@wecode-team/cms-supabase-api 0.1.33 → 0.1.35

package/dist/index.esm.js

@@ -1007,11 +1007,11 @@ function _defineProperty(e, r, t) {
   }) : e[r] = t, e;
 }
 
-function ownKeys$2(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread$2(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$2(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$2(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
-function _createForOfIteratorHelper$1(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray$2(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t["return"] || t["return"](); } finally { if (u) throw o; } } }; }
-function _unsupportedIterableToArray$2(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray$2(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray$2(r, a) : void 0; } }
-function _arrayLikeToArray$2(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
+function ownKeys$3(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread$3(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$3(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$3(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+function _createForOfIteratorHelper$3(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray$4(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t["return"] || t["return"](); } finally { if (u) throw o; } } }; }
+function _unsupportedIterableToArray$4(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray$4(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray$4(r, a) : void 0; } }
+function _arrayLikeToArray$4(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
 // 字段类型映射到PostgreSQL类型
 var fieldTypeMapping = {
   string: "text",
@@ -1101,7 +1101,7 @@ var DynamicTableService = /*#__PURE__*/function () {
     value: function applySupabaseFilters(query, filters) {
       if (!filters || filters.length === 0) return query;
       var q = query;
-      var _iterator = _createForOfIteratorHelper$1(filters),
+      var _iterator = _createForOfIteratorHelper$3(filters),
         _step;
       try {
         for (_iterator.s(); !(_step = _iterator.n()).done;) {
@@ -2063,7 +2063,7 @@ var DynamicTableService = /*#__PURE__*/function () {
               throw error;
             case 2:
               return _context14.abrupt("return", (data || []).map(function (item) {
-                return _objectSpread$2({
+                return _objectSpread$3({
                   id: item.id,
                   label: item[displayField] || "ID: ".concat(item.id)
                 }, item);
@@ -2176,8 +2176,8 @@ function getDynamicTableService() {
   return defaultService$1;
 }
 
-function ownKeys$1(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread$1(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$1(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$1(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+function ownKeys$2(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread$2(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$2(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$2(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 var AuthService = /*#__PURE__*/function () {
   function AuthService() {
     _classCallCheck(this, AuthService);
@@ -2354,7 +2354,7 @@ var AuthService = /*#__PURE__*/function () {
         return _regeneratorRuntime.wrap(function (_context4) {
           while (1) switch (_context4.prev = _context4.next) {
             case 0:
-              finalUserData = _objectSpread$1({
+              finalUserData = _objectSpread$2({
                 tableName: this.defaultTableName
               }, userData);
               _context4.prev = 1;
@@ -2412,7 +2412,7 @@ var AuthService = /*#__PURE__*/function () {
             case 0:
               updateData = _args5.length > 1 && _args5[1] !== undefined ? _args5[1] : {};
               // 设置默认值
-              finalUpdateData = _objectSpread$1({
+              finalUpdateData = _objectSpread$2({
                 tableName: this.defaultTableName
               }, updateData);
               _context5.prev = 1;
@@ -2684,10 +2684,652 @@ function getAuthService() {
   return defaultService;
 }
 
+function _objectWithoutPropertiesLoose(r, e) {
+  if (null == r) return {};
+  var t = {};
+  for (var n in r) if ({}.hasOwnProperty.call(r, n)) {
+    if (-1 !== e.indexOf(n)) continue;
+    t[n] = r[n];
+  }
+  return t;
+}
+
+function _objectWithoutProperties(e, t) {
+  if (null == e) return {};
+  var o,
+    r,
+    i = _objectWithoutPropertiesLoose(e, t);
+  if (Object.getOwnPropertySymbols) {
+    var n = Object.getOwnPropertySymbols(e);
+    for (r = 0; r < n.length; r++) o = n[r], -1 === t.indexOf(o) && {}.propertyIsEnumerable.call(e, o) && (i[o] = e[o]);
+  }
+  return i;
+}
+
+function _assertThisInitialized(e) {
+  if (void 0 === e) throw new ReferenceError("this hasn't been initialised - super() hasn't been called");
+  return e;
+}
+
+function _possibleConstructorReturn(t, e) {
+  if (e && ("object" == _typeof$1(e) || "function" == typeof e)) return e;
+  if (void 0 !== e) throw new TypeError("Derived constructors may only return object or undefined");
+  return _assertThisInitialized(t);
+}
+
+function _getPrototypeOf(t) {
+  return _getPrototypeOf = Object.setPrototypeOf ? Object.getPrototypeOf.bind() : function (t) {
+    return t.__proto__ || Object.getPrototypeOf(t);
+  }, _getPrototypeOf(t);
+}
+
+function _setPrototypeOf(t, e) {
+  return _setPrototypeOf = Object.setPrototypeOf ? Object.setPrototypeOf.bind() : function (t, e) {
+    return t.__proto__ = e, t;
+  }, _setPrototypeOf(t, e);
+}
+
+function _inherits(t, e) {
+  if ("function" != typeof e && null !== e) throw new TypeError("Super expression must either be null or a function");
+  t.prototype = Object.create(e && e.prototype, {
+    constructor: {
+      value: t,
+      writable: !0,
+      configurable: !0
+    }
+  }), Object.defineProperty(t, "prototype", {
+    writable: !1
+  }), e && _setPrototypeOf(t, e);
+}
+
+function _isNativeFunction(t) {
+  try {
+    return -1 !== Function.toString.call(t).indexOf("[native code]");
+  } catch (n) {
+    return "function" == typeof t;
+  }
+}
+
+function _isNativeReflectConstruct$1() {
+  try {
+    var t = !Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function () {}));
+  } catch (t) {}
+  return (_isNativeReflectConstruct$1 = function _isNativeReflectConstruct() {
+    return !!t;
+  })();
+}
+
+function _construct(t, e, r) {
+  if (_isNativeReflectConstruct$1()) return Reflect.construct.apply(null, arguments);
+  var o = [null];
+  o.push.apply(o, e);
+  var p = new (t.bind.apply(t, o))();
+  return r && _setPrototypeOf(p, r.prototype), p;
+}
+
+function _wrapNativeSuper(t) {
+  var r = "function" == typeof Map ? new Map() : void 0;
+  return _wrapNativeSuper = function _wrapNativeSuper(t) {
+    if (null === t || !_isNativeFunction(t)) return t;
+    if ("function" != typeof t) throw new TypeError("Super expression must either be null or a function");
+    if (void 0 !== r) {
+      if (r.has(t)) return r.get(t);
+      r.set(t, Wrapper);
+    }
+    function Wrapper() {
+      return _construct(t, arguments, _getPrototypeOf(this).constructor);
+    }
+    return Wrapper.prototype = Object.create(t.prototype, {
+      constructor: {
+        value: Wrapper,
+        enumerable: !1,
+        writable: !0,
+        configurable: !0
+      }
+    }), _setPrototypeOf(Wrapper, t);
+  }, _wrapNativeSuper(t);
+}
+
+var _excluded$1 = ["accessKeyId", "accessKeySecret"];
+function ownKeys$1(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread$1(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$1(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$1(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+function _createForOfIteratorHelper$2(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray$3(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t["return"] || t["return"](); } finally { if (u) throw o; } } }; }
+function _unsupportedIterableToArray$3(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray$3(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray$3(r, a) : void 0; } }
+function _arrayLikeToArray$3(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
+function _callSuper(t, o, e) { return o = _getPrototypeOf(o), _possibleConstructorReturn(t, _isNativeReflectConstruct() ? Reflect.construct(o, e || [], _getPrototypeOf(t).constructor) : o.apply(t, e)); }
+function _isNativeReflectConstruct() { try { var t = !Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function () {})); } catch (t) {} return (_isNativeReflectConstruct = function _isNativeReflectConstruct() { return !!t; })(); }
+var DEFAULT_MAX_SIZE = 2 * 1024 * 1024;
+var DEFAULT_SIGNED_URL_EXPIRES_IN = 60 * 60;
+var OssUploadError = /*#__PURE__*/function (_Error) {
+  function OssUploadError(message) {
+    var _this;
+    var status = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 400;
+    _classCallCheck(this, OssUploadError);
+    _this = _callSuper(this, OssUploadError, [message]);
+    _this.name = "OssUploadError";
+    _this.status = status;
+    return _this;
+  }
+  _inherits(OssUploadError, _Error);
+  return _createClass(OssUploadError);
+}(/*#__PURE__*/_wrapNativeSuper(Error));
+function requiredValue(value, name) {
+  var trimmed = String(value || "").trim();
+  if (!trimmed) {
+    throw new OssUploadError("Missing required OSS config: ".concat(name), 500);
+  }
+  return trimmed;
+}
+function normalizeHost(value) {
+  return value.replace(/^https?:\/\//, "").replace(/\/+$/, "");
+}
+function buildBucketBaseUrl(bucket, endpoint) {
+  return "https://".concat(bucket, ".").concat(endpoint);
+}
+function normalizePublicBaseUrl(value, bucket, endpoint) {
+  var raw = String(value || "").trim();
+  if (!raw) {
+    return buildBucketBaseUrl(bucket, endpoint);
+  }
+  var withProtocol = /^https?:\/\//i.test(raw) ? raw : "https://".concat(raw);
+  try {
+    var url = new URL(withProtocol);
+    if (url.host === endpoint) {
+      url.host = "".concat(bucket, ".").concat(endpoint);
+    }
+    return url.toString().replace(/\/+$/, "");
+  } catch (_unused) {
+    return withProtocol.replace(/\/+$/, "");
+  }
+}
+function sanitizePathSegment(value) {
+  return String(value || "").trim().replace(/[^a-zA-Z0-9/_-]+/g, "-").replace(/\/{2,}/g, "/").replace(/^\/+|\/+$/g, "");
+}
+function extFromName() {
+  var name = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : "";
+  var match = String(name).match(/(\.[a-zA-Z0-9]+)$/);
+  return match ? match[1].toLowerCase() : "";
+}
+function encodeObjectKey(objectKey) {
+  return objectKey.split("/").map(function (segment) {
+    return encodeURIComponent(segment);
+  }).join("/");
+}
+function buildObjectKey(config, directory, originalName) {
+  var safeDirectory = sanitizePathSegment(directory || "uploads");
+  var safePrefix = sanitizePathSegment(config.prefix || "cms-assets");
+  var extension = extFromName(originalName) || ".bin";
+  var stamp = new Date().toISOString().replace(/[-:.TZ]/g, "").slice(0, 14);
+  var random = Math.random().toString(16).slice(2, 10).padEnd(8, "0");
+  return "".concat(safePrefix, "/").concat(safeDirectory, "/").concat(stamp, "-").concat(random).concat(extension);
+}
+function extractXmlField(errorText, fieldName) {
+  var match = String(errorText || "").match(new RegExp("<".concat(fieldName, ">([^<]+)</").concat(fieldName, ">"), "i"));
+  return match ? match[1].trim() : "";
+}
+function extractRecommendedEndpoint(errorText) {
+  return normalizeHost(extractXmlField(errorText, "Endpoint"));
+}
+function resolvePublicBaseUrl(publicBaseUrl, bucket, endpoint, nextEndpoint) {
+  var defaultBaseUrl = buildBucketBaseUrl(bucket, endpoint);
+  if (publicBaseUrl === defaultBaseUrl) {
+    return buildBucketBaseUrl(bucket, nextEndpoint);
+  }
+  return publicBaseUrl;
+}
+function arrayBufferToBase64(value) {
+  var bytes = new Uint8Array(value);
+  if (typeof Buffer !== "undefined") {
+    return Buffer.from(bytes).toString("base64");
+  }
+  var binary = "";
+  var _iterator = _createForOfIteratorHelper$2(bytes),
+    _step;
+  try {
+    for (_iterator.s(); !(_step = _iterator.n()).done;) {
+      var _byte = _step.value;
+      binary += String.fromCharCode(_byte);
+    }
+  } catch (err) {
+    _iterator.e(err);
+  } finally {
+    _iterator.f();
+  }
+  return btoa(binary);
+}
+function signBase64(_x, _x2) {
+  return _signBase.apply(this, arguments);
+}
+function _signBase() {
+  _signBase = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee2(secret, stringToSign) {
+    var _globalThis$crypto;
+    var encoder, key, signature;
+    return _regeneratorRuntime.wrap(function (_context2) {
+      while (1) switch (_context2.prev = _context2.next) {
+        case 0:
+          if ((_globalThis$crypto = globalThis.crypto) !== null && _globalThis$crypto !== void 0 && _globalThis$crypto.subtle) {
+            _context2.next = 1;
+            break;
+          }
+          throw new OssUploadError("Web Crypto is unavailable in the current runtime", 500);
+        case 1:
+          encoder = new TextEncoder();
+          _context2.next = 2;
+          return globalThis.crypto.subtle.importKey("raw", encoder.encode(secret), {
+            name: "HMAC",
+            hash: "SHA-1"
+          }, false, ["sign"]);
+        case 2:
+          key = _context2.sent;
+          _context2.next = 3;
+          return globalThis.crypto.subtle.sign("HMAC", key, encoder.encode(stringToSign));
+        case 3:
+          signature = _context2.sent;
+          return _context2.abrupt("return", arrayBufferToBase64(signature));
+        case 4:
+        case "end":
+          return _context2.stop();
+      }
+    }, _callee2);
+  }));
+  return _signBase.apply(this, arguments);
+}
+function createPermissionDeniedMessage(bucket, objectKey, errorText) {
+  var action = extractXmlField(errorText, "AuthAction");
+  var principalType = extractXmlField(errorText, "AuthPrincipalType");
+  var principalName = extractXmlField(errorText, "AuthPrincipalDisplayName");
+  var policyType = extractXmlField(errorText, "PolicyType");
+  var denyType = extractXmlField(errorText, "NoPermissionType");
+  var parts = ["OSS permission denied for bucket \"".concat(bucket, "\""), action ? "missing ".concat(action) : "missing required OSS permission", "resource ".concat(bucket, "/").concat(objectKey)];
+  if (principalType || principalName) {
+    parts.push("principal ".concat([principalType, principalName].filter(Boolean).join(":")));
+  }
+  if (policyType || denyType) {
+    parts.push("policy ".concat([policyType, denyType].filter(Boolean).join("/")));
+  }
+  parts.push("Grant oss:PutObject to the configured RAM user for this bucket or prefix.");
+  return parts.join("; ");
+}
+function createEndpointMismatchMessage(bucket, endpoint, suggestedEndpoint) {
+  return ["OSS endpoint mismatch for bucket \"".concat(bucket, "\""), "configured OSS_ENDPOINT=".concat(endpoint), "OSS says use ".concat(suggestedEndpoint), "Update OSS_ENDPOINT and OSS_PUBLIC_BASE_URL to the bucket's actual region."].join("; ");
+}
+function createAuthorization(_x3, _x4, _x5, _x6, _x7) {
+  return _createAuthorization.apply(this, arguments);
+}
+function _createAuthorization() {
+  _createAuthorization = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee3(config, method, objectKey, contentType, date) {
+    var stringToSign, signature;
+    return _regeneratorRuntime.wrap(function (_context3) {
+      while (1) switch (_context3.prev = _context3.next) {
+        case 0:
+          stringToSign = [method, "", contentType, date, "/".concat(config.bucket, "/").concat(objectKey)].join("\n");
+          _context3.next = 1;
+          return signBase64(config.accessKeySecret, stringToSign);
+        case 1:
+          signature = _context3.sent;
+          return _context3.abrupt("return", "OSS ".concat(config.accessKeyId, ":").concat(signature));
+        case 2:
+        case "end":
+          return _context3.stop();
+      }
+    }, _callee3);
+  }));
+  return _createAuthorization.apply(this, arguments);
+}
+function createSignedGetUrl(_x8, _x9, _x0) {
+  return _createSignedGetUrl.apply(this, arguments);
+}
+function _createSignedGetUrl() {
+  _createSignedGetUrl = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee4(config, objectKey, expiresIn) {
+    var expires, stringToSign, signature, encodedObjectKey, url;
+    return _regeneratorRuntime.wrap(function (_context4) {
+      while (1) switch (_context4.prev = _context4.next) {
+        case 0:
+          expires = Math.max(1, Math.floor(Date.now() / 1000) + expiresIn);
+          stringToSign = ["GET", "", "", String(expires), "/".concat(config.bucket, "/").concat(objectKey)].join("\n");
+          _context4.next = 1;
+          return signBase64(config.accessKeySecret, stringToSign);
+        case 1:
+          signature = _context4.sent;
+          encodedObjectKey = encodeObjectKey(objectKey);
+          url = new URL("".concat(buildBucketBaseUrl(config.bucket, config.endpoint), "/").concat(encodedObjectKey));
+          url.searchParams.set("OSSAccessKeyId", config.accessKeyId);
+          url.searchParams.set("Expires", String(expires));
+          url.searchParams.set("Signature", signature);
+          return _context4.abrupt("return", url.toString());
+        case 2:
+        case "end":
+          return _context4.stop();
+      }
+    }, _callee4);
+  }));
+  return _createSignedGetUrl.apply(this, arguments);
+}
+function putObjectToOss(_x1, _x10, _x11, _x12, _x13) {
+  return _putObjectToOss.apply(this, arguments);
+}
+function _putObjectToOss() {
+  _putObjectToOss = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee5(config, endpoint, objectKey, contentType, buffer) {
+    var date, authorization, bodyBytes, body;
+    return _regeneratorRuntime.wrap(function (_context5) {
+      while (1) switch (_context5.prev = _context5.next) {
+        case 0:
+          date = new Date().toUTCString();
+          _context5.next = 1;
+          return createAuthorization(config, "PUT", objectKey, contentType, date);
+        case 1:
+          authorization = _context5.sent;
+          bodyBytes = Uint8Array.from(buffer);
+          body = new Blob([bodyBytes], {
+            type: contentType
+          });
+          return _context5.abrupt("return", fetch("".concat(buildBucketBaseUrl(config.bucket, endpoint), "/").concat(encodeObjectKey(objectKey)), {
+            method: "PUT",
+            headers: {
+              Authorization: authorization,
+              Date: date,
+              "Content-Type": contentType
+            },
+            body: body
+          }));
+        case 2:
+        case "end":
+          return _context5.stop();
+      }
+    }, _callee5);
+  }));
+  return _putObjectToOss.apply(this, arguments);
+}
+function normalizeConfig(config) {
+  var bucket = requiredValue(config.bucket, "bucket");
+  var endpoint = normalizeHost(requiredValue(config.endpoint, "endpoint"));
+  return {
+    provider: "aliyun-oss",
+    bucket: bucket,
+    endpoint: endpoint,
+    accessKeyId: requiredValue(config.accessKeyId, "accessKeyId"),
+    accessKeySecret: requiredValue(config.accessKeySecret, "accessKeySecret"),
+    publicBaseUrl: normalizePublicBaseUrl(config.publicBaseUrl, bucket, endpoint),
+    prefix: sanitizePathSegment(config.prefix || "cms-assets"),
+    maxSize: Number(config.maxSize || DEFAULT_MAX_SIZE),
+    returnMode: config.returnMode || "both",
+    signedUrlExpiresIn: Number(config.signedUrlExpiresIn || DEFAULT_SIGNED_URL_EXPIRES_IN)
+  };
+}
+var OssUploadService = /*#__PURE__*/function () {
+  function OssUploadService(config) {
+    _classCallCheck(this, OssUploadService);
+    this.config = normalizeConfig(config);
+  }
+  return _createClass(OssUploadService, [{
+    key: "getConfig",
+    value: function getConfig() {
+      var _this$config = this.config;
+        _this$config.accessKeyId;
+        _this$config.accessKeySecret;
+        var safeConfig = _objectWithoutProperties(_this$config, _excluded$1);
+      return safeConfig;
+    }
+  }, {
+    key: "upload",
+    value: function () {
+      var _upload = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee(input) {
+        var contentType, buffer, objectKey, activeEndpoint, publicBaseUrl, response, lastErrorText, errorText, suggestedEndpoint, finalErrorText, finalSuggestedEndpoint, encodedObjectKey, publicUrl, signedUrl, _t;
+        return _regeneratorRuntime.wrap(function (_context) {
+          while (1) switch (_context.prev = _context.next) {
+            case 0:
+              contentType = String(input.contentType || "application/octet-stream").trim() || "application/octet-stream";
+              buffer = new Uint8Array(input.buffer);
+              if (buffer.byteLength) {
+                _context.next = 1;
+                break;
+              }
+              throw new OssUploadError("Uploaded file is empty");
+            case 1:
+              if (!(buffer.byteLength > this.config.maxSize)) {
+                _context.next = 2;
+                break;
+              }
+              throw new OssUploadError("File exceeds max size of ".concat(this.config.maxSize, " bytes"));
+            case 2:
+              objectKey = buildObjectKey(this.config, input.directory, input.originalName);
+              activeEndpoint = this.config.endpoint;
+              publicBaseUrl = this.config.publicBaseUrl;
+              _context.next = 3;
+              return putObjectToOss(this.config, activeEndpoint, objectKey, contentType, buffer);
+            case 3:
+              response = _context.sent;
+              lastErrorText = "";
+              if (response.ok) {
+                _context.next = 10;
+                break;
+              }
+              _context.next = 4;
+              return response.text();
+            case 4:
+              errorText = _context.sent;
+              lastErrorText = errorText;
+              suggestedEndpoint = extractRecommendedEndpoint(errorText);
+              if (!(response.status === 403 && suggestedEndpoint && suggestedEndpoint !== activeEndpoint)) {
+                _context.next = 7;
+                break;
+              }
+              activeEndpoint = suggestedEndpoint;
+              publicBaseUrl = resolvePublicBaseUrl(publicBaseUrl, this.config.bucket, this.config.endpoint, suggestedEndpoint);
+              _context.next = 5;
+              return putObjectToOss(this.config, activeEndpoint, objectKey, contentType, buffer);
+            case 5:
+              response = _context.sent;
+              if (response.ok) {
+                _context.next = 7;
+                break;
+              }
+              _context.next = 6;
+              return response.text();
+            case 6:
+              lastErrorText = _context.sent;
+            case 7:
+              if (response.ok) {
+                _context.next = 10;
+                break;
+              }
+              finalErrorText = lastErrorText;
+              finalSuggestedEndpoint = extractRecommendedEndpoint(finalErrorText);
+              if (!(response.status === 403 && finalSuggestedEndpoint && finalSuggestedEndpoint !== this.config.endpoint)) {
+                _context.next = 8;
+                break;
+              }
+              throw new OssUploadError(createEndpointMismatchMessage(this.config.bucket, this.config.endpoint, finalSuggestedEndpoint), 400);
+            case 8:
+              if (!(response.status === 403 && /<Code>AccessDenied<\/Code>/i.test(finalErrorText))) {
+                _context.next = 9;
+                break;
+              }
+              throw new OssUploadError(createPermissionDeniedMessage(this.config.bucket, objectKey, finalErrorText), 403);
+            case 9:
+              throw new OssUploadError("OSS upload failed: ".concat(response.status, " ").concat(finalErrorText), 502);
+            case 10:
+              encodedObjectKey = encodeObjectKey(objectKey);
+              publicUrl = "".concat(publicBaseUrl, "/").concat(encodedObjectKey);
+              if (!(this.config.returnMode === "public-url")) {
+                _context.next = 11;
+                break;
+              }
+              _t = undefined;
+              _context.next = 13;
+              break;
+            case 11:
+              _context.next = 12;
+              return createSignedGetUrl(_objectSpread$1(_objectSpread$1({}, this.config), {}, {
+                endpoint: activeEndpoint
+              }), objectKey, this.config.signedUrlExpiresIn);
+            case 12:
+              _t = _context.sent;
+            case 13:
+              signedUrl = _t;
+              return _context.abrupt("return", {
+                objectKey: objectKey,
+                url: this.config.returnMode === "signed-url" ? signedUrl || publicUrl : publicUrl,
+                signedUrl: this.config.returnMode === "both" || this.config.returnMode === "signed-url" ? signedUrl : undefined
+              });
+            case 14:
+            case "end":
+              return _context.stop();
+          }
+        }, _callee, this);
+      }));
+      function upload(_x14) {
+        return _upload.apply(this, arguments);
+      }
+      return upload;
+    }()
+  }]);
+}();
+var ossUploadService = null;
+function initializeOssUpload(config) {
+  ossUploadService = new OssUploadService(config);
+  return ossUploadService;
+}
+function getOssUploadService() {
+  if (!ossUploadService) {
+    throw new OssUploadError("OSS upload is not initialized. Call initializeOssUpload(config) before registering upload routes.", 500);
+  }
+  return ossUploadService;
+}
+
+var ADMIN_REGISTRY_TABLE = "_cms_admin_registry";
+var ensured = false;
+function normalizeSessionId(sessionId) {
+  // 统一将连字符转换为下划线，确保 UUID 格式一致性
+  // 例如：1047aab4-eecb-4538-ad8d-b5847e762f30 和 1047aab4_eecb_4538_ad8d_b5847e762f30 被视为相同
+  return (sessionId || "").trim().replace(/-/g, "_");
+}
+/**
+ * 从前端传来的 auth tableName 中提取 session_id
+ * 约定：auth tableName 形如 `${sessionId}_cms_users`；无前缀则为 `cms_users`
+ */
+function extractSessionIdFromAuthTableName(tableName) {
+  var name = (tableName || "").trim();
+  if (!name) return "";
+  if (name === "cms_users") return "";
+  if (name.endsWith("_cms_users")) return name.slice(0, -"_cms_users".length);
+  // 兼容：如果传入的不是 cms_users，也允许把最后一个 "_cms_users" 前缀当作 session
+  var idx = name.lastIndexOf("_cms_users");
+  if (idx > 0) return name.slice(0, idx);
+  return "";
+}
+function ensureAdminRegistryTable(_x) {
+  return _ensureAdminRegistryTable.apply(this, arguments);
+}
+function _ensureAdminRegistryTable() {
+  _ensureAdminRegistryTable = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee(supabase) {
+    var _yield$supabase$from$, error;
+    return _regeneratorRuntime.wrap(function (_context) {
+      while (1) switch (_context.prev = _context.next) {
+        case 0:
+          if (!ensured) {
+            _context.next = 1;
+            break;
+          }
+          return _context.abrupt("return", true);
+        case 1:
+          _context.prev = 1;
+          _context.next = 2;
+          return supabase.from(ADMIN_REGISTRY_TABLE).select("session_id").limit(1);
+        case 2:
+          _yield$supabase$from$ = _context.sent;
+          error = _yield$supabase$from$.error;
+          if (error) {
+            _context.next = 3;
+            break;
+          }
+          ensured = true;
+          return _context.abrupt("return", true);
+        case 3:
+          _context.next = 5;
+          break;
+        case 4:
+          _context.prev = 4;
+          _context["catch"](1);
+        case 5:
+          return _context.abrupt("return", false);
+        case 6:
+        case "end":
+          return _context.stop();
+      }
+    }, _callee, null, [[1, 4]]);
+  }));
+  return _ensureAdminRegistryTable.apply(this, arguments);
+}
+function getSessionAdminRow(_x2, _x3) {
+  return _getSessionAdminRow.apply(this, arguments);
+}
+function _getSessionAdminRow() {
+  _getSessionAdminRow = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee2(supabase, sessionId) {
+    var sid, _yield$supabase$from$2, data, error;
+    return _regeneratorRuntime.wrap(function (_context2) {
+      while (1) switch (_context2.prev = _context2.next) {
+        case 0:
+          sid = normalizeSessionId(sessionId);
+          _context2.next = 1;
+          return supabase.from(ADMIN_REGISTRY_TABLE).select("session_id,user_id,email").eq("session_id", sid).maybeSingle();
+        case 1:
+          _yield$supabase$from$2 = _context2.sent;
+          data = _yield$supabase$from$2.data;
+          error = _yield$supabase$from$2.error;
+          if (!(error || !data)) {
+            _context2.next = 2;
+            break;
+          }
+          return _context2.abrupt("return", null);
+        case 2:
+          return _context2.abrupt("return", data);
+        case 3:
+        case "end":
+          return _context2.stop();
+      }
+    }, _callee2);
+  }));
+  return _getSessionAdminRow.apply(this, arguments);
+}
+function isUserSessionAdmin(_x4, _x5, _x6) {
+  return _isUserSessionAdmin.apply(this, arguments);
+}
+function _isUserSessionAdmin() {
+  _isUserSessionAdmin = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee3(supabase, sessionId, userId) {
+    var row;
+    return _regeneratorRuntime.wrap(function (_context3) {
+      while (1) switch (_context3.prev = _context3.next) {
+        case 0:
+          _context3.next = 1;
+          return getSessionAdminRow(supabase, sessionId);
+        case 1:
+          row = _context3.sent;
+          if (row) {
+            _context3.next = 2;
+            break;
+          }
+          return _context3.abrupt("return", false);
+        case 2:
+          return _context3.abrupt("return", row.user_id === userId);
+        case 3:
+        case "end":
+          return _context3.stop();
+      }
+    }, _callee3);
+  }));
+  return _isUserSessionAdmin.apply(this, arguments);
+}
+
+function _createForOfIteratorHelper$1(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray$2(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t["return"] || t["return"](); } finally { if (u) throw o; } } }; }
+function _unsupportedIterableToArray$2(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray$2(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray$2(r, a) : void 0; } }
+function _arrayLikeToArray$2(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
+var RESERVED_STATUS_FIELD = "status";
+var PUBLISH_STATUS_VALUES = new Set(["draft", "published"]);
 // 初始化Supabase连接和CMS系统
 function initializeSystem() {
   return _initializeSystem.apply(this, arguments);
-} // GET - 获取所有模型
+}
 function _initializeSystem() {
   _initializeSystem = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee() {
     var _t;
@@ -2718,13 +3360,72 @@ function _initializeSystem() {
   }));
   return _initializeSystem.apply(this, arguments);
 }
+function validateReservedFields(jsonSchema) {
+  if (!(jsonSchema !== null && jsonSchema !== void 0 && jsonSchema.fields) || !Array.isArray(jsonSchema.fields)) {
+    return "json_schema 必须包含 fields 数组";
+  }
+  var _iterator = _createForOfIteratorHelper$1(jsonSchema.fields),
+    _step;
+  try {
+    for (_iterator.s(); !(_step = _iterator.n()).done;) {
+      var field = _step.value;
+      if ((field === null || field === void 0 ? void 0 : field.name) !== RESERVED_STATUS_FIELD) {
+        continue;
+      }
+      if (field.type !== "string") {
+        return '字段 "status" 是保留字段，类型必须为 string。若这是业务状态，请改名为 category_status、order_status 等更具体的字段名。';
+      }
+      var configuredValues = new Set();
+      if (field.defaultValue !== undefined && field.defaultValue !== null) {
+        configuredValues.add(String(field.defaultValue));
+      }
+      if (Array.isArray(field["enum"])) {
+        var _iterator2 = _createForOfIteratorHelper$1(field["enum"]),
+          _step2;
+        try {
+          for (_iterator2.s(); !(_step2 = _iterator2.n()).done;) {
+            var enumValue = _step2.value;
+            configuredValues.add(String(enumValue));
+          }
+        } catch (err) {
+          _iterator2.e(err);
+        } finally {
+          _iterator2.f();
+        }
+      }
+      if (configuredValues.size === 0) {
+        return '字段 "status" 是保留发布状态字段。请显式将其配置为 draft/published；如果你需要业务状态，请改名为 category_status、order_status、user_status 等。';
+      }
+      var _iterator3 = _createForOfIteratorHelper$1(configuredValues),
+        _step3;
+      try {
+        for (_iterator3.s(); !(_step3 = _iterator3.n()).done;) {
+          var value = _step3.value;
+          if (!PUBLISH_STATUS_VALUES.has(value)) {
+            return "\u5B57\u6BB5 \"status\" \u4EC5\u5141\u8BB8\u8868\u793A\u53D1\u5E03\u72B6\u6001\uFF0C\u652F\u6301\u7684\u503C\u53EA\u6709 draft/published\u3002\u68C0\u6D4B\u5230\u975E\u6CD5\u503C \"".concat(value, "\"\u3002\u5982\u679C\u8FD9\u662F\u4E1A\u52A1\u72B6\u6001\uFF0C\u8BF7\u6539\u540D\u4E3A category_status\u3001order_status\u3001user_status \u7B49\u3002");
+          }
+        }
+      } catch (err) {
+        _iterator3.e(err);
+      } finally {
+        _iterator3.f();
+      }
+    }
+  } catch (err) {
+    _iterator.e(err);
+  } finally {
+    _iterator.f();
+  }
+  return null;
+}
+// GET - 获取所有模型
 function getModels(_x) {
   return _getModels.apply(this, arguments);
 }
 // POST - 创建新模型
 function _getModels() {
   _getModels = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee2(c) {
-    var cmsModelService, page, limit, name, models, total, offset, paginatedModels, response, _response, _t2;
+    var cmsModelService, page, limit, name, sessionId, models, tablePrefix, total, offset, paginatedModels, response, _response, _t2;
     return _regeneratorRuntime.wrap(function (_context2) {
       while (1) switch (_context2.prev = _context2.next) {
         case 0:
@@ -2735,11 +3436,19 @@ function _getModels() {
           cmsModelService = getCmsModelService();
           page = parseInt(c.req.query("page") || "1");
           limit = parseInt(c.req.query("limit") || "10");
-          name = c.req.query("name"); // 获取所有模型
+          name = c.req.query("name"); // 获取当前请求的 session_id
+          sessionId = normalizeSessionId(c.req.header("X-Session-Id") || c.req.header("x-session-id")); // 获取所有模型
           _context2.next = 2;
           return cmsModelService.findAll();
         case 2:
           models = _context2.sent;
+          // 根据 session_id 过滤模型（只返回属于当前 session 的表）
+          if (sessionId) {
+            tablePrefix = sessionId + "_";
+            models = models.filter(function (model) {
+              return model.table_name.startsWith(tablePrefix);
+            });
+          }
           // 如果有名称过滤
           if (name) {
             models = models.filter(function (model) {
@@ -2787,7 +3496,7 @@ function createModel(_x2) {
 // PUT - 更新模型
 function _createModel() {
   _createModel = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee3(c) {
-    var cmsModelService, dynamicTableService, body, name, table_name, json_schema, _response2, _response3, existingModel, _response4, allModels, nameExists, _response5, tableExists, _response6, tableCreated, _response7, newModel, response, _response8, _t3;
+    var cmsModelService, dynamicTableService, body, name, table_name, json_schema, _response2, schemaValidationError, _response3, existingModel, _response4, allModels, nameExists, _response5, tableExists, _response6, tableCreated, _response7, newModel, response, _response8, _t3;
     return _regeneratorRuntime.wrap(function (_context3) {
       while (1) switch (_context3.prev = _context3.next) {
         case 0:
@@ -2812,13 +3521,15 @@ function _createModel() {
           };
           return _context3.abrupt("return", c.json(_response2, 200));
         case 3:
-          if (!(!json_schema.fields || !Array.isArray(json_schema.fields))) {
+          // 验证 JSON 模式格式和保留字段规则
+          schemaValidationError = validateReservedFields(json_schema);
+          if (!schemaValidationError) {
             _context3.next = 4;
             break;
           }
           _response3 = {
             success: false,
-            message: "json_schema 必须包含 fields 数组"
+            message: schemaValidationError
           };
           return _context3.abrupt("return", c.json(_response3, 200));
         case 4:
@@ -2919,7 +3630,7 @@ function updateModel(_x3) {
 // DELETE - 删除模型
 function _updateModel() {
   _updateModel = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee4(c) {
-    var cmsModelService, body, id, name, json_schema, _response9, model, _response0, updateData, updatedModel, response, _response1, _t4;
+    var cmsModelService, body, id, name, json_schema, _response9, model, _response0, schemaValidationError, _response1, updateData, updatedModel, response, _response10, _t4;
     return _regeneratorRuntime.wrap(function (_context4) {
       while (1) switch (_context4.prev = _context4.next) {
         case 0:
@@ -2957,13 +3668,28 @@ function _updateModel() {
           };
           return _context4.abrupt("return", c.json(_response0, 200));
         case 5:
+          if (!json_schema) {
+            _context4.next = 6;
+            break;
+          }
+          schemaValidationError = validateReservedFields(json_schema);
+          if (!schemaValidationError) {
+            _context4.next = 6;
+            break;
+          }
+          _response1 = {
+            success: false,
+            message: schemaValidationError
+          };
+          return _context4.abrupt("return", c.json(_response1, 200));
+        case 6:
           // 更新模型信息（不允许修改表名）
           updateData = {};
           if (name) updateData.name = name;
           if (json_schema) updateData.json_schema = json_schema;
-          _context4.next = 6;
+          _context4.next = 7;
           return cmsModelService.update(id, updateData);
-        case 6:
+        case 7:
           updatedModel = _context4.sent;
           response = {
             success: true,
@@ -2971,21 +3697,21 @@ function _updateModel() {
             data: updatedModel
           };
           return _context4.abrupt("return", c.json(response));
-        case 7:
-          _context4.prev = 7;
+        case 8:
+          _context4.prev = 8;
           _t4 = _context4["catch"](0);
           console.error("更新模型失败:", _t4);
-          _response1 = {
+          _response10 = {
             success: false,
             message: "更新模型失败",
             error: _t4 instanceof Error ? _t4.message : "未知错误"
           };
-          return _context4.abrupt("return", c.json(_response1, 500));
-        case 8:
+          return _context4.abrupt("return", c.json(_response10, 500));
+        case 9:
         case "end":
           return _context4.stop();
       }
-    }, _callee4, null, [[0, 7]]);
+    }, _callee4, null, [[0, 8]]);
   }));
   return _updateModel.apply(this, arguments);
 }
@@ -2994,7 +3720,7 @@ function deleteModel(_x4) {
 }
 function _deleteModel() {
   _deleteModel = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee5(c) {
-    var cmsModelService, dynamicTableService, idStr, _response10, id, model, _response11, tableDropped, _response12, response, _response13, _t5;
+    var cmsModelService, dynamicTableService, idStr, _response11, id, model, _response12, tableDropped, _response13, response, _response14, _t5;
     return _regeneratorRuntime.wrap(function (_context5) {
       while (1) switch (_context5.prev = _context5.next) {
         case 0:
@@ -3009,11 +3735,11 @@ function _deleteModel() {
             _context5.next = 2;
             break;
           }
-          _response10 = {
+          _response11 = {
             success: false,
             message: "缺少模型 ID"
           };
-          return _context5.abrupt("return", c.json(_response10, 200));
+          return _context5.abrupt("return", c.json(_response11, 200));
         case 2:
           id = parseInt(idStr);
           _context5.next = 3;
@@ -3024,11 +3750,11 @@ function _deleteModel() {
             _context5.next = 4;
             break;
           }
-          _response11 = {
+          _response12 = {
             success: false,
             message: "模型不存在"
           };
-          return _context5.abrupt("return", c.json(_response11, 200));
+          return _context5.abrupt("return", c.json(_response12, 200));
         case 4:
           _context5.next = 5;
           return dynamicTableService.dropTable(model.table_name);
@@ -3038,11 +3764,11 @@ function _deleteModel() {
             _context5.next = 6;
             break;
           }
-          _response12 = {
+          _response13 = {
             success: false,
             message: "删除数据表失败"
           };
-          return _context5.abrupt("return", c.json(_response12, 200));
+          return _context5.abrupt("return", c.json(_response13, 200));
         case 6:
           _context5.next = 7;
           return cmsModelService["delete"](id);
@@ -3056,12 +3782,12 @@ function _deleteModel() {
           _context5.prev = 8;
           _t5 = _context5["catch"](0);
           console.error("删除模型失败:", _t5);
-          _response13 = {
+          _response14 = {
             success: false,
             message: "删除模型失败",
             error: _t5 instanceof Error ? _t5.message : "未知错误"
           };
-          return _context5.abrupt("return", c.json(_response13, 500));
+          return _context5.abrupt("return", c.json(_response14, 500));
         case 9:
         case "end":
           return _context5.stop();
@@ -3071,28 +3797,6 @@ function _deleteModel() {
   return _deleteModel.apply(this, arguments);
 }
 
-function _objectWithoutPropertiesLoose(r, e) {
-  if (null == r) return {};
-  var t = {};
-  for (var n in r) if ({}.hasOwnProperty.call(r, n)) {
-    if (-1 !== e.indexOf(n)) continue;
-    t[n] = r[n];
-  }
-  return t;
-}
-
-function _objectWithoutProperties(e, t) {
-  if (null == e) return {};
-  var o,
-    r,
-    i = _objectWithoutPropertiesLoose(e, t);
-  if (Object.getOwnPropertySymbols) {
-    var n = Object.getOwnPropertySymbols(e);
-    for (r = 0; r < n.length; r++) o = n[r], -1 === t.indexOf(o) && {}.propertyIsEnumerable.call(e, o) && (i[o] = e[o]);
-  }
-  return i;
-}
-
 function _arrayWithHoles(r) {
   if (Array.isArray(r)) return r;
 }
@@ -4199,130 +4903,6 @@ var AuthUtils = /*#__PURE__*/function () {
   }]);
 }();
 
-var ADMIN_REGISTRY_TABLE = "_cms_admin_registry";
-var ensured = false;
-function normalizeSessionId(sessionId) {
-  // 统一将连字符转换为下划线，确保 UUID 格式一致性
-  // 例如：1047aab4-eecb-4538-ad8d-b5847e762f30 和 1047aab4_eecb_4538_ad8d_b5847e762f30 被视为相同
-  return (sessionId || "").trim().replace(/-/g, "_");
-}
-/**
- * 从前端传来的 auth tableName 中提取 session_id
- * 约定：auth tableName 形如 `${sessionId}_cms_users`；无前缀则为 `cms_users`
- */
-function extractSessionIdFromAuthTableName(tableName) {
-  var name = (tableName || "").trim();
-  if (!name) return "";
-  if (name === "cms_users") return "";
-  if (name.endsWith("_cms_users")) return name.slice(0, -"_cms_users".length);
-  // 兼容：如果传入的不是 cms_users，也允许把最后一个 "_cms_users" 前缀当作 session
-  var idx = name.lastIndexOf("_cms_users");
-  if (idx > 0) return name.slice(0, idx);
-  return "";
-}
-function ensureAdminRegistryTable(_x) {
-  return _ensureAdminRegistryTable.apply(this, arguments);
-}
-function _ensureAdminRegistryTable() {
-  _ensureAdminRegistryTable = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee(supabase) {
-    var _yield$supabase$from$, error;
-    return _regeneratorRuntime.wrap(function (_context) {
-      while (1) switch (_context.prev = _context.next) {
-        case 0:
-          if (!ensured) {
-            _context.next = 1;
-            break;
-          }
-          return _context.abrupt("return", true);
-        case 1:
-          _context.prev = 1;
-          _context.next = 2;
-          return supabase.from(ADMIN_REGISTRY_TABLE).select("session_id").limit(1);
-        case 2:
-          _yield$supabase$from$ = _context.sent;
-          error = _yield$supabase$from$.error;
-          if (error) {
-            _context.next = 3;
-            break;
-          }
-          ensured = true;
-          return _context.abrupt("return", true);
-        case 3:
-          _context.next = 5;
-          break;
-        case 4:
-          _context.prev = 4;
-          _context["catch"](1);
-        case 5:
-          return _context.abrupt("return", false);
-        case 6:
-        case "end":
-          return _context.stop();
-      }
-    }, _callee, null, [[1, 4]]);
-  }));
-  return _ensureAdminRegistryTable.apply(this, arguments);
-}
-function getSessionAdminRow(_x2, _x3) {
-  return _getSessionAdminRow.apply(this, arguments);
-}
-function _getSessionAdminRow() {
-  _getSessionAdminRow = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee2(supabase, sessionId) {
-    var sid, _yield$supabase$from$2, data, error;
-    return _regeneratorRuntime.wrap(function (_context2) {
-      while (1) switch (_context2.prev = _context2.next) {
-        case 0:
-          sid = normalizeSessionId(sessionId);
-          _context2.next = 1;
-          return supabase.from(ADMIN_REGISTRY_TABLE).select("session_id,user_id,email").eq("session_id", sid).maybeSingle();
-        case 1:
-          _yield$supabase$from$2 = _context2.sent;
-          data = _yield$supabase$from$2.data;
-          error = _yield$supabase$from$2.error;
-          if (!(error || !data)) {
-            _context2.next = 2;
-            break;
-          }
-          return _context2.abrupt("return", null);
-        case 2:
-          return _context2.abrupt("return", data);
-        case 3:
-        case "end":
-          return _context2.stop();
-      }
-    }, _callee2);
-  }));
-  return _getSessionAdminRow.apply(this, arguments);
-}
-function isUserSessionAdmin(_x4, _x5, _x6) {
-  return _isUserSessionAdmin.apply(this, arguments);
-}
-function _isUserSessionAdmin() {
-  _isUserSessionAdmin = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee3(supabase, sessionId, userId) {
-    var row;
-    return _regeneratorRuntime.wrap(function (_context3) {
-      while (1) switch (_context3.prev = _context3.next) {
-        case 0:
-          _context3.next = 1;
-          return getSessionAdminRow(supabase, sessionId);
-        case 1:
-          row = _context3.sent;
-          if (row) {
-            _context3.next = 2;
-            break;
-          }
-          return _context3.abrupt("return", false);
-        case 2:
-          return _context3.abrupt("return", row.user_id === userId);
-        case 3:
-        case "end":
-          return _context3.stop();
-      }
-    }, _callee3);
-  }));
-  return _isUserSessionAdmin.apply(this, arguments);
-}
-
 function getRoleFromSupabaseUser$2(user) {
   var _user$app_metadata, _user$user_metadata;
   var appRole = user === null || user === void 0 || (_user$app_metadata = user.app_metadata) === null || _user$app_metadata === void 0 ? void 0 : _user$app_metadata.role;
@@ -4938,6 +5518,81 @@ function requireAuth(handler) {
   }();
 }
 
+function readTextField(formData, fieldName) {
+  var value = formData.get(fieldName);
+  return typeof value === "string" ? value.trim() : "";
+}
+function isFileLike(value) {
+  return !!value && typeof value !== "string" && typeof value.arrayBuffer === "function";
+}
+function uploadToOss(_x) {
+  return _uploadToOss.apply(this, arguments);
+}
+function _uploadToOss() {
+  _uploadToOss = _asyncToGenerator(/*#__PURE__*/_regeneratorRuntime.mark(function _callee(c) {
+    var formData, file, uploadService, result, status, _t, _t2, _t3, _t4, _t5, _t6;
+    return _regeneratorRuntime.wrap(function (_context) {
+      while (1) switch (_context.prev = _context.next) {
+        case 0:
+          _context.prev = 0;
+          _context.next = 1;
+          return c.req.raw.formData();
+        case 1:
+          formData = _context.sent;
+          file = formData.get("file");
+          if (isFileLike(file)) {
+            _context.next = 2;
+            break;
+          }
+          return _context.abrupt("return", c.json({
+            success: false,
+            message: "Missing file in multipart request"
+          }, 400));
+        case 2:
+          uploadService = getOssUploadService();
+          _t = uploadService;
+          _context.next = 3;
+          return file.arrayBuffer();
+        case 3:
+          _t2 = _context.sent;
+          _t3 = file.type || "application/octet-stream";
+          _t4 = readTextField(formData, "directory");
+          _t5 = file.name || "upload.bin";
+          _context.next = 4;
+          return _t.upload.call(_t, {
+            buffer: _t2,
+            contentType: _t3,
+            directory: _t4,
+            originalName: _t5
+          });
+        case 4:
+          result = _context.sent;
+          return _context.abrupt("return", c.json({
+            success: true,
+            url: result.url,
+            signedUrl: result.signedUrl,
+            objectKey: result.objectKey,
+            fieldName: readTextField(formData, "fieldName"),
+            tableName: readTextField(formData, "tableName")
+          }, 200));
+        case 5:
+          _context.prev = 5;
+          _t6 = _context["catch"](0);
+          status = _t6 instanceof OssUploadError ? _t6.status : 500;
+          return _context.abrupt("return", c.json({
+            success: false,
+            message: "Upload failed",
+            error: _t6 instanceof Error ? _t6.message : "Unknown upload error"
+          }, status));
+        case 6:
+        case "end":
+          return _context.stop();
+      }
+    }, _callee, null, [[0, 5]]);
+  }));
+  return _uploadToOss.apply(this, arguments);
+}
+
 function getRoleFromSupabaseUser$1(user) {
   var _user$app_metadata, _user$user_metadata;
   var appRole = user === null || user === void 0 || (_user$app_metadata = user.app_metadata) === null || _user$app_metadata === void 0 ? void 0 : _user$app_metadata.role;
@@ -5418,6 +6073,10 @@ function createAuthRoute(app, tableName) {
   });
   return app;
 }
+function createOssUploadRoute(app) {
+  app.post("/upload", requireJwtAuth, requireAdminRole, uploadToOss);
+  return app;
+}
 // 一键创建所有CMS路由
 function createCmsRoutes(app) {
   createModelRoute(app);
@@ -5426,5 +6085,5 @@ function createCmsRoutes(app) {
   return app;
 }
 
-export { AuthService, getCmsModelService as CmsModel, CmsModelService, DynamicTableService, closeSupabase as closeDatabase, closeSupabase, createAuthRoute, createCmsRoutes, createDataRoute, createDynamicAuthRoute, createDynamicDataRoute, createModel, createModelRoute, createTableData, deleteModel, deleteTableData, dropForeignKeys, executeSupabaseSetup, getAuthService, getCmsModelService, getCurrentUser, getSupabase as getDatabase, getDynamicTableService, getModels, getRelationOptions, getSupabase, getSupabaseSetupSQL, getTableData, getTableDataWithRelations, initializeCmsModel, initializeCmsSystem, initializeSupabase as initializeDatabase, initializeSupabase, login, requireAuth, signup, signupStatus, initializeCmsSystem as syncDatabase, testConnection, updateModel, updateTableData, verifyAuth };
+export { AuthService, getCmsModelService as CmsModel, CmsModelService, DynamicTableService, OssUploadError, OssUploadService, closeSupabase as closeDatabase, closeSupabase, createAuthRoute, createCmsRoutes, createDataRoute, createDynamicAuthRoute, createDynamicDataRoute, createModel, createModelRoute, createOssUploadRoute, createTableData, deleteModel, deleteTableData, dropForeignKeys, executeSupabaseSetup, getAuthService, getCmsModelService, getCurrentUser, getSupabase as getDatabase, getDynamicTableService, getModels, getOssUploadService, getRelationOptions, getSupabase, getSupabaseSetupSQL, getTableData, getTableDataWithRelations, initializeCmsModel, initializeCmsSystem, initializeSupabase as initializeDatabase, initializeOssUpload, initializeSupabase, login, requireAuth, signup, signupStatus, initializeCmsSystem as syncDatabase, testConnection, updateModel, updateTableData, uploadToOss, verifyAuth };
 //# sourceMappingURL=index.esm.js.map