=.4;if(l.req.method==="POST"){let P=await l.req.json().catch(()=>({}));w=P.vector||[],A=P.q||P.query||"",b=P.limit?parseInt(String(P.limit)):10,E=P.threshold?parseFloat(String(P.threshold)):.4;}else {let P=new URL(l.req.url);A=P.searchParams.get("q")||P.searchParams.get("query")||"",b=parseInt(P.searchParams.get("limit")||"10"),E=parseFloat(P.searchParams.get("threshold")||"0.4");}let v=(await r.find({collection:m,limit:200,tenantId:h})).docs||[],R=d.fields.filter(P=>P.type==="embedding")[0]?.name||"embedding",_=v.map(P=>{let K=P[R],W=0;if(Array.isArray(K)&&Array.isArray(w)&&w.length>0){let f=0,k=0,L=0;for(let q=0;q<Math.min(K.length,w.length);q++)f+=K[q]*w[q],k+=K[q]*K[q],L+=w[q]*w[q];W=k&&L?f/(Math.sqrt(k)*Math.sqrt(L)):0;}else if(A){let f=String(P.title||P.name||"").toLowerCase(),k=String(P.content||P.description||"").toLowerCase(),L=A.toLowerCase();f.includes(L)?W=.9:k.includes(L)?W=.7:W=.1;}return {doc:P,score:W}}),D=await Promise.all(_.filter(P=>P.score>=E).sort((P,K)=>K.score-P.score).slice(0,b).map(async P=>({...await chunkYOJOVQIH_cjs.b(P.doc,d.fields,g,l.req.raw,"read"),_similarity:Math.round(P.score*1e3)/1e3})));return l.json({docs:D,totalDocs:D.length,query:A||void 0})}),i.get(y,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=new URL(l.req.url),w=S.searchParams.get("draft"),A=S.searchParams.get("kyroToken"),b=false,E=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";if(w==="true"&&A&&E)try{let q=await jwt.verify(A,E,"HS256");q&&q.type==="preview"&&q.collection===d.slug&&(b=!0);}catch(q){console.warn("Invalid preview token",q);}if(!b){let q=await H(d,"read",l.req.raw,g,h,T,o,u);if(!q.allowed)throw new I(q.status||403,q.error||"Access denied")}let U=parseInt(S.searchParams.get("limit")||"10"),v=parseInt(S.searchParams.get("page")||"1"),O=S.searchParams.get("sort")||void 0,R=parseInt(S.searchParams.get("depth")||"0"),_=S.searchParams.get("select")?.split(",")||void 0,D=S.searchParams.get("where"),P;if(D)try{P=JSON.parse(decodeURIComponent(D));}catch{throw new I(400,"Invalid JSON in where clause")}let K=S.searchParams.get("search")||S.searchParams.get("q");if(K&&K.trim()){let q=K.trim(),C=(d.fields||[]).filter(x=>x.name&&x.name!=="id"&&(x.type==="text"||x.type==="email"||x.type==="textarea"||x.type==="select"||x.type==="radio"||x.indexed)&&!x.admin?.hidden).map(x=>x.name);if(C.length>0){let x=C.map(M=>({[M]:{contains:q}}));P?P={AND:[P,{OR:x}]}:P={OR:x};}}let W=w==="true"?true:w==="false"?false:!!g,f=await r.find({collection:m,where:P,limit:U,page:v,sort:O,tenantId:h,select:_,draft:W}),k=await r.count({collection:m,where:P,tenantId:h});await chunkOJBL4CXK_cjs.o(f.docs||[],d.fields,r,s,1,R);let L=(f.docs||[]).map(chunkOXEJCIOA_cjs.a);return l.json({docs:L,totalDocs:k,limit:U,page:v,totalPages:Math.ceil(k/U),data:L,meta:{total:k,page:v,limit:U,totalPages:Math.ceil(k/U)}})}),i.get(`${y}/:id/versions`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id"),A=parseInt(l.req.query("page")||"1"),b=Math.min(parseInt(l.req.query("limit")||"30"),100),E=l.req.query("compareA"),U=l.req.query("compareB");if(E&&U&&typeof r.findVersionByID=="function")try{let R=await r.findVersionByID({collection:m,versionId:E,tenantId:h}),_=await r.findVersionByID({collection:m,versionId:U,tenantId:h});if(!R||!_)throw new I(404,"One or both comparison versions were not found");let D=typeof R.data=="string"?JSON.parse(R.data):R.data||{},P=typeof _.data=="string"?JSON.parse(_.data):_.data||{},K=[],W=new Set([...Object.keys(D),...Object.keys(P)]);for(let f of W)["id","createdAt","updatedAt","publishedAt"].includes(f)||JSON.stringify(D[f])!==JSON.stringify(P[f])&&K.push({field:f,oldValue:D[f]??null,newValue:P[f]??null});return l.json({diffs:K,versionA:R,versionB:_})}catch(R){if(R instanceof I)throw R;return console.warn(`[compareVersions] Error comparing versions for ${m}/${w}:`,R),l.json({diffs:[]})}let v=[],O=0;if(typeof r.findVersions=="function")try{let R=await r.findVersions({collection:m,documentId:w,page:A,limit:b,tenantId:h});v=R.docs||[],O=R.totalDocs||v.length;}catch(R){console.warn(`[findVersions] Error fetching versions for ${m}/${w}:`,R);}return l.json({docs:v,totalDocs:O,page:A,limit:b,totalPages:Math.ceil(O/b)||1,data:v,meta:{total:O,page:A,limit:b,totalPages:Math.ceil(O/b)||1}})}),i.post(`${y}/:id/versions`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"update",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id"),A=await l.req.json().catch(()=>({})),b=A.versionId;if(A.action==="restore"&&b&&typeof r.findVersionByID=="function"){let E=await r.findVersionByID({collection:m,versionId:b,tenantId:h});if(!E)throw new I(404,`Version '${b}' not found`);let U=typeof E.data=="string"?JSON.parse(E.data):E.data,{id:v,createdAt:O,updatedAt:R,..._}=U;d.versions&&typeof r.createVersion=="function"&&await r.createVersion({collection:m,documentId:w,data:_,status:_.status||"published",autosave:false,createdBy:g?.id,changeDescription:`Restored from version ${E.version||b}`,tenantId:h});let D=await r.update({collection:m,id:w,data:_,tenantId:h}),P=chunkOXEJCIOA_cjs.a(D);return l.json({doc:P,data:P,message:"Version restored successfully"})}throw new I(400,"Invalid action for version management")}),i.get(`${y}/:id/versions/:versionId`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("versionId"),A=null;if(typeof r.findVersionByID=="function"&&(A=await r.findVersionByID({collection:m,versionId:w,tenantId:h})),!A)throw new I(404,`Version '${w}' not found`);return l.json({doc:A,data:A})}),i.post(`${y}/:id/versions/:versionId/restore`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"update",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id"),A=l.req.param("versionId");if(typeof r.restoreVersion=="function")try{let b=await r.restoreVersion({collection:m,documentId:w,versionId:A,tenantId:h});return l.json({doc:b,data:b,message:"Version restored successfully"})}catch(b){console.warn("[restoreVersion] Adapter restore failed, falling back to manual restore:",b);}if(typeof r.findVersionByID=="function"){let b=await r.findVersionByID({collection:m,versionId:A,tenantId:h});if(!b)throw new I(404,`Version '${A}' not found`);let E=typeof b.data=="string"?JSON.parse(b.data):b.data,{id:U,createdAt:v,updatedAt:O,...R}=E;d.versions&&typeof r.createVersion=="function"&&await r.createVersion({collection:m,documentId:w,data:R,status:R.status||"published",autosave:false,createdBy:g?.id,changeDescription:`Restored from version ${b.version||A}`,tenantId:h});let _=await r.update({collection:m,id:w,data:R,tenantId:h}),D=chunkOXEJCIOA_cjs.a(_);return l.json({doc:D,data:D,message:"Version restored successfully"})}throw new I(501,"Version restoration not supported by database adapter")}),i.post(`${y}/preview-url`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let A=await l.req.json().catch(()=>({}))||{};if(A.id&&!A.slug)try{let v=await r.findByID({collection:d.slug,id:A.id,tenantId:h});v&&(A={...v,...A});}catch{}let b,E=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";try{b=await jwt.sign({type:"preview",collection:d.slug,id:A.id,exp:Math.floor(Date.now()/1e3)+3600},E,"HS256");}catch(v){console.warn("Failed to sign preview token:",v);}let U="";if(typeof d.admin?.preview=="function")try{U=await d.admin.preview(A,{req:l.req.raw,token:b});}catch(v){console.error(`[Kyro Preview] Error in custom preview function for ${d.slug}:`,v);}if(!U){let v=A.slug||A.id||"";if(U=v?`/${d.slug}/${v}`:`/${d.slug}`,b){let O=U.includes("?")?"&":"?";U+=`${O}draft=true&kyroToken=${b}`;}}return l.json({url:U})}),i.get(`${y}/:id`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=new URL(l.req.url),w=S.searchParams.get("draft"),A=S.searchParams.get("kyroToken"),b=false,E=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";if(w==="true"&&A&&E)try{let D=await jwt.verify(A,E,"HS256");D&&D.type==="preview"&&D.collection===d.slug&&(b=!0);}catch(D){console.warn("Invalid preview token",D);}if(!b){let D=await H(d,"read",l.req.raw,g,h,T,o,u);if(!D.allowed)throw new I(D.status||403,D.error||"Access denied")}let U=l.req.param("id"),v=parseInt(S.searchParams.get("depth")||"1"),O=w==="true"?true:w==="false"?false:!!g,R=await r.findByID({collection:m,id:U,tenantId:h,draft:O});if(!R)throw new I(404,`Document '${U}' not found in '${m}'`);await chunkOJBL4CXK_cjs.o([R],d.fields,r,s,1,v);let _=chunkOXEJCIOA_cjs.a(R);return l.json({doc:_,data:_})}),i.post(y,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"create",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=await l.req.json();d.hooks?.beforeChange&&d.hooks.beforeChange.length>0&&(w=await new ae(d.hooks.beforeChange).execute({data:w,collection:m,operation:"create",req:l.req.raw,user:g}));let A=await r.create({collection:m,data:w,tenantId:h});if(d.versions&&typeof r.createVersion=="function")try{await r.createVersion({collection:m,documentId:A?.id||w.id,data:A,status:w.status||"published",autosave:!1,createdBy:g?.id,changeDescription:w.changeDescription||"Initial version",tenantId:h});}catch(E){console.warn(`[createVersion] Failed creating initial version for ${m}:`,E);}d.hooks?.afterChange&&d.hooks.afterChange.length>0&&await new ae(d.hooks.afterChange).execute({data:A,collection:m,operation:"create",req:l.req.raw,user:g});let b=chunkOXEJCIOA_cjs.a(A);return l.json({doc:b,data:b,message:"Document created successfully"},201)}),i.patch(`${y}/:id`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"update",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id"),A=await l.req.json(),b=new URL(l.req.url),E=b.searchParams.get("autosave")==="true"||l.req.header("x-autosave")==="true"||A.autosave===true,U=b.searchParams.get("draft")==="true"||l.req.header("x-draft")==="true"||A.draft===true,v=d.versions?.drafts===true;if(d.hooks?.beforeChange&&d.hooks.beforeChange.length>0){let _=await r.findByID({collection:m,id:w,tenantId:h});A=await new ae(d.hooks.beforeChange).execute({data:A,originalDoc:_||void 0,collection:m,operation:"update",req:l.req.raw,user:g});}let O;if(v&&U)typeof r.createVersion=="function"&&await r.createVersion({collection:m,documentId:w,data:A,status:"draft",autosave:E,createdBy:g?.id,changeDescription:A.changeDescription||(E?"Auto-saved draft":"Draft snapshot"),tenantId:h}),O=await r.findByID({collection:m,id:w,tenantId:h,draft:true});else {let _=await r.findByID({collection:m,id:w,tenantId:h,draft:true});if(!_)throw new I(404,`Document '${w}' not found in '${m}'`);let D={..._,...A};if(d.versions&&typeof r.createVersion=="function")try{await r.createVersion({collection:m,documentId:w,data:D,status:A.status||_.status||"published",autosave:E,createdBy:g?.id,changeDescription:A.changeDescription||(E?"Auto-saved":"Updated snapshot"),tenantId:h});}catch(P){console.warn(`[createVersion] Failed creating version for ${m}/${w}:`,P);}if(O=await r.update({collection:m,id:w,data:A,tenantId:h}),!O)throw new I(404,`Document '${w}' not found in '${m}'`)}d.hooks?.afterChange&&d.hooks.afterChange.length>0&&await new ae(d.hooks.afterChange).execute({data:O,collection:m,operation:"update",req:l.req.raw,user:g});let R=chunkOXEJCIOA_cjs.a(O);return l.json({doc:R,data:R,message:"Document updated successfully"})}),i.delete(`${y}/:id`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"delete",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id");if(!await r.delete({collection:m,id:w,tenantId:h}))throw new I(404,`Document '${w}' not found in '${m}'`);return l.json({success:true,message:`Document '${w}' deleted successfully`})});}}function Pe(i,e,t){let{registry:s,db:r,authSecret:a,user:n,tenantId:c,settings:p}=e,o=p?.access?.enablePublicAccess??true;for(let u of s.getGlobals()){let d=u.slug,m=`/api/globals/${d}`;i.get(m,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c),T=new URL(l.req.url),S=T.searchParams.get("draft"),w=T.searchParams.get("kyroToken"),A=false,b=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";if(S==="true"&&w&&b)try{let R=await jwt.verify(w,b,"HS256");R&&R.type==="preview"&&R.collection===`_globals_${u.slug}`&&(A=!0);}catch(R){console.warn("Invalid preview token",R);}A||await ie(u,"read",l.req.raw,g,h,o);let E=parseInt(T.searchParams.get("depth")||"0"),U=`_globals_${d}`,v=await r.findOne({collection:U,where:{},depth:E,tenantId:h,draft:S==="true"?true:S==="false"?false:!!g});v||(v={id:d}),await chunkOJBL4CXK_cjs.o([v],u.fields,r,s,1,E);let O=chunkOXEJCIOA_cjs.a(v);return l.json({doc:O,data:O})}),i.post(`${m}/preview-url`,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ie(u,"read",l.req.raw,g,h,o);let S=await l.req.json().catch(()=>({}))||{},w,A=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";try{w=await jwt.sign({type:"preview",collection:`_globals_${u.slug}`,exp:Math.floor(Date.now()/1e3)+3600},A,"HS256");}catch(E){console.warn("Failed to sign global preview token:",E);}let b="";if(typeof u.admin?.preview=="function")try{b=await u.admin.preview(S,{req:l.req.raw,token:w});}catch(E){console.error(`[Kyro Preview] Error in custom preview function for global ${u.slug}:`,E);}if(!b&&(b=`/${u.slug}`,w)){let E=b.includes("?")?"&":"?";b+=`${E}draft=true&kyroToken=${w}`;}return l.json({url:b})}),i.get(`${m}/versions`,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ie(u,"read",l.req.raw,g,h,o);let T=`_globals_${d}`,S=parseInt(l.req.query("page")||"1"),w=Math.min(parseInt(l.req.query("limit")||"30"),100),A=l.req.query("compareA"),b=l.req.query("compareB");if(A&&b&&typeof r.findVersionByID=="function")try{let v=await r.findVersionByID({collection:T,versionId:A,tenantId:h}),O=await r.findVersionByID({collection:T,versionId:b,tenantId:h});if(!v||!O)return l.json({error:"One or both comparison versions were not found"},404);let R=typeof v.data=="string"?JSON.parse(v.data):v.data||{},_=typeof O.data=="string"?JSON.parse(O.data):O.data||{},D=[],P=new Set([...Object.keys(R),...Object.keys(_)]);for(let K of P)["id","createdAt","updatedAt","publishedAt"].includes(K)||JSON.stringify(R[K])!==JSON.stringify(_[K])&&D.push({field:K,oldValue:R[K]??null,newValue:_[K]??null});return l.json({diffs:D,versionA:v,versionB:O})}catch(v){return console.warn(`[compareVersions] Error comparing global versions for ${d}:`,v),l.json({diffs:[]})}let E=[],U=0;if(typeof r.findVersions=="function")try{let v=await r.findVersions({collection:T,documentId:d,page:S,limit:w,tenantId:h});E=v.docs||[],U=v.totalDocs||E.length;}catch(v){console.warn(`[findVersions] Error fetching global versions for ${d}:`,v);}return l.json({docs:E,totalDocs:U,page:S,limit:w,totalPages:Math.ceil(U/w)||1,data:E,meta:{total:U,page:S,limit:w,totalPages:Math.ceil(U/w)||1}})}),i.get(`${m}/versions/:versionId`,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ie(u,"read",l.req.raw,g,h,o);let T=`_globals_${d}`,S=l.req.param("versionId"),w=null;return typeof r.findVersionByID=="function"&&(w=await r.findVersionByID({collection:T,versionId:S,tenantId:h})),w?l.json({doc:w,data:w}):l.json({error:`Global version '${S}' not found`},404)}),i.post(`${m}/versions/:versionId/restore`,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ie(u,"update",l.req.raw,g,h,o);let T=`_globals_${d}`,S=l.req.param("versionId");if(typeof r.findVersionByID=="function"){let w=await r.findVersionByID({collection:T,versionId:S,tenantId:h});if(!w)return l.json({error:`Global version '${S}' not found`},404);let A=typeof w.data=="string"?JSON.parse(w.data):w.data,{id:b,createdAt:E,updatedAt:U,...v}=A,O=await r.findOne({collection:T,where:{},tenantId:h}),R;O?R=await r.update({collection:T,id:O.id,data:v,tenantId:h}):R=await r.create({collection:T,data:{id:d,...v},tenantId:h}),u.versions&&typeof r.createVersion=="function"&&await r.createVersion({collection:T,documentId:d,data:R||v,status:"published",autosave:false,createdBy:g?.id,changeDescription:`Restored from version ${w.version||S}`,tenantId:h});let _=chunkOXEJCIOA_cjs.a(R);return l.json({doc:_,data:_,message:"Global version restored successfully"})}return l.json({error:"Version restoration not supported by database adapter"},501)});let y=async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ie(u,"update",l.req.raw,g,h,o);let T=await l.req.json(),S=new URL(l.req.url),w=S.searchParams.get("autosave")==="true"||l.req.header("x-autosave")==="true"||T.autosave===true,A=S.searchParams.get("draft")==="true"||l.req.header("x-draft")==="true"||T.draft===true,b=`_globals_${d}`,E=await r.findOne({collection:b,where:{},tenantId:h}),U;if(E?U=await r.update({collection:b,id:E.id,data:T,tenantId:h}):U=await r.create({collection:b,data:{id:d,...T},tenantId:h}),u.versions&&typeof r.createVersion=="function")try{await r.createVersion({collection:b,documentId:d,data:U||T,status:A?"draft":"published",autosave:w,createdBy:g?.id,changeDescription:T.changeDescription||(w?"Auto-saved":"Updated snapshot"),tenantId:h});}catch(O){console.warn(`[createVersion] Failed creating version for global ${d}:`,O);}let v=chunkOXEJCIOA_cjs.a(U);return l.json({doc:v,data:v,message:"Global updated successfully"})};i.post(m,y),i.patch(m,y),i.put(m,y);}}function ne(i){let{uploadDir:e=Ae.join(ir__default.default.cwd(),"public","uploads"),baseUrl:t="/uploads"}=i;async function s(n){fs.existsSync(n)||await promises.mkdir(n,{recursive:true});}function r(n){let c=Ae.extname(n).toLowerCase();return {".jpg":"image/jpeg",".jpeg":"image/jpeg",".png":"image/png",".gif":"image/gif",".webp":"image/webp",".avif":"image/avif",".svg":"image/svg+xml",".mp4":"video/mp4",".webm":"video/webm",".mov":"video/quicktime",".avi":"video/x-msvideo",".mp3":"audio/mpeg",".wav":"audio/wav",".ogg":"audio/ogg",".pdf":"application/pdf",".doc":"application/msword",".docx":"application/vnd.openxmlformats-officedocument.wordprocessingml.document",".xls":"application/vnd.ms-excel",".xlsx":"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",".zip":"application/zip",".tar":"application/x-tar",".gz":"application/gzip",".rar":"application/vnd.rar",".7z":"application/x-7z-compressed"}[c]||"application/octet-stream"}async function a(n){try{let c=n.toString("hex",0,8);if(c.startsWith("89504e47")){let p=n.readUInt32BE(16),o=n.readUInt32BE(20);return {width:p,height:o}}if(c.startsWith("ffd8")){let p=2;for(;p<n.length&&n[p]===255;){let o=n[p+1];if(o===192||o===194){let u=n.readUInt16BE(p+5);return {width:n.readUInt16BE(p+7),height:u}}p+=2+n.readUInt16BE(p+2);}}}catch{}return {}}return te({name:"local",displayName:"Local Storage",supportsDynamicResize:true,async upload(n,c){await s(e);let p=Buffer.from(await n.arrayBuffer()),o=crypto.createHash("md5").update(p).digest("hex"),u=Ae.extname(n.name),d=c?.filename||`${o}${u}`,m=c?.folder||"",y=m?Ae.join(e,m):e;await s(y);let l=Ae.join(y,d);await promises.writeFile(l,p);let g=n.type.startsWith("image/")?await a(p):{},h=t||"/uploads",T=m?`/${m}/${d}`:`/${d}`,S=h+T;return {id:o,filename:d,originalName:n.name,mimeType:n.type||r(n.name),size:p.length,url:S,thumbnailUrl:n.type.startsWith("image/")?S:void 0,folder:m||void 0,provider:"local",metadata:{...g,...c?.metadata},createdAt:new Date().toISOString()}},async uploadFromUrl(n,c){let p=await fetch(n);if(!p.ok)throw new Error(`Failed to fetch file: ${p.statusText}`);let o=await p.blob(),u=p.headers.get("content-disposition"),d=c?.filename;if(!d&&u){let y=u.match(/filename[^;=\n]*=((['"]).*?\2|[^;\n]*)/);y&&(d=y[1].replace(/['"]/g,""));}d||(d=Ae.basename(new URL(n).pathname));let m=new File([o],d,{type:o.type||r(d)});return this.upload(m,c)},async delete(n){let c=Ae.join(e,n.replace(t+"/",""));try{await promises.unlink(c);}catch{}},async rename(n,c){let p=Ae.join(e,n.replace(t+"/","")),o=Ae.join(e,c);return await promises.rename(p,o),`${t}/${c}`},async list(n){let c=n?Ae.join(e,n):e;if(!fs.existsSync(c))return [];let p=[],o=await promises.readdir(c,{withFileTypes:true});for(let u of o)if(u.isFile()){let d=Ae.join(c,u.name),m=await promises.stat(d),y=`${t}${n?`/${n}`:""}/${u.name}`;p.push({id:crypto.createHash("md5").update(u.name).digest("hex"),filename:u.name,originalName:u.name,mimeType:r(u.name),size:m.size,url:y,provider:"local",createdAt:m.birthtime.toISOString()});}return p},async exists(n){let c=Ae.join(e,n.replace(t+"/",""));return fs.existsSync(c)},async createFolder(n){let c=Ae.join(e,n);await promises.mkdir(c,{recursive:true});},async deleteFolder(n){let c=Ae.join(e,n);if(fs.existsSync(c)){let{rm:p}=await import('fs/promises');await p(c,{recursive:true,force:true});}}})}function Le(i){let e=(t,s)=>{if(!i.signKey)return t;let r=crypto.createHmac("sha256",i.signKey).update(t+s.toString()).digest("hex");return s.set("s",r),t};return {name:"imgix",displayName:"Imgix",supportsDynamicResize:true,async upload(t,s){throw new Error("Imgix is a transformation service. Use another provider for uploads.")},async uploadFromUrl(t,s){let r=s?.filename||t.split("/").pop()||"file",a=await fetch(t);if(!a.ok)throw new Error(`Failed to fetch: ${a.statusText}`);let n=await a.blob();new File([n],r,{type:n.type});return {id:Buffer.from(t).toString("base64").slice(0,20),filename:r,originalName:r,mimeType:n.type,size:n.size,url:this.getImageUrl(t),thumbnailUrl:this.getImageUrl(t,{width:200,height:200,fit:"crop"}),provider:"imgix",createdAt:new Date().toISOString()}},async delete(t){},async rename(t,s){return `https://${i.domain}/${s}`},getImageUrl(t,s){let r=new URL(t),a=new URLSearchParams(r.search);i.defaultParameters&&Object.entries(i.defaultParameters).forEach(([c,p])=>{a.has(c)||a.set(c,p);}),s&&(s.width&&a.set("w",String(s.width)),s.height&&a.set("h",String(s.height)),s.quality&&a.set("q",String(s.quality)),s.format&&a.set("fm",s.format),s.fit&&a.set("fit",s.fit),s.blur&&a.set("blur",String(s.blur)),s.sharpen&&a.set("sharp",String(s.sharpen))),a.set("auto","compress,format");r.pathname+"?"+a.toString();return i.signKey&&(e(r.pathname+a.toString(),a)),`https://${i.domain}${r.pathname}${a.toString()?"?"+a.toString():""}`},async generateThumbnail(t){return this.getImageUrl(t.url,{width:200,height:200,fit:"crop"})},async list(){return []},async exists(t){try{return (await fetch(t,{method:"HEAD"})).ok}catch{return  false}},async createFolder(){},async deleteFolder(){}}}function be(i,e){return e.cdnUrl?`${e.cdnUrl.replace(/\/$/,"")}/${i}`:`https://${e.storageZone}.b-cdn.net/${i}`}function qe(i){return i.cdnUrl?i.cdnUrl.replace(/\/$/,"")+"/":`https://${i.storageZone}.b-cdn.net/`}function De(i){let e=`https://storage.bunnycdn.com/${i.storageZone}`,t=s=>`${i.prefix?`${i.prefix}/`:""}${s}`.replace(/\/+/g,"/");return te({name:"bunny",displayName:"Bunny.net Storage",supportsDynamicResize:true,async upload(s,r){let a=t(`${r?.folder?`${r.folder}/`:""}${r?.filename||s.name}`),n=Buffer.from(await s.arrayBuffer()),c=await fetch(`${e}/${a}`,{method:"PUT",headers:{AccessKey:i.apiKey,"Content-Type":s.type},body:n});if(!c.ok){let p=await c.text();throw new Error(`Bunny.net upload failed: ${c.status} ${p}`)}return {id:Buffer.from(a).toString("base64url"),filename:r?.filename||s.name,originalName:s.name,mimeType:s.type,size:n.length,url:be(a,i),thumbnailUrl:s.type.startsWith("image/")?be(a,i):void 0,folder:r?.folder,provider:"bunny",metadata:r?.metadata,createdAt:new Date().toISOString()}},async delete(s){let r=s.replace(qe(i),""),a=await fetch(`${e}/${r}`,{method:"DELETE",headers:{AccessKey:i.apiKey}});if(!a.ok&&a.status!==404){let n=await a.text();throw new Error(`Bunny.net delete failed: ${a.status} ${n}`)}},async rename(s,r){let a=s.replace(qe(i),""),n=i.prefix?`${i.prefix}/${r}`:r,c=await fetch(`${e}/${a}`,{method:"GET",headers:{AccessKey:i.apiKey}});if(!c.ok)throw new Error("Bunny.net rename failed: could not read old file");let p=await c.arrayBuffer();return await fetch(`${e}/${n}`,{method:"PUT",headers:{AccessKey:i.apiKey,"Content-Type":c.headers.get("Content-Type")||"application/octet-stream"},body:p}),await this.delete(s),be(n,i)},async list(s){let r=t(s||""),a=await fetch(`${e}/${r}`,{method:"GET",headers:{AccessKey:i.apiKey}});if(!a.ok){let c=await a.text();throw new Error(`Bunny.net list failed: ${a.status} ${c}`)}return (await a.json()).map(c=>({id:Buffer.from(c.ObjectName||"").toString("base64url"),filename:c.ObjectName?.split("/").pop()||"",originalName:c.ObjectName?.split("/").pop()||"",mimeType:"application/octet-stream",size:c.Length||0,url:be(c.ObjectName||"",i),provider:"bunny",createdAt:c.LastChanged||new Date().toISOString()}))},async exists(s){let r=s.replace(qe(i),"");return (await fetch(`${e}/${r}`,{method:"HEAD",headers:{AccessKey:i.apiKey}})).ok},async createFolder(s){let r=t(`${s}/`);await fetch(`${e}/${r}`,{method:"PUT",headers:{AccessKey:i.apiKey,"Content-Length":"0"},body:""});},async deleteFolder(s){let r=t(`${s}/`);await fetch(`${e}/${r}`,{method:"DELETE",headers:{AccessKey:i.apiKey}});}})}function Ce(){let i=()=>{let s=globalThis.STORAGE_BUCKET;if(!s)throw new Error("Cloudflare R2 native binding 'STORAGE_BUCKET' not found in global scope.");return s},e=s=>`/api/media/file/${s}`,t=s=>s.replace(/\/+/g,"/").replace(/^\/+/,"");return te({name:"cloudflare_r2",displayName:"Cloudflare R2 (Native)",supportsDynamicResize:true,async upload(s,r){let a=i(),n=t(`${r?.folder?`${r.folder}/`:""}${r?.filename||s.name}`),c=await s.arrayBuffer(),p=await a.put(n,c,{httpMetadata:{contentType:s.type},customMetadata:r?.metadata||{}});return {id:Buffer.from(n).toString("base64url"),filename:r?.filename||s.name,originalName:s.name,mimeType:s.type,size:p.size,url:e(n),thumbnailUrl:s.type.startsWith("image/")?e(n):void 0,folder:r?.folder,provider:"cloudflare_r2",metadata:{...r?.metadata,etag:p.etag},createdAt:new Date().toISOString()}},async delete(s){let r=i(),a=s.replace(/^\/api\/media\/file\//,"");await r.delete(a);},async rename(s,r){let a=i(),n=s.replace(/^\/api\/media\/file\//,""),c=t(r),p=await a.get(n);if(!p)throw new Error("File not found");return await a.put(c,p.body,{httpMetadata:p.httpMetadata,customMetadata:p.customMetadata}),await a.delete(n),e(c)},async list(s){let r=i(),a=t(s||"");return (await r.list({prefix:a})).objects.map(c=>({id:Buffer.from(c.key).toString("base64url"),filename:c.key.split("/").pop()||"",originalName:c.key.split("/").pop()||"",mimeType:c.httpMetadata?.contentType||"application/octet-stream",size:c.size,url:e(c.key),provider:"cloudflare_r2",createdAt:c.uploaded.toISOString()}))},async exists(s){try{let r=i(),a=s.replace(/^\/api\/media\/file\//,"");return await r.head(a)!==null}catch{return  false}}})}var _e=class{providers=new Map;providerToPlugin=new Map;disabledPlugins=new Set;constructor(){this.registerLocal(),this.registerImgix(),this.registerBunny(),this.registerCloudflareR2(),this.registerCloudflareS3();}registerLocal(){this.register({type:"local",displayName:"Local Server",configKey:"local",configFields:[{name:"uploadDir",type:"text",label:"Upload Directory",defaultValue:"./public/uploads"},{name:"baseUrl",type:"text",label:"Base URL",defaultValue:"/uploads"}],extractConfig:(e,t)=>e[t]||{},extractRawConfig:e=>{let t=e?.local||e,s=(t?.uploadDir||"").trim(),r;s?Ae__default.default.isAbsolute(s)?r=s:s.includes("/")||s.includes("\\")?r=Ae__default.default.resolve(process.cwd(),s):r=Ae__default.default.join(process.cwd(),"public",s):r=Ae__default.default.join(process.cwd(),"public","uploads");let a=(t?.baseUrl||"").trim(),n;return a?n=a.startsWith("/")?a:`/${a}`:n="/uploads",{uploadDir:r,baseUrl:n}},factory:e=>ne(e)});}registerImgix(){this.register({type:"imgix",displayName:"Imgix",configKey:"imgix",configFields:[{name:"domain",type:"text",label:"Domain",required:true},{name:"signKey",type:"password",label:"Sign Key"}],extractConfig:(e,t)=>e[t]||{},extractRawConfig:e=>e?.imgix||e,factory:e=>Le(e)});}registerBunny(){this.register({type:"bunny",displayName:"Bunny.net",configKey:"bunny",configFields:[{name:"storageZone",type:"text",label:"Storage Zone",required:true},{name:"apiKey",type:"password",label:"API Key",required:true},{name:"cdnUrl",type:"text",label:"CDN URL"},{name:"prefix",type:"text",label:"Path Prefix"}],extractConfig:(e,t)=>e[t]||{},extractRawConfig:e=>e?.bunny||e,factory:e=>De(e)});}registerCloudflareR2(){this.register({type:"cloudflare_r2",displayName:"Cloudflare R2 (Native)",configKey:"cloudflareR2",configFields:[],extractConfig:()=>({}),extractRawConfig:()=>({}),factory:()=>Ce()});}registerCloudflareS3(){this.register({type:"cloudflare_s3",displayName:"Cloudflare R2 (S3 Compat)",configKey:"cloudflareR2",configFields:[],extractConfig:()=>(console.warn('[StorageRegistry] "cloudflare_s3" is deprecated; use "cloudflare_r2" instead.'),{}),extractRawConfig:()=>({}),factory:()=>Ce()});}register(e){if(this.providers.has(e.type)){console.warn(`[StorageRegistry] Provider "${e.type}" already registered, skipping`);return}e.pluginName&&this.providerToPlugin.set(e.type,e.pluginName),this.providers.set(e.type,e);}unregister(e){this.providers.delete(e),this.providerToPlugin.delete(e);}get(e){return this.providers.get(e)}getAll(){return Array.from(this.providers.values())}getAllAvailable(e){let t=this.getAll();return e?t.filter(s=>s.pluginName?e(s.pluginName):true):t}has(e){return this.providers.has(e)}async resolve(e,t){let s=this.providers.get(e);if(!s)throw new Error(`Unknown storage provider type: "${e}". Is the plugin that provides it enabled?`);if(s.pluginName&&this.disabledPlugins.has(s.pluginName))throw new Error(`Storage provider "${e}" is not available (plugin "${s.pluginName}" is disabled)`);let r=s.configKey||e,a=s.extractConfig(t,r);return s.factory(a)}async resolveWithConfig(e,t){let s=this.providers.get(e);if(!s)throw new Error(`Unknown storage provider type: "${e}". Is the plugin that provides it enabled?`);if(s.pluginName&&this.disabledPlugins.has(s.pluginName))throw new Error(`Storage provider "${e}" is not available (plugin "${s.pluginName}" is disabled)`);let r=s.extractRawConfig(t);return s.factory(r)}getProviderPluginName(e){return this.providerToPlugin.get(e)}getAllPluginNames(){return Array.from(new Set(this.providerToPlugin.values()))}setPluginEnabled(e,t){t?this.disabledPlugins.delete(e):this.disabledPlugins.add(e);}isPluginEnabled(e){return !this.disabledPlugins.has(e)}},$e=null;function Oe(){return $e||($e=new _e),$e}function kt(i){if(!i)return "";if(i.startsWith("pub-"))return i;let e=i.match(/pub-[a-zA-Z0-9]+/i);return e?e[0]:""}function dr(i,e){let t=i.startsWith("/")?i.slice(1):i;if(e.cdnUrl)return `${e.cdnUrl.replace(/\/$/,"")}/${t}`;switch(e.provider){case "r2":{let s=kt(e.publicDevUrl);return s?`https://${s}.r2.dev/${t}`:`https://${e.bucket}.${e.accountId}.r2.cloudflarestorage.com/${t}`}case "gcs":return `https://storage.googleapis.com/${e.bucket}/${t}`;case "digitalocean":return `https://${e.bucket}.${e.region}.cdn.digitaloceanspaces.com/${t}`;case "backblaze":return `https://${e.bucket}.s3.backblazeb2.com/${t}`;case "wasabi":return `https://${e.bucket}.s3.wasabisys.com/${t}`;default:return `https://${e.bucket}.s3.${e.region}.amazonaws.com/${t}`}}function Fe(i){if(i.cdnUrl)return i.cdnUrl.replace(/\/$/,"")+"/";switch(i.provider){case "r2":{let e=kt(i.publicDevUrl);return e?`https://${e}.r2.dev/`:`https://${i.bucket}.${i.accountId}.r2.cloudflarestorage.com/`}case "gcs":return `https://storage.googleapis.com/${i.bucket}/`;case "digitalocean":return `https://${i.bucket}.${i.region}.cdn.digitaloceanspaces.com/`;case "backblaze":return `https://${i.bucket}.s3.backblazeb2.com/`;case "wasabi":return `https://${i.bucket}.s3.wasabisys.com/`;default:return `https://${i.bucket}.s3.${i.region}.amazonaws.com/`}}function ur(i){switch(i){case "r2":return "Cloudflare R2";case "gcs":return "Google Cloud Storage";case "digitalocean":return "DigitalOcean Spaces";case "backblaze":return "Backblaze B2";case "wasabi":return "Wasabi";default:return "AWS S3"}}function pr(i){let e=new clientS3.S3Client({region:i.region||"auto",endpoint:i.endpoint,credentials:{accessKeyId:i.accessKeyId,secretAccessKey:i.secretAccessKey},forcePathStyle:true,tls:true,...i.provider==="r2"&&{requestHandler:new nodeHttpHandler.NodeHttpHandler}}),t=r=>`${i.prefix?`${i.prefix}/`:""}${r}`.replace(/\/+/g,"/"),s=r=>dr(r,i);return te({name:i.provider,displayName:ur(i.provider),supportsDynamicResize:true,async upload(r,a){let n=t(`${a?.folder?`${a.folder}/`:""}${a?.filename||r.name}`),c=Buffer.from(await r.arrayBuffer());await e.send(new clientS3.PutObjectCommand({Bucket:i.bucket,Key:n,Body:c,ContentType:r.type,Metadata:a?.metadata}));let p=await e.send(new clientS3.HeadObjectCommand({Bucket:i.bucket,Key:n}));return {id:Buffer.from(n).toString("base64url"),filename:a?.filename||r.name,originalName:r.name,mimeType:r.type,size:c.length,url:s(n),thumbnailUrl:r.type.startsWith("image/")?s(n):void 0,folder:a?.folder,provider:i.provider,metadata:{...a?.metadata,etag:p.ETag},createdAt:new Date().toISOString()}},async delete(r){let a=r.replace(Fe(i),"");await e.send(new clientS3.DeleteObjectCommand({Bucket:i.bucket,Key:a}));},async rename(r,a){let n=r.replace(Fe(i),""),c=i.prefix?`${i.prefix}/${a}`:a;return await e.send(new clientS3.CopyObjectCommand({Bucket:i.bucket,CopySource:`${i.bucket}/${n}`,Key:c})),await e.send(new clientS3.DeleteObjectCommand({Bucket:i.bucket,Key:n})),s(c)},async list(r){let a=t(r||"");return ((await e.send(new clientS3.ListObjectsV2Command({Bucket:i.bucket,Prefix:a}))).Contents||[]).map(c=>({id:Buffer.from(c.Key||"").toString("base64url"),filename:c.Key?.split("/").pop()||"",originalName:c.Key?.split("/").pop()||"",mimeType:"application/octet-stream",size:c.Size||0,url:s(c.Key||""),provider:i.provider,createdAt:c.LastModified?.toISOString()||new Date().toISOString()}))},async exists(r){try{let a=r.replace(Fe(i),"");return await e.send(new clientS3.HeadObjectCommand({Bucket:i.bucket,Key:a})),!0}catch{return  false}},async createFolder(r){let a=t(`${r}/`);await e.send(new clientS3.PutObjectCommand({Bucket:i.bucket,Key:a,Body:""}));},async deleteFolder(r){let a=t(`${r}/`),n;do{let c=await e.send(new clientS3.ListObjectsV2Command({Bucket:i.bucket,Prefix:a,ContinuationToken:n}));if(c.Contents?.length){let p=c.Contents.map(o=>({Key:o.Key}));await e.send(new clientS3.DeleteObjectsCommand({Bucket:i.bucket,Delete:{Objects:p}}));}n=c.IsTruncated?c.NextContinuationToken:void 0;}while(n);await e.send(new clientS3.DeleteObjectCommand({Bucket:i.bucket,Key:a}));}})}function mr(i){let e=()=>`https://api.cloudinary.com/v1_1/${i.cloudName}/upload`,t=async s=>{let r=await import('crypto'),a=Object.keys(s).sort().map(n=>`${n}=${s[n]}`).join("&");return r.createHash("sha256").update(a+i.apiSecret).digest("hex")};return {name:"cloudinary",displayName:"Cloudinary",supportsDynamicResize:true,async upload(s,r){let a=new FormData;if(a.append("file",s),i.uploadPreset)a.append("upload_preset",i.uploadPreset);else {let p=Math.round(Date.now()/1e3),o={timestamp:String(p)};(r?.folder||i.folder)&&(o.folder=r?.folder||i.folder||"");let u=await t(o);a.append("timestamp",String(p)),a.append("signature",u),a.append("api_key",i.apiKey);}(r?.folder||i.folder)&&a.append("folder",r?.folder||i.folder||"");let n=await fetch(e(),{method:"POST",body:a});if(!n.ok){let p=await n.json();throw new Error(`Cloudinary upload failed: ${p.error?.message||n.statusText}`)}let c=await n.json();return {id:c.public_id,filename:`${c.public_id}.${c.format}`,originalName:c.original_filename||s.name,mimeType:s.type||`image/${c.format}`,size:c.bytes,url:c.secure_url,thumbnailUrl:this.getImageUrl(c.secure_url,{width:200,height:200,fit:"crop"}),width:c.width,height:c.height,folder:r?.folder||i.folder,provider:"cloudinary",createdAt:new Date().toISOString()}},async uploadFromUrl(s,r){let a=new FormData;a.append("file",s),a.append("upload_preset","ml_default"),(r?.folder||i.folder)&&a.append("folder",r?.folder||i.folder||"");let n=await fetch(e(),{method:"POST",body:a});if(!n.ok)throw new Error("Cloudinary upload failed");let c=await n.json();return {id:c.public_id,filename:`${c.public_id}.${c.format}`,originalName:c.original_filename||s.split("/").pop()||"file",mimeType:`image/${c.format}`,size:c.bytes,url:c.secure_url,thumbnailUrl:this.getImageUrl(c.secure_url,{width:200,height:200,fit:"crop"}),width:c.width,height:c.height,provider:"cloudinary",createdAt:new Date().toISOString()}},async delete(s){try{let r=s.split("/image/upload/");if(r.length!==2){console.warn("[Cloudinary delete] Could not parse URL:",s);return}let a=r[1].replace(/^v\d+\//,"").replace(/\.[^.]+$/,""),n=Math.round(Date.now()/1e3),c={timestamp:String(n),public_id:a},p=Object.keys(c).sort().map(l=>`${l}=${c[l]}`).join("&"),u=(await import('crypto')).createHash("sha256").update(p+i.apiSecret).digest("hex"),d=`https://api.cloudinary.com/v1_1/${i.cloudName}/image/destroy`,m=new FormData;m.append("public_id",a),m.append("timestamp",String(n)),m.append("signature",u),m.append("api_key",i.apiKey);let y=await fetch(d,{method:"POST",body:m});if(!y.ok){let l=await y.json();console.warn("[Cloudinary delete] Failed:",l);}}catch(r){console.warn("[Cloudinary delete] Error:",r.message);}},async rename(s,r){let a="",n=r.replace(/\.[^.]+$/,""),c="";try{let p=s.split("/image/upload/");if(p.length!==2)return console.warn("[Cloudinary rename] Could not parse old URL:",s),s;let o=p[1],u=o.match(/^(v\d+)\//);a=u?u[1]:"";let d=o.replace(/^v\d+\//,"").replace(/\.[^.]+$/,""),m=d.split("/");c=m.length>1?m.slice(0,-1).join("/"):"";let y=r.replace(/\.[^.]+$/,"");n=c?`${c}/${y}`:y;let l=Math.round(Date.now()/1e3),g={from_public_id:d,to_public_id:n,timestamp:String(l)},h=Object.keys(g).sort().map(b=>`${b}=${g[b]}`).join("&"),S=(await import('crypto')).createHash("sha256").update(h+i.apiSecret).digest("hex"),w=new FormData;w.append("from_public_id",d),w.append("to_public_id",n),w.append("timestamp",String(l)),w.append("signature",S),w.append("api_key",i.apiKey);let A=await fetch(`https://api.cloudinary.com/v1_1/${i.cloudName}/image/rename`,{method:"POST",body:w});if(A.ok)return (await A.json()).secure_url;{let b=await A.json();console.warn("[Cloudinary rename] Failed:",b);let E=a?`/${a}/`:"/";return `https://res.cloudinary.com/${i.cloudName}/image/upload${E}${n}.${r.split(".").pop()}`}}catch(p){console.warn("[Cloudinary rename] Error:",p.message);let o=a?`/${a}/`:"/";return `https://res.cloudinary.com/${i.cloudName}/image/upload${o}${n}.${r.split(".").pop()}`}},getImageUrl(s,r){if(!r)return s;let a=s.split("/upload/");if(a.length!==2)return s;let n=[];if(r.width&&n.push(`w_${r.width}`),r.height&&n.push(`h_${r.height}`),r.fit){let p={crop:"c_fill",clip:"c_fit",scale:"c_scale",fill:"c_fill"};n.push(p[r.fit]||"c_limit");}r.quality&&n.push(`q_${r.quality}`),r.format&&n.push(`f_${r.format}`);let c=n.join(",");return `${a[0]}/upload/${c}/${a[1]}`},async generateThumbnail(s){return this.getImageUrl(s.url,{width:200,height:200,fit:"crop"})},async list(){return []},async exists(s){return (await fetch(s,{method:"HEAD"})).ok},async createFolder(){},async deleteFolder(){}}}async function Pt(i){let e=i.getStorageConfig(),t=Oe();try{return await t.resolve(e.type,e)}catch(s){return console.warn(`[resolveProvider] ${s.message} \u2014 falling back to local storage`),ne({uploadDir:Ae__default.default.join(process.cwd(),"public","uploads"),baseUrl:"/uploads"})}}function te(i){return {async uploadFromUrl(e,t){let s=await fetch(e);if(!s.ok)throw new Error(`Failed to fetch: ${s.statusText}`);let r=await s.blob(),a=e.split("/").pop()||"file",n=new File([r],a,{type:r.type});return this.upload(n,t)},getImageUrl(e,t){if(!t||Object.keys(t).length===0)return e;let s=new URLSearchParams({url:e});return t.width&&s.set("w",String(t.width)),t.height&&s.set("h",String(t.height)),t.quality&&s.set("q",String(t.quality)),t.format&&s.set("f",t.format),t.cropWidth&&t.cropHeight&&(s.set("cx",String(t.cropX??0)),s.set("cy",String(t.cropY??0)),s.set("cw",String(t.cropWidth)),s.set("ch",String(t.cropHeight))),`/api/media/resize?${s.toString()}`},async generateThumbnail(e){return this.getImageUrl(e.url,{width:400,height:400})},...i}}async function Lt(i){if(!i)return console.warn("[resolveProviderWithConfig] No config, using local"),ne({uploadDir:Ae__default.default.join(process.cwd(),"public","uploads"),baseUrl:"/uploads"});let e=i.type||"local",t=Oe();try{return await t.resolveWithConfig(e,i)}catch(s){return console.warn(`[resolveProviderWithConfig] ${s.message} \u2014 falling back to local storage`),ne({uploadDir:Ae__default.default.join(process.cwd(),"public","uploads"),baseUrl:"/uploads"})}}function qt(){return typeof globalThis>"u"?false:typeof globalThis.EdgeRuntime=="string"||typeof globalThis.WebSocketPair<"u"||typeof globalThis.Deno<"u"||typeof process<"u"&&process.env?.NEXT_RUNTIME==="edge"}async function Dt(i,e){let t=e?.format||"webp",s=(t==="avif"?80:85);if(!qt())try{let{default:r}=await import('sharp'),a=await r(i).metadata(),n=r(i),c=r(i).resize({width:500,withoutEnlargement:!0});return t==="avif"?(n=n.avif({quality:s}),c=c.avif({quality:Math.min(s,75)})):t==="png"?(n=n.png({compressionLevel:8}),c=c.png({compressionLevel:8})):t==="jpeg"||t==="jpg"?(n=n.jpeg({quality:s}),c=c.jpeg({quality:Math.min(s,80)})):(n=n.webp({quality:s}),c=c.webp({quality:Math.min(s,80)})),{buffer:await n.toBuffer(),thumbnailBuffer:await c.toBuffer(),width:a.width,height:a.height,format:t}}catch{}return {buffer:i,thumbnailBuffer:i,format:"passthrough"}}var Ct=`
+'use strict';var chunkH2IJDTA2_cjs=require('./chunk-H2IJDTA2.cjs'),chunkPW6Y5MQL_cjs=require('./chunk-PW6Y5MQL.cjs'),chunk34LCWI5X_cjs=require('./chunk-34LCWI5X.cjs'),chunkLXTVMP5F_cjs=require('./chunk-LXTVMP5F.cjs'),chunk2I2AXTKY_cjs=require('./chunk-2I2AXTKY.cjs'),chunkOJBL4CXK_cjs=require('./chunk-OJBL4CXK.cjs'),chunkDCFOVCJX_cjs=require('./chunk-DCFOVCJX.cjs'),chunkEG4SRTYS_cjs=require('./chunk-EG4SRTYS.cjs'),chunk3A5UO6OQ_cjs=require('./chunk-3A5UO6OQ.cjs'),chunkYOJOVQIH_cjs=require('./chunk-YOJOVQIH.cjs'),chunkUE7DTBD7_cjs=require('./chunk-UE7DTBD7.cjs'),chunkOXEJCIOA_cjs=require('./chunk-OXEJCIOA.cjs'),chunkKOSR7235_cjs=require('./chunk-KOSR7235.cjs'),hono=require('hono'),Ae=require('path'),crypto=require('crypto'),jwt=require('hono/jwt'),fs=require('fs'),promises=require('fs/promises'),ir=require('process'),clientS3=require('@aws-sdk/client-s3'),nodeHttpHandler=require('@smithy/node-http-handler');require('stream');var zodToJsonSchema=require('zod-to-json-schema'),Kt=require('bcryptjs'),drizzleOrm=require('drizzle-orm');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var Ae__default=/*#__PURE__*/_interopDefault(Ae);var ir__default=/*#__PURE__*/_interopDefault(ir);var Kt__default=/*#__PURE__*/_interopDefault(Kt);function yt(i){let{db:t,userLookup:s}=i;return async function(a){let n=chunkDCFOVCJX_cjs.c(a);if(n&&t){let p=await chunkDCFOVCJX_cjs.b(n,t,s);if(p.valid&&p.user)return {user:p.user,tenantContext:ht(p.user),apiKeyContext:chunkDCFOVCJX_cjs.d(p),status:200,authType:"apikey"};if(p.error)return {status:401,error:p.error}}let c=chunkLXTVMP5F_cjs.g(a);if(c)try{let p=await chunkLXTVMP5F_cjs.m(c);if(!p.valid)return {status:401,error:p.reason||"Session invalid"};let o=await chunkLXTVMP5F_cjs.s(a);if(o){let u=s?await s(o.userId):null;if(u)return {user:u,tenantContext:ht(u),status:200,authType:"session"}}}catch(p){console.error("Session validation error:",p);}return {status:401,error:"Authentication required"}}}function ht(i){return {tenantId:i.tenantId||"default",userId:i.id||"anonymous",role:i.role||"guest",roles:[i.role||"guest"],permissions:[],isSuperAdmin:i.role==="super_admin"}}var fe=class{storage=new Map;userStorage=new Map;limits;userLimits;constructor(e,t){this.limits={...zt,...e},this.userLimits=t||{"user:api":{window:6e4,max:500},"user:write":{window:36e5,max:100}};}getKey(e,t){return `${e}:${t}`}getUserKey(e,t,s){return `user:${e}:${t}:${s}`}cleanupOldEntries(e,t){let r=Date.now()-t;for(;e.length>0&&e[0].timestamp<r;)e.shift();}async check(e,t){let s=this.limits[e]||this.limits["api:general"],r=this.getKey(e,t),a=this.storage.get(r);a||(a=[],this.storage.set(r,a)),this.cleanupOldEntries(a,s.window);let n=Date.now(),c=a.reduce((p,o)=>p+o.count,0);if(a.push({timestamp:n,count:1}),c>=s.max){let o=a.reduce((u,d)=>u.timestamp<d.timestamp?u:d,a[0]).timestamp+s.window;return {allowed:false,remaining:0,resetAt:o,retryAfter:Math.ceil((o-n)/1e3)}}return {allowed:true,remaining:s.max-c-1,resetAt:n+s.window}}async checkUser(e,t,s){let r=this.userLimits[e]||this.userLimits["user:api"],a=this.userStorage.get(t),n=[];a?n=a.get(this.getKey(e,s))||[]:(this.userStorage.has(t)||this.userStorage.set(t,new Map),this.userStorage.get(t).set(this.getKey(e,s),n)),this.cleanupOldEntries(n,r.window);let c=Date.now(),p=n.reduce((o,u)=>o+u.count,0);if(n.push({timestamp:c,count:1}),p>=r.max){let u=n.reduce((d,m)=>d.timestamp<m.timestamp?d:m,n[0]).timestamp+r.window;return {allowed:false,remaining:0,resetAt:u,retryAfter:Math.ceil((u-c)/1e3)}}return {allowed:true,remaining:r.max-p-1,resetAt:c+r.window}}async reset(e,t){let s=this.getKey(e,t);this.storage.delete(s);}async resetUser(e,t,s){let r=this.userStorage.get(t);if(r){let a=this.getKey(e,s);r.delete(a);}}async getStatus(e,t){let s=this.limits[e]||this.limits["api:general"],r=this.getKey(e,t),a=this.storage.get(r);a||(a=[],this.storage.set(r,a)),this.cleanupOldEntries(a,s.window);let n=Date.now(),c=a.reduce((p,o)=>p+o.count,0);return {count:c,limit:s.max,remaining:Math.max(0,s.max-c),resetAt:n+s.window}}setLimit(e,t){this.limits[e]=t;}setUserLimit(e,t){this.userLimits[e]=t;}},zt={"auth:login":{window:9e5,max:5},"auth:register":{window:36e5,max:3},"auth:forgot":{window:36e5,max:3},"auth:reset":{window:36e5,max:5},"auth:verify":{window:36e5,max:5},"api:general":{window:6e4,max:100},"api:authenticated":{window:6e4,max:200}};var Ue={retentionDays:30};var wt=class{redis;prefix;retentionDays;constructor(e,t=30,s="kyro:audit:"){this.redis=e,this.prefix=s,this.retentionDays=t;}async log(e){let t=crypto.randomBytes(16).toString("hex"),s=new Date,r={...e,id:t,timestamp:s},a=this.getKeyForDate(s),n=`${this.prefix}log:${t}`;await this.redis.hset(n,this.serializeLog(r)),await this.redis.expire(n,this.retentionDays*24*60*60+3600),await this.redis.zadd(a,s.getTime(),t),await this.redis.expire(a,this.retentionDays*24*60*60+3600);let c=e.userId?`${this.prefix}user:${e.userId}`:null;return c&&(await this.redis.zadd(c,s.getTime(),t),await this.redis.expire(c,this.retentionDays*24*60*60+3600)),t}async get(e){let t=`${this.prefix}log:${e}`,s=await this.redis.hgetall(t);return !s||Object.keys(s).length===0?null:this.deserializeLog(s)}async query(e={}){let{limit:t=50,offset:s=0}=e,r=[];if(e.userId)r.push(`${this.prefix}user:${e.userId}`);else if(e.startDate||e.endDate)r=this.getKeysForDateRange(e.startDate,e.endDate);else {let p=new Date;r=this.getKeysForDateRange(new Date(p.getTime()-this.retentionDays*24*60*60*1e3),p);}let a=[];for(let p of r){let o=await this.redis.zrange(p,0,-1,"WITHSCORES");for(let u=0;u<o.length;u+=2)a.push([o[u],parseInt(o[u+1],10)]);}a.sort((p,o)=>o[1]-p[1]);let n=a.length;a=a.slice(s,s+t);let c=[];for(let[p]of a){let o=await this.get(p);o&&this.matchesFilter(o,e)&&c.push(o);}return {logs:c,total:n}}async getRecent(e=50){let t=[],s=new Date,r=this.getKeysForDateRange(new Date(s.getTime()-10080*60*1e3),s),a=[];for(let n of r){let c=await this.redis.zrange(n,0,-1,"WITHSCORES");for(let p=0;p<c.length;p+=2)a.push([c[p],parseInt(c[p+1],10)]);}a.sort((n,c)=>c[1]-n[1]);for(let[n]of a.slice(0,e)){let c=await this.get(n);c&&t.push(c);}return t}async getUserActivity(e,t=50){let s=`${this.prefix}user:${e}`,r=await this.redis.zrange(s,0,t-1),a=[];for(let n of r){let c=await this.get(n);c&&a.push(c);}return a}async getStats(e,t){let s=this.getKeysForDateRange(e||new Date(Date.now()-2592e6),t||new Date),r={},a=0,n=0,c=0,p=new Set;for(let o of s){let u=await this.redis.zrange(o,0,-1);for(let d of u){let m=await this.get(d);m&&(a++,r[m.action]=(r[m.action]||0)+1,m.success&&c++,m.action==="login_failed"&&n++,m.userId&&p.add(m.userId));}}return {totalEvents:a,byAction:r,successRate:a>0?c/a:1,failedLogins:n,uniqueUsers:p}}async cleanup(){let e=Date.now()-this.retentionDays*24*60*60*1e3,t=await this.redis.keys(`${this.prefix}date:*`),s=0;for(let r of t){let a=await this.redis.zrangebyscore(r,0,e);for(let n of a)await this.redis.del(`${this.prefix}log:${n}`),s++;await this.redis.zremrangebyscore(r,0,e);}return s}getKeyForDate(e){let t=e.getFullYear(),s=String(e.getMonth()+1).padStart(2,"0"),r=String(e.getDate()).padStart(2,"0");return `${this.prefix}date:${t}-${s}-${r}`}getKeysForDateRange(e,t){let s=[],r=e||new Date(Date.now()-this.retentionDays*24*60*60*1e3),a=t||new Date,n=new Date(r);for(;n<=a;)s.push(this.getKeyForDate(n)),n.setDate(n.getDate()+1);return s}matchesFilter(e,t){return !(t.action&&!(Array.isArray(t.action)?t.action:[t.action]).includes(e.action)||t.resource&&e.resource!==t.resource||t.resourceId&&e.resourceId!==t.resourceId||t.success!==void 0&&e.success!==t.success)}serializeLog(e){let t={id:e.id,timestamp:new Date(e.timestamp).toISOString(),action:e.action,resource:e.resource,success:e.success?"1":"0"};return e.userId&&(t.userId=e.userId),e.userEmail&&(t.userEmail=e.userEmail),e.role&&(t.role=e.role),e.resourceId&&(t.resourceId=e.resourceId),e.ipAddress&&(t.ipAddress=e.ipAddress),e.userAgent&&(t.userAgent=e.userAgent),e.error&&(t.error=e.error),e.changes&&(t.changes=JSON.stringify(e.changes)),e.metadata&&(t.metadata=JSON.stringify(e.metadata)),t}deserializeLog(e){return {id:e.id,timestamp:new Date(e.timestamp),action:e.action,userId:e.userId,userEmail:e.userEmail,role:e.role,resource:e.resource,resourceId:e.resourceId,ipAddress:e.ipAddress,userAgent:e.userAgent,success:e.success==="1",error:e.error,changes:e.changes?JSON.parse(e.changes):void 0,metadata:e.metadata?JSON.parse(e.metadata):void 0}}};function Cr(i){return {ipAddress:i.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||i.headers.get("x-real-ip")||"unknown",userAgent:i.headers.get("user-agent")||"unknown"}}function ee(i){return {ipAddress:i.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||i.headers.get("x-real-ip")||"unknown",userAgent:i.headers.get("user-agent")||"unknown"}}var bt=class{logs=[];retentionDays;constructor(e=Ue.retentionDays){this.retentionDays=e;}async log(e){let t=crypto.randomBytes(16).toString("hex"),r={...e,id:t,timestamp:new Date};return this.logs.push(r),this.cleanupOldLogs(),t}async get(e){return this.logs.find(t=>t.id===e)||null}async query(e={}){let{limit:t=50,offset:s=0}=e,r=[...this.logs];if(e.userId&&(r=r.filter(o=>o.userId===e.userId)),e.action){let o=Array.isArray(e.action)?e.action:[e.action];r=r.filter(u=>o.includes(u.action));}e.resource&&(r=r.filter(o=>o.resource===e.resource)),e.resourceId&&(r=r.filter(o=>o.resourceId===e.resourceId)),e.success!==void 0&&(r=r.filter(o=>o.success===e.success));let a=e.startDate,n=e.endDate;a!==void 0&&(r=r.filter(o=>o.timestamp>=a)),n!==void 0&&(r=r.filter(o=>o.timestamp<=n)),r.sort((o,u)=>u.timestamp.getTime()-o.timestamp.getTime());let c=r.length;return {logs:r.slice(s,s+t),total:c}}async getRecent(e=50){let t=new Date(Date.now()-6048e5);return this.logs.filter(r=>r.timestamp>=t).sort((r,a)=>a.timestamp.getTime()-r.timestamp.getTime()).slice(0,e)}async getUserActivity(e,t=50){return this.logs.filter(r=>r.userId===e).sort((r,a)=>a.timestamp.getTime()-r.timestamp.getTime()).slice(0,t)}async getStats(e,t){let s=e||new Date(Date.now()-2592e6),r=t||new Date,a=this.logs.filter(d=>d.timestamp>=s&&d.timestamp<=r),n={},c=0,p=0,o=0,u=new Set;for(let d of a){c++;let m=d.action;n[m]=(n[m]||0)+1,d.success&&o++,d.action==="login_failed"&&p++,d.userId&&u.add(d.userId);}return {totalEvents:c,byAction:n,successRate:c>0?o/c:1,failedLogins:p,uniqueUsers:u}}async cleanup(){let e=new Date(Date.now()-this.retentionDays*24*60*60*1e3),t=this.logs.length;return this.logs=this.logs.filter(s=>s.timestamp>=e),t-this.logs.length}cleanupOldLogs(){let e=new Date(Date.now()-this.retentionDays*24*60*60*1e3);this.logs.length;this.logs=this.logs.filter(s=>s.timestamp>=e);}};var he=class{authAdapter;email;passwordPolicy;lockout;rateLimiter;auditLogger;baseUrl;emailVerificationRequired;jwtSecret;constructor(e){this.authAdapter=e.redis,this.email=e.email,this.passwordPolicy=e.passwordPolicy||new chunkH2IJDTA2_cjs.a,this.lockout=e.lockout,this.rateLimiter=e.rateLimiter,this.auditLogger=e.auditLogger,this.baseUrl=e.baseUrl||"http://localhost:4321",this.emailVerificationRequired=e.emailVerificationRequired??true,this.jwtSecret=e.jwtSecret||"kyro-default-secret-key-change-me-in-production";}getBaseUrl(e){if(e)try{let t=e.headers.get("x-forwarded-proto")||(e.url.startsWith("https")?"https":"http"),s=e.headers.get("x-forwarded-host")||e.headers.get("host");return s?`${t}://${s}`:new URL(e.url).origin}catch{}return process.env.KYRO_BASE_URL||process.env.SERVER_URL||process.env.PUBLIC_URL||process.env.SITE_URL||this.baseUrl||"http://localhost:4321"}async register(e){let{ipAddress:t,userAgent:s}=ee(e);if(this.rateLimiter){let r=await this.rateLimiter.check("auth:register",t);if(!r.allowed)return this.rateLimitResponse(r)}try{let r=await e.json();if(!r.email||!r.password)return this.errorResponse("Email and password are required",400);if(r.password!==r.confirmPassword)return this.errorResponse("Passwords do not match",400);let a=this.passwordPolicy.validate(r.password);if(!a.valid)return this.errorResponse(a.errors.join(". "),400);let n=await this.authAdapter.findUserByEmail(r.email);if(n){if(!n.emailVerified&&this.emailVerificationRequired&&this.email){let o=(await this.authAdapter.createEmailVerificationToken?.(n.id))?.token||crypto.randomBytes(32).toString("hex"),d=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${o}`,m=this.email.getTemplates().verifyEmail(d,r.email);return await this.email.send({to:r.email,...m}),this.jsonResponse({success:!0,message:"An unverified account already exists with this email. We have resent the confirmation link to your inbox.",requiresVerification:!0},200)}return this.errorResponse("Email already registered",400)}let c=await this.authAdapter.createUser({email:r.email,password:r.password,role:r.role||"customer",tenantId:r.tenantId});if(this.emailVerificationRequired&&this.email){let p=crypto.randomBytes(32).toString("hex"),u=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${p}`;await this.authAdapter.createSession(c.id,{ipAddress:t,userAgent:s});let d=this.email.getTemplates().verifyEmail(u,r.email);await this.email.send({to:r.email,...d});}return this.auditLogger&&await this.auditLogger.log({action:"register",userId:c.id,userEmail:c.email,resource:"auth",ipAddress:t,userAgent:s,success:!0}),this.jsonResponse({success:!0,message:"Registration successful",user:this.sanitizeUser(c),requiresVerification:this.emailVerificationRequired&&!!this.email},201)}catch(r){return console.error("[AuthRoutes.register] Registration error:",r),this.errorResponse("Registration failed",500)}}async login(e){let{ipAddress:t,userAgent:s}=ee(e);if(this.rateLimiter){let r=await this.rateLimiter.check("auth:login",t);if(!r.allowed)return this.rateLimitResponse(r)}try{let r=await e.json();if(!r.email||!r.password)return this.errorResponse("Email and password are required",400);let a=await this.authAdapter.findUserByEmail(r.email);if(!a)return await this.recordFailedLogin(t,s),this.errorResponse("Invalid credentials",401);if(a.locked)return this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:a.id,userEmail:a.email,resource:"auth",ipAddress:t,userAgent:s,success:!1,error:"Account locked"}),this.errorResponse("Account locked. Contact an administrator.",403);if(this.lockout){let u=await this.lockout.checkLockout(a.id);if(u.locked)return this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:a.id,userEmail:a.email,resource:"auth",ipAddress:t,userAgent:s,success:!1,error:"Account locked"}),this.errorResponse(`Account locked. Try again in ${Math.ceil((u.lockedUntil.getTime()-Date.now())/6e4)} minutes`,423)}let n=await this.authAdapter.verifyPassword(r.email,r.password);if(!n)return await this.recordFailedLogin(t,s,a.id,a.email),this.errorResponse("Invalid credentials",401);if(this.emailVerificationRequired&&n.emailVerified===!1){if(this.email){let d=(await this.authAdapter.createEmailVerificationToken?.(n.id))?.token||crypto.randomBytes(32).toString("hex"),y=`${this.getBaseUrl(e)}/admin/auth/verify-email?token=${d}`,l=this.email.getTemplates().verifyEmail(y,n.email);await this.email.send({to:n.email,...l});}return this.errorResponse("Your email address is not verified yet. We have sent a new confirmation link to your email inbox.",403)}this.lockout&&await this.lockout.resetAttempts(a.id),this.auditLogger&&await this.auditLogger.log({action:"login",userId:a.id,userEmail:a.email,role:a.role,resource:"auth",ipAddress:t,userAgent:s,success:!0}),await this.authAdapter.updateUser(a.id,{lastLogin:new Date().toISOString()});let c=await chunkLXTVMP5F_cjs.k({id:a.id,email:a.email,role:a.role,tenantId:a.tenantId});if(this.email&&a.email){let u=new Date().toLocaleString(),d=this.email.getTemplates().newLogin(t,u,a.email,void 0,s);this.email.send({to:a.email,...d}).catch(m=>console.error("Failed to send newLogin email:",m));}let p={success:!0,user:this.sanitizeUser(a)},o=this.jsonResponse(p);return chunkLXTVMP5F_cjs.i(o,c)}catch(r){return console.error("[Auth] Login error:",r),this.errorResponse("Login failed",500)}}async logout(e){let t=chunkLXTVMP5F_cjs.g(e);if(!t)return this.errorResponse("No session to logout",401);let{ipAddress:s,userAgent:r}=ee(e);try{let a=await chunkLXTVMP5F_cjs.s(e);a&&(await chunkLXTVMP5F_cjs.o(t),this.auditLogger&&await this.auditLogger.log({action:"logout",userId:a.userId,userEmail:a.email,resource:"auth",ipAddress:s,userAgent:r,success:!0}));let n=this.jsonResponse({success:!0,message:"Logged out successfully"});return chunkLXTVMP5F_cjs.j(n)}catch{return this.errorResponse("Logout failed",500)}}async refresh(e){try{let t=chunkLXTVMP5F_cjs.g(e);if(!t)return this.errorResponse("Not authenticated",401);let s=await chunkLXTVMP5F_cjs.n(t,e);return s?this.jsonResponse({success:!0,expiresAt:s.expiresAt}):this.errorResponse("Session not found",404)}catch(t){return console.error("[Auth] Session refresh error:",t),this.errorResponse("Session refresh failed",500)}}async me(e){let t=await chunkLXTVMP5F_cjs.s(e);return t?this.jsonResponse({success:true,user:{id:t.userId,email:t.email,role:t.role,tenantId:t.tenantId}}):this.errorResponse("Not authenticated",401)}async changePassword(e){let t=await chunkLXTVMP5F_cjs.s(e);if(!t)return this.errorResponse("Not authenticated",401);let{ipAddress:s,userAgent:r}=ee(e);try{let a=await e.json(),{currentPassword:n,newPassword:c,confirmPassword:p}=a;if(!n||!c)return this.errorResponse("Current and new password required",400);if(c!==p)return this.errorResponse("Passwords do not match",400);let o=this.passwordPolicy.validate(c);if(!o.valid)return this.errorResponse(o.errors.join(". "),400);let u=await this.authAdapter.findUserById(t.userId);if(!u)return this.errorResponse("User not found",404);if(!(u.passwordHash?await this.authAdapter.verifyPassword(n,u.passwordHash):!1))return this.errorResponse("Current password is incorrect",401);let m=await this.authAdapter.getPasswordHistory?.(u.id,5);if(await this.authAdapter.isPasswordInHistory?.(c,u.id,5))return this.errorResponse("Password was recently used. Please choose a different password",400);let l=await this.authAdapter.hashPassword(c);if(u.passwordHash&&await this.authAdapter.addPasswordToHistory?.(u.id,u.passwordHash),await this.authAdapter.updateUser(u.id,{passwordHash:l}),await this.authAdapter.deleteUserSessions(u.id),this.email&&this.email.getTemplates){let g=this.email.getTemplates().passwordChanged(u.email,void 0,s,r);await this.email.send({to:u.email,...g});}return this.auditLogger&&await this.auditLogger.log({action:"password_change",userId:u.id,userEmail:u.email,resource:"auth",ipAddress:s,userAgent:r,success:!0}),this.jsonResponse({success:!0,message:"Password changed successfully"})}catch{return this.errorResponse("Password change failed",500)}}async forgotPassword(e){let{ipAddress:t,userAgent:s}=ee(e);if(this.rateLimiter){let r=await this.rateLimiter.check("auth:forgot",t);if(!r.allowed)return this.rateLimitResponse(r)}try{let r=await e.json(),{email:a}=r;if(!a)return this.errorResponse("Email required",400);let n=await this.authAdapter.findUserByEmail(a);if(!n)return this.jsonResponse({success:!0,message:"If the email exists, a reset link has been sent"});if(this.email){let c=crypto.randomBytes(32).toString("hex");if(this.authAdapter.createPasswordResetToken){let d=await this.authAdapter.createPasswordResetToken(n.email);d.token&&(c=d.token);}let o=`${this.getBaseUrl(e)}/admin/auth/reset-password?token=${c}`,u=this.email.getTemplates().resetPassword(o,n.email);await this.email.send({to:n.email,...u});}return this.auditLogger&&await this.auditLogger.log({action:"password_reset",userId:n.id,userEmail:n.email,resource:"auth",ipAddress:t,userAgent:s,success:!0}),this.jsonResponse({success:!0,message:"If the email exists, a reset link has been sent"})}catch{return this.errorResponse("Password reset request failed",500)}}async resetPassword(e){let{ipAddress:t}=ee(e);if(this.rateLimiter){let r=await this.rateLimiter.check("auth:reset",t);if(!r.allowed)return this.rateLimitResponse(r)}try{let r=await e.json(),{token:a,newPassword:n,confirmPassword:c}=r;if(!a||!n)return this.errorResponse("Reset token and new password are required",400);if(n!==c)return this.errorResponse("Passwords do not match",400);let p=this.passwordPolicy.validate(n);if(!p.valid)return this.errorResponse(p.errors.join(". "),400);if(this.authAdapter.resetPasswordWithToken){let o=await this.authAdapter.resetPasswordWithToken(a,n);if(!o.success)return this.errorResponse(o.error||"Password reset failed or token expired",400)}return this.jsonResponse({success:!0,message:"Password reset successful. You can now log in with your new password."})}catch(r){return console.error("[AuthRoutes.resetPassword] Error:",r),this.errorResponse("Password reset failed",500)}}async verifyEmail(e){let s=new URL(e.url).searchParams.get("token");if(!s)return this.errorResponse("Verification token required",400);try{if(this.authAdapter.verifyEmailToken){let r=await this.authAdapter.verifyEmailToken(s);if(!r.success)return this.errorResponse(r.error||"Invalid or expired verification token",400);if(r.userId&&this.email){let a=await this.authAdapter.findUserById(r.userId);if(a){let n=this.email.getTemplates().welcome(a.email);await this.email.send({to:a.email,...n});}}}return this.jsonResponse({success:!0,message:"Email address verified successfully"})}catch(r){return console.error("[AuthRoutes.verifyEmail] Error:",r),this.errorResponse("Email verification failed",500)}}async recordFailedLogin(e,t,s,r){if(this.lockout){let a=await this.lockout.recordFailedAttempt(s||e);if(a.locked&&a.totalAttempts===this.lockout.getConfig().maxAttempts&&this.email&&r){let n=Math.ceil(this.lockout.getConfig().lockDuration/6e4),c=this.email.getTemplates().accountLocked(a.totalAttempts,n,r,void 0,e,t);this.email.send({to:r,...c}).catch(p=>console.error("Failed to send accountLocked email:",p));}}this.auditLogger&&await this.auditLogger.log({action:"login_failed",userId:s,userEmail:r,resource:"auth",ipAddress:e,userAgent:t,success:false,error:"Invalid credentials"});}sanitizeUser(e){let{passwordHash:t,...s}=e;return s}jsonResponse(e,t=200){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":"application/json","Cache-Control":"no-store, no-cache, must-revalidate, max-age=0"}})}async listSessions(e){let t=await chunkLXTVMP5F_cjs.s(e);if(!t)return this.errorResponse("Not authenticated",401);try{let s=await chunkLXTVMP5F_cjs.q(t.userId,chunkLXTVMP5F_cjs.g(e)??void 0);return this.jsonResponse({sessions:s})}catch(s){return console.error("[AuthRoutes.listSessions] Error:",s),this.errorResponse("Failed to list sessions",500)}}async revokeSession(e,t){let s=await chunkLXTVMP5F_cjs.s(e);if(!s)return this.errorResponse("Not authenticated",401);try{let a=(await chunkLXTVMP5F_cjs.q(s.userId)).find(n=>n.id===t);return a?a.currentSession?this.errorResponse("Cannot revoke current session",400):(await chunkLXTVMP5F_cjs.o(t),this.jsonResponse({success:!0,message:"Session revoked"})):this.errorResponse("Session not found",404)}catch(r){return console.error("[AuthRoutes.revokeSession] Error:",r),this.errorResponse("Failed to revoke session",500)}}async revokeOtherSessions(e){let t=await chunkLXTVMP5F_cjs.s(e);if(!t)return this.errorResponse("Not authenticated",401);try{let s=await chunkLXTVMP5F_cjs.q(t.userId),r=chunkLXTVMP5F_cjs.g(e);for(let a of s)a.currentSession||await chunkLXTVMP5F_cjs.o(a.id);return this.jsonResponse({success:!0,message:"Other sessions revoked"})}catch(s){return console.error("[AuthRoutes.revokeOtherSessions] Error:",s),this.errorResponse("Failed to revoke sessions",500)}}async renameSession(e,t){let s=await chunkLXTVMP5F_cjs.s(e);if(!s)return this.errorResponse("Not authenticated",401);try{if(!(await chunkLXTVMP5F_cjs.q(s.userId)).find(p=>p.id===t))return this.errorResponse("Session not found",404);let n=await e.json(),{name:c}=n;return !c||typeof c!="string"||c.trim().length===0?this.errorResponse("Invalid session name",400):(await chunkLXTVMP5F_cjs.r(t,c.trim()),this.jsonResponse({success:!0,message:"Session renamed"}))}catch(r){return console.error("[AuthRoutes.renameSession] Error:",r),this.errorResponse("Failed to rename session",500)}}async refreshSession(e){let t=chunkLXTVMP5F_cjs.g(e);if(!t)return this.errorResponse("No session",401);try{let{refreshSession:s}=await import('./auth-session-VHUHDBCL.cjs'),r=await s(t,e);return r?this.jsonResponse({success:!0,expiresAt:r.expiresAt}):this.errorResponse("Session not found",404)}catch(s){return console.error("[AuthRoutes.refreshSession] Error:",s),this.errorResponse("Failed to refresh session",500)}}errorResponse(e,t){return new Response(JSON.stringify({success:false,error:e}),{status:t,headers:{"Content-Type":"application/json"}})}async rateLimitResponse(e){return new Response(JSON.stringify({error:"Too many requests. Please try again later."}),{status:429,headers:{"Content-Type":"application/json",...e.retryAfter?{"Retry-After":e.retryAfter.toString()}:{}}})}async requestMagicLink(e){ee(e);try{let r=await e.json();if(!r.email)return this.errorResponse("Email required",400);let a=await this.authAdapter.findUserByEmail(r.email);if(!a)return this.jsonResponse({success:!0,message:"If an account exists, a link was sent."});if(this.email){let n=Buffer.from(JSON.stringify({email:a.email,exp:Date.now()+6e5})).toString("base64url"),c=crypto.createHmac("sha256",this.jwtSecret).update(n).digest("hex"),p=`${n}.${c}`,u=`${this.getBaseUrl(e)}/admin/auth/magic-link?token=${p}`,d=this.email.getTemplates().magicLink(u,void 0,a.email);this.email.send({to:a.email,...d}).catch(m=>console.error("Magic link err:",m));}return this.jsonResponse({success:!0,message:"If an account exists, a link was sent."})}catch{return this.errorResponse("Failed to process request",500)}}async verifyMagicLink(e){let{ipAddress:t,userAgent:s}=ee(e),a=new URL(e.url).searchParams.get("token");if(!a)return this.errorResponse("Token required",400);try{let[n,c]=a.split(".");if(!n||!c)return this.errorResponse("Invalid token",400);let p=crypto.createHmac("sha256",this.jwtSecret).update(n).digest("hex");if(c!==p)return this.errorResponse("Invalid token",400);let o=JSON.parse(Buffer.from(n,"base64url").toString());if(Date.now()>o.exp)return this.errorResponse("Token expired",400);let u=await this.authAdapter.findUserByEmail(o.email);if(!u)return this.errorResponse("User not found",404);if(u.locked)return this.errorResponse("Account locked",403);let d=await chunkLXTVMP5F_cjs.k({id:u.id,email:u.email,role:u.role,tenantId:u.tenantId});this.auditLogger&&await this.auditLogger.log({action:"login",userId:u.id,userEmail:u.email,resource:"auth",ipAddress:t,userAgent:s,success:!0});let m=this.jsonResponse({success:!0,user:this.sanitizeUser(u)});return chunkLXTVMP5F_cjs.i(m,d)}catch{return this.errorResponse("Invalid token",400)}}async inviteUser(e){try{let t=await e.json();if(!t.email||!t.role)return this.errorResponse("Email and role required",400);let s=await this.authAdapter.findUserByEmail(t.email);if(s)return this.errorResponse("User already exists",409);if(s=await this.authAdapter.createUser({email:t.email,password:crypto.randomBytes(16).toString("hex"),role:t.role}),this.email){let r=await this.authAdapter.createPasswordResetToken(s.email),n=`${this.getBaseUrl(e)}/admin/auth/reset-password?token=${r.token}`,c=this.email.getTemplates().userInvite(n,t.role,t.inviterName||"An administrator");this.email.send({to:s.email,...c}).catch(p=>console.error("Invite email err:",p));}return this.jsonResponse({success:!0,message:"User invited successfully"})}catch{return this.errorResponse("Failed to invite user",500)}}};var I=class extends Error{constructor(t,s,r){super(s);this.statusCode=t;this.message=s;this.metadata=r;this.name="ApiError";}statusCode;message;metadata};function Tt(i,e){if(e instanceof I)return i.json({error:e.message},e.statusCode);let t=e instanceof Error?e.message:"Internal Server Error";return i.json({error:t},500)}({_media:{create:chunkOJBL4CXK_cjs.c.MEDIA_UPLOAD,update:chunkOJBL4CXK_cjs.c.MEDIA_UPLOAD,delete:chunkOJBL4CXK_cjs.c.MEDIA_DELETE}});var oe=new WeakMap;async function H(i,e,t,s,r,a,n=true,c="none"){let p=t&&typeof t=="object"?t:null,o=p?`col:${i.slug}:${e}:${s?.id||"anon"}:${r||""}:${a?.apiKeyId||""}`:null;if(p&&o){let d=oe.get(p);if(d&&d.has(o))return d.get(o)}let u=await chunkOJBL4CXK_cjs.a(i,e,{user:s,req:t,tenantId:r,apiKey:a},{enablePublicAccess:n,defaultAccess:c});if(p&&o){let d=oe.get(p);d||(d=new Map,oe.set(p,d)),d.set(o,u);}return u}async function ye(i,e,t,s,r,a=true){let n=t&&typeof t=="object"?t:null,c=n?`gbl:${i.slug}:${e}:${s?.id||"anon"}:${r||""}`:null;if(n&&c){let o=oe.get(n);if(o&&o.has(c))return o.get(c)}let p=await chunkOJBL4CXK_cjs.b(i,e,{user:s,req:t,tenantId:r},{enablePublicAccess:a});if(n&&c){let o=oe.get(n);o||(o=new Map,oe.set(n,o)),o.set(c,p);}return p}async function ie(i,e,t,s,r,a=true){let n=await ye(i,e,t,s,r,a);if(!n.allowed)throw new I(n.status||403,n.error||"Access denied");return n}async function $(i,e,t,s){if(t)return {user:t,tenantId:s,apiKeyContext:void 0,authType:"static"};if(e){let r=await e(i);if(r.status===200&&r.user)return {user:r.user,tenantId:r.tenantContext?.tenantId,apiKeyContext:r.apiKeyContext,authType:r.authType}}return {user:void 0,tenantId:void 0,apiKeyContext:void 0,authType:void 0}}var ae=class i{hooks=[];constructor(e=[]){this.hooks=[...e];}pipe(e){return this.hooks.push(e),this}async execute(e){let t=e.data;for(let s of this.hooks)try{let r=await s({...e,data:t});r!==void 0&&(t=r);}catch(r){throw new Error(`[Kyro CMS HookPipeline Error] Failed during ${e.operation} on collection "${e.collection||"global"}": ${r instanceof Error?r.message:String(r)}`)}return t}static async run(e,t){return !e||e.length===0?t.data:new i(e).execute(t)}};function ke(i,e,t){let{registry:s,db:r,authSecret:a,user:n,tenantId:c,settings:p}=e,o=p?.access?.enablePublicAccess??true,u=p?.access?.defaultCollectionAccess??"none";for(let d of s.getCollections()){let m=d.slug,y=`/api/${m}`;i.post(`${y}/dynamic-options/:fieldName`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("fieldName"),A=d.fields.find(_=>_.name===w);if(!A||A.type!=="relationship"||!A.relationTo)throw new I(400,"Invalid field for dynamic options");let b=Array.isArray(A.relationTo)?A.relationTo[0]:A.relationTo,E=await l.req.json(),U=await r.find({collection:b,where:E.where,limit:20,tenantId:h}),O=s.getCollection(b)?.admin?.useAsTitle||"id",R=(U.docs||[]).map(_=>({label:_[O]||_.id,value:_.id}));return l.json({data:R})}),i.all(`${y}/semantic-search`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=[],A="",b=10,E=.4;if(l.req.method==="POST"){let P=await l.req.json().catch(()=>({}));w=P.vector||[],A=P.q||P.query||"",b=P.limit?parseInt(String(P.limit)):10,E=P.threshold?parseFloat(String(P.threshold)):.4;}else {let P=new URL(l.req.url);A=P.searchParams.get("q")||P.searchParams.get("query")||"",b=parseInt(P.searchParams.get("limit")||"10"),E=parseFloat(P.searchParams.get("threshold")||"0.4");}let v=(await r.find({collection:m,limit:200,tenantId:h})).docs||[],R=d.fields.filter(P=>P.type==="embedding")[0]?.name||"embedding",_=v.map(P=>{let K=P[R],W=0;if(Array.isArray(K)&&Array.isArray(w)&&w.length>0){let f=0,k=0,L=0;for(let q=0;q<Math.min(K.length,w.length);q++)f+=K[q]*w[q],k+=K[q]*K[q],L+=w[q]*w[q];W=k&&L?f/(Math.sqrt(k)*Math.sqrt(L)):0;}else if(A){let f=String(P.title||P.name||"").toLowerCase(),k=String(P.content||P.description||"").toLowerCase(),L=A.toLowerCase();f.includes(L)?W=.9:k.includes(L)?W=.7:W=.1;}return {doc:P,score:W}}),D=await Promise.all(_.filter(P=>P.score>=E).sort((P,K)=>K.score-P.score).slice(0,b).map(async P=>({...await chunkYOJOVQIH_cjs.b(P.doc,d.fields,g,l.req.raw,"read"),_similarity:Math.round(P.score*1e3)/1e3})));return l.json({docs:D,totalDocs:D.length,query:A||void 0})}),i.get(y,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=new URL(l.req.url),w=S.searchParams.get("draft"),A=S.searchParams.get("kyroToken"),b=false,E=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";if(w==="true"&&A&&E)try{let q=await jwt.verify(A,E,"HS256");q&&q.type==="preview"&&q.collection===d.slug&&(b=!0);}catch(q){console.warn("Invalid preview token",q);}if(!b){let q=await H(d,"read",l.req.raw,g,h,T,o,u);if(!q.allowed)throw new I(q.status||403,q.error||"Access denied")}let U=parseInt(S.searchParams.get("limit")||"10"),v=parseInt(S.searchParams.get("page")||"1"),O=S.searchParams.get("sort")||void 0,R=parseInt(S.searchParams.get("depth")||"0"),_=S.searchParams.get("select")?.split(",")||void 0,D=S.searchParams.get("where"),P;if(D)try{P=JSON.parse(decodeURIComponent(D));}catch{throw new I(400,"Invalid JSON in where clause")}let K=S.searchParams.get("search")||S.searchParams.get("q");if(K&&K.trim()){let q=K.trim(),C=(d.fields||[]).filter(x=>x.name&&x.name!=="id"&&(x.type==="text"||x.type==="email"||x.type==="textarea"||x.type==="select"||x.type==="radio"||x.indexed)&&!x.admin?.hidden).map(x=>x.name);if(C.length>0){let x=C.map(M=>({[M]:{contains:q}}));P?P={AND:[P,{OR:x}]}:P={OR:x};}}let W=w==="true"?true:w==="false"?false:!!g,f=await r.find({collection:m,where:P,limit:U,page:v,sort:O,tenantId:h,select:_,draft:W}),k=await r.count({collection:m,where:P,tenantId:h});await chunkOJBL4CXK_cjs.o(f.docs||[],d.fields,r,s,1,R);let L=(f.docs||[]).map(chunkOXEJCIOA_cjs.a);return l.json({docs:L,totalDocs:k,limit:U,page:v,totalPages:Math.ceil(k/U),data:L,meta:{total:k,page:v,limit:U,totalPages:Math.ceil(k/U)}})}),i.get(`${y}/:id/versions`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id"),A=parseInt(l.req.query("page")||"1"),b=Math.min(parseInt(l.req.query("limit")||"30"),100),E=l.req.query("compareA"),U=l.req.query("compareB");if(E&&U&&typeof r.findVersionByID=="function")try{let R=await r.findVersionByID({collection:m,versionId:E,tenantId:h}),_=await r.findVersionByID({collection:m,versionId:U,tenantId:h});if(!R||!_)throw new I(404,"One or both comparison versions were not found");let D=typeof R.data=="string"?JSON.parse(R.data):R.data||{},P=typeof _.data=="string"?JSON.parse(_.data):_.data||{},K=[],W=new Set([...Object.keys(D),...Object.keys(P)]);for(let f of W)["id","createdAt","updatedAt","publishedAt"].includes(f)||JSON.stringify(D[f])!==JSON.stringify(P[f])&&K.push({field:f,oldValue:D[f]??null,newValue:P[f]??null});return l.json({diffs:K,versionA:R,versionB:_})}catch(R){if(R instanceof I)throw R;return console.warn(`[compareVersions] Error comparing versions for ${m}/${w}:`,R),l.json({diffs:[]})}let v=[],O=0;if(typeof r.findVersions=="function")try{let R=await r.findVersions({collection:m,documentId:w,page:A,limit:b,tenantId:h});v=R.docs||[],O=R.totalDocs||v.length;}catch(R){console.warn(`[findVersions] Error fetching versions for ${m}/${w}:`,R);}return l.json({docs:v,totalDocs:O,page:A,limit:b,totalPages:Math.ceil(O/b)||1,data:v,meta:{total:O,page:A,limit:b,totalPages:Math.ceil(O/b)||1}})}),i.post(`${y}/:id/versions`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"update",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id"),A=await l.req.json().catch(()=>({})),b=A.versionId;if(A.action==="restore"&&b&&typeof r.findVersionByID=="function"){let E=await r.findVersionByID({collection:m,versionId:b,tenantId:h});if(!E)throw new I(404,`Version '${b}' not found`);let U=typeof E.data=="string"?JSON.parse(E.data):E.data,{id:v,createdAt:O,updatedAt:R,..._}=U;d.versions&&typeof r.createVersion=="function"&&await r.createVersion({collection:m,documentId:w,data:_,status:_.status||"published",autosave:false,createdBy:g?.id,changeDescription:`Restored from version ${E.version||b}`,tenantId:h});let D=await r.update({collection:m,id:w,data:_,tenantId:h}),P=chunkOXEJCIOA_cjs.a(D);return l.json({doc:P,data:P,message:"Version restored successfully"})}throw new I(400,"Invalid action for version management")}),i.get(`${y}/:id/versions/:versionId`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("versionId"),A=null;if(typeof r.findVersionByID=="function"&&(A=await r.findVersionByID({collection:m,versionId:w,tenantId:h})),!A)throw new I(404,`Version '${w}' not found`);return l.json({doc:A,data:A})}),i.post(`${y}/:id/versions/:versionId/restore`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"update",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id"),A=l.req.param("versionId");if(typeof r.restoreVersion=="function")try{let b=await r.restoreVersion({collection:m,documentId:w,versionId:A,tenantId:h});return l.json({doc:b,data:b,message:"Version restored successfully"})}catch(b){console.warn("[restoreVersion] Adapter restore failed, falling back to manual restore:",b);}if(typeof r.findVersionByID=="function"){let b=await r.findVersionByID({collection:m,versionId:A,tenantId:h});if(!b)throw new I(404,`Version '${A}' not found`);let E=typeof b.data=="string"?JSON.parse(b.data):b.data,{id:U,createdAt:v,updatedAt:O,...R}=E;d.versions&&typeof r.createVersion=="function"&&await r.createVersion({collection:m,documentId:w,data:R,status:R.status||"published",autosave:false,createdBy:g?.id,changeDescription:`Restored from version ${b.version||A}`,tenantId:h});let _=await r.update({collection:m,id:w,data:R,tenantId:h}),D=chunkOXEJCIOA_cjs.a(_);return l.json({doc:D,data:D,message:"Version restored successfully"})}throw new I(501,"Version restoration not supported by database adapter")}),i.post(`${y}/preview-url`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"read",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let A=await l.req.json().catch(()=>({}))||{};if(A.id&&!A.slug)try{let v=await r.findByID({collection:d.slug,id:A.id,tenantId:h});v&&(A={...v,...A});}catch{}let b,E=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";try{b=await jwt.sign({type:"preview",collection:d.slug,id:A.id,exp:Math.floor(Date.now()/1e3)+3600},E,"HS256");}catch(v){console.warn("Failed to sign preview token:",v);}let U="";if(typeof d.admin?.preview=="function")try{U=await d.admin.preview(A,{req:l.req.raw,token:b});}catch(v){console.error(`[Kyro Preview] Error in custom preview function for ${d.slug}:`,v);}if(!U){let v=A.slug||A.id||"";if(U=v?`/${d.slug}/${v}`:`/${d.slug}`,b){let O=U.includes("?")?"&":"?";U+=`${O}draft=true&kyroToken=${b}`;}}return l.json({url:U})}),i.get(`${y}/:id`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=new URL(l.req.url),w=S.searchParams.get("draft"),A=S.searchParams.get("kyroToken"),b=false,E=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";if(w==="true"&&A&&E)try{let D=await jwt.verify(A,E,"HS256");D&&D.type==="preview"&&D.collection===d.slug&&(b=!0);}catch(D){console.warn("Invalid preview token",D);}if(!b){let D=await H(d,"read",l.req.raw,g,h,T,o,u);if(!D.allowed)throw new I(D.status||403,D.error||"Access denied")}let U=l.req.param("id"),v=parseInt(S.searchParams.get("depth")||"1"),O=w==="true"?true:w==="false"?false:!!g,R=await r.findByID({collection:m,id:U,tenantId:h,draft:O});if(!R)throw new I(404,`Document '${U}' not found in '${m}'`);await chunkOJBL4CXK_cjs.o([R],d.fields,r,s,1,v);let _=chunkOXEJCIOA_cjs.a(R);return l.json({doc:_,data:_})}),i.post(y,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"create",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=await l.req.json();d.hooks?.beforeChange&&d.hooks.beforeChange.length>0&&(w=await new ae(d.hooks.beforeChange).execute({data:w,collection:m,operation:"create",req:l.req.raw,user:g}));let A=await r.create({collection:m,data:w,tenantId:h});if(d.versions&&typeof r.createVersion=="function")try{await r.createVersion({collection:m,documentId:A?.id||w.id,data:A,status:w.status||"published",autosave:!1,createdBy:g?.id,changeDescription:w.changeDescription||"Initial version",tenantId:h});}catch(E){console.warn(`[createVersion] Failed creating initial version for ${m}:`,E);}d.hooks?.afterChange&&d.hooks.afterChange.length>0&&await new ae(d.hooks.afterChange).execute({data:A,collection:m,operation:"create",req:l.req.raw,user:g});let b=chunkOXEJCIOA_cjs.a(A);return l.json({doc:b,data:b,message:"Document created successfully"},201)}),i.patch(`${y}/:id`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"update",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id"),A=await l.req.json(),b=new URL(l.req.url),E=b.searchParams.get("autosave")==="true"||l.req.header("x-autosave")==="true"||A.autosave===true,U=b.searchParams.get("draft")==="true"||l.req.header("x-draft")==="true"||A.draft===true,v=d.versions?.drafts===true;if(d.hooks?.beforeChange&&d.hooks.beforeChange.length>0){let _=await r.findByID({collection:m,id:w,tenantId:h});A=await new ae(d.hooks.beforeChange).execute({data:A,originalDoc:_||void 0,collection:m,operation:"update",req:l.req.raw,user:g});}let O;if(v&&U)typeof r.createVersion=="function"&&await r.createVersion({collection:m,documentId:w,data:A,status:"draft",autosave:E,createdBy:g?.id,changeDescription:A.changeDescription||(E?"Auto-saved draft":"Draft snapshot"),tenantId:h}),O=await r.findByID({collection:m,id:w,tenantId:h,draft:true});else {let _=await r.findByID({collection:m,id:w,tenantId:h,draft:true});if(!_)throw new I(404,`Document '${w}' not found in '${m}'`);let D={..._,...A};if(d.versions&&typeof r.createVersion=="function")try{await r.createVersion({collection:m,documentId:w,data:D,status:A.status||_.status||"published",autosave:E,createdBy:g?.id,changeDescription:A.changeDescription||(E?"Auto-saved":"Updated snapshot"),tenantId:h});}catch(P){console.warn(`[createVersion] Failed creating version for ${m}/${w}:`,P);}if(O=await r.update({collection:m,id:w,data:A,tenantId:h}),!O)throw new I(404,`Document '${w}' not found in '${m}'`)}d.hooks?.afterChange&&d.hooks.afterChange.length>0&&await new ae(d.hooks.afterChange).execute({data:O,collection:m,operation:"update",req:l.req.raw,user:g});let R=chunkOXEJCIOA_cjs.a(O);return l.json({doc:R,data:R,message:"Document updated successfully"})}),i.delete(`${y}/:id`,async l=>{let{user:g,tenantId:h,apiKeyContext:T}=await $(l.req.raw,t,n,c),S=await H(d,"delete",l.req.raw,g,h,T,o,u);if(!S.allowed)throw new I(S.status||403,S.error||"Access denied");let w=l.req.param("id");if(!await r.delete({collection:m,id:w,tenantId:h}))throw new I(404,`Document '${w}' not found in '${m}'`);return l.json({success:true,message:`Document '${w}' deleted successfully`})});}}function Pe(i,e,t){let{registry:s,db:r,authSecret:a,user:n,tenantId:c,settings:p}=e,o=p?.access?.enablePublicAccess??true;for(let u of s.getGlobals()){let d=u.slug,m=`/api/globals/${d}`;i.get(m,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c),T=new URL(l.req.url),S=T.searchParams.get("draft"),w=T.searchParams.get("kyroToken"),A=false,b=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";if(S==="true"&&w&&b)try{let R=await jwt.verify(w,b,"HS256");R&&R.type==="preview"&&R.collection===`_globals_${u.slug}`&&(A=!0);}catch(R){console.warn("Invalid preview token",R);}A||await ie(u,"read",l.req.raw,g,h,o);let E=parseInt(T.searchParams.get("depth")||"0"),U=`_globals_${d}`,v=await r.findOne({collection:U,where:{},depth:E,tenantId:h,draft:S==="true"?true:S==="false"?false:!!g});v||(v={id:d}),await chunkOJBL4CXK_cjs.o([v],u.fields,r,s,1,E);let O=chunkOXEJCIOA_cjs.a(v);return l.json({doc:O,data:O})}),i.post(`${m}/preview-url`,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ie(u,"read",l.req.raw,g,h,o);let S=await l.req.json().catch(()=>({}))||{},w,A=a||process.env.KYRO_AUTH_SECRET||process.env.AUTH_SECRET||"kyro-preview-secret";try{w=await jwt.sign({type:"preview",collection:`_globals_${u.slug}`,exp:Math.floor(Date.now()/1e3)+3600},A,"HS256");}catch(E){console.warn("Failed to sign global preview token:",E);}let b="";if(typeof u.admin?.preview=="function")try{b=await u.admin.preview(S,{req:l.req.raw,token:w});}catch(E){console.error(`[Kyro Preview] Error in custom preview function for global ${u.slug}:`,E);}if(!b&&(b=`/${u.slug}`,w)){let E=b.includes("?")?"&":"?";b+=`${E}draft=true&kyroToken=${w}`;}return l.json({url:b})}),i.get(`${m}/versions`,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ie(u,"read",l.req.raw,g,h,o);let T=`_globals_${d}`,S=parseInt(l.req.query("page")||"1"),w=Math.min(parseInt(l.req.query("limit")||"30"),100),A=l.req.query("compareA"),b=l.req.query("compareB");if(A&&b&&typeof r.findVersionByID=="function")try{let v=await r.findVersionByID({collection:T,versionId:A,tenantId:h}),O=await r.findVersionByID({collection:T,versionId:b,tenantId:h});if(!v||!O)return l.json({error:"One or both comparison versions were not found"},404);let R=typeof v.data=="string"?JSON.parse(v.data):v.data||{},_=typeof O.data=="string"?JSON.parse(O.data):O.data||{},D=[],P=new Set([...Object.keys(R),...Object.keys(_)]);for(let K of P)["id","createdAt","updatedAt","publishedAt"].includes(K)||JSON.stringify(R[K])!==JSON.stringify(_[K])&&D.push({field:K,oldValue:R[K]??null,newValue:_[K]??null});return l.json({diffs:D,versionA:v,versionB:O})}catch(v){return console.warn(`[compareVersions] Error comparing global versions for ${d}:`,v),l.json({diffs:[]})}let E=[],U=0;if(typeof r.findVersions=="function")try{let v=await r.findVersions({collection:T,documentId:d,page:S,limit:w,tenantId:h});E=v.docs||[],U=v.totalDocs||E.length;}catch(v){console.warn(`[findVersions] Error fetching global versions for ${d}:`,v);}return l.json({docs:E,totalDocs:U,page:S,limit:w,totalPages:Math.ceil(U/w)||1,data:E,meta:{total:U,page:S,limit:w,totalPages:Math.ceil(U/w)||1}})}),i.get(`${m}/versions/:versionId`,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ie(u,"read",l.req.raw,g,h,o);let T=`_globals_${d}`,S=l.req.param("versionId"),w=null;return typeof r.findVersionByID=="function"&&(w=await r.findVersionByID({collection:T,versionId:S,tenantId:h})),w?l.json({doc:w,data:w}):l.json({error:`Global version '${S}' not found`},404)}),i.post(`${m}/versions/:versionId/restore`,async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ie(u,"update",l.req.raw,g,h,o);let T=`_globals_${d}`,S=l.req.param("versionId");if(typeof r.findVersionByID=="function"){let w=await r.findVersionByID({collection:T,versionId:S,tenantId:h});if(!w)return l.json({error:`Global version '${S}' not found`},404);let A=typeof w.data=="string"?JSON.parse(w.data):w.data,{id:b,createdAt:E,updatedAt:U,...v}=A,O=await r.findOne({collection:T,where:{},tenantId:h}),R;O?R=await r.update({collection:T,id:O.id,data:v,tenantId:h}):R=await r.create({collection:T,data:{id:d,...v},tenantId:h}),u.versions&&typeof r.createVersion=="function"&&await r.createVersion({collection:T,documentId:d,data:R||v,status:"published",autosave:false,createdBy:g?.id,changeDescription:`Restored from version ${w.version||S}`,tenantId:h});let _=chunkOXEJCIOA_cjs.a(R);return l.json({doc:_,data:_,message:"Global version restored successfully"})}return l.json({error:"Version restoration not supported by database adapter"},501)});let y=async l=>{let{user:g,tenantId:h}=await $(l.req.raw,t,n,c);await ie(u,"update",l.req.raw,g,h,o);let T=await l.req.json(),S=new URL(l.req.url),w=S.searchParams.get("autosave")==="true"||l.req.header("x-autosave")==="true"||T.autosave===true,A=S.searchParams.get("draft")==="true"||l.req.header("x-draft")==="true"||T.draft===true,b=`_globals_${d}`,E=await r.findOne({collection:b,where:{},tenantId:h}),U;if(E?U=await r.update({collection:b,id:E.id,data:T,tenantId:h}):U=await r.create({collection:b,data:{id:d,...T},tenantId:h}),u.versions&&typeof r.createVersion=="function")try{await r.createVersion({collection:b,documentId:d,data:U||T,status:A?"draft":"published",autosave:w,createdBy:g?.id,changeDescription:T.changeDescription||(w?"Auto-saved":"Updated snapshot"),tenantId:h});}catch(O){console.warn(`[createVersion] Failed creating version for global ${d}:`,O);}let v=chunkOXEJCIOA_cjs.a(U);return l.json({doc:v,data:v,message:"Global updated successfully"})};i.post(m,y),i.patch(m,y),i.put(m,y);}}function ne(i){let{uploadDir:e=Ae.join(ir__default.default.cwd(),"public","uploads"),baseUrl:t="/uploads"}=i;async function s(n){fs.existsSync(n)||await promises.mkdir(n,{recursive:true});}function r(n){let c=Ae.extname(n).toLowerCase();return {".jpg":"image/jpeg",".jpeg":"image/jpeg",".png":"image/png",".gif":"image/gif",".webp":"image/webp",".avif":"image/avif",".svg":"image/svg+xml",".mp4":"video/mp4",".webm":"video/webm",".mov":"video/quicktime",".avi":"video/x-msvideo",".mp3":"audio/mpeg",".wav":"audio/wav",".ogg":"audio/ogg",".pdf":"application/pdf",".doc":"application/msword",".docx":"application/vnd.openxmlformats-officedocument.wordprocessingml.document",".xls":"application/vnd.ms-excel",".xlsx":"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",".zip":"application/zip",".tar":"application/x-tar",".gz":"application/gzip",".rar":"application/vnd.rar",".7z":"application/x-7z-compressed"}[c]||"application/octet-stream"}async function a(n){try{let c=n.toString("hex",0,8);if(c.startsWith("89504e47")){let p=n.readUInt32BE(16),o=n.readUInt32BE(20);return {width:p,height:o}}if(c.startsWith("ffd8")){let p=2;for(;p<n.length&&n[p]===255;){let o=n[p+1];if(o===192||o===194){let u=n.readUInt16BE(p+5);return {width:n.readUInt16BE(p+7),height:u}}p+=2+n.readUInt16BE(p+2);}}}catch{}return {}}return te({name:"local",displayName:"Local Storage",supportsDynamicResize:true,async upload(n,c){await s(e);let p=Buffer.from(await n.arrayBuffer()),o=crypto.createHash("md5").update(p).digest("hex"),u=Ae.extname(n.name),d=c?.filename||`${o}${u}`,m=c?.folder||"",y=m?Ae.join(e,m):e;await s(y);let l=Ae.join(y,d);await promises.writeFile(l,p);let g=n.type.startsWith("image/")?await a(p):{},h=t||"/uploads",T=m?`/${m}/${d}`:`/${d}`,S=h+T;return {id:o,filename:d,originalName:n.name,mimeType:n.type||r(n.name),size:p.length,url:S,thumbnailUrl:n.type.startsWith("image/")?S:void 0,folder:m||void 0,provider:"local",metadata:{...g,...c?.metadata},createdAt:new Date().toISOString()}},async uploadFromUrl(n,c){let p=await fetch(n);if(!p.ok)throw new Error(`Failed to fetch file: ${p.statusText}`);let o=await p.blob(),u=p.headers.get("content-disposition"),d=c?.filename;if(!d&&u){let y=u.match(/filename[^;=\n]*=((['"]).*?\2|[^;\n]*)/);y&&(d=y[1].replace(/['"]/g,""));}d||(d=Ae.basename(new URL(n).pathname));let m=new File([o],d,{type:o.type||r(d)});return this.upload(m,c)},async delete(n){let c=Ae.join(e,n.replace(t+"/",""));try{await promises.unlink(c);}catch{}},async rename(n,c){let p=Ae.join(e,n.replace(t+"/","")),o=Ae.join(e,c);return await promises.rename(p,o),`${t}/${c}`},async list(n){let c=n?Ae.join(e,n):e;if(!fs.existsSync(c))return [];let p=[],o=await promises.readdir(c,{withFileTypes:true});for(let u of o)if(u.isFile()){let d=Ae.join(c,u.name),m=await promises.stat(d),y=`${t}${n?`/${n}`:""}/${u.name}`;p.push({id:crypto.createHash("md5").update(u.name).digest("hex"),filename:u.name,originalName:u.name,mimeType:r(u.name),size:m.size,url:y,provider:"local",createdAt:m.birthtime.toISOString()});}return p},async exists(n){let c=Ae.join(e,n.replace(t+"/",""));return fs.existsSync(c)},async createFolder(n){let c=Ae.join(e,n);await promises.mkdir(c,{recursive:true});},async deleteFolder(n){let c=Ae.join(e,n);if(fs.existsSync(c)){let{rm:p}=await import('fs/promises');await p(c,{recursive:true,force:true});}}})}function Le(i){let e=(t,s)=>{if(!i.signKey)return t;let r=crypto.createHmac("sha256",i.signKey).update(t+s.toString()).digest("hex");return s.set("s",r),t};return {name:"imgix",displayName:"Imgix",supportsDynamicResize:true,async upload(t,s){throw new Error("Imgix is a transformation service. Use another provider for uploads.")},async uploadFromUrl(t,s){let r=s?.filename||t.split("/").pop()||"file",a=await fetch(t);if(!a.ok)throw new Error(`Failed to fetch: ${a.statusText}`);let n=await a.blob();new File([n],r,{type:n.type});return {id:Buffer.from(t).toString("base64").slice(0,20),filename:r,originalName:r,mimeType:n.type,size:n.size,url:this.getImageUrl(t),thumbnailUrl:this.getImageUrl(t,{width:200,height:200,fit:"crop"}),provider:"imgix",createdAt:new Date().toISOString()}},async delete(t){},async rename(t,s){return `https://${i.domain}/${s}`},getImageUrl(t,s){let r=new URL(t),a=new URLSearchParams(r.search);i.defaultParameters&&Object.entries(i.defaultParameters).forEach(([c,p])=>{a.has(c)||a.set(c,p);}),s&&(s.width&&a.set("w",String(s.width)),s.height&&a.set("h",String(s.height)),s.quality&&a.set("q",String(s.quality)),s.format&&a.set("fm",s.format),s.fit&&a.set("fit",s.fit),s.blur&&a.set("blur",String(s.blur)),s.sharpen&&a.set("sharp",String(s.sharpen))),a.set("auto","compress,format");r.pathname+"?"+a.toString();return i.signKey&&(e(r.pathname+a.toString(),a)),`https://${i.domain}${r.pathname}${a.toString()?"?"+a.toString():""}`},async generateThumbnail(t){return this.getImageUrl(t.url,{width:200,height:200,fit:"crop"})},async list(){return []},async exists(t){try{return (await fetch(t,{method:"HEAD"})).ok}catch{return  false}},async createFolder(){},async deleteFolder(){}}}function be(i,e){return e.cdnUrl?`${e.cdnUrl.replace(/\/$/,"")}/${i}`:`https://${e.storageZone}.b-cdn.net/${i}`}function qe(i){return i.cdnUrl?i.cdnUrl.replace(/\/$/,"")+"/":`https://${i.storageZone}.b-cdn.net/`}function De(i){let e=`https://storage.bunnycdn.com/${i.storageZone}`,t=s=>`${i.prefix?`${i.prefix}/`:""}${s}`.replace(/\/+/g,"/");return te({name:"bunny",displayName:"Bunny.net Storage",supportsDynamicResize:true,async upload(s,r){let a=t(`${r?.folder?`${r.folder}/`:""}${r?.filename||s.name}`),n=Buffer.from(await s.arrayBuffer()),c=await fetch(`${e}/${a}`,{method:"PUT",headers:{AccessKey:i.apiKey,"Content-Type":s.type},body:n});if(!c.ok){let p=await c.text();throw new Error(`Bunny.net upload failed: ${c.status} ${p}`)}return {id:Buffer.from(a).toString("base64url"),filename:r?.filename||s.name,originalName:s.name,mimeType:s.type,size:n.length,url:be(a,i),thumbnailUrl:s.type.startsWith("image/")?be(a,i):void 0,folder:r?.folder,provider:"bunny",metadata:r?.metadata,createdAt:new Date().toISOString()}},async delete(s){let r=s.replace(qe(i),""),a=await fetch(`${e}/${r}`,{method:"DELETE",headers:{AccessKey:i.apiKey}});if(!a.ok&&a.status!==404){let n=await a.text();throw new Error(`Bunny.net delete failed: ${a.status} ${n}`)}},async rename(s,r){let a=s.replace(qe(i),""),n=i.prefix?`${i.prefix}/${r}`:r,c=await fetch(`${e}/${a}`,{method:"GET",headers:{AccessKey:i.apiKey}});if(!c.ok)throw new Error("Bunny.net rename failed: could not read old file");let p=await c.arrayBuffer();return await fetch(`${e}/${n}`,{method:"PUT",headers:{AccessKey:i.apiKey,"Content-Type":c.headers.get("Content-Type")||"application/octet-stream"},body:p}),await this.delete(s),be(n,i)},async list(s){let r=t(s||""),a=await fetch(`${e}/${r}`,{method:"GET",headers:{AccessKey:i.apiKey}});if(!a.ok){let c=await a.text();throw new Error(`Bunny.net list failed: ${a.status} ${c}`)}return (await a.json()).map(c=>({id:Buffer.from(c.ObjectName||"").toString("base64url"),filename:c.ObjectName?.split("/").pop()||"",originalName:c.ObjectName?.split("/").pop()||"",mimeType:"application/octet-stream",size:c.Length||0,url:be(c.ObjectName||"",i),provider:"bunny",createdAt:c.LastChanged||new Date().toISOString()}))},async exists(s){let r=s.replace(qe(i),"");return (await fetch(`${e}/${r}`,{method:"HEAD",headers:{AccessKey:i.apiKey}})).ok},async createFolder(s){let r=t(`${s}/`);await fetch(`${e}/${r}`,{method:"PUT",headers:{AccessKey:i.apiKey,"Content-Length":"0"},body:""});},async deleteFolder(s){let r=t(`${s}/`);await fetch(`${e}/${r}`,{method:"DELETE",headers:{AccessKey:i.apiKey}});}})}function Ce(){let i=()=>{let s=globalThis.STORAGE_BUCKET;if(!s)throw new Error("Cloudflare R2 native binding 'STORAGE_BUCKET' not found in global scope.");return s},e=s=>`/api/media/file/${s}`,t=s=>s.replace(/\/+/g,"/").replace(/^\/+/,"");return te({name:"cloudflare_r2",displayName:"Cloudflare R2 (Native)",supportsDynamicResize:true,async upload(s,r){let a=i(),n=t(`${r?.folder?`${r.folder}/`:""}${r?.filename||s.name}`),c=await s.arrayBuffer(),p=await a.put(n,c,{httpMetadata:{contentType:s.type},customMetadata:r?.metadata||{}});return {id:Buffer.from(n).toString("base64url"),filename:r?.filename||s.name,originalName:s.name,mimeType:s.type,size:p.size,url:e(n),thumbnailUrl:s.type.startsWith("image/")?e(n):void 0,folder:r?.folder,provider:"cloudflare_r2",metadata:{...r?.metadata,etag:p.etag},createdAt:new Date().toISOString()}},async delete(s){let r=i(),a=s.replace(/^\/api\/media\/file\//,"");await r.delete(a);},async rename(s,r){let a=i(),n=s.replace(/^\/api\/media\/file\//,""),c=t(r),p=await a.get(n);if(!p)throw new Error("File not found");return await a.put(c,p.body,{httpMetadata:p.httpMetadata,customMetadata:p.customMetadata}),await a.delete(n),e(c)},async list(s){let r=i(),a=t(s||"");return (await r.list({prefix:a})).objects.map(c=>({id:Buffer.from(c.key).toString("base64url"),filename:c.key.split("/").pop()||"",originalName:c.key.split("/").pop()||"",mimeType:c.httpMetadata?.contentType||"application/octet-stream",size:c.size,url:e(c.key),provider:"cloudflare_r2",createdAt:c.uploaded.toISOString()}))},async exists(s){try{let r=i(),a=s.replace(/^\/api\/media\/file\//,"");return await r.head(a)!==null}catch{return  false}}})}var _e=class{providers=new Map;providerToPlugin=new Map;disabledPlugins=new Set;constructor(){this.registerLocal(),this.registerImgix(),this.registerBunny(),this.registerCloudflareR2(),this.registerCloudflareS3();}registerLocal(){this.register({type:"local",displayName:"Local Server",configKey:"local",configFields:[{name:"uploadDir",type:"text",label:"Upload Directory",defaultValue:"./public/uploads"},{name:"baseUrl",type:"text",label:"Base URL",defaultValue:"/uploads"}],extractConfig:(e,t)=>e[t]||{},extractRawConfig:e=>{let t=e?.local||e,s=(t?.uploadDir||"").trim(),r;s?Ae__default.default.isAbsolute(s)?r=s:s.includes("/")||s.includes("\\")?r=Ae__default.default.resolve(process.cwd(),s):r=Ae__default.default.join(process.cwd(),"public",s):r=Ae__default.default.join(process.cwd(),"public","uploads");let a=(t?.baseUrl||"").trim(),n;return a?n=a.startsWith("/")?a:`/${a}`:n="/uploads",{uploadDir:r,baseUrl:n}},factory:e=>ne(e)});}registerImgix(){this.register({type:"imgix",displayName:"Imgix",configKey:"imgix",configFields:[{name:"domain",type:"text",label:"Domain",required:true},{name:"signKey",type:"password",label:"Sign Key"}],extractConfig:(e,t)=>e[t]||{},extractRawConfig:e=>e?.imgix||e,factory:e=>Le(e)});}registerBunny(){this.register({type:"bunny",displayName:"Bunny.net",configKey:"bunny",configFields:[{name:"storageZone",type:"text",label:"Storage Zone",required:true},{name:"apiKey",type:"password",label:"API Key",required:true},{name:"cdnUrl",type:"text",label:"CDN URL"},{name:"prefix",type:"text",label:"Path Prefix"}],extractConfig:(e,t)=>e[t]||{},extractRawConfig:e=>e?.bunny||e,factory:e=>De(e)});}registerCloudflareR2(){this.register({type:"cloudflare_r2",displayName:"Cloudflare R2 (Native)",configKey:"cloudflareR2",configFields:[],extractConfig:()=>({}),extractRawConfig:()=>({}),factory:()=>Ce()});}registerCloudflareS3(){this.register({type:"cloudflare_s3",displayName:"Cloudflare R2 (S3 Compat)",configKey:"cloudflareR2",configFields:[],extractConfig:()=>(console.warn('[StorageRegistry] "cloudflare_s3" is deprecated; use "cloudflare_r2" instead.'),{}),extractRawConfig:()=>({}),factory:()=>Ce()});}register(e){if(this.providers.has(e.type)){console.warn(`[StorageRegistry] Provider "${e.type}" already registered, skipping`);return}e.pluginName&&this.providerToPlugin.set(e.type,e.pluginName),this.providers.set(e.type,e);}unregister(e){this.providers.delete(e),this.providerToPlugin.delete(e);}get(e){return this.providers.get(e)}getAll(){return Array.from(this.providers.values())}getAllAvailable(e){let t=this.getAll();return e?t.filter(s=>s.pluginName?e(s.pluginName):true):t}has(e){return this.providers.has(e)}async resolve(e,t){let s=this.providers.get(e);if(!s)throw new Error(`Unknown storage provider type: "${e}". Is the plugin that provides it enabled?`);if(s.pluginName&&this.disabledPlugins.has(s.pluginName))throw new Error(`Storage provider "${e}" is not available (plugin "${s.pluginName}" is disabled)`);let r=s.configKey||e,a=s.extractConfig(t,r);return s.factory(a)}async resolveWithConfig(e,t){let s=this.providers.get(e);if(!s)throw new Error(`Unknown storage provider type: "${e}". Is the plugin that provides it enabled?`);if(s.pluginName&&this.disabledPlugins.has(s.pluginName))throw new Error(`Storage provider "${e}" is not available (plugin "${s.pluginName}" is disabled)`);let r=s.extractRawConfig(t);return s.factory(r)}getProviderPluginName(e){return this.providerToPlugin.get(e)}getAllPluginNames(){return Array.from(new Set(this.providerToPlugin.values()))}setPluginEnabled(e,t){t?this.disabledPlugins.delete(e):this.disabledPlugins.add(e);}isPluginEnabled(e){return !this.disabledPlugins.has(e)}},$e=null;function Oe(){return $e||($e=new _e),$e}function kt(i){if(!i)return "";if(i.startsWith("pub-"))return i;let e=i.match(/pub-[a-zA-Z0-9]+/i);return e?e[0]:""}function dr(i,e){let t=i.startsWith("/")?i.slice(1):i;if(e.cdnUrl)return `${e.cdnUrl.replace(/\/$/,"")}/${t}`;switch(e.provider){case "r2":{let s=kt(e.publicDevUrl);return s?`https://${s}.r2.dev/${t}`:`https://${e.bucket}.${e.accountId}.r2.cloudflarestorage.com/${t}`}case "gcs":return `https://storage.googleapis.com/${e.bucket}/${t}`;case "digitalocean":return `https://${e.bucket}.${e.region}.cdn.digitaloceanspaces.com/${t}`;case "backblaze":return `https://${e.bucket}.s3.backblazeb2.com/${t}`;case "wasabi":return `https://${e.bucket}.s3.wasabisys.com/${t}`;default:return `https://${e.bucket}.s3.${e.region}.amazonaws.com/${t}`}}function Fe(i){if(i.cdnUrl)return i.cdnUrl.replace(/\/$/,"")+"/";switch(i.provider){case "r2":{let e=kt(i.publicDevUrl);return e?`https://${e}.r2.dev/`:`https://${i.bucket}.${i.accountId}.r2.cloudflarestorage.com/`}case "gcs":return `https://storage.googleapis.com/${i.bucket}/`;case "digitalocean":return `https://${i.bucket}.${i.region}.cdn.digitaloceanspaces.com/`;case "backblaze":return `https://${i.bucket}.s3.backblazeb2.com/`;case "wasabi":return `https://${i.bucket}.s3.wasabisys.com/`;default:return `https://${i.bucket}.s3.${i.region}.amazonaws.com/`}}function ur(i){switch(i){case "r2":return "Cloudflare R2";case "gcs":return "Google Cloud Storage";case "digitalocean":return "DigitalOcean Spaces";case "backblaze":return "Backblaze B2";case "wasabi":return "Wasabi";default:return "AWS S3"}}function pr(i){let e=new clientS3.S3Client({region:i.region||"auto",endpoint:i.endpoint,credentials:{accessKeyId:i.accessKeyId,secretAccessKey:i.secretAccessKey},forcePathStyle:true,tls:true,...i.provider==="r2"&&{requestHandler:new nodeHttpHandler.NodeHttpHandler}}),t=r=>`${i.prefix?`${i.prefix}/`:""}${r}`.replace(/\/+/g,"/"),s=r=>dr(r,i);return te({name:i.provider,displayName:ur(i.provider),supportsDynamicResize:true,async upload(r,a){let n=t(`${a?.folder?`${a.folder}/`:""}${a?.filename||r.name}`),c=Buffer.from(await r.arrayBuffer());await e.send(new clientS3.PutObjectCommand({Bucket:i.bucket,Key:n,Body:c,ContentType:r.type,Metadata:a?.metadata}));let p=await e.send(new clientS3.HeadObjectCommand({Bucket:i.bucket,Key:n}));return {id:Buffer.from(n).toString("base64url"),filename:a?.filename||r.name,originalName:r.name,mimeType:r.type,size:c.length,url:s(n),thumbnailUrl:r.type.startsWith("image/")?s(n):void 0,folder:a?.folder,provider:i.provider,metadata:{...a?.metadata,etag:p.ETag},createdAt:new Date().toISOString()}},async delete(r){let a=r.replace(Fe(i),"");await e.send(new clientS3.DeleteObjectCommand({Bucket:i.bucket,Key:a}));},async rename(r,a){let n=r.replace(Fe(i),""),c=i.prefix?`${i.prefix}/${a}`:a;return await e.send(new clientS3.CopyObjectCommand({Bucket:i.bucket,CopySource:`${i.bucket}/${n}`,Key:c})),await e.send(new clientS3.DeleteObjectCommand({Bucket:i.bucket,Key:n})),s(c)},async list(r){let a=t(r||"");return ((await e.send(new clientS3.ListObjectsV2Command({Bucket:i.bucket,Prefix:a}))).Contents||[]).map(c=>({id:Buffer.from(c.Key||"").toString("base64url"),filename:c.Key?.split("/").pop()||"",originalName:c.Key?.split("/").pop()||"",mimeType:"application/octet-stream",size:c.Size||0,url:s(c.Key||""),provider:i.provider,createdAt:c.LastModified?.toISOString()||new Date().toISOString()}))},async exists(r){try{let a=r.replace(Fe(i),"");return await e.send(new clientS3.HeadObjectCommand({Bucket:i.bucket,Key:a})),!0}catch{return  false}},async createFolder(r){let a=t(`${r}/`);await e.send(new clientS3.PutObjectCommand({Bucket:i.bucket,Key:a,Body:""}));},async deleteFolder(r){let a=t(`${r}/`),n;do{let c=await e.send(new clientS3.ListObjectsV2Command({Bucket:i.bucket,Prefix:a,ContinuationToken:n}));if(c.Contents?.length){let p=c.Contents.map(o=>({Key:o.Key}));await e.send(new clientS3.DeleteObjectsCommand({Bucket:i.bucket,Delete:{Objects:p}}));}n=c.IsTruncated?c.NextContinuationToken:void 0;}while(n);await e.send(new clientS3.DeleteObjectCommand({Bucket:i.bucket,Key:a}));}})}function mr(i){let e=()=>`https://api.cloudinary.com/v1_1/${i.cloudName}/upload`,t=async s=>{let r=await import('crypto'),a=Object.keys(s).sort().map(n=>`${n}=${s[n]}`).join("&");return r.createHash("sha256").update(a+i.apiSecret).digest("hex")};return {name:"cloudinary",displayName:"Cloudinary",supportsDynamicResize:true,async upload(s,r){let a=new FormData;if(a.append("file",s),i.uploadPreset)a.append("upload_preset",i.uploadPreset);else {let p=Math.round(Date.now()/1e3),o={timestamp:String(p)};(r?.folder||i.folder)&&(o.folder=r?.folder||i.folder||"");let u=await t(o);a.append("timestamp",String(p)),a.append("signature",u),a.append("api_key",i.apiKey);}(r?.folder||i.folder)&&a.append("folder",r?.folder||i.folder||"");let n=await fetch(e(),{method:"POST",body:a});if(!n.ok){let p=await n.json();throw new Error(`Cloudinary upload failed: ${p.error?.message||n.statusText}`)}let c=await n.json();return {id:c.public_id,filename:`${c.public_id}.${c.format}`,originalName:c.original_filename||s.name,mimeType:s.type||`image/${c.format}`,size:c.bytes,url:c.secure_url,thumbnailUrl:this.getImageUrl(c.secure_url,{width:200,height:200,fit:"crop"}),width:c.width,height:c.height,folder:r?.folder||i.folder,provider:"cloudinary",createdAt:new Date().toISOString()}},async uploadFromUrl(s,r){let a=new FormData;a.append("file",s),a.append("upload_preset","ml_default"),(r?.folder||i.folder)&&a.append("folder",r?.folder||i.folder||"");let n=await fetch(e(),{method:"POST",body:a});if(!n.ok)throw new Error("Cloudinary upload failed");let c=await n.json();return {id:c.public_id,filename:`${c.public_id}.${c.format}`,originalName:c.original_filename||s.split("/").pop()||"file",mimeType:`image/${c.format}`,size:c.bytes,url:c.secure_url,thumbnailUrl:this.getImageUrl(c.secure_url,{width:200,height:200,fit:"crop"}),width:c.width,height:c.height,provider:"cloudinary",createdAt:new Date().toISOString()}},async delete(s){try{let r=s.split("/image/upload/");if(r.length!==2){console.warn("[Cloudinary delete] Could not parse URL:",s);return}let a=r[1].replace(/^v\d+\//,"").replace(/\.[^.]+$/,""),n=Math.round(Date.now()/1e3),c={timestamp:String(n),public_id:a},p=Object.keys(c).sort().map(l=>`${l}=${c[l]}`).join("&"),u=(await import('crypto')).createHash("sha256").update(p+i.apiSecret).digest("hex"),d=`https://api.cloudinary.com/v1_1/${i.cloudName}/image/destroy`,m=new FormData;m.append("public_id",a),m.append("timestamp",String(n)),m.append("signature",u),m.append("api_key",i.apiKey);let y=await fetch(d,{method:"POST",body:m});if(!y.ok){let l=await y.json();console.warn("[Cloudinary delete] Failed:",l);}}catch(r){console.warn("[Cloudinary delete] Error:",r.message);}},async rename(s,r){let a="",n=r.replace(/\.[^.]+$/,""),c="";try{let p=s.split("/image/upload/");if(p.length!==2)return console.warn("[Cloudinary rename] Could not parse old URL:",s),s;let o=p[1],u=o.match(/^(v\d+)\//);a=u?u[1]:"";let d=o.replace(/^v\d+\//,"").replace(/\.[^.]+$/,""),m=d.split("/");c=m.length>1?m.slice(0,-1).join("/"):"";let y=r.replace(/\.[^.]+$/,"");n=c?`${c}/${y}`:y;let l=Math.round(Date.now()/1e3),g={from_public_id:d,to_public_id:n,timestamp:String(l)},h=Object.keys(g).sort().map(b=>`${b}=${g[b]}`).join("&"),S=(await import('crypto')).createHash("sha256").update(h+i.apiSecret).digest("hex"),w=new FormData;w.append("from_public_id",d),w.append("to_public_id",n),w.append("timestamp",String(l)),w.append("signature",S),w.append("api_key",i.apiKey);let A=await fetch(`https://api.cloudinary.com/v1_1/${i.cloudName}/image/rename`,{method:"POST",body:w});if(A.ok)return (await A.json()).secure_url;{let b=await A.json();console.warn("[Cloudinary rename] Failed:",b);let E=a?`/${a}/`:"/";return `https://res.cloudinary.com/${i.cloudName}/image/upload${E}${n}.${r.split(".").pop()}`}}catch(p){console.warn("[Cloudinary rename] Error:",p.message);let o=a?`/${a}/`:"/";return `https://res.cloudinary.com/${i.cloudName}/image/upload${o}${n}.${r.split(".").pop()}`}},getImageUrl(s,r){if(!r)return s;let a=s.split("/upload/");if(a.length!==2)return s;let n=[];if(r.width&&n.push(`w_${r.width}`),r.height&&n.push(`h_${r.height}`),r.fit){let p={crop:"c_fill",clip:"c_fit",scale:"c_scale",fill:"c_fill"};n.push(p[r.fit]||"c_limit");}r.quality&&n.push(`q_${r.quality}`),r.format&&n.push(`f_${r.format}`);let c=n.join(",");return `${a[0]}/upload/${c}/${a[1]}`},async generateThumbnail(s){return this.getImageUrl(s.url,{width:200,height:200,fit:"crop"})},async list(){return []},async exists(s){return (await fetch(s,{method:"HEAD"})).ok},async createFolder(){},async deleteFolder(){}}}async function Pt(i){let e=i.getStorageConfig(),t=Oe();try{return await t.resolve(e.type,e)}catch(s){return console.warn(`[resolveProvider] ${s.message} \u2014 falling back to local storage`),ne({uploadDir:Ae__default.default.join(process.cwd(),"public","uploads"),baseUrl:"/uploads"})}}function te(i){return {async uploadFromUrl(e,t){let s=await fetch(e);if(!s.ok)throw new Error(`Failed to fetch: ${s.statusText}`);let r=await s.blob(),a=e.split("/").pop()||"file",n=new File([r],a,{type:r.type});return this.upload(n,t)},getImageUrl(e,t){if(!t||Object.keys(t).length===0)return e;let s=new URLSearchParams({url:e});return t.width&&s.set("w",String(t.width)),t.height&&s.set("h",String(t.height)),t.quality&&s.set("q",String(t.quality)),t.format&&s.set("f",t.format),t.cropWidth&&t.cropHeight&&(s.set("cx",String(t.cropX??0)),s.set("cy",String(t.cropY??0)),s.set("cw",String(t.cropWidth)),s.set("ch",String(t.cropHeight))),`/api/media/resize?${s.toString()}`},async generateThumbnail(e){return this.getImageUrl(e.url,{width:400,height:400})},...i}}async function Lt(i){if(!i)return console.warn("[resolveProviderWithConfig] No config, using local"),ne({uploadDir:Ae__default.default.join(process.cwd(),"public","uploads"),baseUrl:"/uploads"});let e=i.type||"local",t=Oe();try{return await t.resolveWithConfig(e,i)}catch(s){return console.warn(`[resolveProviderWithConfig] ${s.message} \u2014 falling back to local storage`),ne({uploadDir:Ae__default.default.join(process.cwd(),"public","uploads"),baseUrl:"/uploads"})}}function qt(){return typeof globalThis>"u"?false:typeof globalThis.EdgeRuntime=="string"||typeof globalThis.WebSocketPair<"u"||typeof globalThis.Deno<"u"||typeof process<"u"&&process.env?.NEXT_RUNTIME==="edge"}async function Dt(i,e){let t=e?.format||"webp",s=(t==="avif"?80:85);if(!qt())try{let{default:r}=await import('sharp'),a=await r(i).metadata(),n=r(i),c=r(i).resize({width:500,withoutEnlargement:!0});return t==="avif"?(n=n.avif({quality:s}),c=c.avif({quality:Math.min(s,75)})):t==="png"?(n=n.png({compressionLevel:8}),c=c.png({compressionLevel:8})):t==="jpeg"||t==="jpg"?(n=n.jpeg({quality:s}),c=c.jpeg({quality:Math.min(s,80)})):(n=n.webp({quality:s}),c=c.webp({quality:Math.min(s,80)})),{buffer:await n.toBuffer(),thumbnailBuffer:await c.toBuffer(),width:a.width,height:a.height,format:t}}catch{}return {buffer:i,thumbnailBuffer:i,format:"passthrough"}}var Ct=`
   CREATE TABLE IF NOT EXISTS media (
     id TEXT PRIMARY KEY,
     filename TEXT NOT NULL UNIQUE,
@@ -103,6 +103,6 @@
         status TEXT,
         timestamp TEXT DEFAULT CURRENT_TIMESTAMP
       );
-    `);}async hashPassword(e){return Kt__default.default.hashSync(e,10)}async verifyPassword(e,t){let s=await this.findUserByEmail(e);return !s||!s.passwordHash?null:Kt__default.default.compareSync(t,s.passwordHash)?s:null}async findUserByEmail(e){let t=await this.getOne("SELECT * FROM users WHERE LOWER(email) = LOWER(?) LIMIT 1",[e]);return t?this.mapUser(t):null}async findUserById(e){let t=await this.getOne("SELECT * FROM users WHERE id = ? LIMIT 1",[e]);return t?this.mapUser(t):null}async createUser(e){let t=`user-${Date.now()}-${Math.random().toString(36).substring(2,9)}`,s=await this.hashPassword(e.password),r=e.email.toLowerCase(),a=e.role||"customer",n=new Date().toISOString();await this.executeSql("INSERT INTO users (id, email, password_hash, name, role, avatar, tenant_id, metadata, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[t,r,s,e.name||null,a,e.avatar||null,e.tenantId||null,e.metadata?JSON.stringify(e.metadata):null,n,n]);let c=await this.findUserById(t);if(!c)throw new Error("Failed to create user in D1");return c}async updateUser(e,t){if(!await this.findUserById(e))return null;let r=["updated_at = ?"],a=[new Date().toISOString()];return t.email&&(r.push("email = ?"),a.push(t.email.toLowerCase())),t.name!==void 0&&(r.push("name = ?"),a.push(t.name)),t.password&&(r.push("password_hash = ?"),a.push(await this.hashPassword(t.password))),t.passwordHash&&(r.push("password_hash = ?"),a.push(t.passwordHash)),t.role&&(r.push("role = ?"),a.push(t.role)),t.avatar!==void 0&&(r.push("avatar = ?"),a.push(t.avatar)),t.tenantId!==void 0&&(r.push("tenant_id = ?"),a.push(t.tenantId)),t.metadata!==void 0&&(r.push("metadata = ?"),a.push(t.metadata?JSON.stringify(t.metadata):null)),a.push(e),await this.executeSql(`UPDATE users SET ${r.join(", ")} WHERE id = ?`,a),this.findUserById(e)}async deleteUser(e){return await this.executeSql("DELETE FROM users WHERE id = ?",[e]),true}async createSession(e,t){let s=`sess-${Date.now()}-${Math.random().toString(36).substring(2,9)}`,r=`token-${Date.now()}-${Math.random().toString(36).substring(2,16)}`,a=new Date(Date.now()+this.sessionTTL*1e3).toISOString(),n=new Date().toISOString();return await this.executeSql("INSERT INTO sessions (id, user_id, token, expires_at, created_at, ip_address, user_agent) VALUES (?, ?, ?, ?, ?, ?, ?)",[s,e,r,a,n,t?.ipAddress||null,t?.userAgent||null]),{id:s,userId:e,token:r,expiresAt:a,createdAt:n,ipAddress:t?.ipAddress,userAgent:t?.userAgent}}async findSessionByToken(e){let t=await this.getOne("SELECT * FROM sessions WHERE token = ? LIMIT 1",[e]);return t?{id:t.id,userId:t.user_id||t.userId,token:t.token,expiresAt:t.expires_at||t.expiresAt,createdAt:t.created_at||t.createdAt,ipAddress:t.ip_address||t.ipAddress,userAgent:t.user_agent||t.userAgent}:null}async findSessionByRefreshToken(e){let t=await this.getOne("SELECT * FROM sessions WHERE refresh_token = ? LIMIT 1",[e]);return t?{id:t.id,userId:t.user_id||t.userId,token:t.token,refreshToken:t.refresh_token,expiresAt:t.expires_at||t.expiresAt,createdAt:t.created_at||t.createdAt}:null}async deleteSession(e){return await this.executeSql("DELETE FROM sessions WHERE id = ?",[e]),true}async deleteUserSessions(e){return await this.executeSql("DELETE FROM sessions WHERE user_id = ?",[e]),1}async hasAnyUsers(){return ((await this.getOne("SELECT COUNT(*) as count FROM users"))?.count||0)>0}async createEmailVerificationToken(e){return {token:`verify-${Date.now()}`,expiresAt:new Date(Date.now()+864e5)}}async verifyEmailToken(e){return {success:true}}async createPasswordResetToken(e){return {token:`reset-${Date.now()}`,expiresAt:new Date(Date.now()+36e5)}}async resetPasswordWithToken(e,t){return {success:true}}async findAuditLogs(e){let s=(await this.executeSql("SELECT * FROM audit_logs ORDER BY timestamp DESC LIMIT ?",[e.limit||50])).map(r=>({id:r.id,action:r.action,userId:r.user_id||r.userId,userEmail:r.user_email||r.userEmail,role:r.role,resource:r.resource,resourceId:r.resource_id||r.resourceId,ipAddress:r.ip_address||r.ipAddress,userAgent:r.user_agent||r.userAgent,success:!!(r.success??true),error:r.error||void 0,metadata:r.details?JSON.parse(r.details):void 0,timestamp:new Date(r.timestamp||Date.now())}));return {logs:s,total:s.length}}async createAuditLog(e){let t=`audit-${Date.now()}-${Math.random().toString(36).substring(2,9)}`,s=new Date;return await this.executeSql("INSERT INTO audit_logs (id, action, user_id, user_email, role, resource, details, ip_address, status, timestamp) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[t,e.action,e.userId||null,e.userEmail||null,e.role||null,e.resource,e.metadata?JSON.stringify(e.metadata):null,e.ipAddress||null,e.success?"success":"failed",s.toISOString()]),{id:t,timestamp:s,...e}}mapUser(e){return {id:e.id,email:e.email,name:e.name||void 0,passwordHash:e.password_hash||e.passwordHash||void 0,role:e.role,avatar:e.avatar||void 0,tenantId:e.tenant_id||e.tenantId||void 0,metadata:e.metadata?typeof e.metadata=="string"?JSON.parse(e.metadata):e.metadata:void 0,emailVerified:!!(e.email_verified||e.emailVerified),locked:!!e.locked,lastLogin:e.last_login||e.lastLogin||void 0,failedLoginAttempts:Number(e.failed_login_attempts||e.failedLoginAttempts||0),createdAt:e.created_at||e.createdAt||new Date().toISOString(),updatedAt:e.updated_at||e.updatedAt||new Date().toISOString()}}};async function Ar(i,e){if("dialect"in i&&i.dialect==="postgres")return new chunk3A5UO6OQ_cjs.a({db:i.client});if("dialect"in i&&i.dialect==="sqlite")return new Ie({db:i.client});if("dialect"in i&&i.dialect==="mongodb"){let s=i;return new chunkNBBAMC2X_cjs.a({db:()=>s.db,adapter:s})}let t=Ae.resolve(e,"data","auth.db");return new chunkPW6Y5MQL_cjs.a({path:process.env.KYRO_AUTH_DB_PATH||t})}async function Ht(i){let{registry:e,db:t,authSecret:s,authAdapter:r,checkSession:a,user:n,tenantId:c,cors:p,webhookService:o,settings:u}=i,d=new hono.Hono;function m(f){if(Array.isArray(f))return f.map(m);if(f!==null&&typeof f=="object"){let k={};for(let L in f)L!=="attrs"&&(k[L]=m(f[L]));return k}return f}d.use("*",async(f,k)=>{await k();let L=f.req.header("referer")||"";if(!(f.req.header("x-kyro-admin")==="true"||L.includes("/admin"))&&f.res.status<400){let C=f.res.headers.get("Content-Type");if(C&&C.includes("application/json"))try{let M=await f.res.clone().json(),N=m(M);f.res=f.json(N,f.res.status);}catch{}}}),d.onError((f,k)=>{if(f instanceof I||f&&typeof f.statusCode=="number")return k.json({error:f.message,...f.metadata},f.statusCode||f.status||500);if(f.name==="ZodError")return k.json({error:`Validation failed: ${chunkYOJOVQIH_cjs.a(f.errors)}`,details:f.errors},400);console.error("[Kyro API Error]",f);let L=process.env.NODE_ENV==="production";return k.json({error:L?"Internal Server Error":f.message||"Internal Server Error"},500)});for(let f of e.getPlugins())typeof f.serverMiddleware=="function"&&f.serverMiddleware(d);let y=u?.access?.apiAccess,l=u?.access?.enablePublicAccess??false,g=u?.access?.defaultCollectionAccess??"none";y?.requireAuth;let T=process.cwd(),S=T.endsWith("admin")?Ae.resolve(T,".."):T,w=r||await Ar(t,S),E=yt({db:t,userLookup:async f=>await w.findUserById(f)||null}),U=y?.cors?.allowedOrigins,v=p?.origins,O=Array.isArray(U)?U:typeof U=="string"&&U?U.split(`
+    `);}async hashPassword(e){return Kt__default.default.hashSync(e,10)}async verifyPassword(e,t){let s=await this.findUserByEmail(e);return !s||!s.passwordHash?null:Kt__default.default.compareSync(t,s.passwordHash)?s:null}async findUserByEmail(e){let t=await this.getOne("SELECT * FROM users WHERE LOWER(email) = LOWER(?) LIMIT 1",[e]);return t?this.mapUser(t):null}async findUserById(e){let t=await this.getOne("SELECT * FROM users WHERE id = ? LIMIT 1",[e]);return t?this.mapUser(t):null}async createUser(e){let t=`user-${Date.now()}-${Math.random().toString(36).substring(2,9)}`,s=await this.hashPassword(e.password),r=e.email.toLowerCase(),a=e.role||"customer",n=new Date().toISOString();await this.executeSql("INSERT INTO users (id, email, password_hash, name, role, avatar, tenant_id, metadata, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[t,r,s,e.name||null,a,e.avatar||null,e.tenantId||null,e.metadata?JSON.stringify(e.metadata):null,n,n]);let c=await this.findUserById(t);if(!c)throw new Error("Failed to create user in D1");return c}async updateUser(e,t){if(!await this.findUserById(e))return null;let r=["updated_at = ?"],a=[new Date().toISOString()];return t.email&&(r.push("email = ?"),a.push(t.email.toLowerCase())),t.name!==void 0&&(r.push("name = ?"),a.push(t.name)),t.password&&(r.push("password_hash = ?"),a.push(await this.hashPassword(t.password))),t.passwordHash&&(r.push("password_hash = ?"),a.push(t.passwordHash)),t.role&&(r.push("role = ?"),a.push(t.role)),t.avatar!==void 0&&(r.push("avatar = ?"),a.push(t.avatar)),t.tenantId!==void 0&&(r.push("tenant_id = ?"),a.push(t.tenantId)),t.metadata!==void 0&&(r.push("metadata = ?"),a.push(t.metadata?JSON.stringify(t.metadata):null)),a.push(e),await this.executeSql(`UPDATE users SET ${r.join(", ")} WHERE id = ?`,a),this.findUserById(e)}async deleteUser(e){return await this.executeSql("DELETE FROM users WHERE id = ?",[e]),true}async createSession(e,t){let s=`sess-${Date.now()}-${Math.random().toString(36).substring(2,9)}`,r=`token-${Date.now()}-${Math.random().toString(36).substring(2,16)}`,a=new Date(Date.now()+this.sessionTTL*1e3).toISOString(),n=new Date().toISOString();return await this.executeSql("INSERT INTO sessions (id, user_id, token, expires_at, created_at, ip_address, user_agent) VALUES (?, ?, ?, ?, ?, ?, ?)",[s,e,r,a,n,t?.ipAddress||null,t?.userAgent||null]),{id:s,userId:e,token:r,expiresAt:a,createdAt:n,ipAddress:t?.ipAddress,userAgent:t?.userAgent}}async findSessionByToken(e){let t=await this.getOne("SELECT * FROM sessions WHERE token = ? LIMIT 1",[e]);return t?{id:t.id,userId:t.user_id||t.userId,token:t.token,expiresAt:t.expires_at||t.expiresAt,createdAt:t.created_at||t.createdAt,ipAddress:t.ip_address||t.ipAddress,userAgent:t.user_agent||t.userAgent}:null}async findSessionByRefreshToken(e){let t=await this.getOne("SELECT * FROM sessions WHERE refresh_token = ? LIMIT 1",[e]);return t?{id:t.id,userId:t.user_id||t.userId,token:t.token,refreshToken:t.refresh_token,expiresAt:t.expires_at||t.expiresAt,createdAt:t.created_at||t.createdAt}:null}async deleteSession(e){return await this.executeSql("DELETE FROM sessions WHERE id = ?",[e]),true}async deleteUserSessions(e){return await this.executeSql("DELETE FROM sessions WHERE user_id = ?",[e]),1}async hasAnyUsers(){return ((await this.getOne("SELECT COUNT(*) as count FROM users"))?.count||0)>0}async createEmailVerificationToken(e){return {token:`verify-${Date.now()}`,expiresAt:new Date(Date.now()+864e5)}}async verifyEmailToken(e){return {success:true}}async createPasswordResetToken(e){return {token:`reset-${Date.now()}`,expiresAt:new Date(Date.now()+36e5)}}async resetPasswordWithToken(e,t){return {success:true}}async findAuditLogs(e){let s=(await this.executeSql("SELECT * FROM audit_logs ORDER BY timestamp DESC LIMIT ?",[e.limit||50])).map(r=>({id:r.id,action:r.action,userId:r.user_id||r.userId,userEmail:r.user_email||r.userEmail,role:r.role,resource:r.resource,resourceId:r.resource_id||r.resourceId,ipAddress:r.ip_address||r.ipAddress,userAgent:r.user_agent||r.userAgent,success:!!(r.success??true),error:r.error||void 0,metadata:r.details?JSON.parse(r.details):void 0,timestamp:new Date(r.timestamp||Date.now())}));return {logs:s,total:s.length}}async createAuditLog(e){let t=`audit-${Date.now()}-${Math.random().toString(36).substring(2,9)}`,s=new Date;return await this.executeSql("INSERT INTO audit_logs (id, action, user_id, user_email, role, resource, details, ip_address, status, timestamp) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[t,e.action,e.userId||null,e.userEmail||null,e.role||null,e.resource,e.metadata?JSON.stringify(e.metadata):null,e.ipAddress||null,e.success?"success":"failed",s.toISOString()]),{id:t,timestamp:s,...e}}mapUser(e){return {id:e.id,email:e.email,name:e.name||void 0,passwordHash:e.password_hash||e.passwordHash||void 0,role:e.role,avatar:e.avatar||void 0,tenantId:e.tenant_id||e.tenantId||void 0,metadata:e.metadata?typeof e.metadata=="string"?JSON.parse(e.metadata):e.metadata:void 0,emailVerified:!!(e.email_verified||e.emailVerified),locked:!!e.locked,lastLogin:e.last_login||e.lastLogin||void 0,failedLoginAttempts:Number(e.failed_login_attempts||e.failedLoginAttempts||0),createdAt:e.created_at||e.createdAt||new Date().toISOString(),updatedAt:e.updated_at||e.updatedAt||new Date().toISOString()}}};async function Ar(i,e){if("dialect"in i&&i.dialect==="postgres")return new chunk3A5UO6OQ_cjs.a({db:i.client});if("dialect"in i&&i.dialect==="sqlite")return new Ie({db:i.client});if("dialect"in i&&i.dialect==="mongodb"){let s=i;return new chunkUE7DTBD7_cjs.a({db:()=>s.db,adapter:s})}let t=Ae.resolve(e,"data","auth.db");return new chunkPW6Y5MQL_cjs.a({path:process.env.KYRO_AUTH_DB_PATH||t})}async function Ht(i){let{registry:e,db:t,authSecret:s,authAdapter:r,checkSession:a,user:n,tenantId:c,cors:p,webhookService:o,settings:u}=i,d=new hono.Hono;function m(f){if(Array.isArray(f))return f.map(m);if(f!==null&&typeof f=="object"){let k={};for(let L in f)L!=="attrs"&&(k[L]=m(f[L]));return k}return f}d.use("*",async(f,k)=>{await k();let L=f.req.header("referer")||"";if(!(f.req.header("x-kyro-admin")==="true"||L.includes("/admin"))&&f.res.status<400){let C=f.res.headers.get("Content-Type");if(C&&C.includes("application/json"))try{let M=await f.res.clone().json(),N=m(M);f.res=f.json(N,f.res.status);}catch{}}}),d.onError((f,k)=>{if(f instanceof I||f&&typeof f.statusCode=="number")return k.json({error:f.message,...f.metadata},f.statusCode||f.status||500);if(f.name==="ZodError")return k.json({error:`Validation failed: ${chunkYOJOVQIH_cjs.a(f.errors)}`,details:f.errors},400);console.error("[Kyro API Error]",f);let L=process.env.NODE_ENV==="production";return k.json({error:L?"Internal Server Error":f.message||"Internal Server Error"},500)});for(let f of e.getPlugins())typeof f.serverMiddleware=="function"&&f.serverMiddleware(d);let y=u?.access?.apiAccess,l=u?.access?.enablePublicAccess??false,g=u?.access?.defaultCollectionAccess??"none";y?.requireAuth;let T=process.cwd(),S=T.endsWith("admin")?Ae.resolve(T,".."):T,w=r||await Ar(t,S),E=yt({db:t,userLookup:async f=>await w.findUserById(f)||null}),U=y?.cors?.allowedOrigins,v=p?.origins,O=Array.isArray(U)?U:typeof U=="string"&&U?U.split(`
 `).map(f=>f.trim()).filter(Boolean):[],R=O.length>0?O:v||[];(R.length>0||p)&&d.use("*",async(f,k)=>{let L=f.req.header("Origin")||"*";if(R.length>0&&!R.includes(L))throw new I(403,"Origin not allowed");let q=R.length>0?L:"*";if(f.header("Access-Control-Allow-Origin",q),f.header("Access-Control-Allow-Methods","GET, POST, PATCH, DELETE, OPTIONS"),f.header("Access-Control-Allow-Headers","Content-Type, Authorization, X-API-Key"),p?.credentials&&f.header("Access-Control-Allow-Credentials","true"),f.req.method==="OPTIONS")return f.text("");await k();});let D=u?.access?.rateLimiting,P;if(D?.enabled){let f=D.maxRequests||100,k=D.windowMs||6e4;P=new fe({"api:general":{window:k,max:f}}),d.use("/api/*",async(L,q)=>{if(!P)return q();let C=L.req.header("CF-Connecting-IP")||L.req.header("X-Forwarded-For")?.split(",")[0]?.trim()||L.req.header("X-Real-IP")||"unknown",x=await P.check("api:general",C);if(L.header("X-RateLimit-Limit",String(f)),L.header("X-RateLimit-Remaining",String(x.remaining)),L.header("X-RateLimit-Reset",String(x.resetAt)),!x.allowed)return L.json({error:"Too many requests",retryAfter:x.retryAfter},429);await q();});}let K=new he({redis:w,jwtSecret:s||"change-me",baseUrl:process.env.KYRO_BASE_URL||"http://localhost:4321",rateLimiter:P});chunk2I2AXTKY_cjs.q.fromConfig(t).then(f=>{f&&(K.email=f);}).catch(f=>{console.error("[Email] Failed to initialize transport from config:",f);}),ze(d,K,t,e,E,n,c,l,g);let W=typeof e.hasCollection=="function"&&e.hasCollection("users")?e.getCollection("users"):(()=>{try{return e.getCollection("users")}catch{return chunk34LCWI5X_cjs.a}})();return d.get("/api/users",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=await H(W,"read",f.req.raw,k,L,void 0,l,g);if(!q.allowed)throw new I(q.status||403,q.error||"Access denied");let C=parseInt(f.req.query("page")||"1"),x=Math.min(parseInt(f.req.query("limit")||"10"),100),M=f.req.query("search")||void 0,N=[],F=0;if(typeof w.findUsers=="function"){let B=await w.findUsers({page:C,limit:x,search:M});N=B.users||[],F=B.total||0;}else {let B=await t.find({collection:"users",page:C,limit:x,where:M?{email:{contains:M}}:{},tenantId:L});N=B.docs||[],F=B.totalDocs||0;}return f.json({docs:N,totalDocs:F,limit:x,totalPages:Math.ceil(F/x)||1,page:C,pagingCounter:(C-1)*x+1,hasPrevPage:C>1,hasNextPage:C<Math.ceil(F/x),prevPage:C>1?C-1:null,nextPage:C<Math.ceil(F/x)?C+1:null})}),d.get("/api/users/:id",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=f.req.param("id"),C=await w.findUserById(q);if(!C)throw new I(404,"User not found");return f.json({data:C})}),d.post("/api/users",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=await H(W,"create",f.req.raw,k,L,void 0,l,g);if(!q.allowed)throw new I(q.status||403,q.error||"Access denied");let C=await f.req.json();if(!C.email||!C.password)throw new I(400,"Email and password are required");if(await w.findUserByEmail(C.email))throw new I(400,"Email already in use");let M=C.role||"customer";if(M!=="customer"&&k?.role!=="super_admin")throw new I(403,"Forbidden: Only super_admin can assign administrative roles");let N=await w.createUser({email:C.email,password:C.password,name:C.name,role:M,avatar:C.avatar,tenantId:C.tenantId});return k&&w?.createAuditLog({action:"user_create",userId:k.id,resource:"users",resourceId:N.id,success:true}),f.json({data:N,message:"User created successfully"},201)}),d.patch("/api/users/:id",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=await H(W,"update",f.req.raw,k,L,void 0,l,g);if(!q.allowed)throw new I(q.status||403,q.error||"Access denied");let C=f.req.param("id"),x=await f.req.json(),M=await w.findUserById(C);if(!M)throw new I(404,"User not found");let N={};if(x.name!==void 0&&(N.name=x.name),x.email!==void 0&&(N.email=x.email),x.role!==void 0&&x.role!==M.role){if(k?.role!=="super_admin")throw new I(403,"Forbidden: Only super_admin can modify user roles");N.role=x.role;}x.avatar!==void 0&&(N.avatar=typeof x.avatar=="object"&&x.avatar!==null?x.avatar.id||String(x.avatar):x.avatar),x.tenantId!==void 0&&(N.tenantId=x.tenantId),x.emailVerified!==void 0&&(N.emailVerified=x.emailVerified),x.locked!==void 0&&(N.locked=x.locked),x.failedLoginAttempts!==void 0&&(N.failedLoginAttempts=x.failedLoginAttempts),x.lastLogin!==void 0&&(N.lastLogin=x.lastLogin);let F=await w.updateUser(C,N);if(!F)throw new I(500,"User update failed");return k&&(w?.createAuditLog({action:"user_update",userId:k.id,resource:"users",resourceId:C,success:true}),x.role&&M.role!==x.role&&w?.createAuditLog({action:"role_change",userId:k.id,resource:"users",resourceId:C,success:true,metadata:{oldRole:M.role,newRole:x.role}})),f.json({data:F,message:"User updated successfully"})}),d.delete("/api/users/:id",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=await H(W,"delete",f.req.raw,k,L,void 0,l,g);if(!q.allowed)throw new I(q.status||403,q.error||"Access denied");let C=f.req.param("id");if(k&&k.id===C)throw new I(403,"You cannot delete your own account");let x=await w.findUserById(C);if(!x)throw new I(404,"User not found");if(!await w.deleteUser(C))throw new I(500,"User deletion failed");return k&&w?.createAuditLog({action:"user_delete",userId:k.id,resource:"users",resourceId:C,success:true}),f.json({data:x,message:"User deleted successfully"})}),d.get("/api/auth/audit-logs",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c),q=e.getCollection("audit_logs");if(q){let V=await H(q,"read",f.req.raw,k,L,void 0,l,g);if(!V.allowed)throw new I(V.status||403,V.error||"Access denied")}else if(!k)throw new I(401,"Authentication required");let C=parseInt(f.req.query("page")||"1"),x=Math.min(parseInt(f.req.query("limit")||"50"),100),M=f.req.query("action")||void 0,N=f.req.query("userId")||void 0,F=f.req.query("resource")||void 0,B=await w.findAuditLogs({action:M,userId:N,resource:F,limit:x,offset:(C-1)*x});return f.json({docs:B.logs,totalDocs:B.total,limit:x,totalPages:Math.ceil(B.total/x),page:C,pagingCounter:(C-1)*x+1,hasPrevPage:C>1,hasNextPage:C<Math.ceil(B.total/x),prevPage:C>1?C-1:null,nextPage:C<Math.ceil(B.total/x)?C+1:null})}),Me(d,i,E),d.get("/api/storage-status",async f=>{let{user:k}=await $(f.req.raw,E,n,c);if(!k)throw new I(401,"Authentication required");let L=typeof globalThis.STORAGE_BUCKET<"u"||typeof f.env?.STORAGE_BUCKET<"u",q=L,C=L?"cloudflare_r2":"local";if(t)try{let x=t.prepare('SELECT provider FROM "_globals_storage-settings" LIMIT 1').get();x&&x.provider&&(q=!0,C=x.provider==="aws"?"s3":x.provider);}catch{try{let x=await t.findOne({collection:"_globals_storage-settings",where:{},draft:!0});x&&x.provider&&(q=!0,C=x.provider==="aws"?"s3":x.provider);}catch{}}return f.json({provider:C,configured:q,usage:0,limit:"unlimited"})}),d.get("/api/plugins",async f=>{let{user:k}=await $(f.req.raw,E,n,c);if(!k)throw new I(401,"Authentication required");let L=e.getPlugins(),q=e.storageProviders,C=await Promise.all(L.map(async x=>{let M=true,N=x.name,F={};try{let X=await t.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});X&&X.states&&(F=X.states);}catch{}F[N]!==void 0&&(M=F[N]),q.setPluginEnabled(N,M);let B=N.replace(/^@[^/]+\//,"");B=B.replace(/^(plugin|kyro)-/,"");let V={ai:"AI",seo:"SEO",s3:"S3",aws:"AWS",api:"API",ui:"UI",ftp:"FTP"};if(B=B.split("-").map(X=>{let pe=X.toLowerCase();return V[pe]?V[pe]:X.charAt(0).toUpperCase()+X.slice(1)}).join(" "),B.toLowerCase().startsWith("storage ")){let X=B.split(" ");X.length===2&&(B=`${X[1]} Storage`);}return {id:N,name:x.displayName||B,version:x.version||"1.0.0",description:x.description||"",enabled:M,status:M?"active":"disabled"}}));return f.json(C)}),d.put("/api/plugins/:name/toggle",async f=>{let{user:k}=await $(f.req.raw,E,n,c);if(!k)throw new I(401,"Authentication required");let L=f.req.param("name"),q=e.storageProviders,x=!q.isPluginEnabled(L),M=[];if(!x)for(let F of q.getAll())F.pluginName===L&&M.push(F.type);if(!(f.req.query("force")==="1")&&!x&&M.length>0){let F="local";try{let B=t?.prepare?.('SELECT provider FROM "_globals_storage-settings" LIMIT 1')?.get();B?.provider&&(F=B.provider);}catch{try{let B=await t?.findOne?.({collection:"_globals_storage-settings",where:{},draft:!0});B?.provider&&(F=B.provider);}catch{}}if(M.includes(F))return f.json({error:`Cannot disable "${L}" \u2014 storage provider "${F}" is currently active. Switch to Local storage first.`,requiresAction:true,activeProvider:F},409)}try{let F={},B="global",V=await t.findOne({collection:"_globals_plugin-settings",where:{},draft:!0});V&&(F=V.states||{},B=V.id),F[L]=x,V?await t.update({collection:"_globals_plugin-settings",id:B,data:{states:F}}):await t.create({collection:"_globals_plugin-settings",data:{states:F,id:"global"}});}catch(F){console.warn(`[Plugins] Could not persist state for "${L}":`,F);}return q.setPluginEnabled(L,x),f.json({name:L,enabled:x})}),d.get("/api/health",f=>f.json({status:"ok",version:"0.13.0",collections:e.getCollectionSlugs(),timestamp:new Date().toISOString()})),d.get("/api/metrics",async f=>{let{user:k,tenantId:L}=await $(f.req.raw,E,n,c);if(!k)throw new I(401,"Authentication required");let q=k.role==="admin"||k.role==="super_admin",x=e.getCollectionSlugs().filter(G=>!["users","audit_logs","media","_globals_access-settings","_globals_brand-settings"].includes(G)&&!G.startsWith("_globals_")).filter(G=>q||chunkKOSR7235_cjs.a(k,`${G}:read`)),M=0,N={};await Promise.all(x.map(async G=>{try{let Je=(await t.find({collection:G,where:{},limit:1,page:1,tenantId:L})).totalDocs??0;M+=Je,N[G]=Je;}catch{}}));let F=0;try{F=(await t.find({collection:"media",where:{},limit:1,page:1,tenantId:L})).totalDocs??0;}catch{}let B=0;try{B=(await t.find({collection:"users",where:{},limit:1,page:1,tenantId:L})).totalDocs??0;}catch{}let V=0;try{if(o){let G=await o.getWebhooks();V=Array.isArray(G)?G.length:0;}}catch{}let X=0;try{X=(await t.find({collection:chunkDCFOVCJX_cjs.a,where:{},limit:1,page:1,tenantId:L})).totalDocs??0;}catch{}let pe=M+F+B;return f.json({totalDocuments:M,totalMedia:q||chunkKOSR7235_cjs.a(k,"media:read")?F:void 0,totalUsers:q||chunkKOSR7235_cjs.a(k,"users:read")?B:void 0,totalWebhooks:q?V:void 0,totalApiKeys:q?X:void 0,totalStoredRecords:pe,collectionCounts:N,collections:x.length,timestamp:new Date().toISOString()})}),Ke(d,i,E),He(d,i,E),ke(d,i,E),Pe(d,i,E),Xe(d,i),d.onError((f,k)=>{let L=Number(f?.statusCode||f?.status||500);return L>=500&&console.error(`[API Error] ${k.req.method} ${k.req.path}:`,f),k.json({error:f.message||"Internal server error",code:L>=500?"INTERNAL_ERROR":"BAD_REQUEST"},L)}),d}async function Tr(i,e,t){return Ht({registry:i,db:e,authSecret:t?.authSecret,user:t?.user,req:t?.req,tenantId:t?.tenantId,cors:t?.cors,webhookService:t?.webhookService})}
 exports.a=pr;exports.b=mr;exports.c=Pt;exports.d=ne;exports.e=Oe;exports.f=fe;exports.g=wt;exports.h=Cr;exports.i=bt;exports.j=he;exports.k=qt;exports.l=Te;exports.m=Ie;exports.n=Ht;exports.o=Tr;

package/dist/chunk-O6I26T6A.js

@@ -0,0 +1,3 @@
+import {a,c,b,d}from'./chunk-YNSKDTFG.js';import {a as a$1}from'./chunk-VLFM66BZ.js';import {a as a$3}from'./chunk-NGNXOXI5.js';import {a as a$2}from'./chunk-RLW6AQF2.js';import {randomBytes}from'crypto';if (typeof window === "undefined") { const { createRequire } = await import(/* @vite-ignore */ 'module'); createRequire(import.meta.url); }
+function D(){let h=globalThis;return h.__KYRO_MONGO_CLIENTS__||(h.__KYRO_MONGO_CLIENTS__=new Map),h.__KYRO_MONGO_CLIENTS__}var C=class h extends a{dialect="mongodb";client;db;database;connectionString;options;constructor(o){if(super(),this.options=o||{},o.connectionString){this.connectionString=o.connectionString;try{let t=new URL(o.connectionString);this.database=o.database||t.pathname.replace(/^\//,"")||"kyro_cms";}catch{this.database=o.database||"kyro_cms";}}else this.client=o.client,this.database=o.database||"kyro_cms";}getPoolOptions(){let o=process.env.MONGODB_MAX_POOL_SIZE?parseInt(process.env.MONGODB_MAX_POOL_SIZE,10):void 0,t=process.env.MONGODB_MIN_POOL_SIZE?parseInt(process.env.MONGODB_MIN_POOL_SIZE,10):void 0,n=process.env.MONGODB_MAX_IDLE_TIME_MS?parseInt(process.env.MONGODB_MAX_IDLE_TIME_MS,10):void 0;return {maxPoolSize:this.options.maxPoolSize??o??10,minPoolSize:this.options.minPoolSize??t??1,maxIdleTimeMS:this.options.maxIdleTimeMS??n??3e4,serverSelectionTimeoutMS:this.options.serverSelectionTimeoutMS??5e3,connectTimeoutMS:this.options.connectTimeoutMS??1e4,...this.options.socketTimeoutMS?{socketTimeoutMS:this.options.socketTimeoutMS}:{},...this.options.clientOptions||{}}}async connect(){if(this.connectionString&&!this.client){let o=this.connectionString,t=!this.options.disableGlobalClientCache,n=D();if(t&&n.has(o)){let i=n.get(o);if(this.client=i.client,i.connectPromise)try{await i.connectPromise;}catch(e){throw n.delete(o),e}}else {let i;try{let r=await import('mongodb');i=r.MongoClient??r.default?.MongoClient;}catch{a$1(["mongodb"]);let c=await import('mongodb');i=c.MongoClient??c.default?.MongoClient;}let e=this.getPoolOptions(),s=new i(this.connectionString,e),a=s.connect();t&&n.set(o,{client:s,connectPromise:a});try{await a,this.client=s;}catch(r){throw t&&n.delete(o),r}}}else if(this.client&&typeof this.client.connect=="function")try{await this.client.connect();}catch{}this.client&&(this.db=this.client.db(this.database),this.connected=true);}async disconnect(o){if(this.client){let t=this.connectionString,n=D(),i=!this.options.disableGlobalClientCache&&t&&n.has(t),e=process.env.NODE_ENV==="production",s=process.env.NODE_ENV==="test"||!!process.env.VITEST;if(o?.force||!i||e||s){try{await this.client.close();}catch{}t&&n.delete(t);}this.connected=false;}}static async getDb(o){let t=typeof o=="string"?{connectionString:o}:o||{},n=globalThis;if(n.__KYRO_INSTANCE__?.db?.dialect==="mongodb"&&n.__KYRO_INSTANCE__.db.db)return n.__KYRO_INSTANCE__.db.db;let i=t.connectionString||process.env.MONGODB_URI;if(!i)throw new Error("[Kyro CMS] MONGODB_URI is required to get Mongo database");let e=new h({...t,connectionString:i});return await e.connect(),e.db}static async getClient(o){let t=typeof o=="string"?{connectionString:o}:o||{},n=globalThis;if(n.__KYRO_INSTANCE__?.db?.dialect==="mongodb"&&n.__KYRO_INSTANCE__.db.client)return n.__KYRO_INSTANCE__.db.client;let i=t.connectionString||process.env.MONGODB_URI;if(!i)throw new Error("[Kyro CMS] MONGODB_URI is required to get MongoClient");let e=new h({...t,connectionString:i});return await e.connect(),e.client}getMongoCollection(o){if(!this.db&&this.client&&(this.db=this.client.db(this.database),this.connected=true),!this.db)throw new Error("MongoDB not connected");return this.db.collection(o)}async find(o){let{collection:t,where:n={},sort:i,limit:e=10,page:s=1,tenantId:a,select:r,draft:c$1}=o,d$1=this.getCollectionConfig(t),f=this.getMongoCollection(t),g={...n};this.tenantContext&&d$1.tenantScoped&&(g=c({where:g},t,this.tenantContext,b).where||{});let u=this.buildFilter(g,d$1.tenantScoped?a:void 0),l=d$1.fields.find(p=>p.name==="status"),_=l?.type==="select"&&Array.isArray(l.options)&&l.options.some(p=>p.value==="published");!c$1&&_&&(u.status="published");let y=this.parseSort(i),w={[y.field]:y.direction==="asc"?1:-1},R=(s-1)*e,[T,P]=await Promise.all([f.find(u).sort(w).skip(R).limit(e).project(this.buildProjection(r)).toArray(),f.countDocuments(u)]),b$1=T.map(p=>this.processResult(p,d$1));return this.tenantContext&&!this.tenantContext.isSuperAdmin&&(b$1=b$1.filter(p=>d(p,t,this.tenantContext,b))),c$1&&(b$1=await Promise.all(b$1.map(async p=>{let m=await this.getMongoCollection(`${t}_versions`).findOne({document_id:p.id},{sort:{createdAt:-1}});if(m){let x=typeof m.data=="string"?JSON.parse(m.data):m.data&&typeof m.data=="object"?m.data:{};return {...p,...x,status:p.status,_hasUnpublishedChanges:m.status==="draft"}}return p}))),{docs:b$1,...this.calculatePagination(s,e,P)}}buildIdFilter(o,t,n){let i=String(o||""),e=/^[0-9a-fA-F]{24}$/.test(i),s=[{_id:i},{id:i},{slug:i},{orderNumber:i}];if(e)try{let{ObjectId:r}=a$2("mongodb");s.unshift({_id:new r(i)});}catch{}let a={$or:s};return t&&n?.tenantScoped&&(a.tenantId=t),a}async findByID(o){let{collection:t,id:n,tenantId:i,draft:e}=o,s=this.getCollectionConfig(t),a=this.getMongoCollection(t);if(this.tenantContext&&s.tenantScoped){let u={_id:n,tenantId:this.tenantContext.tenantId};if(!d(u,t,this.tenantContext,b))return null}let r=this.buildIdFilter(n,i,s),c=s.fields.find(u=>u.name==="status"),d$1=c?.type==="select"&&Array.isArray(c.options)&&c.options.some(u=>u.value==="published");!e&&d$1&&(r.status="published");let f=await a.findOne(r);if(!f)return null;let g=this.processResult(f,s);if(e){let l=await this.getMongoCollection(`${t}_versions`).findOne({document_id:g.id},{sort:{createdAt:-1}});if(l){let _=typeof l.data=="string"?JSON.parse(l.data):l.data&&typeof l.data=="object"?l.data:{};g={...g,..._,status:g.status,_hasUnpublishedChanges:l.status==="draft"};}}return g}async create(o){let{collection:t,data:n,tenantId:i}=o,e=this.getCollectionConfig(t),s=this.getMongoCollection(t),a=this.prepareData(n,e),r=a.id||this.generateId();delete a.id;let c={...a,_id:r};return i&&e.tenantScoped&&(c.tenantId=i),await s.insertOne(c),this.processResult(c,e)}async update(o){let{collection:t,id:n,data:i,tenantId:e}=o,s=this.getCollectionConfig(t),a=this.getMongoCollection(t),r=this.buildIdFilter(n,e,s),c=this.prepareData(i,s),d=await a.findOneAndUpdate(r,{$set:c},{returnDocument:"after"});if(!d)throw new Error(`Document not found: ${t}/${n}`);return this.processResult(d,s)}async delete(o){let{collection:t,id:n,tenantId:i}=o,e=this.getCollectionConfig(t),s=this.getMongoCollection(t),a=this.buildIdFilter(n,i,e),r=await s.findOneAndDelete(a);if(!r)throw new Error(`Document not found: ${t}/${n}`);return this.processResult(r,e)}async count(o){let{collection:t,where:n={},tenantId:i}=o,e=this.getCollectionConfig(t),s=this.getMongoCollection(t),a=this.buildFilter(n,e.tenantScoped?i:void 0);return s.countDocuments(a)}async findOne(o){let{collection:t,where:n={},tenantId:i,draft:e}=o,s=this.getCollectionConfig(t),a=this.getMongoCollection(t),r=this.buildFilter(n,s.tenantScoped?i:void 0),c=s.fields.find(u=>u.name==="status"),d=c?.type==="select"&&Array.isArray(c.options)&&c.options.some(u=>u.value==="published");!e&&d&&(r.status="published");let f=await a.findOne(r);if(!f)return null;let g=this.processResult(f,s);if(e){let l=await this.getMongoCollection(`${t}_versions`).findOne({document_id:g.id},{sort:{createdAt:-1}});if(l){let _=typeof l.data=="string"?JSON.parse(l.data):l.data&&typeof l.data=="object"?l.data:{};g={...g,..._,status:g.status};}}return g}async findVersions(o){let{collection:t,documentId:n,sort:i,limit:e=10,page:s=1,tenantId:a}=o,r=this.getCollectionConfig(t),c=this.getMongoCollection(`${t}_versions`),d={document_id:n,autosave:{$ne:true}};a&&r.tenantScoped&&(d.tenant_id=a);let f=(s-1)*e,g=this.parseSort(i),u={[g.field]:g.direction==="asc"?1:-1},[l,_]=await Promise.all([c.find(d).sort(u).skip(f).limit(e).toArray(),c.countDocuments(d)]);return {docs:l.map(y=>this.processResult(y,{})),...this.calculatePagination(s,e,_)}}async findVersionByID(o){let{collection:t,versionId:n,tenantId:i}=o,e=this.getCollectionConfig(t),s=this.getMongoCollection(`${t}_versions`),a={_id:n};i&&e.tenantScoped&&(a.tenant_id=i);let r=await s.findOne(a);return r?this.processResult(r,{}):null}async createVersion(o){let{collection:t,documentId:n,data:i,status:e,createdBy:s,changeDescription:a,tenantId:r,autosave:c}=o,d=this.getCollectionConfig(t),f=this.getMongoCollection(`${t}_versions`);if(c){let l={document_id:n,collection_slug:t,autosave:true};r&&d.tenantScoped&&(l.tenant_id=r);let _=await f.findOne(l);if(_){let y=new Date().toISOString();return await f.updateOne({_id:_._id},{$set:{data:i,status:e,updatedAt:y}}),this.processResult({..._,data:i,status:e,updatedAt:y},{})}}let g=new Date().toISOString(),u={_id:this.generateId(),document_id:n,collection_slug:t,data:i,status:e,autosave:c===true,created_by:s,change_description:a,createdAt:g,updatedAt:g};if(r&&d.tenantScoped&&(u.tenant_id=r),await f.insertOne(u),!c){let l=this.getCollectionConfig(t);l.versions?.maxPerDoc&&await this.deleteVersions({collection:t,documentId:n,keepLatest:l.versions.maxPerDoc,tenantId:r});}return this.processResult(u,{})}async updateLatestVersion(o){return this.createVersion({...o,autosave:true})}async deleteVersions(o){let{collection:t,documentId:n,keepLatest:i,tenantId:e}=o,s=this.getCollectionConfig(t),a=this.getMongoCollection(`${t}_versions`);if(i){let r={document_id:n,autosave:{$ne:true}};e&&s.tenantScoped&&(r.tenant_id=e);let d=(await a.find(r).sort({createdAt:-1}).limit(i).project({_id:1}).toArray()).map(f=>f._id);d.length>0&&await a.deleteMany({document_id:n,autosave:{$ne:true},_id:{$nin:d},...e&&s.tenantScoped?{tenant_id:e}:{}});}else {let r={document_id:n};e&&s.tenantScoped&&(r.tenant_id=e),await a.deleteMany(r);}}async migrate(){for(let o of this.collections.values()){let t=this.getMongoCollection(o.slug);await t.createIndex({_id:1}),o.tenantScoped&&await t.createIndex({tenantId:1}),o.timestamps&&await t.createIndex({createdAt:-1});for(let n of o.fields)n.unique&&n.name&&await t.createIndex({[n.name]:1},{unique:true}),n.indexed&&n.name&&await t.createIndex({[n.name]:1});}}getCollectionConfig(o){if(o.startsWith("_globals_")){let n=o.replace("_globals_",""),i=this.globals.get(n);if(!i)throw new Error(`Global "${n}" not found`);return i}let t=this.collections.get(o);if(!t)throw new Error(`Collection "${o}" not found`);return t}buildFilter(o={},t){let n={};t&&(n.tenantId=t);for(let[i,e]of Object.entries(o))if(i==="AND"&&Array.isArray(e)){let s=e.map(a=>this.buildFilter(a));Object.assign(n,...s);}else if(i==="OR"&&Array.isArray(e))n.$or=e.map(s=>this.buildFilter(s));else if(typeof e=="object"&&e!==null&&!Array.isArray(e)){let s={};if(e.equals!==void 0){n[i==="id"?"_id":i]=e.equals;continue}e.not_equals!==void 0&&(s.$ne=e.not_equals),e.in!==void 0&&(s.$in=e.in),e.not_in!==void 0&&(s.$nin=e.not_in),e.greater_than!==void 0&&(s.$gt=e.greater_than),e.greater_than_equal!==void 0&&(s.$gte=e.greater_than_equal),e.less_than!==void 0&&(s.$lt=e.less_than),e.less_than_equal!==void 0&&(s.$lte=e.less_than_equal),e.like!==void 0&&(s.$regex=new RegExp(e.like.replace(/%/g,".*"),"i")),e.not_like!==void 0&&(s.$not=new RegExp(e.not_like.replace(/%/g,".*"),"i")),e.contains!==void 0&&(s.$regex=new RegExp(`.*${e.contains}.*`,"i")),e.exists!==void 0&&(s.$exists=e.exists),Object.keys(s).length>0&&(n[i==="id"?"_id":i]=s);}else n[i==="id"?"_id":i]=e;return n}buildProjection(o){if(!o||o.length===0)return;let t={_id:1};for(let n of o)t[n]=1;return t}processResult(o,t){if(!o)return null;let n={...o};for(let i of Object.keys(n))/^\d+$/.test(i)&&delete n[i];return o._id&&(n.id=String(o._id),delete n._id),delete n.__v,n.createdAt&&(n.createdAt=new Date(n.createdAt).toISOString()),n.updatedAt&&(n.updatedAt=new Date(n.updatedAt).toISOString()),a$3(n)}generateId(){let o=Date.now().toString(16).padStart(12,"0"),t=randomBytes(6).toString("hex");return o+t}};function F(h){return new C(h)}async function V(h){return C.getDb(h)}async function k(h){return C.getClient(h)}
+export{C as a,F as b,V as c,k as d};

package/dist/{chunk-VQWOCGJ2.cjs → chunk-PPGZHOYR.cjs}

@@ -1 +1 @@
-'use strict';var chunkTG5YQ4PB_cjs=require('./chunk-TG5YQ4PB.cjs'),chunkVPBGZW4P_cjs=require('./chunk-VPBGZW4P.cjs'),chunkHACW42ZZ_cjs=require('./chunk-HACW42ZZ.cjs'),chunkPW6Y5MQL_cjs=require('./chunk-PW6Y5MQL.cjs'),chunkGWUHIIPO_cjs=require('./chunk-GWUHIIPO.cjs'),chunk3A5UO6OQ_cjs=require('./chunk-3A5UO6OQ.cjs'),chunkNBBAMC2X_cjs=require('./chunk-NBBAMC2X.cjs'),m=require('kyro:config');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var m__default=/*#__PURE__*/_interopDefault(m);exports.a=null;var c=null;async function T(){if(!exports.a){if(globalThis.__KYRO_INSTANCE__)try{await globalThis.__KYRO_INSTANCE__.shutdown();}catch{}try{let e=m__default.default.default||m__default.default,t=e.adapter,r=t&&!t.dialect&&typeof t.connect=="function";if(globalThis.DB&&(!t||r)){let s=globalThis.DB;e.adapter=new chunkGWUHIIPO_cjs.c({type:"sqlite",client:s}),chunkTG5YQ4PB_cjs.J.info("Hot-swapped to D1 DrizzleAdapter");}exports.a=chunkTG5YQ4PB_cjs.G(e),await exports.a.init();let a=e.adapter,p=a&&a.dialect&&(a.dialect==="postgres"||a.dialect==="sqlite"),l=a&&a.dialect==="mongodb",o;if(p)a.dialect==="postgres"?o=new chunk3A5UO6OQ_cjs.a({db:a.client}):a.dialect==="sqlite"&&(o=new chunkHACW42ZZ_cjs.m({db:a.rawClient||a.client}));else if(r&&!globalThis.DB){let s=process.env.KYRO_AUTH_DB_PATH||"./data/auth.db";o=new chunkPW6Y5MQL_cjs.a({path:s});}else l&&(o=new chunkNBBAMC2X_cjs.a({adapter:a}));if(o?.connect)try{await o.connect();}catch(s){chunkTG5YQ4PB_cjs.J.warn("Auth connect warning:",s);}try{await exports.a.loadSettings();}catch(s){chunkTG5YQ4PB_cjs.J.warn("loadSettings warning:",s);}try{await chunkVPBGZW4P_cjs.e(o);}catch(s){chunkTG5YQ4PB_cjs.J.warn("autoBootstrap warning:",s);}globalThis.__KYRO_INSTANCE__=exports.a;}catch(e){throw exports.a=null,c=null,chunkTG5YQ4PB_cjs.J.error("Init failed, will retry:",e),e}}}async function b(e){let t=globalThis.DB?globalThis:null;try{let{env:r}=await import('cloudflare:workers');r&&(t=r);}catch{}if(e)try{t=e.locals?.cfContext?.env||e?.env||t;}catch{}if(!t)try{t=process.env;}catch{}t?.DB&&(globalThis.DB=t.DB),t?.STORAGE_BUCKET&&(globalThis.STORAGE_BUCKET=t.STORAGE_BUCKET),c||(c=T()),await c;}var w={graphqlEnabled:false,trpcEnabled:false,wsEnabled:false,requireAuth:false};function _(e){return exports.a?exports.a.settings?.access?.apiAccess?.[e]??w[e]??true:w[e]??true}var E=async e=>{if(!exports.a)try{await Promise.race([b(e),new Promise((t,r)=>setTimeout(()=>r(new Error("Initialization timeout")),3e4))]);}catch(t){return console.error("[Kyro API] Warm error:",t?.stack||t?.message||t),new Response(JSON.stringify({error:"Service Unavailable",message:"Kyro CMS is still starting up. Please try again in a moment."}),{status:503,headers:{"Content-Type":"application/json","Retry-After":"5"}})}try{let r=new URL(e.request.url).pathname,a=__KYRO_API_PATH__;if(r===`${a}/graphql`&&typeof exports.a.getGraphQL=="function"){if(!_("graphqlEnabled"))return new Response(JSON.stringify({error:"GraphQL is disabled"}),{status:503,headers:{"Content-Type":"application/json"}});let o=await exports.a.getGraphQL().fetch(e.request,e.locals);return new Response(o.body,o)}if(r.startsWith(`${a}/trpc/`)&&typeof exports.a.getTRPC=="function"){if(!_("trpcEnabled"))return new Response(JSON.stringify({error:"tRPC is disabled"}),{status:503,headers:{"Content-Type":"application/json"}});let o=await exports.a.getTRPC().fetch(e.request,e.locals);return new Response(o.body,o)}return await(await exports.a.getREST()).fetch(e.request,e.locals)}catch(t){let r=process.env.NODE_ENV==="production";return console.error("[Kyro API Execution Error]:",t?.stack||t?.message||t),new Response(JSON.stringify({error:"Internal Server Error",message:r?"An unexpected error occurred":t?.message||String(t),...r?{}:{stack:t?.stack}}),{status:500,headers:{"Content-Type":"application/json"}})}},N=E;exports.b=b;exports.c=E;exports.d=N;
+'use strict';var chunkMCK2QRAU_cjs=require('./chunk-MCK2QRAU.cjs'),chunkVPBGZW4P_cjs=require('./chunk-VPBGZW4P.cjs'),chunkO2SA56P2_cjs=require('./chunk-O2SA56P2.cjs'),chunkPW6Y5MQL_cjs=require('./chunk-PW6Y5MQL.cjs'),chunkGWUHIIPO_cjs=require('./chunk-GWUHIIPO.cjs'),chunk3A5UO6OQ_cjs=require('./chunk-3A5UO6OQ.cjs'),chunkUE7DTBD7_cjs=require('./chunk-UE7DTBD7.cjs'),m=require('kyro:config');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var m__default=/*#__PURE__*/_interopDefault(m);exports.a=null;var c=null;async function T(){if(!exports.a){if(globalThis.__KYRO_INSTANCE__)try{await globalThis.__KYRO_INSTANCE__.shutdown();}catch{}try{let e=m__default.default.default||m__default.default,t=e.adapter,r=t&&!t.dialect&&typeof t.connect=="function";if(globalThis.DB&&(!t||r)){let s=globalThis.DB;e.adapter=new chunkGWUHIIPO_cjs.c({type:"sqlite",client:s}),chunkMCK2QRAU_cjs.J.info("Hot-swapped to D1 DrizzleAdapter");}exports.a=chunkMCK2QRAU_cjs.G(e),await exports.a.init();let a=e.adapter,p=a&&a.dialect&&(a.dialect==="postgres"||a.dialect==="sqlite"),l=a&&a.dialect==="mongodb",o;if(p)a.dialect==="postgres"?o=new chunk3A5UO6OQ_cjs.a({db:a.client}):a.dialect==="sqlite"&&(o=new chunkO2SA56P2_cjs.m({db:a.rawClient||a.client}));else if(r&&!globalThis.DB){let s=process.env.KYRO_AUTH_DB_PATH||"./data/auth.db";o=new chunkPW6Y5MQL_cjs.a({path:s});}else l&&(o=new chunkUE7DTBD7_cjs.a({adapter:a}));if(o?.connect)try{await o.connect();}catch(s){chunkMCK2QRAU_cjs.J.warn("Auth connect warning:",s);}try{await exports.a.loadSettings();}catch(s){chunkMCK2QRAU_cjs.J.warn("loadSettings warning:",s);}try{await chunkVPBGZW4P_cjs.e(o);}catch(s){chunkMCK2QRAU_cjs.J.warn("autoBootstrap warning:",s);}globalThis.__KYRO_INSTANCE__=exports.a;}catch(e){throw exports.a=null,c=null,chunkMCK2QRAU_cjs.J.error("Init failed, will retry:",e),e}}}async function b(e){let t=globalThis.DB?globalThis:null;try{let{env:r}=await import('cloudflare:workers');r&&(t=r);}catch{}if(e)try{t=e.locals?.cfContext?.env||e?.env||t;}catch{}if(!t)try{t=process.env;}catch{}t?.DB&&(globalThis.DB=t.DB),t?.STORAGE_BUCKET&&(globalThis.STORAGE_BUCKET=t.STORAGE_BUCKET),c||(c=T()),await c;}var w={graphqlEnabled:false,trpcEnabled:false,wsEnabled:false,requireAuth:false};function _(e){return exports.a?exports.a.settings?.access?.apiAccess?.[e]??w[e]??true:w[e]??true}var E=async e=>{if(!exports.a)try{await Promise.race([b(e),new Promise((t,r)=>setTimeout(()=>r(new Error("Initialization timeout")),3e4))]);}catch(t){return console.error("[Kyro API] Warm error:",t?.stack||t?.message||t),new Response(JSON.stringify({error:"Service Unavailable",message:"Kyro CMS is still starting up. Please try again in a moment."}),{status:503,headers:{"Content-Type":"application/json","Retry-After":"5"}})}try{let r=new URL(e.request.url).pathname,a=__KYRO_API_PATH__;if(r===`${a}/graphql`&&typeof exports.a.getGraphQL=="function"){if(!_("graphqlEnabled"))return new Response(JSON.stringify({error:"GraphQL is disabled"}),{status:503,headers:{"Content-Type":"application/json"}});let o=await exports.a.getGraphQL().fetch(e.request,e.locals);return new Response(o.body,o)}if(r.startsWith(`${a}/trpc/`)&&typeof exports.a.getTRPC=="function"){if(!_("trpcEnabled"))return new Response(JSON.stringify({error:"tRPC is disabled"}),{status:503,headers:{"Content-Type":"application/json"}});let o=await exports.a.getTRPC().fetch(e.request,e.locals);return new Response(o.body,o)}return await(await exports.a.getREST()).fetch(e.request,e.locals)}catch(t){let r=process.env.NODE_ENV==="production";return console.error("[Kyro API Execution Error]:",t?.stack||t?.message||t),new Response(JSON.stringify({error:"Internal Server Error",message:r?"An unexpected error occurred":t?.message||String(t),...r?{}:{stack:t?.stack}}),{status:500,headers:{"Content-Type":"application/json"}})}},N=E;exports.b=b;exports.c=E;exports.d=N;