@kyro-cms/core 0.9.8 → 0.9.9

package/dist/{chunk-2CBCU5ML.cjs → chunk-IEIHABVR.cjs}

@@ -4,8 +4,8 @@ var chunkY7AQK4R4_cjs = require('./chunk-Y7AQK4R4.cjs');
 var chunkKC2GDBLS_cjs = require('./chunk-KC2GDBLS.cjs');
 var chunkIDVRRRAK_cjs = require('./chunk-IDVRRRAK.cjs');
 var chunkADLJSJSN_cjs = require('./chunk-ADLJSJSN.cjs');
-var chunkZ7OH3MWT_cjs = require('./chunk-Z7OH3MWT.cjs');
-var chunkKGJRJ7CU_cjs = require('./chunk-KGJRJ7CU.cjs');
+var chunkLNTFRAHF_cjs = require('./chunk-LNTFRAHF.cjs');
+var chunk4OCMVGEY_cjs = require('./chunk-4OCMVGEY.cjs');
 var chunkRFFSZSCL_cjs = require('./chunk-RFFSZSCL.cjs');
 var chunk7OS7TX2Q_cjs = require('./chunk-7OS7TX2Q.cjs');
 var chunkQ23GAMLE_cjs = require('./chunk-Q23GAMLE.cjs');
@@ -391,14 +391,14 @@ function createAuthMiddleware(config) {
     userLookup
   } = config;
   return async function authMiddleware(req) {
-    const apiKeyRaw = chunkKGJRJ7CU_cjs.extractApiKeyFromRequest(req);
+    const apiKeyRaw = chunk4OCMVGEY_cjs.extractApiKeyFromRequest(req);
     if (apiKeyRaw && db) {
-      const result = await chunkKGJRJ7CU_cjs.validateApiKey(apiKeyRaw, db, userLookup);
+      const result = await chunk4OCMVGEY_cjs.validateApiKey(apiKeyRaw, db, userLookup);
       if (result.valid && result.user) {
         return {
           user: result.user,
           tenantContext: createTenantContextFromUser(result.user),
-          apiKeyContext: chunkKGJRJ7CU_cjs.createApiKeyContext(result),
+          apiKeyContext: chunk4OCMVGEY_cjs.createApiKeyContext(result),
           status: 200,
           authType: "apikey"
         };
@@ -2958,7 +2958,7 @@ var MediaService = class _MediaService {
     const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
     return { where, params: p, orderBy: sortDir, sortCol };
   }
-  rowToMedia(row) {
+  rowToMedia(row, origin) {
     return {
       id: row.id,
       filename: row.filename,
@@ -2968,8 +2968,8 @@ var MediaService = class _MediaService {
       fileSize: row.file_size ?? row.fileSize,
       width: row.width ?? null,
       height: row.height ?? null,
-      url: row.url,
-      thumbnailUrl: row.thumbnail_url ?? row.thumbnailUrl ?? null,
+      url: _MediaService.resolveMediaUrl(row.url, origin),
+      thumbnailUrl: _MediaService.resolveMediaUrl(row.thumbnail_url ?? row.thumbnailUrl ?? null, origin),
       folder: row.folder ?? null,
       provider: row.provider,
       alt: row.alt ?? null,
@@ -2979,6 +2979,12 @@ var MediaService = class _MediaService {
       updatedAt: row.updated_at ?? row.updatedAt
     };
   }
+  static resolveMediaUrl(url, origin) {
+    if (!url) return null;
+    if (url.startsWith("http://") || url.startsWith("https://") || url.startsWith("blob:") || url.startsWith("data:")) return url;
+    const base = (process.env.KYRO_BASE_URL || origin || "http://localhost:4321").replace(/\/+$/, "");
+    return `${base}${url.startsWith("/") ? "" : "/"}${url}`;
+  }
   async sqliteRun(sql, params = []) {
     const stmt = this.db.prepare(sql);
     const sqlLower = sql.trim().toLowerCase();
@@ -3106,17 +3112,19 @@ var MediaService = class _MediaService {
     const file = new File([blob], originalName, { type: mimeType });
     return this.upload(file, folder);
   }
-  async delete(id) {
+  async delete(id, origin) {
     let item = null;
     if (this.dialect === "sqlite") {
-      item = this.sqliteGet(`SELECT * FROM ${this.mediaTable} WHERE id = ?`, [
-        id
-      ]);
+      const row = this.sqliteGet(
+        `SELECT * FROM ${this.mediaTable} WHERE id = ?`,
+        [id]
+      );
+      if (row) item = this.rowToMedia(row, origin);
     } else {
       const { media: mediaSchema } = await import('./media-TUSLVRQ6.cjs');
       const { eq } = await import('drizzle-orm');
       const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
-      if (row) item = this.rowToMedia(row);
+      if (row) item = this.rowToMedia(row, origin);
     }
     if (!item) return;
     await this.deleteFile(item.url);
@@ -3137,7 +3145,7 @@ var MediaService = class _MediaService {
   async deleteFile(url) {
     await this.storage.delete(url);
   }
-  async rename(id, newKey) {
+  async rename(id, newKey, origin) {
     let item = null;
     if (this.dialect === "sqlite") {
       item = this.sqliteGet(`SELECT * FROM ${this.mediaTable} WHERE id = ?`, [
@@ -3147,7 +3155,7 @@ var MediaService = class _MediaService {
       const { media: mediaSchema } = await import('./media-TUSLVRQ6.cjs');
       const { eq } = await import('drizzle-orm');
       const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
-      if (row) item = this.rowToMedia(row);
+      if (row) item = this.rowToMedia(row, origin);
     }
     if (!item) return null;
     const newUrl = await this.storage.rename(item.url, newKey);
@@ -3190,20 +3198,20 @@ var MediaService = class _MediaService {
       thumbnailUrl: updateData.thumbnailUrl ?? null
     };
   }
-  async findById(id) {
+  async findById(id, origin) {
     if (this.dialect === "sqlite") {
       const row2 = this.sqliteGet(
         `SELECT * FROM ${this.mediaTable} WHERE id = ?`,
         [id]
       );
-      return row2 ? this.rowToMedia(row2) : null;
+      return row2 ? this.rowToMedia(row2, origin) : null;
     }
     const { media: mediaSchema } = await import('./media-TUSLVRQ6.cjs');
     const { eq } = await import('drizzle-orm');
     const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
-    return row ? this.rowToMedia(row) : null;
+    return row ? this.rowToMedia(row, origin) : null;
   }
-  async find(params = {}) {
+  async find(params = {}, origin) {
     const {
       page = 1,
       limit = 30,
@@ -3239,7 +3247,7 @@ var MediaService = class _MediaService {
         [...p, limit, offset]
       );
       return {
-        docs: rows.map((r) => this.rowToMedia(r)),
+        docs: rows.map((r) => this.rowToMedia(r, origin)),
         totalDocs: totalDocs2,
         page,
         limit,
@@ -3286,14 +3294,14 @@ var MediaService = class _MediaService {
     const [{ count }] = await this.db.select({ count: sql`count(*)` }).from(mediaSchema).where(whereClause);
     const totalDocs = Number(count);
     return {
-      docs: docs.map((r) => this.rowToMedia(r)),
+      docs: docs.map((r) => this.rowToMedia(r, origin)),
       totalDocs,
       page,
       limit,
       totalPages: Math.ceil(totalDocs / limit)
     };
   }
-  async update(id, data) {
+  async update(id, data, origin) {
     const now = this.now();
     if (this.dialect === "sqlite") {
       const sets = ["updated_at = ?"];
@@ -3312,7 +3320,7 @@ var MediaService = class _MediaService {
       }
       if (data.folder !== void 0) {
         sets.push("folder = ?");
-        p.push(data.folder || null);
+        p.push(data.folder);
       }
       p.push(id);
       await this.sqliteRun(
@@ -3323,12 +3331,12 @@ var MediaService = class _MediaService {
         `SELECT * FROM ${this.mediaTable} WHERE id = ?`,
         [id]
       );
-      return row ? this.rowToMedia(row) : null;
+      return row ? this.rowToMedia(row, origin) : null;
     }
     const { media: mediaSchema } = await import('./media-TUSLVRQ6.cjs');
     const { eq } = await import('drizzle-orm');
     const [updated] = await this.db.update(mediaSchema).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq(mediaSchema.id, id)).returning();
-    return updated ? this.rowToMedia(updated) : null;
+    return updated ? this.rowToMedia(updated, origin) : null;
   }
   async updateMany(ids, data) {
     const now = this.now();
@@ -3485,9 +3493,9 @@ function convertRichtextFields(fields, data) {
 }
 var COLLECTION_EVENT_MAP = {
   _media: {
-    create: chunkZ7OH3MWT_cjs.WEBHOOK_EVENTS.MEDIA_UPLOAD,
-    update: chunkZ7OH3MWT_cjs.WEBHOOK_EVENTS.MEDIA_UPLOAD,
-    delete: chunkZ7OH3MWT_cjs.WEBHOOK_EVENTS.MEDIA_DELETE
+    create: chunkLNTFRAHF_cjs.WEBHOOK_EVENTS.MEDIA_UPLOAD,
+    update: chunkLNTFRAHF_cjs.WEBHOOK_EVENTS.MEDIA_UPLOAD,
+    delete: chunkLNTFRAHF_cjs.WEBHOOK_EVENTS.MEDIA_DELETE
   }
 };
 function getWebhookEvent(collection, operation) {
@@ -3535,7 +3543,7 @@ function buildConflictResponse(expectedUpdatedAt, currentDoc) {
   };
 }
 async function checkCollectionAccess2(collection, operation, req, ctxUser, ctxTenantID, apiKeyContext, enablePublicAccess = true, defaultCollectionAccess = "none") {
-  const result = await chunkKGJRJ7CU_cjs.checkCollectionAccess(collection, operation, {
+  const result = await chunkLNTFRAHF_cjs.checkCollectionAccess(collection, operation, {
     user: ctxUser,
     req,
     tenantID: ctxTenantID,
@@ -3547,7 +3555,7 @@ async function checkCollectionAccess2(collection, operation, req, ctxUser, ctxTe
   return result;
 }
 async function checkGlobalAccess2(global, operation, req, ctxUser, ctxTenantID, enablePublicAccess = true) {
-  const result = await chunkKGJRJ7CU_cjs.checkGlobalAccess(global, operation, {
+  const result = await chunkLNTFRAHF_cjs.checkGlobalAccess(global, operation, {
     user: ctxUser,
     req,
     tenantID: ctxTenantID
@@ -4115,12 +4123,13 @@ function createHonoApp(options) {
       const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
       if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
+      const origin = new URL(c.req.url).origin;
       const page = parseInt(c.req.query("page") || "1");
       const limit = parseInt(c.req.query("limit") || "30");
       const search = c.req.query("search") || "";
       const type = c.req.query("type") || "";
       const folder = c.req.query("folder") || "";
-      const result = await service.find({ page, limit, search, type, folder });
+      const result = await service.find({ page, limit, search, type, folder }, origin);
       return c.json(result);
     } catch (error) {
       console.error("[Media] find error:", error);
@@ -4204,7 +4213,8 @@ function createHonoApp(options) {
       if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const id = c.req.param("id");
-      await service.delete(id);
+      const origin = new URL(c.req.url).origin;
+      await service.delete(id, origin);
       return c.json({ success: true });
     } catch (error) {
       console.error("[Media] delete error:", error);
@@ -4260,7 +4270,8 @@ function createHonoApp(options) {
       if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const id = c.req.param("id");
-      const doc = await service.findById(id);
+      const origin = new URL(c.req.url).origin;
+      const doc = await service.findById(id, origin);
       if (!doc) return c.json({ error: "Media not found" }, 404);
       return c.json(doc);
     } catch (error) {
@@ -4275,8 +4286,9 @@ function createHonoApp(options) {
       const service = await getMedia();
       const id = c.req.param("id");
       const body = await c.req.json();
+      const origin = new URL(c.req.url).origin;
       if (body.folder !== void 0) {
-        const updated = await service.update(id, { folder: body.folder });
+        const updated = await service.update(id, { folder: body.folder }, origin);
         return c.json({ doc: updated });
       }
       return c.json({ error: "No valid fields to update" }, 400);
@@ -4782,7 +4794,7 @@ function createHonoApp(options) {
       }
       const page = parseInt(c.req.query("page") || "1");
       const limit = Math.min(parseInt(c.req.query("limit") || "50"), 100);
-      const result = await db.find({ collection: chunkKGJRJ7CU_cjs.API_KEY_COLLECTION, where: {}, page, limit, tenantID: ctxTenantID });
+      const result = await db.find({ collection: chunk4OCMVGEY_cjs.API_KEY_COLLECTION, where: {}, page, limit, tenantID: ctxTenantID });
       const docs = (result.docs || []).map((doc) => ({
         id: doc.id,
         name: doc.name,
@@ -4807,14 +4819,14 @@ function createHonoApp(options) {
       if (!body.name || typeof body.name !== "string") {
         return c.json({ error: "name is required" }, 400);
       }
-      const rawKey = chunkKGJRJ7CU_cjs.generateApiKey();
+      const rawKey = chunk4OCMVGEY_cjs.generateApiKey();
       const doc = await db.create({
-        collection: chunkKGJRJ7CU_cjs.API_KEY_COLLECTION,
+        collection: chunk4OCMVGEY_cjs.API_KEY_COLLECTION,
         data: {
           userId: ctxUser.id,
           name: body.name,
           key: rawKey,
-          keyPrefix: chunkKGJRJ7CU_cjs.generateApiKeyPrefix(rawKey),
+          keyPrefix: chunk4OCMVGEY_cjs.generateApiKeyPrefix(rawKey),
           permissions: Array.isArray(body.permissions) ? body.permissions : ["*"],
           expiresAt: body.expiresAt || null,
           createdAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -4845,9 +4857,9 @@ function createHonoApp(options) {
         return c.json({ error: "Forbidden" }, 403);
       }
       const id = c.req.param("id");
-      const existing = await db.findByID({ collection: chunkKGJRJ7CU_cjs.API_KEY_COLLECTION, id });
+      const existing = await db.findByID({ collection: chunk4OCMVGEY_cjs.API_KEY_COLLECTION, id });
       if (!existing) return c.json({ error: "API key not found" }, 404);
-      await db.delete({ collection: chunkKGJRJ7CU_cjs.API_KEY_COLLECTION, id });
+      await db.delete({ collection: chunk4OCMVGEY_cjs.API_KEY_COLLECTION, id });
       await sessionAuthAdapter?.createAuditLog({
         action: "api_key_delete",
         userId: ctxUser.id,
@@ -4870,14 +4882,14 @@ function createHonoApp(options) {
       }
       const id = c.req.param("id");
       const body = await c.req.json();
-      const existing = await db.findByID({ collection: chunkKGJRJ7CU_cjs.API_KEY_COLLECTION, id });
+      const existing = await db.findByID({ collection: chunk4OCMVGEY_cjs.API_KEY_COLLECTION, id });
       if (!existing) return c.json({ error: "API key not found" }, 404);
       const updateData = {};
       if (typeof body.name === "string" && body.name.trim()) updateData.name = body.name.trim();
       if (Array.isArray(body.permissions)) updateData.permissions = body.permissions;
       if (body.expiresAt !== void 0) updateData.expiresAt = body.expiresAt || null;
       if (Object.keys(updateData).length === 0) return c.json({ error: "Nothing to update" }, 400);
-      const updated = await db.update({ collection: chunkKGJRJ7CU_cjs.API_KEY_COLLECTION, id, data: updateData });
+      const updated = await db.update({ collection: chunk4OCMVGEY_cjs.API_KEY_COLLECTION, id, data: updateData });
       return c.json({ ...updated, keyPrefix: existing.keyPrefix });
     } catch (error) {
       console.error("[ApiKeys] PATCH error:", error);
@@ -4891,15 +4903,15 @@ function createHonoApp(options) {
         return c.json({ error: "Forbidden" }, 403);
       }
       const id = c.req.param("id");
-      const existing = await db.findByID({ collection: chunkKGJRJ7CU_cjs.API_KEY_COLLECTION, id });
+      const existing = await db.findByID({ collection: chunk4OCMVGEY_cjs.API_KEY_COLLECTION, id });
       if (!existing) return c.json({ error: "API key not found" }, 404);
-      const rawKey = chunkKGJRJ7CU_cjs.generateApiKey();
+      const rawKey = chunk4OCMVGEY_cjs.generateApiKey();
       const updated = await db.update({
-        collection: chunkKGJRJ7CU_cjs.API_KEY_COLLECTION,
+        collection: chunk4OCMVGEY_cjs.API_KEY_COLLECTION,
         id,
         data: {
           key: rawKey,
-          keyPrefix: chunkKGJRJ7CU_cjs.generateApiKeyPrefix(rawKey),
+          keyPrefix: chunk4OCMVGEY_cjs.generateApiKeyPrefix(rawKey),
           lastUsedAt: null
         }
       });
@@ -5057,6 +5069,75 @@ function createHonoApp(options) {
       return c.json({ error: error.message }, 500);
     }
   });
+  function serializeField(field) {
+    const safe = {};
+    const keys = [
+      "name",
+      "type",
+      "required",
+      "hasMany",
+      "relationTo",
+      "options",
+      "min",
+      "max",
+      "minLength",
+      "maxLength",
+      "defaultValue",
+      "label",
+      "localized",
+      "admin",
+      "unique",
+      "index",
+      "hidden",
+      "readOnly",
+      "deprecated"
+    ];
+    for (const k of keys) {
+      if (k in field) safe[k] = field[k];
+    }
+    if (field.fields) {
+      safe.fields = field.fields.map(serializeField);
+    }
+    if (field.tabs) {
+      safe.tabs = field.tabs.map((t) => ({
+        label: t.label,
+        name: t.name,
+        fields: t.fields.map(serializeField)
+      }));
+    }
+    return safe;
+  }
+  app.get("/api/__schema", async (c) => {
+    try {
+      const { user: ctxUser, apiKeyContext } = await resolveAuthContext(
+        c.req.raw,
+        authMw,
+        user,
+        tenantID
+      );
+      if (!ctxUser && !apiKeyContext) {
+        return c.json({ error: "Unauthorized" }, 401);
+      }
+      const cols = registry.getCollections().filter(
+        (col) => col.slug !== "users" && col.slug !== "audit_logs"
+      );
+      const serialized = cols.map((col) => ({
+        slug: col.slug,
+        label: col.label,
+        labelPlural: col.labelPlural,
+        singularLabel: col.singularLabel,
+        timestamps: col.timestamps,
+        auth: !!col.auth,
+        tenantScoped: !!col.tenantScoped,
+        upload: col.upload ? { staticDir: col.upload.staticDir, imageSizes: col.upload.imageSizes, mimeTypes: col.upload.mimeTypes } : void 0,
+        fields: col.fields.map(serializeField)
+      }));
+      return c.json(serialized);
+    } catch (error) {
+      console.error("[Schema] error:", error);
+      return c.json({ error: error.message }, 500);
+    }
+  });
   const collections = registry.getCollections();
   for (const collection of collections) {
     let computeDiff2 = function(a, b) {
@@ -6419,5 +6500,5 @@ exports.init_secret = init_secret;
 exports.loadSecrets = loadSecrets;
 exports.resolveProvider = resolveProvider;
 exports.setDbAdapter = setDbAdapter;
-//# sourceMappingURL=chunk-2CBCU5ML.cjs.map
-//# sourceMappingURL=chunk-2CBCU5ML.cjs.map
+//# sourceMappingURL=chunk-IEIHABVR.cjs.map
+//# sourceMappingURL=chunk-IEIHABVR.cjs.map