@kyro-cms/core 0.9.8 → 0.10.0

package/dist/{chunk-2GXALYKV.js → chunk-3AKCVYDB.js}

@@ -1,4 +1,3 @@
-import { hasPermission } from './chunk-L4EZKIEX.js';
 import { timingSafeEqual } from 'crypto';
 
 // src/access/types.ts
@@ -27,7 +26,7 @@ function getWhereClause(access, args) {
     return result;
   });
 }
-var API_KEY_COLLECTION = "_api_keys";
+var API_KEY_COLLECTION = "api_keys";
 function generateKeyPrefix(key) {
   return key.substring(0, 8);
 }
@@ -158,110 +157,6 @@ function generateApiKeyPrefix(key) {
   return key.substring(0, 8);
 }
 
-// src/access/checker.ts
-function actionToPermission(operation) {
-  if (operation === "read") return "read";
-  if (operation === "create") return "create";
-  if (operation === "update") return "update";
-  return "delete";
-}
-function isDefaultAllowed(operation, defaultAccess) {
-  const levels = {
-    none: false,
-    read: operation === "read",
-    create: operation === "read" || operation === "create",
-    update: operation === "read" || operation === "create" || operation === "update",
-    delete: operation === "read" || operation === "create" || operation === "update" || operation === "delete",
-    admin: true
-  };
-  return levels[defaultAccess] || false;
-}
-async function checkCollectionAccess(config, operation, context, options = {}) {
-  const { user, req, tenantID, apiKey } = context;
-  const { enablePublicAccess = true, defaultAccess = "none" } = options;
-  const accessRule = config.access?.[operation];
-  if (accessRule) {
-    const allowed = await evaluateAccess(accessRule, {
-      req,
-      user,
-      tenantID
-    });
-    if (allowed === false) {
-      return { allowed: false, error: "Access denied", status: 403 };
-    }
-    if (typeof allowed === "object") {
-      return { allowed: true, extraWhere: allowed };
-    }
-    return { allowed: true };
-  }
-  if (apiKey?.permissions?.length > 0) {
-    const resource = config.slug;
-    const action = actionToPermission(operation);
-    const permission = `${resource}:${action}`;
-    if (!hasApiKeyPermission(apiKey.permissions, permission) && !hasApiKeyPermission(apiKey.permissions, `${resource}:admin`)) {
-      return { allowed: false, error: "Access denied: insufficient permissions", status: 403 };
-    }
-    return { allowed: true };
-  }
-  if (user) {
-    const resource = config.slug;
-    const action = actionToPermission(operation);
-    const permission = `${resource}:${action}`;
-    const userHas = hasPermission(
-      { id: user.id, email: user.email, role: user.role },
-      permission
-    );
-    const adminHas = hasPermission(
-      { id: user.id, email: user.email, role: user.role },
-      `${resource}:admin`
-    );
-    if (userHas || adminHas) {
-      return { allowed: true };
-    }
-    return { allowed: false, error: "Access denied: missing RBAC permission", status: 403 };
-  }
-  const defaultAllowed = isDefaultAllowed(operation, defaultAccess);
-  if (enablePublicAccess && defaultAllowed) {
-    return { allowed: true };
-  }
-  return { allowed: false, error: "Authentication required", status: 401 };
-}
-async function checkGlobalAccess(config, operation, context, options = {}) {
-  const { user, req, tenantID } = context;
-  const { enablePublicAccess = true } = options;
-  const accessRule = config.access?.[operation];
-  if (accessRule) {
-    const allowed = await evaluateAccess(accessRule, {
-      req,
-      user,
-      tenantID
-    });
-    if (allowed === false) {
-      return { allowed: false, error: "Access denied", status: 403 };
-    }
-    return { allowed: true };
-  }
-  if (user) {
-    const permission = `globals:${operation}`;
-    const userHas = hasPermission(
-      { id: user.id, email: user.email, role: user.role },
-      permission
-    );
-    const adminHas = hasPermission(
-      { id: user.id, email: user.email, role: user.role },
-      "globals:admin"
-    );
-    if (userHas || adminHas) {
-      return { allowed: true };
-    }
-    return { allowed: false, error: "Access denied: missing RBAC permission", status: 403 };
-  }
-  if (enablePublicAccess) {
-    return { allowed: true };
-  }
-  return { allowed: false, error: "Authentication required", status: 401 };
-}
-
-export { API_KEY_COLLECTION, checkCollectionAccess, checkGlobalAccess, createApiKeyContext, evaluateAccess, extractApiKeyFromRequest, generateApiKey, generateApiKeyPrefix, getWhereClause, mergeWhereClauses, validateApiKey };
-//# sourceMappingURL=chunk-2GXALYKV.js.map
-//# sourceMappingURL=chunk-2GXALYKV.js.map
+export { API_KEY_COLLECTION, createApiKeyContext, evaluateAccess, extractApiKeyFromRequest, generateApiKey, generateApiKeyPrefix, getWhereClause, hasApiKeyPermission, mergeWhereClauses, validateApiKey };
+//# sourceMappingURL=chunk-3AKCVYDB.js.map
+//# sourceMappingURL=chunk-3AKCVYDB.js.map

package/dist/chunk-3AKCVYDB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access/types.ts","../src/auth/api-key.ts"],"names":[],"mappings":";;;AA+CA,eAAsB,cAAA,CACpB,QACA,IAAA,EACgC;AAChC,EAAA,IAAI,OAAO,WAAW,SAAA,EAAW;AAC/B,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,WAAW,UAAA,EAAY;AAChC,IAAA,OAAO,MAAM,OAAO,IAAI,CAAA;AAAA,EAC1B;AACA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,qBACX,YAAA,EACU;AACb,EAAA,MAAM,SAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,UAAU,YAAA,EAAc;AACjC,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACxC,MAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,IAC9B;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,cAAA,CACd,QACA,IAAA,EACkC;AAClC,EAAA,OAAO,cAAA,CAAe,MAAA,EAAQ,IAAI,CAAA,CAAE,KAAK,CAAA,MAAA,KAAU;AACjD,IAAA,IAAI,MAAA,KAAW,MAAM,OAAO,MAAA;AAC5B,IAAA,IAAI,MAAA,KAAW,OAAO,OAAO,EAAE,KAAK,EAAE,GAAA,EAAK,MAAK,EAAE;AAClD,IAAA,OAAO,MAAA;AAAA,EACT,CAAC,CAAA;AACH;AC7CO,IAAM,kBAAA,GAAqB;AAElC,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAO,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AAC3B;AAEA,SAAS,mBAAA,CAAoB,GAAW,CAAA,EAAoB;AAC1D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAO,eAAA,CAAgB,OAAO,IAAA,CAAK,CAAC,GAAG,MAAA,CAAO,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,eAAsB,cAAA,CACpB,MAAA,EACA,EAAA,EACA,UAAA,EACiC;AACjC,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,EACtD;AAEA,EAAA,IAAI,CAAC,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,wBAAA,EAAyB;AAAA,EACzD;AAEA,EAAA,MAAM,SAAA,GAAY,kBAAkB,MAAM,CAAA;AAE1C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,IAAA,CAAK;AAAA,MAC3B,UAAA,EAAY,kBAAA;AAAA,MACZ,OAAO,EAAE,SAAA,EAAW,EAAE,MAAA,EAAQ,WAAU,EAAE;AAAA,MAC1C,KAAA,EAAO,GAAA;AAAA,MACP,IAAA,EAAM;AAAA,KACP,CAAA;AAED,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA,EAAG;AAC5C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,iBAAA,EAAkB;AAAA,IAClD;AAEA,IAAA,IAAI,UAAA,GAAkC,IAAA;AACtC,IAAA,KAAA,MAAW,GAAA,IAAO,OAAO,IAAA,EAAM;AAC7B,MAAA,MAAM,MAAA,GAAS,GAAA;AACf,MAAA,IAAI,mBAAA,CAAoB,MAAA,CAAO,GAAA,EAAK,MAAM,CAAA,EAAG;AAC3C,QAAA,UAAA,GAAa,MAAA;AACb,QAAA;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,iBAAA,EAAkB;AAAA,IAClD;AAEA,IAAA,IAAI,WAAW,SAAA,EAAW;AACxB,MAAA,MAAM,SAAA,GAAY,IAAI,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA;AAC/C,MAAA,IAAI,SAAA,mBAAY,IAAI,IAAA,EAAK,EAAG;AAC1B,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,MACtD;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,GAAG,MAAA,CAAO;AAAA,QACd,UAAA,EAAY,kBAAA;AAAA,QACZ,IAAI,UAAA,CAAW,EAAA;AAAA,QACf,MAAM,EAAE,UAAA,EAAA,qBAAgB,IAAA,EAAK,EAAE,aAAY;AAAE,OAC9C,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,MAAM,IAAA,GAA0B;AAAA,MAC9B,IAAI,UAAA,CAAW,MAAA;AAAA,MACf,IAAA,EAAO,WAAmB,IAAA,IAAQ,QAAA;AAAA,MAClC,UAAW,UAAA,CAAmB;AAAA,KAChC;AAEA,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,UAAA,CAAW,MAAM,CAAA;AACjD,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAA,CAAO,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,MAC5B;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,IAAA;AAAA,MACP,QAAQ,UAAA,CAAW,MAAA;AAAA,MACnB,IAAA;AAAA,MACA,WAAA,EAAa,UAAA,CAAW,WAAA,IAAe,EAAC;AAAA,MACxC,UAAU,UAAA,CAAW,EAAA;AAAA,MACrB,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,MAAM,IAAA,CAAK;AAAA,KACb;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,4BAAA,EAA6B;AAAA,EAC7D;AACF;AAEO,SAAS,yBAAyB,OAAA,EAAiC;AACxE,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACtD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAI,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpC,MAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,EAAK;AAAA,IAClC;AACA,IAAA,IAAI,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AAC/C,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,OAAO,QAAQ,IAAA,EAAK;AAAA,EACtB;AAEA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,oBACd,MAAA,EACsB;AACtB,EAAA,IAAI,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,OAAO,MAAA,EAAQ;AACnC,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,IAAA,EAAM,MAAA,CAAO,IAAA,IAAQ,EAAC;AAAA,IACtB,WAAA,EAAa,MAAA,CAAO,WAAA,IAAe,EAAC;AAAA,IACpC,QAAA,EAAU,OAAO,QAAA,IAAY,EAAA;AAAA,IAC7B,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,MAAM,MAAA,CAAO;AAAA,GACf;AACF;AAEO,SAAS,mBAAA,CACd,aACA,QAAA,EACS;AACT,EAAA,IAAI,WAAA,CAAY,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AACrC,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,GAAG,CAAA,EAAG,OAAO,IAAA;AACtC,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,IAAA;AAE3C,EAAA,MAAM,CAAC,QAAA,EAAU,MAAM,CAAA,GAAI,QAAA,CAAS,MAAM,GAAG,CAAA;AAC7C,EAAA,IAAI,YAAY,QAAA,CAAS,CAAA,EAAG,QAAQ,CAAA,EAAA,CAAI,GAAG,OAAO,IAAA;AAElD,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,cAAA,GAAyB;AACvC,EAAA,MAAM,KAAA,GAAQ,sCAAA;AACd,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,IAAA,MAAA,IAAU,KAAA,CAAM,KAAK,KAAA,CAAM,IAAA,CAAK,QAAO,GAAI,KAAA,CAAM,MAAM,CAAC,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,QAAQ,MAAM,CAAA,CAAA;AACvB;AAEO,SAAS,qBAAqB,GAAA,EAAqB;AACxD,EAAA,OAAO,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AAC3B","file":"chunk-3AKCVYDB.js","sourcesContent":["import type { User, Request } from '../hooks/types.js';\n\n// ============================================================================\n// Access Control Types\n// ============================================================================\n\nexport interface WhereClause {\n  [field: string]: any;\n}\n\nexport interface AccessArgs {\n  req: Request;\n  user?: User;\n  data?: unknown;\n  doc?: unknown;\n  id?: string;\n  tenantID?: string;\n  context?: Record<string, unknown>;\n}\n\nexport type AccessControl = boolean | ((args: AccessArgs) => Promise<boolean | WhereClause> | boolean | WhereClause);\n\nexport interface CollectionAccess {\n  create?: AccessControl;\n  read?: AccessControl;\n  update?: AccessControl;\n  delete?: AccessControl;\n  admin?: AccessControl;\n  unlock?: AccessControl;\n  readVersions?: AccessControl;\n}\n\nexport interface GlobalAccess {\n  read?: AccessControl;\n  update?: AccessControl;\n}\n\nexport interface FieldAccess {\n  create?: AccessControl;\n  read?: AccessControl;\n  update?: AccessControl;\n}\n\n// ============================================================================\n// Access Control Evaluation\n// ============================================================================\n\nexport async function evaluateAccess(\n  access: AccessControl,\n  args: AccessArgs\n): Promise<boolean | WhereClause> {\n  if (typeof access === 'boolean') {\n    return access;\n  }\n  if (typeof access === 'function') {\n    return await access(args);\n  }\n  return true;\n}\n\nexport function mergeWhereClauses(\n  ...whereClauses: (WhereClause | boolean | undefined)[]\n): WhereClause {\n  const result: WhereClause = {};\n  for (const clause of whereClauses) {\n    if (clause && typeof clause === 'object') {\n      Object.assign(result, clause);\n    }\n  }\n  return result;\n}\n\nexport function getWhereClause(\n  access: AccessControl,\n  args: AccessArgs\n): Promise<WhereClause | undefined> {\n  return evaluateAccess(access, args).then(result => {\n    if (result === true) return undefined;\n    if (result === false) return { _id: { $eq: null } };\n    return result;\n  });\n}\n","import { timingSafeEqual } from \"crypto\";\nimport type { BaseAdapter } from \"../registry/types.js\";\nimport type { AuthUser, UserRole } from \"./types.js\";\n\nexport interface ApiKeyRecord {\n  id: string;\n  userId: string;\n  name: string;\n  key: string;\n  keyPrefix: string;\n  permissions: string[];\n  lastUsedAt?: string;\n  expiresAt?: string;\n  createdAt: string;\n}\n\nexport interface ApiKeyValidationResult {\n  valid: boolean;\n  userId?: string;\n  user?: Partial<AuthUser>;\n  permissions?: string[];\n  apiKeyId?: string;\n  error?: string;\n  tenantId?: string;\n  role?: UserRole;\n}\n\nexport interface ApiKeyContext {\n  userId: string;\n  user: Partial<AuthUser>;\n  permissions: string[];\n  apiKeyId: string;\n  tenantId?: string;\n  role?: UserRole;\n}\n\nexport const API_KEY_COLLECTION = \"api_keys\";\n\nfunction generateKeyPrefix(key: string): string {\n  return key.substring(0, 8);\n}\n\nfunction constantTimeCompare(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  try {\n    return timingSafeEqual(Buffer.from(a), Buffer.from(b));\n  } catch {\n    return false;\n  }\n}\n\nexport async function validateApiKey(\n  rawKey: string,\n  db: BaseAdapter,\n  userLookup?: (userId: string) => Promise<Partial<AuthUser> | null>,\n): Promise<ApiKeyValidationResult> {\n  if (!rawKey || typeof rawKey !== \"string\") {\n    return { valid: false, error: \"No API key provided\" };\n  }\n\n  if (!rawKey.startsWith(\"kyro_\")) {\n    return { valid: false, error: \"Invalid API key format\" };\n  }\n\n  const keyPrefix = generateKeyPrefix(rawKey);\n\n  try {\n    const result = await db.find({\n      collection: API_KEY_COLLECTION,\n      where: { keyPrefix: { equals: keyPrefix } },\n      limit: 100,\n      page: 1,\n    });\n\n    if (!result.docs || result.docs.length === 0) {\n      return { valid: false, error: \"Invalid API key\" };\n    }\n\n    let matchedKey: ApiKeyRecord | null = null;\n    for (const doc of result.docs) {\n      const record = doc as unknown as ApiKeyRecord;\n      if (constantTimeCompare(record.key, rawKey)) {\n        matchedKey = record;\n        break;\n      }\n    }\n\n    if (!matchedKey) {\n      return { valid: false, error: \"Invalid API key\" };\n    }\n\n    if (matchedKey.expiresAt) {\n      const expiresAt = new Date(matchedKey.expiresAt);\n      if (expiresAt < new Date()) {\n        return { valid: false, error: \"API key has expired\" };\n      }\n    }\n\n    try {\n      await db.update({\n        collection: API_KEY_COLLECTION,\n        id: matchedKey.id,\n        data: { lastUsedAt: new Date().toISOString() },\n      });\n    } catch {\n      // Non-critical: don't fail if lastUsedAt update fails\n    }\n\n    const user: Partial<AuthUser> = {\n      id: matchedKey.userId,\n      role: (matchedKey as any).role || \"author\",\n      tenantId: (matchedKey as any).tenantId,\n    };\n\n    if (userLookup) {\n      const dbUser = await userLookup(matchedKey.userId);\n      if (dbUser) {\n        Object.assign(user, dbUser);\n      }\n    }\n\n    return {\n      valid: true,\n      userId: matchedKey.userId,\n      user,\n      permissions: matchedKey.permissions || [],\n      apiKeyId: matchedKey.id,\n      tenantId: user.tenantId,\n      role: user.role,\n    };\n  } catch (error) {\n    console.error(\"[ApiKey] Validation error:\", error);\n    return { valid: false, error: \"Failed to validate API key\" };\n  }\n}\n\nexport function extractApiKeyFromRequest(request: Request): string | null {\n  const authHeader = request.headers.get(\"Authorization\");\n  if (authHeader) {\n    if (authHeader.startsWith(\"ApiKey \")) {\n      return authHeader.slice(7).trim();\n    }\n    if (authHeader.startsWith(\"Bearer \")) {\n      return null;\n    }\n  }\n\n  const xApiKey = request.headers.get(\"X-API-Key\");\n  if (xApiKey) {\n    return xApiKey.trim();\n  }\n\n  return null;\n}\n\nexport function createApiKeyContext(\n  result: ApiKeyValidationResult,\n): ApiKeyContext | null {\n  if (!result.valid || !result.userId) {\n    return null;\n  }\n  return {\n    userId: result.userId,\n    user: result.user || {},\n    permissions: result.permissions || [],\n    apiKeyId: result.apiKeyId || \"\",\n    tenantId: result.tenantId,\n    role: result.role,\n  };\n}\n\nexport function hasApiKeyPermission(\n  permissions: string[],\n  required: string,\n): boolean {\n  if (permissions.length === 0) return false;\n  if (permissions.includes(\"*\")) return true;\n  if (permissions.includes(required)) return true;\n\n  const [resource, action] = required.split(\":\");\n  if (permissions.includes(`${resource}:*`)) return true;\n\n  return false;\n}\n\nexport function generateApiKey(): string {\n  const chars = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n  let suffix = \"\";\n  for (let i = 0; i < 32; i++) {\n    suffix += chars[Math.floor(Math.random() * chars.length)];\n  }\n  return `kyro_${suffix}`;\n}\n\nexport function generateApiKeyPrefix(key: string): string {\n  return key.substring(0, 8);\n}\n"]}

package/dist/{chunk-OVZO4KB6.cjs → chunk-3P5AHK2U.cjs}

@@ -1,12 +1,14 @@
 'use strict';
 
 var chunk3KTWGODI_cjs = require('./chunk-3KTWGODI.cjs');
-var chunkW3GT55TY_cjs = require('./chunk-W3GT55TY.cjs');
-var chunkPF642V5O_cjs = require('./chunk-PF642V5O.cjs');
-var chunk2CBCU5ML_cjs = require('./chunk-2CBCU5ML.cjs');
-var chunkZ7OH3MWT_cjs = require('./chunk-Z7OH3MWT.cjs');
-var chunkKGJRJ7CU_cjs = require('./chunk-KGJRJ7CU.cjs');
+var chunkTQG7G7YI_cjs = require('./chunk-TQG7G7YI.cjs');
+var chunkN4GN6Q3V_cjs = require('./chunk-N4GN6Q3V.cjs');
+var chunkISKYUUP4_cjs = require('./chunk-ISKYUUP4.cjs');
+var chunkLNTFRAHF_cjs = require('./chunk-LNTFRAHF.cjs');
+var chunk4OCMVGEY_cjs = require('./chunk-4OCMVGEY.cjs');
 var chunkEEJUFDMF_cjs = require('./chunk-EEJUFDMF.cjs');
+var chunkGYIJ3JJM_cjs = require('./chunk-GYIJ3JJM.cjs');
+var chunkDPA3KWPY_cjs = require('./chunk-DPA3KWPY.cjs');
 var chunkGUUB5EAG_cjs = require('./chunk-GUUB5EAG.cjs');
 var zod = require('zod');
 var graphqlYoga = require('graphql-yoga');
@@ -778,7 +780,7 @@ function globalToUpdateZod(global) {
 
 // src/registry/index.ts
 var Registry = class {
-  storageProviders = chunk2CBCU5ML_cjs.getDefaultRegistry();
+  storageProviders = chunkISKYUUP4_cjs.getDefaultRegistry();
   collections = /* @__PURE__ */ new Map();
   globals = /* @__PURE__ */ new Map();
   plugins = [];
@@ -1319,7 +1321,7 @@ var s3StoragePlugin = {
         configFields: v.configFields,
         extractConfig: (sc) => buildS3ConfigFromStorageConfig(v.type, v, sc),
         extractRawConfig: (raw) => buildS3ConfigFromRaw(v.type, v, raw),
-        factory: (c) => chunk2CBCU5ML_cjs.createS3Storage(c)
+        factory: (c) => chunkISKYUUP4_cjs.createS3Storage(c)
       });
     }
   }
@@ -1367,7 +1369,7 @@ var cloudinaryStoragePlugin = {
           uploadPreset: cl?.uploadPreset
         };
       },
-      factory: (c) => chunk2CBCU5ML_cjs.createCloudinaryStorage(c)
+      factory: (c) => chunkISKYUUP4_cjs.createCloudinaryStorage(c)
     });
   }
 };
@@ -1417,7 +1419,7 @@ var ftpStoragePlugin = {
           type: "ftp"
         };
       },
-      factory: (c) => chunk2CBCU5ML_cjs.createFtpStorage(c)
+      factory: (c) => chunkISKYUUP4_cjs.createFtpStorage(c)
     });
   }
 };
@@ -1477,7 +1479,7 @@ var Kyro = class {
     this.registry = createRegistry();
     this.db = config.adapter;
     this.pubsub = new chunkEEJUFDMF_cjs.KyroPubSub(this.registry);
-    this.webhookService = chunkZ7OH3MWT_cjs.createWebhookService(this.db);
+    this.webhookService = chunkLNTFRAHF_cjs.createWebhookService(this.db);
     if (config.collections && config.admin?.collectionOverrides) {
       applyCollectionOverrides(config.collections, config.admin.collectionOverrides);
     }
@@ -1515,7 +1517,7 @@ var Kyro = class {
       );
     }
     const systemCollection = {
-      slug: chunkKGJRJ7CU_cjs.API_KEY_COLLECTION,
+      slug: chunk4OCMVGEY_cjs.API_KEY_COLLECTION,
       fields: [
         { name: "userId", type: "text", required: true },
         { name: "name", type: "text", required: true },
@@ -1527,7 +1529,7 @@ var Kyro = class {
       ]
     };
     const webhookCollection = {
-      slug: chunkZ7OH3MWT_cjs.WEBHOOK_COLLECTION,
+      slug: chunkLNTFRAHF_cjs.WEBHOOK_COLLECTION,
       fields: [
         { name: "name", type: "text", required: true },
         { name: "url", type: "text", required: true },
@@ -1540,7 +1542,7 @@ var Kyro = class {
       ]
     };
     const webhookDeliveryCollection = {
-      slug: chunkZ7OH3MWT_cjs.WEBHOOK_DELIVERY_COLLECTION,
+      slug: chunkLNTFRAHF_cjs.WEBHOOK_DELIVERY_COLLECTION,
       fields: [
         { name: "webhookId", type: "text", required: true },
         { name: "event", type: "text", required: true },
@@ -1556,6 +1558,13 @@ var Kyro = class {
       ]
     };
     const allGlobals = this.registry.getGlobals();
+    if (this.db instanceof chunkGYIJ3JJM_cjs.DrizzleAdapter && this.db.dialect === "postgres") {
+      const drizzle = this.db;
+      const tableName = chunk4OCMVGEY_cjs.API_KEY_COLLECTION.replace(/-/g, "_");
+      if (!drizzle.schema[tableName]) {
+        drizzle.schema[tableName] = chunkDPA3KWPY_cjs.apiKeys;
+      }
+    }
     await this.db.init(
       [
         ...this.registry.getCollections(),
@@ -1567,9 +1576,6 @@ var Kyro = class {
     );
     await this.loadPluginState();
     this.pubsub.autoRegisterHooks();
-    console.log("\u2705 Kyro CMS initialized");
-    console.log(`   Collections: ${this.registry.getCollections().length}`);
-    console.log(`   Globals: ${allGlobals.length}`);
   }
   // ============================================================================
   // API Methods
@@ -1586,7 +1592,6 @@ var Kyro = class {
         this.settings = { access: doc };
       }
     } catch (e) {
-      console.log("\u26A0\uFE0F No access-settings found, using defaults");
     }
     return this.settings || {};
   }
@@ -1614,7 +1619,7 @@ var Kyro = class {
     const authObj = typeof this.config.auth === "object" ? this.config.auth : null;
     const authSecret = authObj?.secret;
     const checkSession = authObj?.checkSession !== false;
-    return chunk2CBCU5ML_cjs.createHonoApp({
+    return chunkISKYUUP4_cjs.createHonoApp({
       registry: this.registry,
       db: this.db,
       authSecret,
@@ -1627,7 +1632,7 @@ var Kyro = class {
     });
   }
   getGraphQL(options) {
-    const schema = chunkPF642V5O_cjs.buildGraphQLSchema({
+    const schema = chunkN4GN6Q3V_cjs.buildGraphQLSchema({
       registry: this.registry,
       db: this.db,
       settings: this.settings
@@ -1635,14 +1640,14 @@ var Kyro = class {
     const yoga = graphqlYoga.createYoga({
       schema,
       context: async ({ request }) => {
-        const apiKeyRaw = chunkKGJRJ7CU_cjs.extractApiKeyFromRequest(request);
+        const apiKeyRaw = chunk4OCMVGEY_cjs.extractApiKeyFromRequest(request);
         let gqlUser;
         let apiKeyCtx;
         if (apiKeyRaw && this.db) {
-          const apiKeyResult = await chunkKGJRJ7CU_cjs.validateApiKey(apiKeyRaw, this.db);
+          const apiKeyResult = await chunk4OCMVGEY_cjs.validateApiKey(apiKeyRaw, this.db);
           if (apiKeyResult.user) {
             gqlUser = apiKeyResult.user;
-            apiKeyCtx = chunkKGJRJ7CU_cjs.createApiKeyContext(apiKeyResult);
+            apiKeyCtx = chunk4OCMVGEY_cjs.createApiKeyContext(apiKeyResult);
           }
         }
         const tenantID = options?.tenantID;
@@ -1653,7 +1658,7 @@ var Kyro = class {
           req: request,
           tenantID,
           apiKey: apiKeyCtx,
-          relationLoader: new chunkPF642V5O_cjs.RelationLoader({ db: this.db, tenantID, user: gqlUser })
+          relationLoader: new chunkN4GN6Q3V_cjs.RelationLoader({ db: this.db, tenantID, user: gqlUser })
         };
       },
       graphiql: false,
@@ -1684,7 +1689,7 @@ var Kyro = class {
             { status: 400, headers: { "Content-Type": "application/json" } }
           );
         }
-        const ctx = await chunkW3GT55TY_cjs.createContext({
+        const ctx = await chunkTQG7G7YI_cjs.createContext({
           db: this.db,
           registry: this.registry,
           req: request,
@@ -1692,7 +1697,7 @@ var Kyro = class {
           tenantID: options?.tenantID,
           settings: this.settings
         });
-        const kyroRouter = chunkW3GT55TY_cjs.createKyroServer(ctx);
+        const kyroRouter = chunkTQG7G7YI_cjs.createKyroServer(ctx);
         const collectionRouter = kyroRouter[slug];
         if (!collectionRouter) {
           return new Response(
@@ -1766,11 +1771,10 @@ var Kyro = class {
   async startWebSocket(options) {
     const apiAccess = this.settings?.access?.apiAccess;
     if (apiAccess?.wsEnabled === false) {
-      console.log("\u26A0\uFE0F WebSocket is disabled in settings");
       return null;
     }
     const defaultVerifyToken = async (token) => {
-      const result = await chunkKGJRJ7CU_cjs.validateApiKey(token, this.db);
+      const result = await chunk4OCMVGEY_cjs.validateApiKey(token, this.db);
       if (!result.valid) throw new Error(result.error || "Invalid API key");
       if (!result.user) throw new Error("API key has no associated user");
       return result.user;
@@ -1781,7 +1785,6 @@ var Kyro = class {
       requireAuth: options?.requireAuth ?? apiAccess?.requireAuth,
       verifyToken: options?.verifyToken || defaultVerifyToken
     });
-    console.log(`\u{1F50C} WebSocket server started on port ${options?.port || 8080}`);
     return this.wsServer;
   }
   // ============================================================================
@@ -1792,13 +1795,12 @@ var Kyro = class {
       await this.wsServer.close();
     }
     await this.db.disconnect();
-    console.log("\u{1F44B} Kyro CMS shut down");
   }
 };
 function createKyro(config) {
   return new Kyro(config);
 }
-var _require = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-OVZO4KB6.cjs', document.baseURI).href)));
+var _require = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-3P5AHK2U.cjs', document.baseURI).href)));
 var modPath = "node:sqlite";
 var { DatabaseSync } = _require(modPath);
 function flattenFields(fields) {
@@ -1947,16 +1949,12 @@ var LocalAdapter = class extends chunkGUUB5EAG_cjs.AbstractBaseAdapter {
     this.db.exec("PRAGMA journal_mode = WAL");
     this.db.exec("PRAGMA foreign_keys = ON");
     this.connected = true;
-    console.log(
-      `[LocalAdapter] Connected to SQLite (${this.path || "memory"})`
-    );
   }
   async disconnect() {
     if (this.db) {
       this.db.close();
     }
     this.connected = false;
-    console.log("[LocalAdapter] Disconnected");
   }
   // ========================================================================
   // Schema Management
@@ -2692,10 +2690,8 @@ var LocalAdapter = class extends chunkGUUB5EAG_cjs.AbstractBaseAdapter {
     for (const config of this.collections.values()) {
       this.ensureTable(config);
     }
-    console.log("[LocalAdapter] Migrations complete");
   }
   async rollback() {
-    console.log("[LocalAdapter] Rollback not supported for schema changes");
   }
   // ========================================================================
   // Transaction Support
@@ -2749,5 +2745,5 @@ exports.validateCollection = validateCollection;
 exports.validateConfig = validateConfig;
 exports.validateFields = validateFields;
 exports.validateGlobal = validateGlobal;
-//# sourceMappingURL=chunk-OVZO4KB6.cjs.map
-//# sourceMappingURL=chunk-OVZO4KB6.cjs.map
+//# sourceMappingURL=chunk-3P5AHK2U.cjs.map
+//# sourceMappingURL=chunk-3P5AHK2U.cjs.map