@kyro-cms/core 0.9.8 → 0.10.0

package/dist/{chunk-KGJRJ7CU.cjs → chunk-4OCMVGEY.cjs}

@@ -1,6 +1,5 @@
 'use strict';
 
-var chunkNKPKR5BW_cjs = require('./chunk-NKPKR5BW.cjs');
 var crypto = require('crypto');
 
 // src/access/types.ts
@@ -29,7 +28,7 @@ function getWhereClause(access, args) {
     return result;
   });
 }
-var API_KEY_COLLECTION = "_api_keys";
+var API_KEY_COLLECTION = "api_keys";
 function generateKeyPrefix(key) {
   return key.substring(0, 8);
 }
@@ -160,120 +159,15 @@ function generateApiKeyPrefix(key) {
   return key.substring(0, 8);
 }
 
-// src/access/checker.ts
-function actionToPermission(operation) {
-  if (operation === "read") return "read";
-  if (operation === "create") return "create";
-  if (operation === "update") return "update";
-  return "delete";
-}
-function isDefaultAllowed(operation, defaultAccess) {
-  const levels = {
-    none: false,
-    read: operation === "read",
-    create: operation === "read" || operation === "create",
-    update: operation === "read" || operation === "create" || operation === "update",
-    delete: operation === "read" || operation === "create" || operation === "update" || operation === "delete",
-    admin: true
-  };
-  return levels[defaultAccess] || false;
-}
-async function checkCollectionAccess(config, operation, context, options = {}) {
-  const { user, req, tenantID, apiKey } = context;
-  const { enablePublicAccess = true, defaultAccess = "none" } = options;
-  const accessRule = config.access?.[operation];
-  if (accessRule) {
-    const allowed = await evaluateAccess(accessRule, {
-      req,
-      user,
-      tenantID
-    });
-    if (allowed === false) {
-      return { allowed: false, error: "Access denied", status: 403 };
-    }
-    if (typeof allowed === "object") {
-      return { allowed: true, extraWhere: allowed };
-    }
-    return { allowed: true };
-  }
-  if (apiKey?.permissions?.length > 0) {
-    const resource = config.slug;
-    const action = actionToPermission(operation);
-    const permission = `${resource}:${action}`;
-    if (!hasApiKeyPermission(apiKey.permissions, permission) && !hasApiKeyPermission(apiKey.permissions, `${resource}:admin`)) {
-      return { allowed: false, error: "Access denied: insufficient permissions", status: 403 };
-    }
-    return { allowed: true };
-  }
-  if (user) {
-    const resource = config.slug;
-    const action = actionToPermission(operation);
-    const permission = `${resource}:${action}`;
-    const userHas = chunkNKPKR5BW_cjs.hasPermission(
-      { id: user.id, email: user.email, role: user.role },
-      permission
-    );
-    const adminHas = chunkNKPKR5BW_cjs.hasPermission(
-      { id: user.id, email: user.email, role: user.role },
-      `${resource}:admin`
-    );
-    if (userHas || adminHas) {
-      return { allowed: true };
-    }
-    return { allowed: false, error: "Access denied: missing RBAC permission", status: 403 };
-  }
-  const defaultAllowed = isDefaultAllowed(operation, defaultAccess);
-  if (enablePublicAccess && defaultAllowed) {
-    return { allowed: true };
-  }
-  return { allowed: false, error: "Authentication required", status: 401 };
-}
-async function checkGlobalAccess(config, operation, context, options = {}) {
-  const { user, req, tenantID } = context;
-  const { enablePublicAccess = true } = options;
-  const accessRule = config.access?.[operation];
-  if (accessRule) {
-    const allowed = await evaluateAccess(accessRule, {
-      req,
-      user,
-      tenantID
-    });
-    if (allowed === false) {
-      return { allowed: false, error: "Access denied", status: 403 };
-    }
-    return { allowed: true };
-  }
-  if (user) {
-    const permission = `globals:${operation}`;
-    const userHas = chunkNKPKR5BW_cjs.hasPermission(
-      { id: user.id, email: user.email, role: user.role },
-      permission
-    );
-    const adminHas = chunkNKPKR5BW_cjs.hasPermission(
-      { id: user.id, email: user.email, role: user.role },
-      "globals:admin"
-    );
-    if (userHas || adminHas) {
-      return { allowed: true };
-    }
-    return { allowed: false, error: "Access denied: missing RBAC permission", status: 403 };
-  }
-  if (enablePublicAccess) {
-    return { allowed: true };
-  }
-  return { allowed: false, error: "Authentication required", status: 401 };
-}
-
 exports.API_KEY_COLLECTION = API_KEY_COLLECTION;
-exports.checkCollectionAccess = checkCollectionAccess;
-exports.checkGlobalAccess = checkGlobalAccess;
 exports.createApiKeyContext = createApiKeyContext;
 exports.evaluateAccess = evaluateAccess;
 exports.extractApiKeyFromRequest = extractApiKeyFromRequest;
 exports.generateApiKey = generateApiKey;
 exports.generateApiKeyPrefix = generateApiKeyPrefix;
 exports.getWhereClause = getWhereClause;
+exports.hasApiKeyPermission = hasApiKeyPermission;
 exports.mergeWhereClauses = mergeWhereClauses;
 exports.validateApiKey = validateApiKey;
-//# sourceMappingURL=chunk-KGJRJ7CU.cjs.map
-//# sourceMappingURL=chunk-KGJRJ7CU.cjs.map
+//# sourceMappingURL=chunk-4OCMVGEY.cjs.map
+//# sourceMappingURL=chunk-4OCMVGEY.cjs.map

package/dist/chunk-4OCMVGEY.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access/types.ts","../src/auth/api-key.ts"],"names":["timingSafeEqual"],"mappings":";;;;;AA+CA,eAAsB,cAAA,CACpB,QACA,IAAA,EACgC;AAChC,EAAA,IAAI,OAAO,WAAW,SAAA,EAAW;AAC/B,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,WAAW,UAAA,EAAY;AAChC,IAAA,OAAO,MAAM,OAAO,IAAI,CAAA;AAAA,EAC1B;AACA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,qBACX,YAAA,EACU;AACb,EAAA,MAAM,SAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,UAAU,YAAA,EAAc;AACjC,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACxC,MAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,IAC9B;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,cAAA,CACd,QACA,IAAA,EACkC;AAClC,EAAA,OAAO,cAAA,CAAe,MAAA,EAAQ,IAAI,CAAA,CAAE,KAAK,CAAA,MAAA,KAAU;AACjD,IAAA,IAAI,MAAA,KAAW,MAAM,OAAO,MAAA;AAC5B,IAAA,IAAI,MAAA,KAAW,OAAO,OAAO,EAAE,KAAK,EAAE,GAAA,EAAK,MAAK,EAAE;AAClD,IAAA,OAAO,MAAA;AAAA,EACT,CAAC,CAAA;AACH;AC7CO,IAAM,kBAAA,GAAqB;AAElC,SAAS,kBAAkB,GAAA,EAAqB;AAC9C,EAAA,OAAO,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AAC3B;AAEA,SAAS,mBAAA,CAAoB,GAAW,CAAA,EAAoB;AAC1D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAOA,sBAAA,CAAgB,OAAO,IAAA,CAAK,CAAC,GAAG,MAAA,CAAO,IAAA,CAAK,CAAC,CAAC,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,eAAsB,cAAA,CACpB,MAAA,EACA,EAAA,EACA,UAAA,EACiC;AACjC,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,EACtD;AAEA,EAAA,IAAI,CAAC,MAAA,CAAO,UAAA,CAAW,OAAO,CAAA,EAAG;AAC/B,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,wBAAA,EAAyB;AAAA,EACzD;AAEA,EAAA,MAAM,SAAA,GAAY,kBAAkB,MAAM,CAAA;AAE1C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,IAAA,CAAK;AAAA,MAC3B,UAAA,EAAY,kBAAA;AAAA,MACZ,OAAO,EAAE,SAAA,EAAW,EAAE,MAAA,EAAQ,WAAU,EAAE;AAAA,MAC1C,KAAA,EAAO,GAAA;AAAA,MACP,IAAA,EAAM;AAAA,KACP,CAAA;AAED,IAAA,IAAI,CAAC,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA,EAAG;AAC5C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,iBAAA,EAAkB;AAAA,IAClD;AAEA,IAAA,IAAI,UAAA,GAAkC,IAAA;AACtC,IAAA,KAAA,MAAW,GAAA,IAAO,OAAO,IAAA,EAAM;AAC7B,MAAA,MAAM,MAAA,GAAS,GAAA;AACf,MAAA,IAAI,mBAAA,CAAoB,MAAA,CAAO,GAAA,EAAK,MAAM,CAAA,EAAG;AAC3C,QAAA,UAAA,GAAa,MAAA;AACb,QAAA;AAAA,MACF;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,iBAAA,EAAkB;AAAA,IAClD;AAEA,IAAA,IAAI,WAAW,SAAA,EAAW;AACxB,MAAA,MAAM,SAAA,GAAY,IAAI,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA;AAC/C,MAAA,IAAI,SAAA,mBAAY,IAAI,IAAA,EAAK,EAAG;AAC1B,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,qBAAA,EAAsB;AAAA,MACtD;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,GAAG,MAAA,CAAO;AAAA,QACd,UAAA,EAAY,kBAAA;AAAA,QACZ,IAAI,UAAA,CAAW,EAAA;AAAA,QACf,MAAM,EAAE,UAAA,EAAA,qBAAgB,IAAA,EAAK,EAAE,aAAY;AAAE,OAC9C,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,MAAM,IAAA,GAA0B;AAAA,MAC9B,IAAI,UAAA,CAAW,MAAA;AAAA,MACf,IAAA,EAAO,WAAmB,IAAA,IAAQ,QAAA;AAAA,MAClC,UAAW,UAAA,CAAmB;AAAA,KAChC;AAEA,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,UAAA,CAAW,MAAM,CAAA;AACjD,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAA,CAAO,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,MAC5B;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,IAAA;AAAA,MACP,QAAQ,UAAA,CAAW,MAAA;AAAA,MACnB,IAAA;AAAA,MACA,WAAA,EAAa,UAAA,CAAW,WAAA,IAAe,EAAC;AAAA,MACxC,UAAU,UAAA,CAAW,EAAA;AAAA,MACrB,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,MAAM,IAAA,CAAK;AAAA,KACb;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,8BAA8B,KAAK,CAAA;AACjD,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,4BAAA,EAA6B;AAAA,EAC7D;AACF;AAEO,SAAS,yBAAyB,OAAA,EAAiC;AACxE,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AACtD,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,IAAI,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpC,MAAA,OAAO,UAAA,CAAW,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,EAAK;AAAA,IAClC;AACA,IAAA,IAAI,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AAC/C,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,OAAO,QAAQ,IAAA,EAAK;AAAA,EACtB;AAEA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,oBACd,MAAA,EACsB;AACtB,EAAA,IAAI,CAAC,MAAA,CAAO,KAAA,IAAS,CAAC,OAAO,MAAA,EAAQ;AACnC,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,IAAA,EAAM,MAAA,CAAO,IAAA,IAAQ,EAAC;AAAA,IACtB,WAAA,EAAa,MAAA,CAAO,WAAA,IAAe,EAAC;AAAA,IACpC,QAAA,EAAU,OAAO,QAAA,IAAY,EAAA;AAAA,IAC7B,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,MAAM,MAAA,CAAO;AAAA,GACf;AACF;AAEO,SAAS,mBAAA,CACd,aACA,QAAA,EACS;AACT,EAAA,IAAI,WAAA,CAAY,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AACrC,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,GAAG,CAAA,EAAG,OAAO,IAAA;AACtC,EAAA,IAAI,WAAA,CAAY,QAAA,CAAS,QAAQ,CAAA,EAAG,OAAO,IAAA;AAE3C,EAAA,MAAM,CAAC,QAAA,EAAU,MAAM,CAAA,GAAI,QAAA,CAAS,MAAM,GAAG,CAAA;AAC7C,EAAA,IAAI,YAAY,QAAA,CAAS,CAAA,EAAG,QAAQ,CAAA,EAAA,CAAI,GAAG,OAAO,IAAA;AAElD,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,cAAA,GAAyB;AACvC,EAAA,MAAM,KAAA,GAAQ,sCAAA;AACd,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,CAAA,EAAA,EAAK;AAC3B,IAAA,MAAA,IAAU,KAAA,CAAM,KAAK,KAAA,CAAM,IAAA,CAAK,QAAO,GAAI,KAAA,CAAM,MAAM,CAAC,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,QAAQ,MAAM,CAAA,CAAA;AACvB;AAEO,SAAS,qBAAqB,GAAA,EAAqB;AACxD,EAAA,OAAO,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AAC3B","file":"chunk-4OCMVGEY.cjs","sourcesContent":["import type { User, Request } from '../hooks/types.js';\n\n// ============================================================================\n// Access Control Types\n// ============================================================================\n\nexport interface WhereClause {\n  [field: string]: any;\n}\n\nexport interface AccessArgs {\n  req: Request;\n  user?: User;\n  data?: unknown;\n  doc?: unknown;\n  id?: string;\n  tenantID?: string;\n  context?: Record<string, unknown>;\n}\n\nexport type AccessControl = boolean | ((args: AccessArgs) => Promise<boolean | WhereClause> | boolean | WhereClause);\n\nexport interface CollectionAccess {\n  create?: AccessControl;\n  read?: AccessControl;\n  update?: AccessControl;\n  delete?: AccessControl;\n  admin?: AccessControl;\n  unlock?: AccessControl;\n  readVersions?: AccessControl;\n}\n\nexport interface GlobalAccess {\n  read?: AccessControl;\n  update?: AccessControl;\n}\n\nexport interface FieldAccess {\n  create?: AccessControl;\n  read?: AccessControl;\n  update?: AccessControl;\n}\n\n// ============================================================================\n// Access Control Evaluation\n// ============================================================================\n\nexport async function evaluateAccess(\n  access: AccessControl,\n  args: AccessArgs\n): Promise<boolean | WhereClause> {\n  if (typeof access === 'boolean') {\n    return access;\n  }\n  if (typeof access === 'function') {\n    return await access(args);\n  }\n  return true;\n}\n\nexport function mergeWhereClauses(\n  ...whereClauses: (WhereClause | boolean | undefined)[]\n): WhereClause {\n  const result: WhereClause = {};\n  for (const clause of whereClauses) {\n    if (clause && typeof clause === 'object') {\n      Object.assign(result, clause);\n    }\n  }\n  return result;\n}\n\nexport function getWhereClause(\n  access: AccessControl,\n  args: AccessArgs\n): Promise<WhereClause | undefined> {\n  return evaluateAccess(access, args).then(result => {\n    if (result === true) return undefined;\n    if (result === false) return { _id: { $eq: null } };\n    return result;\n  });\n}\n","import { timingSafeEqual } from \"crypto\";\nimport type { BaseAdapter } from \"../registry/types.js\";\nimport type { AuthUser, UserRole } from \"./types.js\";\n\nexport interface ApiKeyRecord {\n  id: string;\n  userId: string;\n  name: string;\n  key: string;\n  keyPrefix: string;\n  permissions: string[];\n  lastUsedAt?: string;\n  expiresAt?: string;\n  createdAt: string;\n}\n\nexport interface ApiKeyValidationResult {\n  valid: boolean;\n  userId?: string;\n  user?: Partial<AuthUser>;\n  permissions?: string[];\n  apiKeyId?: string;\n  error?: string;\n  tenantId?: string;\n  role?: UserRole;\n}\n\nexport interface ApiKeyContext {\n  userId: string;\n  user: Partial<AuthUser>;\n  permissions: string[];\n  apiKeyId: string;\n  tenantId?: string;\n  role?: UserRole;\n}\n\nexport const API_KEY_COLLECTION = \"api_keys\";\n\nfunction generateKeyPrefix(key: string): string {\n  return key.substring(0, 8);\n}\n\nfunction constantTimeCompare(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  try {\n    return timingSafeEqual(Buffer.from(a), Buffer.from(b));\n  } catch {\n    return false;\n  }\n}\n\nexport async function validateApiKey(\n  rawKey: string,\n  db: BaseAdapter,\n  userLookup?: (userId: string) => Promise<Partial<AuthUser> | null>,\n): Promise<ApiKeyValidationResult> {\n  if (!rawKey || typeof rawKey !== \"string\") {\n    return { valid: false, error: \"No API key provided\" };\n  }\n\n  if (!rawKey.startsWith(\"kyro_\")) {\n    return { valid: false, error: \"Invalid API key format\" };\n  }\n\n  const keyPrefix = generateKeyPrefix(rawKey);\n\n  try {\n    const result = await db.find({\n      collection: API_KEY_COLLECTION,\n      where: { keyPrefix: { equals: keyPrefix } },\n      limit: 100,\n      page: 1,\n    });\n\n    if (!result.docs || result.docs.length === 0) {\n      return { valid: false, error: \"Invalid API key\" };\n    }\n\n    let matchedKey: ApiKeyRecord | null = null;\n    for (const doc of result.docs) {\n      const record = doc as unknown as ApiKeyRecord;\n      if (constantTimeCompare(record.key, rawKey)) {\n        matchedKey = record;\n        break;\n      }\n    }\n\n    if (!matchedKey) {\n      return { valid: false, error: \"Invalid API key\" };\n    }\n\n    if (matchedKey.expiresAt) {\n      const expiresAt = new Date(matchedKey.expiresAt);\n      if (expiresAt < new Date()) {\n        return { valid: false, error: \"API key has expired\" };\n      }\n    }\n\n    try {\n      await db.update({\n        collection: API_KEY_COLLECTION,\n        id: matchedKey.id,\n        data: { lastUsedAt: new Date().toISOString() },\n      });\n    } catch {\n      // Non-critical: don't fail if lastUsedAt update fails\n    }\n\n    const user: Partial<AuthUser> = {\n      id: matchedKey.userId,\n      role: (matchedKey as any).role || \"author\",\n      tenantId: (matchedKey as any).tenantId,\n    };\n\n    if (userLookup) {\n      const dbUser = await userLookup(matchedKey.userId);\n      if (dbUser) {\n        Object.assign(user, dbUser);\n      }\n    }\n\n    return {\n      valid: true,\n      userId: matchedKey.userId,\n      user,\n      permissions: matchedKey.permissions || [],\n      apiKeyId: matchedKey.id,\n      tenantId: user.tenantId,\n      role: user.role,\n    };\n  } catch (error) {\n    console.error(\"[ApiKey] Validation error:\", error);\n    return { valid: false, error: \"Failed to validate API key\" };\n  }\n}\n\nexport function extractApiKeyFromRequest(request: Request): string | null {\n  const authHeader = request.headers.get(\"Authorization\");\n  if (authHeader) {\n    if (authHeader.startsWith(\"ApiKey \")) {\n      return authHeader.slice(7).trim();\n    }\n    if (authHeader.startsWith(\"Bearer \")) {\n      return null;\n    }\n  }\n\n  const xApiKey = request.headers.get(\"X-API-Key\");\n  if (xApiKey) {\n    return xApiKey.trim();\n  }\n\n  return null;\n}\n\nexport function createApiKeyContext(\n  result: ApiKeyValidationResult,\n): ApiKeyContext | null {\n  if (!result.valid || !result.userId) {\n    return null;\n  }\n  return {\n    userId: result.userId,\n    user: result.user || {},\n    permissions: result.permissions || [],\n    apiKeyId: result.apiKeyId || \"\",\n    tenantId: result.tenantId,\n    role: result.role,\n  };\n}\n\nexport function hasApiKeyPermission(\n  permissions: string[],\n  required: string,\n): boolean {\n  if (permissions.length === 0) return false;\n  if (permissions.includes(\"*\")) return true;\n  if (permissions.includes(required)) return true;\n\n  const [resource, action] = required.split(\":\");\n  if (permissions.includes(`${resource}:*`)) return true;\n\n  return false;\n}\n\nexport function generateApiKey(): string {\n  const chars = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n  let suffix = \"\";\n  for (let i = 0; i < 32; i++) {\n    suffix += chars[Math.floor(Math.random() * chars.length)];\n  }\n  return `kyro_${suffix}`;\n}\n\nexport function generateApiKeyPrefix(key: string): string {\n  return key.substring(0, 8);\n}\n"]}

package/dist/{chunk-EQTMBMDR.js → chunk-526M5MOA.js}

@@ -1,9 +1,9 @@
-import { createKyro, LocalAdapter } from './chunk-ZFHTJ2YX.js';
-import { autoBootstrap } from './chunk-GAAHG2Z4.js';
+import { createKyro, LocalAdapter } from './chunk-AN2L2CJZ.js';
+import { autoBootstrap } from './chunk-HY6B7B5A.js';
 import { SQLiteAuthAdapter } from './chunk-Q72BOAPK.js';
-import { DrizzleAdapter } from './chunk-V7KZQIZ6.js';
+import { DrizzleAdapter } from './chunk-XHAAAEXX.js';
 import { PostgresAuthAdapter } from './chunk-CJX74IYK.js';
-import { MongoDBAdapter } from './chunk-PQ72Z6WC.js';
+import { MongoDBAdapter } from './chunk-GZS4LMR7.js';
 import { MongoDBAuthAdapter } from './chunk-7OGPN7MP.js';
 import projectConfig from 'kyro:config';
 
@@ -36,7 +36,6 @@ async function doInit() {
     }
     const result = await autoBootstrap(bootstrapAuthAdapter);
     if (result?.success) {
-      console.log(`[Kyro] Admin user auto-created from env: ${result.user?.email}`);
     }
     if (typeof kyroInstance.startWebSocket === "function") {
       kyroInstance.startWebSocket().catch((err) => {
@@ -44,7 +43,6 @@ async function doInit() {
       });
     }
     globalThis.__KYRO_INSTANCE__ = kyroInstance;
-    console.log("[Kyro API] Backend initialized via Astro Integration");
   } catch (err) {
     kyroInstance = null;
     initPromise = null;
@@ -83,10 +81,23 @@ var ALL = async (context) => {
       });
     }
   }
+  const url = new URL(context.request.url);
+  const path = url.pathname;
+  const p = __KYRO_API_PATH__;
+  if (path === `${p}/graphql` && typeof kyroInstance.getGraphQL === "function") {
+    const yoga = kyroInstance.getGraphQL();
+    const res = await yoga.fetch(context.request, context.locals);
+    return new Response(res.body, res);
+  }
+  if (path.startsWith(`${p}/trpc/`) && typeof kyroInstance.getTRPC === "function") {
+    const trpc = kyroInstance.getTRPC();
+    const res = await trpc.fetch(context.request, context.locals);
+    return new Response(res.body, res);
+  }
   const app = kyroInstance.getREST();
   return app.fetch(context.request, context.locals);
 };
 
 export { ALL, kyroInstance, warmKyroInstance };
-//# sourceMappingURL=chunk-EQTMBMDR.js.map
-//# sourceMappingURL=chunk-EQTMBMDR.js.map
+//# sourceMappingURL=chunk-526M5MOA.js.map
+//# sourceMappingURL=chunk-526M5MOA.js.map

package/dist/chunk-526M5MOA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/api-handler.ts"],"names":[],"mappings":";;;;;;;;;AAcO,IAAI,YAAA,GAAoB;AAC/B,IAAI,WAAA,GAAoC,IAAA;AAExC,eAAe,MAAA,GAAwB;AACrC,EAAA,IAAI,YAAA,EAAc;AAElB,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,cAAc,OAAA,IAAW,aAAA;AACxC,IAAA,YAAA,GAAe,WAAW,MAAM,CAAA;AAChC,IAAA,MAAM,aAAa,IAAA,EAAK;AACxB,IAAA,MAAM,aAAa,YAAA,EAAa;AAEhC,IAAA,MAAM,KAAK,YAAA,CAAa,EAAA;AACxB,IAAA,IAAI,oBAAA,GAA4B,KAAA,CAAA;AAEhC,IAAA,IAAI,cAAc,cAAA,EAAgB;AAChC,MAAA,IAAI,EAAA,CAAG,YAAY,UAAA,EAAY;AAC7B,QAAA,oBAAA,GAAuB,IAAI,mBAAA,CAAoB,EAAE,EAAA,EAAI,EAAA,CAAG,QAAQ,CAAA;AAAA,MAClE,CAAA,MAAA,IAAW,EAAA,CAAG,OAAA,KAAY,QAAA,EAAU;AAClC,QAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,CAAI,iBAAA,IAAqB,gBAAA;AACpD,QAAA,oBAAA,GAAuB,IAAI,iBAAA,CAAkB,EAAE,IAAA,EAAM,YAAY,CAAA;AAAA,MACnE;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,YAAA,EAAc;AACrC,MAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,CAAI,iBAAA,IAAqB,gBAAA;AACpD,MAAA,oBAAA,GAAuB,IAAI,iBAAA,CAAkB,EAAE,IAAA,EAAM,YAAY,CAAA;AAAA,IACnE,CAAA,MAAA,IAAW,cAAc,cAAA,EAAgB;AACvC,MAAA,oBAAA,GAAuB,IAAI,kBAAA,CAAmB,EAAE,EAAA,EAAI,EAAA,CAAG,IAAI,CAAA;AAAA,IAC7D;AAEA,IAAA,IAAI,sBAAsB,OAAA,EAAS;AACjC,MAAA,MAAM,qBAAqB,OAAA,EAAQ;AAAA,IACrC;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,oBAAoB,CAAA;AACvD,IAAA,IAAI,QAAQ,OAAA,EAAS;AAAA,IACrB;AAGA,IAAA,IAAI,OAAO,YAAA,CAAa,cAAA,KAAmB,UAAA,EAAY;AACrD,MAAA,YAAA,CAAa,cAAA,EAAe,CAAE,KAAA,CAAM,CAAC,GAAA,KAAa;AAChD,QAAA,OAAA,CAAQ,KAAA,CAAM,uCAAuC,GAAG,CAAA;AAAA,MAC1D,CAAC,CAAA;AAAA,IACH;AAGA,IAAC,WAAmB,iBAAA,GAAoB,YAAA;AAAA,EAE1C,SAAS,GAAA,EAAK;AACZ,IAAA,YAAA,GAAe,IAAA;AACf,IAAA,WAAA,GAAc,IAAA;AACd,IAAA,OAAA,CAAQ,KAAA,CAAM,uCAAuC,GAAG,CAAA;AACxD,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAEA,eAAsB,gBAAA,GAAkC;AACtD,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,WAAA,GAAc,MAAA,EAAO;AAAA,EACvB;AACA,EAAA,MAAM,WAAA;AACR;AAEO,IAAM,GAAA,GAAgB,OAAO,OAAA,KAAY;AAC9C,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,WAAA,GAAc,MAAA,EAAO;AAAA,IACvB;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,QAAQ,IAAA,CAAK;AAAA,QACjB,WAAA;AAAA,QACA,IAAI,OAAA;AAAA,UAAc,CAAC,CAAA,EAAG,MAAA,KACpB,UAAA,CAAW,MAAM,MAAA,CAAO,IAAI,KAAA,CAAM,wBAAwB,CAAC,CAAA,EAAG,GAAK;AAAA;AACrE,OACD,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU;AAAA,QACjC,KAAA,EAAO,qBAAA;AAAA,QACP,OAAA,EAAS;AAAA,OACV,CAAA,EAAG;AAAA,QACF,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,aAAA,EAAe;AAAA;AACjB,OACD,CAAA;AAAA,IACH;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,QAAQ,GAAG,CAAA;AACvC,EAAA,MAAM,OAAO,GAAA,CAAI,QAAA;AACjB,EAAA,MAAM,CAAA,GAAI,iBAAA;AAEV,EAAA,IAAI,SAAS,CAAA,EAAG,CAAC,cAAc,OAAO,YAAA,CAAa,eAAe,UAAA,EAAY;AAC5E,IAAA,MAAM,IAAA,GAAO,aAAa,UAAA,EAAW;AACrC,IAAA,MAAM,MAAM,MAAM,IAAA,CAAK,MAAM,OAAA,CAAQ,OAAA,EAAS,QAAQ,MAAM,CAAA;AAC5D,IAAA,OAAO,IAAI,QAAA,CAAS,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,EACnC;AAEA,EAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG,CAAC,QAAQ,CAAA,IAAK,OAAO,YAAA,CAAa,OAAA,KAAY,UAAA,EAAY;AAC/E,IAAA,MAAM,IAAA,GAAO,aAAa,OAAA,EAAQ;AAClC,IAAA,MAAM,MAAM,MAAM,IAAA,CAAK,MAAM,OAAA,CAAQ,OAAA,EAAS,QAAQ,MAAM,CAAA;AAC5D,IAAA,OAAO,IAAI,QAAA,CAAS,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,EACnC;AAEA,EAAA,MAAM,GAAA,GAAM,aAAa,OAAA,EAAQ;AACjC,EAAA,OAAO,GAAA,CAAI,KAAA,CAAM,OAAA,CAAQ,OAAA,EAAS,QAAQ,MAAM,CAAA;AAClD","file":"chunk-526M5MOA.js","sourcesContent":["import type { APIRoute } from \"astro\";\nimport { createKyro } from \"./createKyro.js\";\nimport { autoBootstrap } from \"./auth/bootstrap.js\";\nimport { DrizzleAdapter } from \"./database/drizzle/adapter.js\";\nimport { PostgresAuthAdapter } from \"./database/drizzle/postgres-auth-adapter.js\";\nimport { LocalAdapter } from \"./database/local/adapter.js\";\nimport { SQLiteAuthAdapter } from \"./auth/sqlite-adapter.js\";\nimport { MongoDBAdapter } from \"./database/mongodb/adapter.js\";\nimport { MongoDBAuthAdapter } from \"./database/mongodb/mongo-auth-adapter.js\";\n// @ts-ignore - handled by vite alias\nimport projectConfig from \"kyro:config\";\n\ndeclare var __KYRO_API_PATH__: string;\n\nexport let kyroInstance: any = null;\nlet initPromise: Promise<void> | null = null;\n\nasync function doInit(): Promise<void> {\n  if (kyroInstance) return;\n\n  try {\n    const config = projectConfig.default || projectConfig;\n    kyroInstance = createKyro(config);\n    await kyroInstance.init();\n    await kyroInstance.loadSettings();\n\n    const db = kyroInstance.db;\n    let bootstrapAuthAdapter: any = undefined;\n    \n    if (db instanceof DrizzleAdapter) {\n      if (db.dialect === \"postgres\") {\n        bootstrapAuthAdapter = new PostgresAuthAdapter({ db: db.client });\n      } else if (db.dialect === \"sqlite\") {\n        const authDbPath = process.env.KYRO_AUTH_DB_PATH || \"./data/auth.db\";\n        bootstrapAuthAdapter = new SQLiteAuthAdapter({ path: authDbPath });\n      }\n    } else if (db instanceof LocalAdapter) {\n      const authDbPath = process.env.KYRO_AUTH_DB_PATH || \"./data/auth.db\";\n      bootstrapAuthAdapter = new SQLiteAuthAdapter({ path: authDbPath });\n    } else if (db instanceof MongoDBAdapter) {\n      bootstrapAuthAdapter = new MongoDBAuthAdapter({ db: db.db });\n    }\n\n    if (bootstrapAuthAdapter?.connect) {\n      await bootstrapAuthAdapter.connect();\n    }\n\n    const result = await autoBootstrap(bootstrapAuthAdapter);\n    if (result?.success) {\n    }\n\n    // Auto-start WebSocket (checks settings.access.apiAccess.wsEnabled internally)\n    if (typeof kyroInstance.startWebSocket === \"function\") {\n      kyroInstance.startWebSocket().catch((err: any) => {\n        console.error(\"[Kyro] WebSocket auto-start failed:\", err);\n      });\n    }\n\n    // Expose instance globally so admin SSR can read DB directly\n    (globalThis as any).__KYRO_INSTANCE__ = kyroInstance;\n\n  } catch (err) {\n    kyroInstance = null;\n    initPromise = null;\n    console.error(\"[Kyro API] Init failed, will retry:\", err);\n    throw err;\n  }\n}\n\nexport async function warmKyroInstance(): Promise<void> {\n  if (!initPromise) {\n    initPromise = doInit();\n  }\n  await initPromise;\n}\n\nexport const ALL: APIRoute = async (context) => {\n  if (!kyroInstance) {\n    if (!initPromise) {\n      initPromise = doInit();\n    }\n\n    try {\n      await Promise.race([\n        initPromise,\n        new Promise<void>((_, reject) =>\n          setTimeout(() => reject(new Error(\"Initialization timeout\")), 30000)\n        ),\n      ]);\n    } catch {\n      return new Response(JSON.stringify({\n        error: \"Service Unavailable\",\n        message: \"Kyro CMS is still starting up. Please try again in a moment.\",\n      }), {\n        status: 503,\n        headers: {\n          \"Content-Type\": \"application/json\",\n          \"Retry-After\": \"5\",\n        },\n      });\n    }\n  }\n\n  const url = new URL(context.request.url);\n  const path = url.pathname;\n  const p = __KYRO_API_PATH__;\n\n  if (path === `${p}/graphql` && typeof kyroInstance.getGraphQL === \"function\") {\n    const yoga = kyroInstance.getGraphQL();\n    const res = await yoga.fetch(context.request, context.locals);\n    return new Response(res.body, res);\n  }\n\n  if (path.startsWith(`${p}/trpc/`) && typeof kyroInstance.getTRPC === \"function\") {\n    const trpc = kyroInstance.getTRPC();\n    const res = await trpc.fetch(context.request, context.locals);\n    return new Response(res.body, res);\n  }\n\n  const app = kyroInstance.getREST();\n  return app.fetch(context.request, context.locals);\n};\n"]}

package/dist/{chunk-5PMQQFRE.cjs → chunk-5GFQPHGT.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkY7AQK4R4_cjs = require('./chunk-Y7AQK4R4.cjs');
+var chunkVKREAIBA_cjs = require('./chunk-VKREAIBA.cjs');
 var chunkIDVRRRAK_cjs = require('./chunk-IDVRRRAK.cjs');
 
 // src/auth/bootstrap.ts
@@ -24,7 +24,7 @@ async function bootstrapAdmin(config) {
       error: "Failed to connect to auth storage"
     };
   }
-  const passwordPolicy = new chunkY7AQK4R4_cjs.PasswordPolicy();
+  const passwordPolicy = new chunkVKREAIBA_cjs.PasswordPolicy();
   const passwordValidation = passwordPolicy.validate(adminPassword);
   if (!passwordValidation.valid) {
     await authAdapter.disconnect?.();
@@ -49,7 +49,7 @@ async function bootstrapAdmin(config) {
       tenantId
     });
     if (sendWelcomeEmail && emailConfig) {
-      const emailTransport = new chunkY7AQK4R4_cjs.EmailTransport(emailConfig);
+      const emailTransport = new chunkVKREAIBA_cjs.EmailTransport(emailConfig);
       const templates = emailTransport.getTemplates();
       const welcomeTemplate = templates.welcome(adminEmail.split("@")[0]);
       await emailTransport.send({
@@ -120,11 +120,8 @@ async function autoBootstrap(authAdapter) {
     }
   } catch {
   }
-  console.log("Auto-bootstrapping admin user...");
   const result = await bootstrapAdmin(config);
-  if (result.success) {
-    console.log(`Admin user created: ${config.adminEmail}`);
-  } else {
+  if (result.success) ; else {
     console.error(`Bootstrap failed: ${result.error}`);
   }
   return result;
@@ -155,5 +152,5 @@ exports.bootstrapAdmin = bootstrapAdmin;
 exports.bootstrapWithRetry = bootstrapWithRetry;
 exports.checkBootstrapRequired = checkBootstrapRequired;
 exports.getBootstrapFromEnv = getBootstrapFromEnv;
-//# sourceMappingURL=chunk-5PMQQFRE.cjs.map
-//# sourceMappingURL=chunk-5PMQQFRE.cjs.map
+//# sourceMappingURL=chunk-5GFQPHGT.cjs.map
+//# sourceMappingURL=chunk-5GFQPHGT.cjs.map

package/dist/chunk-5GFQPHGT.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth/bootstrap.ts"],"names":["SQLiteAuthAdapter","PasswordPolicy","EmailTransport"],"mappings":";;;;;;AAsBA,eAAsB,eACpB,MAAA,EAC0B;AAC1B,EAAA,MAAM;AAAA,IACJ,UAAA;AAAA,IACA,aAAA;AAAA,IACA,SAAA,GAAY,aAAA;AAAA,IACZ,QAAA;AAAA,IACA,WAAA;AAAA,IACA,gBAAA,GAAmB;AAAA,GACrB,GAAI,MAAA;AAEJ,EAAA,MAAM,WAAA,GACJ,MAAA,CAAO,WAAA,IACP,IAAIA,mCAAA,CAAkB;AAAA,IACpB,IAAA,EAAM,OAAO,UAAA,IAAc;AAAA,GAC5B,CAAA;AAEH,EAAA,IAAI;AACF,IAAA,MAAM,YAAY,OAAA,IAAU;AAAA,EAC9B,SAAS,KAAA,EAAO;AACd,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,KAAA,EAAO;AAAA,KACT;AAAA,EACF;AAEA,EAAA,MAAM,cAAA,GAAiB,IAAIC,gCAAA,EAAe;AAC1C,EAAA,MAAM,kBAAA,GAAqB,cAAA,CAAe,QAAA,CAAS,aAAa,CAAA;AAChE,EAAA,IAAI,CAAC,mBAAmB,KAAA,EAAO;AAC7B,IAAA,MAAM,YAAY,UAAA,IAAa;AAC/B,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,OAAO,CAAA,kBAAA,EAAqB,kBAAA,CAAmB,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,KAClE;AAAA,EACF;AAEA,EAAA,MAAM,YAAA,GAAe,MAAM,WAAA,CAAY,eAAA,CAAgB,UAAU,CAAA;AACjE,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,MAAM,YAAY,UAAA,IAAa;AAC/B,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,KAAA,EAAO;AAAA,KACT;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,WAAA,CAAY,UAAA,CAAW;AAAA,MACxC,KAAA,EAAO,UAAA;AAAA,MACP,QAAA,EAAU,aAAA;AAAA,MACV,MAAO,SAAA,IAA0B,OAAA;AAAA,MACjC;AAAA,KACD,CAAA;AAED,IAAA,IAAI,oBAAoB,WAAA,EAAa;AACnC,MAAA,MAAM,cAAA,GAAiB,IAAIC,gCAAA,CAAe,WAAW,CAAA;AACrD,MAAA,MAAM,SAAA,GAAY,eAAe,YAAA,EAAa;AAC9C,MAAA,MAAM,eAAA,GAAkB,UAAU,OAAA,CAAQ,UAAA,CAAW,MAAM,GAAG,CAAA,CAAE,CAAC,CAAC,CAAA;AAClE,MAAA,MAAM,eAAe,IAAA,CAAK;AAAA,QACxB,EAAA,EAAI,UAAA;AAAA,QACJ,GAAG;AAAA,OACJ,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,YAAY,UAAA,IAAa;AAC/B,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT;AAAA,KACF;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,YAAY,UAAA,IAAa;AAC/B,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,KAAA,EACE,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU;AAAA,KAC7C;AAAA,EACF;AACF;AAEA,eAAsB,sBAAA,CACpB,aACA,UAAA,EACkB;AAClB,EAAA,MAAM,YAAA,GAAe,MAAM,WAAA,CAAY,eAAA,CAAgB,UAAU,CAAA;AACjE,EAAA,OAAO,CAAC,YAAA;AACV;AAEO,SAAS,mBAAA,GAA8C;AAC5D,EAAA,MAAM,KAAA,GAAQ,QAAQ,GAAA,CAAI,gBAAA;AAC1B,EAAA,MAAM,QAAA,GAAW,QAAQ,GAAA,CAAI,mBAAA;AAE7B,EAAA,IAAI,CAAC,KAAA,IAAS,CAAC,QAAA,EAAU;AACvB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,OAAA,CAAQ,GAAA,CAAI,iBAAA,IAAqB,gBAAA;AAAA,IAC7C,UAAA,EAAY,KAAA;AAAA,IACZ,aAAA,EAAe,QAAA;AAAA,IACf,SAAA,EAAW,OAAA,CAAQ,GAAA,CAAI,eAAA,IAAmB,aAAA;AAAA,IAC1C,QAAA,EAAU,QAAQ,GAAA,CAAI,oBAAA;AAAA,IACtB,WAAA,EAAa,OAAA,CAAQ,GAAA,CAAI,SAAA,GACrB;AAAA,MACE,QAAA,EAAU,MAAA;AAAA,MACV,IAAA,EAAM;AAAA,QACJ,IAAA,EAAM,QAAQ,GAAA,CAAI,SAAA;AAAA,QAClB,MAAM,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,SAAA,IAAa,OAAO,EAAE,CAAA;AAAA,QACjD,MAAA,EAAQ,OAAA,CAAQ,GAAA,CAAI,WAAA,KAAgB,MAAA;AAAA,QACpC,IAAA,EAAM;AAAA,UACJ,IAAA,EAAM,OAAA,CAAQ,GAAA,CAAI,SAAA,IAAa,EAAA;AAAA,UAC/B,IAAA,EAAM,OAAA,CAAQ,GAAA,CAAI,SAAA,IAAa;AAAA;AACjC,OACF;AAAA,MACA,IAAA,EAAM,OAAA,CAAQ,GAAA,CAAI,SAAA,IAAa,qBAAA;AAAA,MAC/B,QAAA,EAAU,QAAQ,GAAA,CAAI;AAAA,KACxB,GACA,MAAA;AAAA,IACJ,gBAAA,EAAkB,OAAA,CAAQ,GAAA,CAAI,uBAAA,KAA4B;AAAA,GAC5D;AACF;AAEA,eAAsB,cACpB,WAAA,EACiC;AACjC,EAAA,MAAM,SAAS,mBAAA,EAAoB;AACnC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,MAAA,CAAO,WAAA,GAAc,WAAA;AAAA,EACvB;AAGA,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,CAAO,aAAa,OAAA,IAAU;AACpC,IAAA,MAAM,eAAe,MAAM,MAAA,CAAO,WAAA,EAAa,eAAA,CAAgB,OAAO,UAAU,CAAA;AAChF,IAAA,IAAI,YAAA,EAAc;AAChB,MAAA,MAAM,MAAA,CAAO,aAAa,UAAA,IAAa;AACvC,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,2BAAA,EAA4B;AAAA,IAC9D;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,cAAA,CAAe,MAAM,CAAA;AAE1C,EAAA,IAAI,OAAO,OAAA,EAAS,CACpB,MAAO;AACL,IAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,kBAAA,EAAqB,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAAA,EACnD;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,eAAsB,kBAAA,CACpB,MAAA,EACA,UAAA,GAAqB,CAAA,EACrB,eAAuB,GAAA,EACG;AAC1B,EAAA,IAAI,SAAA,GAAoB,EAAA;AAExB,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,UAAA,EAAY,CAAA,EAAA,EAAK;AACnC,IAAA,MAAM,MAAA,GAAS,MAAM,cAAA,CAAe,MAAM,CAAA;AAE1C,IAAA,IAAI,OAAO,OAAA,EAAS;AAClB,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,SAAA,GAAY,OAAO,KAAA,IAAS,eAAA;AAE5B,IAAA,IAAI,SAAA,CAAU,QAAA,CAAS,gBAAgB,CAAA,EAAG;AACxC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,IAAI,CAAA,GAAI,aAAa,CAAA,EAAG;AACtB,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,YAAY,CAAC,CAAA;AAAA,IAClE;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,KAAA;AAAA,IACT,KAAA,EAAO,CAAA,aAAA,EAAgB,UAAU,CAAA,UAAA,EAAa,SAAS,CAAA;AAAA,GACzD;AACF","file":"chunk-5GFQPHGT.cjs","sourcesContent":["import { SQLiteAuthAdapter } from \"./sqlite-adapter.js\";\nimport { EmailTransport, type EmailConfig } from \"./nodemailer-transport.js\";\nimport { PasswordPolicy } from \"./security/password-policy.js\";\nimport type { AuthUser, UserRole, AuthAdapter } from \"./types.js\";\n\nexport interface BootstrapConfig {\n  authAdapter?: AuthAdapter;\n  authDbPath?: string;\n  adminEmail: string;\n  adminPassword: string;\n  adminRole?: string;\n  tenantId?: string;\n  emailConfig?: EmailConfig;\n  sendWelcomeEmail?: boolean;\n}\n\nexport interface BootstrapResult {\n  success: boolean;\n  user?: AuthUser;\n  error?: string;\n}\n\nexport async function bootstrapAdmin(\n  config: BootstrapConfig,\n): Promise<BootstrapResult> {\n  const {\n    adminEmail,\n    adminPassword,\n    adminRole = \"super_admin\",\n    tenantId,\n    emailConfig,\n    sendWelcomeEmail = false,\n  } = config;\n\n  const authAdapter =\n    config.authAdapter ||\n    new SQLiteAuthAdapter({\n      path: config.authDbPath || \"./data/auth.db\",\n    });\n\n  try {\n    await authAdapter.connect?.();\n  } catch (error) {\n    return {\n      success: false,\n      error: \"Failed to connect to auth storage\",\n    };\n  }\n\n  const passwordPolicy = new PasswordPolicy();\n  const passwordValidation = passwordPolicy.validate(adminPassword);\n  if (!passwordValidation.valid) {\n    await authAdapter.disconnect?.();\n    return {\n      success: false,\n      error: `Invalid password: ${passwordValidation.errors.join(\", \")}`,\n    };\n  }\n\n  const existingUser = await authAdapter.findUserByEmail(adminEmail);\n  if (existingUser) {\n    await authAdapter.disconnect?.();\n    return {\n      success: false,\n      error: \"Admin user already exists\",\n    };\n  }\n\n  try {\n    const user = await authAdapter.createUser({\n      email: adminEmail,\n      password: adminPassword,\n      role: (adminRole as UserRole) || \"admin\",\n      tenantId,\n    });\n\n    if (sendWelcomeEmail && emailConfig) {\n      const emailTransport = new EmailTransport(emailConfig);\n      const templates = emailTransport.getTemplates();\n      const welcomeTemplate = templates.welcome(adminEmail.split(\"@\")[0]);\n      await emailTransport.send({\n        to: adminEmail,\n        ...welcomeTemplate,\n      });\n    }\n\n    await authAdapter.disconnect?.();\n    return {\n      success: true,\n      user,\n    };\n  } catch (error) {\n    await authAdapter.disconnect?.();\n    return {\n      success: false,\n      error:\n        error instanceof Error ? error.message : \"Failed to create admin user\",\n    };\n  }\n}\n\nexport async function checkBootstrapRequired(\n  authAdapter: AuthAdapter,\n  adminEmail: string,\n): Promise<boolean> {\n  const existingUser = await authAdapter.findUserByEmail(adminEmail);\n  return !existingUser;\n}\n\nexport function getBootstrapFromEnv(): BootstrapConfig | null {\n  const email = process.env.KYRO_ADMIN_EMAIL;\n  const password = process.env.KYRO_ADMIN_PASSWORD;\n\n  if (!email || !password) {\n    return null;\n  }\n\n  return {\n    authDbPath: process.env.KYRO_AUTH_DB_PATH || \"./data/auth.db\",\n    adminEmail: email,\n    adminPassword: password,\n    adminRole: process.env.KYRO_ADMIN_ROLE || \"super_admin\",\n    tenantId: process.env.KYRO_ADMIN_TENANT_ID,\n    emailConfig: process.env.SMTP_HOST\n      ? {\n          provider: \"smtp\",\n          smtp: {\n            host: process.env.SMTP_HOST,\n            port: parseInt(process.env.SMTP_PORT || \"587\", 10),\n            secure: process.env.SMTP_SECURE === \"true\",\n            auth: {\n              user: process.env.SMTP_USER || \"\",\n              pass: process.env.SMTP_PASS || \"\",\n            },\n          },\n          from: process.env.SMTP_FROM || \"noreply@example.com\",\n          fromName: process.env.SMTP_FROM_NAME,\n        }\n      : undefined,\n    sendWelcomeEmail: process.env.KYRO_ADMIN_SEND_WELCOME === \"true\",\n  };\n}\n\nexport async function autoBootstrap(\n  authAdapter?: AuthAdapter,\n): Promise<BootstrapResult | null> {\n  const config = getBootstrapFromEnv();\n  if (!config) {\n    return null;\n  }\n\n  if (authAdapter) {\n    config.authAdapter = authAdapter;\n  }\n\n  // Check if bootstrap is actually needed before connecting\n  try {\n    await config.authAdapter?.connect?.();\n    const existingUser = await config.authAdapter?.findUserByEmail(config.adminEmail);\n    if (existingUser) {\n      await config.authAdapter?.disconnect?.();\n      return { success: false, error: \"Admin user already exists\" };\n    }\n  } catch {\n    // Connection failed — let bootstrapAdmin handle the error\n  }\n\n  const result = await bootstrapAdmin(config);\n\n  if (result.success) {\n  } else {\n    console.error(`Bootstrap failed: ${result.error}`);\n  }\n\n  return result;\n}\n\nexport async function bootstrapWithRetry(\n  config: BootstrapConfig,\n  maxRetries: number = 3,\n  retryDelayMs: number = 2000,\n): Promise<BootstrapResult> {\n  let lastError: string = \"\";\n\n  for (let i = 0; i < maxRetries; i++) {\n    const result = await bootstrapAdmin(config);\n\n    if (result.success) {\n      return result;\n    }\n\n    lastError = result.error || \"Unknown error\";\n\n    if (lastError.includes(\"already exists\")) {\n      return result;\n    }\n\n    if (i < maxRetries - 1) {\n      await new Promise((resolve) => setTimeout(resolve, retryDelayMs));\n    }\n  }\n\n  return {\n    success: false,\n    error: `Failed after ${maxRetries} retries: ${lastError}`,\n  };\n}\n"]}