@kyro-cms/core 0.9.6 → 0.9.8

package/dist/{chunk-FKKQUMXR.cjs → chunk-KGJRJ7CU.cjs}

@@ -275,5 +275,5 @@ exports.generateApiKeyPrefix = generateApiKeyPrefix;
 exports.getWhereClause = getWhereClause;
 exports.mergeWhereClauses = mergeWhereClauses;
 exports.validateApiKey = validateApiKey;
-//# sourceMappingURL=chunk-FKKQUMXR.cjs.map
-//# sourceMappingURL=chunk-FKKQUMXR.cjs.map
+//# sourceMappingURL=chunk-KGJRJ7CU.cjs.map
+//# sourceMappingURL=chunk-KGJRJ7CU.cjs.map

package/dist/chunk-KGJRJ7CU.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access/types.ts","../src/auth/api-key.ts","../src/access/checker.ts"],"names":["timingSafeEqual","hasPermission"],"mappings":";;;;;;AA+CA,eAAsB,cAAA,CACpB,QACA,IAAA,EACgC;AAChC,EAAA,IAAI,OAAO,WAAW,SAAA,EAAW;AAC/B,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,WAAW,UAAA,EAAY;AAChC,IAAA,OAAO,MAAM,OAAO,IAAI,CAAA;AAAA,EAC1B;AACA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,qBACX,YAAA,EACU;AACb,EAAA,MAAM,SAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,UAAU,YAAA,EAAc;AACjC,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACxC,MAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,IAC9B;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,cAAA,CACd,QACA,IAAA,EACkC;AAClC,EAAA,OAAO,cAAA,CAAe,MAAA,EAAQ,IAAI,CAAA,CAAE,KAAK,CAAA,MAAA,KAAU;AACjD,IAAA,IAAI,MAAA,KAAW,MAAM,OAAO,MAAA;AAC5B,IAAA,IAAI,MAAA,KAAW,OAAO,OAAO,EAAE,KAAK,EAAE,GAAA,EAAK,MAAK,EAAE;AAClD,IAAA,OAAO,MAAA;AAAA,EACT,CAAC,CAAA;AACH;AC7CO,IAAM,kBAAA,GAAqB;AAElC,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAO,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AAC3B;AAEA,SAAS,mBAAA,CAAoB,GAAW,CAAA,EAAoB;AAC1D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAOA,sBAAA,CAAgB,OAAO,IAAA,CAAK,CAAC,GAAG,MAAA,CAAO,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,eAAsB,cAAA,CACpB,MAAA,EACA,EAAA,EACA,UAAA,EACiC;AACjC,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,EACtD;AAEA,EAAA,IAAI,CAAC,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,wBAAA,EAAyB;AAAA,EACzD;AAEA,EAAA,MAAM,SAAA,GAAY,kBAAkB,MAAM,CAAA;AAE1C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,IAAA,CAAK;AAAA,MAC3B,UAAA,EAAY,kBAAA;AAAA,MACZ,OAAO,EAAE,SAAA,EAAW,EAAE,MAAA,EAAQ,WAAU,EAAE;AAAA,MAC1C,KAAA,EAAO,GAAA;AAAA,MACP,IAAA,EAAM;AAAA,KACP,CAAA;AAED,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA,EAAG;AAC5C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,iBAAA,EAAkB;AAAA,IAClD;AAEA,IAAA,IAAI,UAAA,GAAkC,IAAA;AACtC,IAAA,KAAA,MAAW,GAAA,IAAO,OAAO,IAAA,EAAM;AAC7B,MAAA,MAAM,MAAA,GAAS,GAAA;AACf,MAAA,IAAI,mBAAA,CAAoB,MAAA,CAAO,GAAA,EAAK,MAAM,CAAA,EAAG;AAC3C,QAAA,UAAA,GAAa,MAAA;AACb,QAAA;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,iBAAA,EAAkB;AAAA,IAClD;AAEA,IAAA,IAAI,WAAW,SAAA,EAAW;AACxB,MAAA,MAAM,SAAA,GAAY,IAAI,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA;AAC/C,MAAA,IAAI,SAAA,mBAAY,IAAI,IAAA,EAAK,EAAG;AAC1B,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,MACtD;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,GAAG,MAAA,CAAO;AAAA,QACd,UAAA,EAAY,kBAAA;AAAA,QACZ,IAAI,UAAA,CAAW,EAAA;AAAA,QACf,MAAM,EAAE,UAAA,EAAA,qBAAgB,IAAA,EAAK,EAAE,aAAY;AAAE,OAC9C,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,MAAM,IAAA,GAA0B;AAAA,MAC9B,IAAI,UAAA,CAAW,MAAA;AAAA,MACf,IAAA,EAAO,WAAmB,IAAA,IAAQ,QAAA;AAAA,MAClC,UAAW,UAAA,CAAmB;AAAA,KAChC;AAEA,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,UAAA,CAAW,MAAM,CAAA;AACjD,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAA,CAAO,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,MAC5B;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,IAAA;AAAA,MACP,QAAQ,UAAA,CAAW,MAAA;AAAA,MACnB,IAAA;AAAA,MACA,WAAA,EAAa,UAAA,CAAW,WAAA,IAAe,EAAC;AAAA,MACxC,UAAU,UAAA,CAAW,EAAA;AAAA,MACrB,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,MAAM,IAAA,CAAK;AAAA,KACb;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,4BAAA,EAA6B;AAAA,EAC7D;AACF;AAEO,SAAS,yBAAyB,OAAA,EAAiC;AACxE,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACtD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAI,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpC,MAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,EAAK;AAAA,IAClC;AACA,IAAA,IAAI,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AAC/C,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,OAAO,QAAQ,IAAA,EAAK;AAAA,EACtB;AAEA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,oBACd,MAAA,EACsB;AACtB,EAAA,IAAI,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,OAAO,MAAA,EAAQ;AACnC,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,IAAA,EAAM,MAAA,CAAO,IAAA,IAAQ,EAAC;AAAA,IACtB,WAAA,EAAa,MAAA,CAAO,WAAA,IAAe,EAAC;AAAA,IACpC,QAAA,EAAU,OAAO,QAAA,IAAY,EAAA;AAAA,IAC7B,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,MAAM,MAAA,CAAO;AAAA,GACf;AACF;AAEO,SAAS,mBAAA,CACd,aACA,QAAA,EACS;AACT,EAAA,IAAI,WAAA,CAAY,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AACrC,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,GAAG,CAAA,EAAG,OAAO,IAAA;AACtC,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,IAAA;AAE3C,EAAA,MAAM,CAAC,QAAA,EAAU,MAAM,CAAA,GAAI,QAAA,CAAS,MAAM,GAAG,CAAA;AAC7C,EAAA,IAAI,YAAY,QAAA,CAAS,CAAA,EAAG,QAAQ,CAAA,EAAA,CAAI,GAAG,OAAO,IAAA;AAElD,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,cAAA,GAAyB;AACvC,EAAA,MAAM,KAAA,GAAQ,sCAAA;AACd,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,IAAA,MAAA,IAAU,KAAA,CAAM,KAAK,KAAA,CAAM,IAAA,CAAK,QAAO,GAAI,KAAA,CAAM,MAAM,CAAC,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,QAAQ,MAAM,CAAA,CAAA;AACvB;AAEO,SAAS,qBAAqB,GAAA,EAAqB;AACxD,EAAA,OAAO,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AAC3B;;;AC9KA,SAAS,mBACP,SAAA,EACQ;AACR,EAAA,IAAI,SAAA,KAAc,QAAQ,OAAO,MAAA;AACjC,EAAA,IAAI,SAAA,KAAc,UAAU,OAAO,QAAA;AACnC,EAAA,IAAI,SAAA,KAAc,UAAU,OAAO,QAAA;AACnC,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,gBAAA,CACP,WACA,aAAA,EACS;AACT,EAAA,MAAM,MAAA,GAAkC;AAAA,IACtC,IAAA,EAAM,KAAA;AAAA,IACN,MAAM,SAAA,KAAc,MAAA;AAAA,IACpB,MAAA,EAAQ,SAAA,KAAc,MAAA,IAAU,SAAA,KAAc,QAAA;AAAA,IAC9C,MAAA,EAAQ,SAAA,KAAc,MAAA,IAAU,SAAA,KAAc,YAAY,SAAA,KAAc,QAAA;AAAA,IACxE,QAAQ,SAAA,KAAc,MAAA,IAAU,cAAc,QAAA,IAAY,SAAA,KAAc,YAAY,SAAA,KAAc,QAAA;AAAA,IAClG,KAAA,EAAO;AAAA,GACT;AACA,EAAA,OAAO,MAAA,CAAO,aAAa,CAAA,IAAK,KAAA;AAClC;AAEA,eAAsB,sBACpB,MAAA,EACA,SAAA,EACA,OAAA,EACA,OAAA,GAAyB,EAAC,EACE;AAC5B,EAAA,MAAM,EAAE,IAAA,EAAM,GAAA,EAAK,QAAA,EAAU,QAAO,GAAI,OAAA;AACxC,EAAA,MAAM,EAAE,kBAAA,GAAqB,IAAA,EAAM,aAAA,GAAgB,QAAO,GAAI,OAAA;AAC9D,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,MAAA,GAAS,SAAS,CAAA;AAG5C,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,OAAA,GAAU,MAAM,cAAA,CAAe,UAAA,EAAY;AAAA,MAC/C,GAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,IAAI,YAAY,KAAA,EAAO;AACrB,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,eAAA,EAAiB,QAAQ,GAAA,EAAI;AAAA,IAC/D;AACA,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,UAAA,EAAY,OAAA,EAAuB;AAAA,IAC7D;AACA,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AAGA,EAAA,IAAI,MAAA,EAAQ,WAAA,EAAa,MAAA,GAAS,CAAA,EAAG;AACnC,IAAA,MAAM,WAAW,MAAA,CAAO,IAAA;AACxB,IAAA,MAAM,MAAA,GAAS,mBAAmB,SAAS,CAAA;AAC3C,IAAA,MAAM,UAAA,GAAa,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AACxC,IAAA,IACE,CAAC,mBAAA,CAAoB,MAAA,CAAO,WAAA,EAAa,UAAU,CAAA,IACnD,CAAC,mBAAA,CAAoB,MAAA,CAAO,WAAA,EAAa,CAAA,EAAG,QAAQ,QAAQ,CAAA,EAC5D;AACA,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,yCAAA,EAA2C,QAAQ,GAAA,EAAI;AAAA,IACzF;AACA,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AAGA,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,WAAW,MAAA,CAAO,IAAA;AACxB,IAAA,MAAM,MAAA,GAAS,mBAAmB,SAAS,CAAA;AAC3C,IAAA,MAAM,UAAA,GAAa,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AAExC,IAAA,MAAM,OAAA,GAAUC,+BAAA;AAAA,MACd,EAAE,IAAI,IAAA,CAAK,EAAA,EAAI,OAAO,IAAA,CAAK,KAAA,EAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK;AAAA,MAClD;AAAA,KACF;AACA,IAAA,MAAM,QAAA,GAAWA,+BAAA;AAAA,MACf,EAAE,IAAI,IAAA,CAAK,EAAA,EAAI,OAAO,IAAA,CAAK,KAAA,EAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK;AAAA,MAClD,GAAG,QAAQ,CAAA,MAAA;AAAA,KACb;AAEA,IAAA,IAAI,WAAW,QAAA,EAAU;AACvB,MAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,IACzB;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,wCAAA,EAA0C,QAAQ,GAAA,EAAI;AAAA,EACxF;AAGA,EAAA,MAAM,cAAA,GAAiB,gBAAA,CAAiB,SAAA,EAAW,aAAa,CAAA;AAChE,EAAA,IAAI,sBAAsB,cAAA,EAAgB;AACxC,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,yBAAA,EAA2B,QAAQ,GAAA,EAAI;AACzE;AAEA,eAAsB,kBACpB,MAAA,EACA,SAAA,EACA,OAAA,EACA,OAAA,GAAyB,EAAC,EACE;AAC5B,EAAA,MAAM,EAAE,IAAA,EAAM,GAAA,EAAK,QAAA,EAAS,GAAI,OAAA;AAChC,EAAA,MAAM,EAAE,kBAAA,GAAqB,IAAA,EAAK,GAAI,OAAA;AACtC,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,MAAA,GAAS,SAAS,CAAA;AAG5C,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,OAAA,GAAU,MAAM,cAAA,CAAe,UAAA,EAAY;AAAA,MAC/C,GAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,IAAI,YAAY,KAAA,EAAO;AACrB,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,eAAA,EAAiB,QAAQ,GAAA,EAAI;AAAA,IAC/D;AACA,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AAGA,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,UAAA,GAAa,WAAW,SAAS,CAAA,CAAA;AACvC,IAAA,MAAM,OAAA,GAAUA,+BAAA;AAAA,MACd,EAAE,IAAI,IAAA,CAAK,EAAA,EAAI,OAAO,IAAA,CAAK,KAAA,EAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK;AAAA,MAClD;AAAA,KACF;AACA,IAAA,MAAM,QAAA,GAAWA,+BAAA;AAAA,MACf,EAAE,IAAI,IAAA,CAAK,EAAA,EAAI,OAAO,IAAA,CAAK,KAAA,EAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK;AAAA,MAClD;AAAA,KACF;AACA,IAAA,IAAI,WAAW,QAAA,EAAU;AACvB,MAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,IACzB;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,wCAAA,EAA0C,QAAQ,GAAA,EAAI;AAAA,EACxF;AAGA,EAAA,IAAI,kBAAA,EAAoB;AACtB,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,yBAAA,EAA2B,QAAQ,GAAA,EAAI;AACzE","file":"chunk-KGJRJ7CU.cjs","sourcesContent":["import type { User, Request } from '../hooks/types.js';\n\n// ============================================================================\n// Access Control Types\n// ============================================================================\n\nexport interface WhereClause {\n  [field: string]: any;\n}\n\nexport interface AccessArgs {\n  req: Request;\n  user?: User;\n  data?: unknown;\n  doc?: unknown;\n  id?: string;\n  tenantID?: string;\n  context?: Record<string, unknown>;\n}\n\nexport type AccessControl = boolean | ((args: AccessArgs) => Promise<boolean | WhereClause> | boolean | WhereClause);\n\nexport interface CollectionAccess {\n  create?: AccessControl;\n  read?: AccessControl;\n  update?: AccessControl;\n  delete?: AccessControl;\n  admin?: AccessControl;\n  unlock?: AccessControl;\n  readVersions?: AccessControl;\n}\n\nexport interface GlobalAccess {\n  read?: AccessControl;\n  update?: AccessControl;\n}\n\nexport interface FieldAccess {\n  create?: AccessControl;\n  read?: AccessControl;\n  update?: AccessControl;\n}\n\n// ============================================================================\n// Access Control Evaluation\n// ============================================================================\n\nexport async function evaluateAccess(\n  access: AccessControl,\n  args: AccessArgs\n): Promise<boolean | WhereClause> {\n  if (typeof access === 'boolean') {\n    return access;\n  }\n  if (typeof access === 'function') {\n    return await access(args);\n  }\n  return true;\n}\n\nexport function mergeWhereClauses(\n  ...whereClauses: (WhereClause | boolean | undefined)[]\n): WhereClause {\n  const result: WhereClause = {};\n  for (const clause of whereClauses) {\n    if (clause && typeof clause === 'object') {\n      Object.assign(result, clause);\n    }\n  }\n  return result;\n}\n\nexport function getWhereClause(\n  access: AccessControl,\n  args: AccessArgs\n): Promise<WhereClause | undefined> {\n  return evaluateAccess(access, args).then(result => {\n    if (result === true) return undefined;\n    if (result === false) return { _id: { $eq: null } };\n    return result;\n  });\n}\n","import { timingSafeEqual } from \"crypto\";\nimport type { BaseAdapter } from \"../registry/types.js\";\nimport type { AuthUser, UserRole } from \"./types.js\";\n\nexport interface ApiKeyRecord {\n  id: string;\n  userId: string;\n  name: string;\n  key: string;\n  keyPrefix: string;\n  permissions: string[];\n  lastUsedAt?: string;\n  expiresAt?: string;\n  createdAt: string;\n}\n\nexport interface ApiKeyValidationResult {\n  valid: boolean;\n  userId?: string;\n  user?: Partial<AuthUser>;\n  permissions?: string[];\n  apiKeyId?: string;\n  error?: string;\n  tenantId?: string;\n  role?: UserRole;\n}\n\nexport interface ApiKeyContext {\n  userId: string;\n  user: Partial<AuthUser>;\n  permissions: string[];\n  apiKeyId: string;\n  tenantId?: string;\n  role?: UserRole;\n}\n\nexport const API_KEY_COLLECTION = \"_api_keys\";\n\nfunction generateKeyPrefix(key: string): string {\n  return key.substring(0, 8);\n}\n\nfunction constantTimeCompare(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  try {\n    return timingSafeEqual(Buffer.from(a), Buffer.from(b));\n  } catch {\n    return false;\n  }\n}\n\nexport async function validateApiKey(\n  rawKey: string,\n  db: BaseAdapter,\n  userLookup?: (userId: string) => Promise<Partial<AuthUser> | null>,\n): Promise<ApiKeyValidationResult> {\n  if (!rawKey || typeof rawKey !== \"string\") {\n    return { valid: false, error: \"No API key provided\" };\n  }\n\n  if (!rawKey.startsWith(\"kyro_\")) {\n    return { valid: false, error: \"Invalid API key format\" };\n  }\n\n  const keyPrefix = generateKeyPrefix(rawKey);\n\n  try {\n    const result = await db.find({\n      collection: API_KEY_COLLECTION,\n      where: { keyPrefix: { equals: keyPrefix } },\n      limit: 100,\n      page: 1,\n    });\n\n    if (!result.docs || result.docs.length === 0) {\n      return { valid: false, error: \"Invalid API key\" };\n    }\n\n    let matchedKey: ApiKeyRecord | null = null;\n    for (const doc of result.docs) {\n      const record = doc as unknown as ApiKeyRecord;\n      if (constantTimeCompare(record.key, rawKey)) {\n        matchedKey = record;\n        break;\n      }\n    }\n\n    if (!matchedKey) {\n      return { valid: false, error: \"Invalid API key\" };\n    }\n\n    if (matchedKey.expiresAt) {\n      const expiresAt = new Date(matchedKey.expiresAt);\n      if (expiresAt < new Date()) {\n        return { valid: false, error: \"API key has expired\" };\n      }\n    }\n\n    try {\n      await db.update({\n        collection: API_KEY_COLLECTION,\n        id: matchedKey.id,\n        data: { lastUsedAt: new Date().toISOString() },\n      });\n    } catch {\n      // Non-critical: don't fail if lastUsedAt update fails\n    }\n\n    const user: Partial<AuthUser> = {\n      id: matchedKey.userId,\n      role: (matchedKey as any).role || \"author\",\n      tenantId: (matchedKey as any).tenantId,\n    };\n\n    if (userLookup) {\n      const dbUser = await userLookup(matchedKey.userId);\n      if (dbUser) {\n        Object.assign(user, dbUser);\n      }\n    }\n\n    return {\n      valid: true,\n      userId: matchedKey.userId,\n      user,\n      permissions: matchedKey.permissions || [],\n      apiKeyId: matchedKey.id,\n      tenantId: user.tenantId,\n      role: user.role,\n    };\n  } catch (error) {\n    console.error(\"[ApiKey] Validation error:\", error);\n    return { valid: false, error: \"Failed to validate API key\" };\n  }\n}\n\nexport function extractApiKeyFromRequest(request: Request): string | null {\n  const authHeader = request.headers.get(\"Authorization\");\n  if (authHeader) {\n    if (authHeader.startsWith(\"ApiKey \")) {\n      return authHeader.slice(7).trim();\n    }\n    if (authHeader.startsWith(\"Bearer \")) {\n      return null;\n    }\n  }\n\n  const xApiKey = request.headers.get(\"X-API-Key\");\n  if (xApiKey) {\n    return xApiKey.trim();\n  }\n\n  return null;\n}\n\nexport function createApiKeyContext(\n  result: ApiKeyValidationResult,\n): ApiKeyContext | null {\n  if (!result.valid || !result.userId) {\n    return null;\n  }\n  return {\n    userId: result.userId,\n    user: result.user || {},\n    permissions: result.permissions || [],\n    apiKeyId: result.apiKeyId || \"\",\n    tenantId: result.tenantId,\n    role: result.role,\n  };\n}\n\nexport function hasApiKeyPermission(\n  permissions: string[],\n  required: string,\n): boolean {\n  if (permissions.length === 0) return false;\n  if (permissions.includes(\"*\")) return true;\n  if (permissions.includes(required)) return true;\n\n  const [resource, action] = required.split(\":\");\n  if (permissions.includes(`${resource}:*`)) return true;\n\n  return false;\n}\n\nexport function generateApiKey(): string {\n  const chars = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n  let suffix = \"\";\n  for (let i = 0; i < 32; i++) {\n    suffix += chars[Math.floor(Math.random() * chars.length)];\n  }\n  return `kyro_${suffix}`;\n}\n\nexport function generateApiKeyPrefix(key: string): string {\n  return key.substring(0, 8);\n}\n","import type { User, Request } from '../hooks/types.js';\nimport { evaluateAccess, type WhereClause } from './types.js';\nimport { hasPermission } from '../auth/rbac/checker.js';\nimport { hasApiKeyPermission } from '../auth/api-key.js';\n\nexport interface AccessCheckResult {\n  allowed: boolean;\n  extraWhere?: WhereClause;\n  error?: string;\n  status?: number;\n}\n\nexport interface AccessContext {\n  user?: User;\n  req?: Request;\n  tenantID?: string;\n  apiKey?: any;\n}\n\nexport interface AccessOptions {\n  enablePublicAccess?: boolean;\n  defaultAccess?: string;\n}\n\nfunction actionToPermission(\n  operation: \"read\" | \"create\" | \"update\" | \"delete\",\n): string {\n  if (operation === \"read\") return \"read\";\n  if (operation === \"create\") return \"create\";\n  if (operation === \"update\") return \"update\";\n  return \"delete\";\n}\n\nfunction isDefaultAllowed(\n  operation: \"read\" | \"create\" | \"update\" | \"delete\",\n  defaultAccess: string,\n): boolean {\n  const levels: Record<string, boolean> = {\n    none: false,\n    read: operation === \"read\",\n    create: operation === \"read\" || operation === \"create\",\n    update: operation === \"read\" || operation === \"create\" || operation === \"update\",\n    delete: operation === \"read\" || operation === \"create\" || operation === \"update\" || operation === \"delete\",\n    admin: true,\n  };\n  return levels[defaultAccess] || false;\n}\n\nexport async function checkCollectionAccess(\n  config: { access?: any; slug: string },\n  operation: \"read\" | \"create\" | \"update\" | \"delete\",\n  context: AccessContext,\n  options: AccessOptions = {},\n): Promise<AccessCheckResult> {\n  const { user, req, tenantID, apiKey } = context;\n  const { enablePublicAccess = true, defaultAccess = \"none\" } = options;\n  const accessRule = config.access?.[operation];\n\n  // Custom access function (highest priority)\n  if (accessRule) {\n    const allowed = await evaluateAccess(accessRule, {\n      req: req!,\n      user,\n      tenantID,\n    });\n    if (allowed === false) {\n      return { allowed: false, error: \"Access denied\", status: 403 };\n    }\n    if (typeof allowed === \"object\") {\n      return { allowed: true, extraWhere: allowed as WhereClause };\n    }\n    return { allowed: true };\n  }\n\n  // API key permission check\n  if (apiKey?.permissions?.length > 0) {\n    const resource = config.slug;\n    const action = actionToPermission(operation);\n    const permission = `${resource}:${action}`;\n    if (\n      !hasApiKeyPermission(apiKey.permissions, permission) &&\n      !hasApiKeyPermission(apiKey.permissions, `${resource}:admin`)\n    ) {\n      return { allowed: false, error: \"Access denied: insufficient permissions\", status: 403 };\n    }\n    return { allowed: true };\n  }\n\n  // No accessRule, no apiKey — authenticated user RBAC\n  if (user) {\n    const resource = config.slug;\n    const action = actionToPermission(operation);\n    const permission = `${resource}:${action}`;\n\n    const userHas = hasPermission(\n      { id: user.id, email: user.email, role: user.role } as any,\n      permission,\n    );\n    const adminHas = hasPermission(\n      { id: user.id, email: user.email, role: user.role } as any,\n      `${resource}:admin`,\n    );\n\n    if (userHas || adminHas) {\n      return { allowed: true };\n    }\n    return { allowed: false, error: \"Access denied: missing RBAC permission\", status: 403 };\n  }\n\n  // Unauthenticated — check public access\n  const defaultAllowed = isDefaultAllowed(operation, defaultAccess);\n  if (enablePublicAccess && defaultAllowed) {\n    return { allowed: true };\n  }\n\n  return { allowed: false, error: \"Authentication required\", status: 401 };\n}\n\nexport async function checkGlobalAccess(\n  config: { access?: any; slug: string },\n  operation: \"read\" | \"update\",\n  context: AccessContext,\n  options: AccessOptions = {},\n): Promise<AccessCheckResult> {\n  const { user, req, tenantID } = context;\n  const { enablePublicAccess = true } = options;\n  const accessRule = config.access?.[operation];\n\n  // Custom access function\n  if (accessRule) {\n    const allowed = await evaluateAccess(accessRule, {\n      req: req!,\n      user,\n      tenantID,\n    });\n    if (allowed === false) {\n      return { allowed: false, error: \"Access denied\", status: 403 };\n    }\n    return { allowed: true };\n  }\n\n  // Authenticated user RBAC\n  if (user) {\n    const permission = `globals:${operation}`;\n    const userHas = hasPermission(\n      { id: user.id, email: user.email, role: user.role } as any,\n      permission,\n    );\n    const adminHas = hasPermission(\n      { id: user.id, email: user.email, role: user.role } as any,\n      \"globals:admin\",\n    );\n    if (userHas || adminHas) {\n      return { allowed: true };\n    }\n    return { allowed: false, error: \"Access denied: missing RBAC permission\", status: 403 };\n  }\n\n  // Unauthenticated\n  if (enablePublicAccess) {\n    return { allowed: true };\n  }\n\n  return { allowed: false, error: \"Authentication required\", status: 401 };\n}\n"]}

package/dist/{chunk-FSKONGCX.cjs → chunk-OJ2AM75W.cjs}

@@ -249,5 +249,5 @@ exports.isUploadField = isUploadField;
 exports.normalizeRichTextValue = normalizeRichTextValue;
 exports.renderRichText = renderRichText;
 exports.richTextStyles = richTextStyles;
-//# sourceMappingURL=chunk-FSKONGCX.cjs.map
-//# sourceMappingURL=chunk-FSKONGCX.cjs.map
+//# sourceMappingURL=chunk-OJ2AM75W.cjs.map
+//# sourceMappingURL=chunk-OJ2AM75W.cjs.map

package/dist/chunk-OJ2AM75W.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/fields/types.ts","../src/fields/richtext.ts"],"names":["StarterKit","Link","Image","TextAlign","Underline","Highlight","TaskList","TaskItem","TextStyle","Color","html","generateHTML"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAoVO,SAAS,YAAY,KAAA,EAAkC;AAC5D,EAAA,OAAO,MAAM,IAAA,KAAS,MAAA;AACxB;AAEO,SAAS,cAAc,KAAA,EAAoC;AAChE,EAAA,OAAO,MAAM,IAAA,KAAS,QAAA;AACxB;AAEO,SAAS,oBAAoB,KAAA,EAA0C;AAC5E,EAAA,OAAO,MAAM,IAAA,KAAS,cAAA;AACxB;AAEO,SAAS,aAAa,KAAA,EAAmC;AAC9D,EAAA,OAAO,MAAM,IAAA,KAAS,OAAA;AACxB;AAEO,SAAS,aAAa,KAAA,EAAmC;AAC9D,EAAA,OAAO,MAAM,IAAA,KAAS,OAAA;AACxB;AAEO,SAAS,cAAc,KAAA,EAAoC;AAChE,EAAA,OAAO,MAAM,IAAA,KAAS,QAAA;AACxB;AAEO,SAAS,cAAc,KAAA,EAAoC;AAChE,EAAA,OAAO,MAAM,IAAA,KAAS,QAAA;AACxB;AAEO,SAAS,aAAa,KAAA,EAAmC;AAC9D,EAAA,OAAO,MAAM,IAAA,KAAS,OAAA;AACxB;AAEO,SAAS,gBAAgB,KAAA,EAAsC;AACpE,EAAA,OAAO,MAAM,IAAA,KAAS,UAAA;AACxB;AAEO,SAAS,cAAc,KAAA,EAAoC;AAChE,EAAA,OAAO,MAAM,IAAA,KAAS,QAAA;AACxB;AAEO,SAAS,cACd,KAAA,EACkD;AAClD,EAAA,OACE,MAAM,IAAA,KAAS,KAAA,IACf,MAAM,IAAA,KAAS,aAAA,IACf,MAAM,IAAA,KAAS,MAAA;AAEnB;AAMO,IAAM,qBAAA,GAAwB;AAAA,EACnC,MAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF;AAEO,IAAM,mBAAA,GAAsB;AAAA,EACjC,UAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF;AAEO,IAAM,sBAAA,GAAyB;AAAA,EACpC,cAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF;AAEO,IAAM,kBAAA,GAAqB,CAAC,KAAA,EAAO,aAAA,EAAe,MAAM;AAExD,IAAM,eAAA,GAAkB;AAAA,EAC7B,GAAG,qBAAA;AAAA,EACH,GAAG,mBAAA;AAAA,EACH,GAAG,sBAAA;AAAA,EACH,GAAG;AACL;AAMO,SAAS,6BAAA,CACd,IAAA,EACA,UAAA,EACA,OAAA,EACmB;AACnB,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,IAAA,EAAM,cAAA;AAAA,IACN,UAAA;AAAA,IACA,GAAG,OAAA;AAAA,IACH,QAAA,EAAU,SAAS,QAAA,IAAY;AAAA,GACjC;AACF;ACpbO,IAAM,cAAA,GAAiB;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA,CAyF5B,IAAA;AAEF,IAAM,UAAA,GAAa;AAAA,EACjBA,2BAAA;AAAA,EACAC,sBAAK,SAAA,CAAU;AAAA,IACb,WAAA,EAAa;AAAA,GACd,CAAA;AAAA,EACDC,sBAAA;AAAA,EACAC,2BAAU,SAAA,CAAU;AAAA,IAClB,KAAA,EAAO,CAAC,SAAA,EAAW,WAAW;AAAA,GAC/B,CAAA;AAAA,EACDC,0BAAA;AAAA,EACAC,2BAAU,SAAA,CAAU;AAAA,IAClB,UAAA,EAAY;AAAA,GACb,CAAA;AAAA,EACDC,yBAAA;AAAA,EACAC,0BAAS,SAAA,CAAU;AAAA,IACjB,MAAA,EAAQ;AAAA,GACT,CAAA;AAAA,EACDC,4BAAA;AAAA,EACAC;AACF,CAAA;AAEO,SAAS,uBAA0B,KAAA,EAAa;AAErD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA,EAAM;AAC/C,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,EAAC;AACV;AAEO,SAAS,eAAe,KAAA,EAAwB;AACrD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA,EAAM;AAC/C,IAAA,OAAO,EAAA;AAAA,EACT;AAEA,EAAA,IAAI;AACF,IAAA,MAAMC,MAAA,GAAOC,iBAAA,CAAa,KAAA,EAA8B,UAAU,CAAA;AAClE,IAAA,OAAO,8BAA8BD,MAAI,CAAA,MAAA,CAAA;AAAA,EAC3C,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,+BAA+B,KAAK,CAAA;AAClD,IAAA,OAAO,EAAA;AAAA,EACT;AACF","file":"chunk-OJ2AM75W.cjs","sourcesContent":["\n\n// ============================================================================\n// Base Field Interface\n// ============================================================================\n\n/**\n * Serializable condition for conditional field visibility.\n * Unlike function conditions, these survive JSON serialization\n * and can be used in admin configs that are built at compile time.\n */\nexport interface DeclarativeCondition {\n  /** The field name to evaluate (resolved from root form data) */\n  field: string;\n  /** Show the field when the target field equals this value */\n  equals?: string | number | boolean;\n  /** Show the field when the target field does NOT equal this value */\n  notEquals?: string | number | boolean;\n  /** Show the field when the target field's value is one of these */\n  in?: (string | number | boolean)[];\n}\n\nexport interface FieldAdmin {\n  description?: string;\n  placeholder?: string;\n  readOnly?: boolean | ((\n    data: Record<string, unknown>,\n    siblingData: Record<string, unknown>,\n  ) => boolean);\n  hidden?: boolean | ((\n    data: Record<string, unknown>,\n    siblingData: Record<string, unknown>,\n  ) => boolean);\n  width?: string;\n  position?: \"sidebar\" | \"main\";\n  autoGenerate?: string;\n  action?: string;\n  method?: string;\n  inline?: boolean;\n  pickerMode?: \"drawer\" | \"dropdown\";\n  condition?:\n    | ((\n        data: Record<string, unknown>,\n        siblingData: Record<string, unknown>,\n      ) => boolean)\n    | DeclarativeCondition;\n}\n\nexport interface BaseField {\n  name: string;\n  label?: string;\n  required?: boolean;\n  unique?: boolean;\n  indexed?: boolean;\n  defaultValue?: any;\n  admin?: FieldAdmin;\n  validate?: (\n    value: any,\n    options: ValidateOptions,\n  ) => string | true | Promise<string | true>;\n  hooks?: {\n    beforeValidate?: Hook[];\n    beforeChange?: Hook[];\n    afterChange?: Hook[];\n    afterRead?: Hook[];\n  };\n}\n\nexport interface ValidateOptions {\n  data?: Record<string, any>;\n  siblingData?: Record<string, any>;\n  user?: unknown;\n  operation?: string;\n  required?: boolean;\n}\n\nexport type Hook = (args: any) => Promise<any> | any;\n\n// ============================================================================\n// Primitive Fields\n// ============================================================================\n\nexport type TextFieldVariant = \"text\" | \"email\" | \"password\" | \"url\" | \"id\";\n\nexport interface TextField extends BaseField {\n  type: \"text\";\n  variant?: TextFieldVariant;\n  minLength?: number;\n  maxLength?: number;\n  pattern?: string;\n  hasMany?: boolean;\n  localized?: boolean;\n}\n\nexport interface NumberField extends BaseField {\n  type: \"number\";\n  min?: number;\n  max?: number;\n  step?: number;\n  integer?: boolean;\n  hasMany?: boolean;\n}\n\nexport interface CheckboxField extends BaseField {\n  type: \"checkbox\";\n}\n\nexport interface DateField extends BaseField {\n  type: \"date\";\n  minDate?: string;\n  maxDate?: string;\n  time?: boolean;\n}\n\nexport interface EmailField extends BaseField {\n  type: \"email\";\n}\n\nexport interface PasswordField extends BaseField {\n  type: \"password\";\n}\n\nexport interface TextareaField extends BaseField {\n  type: \"textarea\";\n  minLength?: number;\n  maxLength?: number;\n  rows?: number;\n  localized?: boolean;\n}\n\nexport interface SelectField extends BaseField {\n  type: \"select\";\n  options?: Array<{ label: string; value: string }>;\n  dynamicOptions?: string;\n  hasMany?: boolean;\n  defaultValue?: string | string[];\n}\n\nexport interface RadioField extends BaseField {\n  type: \"radio\";\n  options: Array<{ label: string; value: string }>;\n  defaultValue?: string;\n}\n\nexport interface ColorField extends BaseField {\n  type: \"color\";\n  format?: \"hex\" | \"rgb\" | \"hsl\";\n  defaultValue?: string;\n}\n\nexport interface ImageField extends BaseField {\n  type: \"image\";\n  minCount?: number;\n  maxCount?: number;\n  allowedTypes?: string[];\n  maxSize?: number;\n}\n\n// ============================================================================\n// Complex Fields\n// ============================================================================\n\nexport type RichTextBlock = Record<string, any>; // TipTap JSONContent\n\nexport interface RichTextField extends BaseField {\n  type: \"richtext\";\n  defaultValue?: Record<string, any>;\n  localized?: boolean;\n}\n\nexport interface JSONField extends BaseField {\n  type: \"json\";\n  defaultValue?: Record<string, any>;\n}\n\nexport interface CodeField extends BaseField {\n  type: \"code\";\n  language?: string;\n  defaultValue?: string;\n}\n\nexport interface UploadField extends BaseField {\n  type: \"upload\";\n  relationTo: string;\n  hasMany?: boolean;\n  maxDepth?: number;\n  defaultValue?: string;\n}\n\nexport interface MarkdownField extends BaseField {\n  type: \"markdown\";\n  localized?: boolean;\n  defaultValue?: string;\n}\n\n// ============================================================================\n// Relational Fields\n// ============================================================================\n\nexport interface RelationshipField extends BaseField {\n  type: \"relationship\";\n  relationTo: string | string[];\n  hasMany?: boolean;\n  maxDepth?: number;\n  filterOptions?: (args: { data: any; user: any }) => Record<string, any>;\n  defaultValue?: string | string[];\n}\n\nexport interface ArrayField extends BaseField {\n  type: \"array\";\n  fields: Field[];\n  minRows?: number;\n  maxRows?: number;\n  labels?: { singular?: string; plural?: string };\n  defaultValue?: Record<string, any>[];\n}\n\nexport interface ListField extends BaseField {\n  type: \"list\";\n  defaultValue?: string[];\n}\n\nexport interface GroupField extends BaseField {\n  type: \"group\";\n  fields: Field[];\n  defaultValue?: Record<string, any>;\n}\n\nexport interface BlockImage {\n  url: string;\n  alt?: string;\n}\n\nexport interface BlockAdmin {\n  group?: string;\n  description?: string;\n  images?: {\n    icon?: BlockImage | string;\n    thumbnail?: BlockImage | string;\n  };\n}\n\nexport interface Block {\n  slug: string;\n  label: string;\n  fields: Field[];\n  imageURL?: string;\n  admin?: BlockAdmin;\n}\n\nexport interface BlocksField extends BaseField {\n  type: \"blocks\";\n  blocks?: Block[];\n  minRows?: number;\n  maxRows?: number;\n  defaultValue?: Array<{ blockType: string; [key: string]: any }>;\n}\n\nexport interface RowField extends Omit<BaseField, \"name\"> {\n  type: \"row\";\n  fields: Field[];\n  name?: string;\n}\n\nexport interface CollapsibleField extends Omit<BaseField, \"name\"> {\n  type: \"collapsible\";\n  fields: Field[];\n  label: string;\n  name?: string;\n}\n\nexport interface TabsField extends Omit<BaseField, \"name\"> {\n  type: \"tabs\";\n  tabs: Array<{\n    label: string;\n    fields: Field[];\n    name?: string;\n  }>;\n  name?: string;\n}\n\nexport interface ButtonField extends BaseField {\n  type: \"button\";\n  label: string;\n  action?: string;\n  method?: string;\n  inline?: boolean;\n}\n\nexport interface ActionField extends BaseField {\n  type: \"action\";\n  label: string;\n  action?: string;\n  method?: string;\n  inline?: boolean;\n}\n\nexport interface SecretField extends BaseField {\n  type: \"secret\";\n}\n\n// ============================================================================\n// Union Type\n// ============================================================================\n\nexport type Field =\n  | TextField\n  | NumberField\n  | CheckboxField\n  | DateField\n  | EmailField\n  | PasswordField\n  | TextareaField\n  | SelectField\n  | RadioField\n  | ColorField\n  | ImageField\n  | RichTextField\n  | JSONField\n  | CodeField\n  | UploadField\n  | MarkdownField\n  | RelationshipField\n  | ArrayField\n  | ListField\n  | GroupField\n  | BlocksField\n  | RowField\n  | CollapsibleField\n  | TabsField\n  | ButtonField\n  | ActionField\n  | SecretField;\n\nexport type FieldType = Field[\"type\"];\n\n// ============================================================================\n// Field Type Guards\n// ============================================================================\n\nexport function isTextField(field: Field): field is TextField {\n  return field.type === \"text\";\n}\n\nexport function isNumberField(field: Field): field is NumberField {\n  return field.type === \"number\";\n}\n\nexport function isRelationshipField(field: Field): field is RelationshipField {\n  return field.type === \"relationship\";\n}\n\nexport function isArrayField(field: Field): field is ArrayField {\n  return field.type === \"array\";\n}\n\nexport function isGroupField(field: Field): field is GroupField {\n  return field.type === \"group\";\n}\n\nexport function isBlocksField(field: Field): field is BlocksField {\n  return field.type === \"blocks\";\n}\n\nexport function isUploadField(field: Field): field is UploadField {\n  return field.type === \"upload\";\n}\n\nexport function isImageField(field: Field): field is ImageField {\n  return field.type === \"image\";\n}\n\nexport function isRichTextField(field: Field): field is RichTextField {\n  return field.type === \"richtext\";\n}\n\nexport function isSelectField(field: Field): field is SelectField {\n  return field.type === \"select\";\n}\n\nexport function isLayoutField(\n  field: Field,\n): field is RowField | CollapsibleField | TabsField {\n  return (\n    field.type === \"row\" ||\n    field.type === \"collapsible\" ||\n    field.type === \"tabs\"\n  );\n}\n\n// ============================================================================\n// Field Type List\n// ============================================================================\n\nexport const PRIMITIVE_FIELD_TYPES = [\n  \"text\",\n  \"number\",\n  \"checkbox\",\n  \"date\",\n  \"email\",\n  \"password\",\n  \"textarea\",\n  \"select\",\n  \"radio\",\n  \"color\",\n] as const;\n\nexport const COMPLEX_FIELD_TYPES = [\n  \"richtext\",\n  \"json\",\n  \"code\",\n  \"upload\",\n  \"image\",\n  \"markdown\",\n] as const;\n\nexport const RELATIONAL_FIELD_TYPES = [\n  \"relationship\",\n  \"array\",\n  \"group\",\n  \"blocks\",\n] as const;\n\nexport const LAYOUT_FIELD_TYPES = [\"row\", \"collapsible\", \"tabs\"] as const;\n\nexport const ALL_FIELD_TYPES = [\n  ...PRIMITIVE_FIELD_TYPES,\n  ...COMPLEX_FIELD_TYPES,\n  ...RELATIONAL_FIELD_TYPES,\n  ...LAYOUT_FIELD_TYPES,\n] as const;\n\n// ============================================================================\n// Field Factory Functions\n// ============================================================================\n\nexport function createRelationshipFieldConfig(\n  name: string,\n  relationTo: string | string[],\n  options?: Partial<Omit<RelationshipField, \"type\" | \"name\" | \"relationTo\">>,\n): RelationshipField {\n  return {\n    name,\n    type: \"relationship\",\n    relationTo,\n    ...options,\n    required: options?.required ?? false,\n  };\n}\n","import { generateHTML } from \"@tiptap/html\";\nimport StarterKit from \"@tiptap/starter-kit\";\nimport Link from \"@tiptap/extension-link\";\nimport Image from \"@tiptap/extension-image\";\nimport TextAlign from \"@tiptap/extension-text-align\";\nimport Underline from \"@tiptap/extension-underline\";\nimport Highlight from \"@tiptap/extension-highlight\";\nimport TaskList from \"@tiptap/extension-task-list\";\nimport TaskItem from \"@tiptap/extension-task-item\";\nimport { TextStyle } from \"@tiptap/extension-text-style\";\nimport Color from \"@tiptap/extension-color\";\n\nexport const richTextStyles = `\n.kyro-richtext {\n  color: inherit;\n  line-height: 1.7;\n}\n\n.kyro-richtext > *:first-child {\n  margin-top: 0;\n}\n\n.kyro-richtext > *:last-child {\n  margin-bottom: 0;\n}\n\n.kyro-richtext p,\n.kyro-richtext ul,\n.kyro-richtext ol,\n.kyro-richtext blockquote,\n.kyro-richtext pre {\n  margin: 0 0 1rem;\n}\n\n.kyro-richtext h1,\n.kyro-richtext h2,\n.kyro-richtext h3,\n.kyro-richtext h4,\n.kyro-richtext h5,\n.kyro-richtext h6 {\n  margin: 0 0 0.75rem;\n  line-height: 1.2;\n}\n\n.kyro-richtext ul,\n.kyro-richtext ol {\n  padding-left: 1.5rem;\n}\n\n.kyro-richtext blockquote {\n  border-left: 4px solid rgba(148, 163, 184, 0.5);\n  margin-left: 0;\n  padding-left: 1rem;\n  font-style: italic;\n}\n\n.kyro-richtext pre {\n  overflow-x: auto;\n  border-radius: 0.75rem;\n  background: rgba(15, 23, 42, 0.92);\n  color: #f8fafc;\n  padding: 1rem;\n}\n\n.kyro-richtext code {\n  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;\n}\n\n.kyro-richtext img {\n  display: block;\n  max-width: 100%;\n  height: auto;\n  border-radius: 0.75rem;\n}\n\n.kyro-richtext ul[data-type=\"taskList\"] {\n  list-style: none;\n  padding: 0;\n}\n\n.kyro-richtext li[data-type=\"taskItem\"] {\n  display: flex;\n  align-items: flex-start;\n  gap: 0.5rem;\n}\n\n.kyro-richtext li[data-type=\"taskItem\"] > label {\n  user-select: none;\n  pointer-events: none;\n  margin-top: 0.2rem;\n}\n\n.kyro-richtext li[data-type=\"taskItem\"] > div {\n  flex: 1;\n}\n\n.kyro-richtext mark {\n  background-color: #fef08a;\n  border-radius: 0.25rem;\n  padding: 0.125rem 0.25rem;\n}\n`.trim();\n\nconst extensions = [\n  StarterKit,\n  Link.configure({\n    openOnClick: false,\n  }),\n  Image,\n  TextAlign.configure({\n    types: [\"heading\", \"paragraph\"],\n  }),\n  Underline,\n  Highlight.configure({\n    multicolor: true,\n  }),\n  TaskList,\n  TaskItem.configure({\n    nested: true,\n  }),\n  TextStyle,\n  Color,\n];\n\nexport function normalizeRichTextValue<T>(value: T): T {\n  // TipTap JSON is already standard JSON, so we just ensure it's an object.\n  if (typeof value === \"object\" && value !== null) {\n    return value;\n  }\n  return {} as T;\n}\n\nexport function renderRichText(value: unknown): string {\n  if (typeof value !== \"object\" || value === null) {\n    return \"\";\n  }\n  \n  try {\n    const html = generateHTML(value as Record<string, any>, extensions);\n    return `<div class=\"kyro-richtext\">${html}</div>`;\n  } catch (error) {\n    console.error(\"Failed to render rich text:\", error);\n    return \"\";\n  }\n}\n"]}

package/dist/{chunk-DRVOUQMT.cjs → chunk-OVZO4KB6.cjs}

@@ -1,15 +1,15 @@
 'use strict';
 
 var chunk3KTWGODI_cjs = require('./chunk-3KTWGODI.cjs');
-var chunkHVCUIII2_cjs = require('./chunk-HVCUIII2.cjs');
-var chunkRRKCIAPU_cjs = require('./chunk-RRKCIAPU.cjs');
-var chunkQVJNSAQL_cjs = require('./chunk-QVJNSAQL.cjs');
-var chunkQFLB4EIJ_cjs = require('./chunk-QFLB4EIJ.cjs');
-var chunkFKKQUMXR_cjs = require('./chunk-FKKQUMXR.cjs');
+var chunkW3GT55TY_cjs = require('./chunk-W3GT55TY.cjs');
+var chunkPF642V5O_cjs = require('./chunk-PF642V5O.cjs');
+var chunk2CBCU5ML_cjs = require('./chunk-2CBCU5ML.cjs');
+var chunkZ7OH3MWT_cjs = require('./chunk-Z7OH3MWT.cjs');
+var chunkKGJRJ7CU_cjs = require('./chunk-KGJRJ7CU.cjs');
 var chunkEEJUFDMF_cjs = require('./chunk-EEJUFDMF.cjs');
 var chunkGUUB5EAG_cjs = require('./chunk-GUUB5EAG.cjs');
 var zod = require('zod');
-var graphql = require('graphql');
+var graphqlYoga = require('graphql-yoga');
 var module$1 = require('module');
 var crypto = require('crypto');
 
@@ -778,7 +778,7 @@ function globalToUpdateZod(global) {
 
 // src/registry/index.ts
 var Registry = class {
-  storageProviders = chunkQVJNSAQL_cjs.getDefaultRegistry();
+  storageProviders = chunk2CBCU5ML_cjs.getDefaultRegistry();
   collections = /* @__PURE__ */ new Map();
   globals = /* @__PURE__ */ new Map();
   plugins = [];
@@ -1319,7 +1319,7 @@ var s3StoragePlugin = {
         configFields: v.configFields,
         extractConfig: (sc) => buildS3ConfigFromStorageConfig(v.type, v, sc),
         extractRawConfig: (raw) => buildS3ConfigFromRaw(v.type, v, raw),
-        factory: (c) => chunkQVJNSAQL_cjs.createS3Storage(c)
+        factory: (c) => chunk2CBCU5ML_cjs.createS3Storage(c)
       });
     }
   }
@@ -1367,7 +1367,7 @@ var cloudinaryStoragePlugin = {
           uploadPreset: cl?.uploadPreset
         };
       },
-      factory: (c) => chunkQVJNSAQL_cjs.createCloudinaryStorage(c)
+      factory: (c) => chunk2CBCU5ML_cjs.createCloudinaryStorage(c)
     });
   }
 };
@@ -1417,7 +1417,7 @@ var ftpStoragePlugin = {
           type: "ftp"
         };
       },
-      factory: (c) => chunkQVJNSAQL_cjs.createFtpStorage(c)
+      factory: (c) => chunk2CBCU5ML_cjs.createFtpStorage(c)
     });
   }
 };
@@ -1477,7 +1477,7 @@ var Kyro = class {
     this.registry = createRegistry();
     this.db = config.adapter;
     this.pubsub = new chunkEEJUFDMF_cjs.KyroPubSub(this.registry);
-    this.webhookService = chunkQFLB4EIJ_cjs.createWebhookService(this.db);
+    this.webhookService = chunkZ7OH3MWT_cjs.createWebhookService(this.db);
     if (config.collections && config.admin?.collectionOverrides) {
       applyCollectionOverrides(config.collections, config.admin.collectionOverrides);
     }
@@ -1515,7 +1515,7 @@ var Kyro = class {
       );
     }
     const systemCollection = {
-      slug: chunkFKKQUMXR_cjs.API_KEY_COLLECTION,
+      slug: chunkKGJRJ7CU_cjs.API_KEY_COLLECTION,
       fields: [
         { name: "userId", type: "text", required: true },
         { name: "name", type: "text", required: true },
@@ -1527,7 +1527,7 @@ var Kyro = class {
       ]
     };
     const webhookCollection = {
-      slug: chunkQFLB4EIJ_cjs.WEBHOOK_COLLECTION,
+      slug: chunkZ7OH3MWT_cjs.WEBHOOK_COLLECTION,
       fields: [
         { name: "name", type: "text", required: true },
         { name: "url", type: "text", required: true },
@@ -1540,7 +1540,7 @@ var Kyro = class {
       ]
     };
     const webhookDeliveryCollection = {
-      slug: chunkQFLB4EIJ_cjs.WEBHOOK_DELIVERY_COLLECTION,
+      slug: chunkZ7OH3MWT_cjs.WEBHOOK_DELIVERY_COLLECTION,
       fields: [
         { name: "webhookId", type: "text", required: true },
         { name: "event", type: "text", required: true },
@@ -1614,7 +1614,7 @@ var Kyro = class {
     const authObj = typeof this.config.auth === "object" ? this.config.auth : null;
     const authSecret = authObj?.secret;
     const checkSession = authObj?.checkSession !== false;
-    return chunkQVJNSAQL_cjs.createHonoApp({
+    return chunk2CBCU5ML_cjs.createHonoApp({
       registry: this.registry,
       db: this.db,
       authSecret,
@@ -1627,78 +1627,41 @@ var Kyro = class {
     });
   }
   getGraphQL(options) {
-    const defaultSchema = chunkRRKCIAPU_cjs.buildGraphQLSchema({
+    const schema = chunkPF642V5O_cjs.buildGraphQLSchema({
       registry: this.registry,
       db: this.db,
-      settings: this.settings,
-      user: options?.user,
-      req: options?.req,
-      tenantID: options?.tenantID
+      settings: this.settings
     });
-    return {
-      fetch: async (request, _locals) => {
-        const apiKeyRaw = chunkFKKQUMXR_cjs.extractApiKeyFromRequest(request);
+    const yoga = graphqlYoga.createYoga({
+      schema,
+      context: async ({ request }) => {
+        const apiKeyRaw = chunkKGJRJ7CU_cjs.extractApiKeyFromRequest(request);
         let gqlUser;
         let apiKeyCtx;
         if (apiKeyRaw && this.db) {
-          const apiKeyResult = await chunkFKKQUMXR_cjs.validateApiKey(apiKeyRaw, this.db);
-          if (!apiKeyResult.valid) {
-            return new Response(
-              JSON.stringify({ errors: [{ message: apiKeyResult.error || "Invalid API key" }] }),
-              { status: 401, headers: { "Content-Type": "application/json" } }
-            );
-          }
+          const apiKeyResult = await chunkKGJRJ7CU_cjs.validateApiKey(apiKeyRaw, this.db);
           if (apiKeyResult.user) {
             gqlUser = apiKeyResult.user;
-            apiKeyCtx = chunkFKKQUMXR_cjs.createApiKeyContext(apiKeyResult);
+            apiKeyCtx = chunkKGJRJ7CU_cjs.createApiKeyContext(apiKeyResult);
           }
         }
-        const mustRebuild = gqlUser !== options?.user || apiKeyCtx !== void 0;
-        const schema = mustRebuild ? chunkRRKCIAPU_cjs.buildGraphQLSchema({
-          registry: this.registry,
+        const tenantID = options?.tenantID;
+        return {
           db: this.db,
-          settings: this.settings,
+          registry: this.registry,
           user: gqlUser,
           req: request,
-          tenantID: options?.tenantID,
-          apiKey: apiKeyCtx
-        }) : defaultSchema;
-        const body = request.method === "POST" ? await request.json().catch(() => ({})) : {};
-        const query = body.query || "";
-        const variables = body.variables || {};
-        if (!query) {
-          return new Response(
-            JSON.stringify({ error: "No GraphQL query provided" }),
-            { status: 400, headers: { "Content-Type": "application/json" } }
-          );
-        }
-        try {
-          const document = graphql.parse(query);
-          const result = await graphql.execute({
-            schema,
-            document,
-            variableValues: variables,
-            contextValue: {
-              db: this.db,
-              registry: this.registry,
-              settings: this.settings,
-              user: gqlUser,
-              req: request,
-              tenantID: options?.tenantID
-            }
-          });
-          return new Response(JSON.stringify(result), {
-            status: 200,
-            headers: { "Content-Type": "application/json" }
-          });
-        } catch (err) {
-          return new Response(
-            JSON.stringify({ errors: [{ message: err.message }] }),
-            { status: 400, headers: { "Content-Type": "application/json" } }
-          );
-        }
+          tenantID,
+          apiKey: apiKeyCtx,
+          relationLoader: new chunkPF642V5O_cjs.RelationLoader({ db: this.db, tenantID, user: gqlUser })
+        };
       },
-      schema: defaultSchema
+      graphiql: false,
+      plugins: []
+    });
+    return {
+      fetch: yoga.fetch,
+      schema
     };
   }
   getTRPC(options) {
@@ -1721,7 +1684,7 @@ var Kyro = class {
             { status: 400, headers: { "Content-Type": "application/json" } }
           );
         }
-        const ctx = await chunkHVCUIII2_cjs.createContext({
+        const ctx = await chunkW3GT55TY_cjs.createContext({
           db: this.db,
           registry: this.registry,
           req: request,
@@ -1729,7 +1692,7 @@ var Kyro = class {
           tenantID: options?.tenantID,
           settings: this.settings
         });
-        const kyroRouter = chunkHVCUIII2_cjs.createKyroServer(ctx);
+        const kyroRouter = chunkW3GT55TY_cjs.createKyroServer(ctx);
         const collectionRouter = kyroRouter[slug];
         if (!collectionRouter) {
           return new Response(
@@ -1807,7 +1770,7 @@ var Kyro = class {
       return null;
     }
     const defaultVerifyToken = async (token) => {
-      const result = await chunkFKKQUMXR_cjs.validateApiKey(token, this.db);
+      const result = await chunkKGJRJ7CU_cjs.validateApiKey(token, this.db);
       if (!result.valid) throw new Error(result.error || "Invalid API key");
       if (!result.user) throw new Error("API key has no associated user");
       return result.user;
@@ -1835,7 +1798,7 @@ var Kyro = class {
 function createKyro(config) {
   return new Kyro(config);
 }
-var _require = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-DRVOUQMT.cjs', document.baseURI).href)));
+var _require = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-OVZO4KB6.cjs', document.baseURI).href)));
 var modPath = "node:sqlite";
 var { DatabaseSync } = _require(modPath);
 function flattenFields(fields) {
@@ -2293,6 +2256,7 @@ var LocalAdapter = class extends chunkGUUB5EAG_cjs.AbstractBaseAdapter {
     this.db.prepare(
       `INSERT OR REPLACE INTO ${tableName} (${quotedColumns.join(", ")}) VALUES (${placeholders})`
     ).run(...values);
+    this.ensureVersionsTable();
     return this.findByID({ collection: slug, id, tenantID, draft: true });
   }
   async update(args) {
@@ -2322,6 +2286,7 @@ var LocalAdapter = class extends chunkGUUB5EAG_cjs.AbstractBaseAdapter {
       params.push(tenantID);
     }
     this.db.prepare(sql).run(...params);
+    this.ensureVersionsTable();
     return this.findByID({ collection: slug, id, tenantID, draft: true });
   }
   async delete(args) {
@@ -2329,6 +2294,7 @@ var LocalAdapter = class extends chunkGUUB5EAG_cjs.AbstractBaseAdapter {
     const parsed = this.parseGlobalsSlug(slug);
     const config = parsed.isGlobal ? this.globals.get(parsed.globalSlug) : this.getCollection(slug);
     this.ensureTable(config, parsed.tableName);
+    this.ensureVersionsTable();
     const doc = await this.findByID({ collection: slug, id, tenantID, draft: true });
     if (!doc) throw new Error(`Document not found: ${slug}/${id}`);
     const tableName = parsed.tableName;
@@ -2783,5 +2749,5 @@ exports.validateCollection = validateCollection;
 exports.validateConfig = validateConfig;
 exports.validateFields = validateFields;
 exports.validateGlobal = validateGlobal;
-//# sourceMappingURL=chunk-DRVOUQMT.cjs.map
-//# sourceMappingURL=chunk-DRVOUQMT.cjs.map
+//# sourceMappingURL=chunk-OVZO4KB6.cjs.map
+//# sourceMappingURL=chunk-OVZO4KB6.cjs.map