@kyro-cms/core 0.9.7 → 0.9.9

package/dist/{WebhookService-BKszZlG0.d.cts → WebhookService-Dj8pJ3sp.d.cts}

@@ -1,4 +1,4 @@
-import { B as BaseAdapter } from './types-Ds0tCA3L.cjs';
+import { B as BaseAdapter } from './types-CY_iNunL.cjs';
 
 declare const WEBHOOK_EVENTS: {
     readonly COLLECTION_CREATE: "collection.create";

package/dist/{WebhookService-Ccf1j-IN.d.ts → WebhookService-DpRB940h.d.ts}

@@ -1,4 +1,4 @@
-import { B as BaseAdapter } from './types-Dgzlftb7.js';
+import { B as BaseAdapter } from './types-BzH3_rtP.js';
 
 declare const WEBHOOK_EVENTS: {
     readonly COLLECTION_CREATE: "collection.create";

package/dist/api-handler-graphql.cjs

@@ -1,19 +1,19 @@
 'use strict';
 
-var chunkOZ3CCTTA_cjs = require('./chunk-OZ3CCTTA.cjs');
-require('./chunk-DRVOUQMT.cjs');
+var chunkOXYSOU6Z_cjs = require('./chunk-OXYSOU6Z.cjs');
+require('./chunk-E4JZ73FY.cjs');
 require('./chunk-5PMQQFRE.cjs');
 require('./chunk-3KTWGODI.cjs');
-require('./chunk-HVCUIII2.cjs');
-require('./chunk-RRKCIAPU.cjs');
-require('./chunk-QVJNSAQL.cjs');
+require('./chunk-TQG7G7YI.cjs');
+require('./chunk-N4GN6Q3V.cjs');
+require('./chunk-IEIHABVR.cjs');
 require('./chunk-Y7AQK4R4.cjs');
 require('./chunk-4PWRCMTQ.cjs');
 require('./chunk-KC2GDBLS.cjs');
 require('./chunk-IDVRRRAK.cjs');
 require('./chunk-ADLJSJSN.cjs');
-require('./chunk-QFLB4EIJ.cjs');
-require('./chunk-FKKQUMXR.cjs');
+require('./chunk-LNTFRAHF.cjs');
+require('./chunk-4OCMVGEY.cjs');
 require('./chunk-EEJUFDMF.cjs');
 require('./chunk-3YELQL7Z.cjs');
 require('./chunk-RFFSZSCL.cjs');
@@ -27,15 +27,20 @@ require('./chunk-NKPKR5BW.cjs');
 require('./chunk-CZLDE2OZ.cjs');
 
 // src/api-handler-graphql.ts
+function toNativeResponse(r) {
+  return new Response(r.body, r);
+}
 var POST = async (context) => {
-  await chunkOZ3CCTTA_cjs.warmKyroInstance();
-  const app = chunkOZ3CCTTA_cjs.kyroInstance.getGraphQL();
-  return app.fetch(context.request, context.locals);
+  await chunkOXYSOU6Z_cjs.warmKyroInstance();
+  const app = chunkOXYSOU6Z_cjs.kyroInstance.getGraphQL();
+  const res = await app.fetch(context.request, context.locals);
+  return toNativeResponse(res);
 };
 var GET = async (context) => {
-  await chunkOZ3CCTTA_cjs.warmKyroInstance();
-  const app = chunkOZ3CCTTA_cjs.kyroInstance.getGraphQL();
-  return app.fetch(context.request, context.locals);
+  await chunkOXYSOU6Z_cjs.warmKyroInstance();
+  const app = chunkOXYSOU6Z_cjs.kyroInstance.getGraphQL();
+  const res = await app.fetch(context.request, context.locals);
+  return toNativeResponse(res);
 };
 
 exports.GET = GET;

package/dist/api-handler-graphql.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/api-handler-graphql.ts"],"names":["warmKyroInstance","kyroInstance"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGO,IAAM,IAAA,GAAiB,OAAO,OAAA,KAAY;AAC/C,EAAA,MAAMA,kCAAA,EAAiB;AACvB,EAAA,MAAM,GAAA,GAAMC,+BAAc,UAAA,EAAW;AACrC,EAAA,OAAO,GAAA,CAAI,KAAA,CAAM,OAAA,CAAQ,OAAA,EAAS,QAAQ,MAAM,CAAA;AAClD;AAEO,IAAM,GAAA,GAAgB,OAAO,OAAA,KAAY;AAC9C,EAAA,MAAMD,kCAAA,EAAiB;AACvB,EAAA,MAAM,GAAA,GAAMC,+BAAc,UAAA,EAAW;AACrC,EAAA,OAAO,GAAA,CAAI,KAAA,CAAM,OAAA,CAAQ,OAAA,EAAS,QAAQ,MAAM,CAAA;AAClD","file":"api-handler-graphql.cjs","sourcesContent":["import type { APIRoute } from \"astro\";\nimport { warmKyroInstance, kyroInstance } from \"./api-handler.js\";\n\nexport const POST: APIRoute = async (context) => {\n  await warmKyroInstance();\n  const app = kyroInstance!.getGraphQL();\n  return app.fetch(context.request, context.locals);\n};\n\nexport const GET: APIRoute = async (context) => {\n  await warmKyroInstance();\n  const app = kyroInstance!.getGraphQL();\n  return app.fetch(context.request, context.locals);\n};\n"]}
+{"version":3,"sources":["../src/api-handler-graphql.ts"],"names":["warmKyroInstance","kyroInstance"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,SAAS,iBAAiB,CAAA,EAAuB;AAC/C,EAAA,OAAO,IAAI,QAAA,CAAS,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAC/B;AAEO,IAAM,IAAA,GAAiB,OAAO,OAAA,KAAY;AAC/C,EAAA,MAAMA,kCAAA,EAAiB;AACvB,EAAA,MAAM,GAAA,GAAMC,+BAAc,UAAA,EAAW;AACrC,EAAA,MAAM,MAAM,MAAM,GAAA,CAAI,MAAM,OAAA,CAAQ,OAAA,EAAS,QAAQ,MAAM,CAAA;AAC3D,EAAA,OAAO,iBAAiB,GAAG,CAAA;AAC7B;AAEO,IAAM,GAAA,GAAgB,OAAO,OAAA,KAAY;AAC9C,EAAA,MAAMD,kCAAA,EAAiB;AACvB,EAAA,MAAM,GAAA,GAAMC,+BAAc,UAAA,EAAW;AACrC,EAAA,MAAM,MAAM,MAAM,GAAA,CAAI,MAAM,OAAA,CAAQ,OAAA,EAAS,QAAQ,MAAM,CAAA;AAC3D,EAAA,OAAO,iBAAiB,GAAG,CAAA;AAC7B","file":"api-handler-graphql.cjs","sourcesContent":["import type { APIRoute } from \"astro\";\nimport { warmKyroInstance, kyroInstance } from \"./api-handler.js\";\n\nfunction toNativeResponse(r: Response): Response {\n  return new Response(r.body, r);\n}\n\nexport const POST: APIRoute = async (context) => {\n  await warmKyroInstance();\n  const app = kyroInstance!.getGraphQL();\n  const res = await app.fetch(context.request, context.locals);\n  return toNativeResponse(res);\n};\n\nexport const GET: APIRoute = async (context) => {\n  await warmKyroInstance();\n  const app = kyroInstance!.getGraphQL();\n  const res = await app.fetch(context.request, context.locals);\n  return toNativeResponse(res);\n};\n"]}

package/dist/api-handler-graphql.js

@@ -1,17 +1,17 @@
-import { warmKyroInstance, kyroInstance } from './chunk-AX2TZRQJ.js';
-import './chunk-CMXVTUYV.js';
+import { warmKyroInstance, kyroInstance } from './chunk-BVUDFKKS.js';
+import './chunk-OYCICW4B.js';
 import './chunk-GAAHG2Z4.js';
 import './chunk-GAOXD3XT.js';
-import './chunk-QX3WNQ7V.js';
-import './chunk-PONTBXR5.js';
-import './chunk-VLK5SJRI.js';
+import './chunk-OX6GOIPH.js';
+import './chunk-5RPRLTTN.js';
+import './chunk-5RFGYEQ3.js';
 import './chunk-6UNONDW7.js';
 import './chunk-YT7HXXVN.js';
 import './chunk-XEB7PH2E.js';
 import './chunk-Q72BOAPK.js';
 import './chunk-P2YW545G.js';
-import './chunk-3UK5XBVJ.js';
-import './chunk-NZEUU7QB.js';
+import './chunk-WDTTHKDS.js';
+import './chunk-3AKCVYDB.js';
 import './chunk-BYBMTIMT.js';
 import './chunk-QU2RFFH4.js';
 import './chunk-V7KZQIZ6.js';
@@ -25,15 +25,20 @@ import './chunk-L4EZKIEX.js';
 import './chunk-4CV4JOE5.js';
 
 // src/api-handler-graphql.ts
+function toNativeResponse(r) {
+  return new Response(r.body, r);
+}
 var POST = async (context) => {
   await warmKyroInstance();
   const app = kyroInstance.getGraphQL();
-  return app.fetch(context.request, context.locals);
+  const res = await app.fetch(context.request, context.locals);
+  return toNativeResponse(res);
 };
 var GET = async (context) => {
   await warmKyroInstance();
   const app = kyroInstance.getGraphQL();
-  return app.fetch(context.request, context.locals);
+  const res = await app.fetch(context.request, context.locals);
+  return toNativeResponse(res);
 };
 
 export { GET, POST };

package/dist/api-handler-graphql.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/api-handler-graphql.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAGO,IAAM,IAAA,GAAiB,OAAO,OAAA,KAAY;AAC/C,EAAA,MAAM,gBAAA,EAAiB;AACvB,EAAA,MAAM,GAAA,GAAM,aAAc,UAAA,EAAW;AACrC,EAAA,OAAO,GAAA,CAAI,KAAA,CAAM,OAAA,CAAQ,OAAA,EAAS,QAAQ,MAAM,CAAA;AAClD;AAEO,IAAM,GAAA,GAAgB,OAAO,OAAA,KAAY;AAC9C,EAAA,MAAM,gBAAA,EAAiB;AACvB,EAAA,MAAM,GAAA,GAAM,aAAc,UAAA,EAAW;AACrC,EAAA,OAAO,GAAA,CAAI,KAAA,CAAM,OAAA,CAAQ,OAAA,EAAS,QAAQ,MAAM,CAAA;AAClD","file":"api-handler-graphql.js","sourcesContent":["import type { APIRoute } from \"astro\";\nimport { warmKyroInstance, kyroInstance } from \"./api-handler.js\";\n\nexport const POST: APIRoute = async (context) => {\n  await warmKyroInstance();\n  const app = kyroInstance!.getGraphQL();\n  return app.fetch(context.request, context.locals);\n};\n\nexport const GET: APIRoute = async (context) => {\n  await warmKyroInstance();\n  const app = kyroInstance!.getGraphQL();\n  return app.fetch(context.request, context.locals);\n};\n"]}
+{"version":3,"sources":["../src/api-handler-graphql.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,SAAS,iBAAiB,CAAA,EAAuB;AAC/C,EAAA,OAAO,IAAI,QAAA,CAAS,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAC/B;AAEO,IAAM,IAAA,GAAiB,OAAO,OAAA,KAAY;AAC/C,EAAA,MAAM,gBAAA,EAAiB;AACvB,EAAA,MAAM,GAAA,GAAM,aAAc,UAAA,EAAW;AACrC,EAAA,MAAM,MAAM,MAAM,GAAA,CAAI,MAAM,OAAA,CAAQ,OAAA,EAAS,QAAQ,MAAM,CAAA;AAC3D,EAAA,OAAO,iBAAiB,GAAG,CAAA;AAC7B;AAEO,IAAM,GAAA,GAAgB,OAAO,OAAA,KAAY;AAC9C,EAAA,MAAM,gBAAA,EAAiB;AACvB,EAAA,MAAM,GAAA,GAAM,aAAc,UAAA,EAAW;AACrC,EAAA,MAAM,MAAM,MAAM,GAAA,CAAI,MAAM,OAAA,CAAQ,OAAA,EAAS,QAAQ,MAAM,CAAA;AAC3D,EAAA,OAAO,iBAAiB,GAAG,CAAA;AAC7B","file":"api-handler-graphql.js","sourcesContent":["import type { APIRoute } from \"astro\";\nimport { warmKyroInstance, kyroInstance } from \"./api-handler.js\";\n\nfunction toNativeResponse(r: Response): Response {\n  return new Response(r.body, r);\n}\n\nexport const POST: APIRoute = async (context) => {\n  await warmKyroInstance();\n  const app = kyroInstance!.getGraphQL();\n  const res = await app.fetch(context.request, context.locals);\n  return toNativeResponse(res);\n};\n\nexport const GET: APIRoute = async (context) => {\n  await warmKyroInstance();\n  const app = kyroInstance!.getGraphQL();\n  const res = await app.fetch(context.request, context.locals);\n  return toNativeResponse(res);\n};\n"]}

package/dist/api-handler-trpc.cjs

@@ -1,19 +1,19 @@
 'use strict';
 
-var chunkOZ3CCTTA_cjs = require('./chunk-OZ3CCTTA.cjs');
-require('./chunk-DRVOUQMT.cjs');
+var chunkOXYSOU6Z_cjs = require('./chunk-OXYSOU6Z.cjs');
+require('./chunk-E4JZ73FY.cjs');
 require('./chunk-5PMQQFRE.cjs');
 require('./chunk-3KTWGODI.cjs');
-require('./chunk-HVCUIII2.cjs');
-require('./chunk-RRKCIAPU.cjs');
-require('./chunk-QVJNSAQL.cjs');
+require('./chunk-TQG7G7YI.cjs');
+require('./chunk-N4GN6Q3V.cjs');
+require('./chunk-IEIHABVR.cjs');
 require('./chunk-Y7AQK4R4.cjs');
 require('./chunk-4PWRCMTQ.cjs');
 require('./chunk-KC2GDBLS.cjs');
 require('./chunk-IDVRRRAK.cjs');
 require('./chunk-ADLJSJSN.cjs');
-require('./chunk-QFLB4EIJ.cjs');
-require('./chunk-FKKQUMXR.cjs');
+require('./chunk-LNTFRAHF.cjs');
+require('./chunk-4OCMVGEY.cjs');
 require('./chunk-EEJUFDMF.cjs');
 require('./chunk-3YELQL7Z.cjs');
 require('./chunk-RFFSZSCL.cjs');
@@ -28,8 +28,8 @@ require('./chunk-CZLDE2OZ.cjs');
 
 // src/api-handler-trpc.ts
 var ALL = async (context) => {
-  await chunkOZ3CCTTA_cjs.warmKyroInstance();
-  const app = chunkOZ3CCTTA_cjs.kyroInstance.getTRPC();
+  await chunkOXYSOU6Z_cjs.warmKyroInstance();
+  const app = chunkOXYSOU6Z_cjs.kyroInstance.getTRPC();
   return app.fetch(context.request, context.locals);
 };
 

package/dist/api-handler-trpc.js

@@ -1,17 +1,17 @@
-import { warmKyroInstance, kyroInstance } from './chunk-AX2TZRQJ.js';
-import './chunk-CMXVTUYV.js';
+import { warmKyroInstance, kyroInstance } from './chunk-BVUDFKKS.js';
+import './chunk-OYCICW4B.js';
 import './chunk-GAAHG2Z4.js';
 import './chunk-GAOXD3XT.js';
-import './chunk-QX3WNQ7V.js';
-import './chunk-PONTBXR5.js';
-import './chunk-VLK5SJRI.js';
+import './chunk-OX6GOIPH.js';
+import './chunk-5RPRLTTN.js';
+import './chunk-5RFGYEQ3.js';
 import './chunk-6UNONDW7.js';
 import './chunk-YT7HXXVN.js';
 import './chunk-XEB7PH2E.js';
 import './chunk-Q72BOAPK.js';
 import './chunk-P2YW545G.js';
-import './chunk-3UK5XBVJ.js';
-import './chunk-NZEUU7QB.js';
+import './chunk-WDTTHKDS.js';
+import './chunk-3AKCVYDB.js';
 import './chunk-BYBMTIMT.js';
 import './chunk-QU2RFFH4.js';
 import './chunk-V7KZQIZ6.js';

package/dist/api-handler.cjs

@@ -1,19 +1,19 @@
 'use strict';
 
-var chunkOZ3CCTTA_cjs = require('./chunk-OZ3CCTTA.cjs');
-require('./chunk-DRVOUQMT.cjs');
+var chunkOXYSOU6Z_cjs = require('./chunk-OXYSOU6Z.cjs');
+require('./chunk-E4JZ73FY.cjs');
 require('./chunk-5PMQQFRE.cjs');
 require('./chunk-3KTWGODI.cjs');
-require('./chunk-HVCUIII2.cjs');
-require('./chunk-RRKCIAPU.cjs');
-require('./chunk-QVJNSAQL.cjs');
+require('./chunk-TQG7G7YI.cjs');
+require('./chunk-N4GN6Q3V.cjs');
+require('./chunk-IEIHABVR.cjs');
 require('./chunk-Y7AQK4R4.cjs');
 require('./chunk-4PWRCMTQ.cjs');
 require('./chunk-KC2GDBLS.cjs');
 require('./chunk-IDVRRRAK.cjs');
 require('./chunk-ADLJSJSN.cjs');
-require('./chunk-QFLB4EIJ.cjs');
-require('./chunk-FKKQUMXR.cjs');
+require('./chunk-LNTFRAHF.cjs');
+require('./chunk-4OCMVGEY.cjs');
 require('./chunk-EEJUFDMF.cjs');
 require('./chunk-3YELQL7Z.cjs');
 require('./chunk-RFFSZSCL.cjs');
@@ -30,15 +30,15 @@ require('./chunk-CZLDE2OZ.cjs');
 
 Object.defineProperty(exports, "ALL", {
   enumerable: true,
-  get: function () { return chunkOZ3CCTTA_cjs.ALL; }
+  get: function () { return chunkOXYSOU6Z_cjs.ALL; }
 });
 Object.defineProperty(exports, "kyroInstance", {
   enumerable: true,
-  get: function () { return chunkOZ3CCTTA_cjs.kyroInstance; }
+  get: function () { return chunkOXYSOU6Z_cjs.kyroInstance; }
 });
 Object.defineProperty(exports, "warmKyroInstance", {
   enumerable: true,
-  get: function () { return chunkOZ3CCTTA_cjs.warmKyroInstance; }
+  get: function () { return chunkOXYSOU6Z_cjs.warmKyroInstance; }
 });
 //# sourceMappingURL=api-handler.cjs.map
 //# sourceMappingURL=api-handler.cjs.map

package/dist/api-handler.js

@@ -1,17 +1,17 @@
-export { ALL, kyroInstance, warmKyroInstance } from './chunk-AX2TZRQJ.js';
-import './chunk-CMXVTUYV.js';
+export { ALL, kyroInstance, warmKyroInstance } from './chunk-BVUDFKKS.js';
+import './chunk-OYCICW4B.js';
 import './chunk-GAAHG2Z4.js';
 import './chunk-GAOXD3XT.js';
-import './chunk-QX3WNQ7V.js';
-import './chunk-PONTBXR5.js';
-import './chunk-VLK5SJRI.js';
+import './chunk-OX6GOIPH.js';
+import './chunk-5RPRLTTN.js';
+import './chunk-5RFGYEQ3.js';
 import './chunk-6UNONDW7.js';
 import './chunk-YT7HXXVN.js';
 import './chunk-XEB7PH2E.js';
 import './chunk-Q72BOAPK.js';
 import './chunk-P2YW545G.js';
-import './chunk-3UK5XBVJ.js';
-import './chunk-NZEUU7QB.js';
+import './chunk-WDTTHKDS.js';
+import './chunk-3AKCVYDB.js';
 import './chunk-BYBMTIMT.js';
 import './chunk-QU2RFFH4.js';
 import './chunk-V7KZQIZ6.js';

package/dist/{base-CIuXkrH4.d.cts → base-BjyoF6da.d.cts}

@@ -1,5 +1,5 @@
-import { B as BaseAdapter, C as CollectionConfig, G as GlobalConfig, T as TenantContext, F as FindArgs, b as FindResult, c as FindByIDArgs, d as CreateArgs, e as UpdateArgs, D as DeleteArgs, f as FindVersionsArgs, g as VersionRecord, h as CreateVersionArgs } from './types-Ds0tCA3L.cjs';
-import { F as Field, k as RelationshipField, U as UploadField } from './types-DeSApf9T.cjs';
+import { B as BaseAdapter, C as CollectionConfig, G as GlobalConfig, T as TenantContext, F as FindArgs, b as FindResult, c as FindByIDArgs, d as CreateArgs, e as UpdateArgs, D as DeleteArgs, f as FindVersionsArgs, g as VersionRecord, h as CreateVersionArgs } from './types-CY_iNunL.cjs';
+import { F as Field, k as RelationshipField, U as UploadField } from './types-C_rVxU2T.cjs';
 
 declare abstract class AbstractBaseAdapter implements BaseAdapter {
     protected collections: Map<string, CollectionConfig>;

package/dist/{base-fFo4lqER.d.ts → base-C2YR8lWt.d.ts}

@@ -1,5 +1,5 @@
-import { B as BaseAdapter, C as CollectionConfig, G as GlobalConfig, T as TenantContext, F as FindArgs, b as FindResult, c as FindByIDArgs, d as CreateArgs, e as UpdateArgs, D as DeleteArgs, f as FindVersionsArgs, g as VersionRecord, h as CreateVersionArgs } from './types-Dgzlftb7.js';
-import { F as Field, k as RelationshipField, U as UploadField } from './types-DeSApf9T.js';
+import { B as BaseAdapter, C as CollectionConfig, G as GlobalConfig, T as TenantContext, F as FindArgs, b as FindResult, c as FindByIDArgs, d as CreateArgs, e as UpdateArgs, D as DeleteArgs, f as FindVersionsArgs, g as VersionRecord, h as CreateVersionArgs } from './types-BzH3_rtP.js';
+import { F as Field, k as RelationshipField, U as UploadField } from './types-C_rVxU2T.js';
 
 declare abstract class AbstractBaseAdapter implements BaseAdapter {
     protected collections: Map<string, CollectionConfig>;

package/dist/{chunk-NZEUU7QB.js → chunk-3AKCVYDB.js}

@@ -1,4 +1,3 @@
-import { hasPermission } from './chunk-L4EZKIEX.js';
 import { timingSafeEqual } from 'crypto';
 
 // src/access/types.ts
@@ -27,7 +26,7 @@ function getWhereClause(access, args) {
     return result;
   });
 }
-var API_KEY_COLLECTION = "_api_keys";
+var API_KEY_COLLECTION = "api_keys";
 function generateKeyPrefix(key) {
   return key.substring(0, 8);
 }
@@ -158,110 +157,6 @@ function generateApiKeyPrefix(key) {
   return key.substring(0, 8);
 }
 
-// src/access/checker.ts
-function actionToPermission(operation) {
-  if (operation === "read") return "read";
-  if (operation === "create") return "create";
-  if (operation === "update") return "update";
-  return "delete";
-}
-function isDefaultAllowed(operation, defaultAccess) {
-  const levels = {
-    none: false,
-    read: operation === "read",
-    create: operation === "read" || operation === "create",
-    update: operation === "read" || operation === "create" || operation === "update",
-    delete: operation === "read" || operation === "create" || operation === "update" || operation === "delete",
-    admin: true
-  };
-  return levels[defaultAccess] || false;
-}
-async function checkCollectionAccess(config, operation, context, options = {}) {
-  const { user, req, tenantID, apiKey } = context;
-  const { enablePublicAccess = true, defaultAccess = "none" } = options;
-  const accessRule = config.access?.[operation];
-  if (accessRule) {
-    const allowed = await evaluateAccess(accessRule, {
-      req,
-      user,
-      tenantID
-    });
-    if (allowed === false) {
-      return { allowed: false, error: "Access denied", status: 403 };
-    }
-    if (typeof allowed === "object") {
-      return { allowed: true, extraWhere: allowed };
-    }
-    return { allowed: true };
-  }
-  if (apiKey?.permissions?.length > 0) {
-    const resource = config.slug;
-    const action = actionToPermission(operation);
-    const permission = `${resource}:${action}`;
-    if (!hasApiKeyPermission(apiKey.permissions, permission) && !hasApiKeyPermission(apiKey.permissions, `${resource}:admin`)) {
-      return { allowed: false, error: "Access denied: insufficient permissions", status: 403 };
-    }
-    return { allowed: true };
-  }
-  if (user) {
-    const resource = config.slug;
-    const action = actionToPermission(operation);
-    const permission = `${resource}:${action}`;
-    const userHas = hasPermission(
-      { id: user.id, email: user.email, role: user.role },
-      permission
-    );
-    const adminHas = hasPermission(
-      { id: user.id, email: user.email, role: user.role },
-      `${resource}:admin`
-    );
-    if (userHas || adminHas) {
-      return { allowed: true };
-    }
-    return { allowed: false, error: "Access denied: missing RBAC permission", status: 403 };
-  }
-  const defaultAllowed = isDefaultAllowed(operation, defaultAccess);
-  if (enablePublicAccess && defaultAllowed) {
-    return { allowed: true };
-  }
-  return { allowed: false, error: "Authentication required", status: 401 };
-}
-async function checkGlobalAccess(config, operation, context, options = {}) {
-  const { user, req, tenantID } = context;
-  const { enablePublicAccess = true } = options;
-  const accessRule = config.access?.[operation];
-  if (accessRule) {
-    const allowed = await evaluateAccess(accessRule, {
-      req,
-      user,
-      tenantID
-    });
-    if (allowed === false) {
-      return { allowed: false, error: "Access denied", status: 403 };
-    }
-    return { allowed: true };
-  }
-  if (user) {
-    const permission = `globals:${operation}`;
-    const userHas = hasPermission(
-      { id: user.id, email: user.email, role: user.role },
-      permission
-    );
-    const adminHas = hasPermission(
-      { id: user.id, email: user.email, role: user.role },
-      "globals:admin"
-    );
-    if (userHas || adminHas) {
-      return { allowed: true };
-    }
-    return { allowed: false, error: "Access denied: missing RBAC permission", status: 403 };
-  }
-  if (enablePublicAccess) {
-    return { allowed: true };
-  }
-  return { allowed: false, error: "Authentication required", status: 401 };
-}
-
-export { API_KEY_COLLECTION, checkCollectionAccess, checkGlobalAccess, createApiKeyContext, evaluateAccess, extractApiKeyFromRequest, generateApiKey, generateApiKeyPrefix, getWhereClause, mergeWhereClauses, validateApiKey };
-//# sourceMappingURL=chunk-NZEUU7QB.js.map
-//# sourceMappingURL=chunk-NZEUU7QB.js.map
+export { API_KEY_COLLECTION, createApiKeyContext, evaluateAccess, extractApiKeyFromRequest, generateApiKey, generateApiKeyPrefix, getWhereClause, hasApiKeyPermission, mergeWhereClauses, validateApiKey };
+//# sourceMappingURL=chunk-3AKCVYDB.js.map
+//# sourceMappingURL=chunk-3AKCVYDB.js.map

package/dist/chunk-3AKCVYDB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access/types.ts","../src/auth/api-key.ts"],"names":[],"mappings":";;;AA+CA,eAAsB,cAAA,CACpB,QACA,IAAA,EACgC;AAChC,EAAA,IAAI,OAAO,WAAW,SAAA,EAAW;AAC/B,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,WAAW,UAAA,EAAY;AAChC,IAAA,OAAO,MAAM,OAAO,IAAI,CAAA;AAAA,EAC1B;AACA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,qBACX,YAAA,EACU;AACb,EAAA,MAAM,SAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,UAAU,YAAA,EAAc;AACjC,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACxC,MAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,IAC9B;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,cAAA,CACd,QACA,IAAA,EACkC;AAClC,EAAA,OAAO,cAAA,CAAe,MAAA,EAAQ,IAAI,CAAA,CAAE,KAAK,CAAA,MAAA,KAAU;AACjD,IAAA,IAAI,MAAA,KAAW,MAAM,OAAO,MAAA;AAC5B,IAAA,IAAI,MAAA,KAAW,OAAO,OAAO,EAAE,KAAK,EAAE,GAAA,EAAK,MAAK,EAAE;AAClD,IAAA,OAAO,MAAA;AAAA,EACT,CAAC,CAAA;AACH;AC7CO,IAAM,kBAAA,GAAqB;AAElC,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAO,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AAC3B;AAEA,SAAS,mBAAA,CAAoB,GAAW,CAAA,EAAoB;AAC1D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAO,eAAA,CAAgB,OAAO,IAAA,CAAK,CAAC,GAAG,MAAA,CAAO,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,eAAsB,cAAA,CACpB,MAAA,EACA,EAAA,EACA,UAAA,EACiC;AACjC,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,EACtD;AAEA,EAAA,IAAI,CAAC,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,wBAAA,EAAyB;AAAA,EACzD;AAEA,EAAA,MAAM,SAAA,GAAY,kBAAkB,MAAM,CAAA;AAE1C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,IAAA,CAAK;AAAA,MAC3B,UAAA,EAAY,kBAAA;AAAA,MACZ,OAAO,EAAE,SAAA,EAAW,EAAE,MAAA,EAAQ,WAAU,EAAE;AAAA,MAC1C,KAAA,EAAO,GAAA;AAAA,MACP,IAAA,EAAM;AAAA,KACP,CAAA;AAED,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA,EAAG;AAC5C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,iBAAA,EAAkB;AAAA,IAClD;AAEA,IAAA,IAAI,UAAA,GAAkC,IAAA;AACtC,IAAA,KAAA,MAAW,GAAA,IAAO,OAAO,IAAA,EAAM;AAC7B,MAAA,MAAM,MAAA,GAAS,GAAA;AACf,MAAA,IAAI,mBAAA,CAAoB,MAAA,CAAO,GAAA,EAAK,MAAM,CAAA,EAAG;AAC3C,QAAA,UAAA,GAAa,MAAA;AACb,QAAA;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,iBAAA,EAAkB;AAAA,IAClD;AAEA,IAAA,IAAI,WAAW,SAAA,EAAW;AACxB,MAAA,MAAM,SAAA,GAAY,IAAI,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA;AAC/C,MAAA,IAAI,SAAA,mBAAY,IAAI,IAAA,EAAK,EAAG;AAC1B,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,MACtD;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,GAAG,MAAA,CAAO;AAAA,QACd,UAAA,EAAY,kBAAA;AAAA,QACZ,IAAI,UAAA,CAAW,EAAA;AAAA,QACf,MAAM,EAAE,UAAA,EAAA,qBAAgB,IAAA,EAAK,EAAE,aAAY;AAAE,OAC9C,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,MAAM,IAAA,GAA0B;AAAA,MAC9B,IAAI,UAAA,CAAW,MAAA;AAAA,MACf,IAAA,EAAO,WAAmB,IAAA,IAAQ,QAAA;AAAA,MAClC,UAAW,UAAA,CAAmB;AAAA,KAChC;AAEA,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,UAAA,CAAW,MAAM,CAAA;AACjD,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAA,CAAO,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,MAC5B;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,IAAA;AAAA,MACP,QAAQ,UAAA,CAAW,MAAA;AAAA,MACnB,IAAA;AAAA,MACA,WAAA,EAAa,UAAA,CAAW,WAAA,IAAe,EAAC;AAAA,MACxC,UAAU,UAAA,CAAW,EAAA;AAAA,MACrB,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,MAAM,IAAA,CAAK;AAAA,KACb;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,4BAAA,EAA6B;AAAA,EAC7D;AACF;AAEO,SAAS,yBAAyB,OAAA,EAAiC;AACxE,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACtD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAI,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpC,MAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,EAAK;AAAA,IAClC;AACA,IAAA,IAAI,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AAC/C,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,OAAO,QAAQ,IAAA,EAAK;AAAA,EACtB;AAEA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,oBACd,MAAA,EACsB;AACtB,EAAA,IAAI,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,OAAO,MAAA,EAAQ;AACnC,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,IAAA,EAAM,MAAA,CAAO,IAAA,IAAQ,EAAC;AAAA,IACtB,WAAA,EAAa,MAAA,CAAO,WAAA,IAAe,EAAC;AAAA,IACpC,QAAA,EAAU,OAAO,QAAA,IAAY,EAAA;AAAA,IAC7B,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,MAAM,MAAA,CAAO;AAAA,GACf;AACF;AAEO,SAAS,mBAAA,CACd,aACA,QAAA,EACS;AACT,EAAA,IAAI,WAAA,CAAY,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AACrC,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,GAAG,CAAA,EAAG,OAAO,IAAA;AACtC,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,IAAA;AAE3C,EAAA,MAAM,CAAC,QAAA,EAAU,MAAM,CAAA,GAAI,QAAA,CAAS,MAAM,GAAG,CAAA;AAC7C,EAAA,IAAI,YAAY,QAAA,CAAS,CAAA,EAAG,QAAQ,CAAA,EAAA,CAAI,GAAG,OAAO,IAAA;AAElD,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,cAAA,GAAyB;AACvC,EAAA,MAAM,KAAA,GAAQ,sCAAA;AACd,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,IAAA,MAAA,IAAU,KAAA,CAAM,KAAK,KAAA,CAAM,IAAA,CAAK,QAAO,GAAI,KAAA,CAAM,MAAM,CAAC,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,QAAQ,MAAM,CAAA,CAAA;AACvB;AAEO,SAAS,qBAAqB,GAAA,EAAqB;AACxD,EAAA,OAAO,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AAC3B","file":"chunk-3AKCVYDB.js","sourcesContent":["import type { User, Request } from '../hooks/types.js';\n\n// ============================================================================\n// Access Control Types\n// ============================================================================\n\nexport interface WhereClause {\n  [field: string]: any;\n}\n\nexport interface AccessArgs {\n  req: Request;\n  user?: User;\n  data?: unknown;\n  doc?: unknown;\n  id?: string;\n  tenantID?: string;\n  context?: Record<string, unknown>;\n}\n\nexport type AccessControl = boolean | ((args: AccessArgs) => Promise<boolean | WhereClause> | boolean | WhereClause);\n\nexport interface CollectionAccess {\n  create?: AccessControl;\n  read?: AccessControl;\n  update?: AccessControl;\n  delete?: AccessControl;\n  admin?: AccessControl;\n  unlock?: AccessControl;\n  readVersions?: AccessControl;\n}\n\nexport interface GlobalAccess {\n  read?: AccessControl;\n  update?: AccessControl;\n}\n\nexport interface FieldAccess {\n  create?: AccessControl;\n  read?: AccessControl;\n  update?: AccessControl;\n}\n\n// ============================================================================\n// Access Control Evaluation\n// ============================================================================\n\nexport async function evaluateAccess(\n  access: AccessControl,\n  args: AccessArgs\n): Promise<boolean | WhereClause> {\n  if (typeof access === 'boolean') {\n    return access;\n  }\n  if (typeof access === 'function') {\n    return await access(args);\n  }\n  return true;\n}\n\nexport function mergeWhereClauses(\n  ...whereClauses: (WhereClause | boolean | undefined)[]\n): WhereClause {\n  const result: WhereClause = {};\n  for (const clause of whereClauses) {\n    if (clause && typeof clause === 'object') {\n      Object.assign(result, clause);\n    }\n  }\n  return result;\n}\n\nexport function getWhereClause(\n  access: AccessControl,\n  args: AccessArgs\n): Promise<WhereClause | undefined> {\n  return evaluateAccess(access, args).then(result => {\n    if (result === true) return undefined;\n    if (result === false) return { _id: { $eq: null } };\n    return result;\n  });\n}\n","import { timingSafeEqual } from \"crypto\";\nimport type { BaseAdapter } from \"../registry/types.js\";\nimport type { AuthUser, UserRole } from \"./types.js\";\n\nexport interface ApiKeyRecord {\n  id: string;\n  userId: string;\n  name: string;\n  key: string;\n  keyPrefix: string;\n  permissions: string[];\n  lastUsedAt?: string;\n  expiresAt?: string;\n  createdAt: string;\n}\n\nexport interface ApiKeyValidationResult {\n  valid: boolean;\n  userId?: string;\n  user?: Partial<AuthUser>;\n  permissions?: string[];\n  apiKeyId?: string;\n  error?: string;\n  tenantId?: string;\n  role?: UserRole;\n}\n\nexport interface ApiKeyContext {\n  userId: string;\n  user: Partial<AuthUser>;\n  permissions: string[];\n  apiKeyId: string;\n  tenantId?: string;\n  role?: UserRole;\n}\n\nexport const API_KEY_COLLECTION = \"api_keys\";\n\nfunction generateKeyPrefix(key: string): string {\n  return key.substring(0, 8);\n}\n\nfunction constantTimeCompare(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  try {\n    return timingSafeEqual(Buffer.from(a), Buffer.from(b));\n  } catch {\n    return false;\n  }\n}\n\nexport async function validateApiKey(\n  rawKey: string,\n  db: BaseAdapter,\n  userLookup?: (userId: string) => Promise<Partial<AuthUser> | null>,\n): Promise<ApiKeyValidationResult> {\n  if (!rawKey || typeof rawKey !== \"string\") {\n    return { valid: false, error: \"No API key provided\" };\n  }\n\n  if (!rawKey.startsWith(\"kyro_\")) {\n    return { valid: false, error: \"Invalid API key format\" };\n  }\n\n  const keyPrefix = generateKeyPrefix(rawKey);\n\n  try {\n    const result = await db.find({\n      collection: API_KEY_COLLECTION,\n      where: { keyPrefix: { equals: keyPrefix } },\n      limit: 100,\n      page: 1,\n    });\n\n    if (!result.docs || result.docs.length === 0) {\n      return { valid: false, error: \"Invalid API key\" };\n    }\n\n    let matchedKey: ApiKeyRecord | null = null;\n    for (const doc of result.docs) {\n      const record = doc as unknown as ApiKeyRecord;\n      if (constantTimeCompare(record.key, rawKey)) {\n        matchedKey = record;\n        break;\n      }\n    }\n\n    if (!matchedKey) {\n      return { valid: false, error: \"Invalid API key\" };\n    }\n\n    if (matchedKey.expiresAt) {\n      const expiresAt = new Date(matchedKey.expiresAt);\n      if (expiresAt < new Date()) {\n        return { valid: false, error: \"API key has expired\" };\n      }\n    }\n\n    try {\n      await db.update({\n        collection: API_KEY_COLLECTION,\n        id: matchedKey.id,\n        data: { lastUsedAt: new Date().toISOString() },\n      });\n    } catch {\n      // Non-critical: don't fail if lastUsedAt update fails\n    }\n\n    const user: Partial<AuthUser> = {\n      id: matchedKey.userId,\n      role: (matchedKey as any).role || \"author\",\n      tenantId: (matchedKey as any).tenantId,\n    };\n\n    if (userLookup) {\n      const dbUser = await userLookup(matchedKey.userId);\n      if (dbUser) {\n        Object.assign(user, dbUser);\n      }\n    }\n\n    return {\n      valid: true,\n      userId: matchedKey.userId,\n      user,\n      permissions: matchedKey.permissions || [],\n      apiKeyId: matchedKey.id,\n      tenantId: user.tenantId,\n      role: user.role,\n    };\n  } catch (error) {\n    console.error(\"[ApiKey] Validation error:\", error);\n    return { valid: false, error: \"Failed to validate API key\" };\n  }\n}\n\nexport function extractApiKeyFromRequest(request: Request): string | null {\n  const authHeader = request.headers.get(\"Authorization\");\n  if (authHeader) {\n    if (authHeader.startsWith(\"ApiKey \")) {\n      return authHeader.slice(7).trim();\n    }\n    if (authHeader.startsWith(\"Bearer \")) {\n      return null;\n    }\n  }\n\n  const xApiKey = request.headers.get(\"X-API-Key\");\n  if (xApiKey) {\n    return xApiKey.trim();\n  }\n\n  return null;\n}\n\nexport function createApiKeyContext(\n  result: ApiKeyValidationResult,\n): ApiKeyContext | null {\n  if (!result.valid || !result.userId) {\n    return null;\n  }\n  return {\n    userId: result.userId,\n    user: result.user || {},\n    permissions: result.permissions || [],\n    apiKeyId: result.apiKeyId || \"\",\n    tenantId: result.tenantId,\n    role: result.role,\n  };\n}\n\nexport function hasApiKeyPermission(\n  permissions: string[],\n  required: string,\n): boolean {\n  if (permissions.length === 0) return false;\n  if (permissions.includes(\"*\")) return true;\n  if (permissions.includes(required)) return true;\n\n  const [resource, action] = required.split(\":\");\n  if (permissions.includes(`${resource}:*`)) return true;\n\n  return false;\n}\n\nexport function generateApiKey(): string {\n  const chars = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n  let suffix = \"\";\n  for (let i = 0; i < 32; i++) {\n    suffix += chars[Math.floor(Math.random() * chars.length)];\n  }\n  return `kyro_${suffix}`;\n}\n\nexport function generateApiKeyPrefix(key: string): string {\n  return key.substring(0, 8);\n}\n"]}

package/dist/{chunk-FKKQUMXR.cjs → chunk-4OCMVGEY.cjs}

@@ -1,6 +1,5 @@
 'use strict';
 
-var chunkNKPKR5BW_cjs = require('./chunk-NKPKR5BW.cjs');
 var crypto = require('crypto');
 
 // src/access/types.ts
@@ -29,7 +28,7 @@ function getWhereClause(access, args) {
     return result;
   });
 }
-var API_KEY_COLLECTION = "_api_keys";
+var API_KEY_COLLECTION = "api_keys";
 function generateKeyPrefix(key) {
   return key.substring(0, 8);
 }
@@ -160,120 +159,15 @@ function generateApiKeyPrefix(key) {
   return key.substring(0, 8);
 }
 
-// src/access/checker.ts
-function actionToPermission(operation) {
-  if (operation === "read") return "read";
-  if (operation === "create") return "create";
-  if (operation === "update") return "update";
-  return "delete";
-}
-function isDefaultAllowed(operation, defaultAccess) {
-  const levels = {
-    none: false,
-    read: operation === "read",
-    create: operation === "read" || operation === "create",
-    update: operation === "read" || operation === "create" || operation === "update",
-    delete: operation === "read" || operation === "create" || operation === "update" || operation === "delete",
-    admin: true
-  };
-  return levels[defaultAccess] || false;
-}
-async function checkCollectionAccess(config, operation, context, options = {}) {
-  const { user, req, tenantID, apiKey } = context;
-  const { enablePublicAccess = true, defaultAccess = "none" } = options;
-  const accessRule = config.access?.[operation];
-  if (accessRule) {
-    const allowed = await evaluateAccess(accessRule, {
-      req,
-      user,
-      tenantID
-    });
-    if (allowed === false) {
-      return { allowed: false, error: "Access denied", status: 403 };
-    }
-    if (typeof allowed === "object") {
-      return { allowed: true, extraWhere: allowed };
-    }
-    return { allowed: true };
-  }
-  if (apiKey?.permissions?.length > 0) {
-    const resource = config.slug;
-    const action = actionToPermission(operation);
-    const permission = `${resource}:${action}`;
-    if (!hasApiKeyPermission(apiKey.permissions, permission) && !hasApiKeyPermission(apiKey.permissions, `${resource}:admin`)) {
-      return { allowed: false, error: "Access denied: insufficient permissions", status: 403 };
-    }
-    return { allowed: true };
-  }
-  if (user) {
-    const resource = config.slug;
-    const action = actionToPermission(operation);
-    const permission = `${resource}:${action}`;
-    const userHas = chunkNKPKR5BW_cjs.hasPermission(
-      { id: user.id, email: user.email, role: user.role },
-      permission
-    );
-    const adminHas = chunkNKPKR5BW_cjs.hasPermission(
-      { id: user.id, email: user.email, role: user.role },
-      `${resource}:admin`
-    );
-    if (userHas || adminHas) {
-      return { allowed: true };
-    }
-    return { allowed: false, error: "Access denied: missing RBAC permission", status: 403 };
-  }
-  const defaultAllowed = isDefaultAllowed(operation, defaultAccess);
-  if (enablePublicAccess && defaultAllowed) {
-    return { allowed: true };
-  }
-  return { allowed: false, error: "Authentication required", status: 401 };
-}
-async function checkGlobalAccess(config, operation, context, options = {}) {
-  const { user, req, tenantID } = context;
-  const { enablePublicAccess = true } = options;
-  const accessRule = config.access?.[operation];
-  if (accessRule) {
-    const allowed = await evaluateAccess(accessRule, {
-      req,
-      user,
-      tenantID
-    });
-    if (allowed === false) {
-      return { allowed: false, error: "Access denied", status: 403 };
-    }
-    return { allowed: true };
-  }
-  if (user) {
-    const permission = `globals:${operation}`;
-    const userHas = chunkNKPKR5BW_cjs.hasPermission(
-      { id: user.id, email: user.email, role: user.role },
-      permission
-    );
-    const adminHas = chunkNKPKR5BW_cjs.hasPermission(
-      { id: user.id, email: user.email, role: user.role },
-      "globals:admin"
-    );
-    if (userHas || adminHas) {
-      return { allowed: true };
-    }
-    return { allowed: false, error: "Access denied: missing RBAC permission", status: 403 };
-  }
-  if (enablePublicAccess) {
-    return { allowed: true };
-  }
-  return { allowed: false, error: "Authentication required", status: 401 };
-}
-
 exports.API_KEY_COLLECTION = API_KEY_COLLECTION;
-exports.checkCollectionAccess = checkCollectionAccess;
-exports.checkGlobalAccess = checkGlobalAccess;
 exports.createApiKeyContext = createApiKeyContext;
 exports.evaluateAccess = evaluateAccess;
 exports.extractApiKeyFromRequest = extractApiKeyFromRequest;
 exports.generateApiKey = generateApiKey;
 exports.generateApiKeyPrefix = generateApiKeyPrefix;
 exports.getWhereClause = getWhereClause;
+exports.hasApiKeyPermission = hasApiKeyPermission;
 exports.mergeWhereClauses = mergeWhereClauses;
 exports.validateApiKey = validateApiKey;
-//# sourceMappingURL=chunk-FKKQUMXR.cjs.map
-//# sourceMappingURL=chunk-FKKQUMXR.cjs.map
+//# sourceMappingURL=chunk-4OCMVGEY.cjs.map
+//# sourceMappingURL=chunk-4OCMVGEY.cjs.map

package/dist/chunk-4OCMVGEY.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access/types.ts","../src/auth/api-key.ts"],"names":["timingSafeEqual"],"mappings":";;;;;AA+CA,eAAsB,cAAA,CACpB,QACA,IAAA,EACgC;AAChC,EAAA,IAAI,OAAO,WAAW,SAAA,EAAW;AAC/B,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,WAAW,UAAA,EAAY;AAChC,IAAA,OAAO,MAAM,OAAO,IAAI,CAAA;AAAA,EAC1B;AACA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,qBACX,YAAA,EACU;AACb,EAAA,MAAM,SAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,UAAU,YAAA,EAAc;AACjC,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACxC,MAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,IAC9B;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,cAAA,CACd,QACA,IAAA,EACkC;AAClC,EAAA,OAAO,cAAA,CAAe,MAAA,EAAQ,IAAI,CAAA,CAAE,KAAK,CAAA,MAAA,KAAU;AACjD,IAAA,IAAI,MAAA,KAAW,MAAM,OAAO,MAAA;AAC5B,IAAA,IAAI,MAAA,KAAW,OAAO,OAAO,EAAE,KAAK,EAAE,GAAA,EAAK,MAAK,EAAE;AAClD,IAAA,OAAO,MAAA;AAAA,EACT,CAAC,CAAA;AACH;AC7CO,IAAM,kBAAA,GAAqB;AAElC,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAO,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AAC3B;AAEA,SAAS,mBAAA,CAAoB,GAAW,CAAA,EAAoB;AAC1D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAOA,sBAAA,CAAgB,OAAO,IAAA,CAAK,CAAC,GAAG,MAAA,CAAO,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,eAAsB,cAAA,CACpB,MAAA,EACA,EAAA,EACA,UAAA,EACiC;AACjC,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,EACtD;AAEA,EAAA,IAAI,CAAC,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,wBAAA,EAAyB;AAAA,EACzD;AAEA,EAAA,MAAM,SAAA,GAAY,kBAAkB,MAAM,CAAA;AAE1C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,IAAA,CAAK;AAAA,MAC3B,UAAA,EAAY,kBAAA;AAAA,MACZ,OAAO,EAAE,SAAA,EAAW,EAAE,MAAA,EAAQ,WAAU,EAAE;AAAA,MAC1C,KAAA,EAAO,GAAA;AAAA,MACP,IAAA,EAAM;AAAA,KACP,CAAA;AAED,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA,EAAG;AAC5C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,iBAAA,EAAkB;AAAA,IAClD;AAEA,IAAA,IAAI,UAAA,GAAkC,IAAA;AACtC,IAAA,KAAA,MAAW,GAAA,IAAO,OAAO,IAAA,EAAM;AAC7B,MAAA,MAAM,MAAA,GAAS,GAAA;AACf,MAAA,IAAI,mBAAA,CAAoB,MAAA,CAAO,GAAA,EAAK,MAAM,CAAA,EAAG;AAC3C,QAAA,UAAA,GAAa,MAAA;AACb,QAAA;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,iBAAA,EAAkB;AAAA,IAClD;AAEA,IAAA,IAAI,WAAW,SAAA,EAAW;AACxB,MAAA,MAAM,SAAA,GAAY,IAAI,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA;AAC/C,MAAA,IAAI,SAAA,mBAAY,IAAI,IAAA,EAAK,EAAG;AAC1B,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,MACtD;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,GAAG,MAAA,CAAO;AAAA,QACd,UAAA,EAAY,kBAAA;AAAA,QACZ,IAAI,UAAA,CAAW,EAAA;AAAA,QACf,MAAM,EAAE,UAAA,EAAA,qBAAgB,IAAA,EAAK,EAAE,aAAY;AAAE,OAC9C,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,MAAM,IAAA,GAA0B;AAAA,MAC9B,IAAI,UAAA,CAAW,MAAA;AAAA,MACf,IAAA,EAAO,WAAmB,IAAA,IAAQ,QAAA;AAAA,MAClC,UAAW,UAAA,CAAmB;AAAA,KAChC;AAEA,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,UAAA,CAAW,MAAM,CAAA;AACjD,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAA,CAAO,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,MAC5B;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,IAAA;AAAA,MACP,QAAQ,UAAA,CAAW,MAAA;AAAA,MACnB,IAAA;AAAA,MACA,WAAA,EAAa,UAAA,CAAW,WAAA,IAAe,EAAC;AAAA,MACxC,UAAU,UAAA,CAAW,EAAA;AAAA,MACrB,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,MAAM,IAAA,CAAK;AAAA,KACb;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,4BAAA,EAA6B;AAAA,EAC7D;AACF;AAEO,SAAS,yBAAyB,OAAA,EAAiC;AACxE,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACtD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAI,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpC,MAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,EAAK;AAAA,IAClC;AACA,IAAA,IAAI,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AAC/C,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,OAAO,QAAQ,IAAA,EAAK;AAAA,EACtB;AAEA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,oBACd,MAAA,EACsB;AACtB,EAAA,IAAI,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,OAAO,MAAA,EAAQ;AACnC,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,IAAA,EAAM,MAAA,CAAO,IAAA,IAAQ,EAAC;AAAA,IACtB,WAAA,EAAa,MAAA,CAAO,WAAA,IAAe,EAAC;AAAA,IACpC,QAAA,EAAU,OAAO,QAAA,IAAY,EAAA;AAAA,IAC7B,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,MAAM,MAAA,CAAO;AAAA,GACf;AACF;AAEO,SAAS,mBAAA,CACd,aACA,QAAA,EACS;AACT,EAAA,IAAI,WAAA,CAAY,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AACrC,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,GAAG,CAAA,EAAG,OAAO,IAAA;AACtC,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,IAAA;AAE3C,EAAA,MAAM,CAAC,QAAA,EAAU,MAAM,CAAA,GAAI,QAAA,CAAS,MAAM,GAAG,CAAA;AAC7C,EAAA,IAAI,YAAY,QAAA,CAAS,CAAA,EAAG,QAAQ,CAAA,EAAA,CAAI,GAAG,OAAO,IAAA;AAElD,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,cAAA,GAAyB;AACvC,EAAA,MAAM,KAAA,GAAQ,sCAAA;AACd,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,IAAA,MAAA,IAAU,KAAA,CAAM,KAAK,KAAA,CAAM,IAAA,CAAK,QAAO,GAAI,KAAA,CAAM,MAAM,CAAC,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,QAAQ,MAAM,CAAA,CAAA;AACvB;AAEO,SAAS,qBAAqB,GAAA,EAAqB;AACxD,EAAA,OAAO,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AAC3B","file":"chunk-4OCMVGEY.cjs","sourcesContent":["import type { User, Request } from '../hooks/types.js';\n\n// ============================================================================\n// Access Control Types\n// ============================================================================\n\nexport interface WhereClause {\n  [field: string]: any;\n}\n\nexport interface AccessArgs {\n  req: Request;\n  user?: User;\n  data?: unknown;\n  doc?: unknown;\n  id?: string;\n  tenantID?: string;\n  context?: Record<string, unknown>;\n}\n\nexport type AccessControl = boolean | ((args: AccessArgs) => Promise<boolean | WhereClause> | boolean | WhereClause);\n\nexport interface CollectionAccess {\n  create?: AccessControl;\n  read?: AccessControl;\n  update?: AccessControl;\n  delete?: AccessControl;\n  admin?: AccessControl;\n  unlock?: AccessControl;\n  readVersions?: AccessControl;\n}\n\nexport interface GlobalAccess {\n  read?: AccessControl;\n  update?: AccessControl;\n}\n\nexport interface FieldAccess {\n  create?: AccessControl;\n  read?: AccessControl;\n  update?: AccessControl;\n}\n\n// ============================================================================\n// Access Control Evaluation\n// ============================================================================\n\nexport async function evaluateAccess(\n  access: AccessControl,\n  args: AccessArgs\n): Promise<boolean | WhereClause> {\n  if (typeof access === 'boolean') {\n    return access;\n  }\n  if (typeof access === 'function') {\n    return await access(args);\n  }\n  return true;\n}\n\nexport function mergeWhereClauses(\n  ...whereClauses: (WhereClause | boolean | undefined)[]\n): WhereClause {\n  const result: WhereClause = {};\n  for (const clause of whereClauses) {\n    if (clause && typeof clause === 'object') {\n      Object.assign(result, clause);\n    }\n  }\n  return result;\n}\n\nexport function getWhereClause(\n  access: AccessControl,\n  args: AccessArgs\n): Promise<WhereClause | undefined> {\n  return evaluateAccess(access, args).then(result => {\n    if (result === true) return undefined;\n    if (result === false) return { _id: { $eq: null } };\n    return result;\n  });\n}\n","import { timingSafeEqual } from \"crypto\";\nimport type { BaseAdapter } from \"../registry/types.js\";\nimport type { AuthUser, UserRole } from \"./types.js\";\n\nexport interface ApiKeyRecord {\n  id: string;\n  userId: string;\n  name: string;\n  key: string;\n  keyPrefix: string;\n  permissions: string[];\n  lastUsedAt?: string;\n  expiresAt?: string;\n  createdAt: string;\n}\n\nexport interface ApiKeyValidationResult {\n  valid: boolean;\n  userId?: string;\n  user?: Partial<AuthUser>;\n  permissions?: string[];\n  apiKeyId?: string;\n  error?: string;\n  tenantId?: string;\n  role?: UserRole;\n}\n\nexport interface ApiKeyContext {\n  userId: string;\n  user: Partial<AuthUser>;\n  permissions: string[];\n  apiKeyId: string;\n  tenantId?: string;\n  role?: UserRole;\n}\n\nexport const API_KEY_COLLECTION = \"api_keys\";\n\nfunction generateKeyPrefix(key: string): string {\n  return key.substring(0, 8);\n}\n\nfunction constantTimeCompare(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  try {\n    return timingSafeEqual(Buffer.from(a), Buffer.from(b));\n  } catch {\n    return false;\n  }\n}\n\nexport async function validateApiKey(\n  rawKey: string,\n  db: BaseAdapter,\n  userLookup?: (userId: string) => Promise<Partial<AuthUser> | null>,\n): Promise<ApiKeyValidationResult> {\n  if (!rawKey || typeof rawKey !== \"string\") {\n    return { valid: false, error: \"No API key provided\" };\n  }\n\n  if (!rawKey.startsWith(\"kyro_\")) {\n    return { valid: false, error: \"Invalid API key format\" };\n  }\n\n  const keyPrefix = generateKeyPrefix(rawKey);\n\n  try {\n    const result = await db.find({\n      collection: API_KEY_COLLECTION,\n      where: { keyPrefix: { equals: keyPrefix } },\n      limit: 100,\n      page: 1,\n    });\n\n    if (!result.docs || result.docs.length === 0) {\n      return { valid: false, error: \"Invalid API key\" };\n    }\n\n    let matchedKey: ApiKeyRecord | null = null;\n    for (const doc of result.docs) {\n      const record = doc as unknown as ApiKeyRecord;\n      if (constantTimeCompare(record.key, rawKey)) {\n        matchedKey = record;\n        break;\n      }\n    }\n\n    if (!matchedKey) {\n      return { valid: false, error: \"Invalid API key\" };\n    }\n\n    if (matchedKey.expiresAt) {\n      const expiresAt = new Date(matchedKey.expiresAt);\n      if (expiresAt < new Date()) {\n        return { valid: false, error: \"API key has expired\" };\n      }\n    }\n\n    try {\n      await db.update({\n        collection: API_KEY_COLLECTION,\n        id: matchedKey.id,\n        data: { lastUsedAt: new Date().toISOString() },\n      });\n    } catch {\n      // Non-critical: don't fail if lastUsedAt update fails\n    }\n\n    const user: Partial<AuthUser> = {\n      id: matchedKey.userId,\n      role: (matchedKey as any).role || \"author\",\n      tenantId: (matchedKey as any).tenantId,\n    };\n\n    if (userLookup) {\n      const dbUser = await userLookup(matchedKey.userId);\n      if (dbUser) {\n        Object.assign(user, dbUser);\n      }\n    }\n\n    return {\n      valid: true,\n      userId: matchedKey.userId,\n      user,\n      permissions: matchedKey.permissions || [],\n      apiKeyId: matchedKey.id,\n      tenantId: user.tenantId,\n      role: user.role,\n    };\n  } catch (error) {\n    console.error(\"[ApiKey] Validation error:\", error);\n    return { valid: false, error: \"Failed to validate API key\" };\n  }\n}\n\nexport function extractApiKeyFromRequest(request: Request): string | null {\n  const authHeader = request.headers.get(\"Authorization\");\n  if (authHeader) {\n    if (authHeader.startsWith(\"ApiKey \")) {\n      return authHeader.slice(7).trim();\n    }\n    if (authHeader.startsWith(\"Bearer \")) {\n      return null;\n    }\n  }\n\n  const xApiKey = request.headers.get(\"X-API-Key\");\n  if (xApiKey) {\n    return xApiKey.trim();\n  }\n\n  return null;\n}\n\nexport function createApiKeyContext(\n  result: ApiKeyValidationResult,\n): ApiKeyContext | null {\n  if (!result.valid || !result.userId) {\n    return null;\n  }\n  return {\n    userId: result.userId,\n    user: result.user || {},\n    permissions: result.permissions || [],\n    apiKeyId: result.apiKeyId || \"\",\n    tenantId: result.tenantId,\n    role: result.role,\n  };\n}\n\nexport function hasApiKeyPermission(\n  permissions: string[],\n  required: string,\n): boolean {\n  if (permissions.length === 0) return false;\n  if (permissions.includes(\"*\")) return true;\n  if (permissions.includes(required)) return true;\n\n  const [resource, action] = required.split(\":\");\n  if (permissions.includes(`${resource}:*`)) return true;\n\n  return false;\n}\n\nexport function generateApiKey(): string {\n  const chars = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n  let suffix = \"\";\n  for (let i = 0; i < 32; i++) {\n    suffix += chars[Math.floor(Math.random() * chars.length)];\n  }\n  return `kyro_${suffix}`;\n}\n\nexport function generateApiKeyPrefix(key: string): string {\n  return key.substring(0, 8);\n}\n"]}