globalThis.process ??= {};
globalThis.process.env ??= {};
import { t as createD1Client } from "./d1_DTqC4o_t.mjs";
import { i as createNeonHttpClient } from "./crypto_CY2zBtG3.mjs";
import { n as createCustomEngine, r as customAuthSchema, s as resolveServiceToken } from "./engine-custom_BJVTPCgT.mjs";
//#region src/lib/admin-engine.ts
var ROLE_HIERARCHY = [
	"viewer",
	"editor",
	"admin"
];
var SESSION_COOKIE = "mod_session";
function getAuthDb(env) {
	if (env.DB) return createD1Client(env.DB, { schema: customAuthSchema });
	if (env.DATABASE_URL) return createNeonHttpClient({
		connectionString: env.DATABASE_URL,
		schema: customAuthSchema
	});
	throw new Error("No database configured: set DB binding (D1) or DATABASE_URL secret (Neon)");
}
function buildAuthEngine(env) {
	const db = getAuthDb(env);
	const limiter = env.ADMIN_LOGIN_LIMITER;
	if (!limiter) console.warn("[mod-cms] ADMIN_LOGIN_LIMITER binding absent — login endpoint has no rate limiting");
	return createCustomEngine({
		db,
		jwtSecrets: [env.AUTH_SESSION_SECRET],
		pepper: {
			currentVersion: "v1",
			secrets: { v1: env.AUTH_PEPPER }
		},
		accessCookieName: SESSION_COOKIE,
		rateLimit: limiter ? async (scope, key) => {
			const { success } = await limiter.limit({ key: `${scope}:${key}` });
			return { allowed: success };
		} : void 0
	});
}
var SERVICE_TOKEN_TABLES = {
	authUsers: customAuthSchema.authUsers,
	serviceTokens: customAuthSchema.serviceTokens
};
function buildServiceTokenResolver(env) {
	const db = getAuthDb(env);
	return (rawToken) => resolveServiceToken(db, SERVICE_TOKEN_TABLES, rawToken);
}
//#endregion
export { buildServiceTokenResolver as i, SESSION_COOKIE as n, buildAuthEngine as r, ROLE_HIERARCHY as t };
