@dyrected/core 0.0.1 → 1.0.1

package/dist/index.mjs

@@ -1,6 +1,5 @@
 // src/app.ts
 import { Hono } from "hono";
-import { logger } from "hono/logger";
 import { cors } from "hono/cors";
 import { requestId } from "hono/request-id";
 
@@ -26,13 +25,13 @@ var PopulationService = class {
     const populatedDoc = { ...data };
     for (const field of fields) {
       const value = populatedDoc[field.name];
-      if (field.type === "relationship" && field.collection && value) {
-        const relatedCollection = this.collections.find((c) => c.slug === field.collection);
+      if (field.type === "relationship" && field.relationTo && value) {
+        const relatedCollection = this.collections.find((c) => c.slug === field.relationTo);
         if (!relatedCollection) continue;
         if (Array.isArray(value)) {
           populatedDoc[field.name] = await Promise.all(
             value.map(async (id) => {
-              const doc = await this.db.findOne({ collection: field.collection, id });
+              const doc = await this.db.findOne({ collection: field.relationTo, id });
               if (!doc) return id;
               return this.populate({
                 data: doc,
@@ -43,7 +42,7 @@ var PopulationService = class {
             })
           );
         } else if (typeof value === "string") {
-          const doc = await this.db.findOne({ collection: field.collection, id: value });
+          const doc = await this.db.findOne({ collection: field.relationTo, id: value });
           if (doc) {
             populatedDoc[field.name] = await this.populate({
               data: doc,
@@ -63,6 +62,20 @@ var PopulationService = class {
           maxDepth
         });
       }
+      if (field.type === "blocks" && field.blocks && Array.isArray(value)) {
+        populatedDoc[field.name] = await Promise.all(
+          value.map(async (blockData) => {
+            const blockConfig = field.blocks.find((b) => b.slug === blockData.blockType);
+            if (!blockConfig) return blockData;
+            return this.populate({
+              data: blockData,
+              fields: blockConfig.fields,
+              currentDepth,
+              maxDepth
+            });
+          })
+        );
+      }
     }
     return populatedDoc;
   }
@@ -84,6 +97,36 @@ var PopulationService = class {
   }
 };
 
+// src/services/defaults.service.ts
+var DefaultsService = class {
+  /**
+   * Recursively apply default values to a data object based on field definitions.
+   */
+  static apply(fields, data = {}) {
+    const result = { ...data || {} };
+    fields.forEach((field) => {
+      const value = result[field.name];
+      if (value === void 0 || value === null) {
+        if (field.defaultValue !== void 0) {
+          result[field.name] = field.defaultValue;
+        } else {
+          if (field.type === "boolean") result[field.name] = false;
+          else if (field.type === "array") result[field.name] = [];
+          else if (field.type === "multiSelect") result[field.name] = [];
+          else if (field.type === "object") {
+            result[field.name] = this.apply(field.fields || [], {});
+          }
+        }
+      } else if (field.type === "object" && field.fields) {
+        result[field.name] = this.apply(field.fields, value);
+      } else if (field.type === "array" && field.fields && Array.isArray(value)) {
+        result[field.name] = value.map((item) => this.apply(field.fields, item));
+      }
+    });
+    return result;
+  }
+};
+
 // src/controllers/collection.controller.ts
 var CollectionController = class {
   constructor(collection) {
@@ -91,50 +134,104 @@ var CollectionController = class {
   }
   collection;
   async find(c) {
-    const config = c.get("config");
-    const db = config.db;
+    const config2 = c.get("config");
+    const db = config2.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
     const limit = Number(c.req.query("limit")) || 10;
     const page = Number(c.req.query("page")) || 1;
-    const depth = Number(c.req.query("depth")) || 0;
+    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
+    const sort = c.req.query("sort") || void 0;
+    let where = void 0;
+    const whereRaw = c.req.query("where");
+    if (whereRaw) {
+      try {
+        where = JSON.parse(decodeURIComponent(whereRaw));
+      } catch {
+      }
+    }
     let result = await db.find({
       collection: this.collection.slug,
       limit,
-      page
+      page,
+      sort,
+      where
     });
+    result.docs = result.docs.map((doc) => DefaultsService.apply(this.collection.fields, doc));
     if (depth > 0) {
-      const populationService = new PopulationService(db, config.collections);
+      const populationService = new PopulationService(db, config2.collections);
       result = await populationService.populateResult(result, this.collection.fields, depth);
     }
     return c.json(result);
   }
   async findOne(c) {
-    const config = c.get("config");
-    const db = config.db;
+    const config2 = c.get("config");
+    const db = config2.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
     const id = c.req.param("id");
-    const depth = Number(c.req.query("depth")) || 0;
+    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     if (!id) return c.json({ message: "Missing ID" }, 400);
     const doc = await db.findOne({ collection: this.collection.slug, id });
     if (!doc) return c.json({ message: "Not Found" }, 404);
-    if (depth > 0 && doc) {
-      const populationService = new PopulationService(db, config.collections);
+    const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
+    if (depth > 0 && docWithDefaults) {
+      const populationService = new PopulationService(db, config2.collections);
       const populatedDoc = await populationService.populate({
-        data: doc,
+        data: docWithDefaults,
         fields: this.collection.fields,
         currentDepth: 0,
         maxDepth: depth
       });
       return c.json(populatedDoc);
     }
-    return c.json(doc);
+    return c.json(docWithDefaults);
   }
   async create(c) {
-    const db = c.get("config").db;
+    const config2 = c.get("config");
+    const db = config2.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const contentType = c.req.header("Content-Type") || "";
+    if (contentType.toLowerCase().includes("multipart/form-data")) {
+      return this.upload(c);
+    }
     const body = await c.req.json();
     const doc = await db.create({ collection: this.collection.slug, data: body });
     return c.json(doc, 201);
   }
+  async upload(c) {
+    const config2 = c.get("config");
+    const storage = config2.storage;
+    if (!storage) return c.json({ message: "Storage not configured" }, 500);
+    const formData = await c.req.formData();
+    const file = formData.get("file");
+    if (!file) return c.json({ message: "No file uploaded" }, 400);
+    const buffer = Buffer.from(await file.arrayBuffer());
+    const siteId = c.get("siteId");
+    const workspaceId = c.get("workspaceId");
+    const prefix = workspaceId ? `${workspaceId}/${siteId}` : siteId;
+    const fileData = await storage.upload({
+      filename: file.name,
+      buffer,
+      mimeType: file.type,
+      prefix
+    });
+    const otherData = {};
+    formData.forEach((value, key) => {
+      if (key !== "file" && typeof value === "string") {
+        otherData[key] = value;
+      }
+    });
+    const doc = await config2.db.create({
+      collection: this.collection.slug,
+      data: {
+        ...otherData,
+        ...fileData
+      }
+    });
+    return c.json(doc, 201);
+  }
   async update(c) {
     const db = c.get("config").db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
     const id = c.req.param("id");
     if (!id) return c.json({ message: "Missing ID" }, 400);
     const body = await c.req.json();
@@ -143,11 +240,33 @@ var CollectionController = class {
   }
   async delete(c) {
     const db = c.get("config").db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
     const id = c.req.param("id");
     if (!id) return c.json({ message: "Missing ID" }, 400);
     await db.delete({ collection: this.collection.slug, id });
     return c.json({ message: "Deleted" });
   }
+  async seed(c) {
+    const config2 = c.get("config");
+    const db = config2.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const body = await c.req.json();
+    const initialData = body.data;
+    if (!initialData || !Array.isArray(initialData)) {
+      return c.json({ message: "Invalid initial data" }, 400);
+    }
+    const result = await db.find({ collection: this.collection.slug, limit: 1 });
+    if (result.total > 0) {
+      return c.json({ message: "Collection is not empty, skipping seed" });
+    }
+    console.log(`[dyrected/core] Auto-seeding collection: ${this.collection.slug}`);
+    const createdDocs = [];
+    for (const data of initialData) {
+      const doc = await db.create({ collection: this.collection.slug, data });
+      createdDocs.push(doc);
+    }
+    return c.json({ message: "Seed successful", count: createdDocs.length }, 201);
+  }
 };
 
 // src/controllers/global.controller.ts
@@ -157,139 +276,1375 @@ var GlobalController = class {
   }
   global;
   async get(c) {
-    const config = c.get("config");
-    const db = config.db;
-    const depth = Number(c.req.query("depth")) || 0;
+    const config2 = c.get("config");
+    const db = config2.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const data = await db.getGlobal({ slug: this.global.slug });
-    if (depth > 0 && data) {
-      const populationService = new PopulationService(db, config.collections);
+    const dataWithDefaults = DefaultsService.apply(this.global.fields, data);
+    if (depth > 0 && dataWithDefaults) {
+      const populationService = new PopulationService(db, config2.collections);
       const populatedData = await populationService.populate({
-        data,
+        data: dataWithDefaults,
         fields: this.global.fields,
-        currentDepth: 0,
+        currentDepth: 1,
         maxDepth: depth
       });
       return c.json(populatedData);
     }
-    return c.json(data || {});
+    return c.json(dataWithDefaults);
   }
   async update(c) {
     const db = c.get("config").db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json();
     const data = await db.updateGlobal({ slug: this.global.slug, data: body });
     return c.json(data);
   }
+  async seed(c) {
+    const config2 = c.get("config");
+    const db = config2.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const body = await c.req.json();
+    const initialData = body.data;
+    if (!initialData) {
+      return c.json({ message: "Invalid initial data" }, 400);
+    }
+    const existing = await db.getGlobal({ slug: this.global.slug });
+    if (existing && Object.keys(existing).length > 0) {
+      return c.json({ message: "Global is not empty, skipping seed" });
+    }
+    console.log(`[dyrected/core] Auto-seeding global: ${this.global.slug}`);
+    await db.updateGlobal({ slug: this.global.slug, data: initialData });
+    return c.json({ message: "Seed successful", data: initialData }, 201);
+  }
 };
 
 // src/controllers/media.controller.ts
 var MediaController = class {
+  collection;
+  constructor(collection = "media") {
+    this.collection = collection;
+  }
   async upload(c) {
-    const config = c.get("config");
-    const storage = config.storage;
+    const config2 = c.get("config");
+    const storage = config2.storage;
+    const imageService = config2.image;
     if (!storage) {
       return c.json({ message: "Storage not configured" }, 500);
     }
     const body = await c.req.parseBody();
     const file = body["file"];
+    const focalPointStr = body["focalPoint"];
+    const focalPoint = focalPointStr ? JSON.parse(focalPointStr) : void 0;
     if (!file) {
       return c.json({ message: "No file uploaded" }, 400);
     }
     const buffer = Buffer.from(await file.arrayBuffer());
+    const siteId = c.get("siteId");
+    const workspaceId = c.get("workspaceId");
+    const prefix = workspaceId ? `${workspaceId}/${siteId}` : siteId || "default";
+    let imageMetadata = {};
+    let imageSizes = {};
+    if (imageService && file.type.startsWith("image/")) {
+      let colConfig = config2.collections.find((col) => col.slug === this.collection);
+      if (!colConfig && config2.onSchemaFetch && siteId) {
+        const dynamic = await config2.onSchemaFetch(siteId);
+        colConfig = dynamic.collections?.find((col) => col.slug === this.collection);
+      }
+      try {
+        const processed = await imageService.process({
+          buffer,
+          mimeType: file.type,
+          config: colConfig?.upload,
+          focalPoint
+        });
+        imageMetadata = processed.metadata;
+        imageSizes = processed.sizes;
+      } catch (err) {
+        console.error("[MediaController] Image processing failed:", err);
+      }
+    }
     const fileData = await storage.upload({
       filename: file.name,
       buffer,
-      mimeType: file.type
+      mimeType: file.type,
+      prefix
     });
-    const db = config.db;
+    const finalFileData = {
+      ...fileData,
+      ...imageMetadata,
+      focalPoint,
+      sizes: {}
+    };
+    if (imageSizes) {
+      for (const [sizeName, sizeData] of Object.entries(imageSizes)) {
+        const ext = file.name.split(".").pop();
+        const baseName = file.name.substring(0, file.name.lastIndexOf("."));
+        const sizeFilename = `${baseName}-${sizeName}.${ext}`;
+        try {
+          const sizeFileData = await storage.upload({
+            filename: sizeFilename,
+            buffer: sizeData.buffer,
+            mimeType: file.type,
+            prefix
+          });
+          finalFileData.sizes[sizeName] = {
+            ...sizeFileData,
+            width: sizeData.width,
+            height: sizeData.height
+          };
+        } catch (err) {
+          console.error(`[MediaController] Failed to upload size ${sizeName}:`, err);
+        }
+      }
+    }
+    const db = config2.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
     const doc = await db.create({
-      collection: "media",
-      data: fileData
+      collection: this.collection,
+      data: finalFileData
     });
     return c.json(doc, 201);
   }
   async find(c) {
     const db = c.get("config").db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
     const limit = Number(c.req.query("limit")) || 10;
     const page = Number(c.req.query("page")) || 1;
     const result = await db.find({
-      collection: "media",
+      collection: this.collection,
       limit,
       page
     });
     return c.json(result);
   }
   async delete(c) {
-    const config = c.get("config");
-    const storage = config.storage;
-    const db = config.db;
+    const config2 = c.get("config");
+    const storage = config2.storage;
+    const db = config2.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
     const id = c.req.param("id");
     if (!id) return c.json({ message: "Missing ID" }, 400);
-    const doc = await db.findOne({ collection: "media", id });
+    const doc = await db.findOne({ collection: this.collection, id });
     if (!doc) return c.json({ message: "Not Found" }, 404);
     if (storage) {
       await storage.delete({ filename: doc.filename });
+      if (doc.sizes) {
+        for (const size of Object.values(doc.sizes)) {
+          if (size.filename) {
+            await storage.delete({ filename: size.filename });
+          }
+        }
+      }
     }
-    await db.delete({ collection: "media", id });
+    await db.delete({ collection: this.collection, id });
     return c.json({ message: "Deleted" });
   }
+  async serve(c) {
+    const config2 = c.get("config");
+    const storage = config2.storage;
+    if (!storage || !storage.resolve) {
+      return c.json({ message: "Storage not configured for serving" }, 404);
+    }
+    const filename = c.req.param("filename");
+    if (!filename) return c.json({ message: "Missing filename" }, 400);
+    let res = await storage.resolve({ filename });
+    if (!res && !filename.includes("/")) {
+      res = await storage.resolve({ filename: `default/${filename}` });
+    }
+    if (!res) return c.json({ message: "Not Found" }, 404);
+    c.header("Content-Type", res.mimeType);
+    return c.body(res.buffer);
+  }
+};
+
+// src/auth/password.ts
+import { promisify } from "util";
+import { scrypt, randomBytes, timingSafeEqual } from "crypto";
+var scryptAsync = promisify(scrypt);
+var SALT_LEN = 16;
+var KEY_LEN = 64;
+async function hashPassword(plain) {
+  const salt = randomBytes(SALT_LEN).toString("hex");
+  const derivedKey = await scryptAsync(plain, salt, KEY_LEN);
+  return `${salt}:${derivedKey.toString("hex")}`;
+}
+async function verifyPassword(plain, stored) {
+  const [salt, storedHash] = stored.split(":");
+  if (!salt || !storedHash) return false;
+  const derivedKey = await scryptAsync(plain, salt, KEY_LEN);
+  const storedBuffer = Buffer.from(storedHash, "hex");
+  if (derivedKey.length !== storedBuffer.length) return false;
+  return timingSafeEqual(derivedKey, storedBuffer);
+}
+
+// src/auth/token.ts
+import { SignJWT, jwtVerify, decodeJwt } from "jose";
+import { TextEncoder } from "util";
+function getSecret() {
+  const secret = process.env.DYRECTED_JWT_SECRET || process.env.JWT_SECRET;
+  if (!secret) {
+    throw new Error(
+      "[dyrected/core] DYRECTED_JWT_SECRET is not set. Add it to your environment variables to enable auth collections."
+    );
+  }
+  return new TextEncoder().encode(secret);
+}
+var DEFAULT_EXPIRY = "7d";
+async function signCollectionToken(payload, expiresIn = DEFAULT_EXPIRY) {
+  return new SignJWT({ ...payload }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(expiresIn).sign(getSecret());
+}
+async function verifyCollectionToken(token) {
+  const { payload } = await jwtVerify(token, getSecret());
+  return payload;
+}
+
+// src/services/email.service.ts
+var _devSend = null;
+var _devSendPromise = null;
+async function getDevSend() {
+  if (_devSend) return _devSend;
+  if (_devSendPromise) return _devSendPromise;
+  _devSendPromise = (async () => {
+    try {
+      const nodemailer = await import("nodemailer");
+      const account = await nodemailer.default.createTestAccount();
+      const transport = nodemailer.default.createTransport({
+        host: "smtp.ethereal.email",
+        port: 587,
+        auth: { user: account.user, pass: account.pass }
+      });
+      console.log("[dyrected/core] No email config \u2014 using Ethereal for dev email preview.");
+      console.log(`[dyrected/core] Ethereal login: https://ethereal.email  user: ${account.user}  pass: ${account.pass}`);
+      _devSend = async ({ to, subject, html }) => {
+        const info = await transport.sendMail({ from: '"Dyrected Dev" <dev@dyrected.local>', to, subject, html });
+        console.log(`[dyrected/core] Email preview URL: ${nodemailer.default.getTestMessageUrl(info)}`);
+      };
+      return _devSend;
+    } catch {
+      console.warn("[dyrected/core] nodemailer not available \u2014 emails will not be sent in dev.");
+      return null;
+    }
+  })();
+  return _devSendPromise;
+}
+async function sendEmail(config2, payload) {
+  if (config2.email) {
+    await config2.email.send(payload);
+    return;
+  }
+  if (process.env.NODE_ENV !== "production") {
+    const devSend = await getDevSend();
+    await devSend?.(payload);
+  }
+}
+function buildWelcomeEmail(config2, args) {
+  const custom = config2.email?.templates?.welcome?.(args);
+  return {
+    subject: custom?.subject ?? "Welcome \u2014 your account is ready",
+    html: custom?.html ?? `
+      <div style="font-family:sans-serif;max-width:600px;margin:0 auto">
+        <h2>Welcome!</h2>
+        <p>Your account has been created. You can now log in with:</p>
+        <p><strong>${args.email}</strong></p>
+      </div>`
+  };
+}
+function buildInviteEmail(config2, args) {
+  const custom = config2.email?.templates?.invite?.(args);
+  return {
+    subject: custom?.subject ?? "You've been invited",
+    html: custom?.html ?? `
+      <div style="font-family:sans-serif;max-width:600px;margin:0 auto">
+        <h2>You've been invited</h2>
+        ${args.invitedByEmail ? `<p>Invited by <strong>${args.invitedByEmail}</strong>.</p>` : ""}
+        <p>Use the token below to accept your invitation. It expires in 7 days.</p>
+        <pre style="background:#f4f4f4;padding:12px;border-radius:4px;word-break:break-all">${args.token}</pre>
+      </div>`
+  };
+}
+function buildResetPasswordEmail(config2, args) {
+  const custom = config2.email?.templates?.resetPassword?.(args);
+  return {
+    subject: custom?.subject ?? "Reset your password",
+    html: custom?.html ?? `
+      <div style="font-family:sans-serif;max-width:600px;margin:0 auto">
+        <h2>Reset your password</h2>
+        <p>Use the token below to reset your password. It expires in 1 hour.</p>
+        <pre style="background:#f4f4f4;padding:12px;border-radius:4px;word-break:break-all">${args.token}</pre>
+      </div>`
+  };
+}
+function buildPasswordChangedEmail(config2, args) {
+  const custom = config2.email?.templates?.passwordChanged?.(args);
+  return {
+    subject: custom?.subject ?? "Your password has been changed",
+    html: custom?.html ?? `
+      <div style="font-family:sans-serif;max-width:600px;margin:0 auto">
+        <h2>Password changed</h2>
+        <p>The password for <strong>${args.email}</strong> was just changed.</p>
+        <p>If you did not make this change, please contact support immediately.</p>
+      </div>`
+  };
+}
+
+// src/controllers/auth.controller.ts
+var AuthController = class {
+  constructor(collection) {
+    this.collection = collection;
+  }
+  collection;
+  // ---------------------------------------------------------------------------
+  // GET /init
+  // Checks if the first user needs to be created.
+  // ---------------------------------------------------------------------------
+  async init(c) {
+    const db = c.get("config").db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const result = await db.find({
+      collection: this.collection.slug,
+      limit: 1
+    });
+    return c.json({
+      initialized: result.total > 0
+    });
+  }
+  // ---------------------------------------------------------------------------
+  // POST /first-user
+  // Creates the first user if none exist.
+  // ---------------------------------------------------------------------------
+  async registerFirstUser(c) {
+    const db = c.get("config").db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const check = await db.find({
+      collection: this.collection.slug,
+      limit: 1
+    });
+    if (check.total > 0) {
+      return c.json({ error: true, message: "Initial user already exists." }, 403);
+    }
+    const body = await c.req.json().catch(() => null);
+    if (!body?.email || !body?.password) {
+      return c.json({ error: true, message: "email and password are required." }, 400);
+    }
+    const hashedPassword = await hashPassword(body.password);
+    const user = await db.create({
+      collection: this.collection.slug,
+      data: {
+        ...body,
+        password: hashedPassword,
+        roles: ["admin"]
+        // Default first user to admin
+      }
+    });
+    const token = await signCollectionToken({
+      sub: user.id,
+      email: user.email,
+      collection: this.collection.slug
+    });
+    const { subject, html } = buildWelcomeEmail(config, { email: body.email });
+    sendEmail(config, { to: body.email, subject, html }).catch(
+      (err) => console.error("[dyrected/core] Failed to send welcome email:", err)
+    );
+    const { password: _, ...safeUser } = user;
+    return c.json({ token, user: safeUser });
+  }
+  // ---------------------------------------------------------------------------
+  // POST /login
+  // ---------------------------------------------------------------------------
+  async login(c) {
+    const db = c.get("config").db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const body = await c.req.json().catch(() => null);
+    if (!body?.email || !body?.password) {
+      return c.json({ error: true, message: "email and password are required." }, 400);
+    }
+    const result = await db.find({
+      collection: this.collection.slug,
+      where: { email: body.email },
+      limit: 1
+    });
+    const user = result.docs[0];
+    if (!user) {
+      return c.json({ error: true, message: "Invalid email or password." }, 401);
+    }
+    const valid = await verifyPassword(body.password, user.password);
+    if (!valid) {
+      return c.json({ error: true, message: "Invalid email or password." }, 401);
+    }
+    const token = await signCollectionToken({
+      sub: user.id,
+      email: user.email,
+      collection: this.collection.slug
+    });
+    const { password: _, ...safeUser } = user;
+    return c.json({ token, user: safeUser });
+  }
+  // ---------------------------------------------------------------------------
+  // POST /logout
+  // Auth collections use stateless JWTs — logout is handled client-side.
+  // This endpoint exists so clients have a consistent API surface.
+  // ---------------------------------------------------------------------------
+  async logout(c) {
+    return c.json({ success: true, message: "Logged out. Discard your token." });
+  }
+  // ---------------------------------------------------------------------------
+  // GET /me
+  // ---------------------------------------------------------------------------
+  async me(c) {
+    const db = c.get("config").db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const requestUser = c.get("user");
+    if (!requestUser) {
+      return c.json({ error: true, message: "Authentication required." }, 401);
+    }
+    const user = await db.findOne({ collection: this.collection.slug, id: requestUser.sub });
+    if (!user) {
+      return c.json({ error: true, message: "User not found." }, 404);
+    }
+    const { password: _, ...safeUser } = user;
+    return c.json(safeUser);
+  }
+  // ---------------------------------------------------------------------------
+  // POST /refresh-token
+  // ---------------------------------------------------------------------------
+  async refreshToken(c) {
+    const requestUser = c.get("user");
+    if (!requestUser) {
+      return c.json({ error: true, message: "Authentication required." }, 401);
+    }
+    const token = await signCollectionToken({
+      sub: requestUser.sub,
+      email: requestUser.email,
+      collection: this.collection.slug
+    });
+    return c.json({ token });
+  }
+  // ---------------------------------------------------------------------------
+  // POST /forgot-password
+  // Requires config.email to be set. Silently succeeds if email not found
+  // to prevent email enumeration.
+  // ---------------------------------------------------------------------------
+  async forgotPassword(c) {
+    const config2 = c.get("config");
+    const db = config2.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const body = await c.req.json().catch(() => null);
+    if (!body?.email) {
+      return c.json({ error: true, message: "email is required." }, 400);
+    }
+    const result = await db.find({
+      collection: this.collection.slug,
+      where: { email: body.email },
+      limit: 1
+    });
+    const user = result.docs[0];
+    if (user) {
+      const resetToken = await signCollectionToken(
+        { sub: user.id, email: user.email, collection: this.collection.slug, purpose: "reset" },
+        "1h"
+      );
+      try {
+        const { subject, html } = buildResetPasswordEmail(config2, { token: resetToken });
+        await sendEmail(config2, { to: user.email, subject, html });
+      } catch (err) {
+        console.error("[dyrected/core] Failed to send password reset email:", err);
+      }
+    }
+    return c.json({
+      success: true,
+      message: "If an account with that email exists, a reset link has been sent."
+    });
+  }
+  // ---------------------------------------------------------------------------
+  // POST /reset-password
+  // Expects { token: string, password: string } in body.
+  // The token is the reset JWT issued by /forgot-password.
+  // ---------------------------------------------------------------------------
+  async resetPassword(c) {
+    const db = c.get("config").db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const body = await c.req.json().catch(() => null);
+    if (!body?.token || !body?.password) {
+      return c.json({ error: true, message: "token and password are required." }, 400);
+    }
+    let payload;
+    try {
+      payload = await verifyCollectionToken(body.token);
+    } catch {
+      return c.json({ error: true, message: "Reset token is invalid or has expired." }, 400);
+    }
+    if (payload.collection !== this.collection.slug || payload.purpose !== "reset") {
+      return c.json({ error: true, message: "Reset token is invalid or has expired." }, 400);
+    }
+    const hashedPassword = await hashPassword(body.password);
+    await db.update({
+      collection: this.collection.slug,
+      id: payload.sub,
+      data: { password: hashedPassword }
+    });
+    const { subject, html } = buildPasswordChangedEmail(config, { email: payload.email });
+    sendEmail(config, { to: payload.email, subject, html }).catch(
+      (err) => console.error("[dyrected/core] Failed to send password-changed email:", err)
+    );
+    return c.json({ success: true, message: "Password has been reset. You can now log in." });
+  }
+  // ---------------------------------------------------------------------------
+  // POST /invite
+  // Requires auth. Issues a signed invite token and emails it to the invitee.
+  // ---------------------------------------------------------------------------
+  async invite(c) {
+    const config2 = c.get("config");
+    const db = config2.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const requestUser = c.get("user");
+    if (!requestUser) {
+      return c.json({ error: true, message: "Authentication required." }, 401);
+    }
+    const body = await c.req.json().catch(() => null);
+    if (!body?.email) {
+      return c.json({ error: true, message: "email is required." }, 400);
+    }
+    const existing = await db.find({
+      collection: this.collection.slug,
+      where: { email: body.email },
+      limit: 1
+    });
+    if (existing.total > 0) {
+      return c.json({ error: true, message: "An account with that email already exists." }, 409);
+    }
+    const inviteToken = await signCollectionToken(
+      { sub: body.email, email: body.email, collection: this.collection.slug, purpose: "invite" },
+      "7d"
+    );
+    try {
+      const { subject, html } = buildInviteEmail(config2, {
+        token: inviteToken,
+        invitedByEmail: requestUser.email
+      });
+      await sendEmail(config2, { to: body.email, subject, html });
+    } catch (err) {
+      console.error("[dyrected/core] Failed to send invite email:", err);
+    }
+    return c.json({ success: true, message: `Invite sent to ${body.email}.` });
+  }
+  // ---------------------------------------------------------------------------
+  // POST /accept-invite
+  // Public. Validates the invite token and creates the user account.
+  // Body: { token, password, ...extraFields }
+  // ---------------------------------------------------------------------------
+  async acceptInvite(c) {
+    const config2 = c.get("config");
+    const db = config2.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const body = await c.req.json().catch(() => null);
+    if (!body?.token || !body?.password) {
+      return c.json({ error: true, message: "token and password are required." }, 400);
+    }
+    let payload;
+    try {
+      payload = await verifyCollectionToken(body.token);
+    } catch {
+      return c.json({ error: true, message: "Invite token is invalid or has expired." }, 400);
+    }
+    if (payload.collection !== this.collection.slug || payload.purpose !== "invite") {
+      return c.json({ error: true, message: "Invite token is invalid or has expired." }, 400);
+    }
+    const inviteeEmail = payload.sub;
+    const existing = await db.find({
+      collection: this.collection.slug,
+      where: { email: inviteeEmail },
+      limit: 1
+    });
+    if (existing.total > 0) {
+      return c.json({ error: true, message: "An account with that email already exists." }, 409);
+    }
+    const { token: _t, password: _p, ...extraFields } = body;
+    const hashedPassword = await hashPassword(body.password);
+    const user = await db.create({
+      collection: this.collection.slug,
+      data: { ...extraFields, email: inviteeEmail, password: hashedPassword }
+    });
+    const sessionToken = await signCollectionToken({
+      sub: user.id,
+      email: inviteeEmail,
+      collection: this.collection.slug
+    });
+    const { subject, html } = buildWelcomeEmail(config2, { email: inviteeEmail });
+    sendEmail(config2, { to: inviteeEmail, subject, html }).catch(
+      (err) => console.error("[dyrected/core] Failed to send welcome email:", err)
+    );
+    const { password: _, ...safeUser } = user;
+    return c.json({ token: sessionToken, user: safeUser }, 201);
+  }
 };
 
+// src/controllers/preview.controller.ts
+import { SignJWT as SignJWT2, jwtVerify as jwtVerify2 } from "jose";
+import { TextEncoder as TextEncoder2 } from "util";
+var PreviewController = class {
+  getSecret() {
+    const secret = process.env.DYRECTED_JWT_SECRET || process.env.JWT_SECRET || "dyrected-preview-secret-change-me";
+    return new TextEncoder2().encode(secret);
+  }
+  /**
+   * POST /api/preview-token
+   * Generates a short-lived token for previewing unsaved data.
+   */
+  async createToken(c) {
+    const body = await c.req.json().catch(() => null);
+    if (!body?.collectionSlug || !body?.data) {
+      return c.json({ error: true, message: "collectionSlug and data are required." }, 400);
+    }
+    const token = await new SignJWT2({
+      collectionSlug: body.collectionSlug,
+      documentId: body.documentId,
+      data: body.data
+    }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("15m").sign(this.getSecret());
+    const expiresAt = new Date(Date.now() + 15 * 60 * 1e3).toISOString();
+    return c.json({ token, expiresAt });
+  }
+  /**
+   * GET /api/preview-data?token=<jwt>
+   * Returns the data stored in the preview token.
+   */
+  async getData(c) {
+    const token = c.req.query("token");
+    if (!token) {
+      return c.json({ error: true, message: "token query parameter is required." }, 400);
+    }
+    try {
+      const { payload } = await jwtVerify2(token, this.getSecret());
+      return c.json(payload);
+    } catch (err) {
+      return c.json({ error: true, message: "Invalid or expired preview token." }, 401);
+    }
+  }
+};
+
+// src/middleware/auth.ts
+function requireAuth() {
+  return async (c, next) => {
+    const authHeader = c.req.header("Authorization");
+    const token = authHeader?.replace(/^Bearer\s+/i, "");
+    if (!token) {
+      return c.json({ error: true, message: "Authentication required." }, 401);
+    }
+    try {
+      const user = await verifyCollectionToken(token);
+      c.set("user", user);
+      await next();
+    } catch {
+      return c.json({ error: true, message: "Invalid or expired token." }, 401);
+    }
+  };
+}
+function optionalAuth() {
+  return async (c, next) => {
+    const authHeader = c.req.header("Authorization");
+    const token = authHeader?.replace(/^Bearer\s+/i, "");
+    if (token) {
+      try {
+        const user = await verifyCollectionToken(token);
+        c.set("user", user);
+      } catch {
+      }
+    }
+    await next();
+  };
+}
+
+// src/utils/openapi.ts
+function generateOpenApi(config2) {
+  const spec = {
+    openapi: "3.0.0",
+    info: {
+      title: "Dyrected API",
+      version: "1.0.0",
+      description: "Automatically generated OpenAPI specification for the Dyrected project."
+    },
+    components: {
+      schemas: {},
+      securitySchemes: {
+        ApiKeyAuth: {
+          type: "apiKey",
+          in: "header",
+          name: "x-api-key"
+        }
+      }
+    },
+    paths: {},
+    security: [{ ApiKeyAuth: [] }]
+  };
+  for (const collection of config2.collections) {
+    spec.components.schemas[collection.slug] = collectionToSchema(collection);
+  }
+  for (const global of config2.globals) {
+    spec.components.schemas[global.slug] = globalToSchema(global);
+  }
+  for (const collection of config2.collections) {
+    const slug = collection.slug;
+    const path = `/api/collections/${slug}`;
+    const labels = collection.labels || { singular: slug, plural: `${slug}s` };
+    spec.paths[path] = {
+      get: {
+        tags: ["Collections"],
+        summary: `Find ${labels.plural}`,
+        parameters: [
+          { name: "limit", in: "query", schema: { type: "integer", default: 10 } },
+          { name: "page", in: "query", schema: { type: "integer", default: 1 } },
+          { name: "where", in: "query", schema: { type: "string" }, description: "JSON filter" },
+          { name: "sort", in: "query", schema: { type: "string" }, description: "Sort field (e.g. -createdAt)" }
+        ],
+        responses: {
+          200: {
+            description: "Success",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    docs: { type: "array", items: { $ref: `#/components/schemas/${slug}` } },
+                    total: { type: "integer" },
+                    limit: { type: "integer" },
+                    page: { type: "integer" }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      post: {
+        tags: ["Collections"],
+        summary: `Create ${labels.singular}`,
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: { $ref: `#/components/schemas/${slug}` }
+            }
+          }
+        },
+        responses: {
+          201: {
+            description: "Created",
+            content: {
+              "application/json": {
+                schema: { $ref: `#/components/schemas/${slug}` }
+              }
+            }
+          }
+        }
+      }
+    };
+    spec.paths[`${path}/{id}`] = {
+      get: {
+        tags: ["Collections"],
+        summary: `Get a single ${labels.singular}`,
+        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+        responses: {
+          200: {
+            description: "Success",
+            content: {
+              "application/json": {
+                schema: { $ref: `#/components/schemas/${slug}` }
+              }
+            }
+          }
+        }
+      },
+      patch: {
+        tags: ["Collections"],
+        summary: `Update ${labels.singular}`,
+        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: { $ref: `#/components/schemas/${slug}` }
+            }
+          }
+        },
+        responses: {
+          200: {
+            description: "Updated",
+            content: {
+              "application/json": {
+                schema: { $ref: `#/components/schemas/${slug}` }
+              }
+            }
+          }
+        }
+      },
+      delete: {
+        tags: ["Collections"],
+        summary: `Delete ${labels.singular}`,
+        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+        responses: {
+          204: { description: "Deleted" }
+        }
+      }
+    };
+  }
+  for (const global of config2.globals) {
+    const slug = global.slug;
+    const path = `/api/globals/${slug}`;
+    spec.paths[path] = {
+      get: {
+        tags: ["Globals"],
+        summary: `Get ${global.label || slug}`,
+        responses: {
+          200: {
+            description: "Success",
+            content: {
+              "application/json": {
+                schema: { $ref: `#/components/schemas/${slug}` }
+              }
+            }
+          }
+        }
+      },
+      patch: {
+        tags: ["Globals"],
+        summary: `Update ${global.label || slug}`,
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: { $ref: `#/components/schemas/${slug}` }
+            }
+          }
+        },
+        responses: {
+          200: {
+            description: "Updated",
+            content: {
+              "application/json": {
+                schema: { $ref: `#/components/schemas/${slug}` }
+              }
+            }
+          }
+        }
+      }
+    };
+  }
+  if (config2.storage) {
+    spec.paths["/api/media"] = {
+      get: {
+        tags: ["Media"],
+        summary: "List Media",
+        responses: {
+          200: {
+            description: "Success",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    docs: { type: "array", items: { type: "object", additionalProperties: true } }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      post: {
+        tags: ["Media"],
+        summary: "Upload Media",
+        requestBody: {
+          content: {
+            "multipart/form-data": {
+              schema: {
+                type: "object",
+                properties: {
+                  file: { type: "string", format: "binary" }
+                }
+              }
+            }
+          }
+        },
+        responses: {
+          201: { description: "Uploaded" }
+        }
+      }
+    };
+  }
+  return spec;
+}
+function collectionToSchema(collection) {
+  const { properties, required } = fieldsToProperties(collection.fields);
+  return {
+    type: "object",
+    properties: {
+      id: { type: "string" },
+      createdAt: { type: "string", format: "date-time" },
+      updatedAt: { type: "string", format: "date-time" },
+      ...properties
+    },
+    required: ["id", ...required]
+  };
+}
+function globalToSchema(global) {
+  const { properties, required } = fieldsToProperties(global.fields);
+  return {
+    type: "object",
+    properties,
+    required
+  };
+}
+function fieldsToProperties(fields) {
+  const props = {};
+  const required = [];
+  for (const field of fields) {
+    props[field.name] = fieldToSchema(field);
+    if (field.required) {
+      required.push(field.name);
+    }
+  }
+  return { properties: props, required };
+}
+function fieldToSchema(field) {
+  let schema = {};
+  switch (field.type) {
+    case "text":
+    case "textarea":
+    case "email":
+    case "url":
+      schema = { type: "string" };
+      break;
+    case "number":
+      schema = { type: "number" };
+      break;
+    case "boolean":
+      schema = { type: "boolean" };
+      break;
+    case "date":
+      schema = { type: "string", format: "date-time" };
+      break;
+    case "select":
+      schema = { type: "string", enum: field.options?.map((o) => typeof o === "string" ? o : o.value) };
+      break;
+    case "multiSelect":
+      schema = { type: "array", items: { type: "string", enum: field.options?.map((o) => typeof o === "string" ? o : o.value) } };
+      break;
+    case "relationship":
+      schema = { type: "string", description: `ID of a ${field.collection} record` };
+      break;
+    case "object": {
+      const { properties, required } = fieldsToProperties(field.fields || []);
+      schema = { type: "object", properties, required };
+      break;
+    }
+    case "array": {
+      const { properties, required } = fieldsToProperties(field.fields || []);
+      schema = { type: "array", items: { type: "object", properties, required } };
+      break;
+    }
+    case "json":
+    case "richText":
+      schema = { type: "object", additionalProperties: true };
+      break;
+    case "blocks":
+      schema = {
+        type: "array",
+        items: {
+          oneOf: field.blocks?.map((block) => {
+            const { properties, required } = fieldsToProperties(block.fields);
+            return {
+              type: "object",
+              properties: {
+                blockType: { type: "string", enum: [block.slug] },
+                ...properties
+              },
+              required: ["blockType", ...required]
+            };
+          })
+        }
+      };
+      break;
+    default:
+      schema = { type: "string" };
+  }
+  if (field.label) schema.description = field.label;
+  return schema;
+}
+
+// src/utils/swagger.ts
+function getSwaggerHtml(specUrl = "/api/openapi.json") {
+  return `
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <meta name="description" content="SwaggerUI" />
+  <title>Dyrected API Documentation</title>
+  <link rel="stylesheet" href="https://unpkg.com/swagger-ui-dist@5.11.0/swagger-ui.css" />
+</head>
+<body>
+<div id="swagger-ui"></div>
+<script src="https://unpkg.com/swagger-ui-dist@5.11.0/swagger-ui-bundle.js" charset="UTF-8"></script>
+<script src="https://unpkg.com/swagger-ui-dist@5.11.0/swagger-ui-standalone-preset.js" charset="UTF-8"></script>
+<script>
+  window.onload = () => {
+    // Forward the apikey query param when loading the spec and making API calls
+    const params = new URLSearchParams(window.location.search);
+    const apiKey = params.get('apikey');
+    const specUrlWithKey = apiKey ? '${specUrl}?apikey=' + encodeURIComponent(apiKey) : '${specUrl}';
+
+    window.ui = SwaggerUIBundle({
+      url: specUrlWithKey,
+      dom_id: '#swagger-ui',
+      presets: [
+        SwaggerUIBundle.presets.apis,
+        SwaggerUIStandalonePreset
+      ],
+      layout: "BaseLayout",
+      deepLinking: true,
+      showExtensions: true,
+      showCommonExtensions: true,
+      // Inject x-api-key header on every request made from the Swagger UI
+      requestInterceptor: (request) => {
+        if (apiKey) {
+          request.headers['x-api-key'] = apiKey;
+        }
+        return request;
+      }
+    });
+  };
+</script>
+</body>
+</html>
+  `;
+}
+
+// src/auth/jexl.ts
+import jexl from "jexl";
+async function evaluateAccess(expression, context) {
+  if (expression === void 0 || expression === null) return false;
+  if (typeof expression === "boolean") return expression;
+  try {
+    const result = await jexl.eval(expression, context);
+    return !!result;
+  } catch (err) {
+    console.error("[dyrected/core] Jexl evaluation failed:", err);
+    return false;
+  }
+}
+
 // src/router.ts
-function registerRoutes(app, config) {
-  app.get("/api/schemas", (c) => {
+function accessGate(target, action) {
+  return async (c, next) => {
+    const user = c.get("user");
+    const accessExpr = target.access?.[action];
+    if (accessExpr === void 0 || accessExpr === null) {
+      return await next();
+    }
+    const accessArgs = { user, req: c.req, doc: null };
+    const allowed = await evaluateAccess(accessExpr, accessArgs);
+    if (!allowed) {
+      return c.json({ error: true, message: `Access denied: ${action} on ${target.slug}` }, 403);
+    }
+    await next();
+  };
+}
+function registerRoutes(app, config2) {
+  app.get("/api/schemas", optionalAuth(), async (c) => {
+    const siteId = c.req.header("X-Site-Id");
+    let collections = [...config2.collections];
+    let globals = [...config2.globals];
+    if (siteId && config2.onSchemaFetch) {
+      const dynamic = await config2.onSchemaFetch(siteId);
+      if (dynamic.collections) collections = [...collections, ...dynamic.collections];
+      if (dynamic.globals) globals = [...globals, ...dynamic.globals];
+      if (dynamic.admin) {
+        config2.admin = { ...config2.admin, ...dynamic.admin };
+      }
+    }
+    const user = c.get("user");
+    const accessArgs = { user, req: c.req, doc: null };
+    const resolveAccess = async (access) => {
+      if (access === void 0 || access === null) return true;
+      if (typeof access === "function") {
+        try {
+          const result = await access(accessArgs);
+          return typeof result === "boolean" ? result : !!result;
+        } catch (err) {
+          console.error("[dyrected/core] Functional access check failed:", err);
+          return false;
+        }
+      }
+      if (typeof access === "string" || typeof access === "boolean") {
+        return evaluateAccess(access, accessArgs);
+      }
+      return true;
+    };
+    const filteredCollections = await Promise.all(collections.filter((col) => !siteId || col.shared || !col.siteId || col.siteId === siteId).map(async (col) => ({
+      slug: col.slug,
+      labels: col.labels,
+      access: {
+        read: await resolveAccess(col.access?.read),
+        create: await resolveAccess(col.access?.create),
+        update: await resolveAccess(col.access?.update),
+        delete: await resolveAccess(col.access?.delete)
+      },
+      fields: await Promise.all(col.fields.map(async (f) => ({
+        name: f.name,
+        type: f.type,
+        label: f.label,
+        required: f.required,
+        defaultValue: f.defaultValue,
+        options: f.options,
+        relationTo: f.relationTo,
+        hasMany: f.hasMany,
+        fields: f.fields,
+        blocks: f.blocks,
+        admin: f.admin,
+        access: {
+          read: await resolveAccess(f.access?.read),
+          update: await resolveAccess(f.access?.update)
+        }
+      }))),
+      upload: !!col.upload,
+      auth: !!col.auth,
+      admin: col.admin
+    })));
+    const filteredGlobals = await Promise.all(globals.filter((glb) => !siteId || glb.shared || !glb.siteId || glb.siteId === siteId).map(async (glb) => ({
+      slug: glb.slug,
+      label: glb.label,
+      access: {
+        read: await resolveAccess(glb.access?.read),
+        update: await resolveAccess(glb.access?.update)
+      },
+      fields: await Promise.all(glb.fields.map(async (f) => ({
+        name: f.name,
+        type: f.type,
+        label: f.label,
+        required: f.required,
+        defaultValue: f.defaultValue,
+        options: f.options,
+        relationTo: f.relationTo,
+        hasMany: f.hasMany,
+        fields: f.fields,
+        blocks: f.blocks,
+        admin: f.admin,
+        access: {
+          read: await resolveAccess(f.access?.read),
+          update: await resolveAccess(f.access?.update)
+        }
+      }))),
+      admin: glb.admin
+    })));
     return c.json({
-      collections: config.collections.map((col) => ({
-        slug: col.slug,
-        labels: col.labels,
-        fields: col.fields,
-        auth: col.auth,
-        upload: col.upload
-      })),
-      globals: config.globals.map((glb) => ({
-        slug: glb.slug,
-        label: glb.label,
-        fields: glb.fields
-      }))
+      collections: filteredCollections,
+      globals: filteredGlobals,
+      admin: config2.admin || {}
     });
   });
-  if (config.storage) {
-    const mediaController = new MediaController();
-    app.get("/api/media", (c) => mediaController.find(c));
-    app.post("/api/media", (c) => mediaController.upload(c));
-    app.delete("/api/media/:id", (c) => mediaController.delete(c));
+  app.get("/api/openapi.json", (c) => {
+    return c.json(generateOpenApi(config2));
+  });
+  app.get("/api/docs", (c) => {
+    return c.html(getSwaggerHtml());
+  });
+  app.get("/api/media/:filename{.+$}", async (c) => {
+    const mediaController = new MediaController("media");
+    return mediaController.serve(c);
+  });
+  app.get("/media/:filename{.+$}", async (c) => {
+    const mediaController = new MediaController("media");
+    return mediaController.serve(c);
+  });
+  if (config2.storage) {
+    const uploadCollections = config2.collections.filter((c) => c.upload);
+    for (const col of uploadCollections) {
+      const mediaController = new MediaController(col.slug);
+      const prefix = `/api/collections/${col.slug}`;
+      app.get(`${prefix}/media`, accessGate(col, "read"), (c) => mediaController.find(c));
+      app.get(`${prefix}/media/:filename{.+$}`, (c) => mediaController.serve(c));
+      app.post(`${prefix}/media`, accessGate(col, "create"), (c) => mediaController.upload(c));
+      app.delete(`${prefix}/media/:id`, accessGate(col, "delete"), (c) => mediaController.delete(c));
+    }
+  }
+  for (const collection of config2.collections) {
+    if (!collection.auth) continue;
+    const path = `/api/collections/${collection.slug}`;
+    const authController = new AuthController(collection);
+    app.post(`${path}/login`, (c) => authController.login(c));
+    app.post(`${path}/logout`, (c) => authController.logout(c));
+    app.get(`${path}/init`, (c) => authController.init(c));
+    app.post(`${path}/first-user`, (c) => authController.registerFirstUser(c));
+    app.get(`${path}/me`, requireAuth(), (c) => authController.me(c));
+    app.post(`${path}/refresh-token`, requireAuth(), (c) => authController.refreshToken(c));
+    app.post(`${path}/forgot-password`, (c) => authController.forgotPassword(c));
+    app.post(`${path}/reset-password`, (c) => authController.resetPassword(c));
+    app.post(`${path}/invite`, requireAuth(), (c) => authController.invite(c));
+    app.post(`${path}/accept-invite`, (c) => authController.acceptInvite(c));
   }
-  for (const collection of config.collections) {
+  for (const collection of config2.collections) {
     const path = `/api/collections/${collection.slug}`;
     const controller = new CollectionController(collection);
-    app.get(path, (c) => controller.find(c));
-    app.post(path, (c) => controller.create(c));
-    app.get(`${path}/:id`, (c) => controller.findOne(c));
-    app.patch(`${path}/:id`, (c) => controller.update(c));
-    app.delete(`${path}/:id`, (c) => controller.delete(c));
+    app.get(path, accessGate(collection, "read"), (c) => controller.find(c));
+    app.post(path, accessGate(collection, "create"), (c) => controller.create(c));
+    app.post(`${path}/media`, accessGate(collection, "create"), (c) => controller.create(c));
+    app.get(`${path}/:id`, accessGate(collection, "read"), (c) => controller.findOne(c));
+    app.patch(`${path}/:id`, accessGate(collection, "update"), (c) => controller.update(c));
+    app.delete(`${path}/:id`, accessGate(collection, "delete"), (c) => controller.delete(c));
+    app.post(`${path}/seed`, (c) => controller.seed(c));
   }
-  for (const global of config.globals) {
+  for (const global of config2.globals) {
     const path = `/api/globals/${global.slug}`;
     const controller = new GlobalController(global);
-    app.get(path, (c) => controller.get(c));
-    app.patch(path, (c) => controller.update(c));
+    app.get(path, accessGate(global, "read"), (c) => controller.get(c));
+    app.patch(path, accessGate(global, "update"), (c) => controller.update(c));
+    app.post(`${path}/seed`, (c) => controller.seed(c));
   }
+  const previewController = new PreviewController();
+  app.post("/api/preview-token", requireAuth(), (c) => previewController.createToken(c));
+  app.get("/api/preview-data", (c) => previewController.getData(c));
+  app.all("/api/collections/:slug/:id?", async (c) => {
+    const slug = c.req.param("slug");
+    const id = c.req.param("id");
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const config3 = c.get("config");
+    if (config3.collections.some((col) => col.slug === slug)) {
+      return c.json({ message: "Method Not Allowed" }, 405);
+    }
+    if (config3.onSchemaFetch && siteId) {
+      const dynamic = await config3.onSchemaFetch(siteId);
+      let collection = dynamic.collections?.find((col) => col.slug === slug);
+      if (!collection && slug === "media") {
+        collection = {
+          slug: "media",
+          labels: { singular: "Media", plural: "Media" },
+          upload: true,
+          fields: []
+        };
+      }
+      if (collection) {
+        if (collection.auth && id) {
+          const authController = new AuthController(collection);
+          const method2 = c.req.method;
+          if (method2 === "POST" && id === "login") return authController.login(c);
+          if (method2 === "POST" && id === "logout") return authController.logout(c);
+          if (method2 === "GET" && id === "me") return authController.me(c);
+          if (method2 === "POST" && id === "refresh-token") return authController.refreshToken(c);
+          if (method2 === "POST" && id === "forgot-password") return authController.forgotPassword(c);
+          if (method2 === "POST" && id === "reset-password") return authController.resetPassword(c);
+        }
+        const controller = new CollectionController(collection);
+        const method = c.req.method;
+        if (id) {
+          if (method === "GET") return controller.findOne(c);
+          if (method === "PATCH") return controller.update(c);
+          if (method === "DELETE") return controller.delete(c);
+          if (method === "POST" && id === "media") return controller.create(c);
+        } else {
+          if (method === "GET") return controller.find(c);
+          if (method === "POST") return controller.create(c);
+        }
+      }
+    }
+    return c.json({ message: `Collection "${slug}" not found` }, 404);
+  });
+  app.all("/api/globals/:slug", async (c) => {
+    const slug = c.req.param("slug");
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const config3 = c.get("config");
+    if (config3.globals.some((glb) => glb.slug === slug)) {
+      return c.json({ message: "Method Not Allowed" }, 405);
+    }
+    if (config3.onSchemaFetch && siteId) {
+      const dynamic = await config3.onSchemaFetch(siteId);
+      const global = dynamic.globals?.find((glb) => glb.slug === slug);
+      if (global) {
+        const controller = new GlobalController(global);
+        if (c.req.method === "GET") return controller.get(c);
+        if (c.req.method === "PATCH") return controller.update(c);
+      }
+    }
+    return c.json({ message: `Global "${slug}" not found` }, 404);
+  });
+}
+
+// src/utils/config.ts
+function normalizeConfig(config2) {
+  const normalizedCollections = config2.collections.map((col) => {
+    const useTimestamps = col.timestamps !== false;
+    if (!useTimestamps) return col;
+    const timestampFields = [
+      {
+        name: "createdAt",
+        type: "date",
+        label: "Created At",
+        admin: {
+          readOnly: true,
+          hidden: false,
+          description: "The date this record was created."
+        }
+      },
+      {
+        name: "updatedAt",
+        type: "date",
+        label: "Updated At",
+        admin: {
+          readOnly: true,
+          hidden: false,
+          description: "The date this record was last updated."
+        }
+      }
+    ];
+    const existingFieldNames = col.fields.map((f) => f.name);
+    const fieldsToInject = timestampFields.filter((f) => !existingFieldNames.includes(f.name));
+    return {
+      ...col,
+      fields: [...col.fields, ...fieldsToInject]
+    };
+  });
+  return {
+    ...config2,
+    collections: normalizedCollections
+  };
 }
 
 // src/app.ts
-function createDyrectedApp(config) {
+async function createDyrectedApp(rawConfig) {
+  const config2 = normalizeConfig(rawConfig);
   const app = new Hono();
+  if (config2.db?.sync) {
+    await config2.db.sync(config2.collections, config2.globals);
+  }
   app.use("*", requestId());
-  app.use("*", logger());
+  app.use("*", async (c, next) => {
+    const start = Date.now();
+    await next();
+    const ms = Date.now() - start;
+    console.log(`[dyrected/api] ${c.req.method} ${c.req.path} ${c.res.status} - ${ms}ms`);
+  });
   app.use("*", cors());
   app.use("*", async (c, next) => {
-    c.set("config", config);
+    c.set("config", config2);
     if (!c.get("siteId")) {
       c.set("siteId", "default");
     }
     await next();
   });
   app.get("/health", (c) => c.json({ status: "ok", version: "0.0.1" }));
-  registerRoutes(app, config);
+  app.get("/routes", (c) => {
+    const routes = app.routes.map((r) => ({ method: r.method, path: r.path }));
+    return c.json({ routes });
+  });
+  app.onError((err, c) => {
+    console.error(`[dyrected/core] Uncaught Error:`, err);
+    return c.json({
+      message: err.message || "Internal Server Error",
+      stack: process.env.NODE_ENV === "development" ? err.stack : void 0
+    }, 500);
+  });
+  registerRoutes(app, config2);
   return app;
 }
 
@@ -339,15 +1694,274 @@ var MediaService = class {
   }
 };
 
+// src/utils/setup-prompt.ts
+function generateAIPrompt(activeTab, config2) {
+  const frameworkLabel = activeTab === "next" ? "Next.js" : activeTab === "nuxt" ? "Nuxt" : activeTab.charAt(0).toUpperCase() + activeTab.slice(1);
+  const backendPkg = activeTab === "nuxt" ? "@dyrected/nuxt" : "@dyrected/next";
+  const isSelfHosted = config2.isSelfHosted ?? (config2.baseUrl?.includes("localhost") || !config2.apiKey);
+  const baseIntro = isSelfHosted ? `You are a Senior Content Architect. Your mission is to integrate Dyrected CMS into a ${config2.siteName || "new"} project using ${frameworkLabel}. This is a SELF-HOSTED installation.
+The backend is already configured via ${backendPkg}.
+Your priority is DATA PRESERVATION and creating a CMS that empowers marketing teams.` : `You are a Senior Content Architect. Your mission is to integrate Dyrected CMS into a ${config2.siteName || "new"} project using ${frameworkLabel}. Complete the entire setup automatically, prioritizing DATA PRESERVATION and marketing independence.`;
+  const credentials = `
+\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+SITE CREDENTIALS
+\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+${config2.siteName ? `Site Name : ${config2.siteName}
+` : ""}${isSelfHosted ? "" : `Site ID   : ${config2.siteId}
+API Key   : ${config2.apiKey}
+`}API URL   : ${config2.baseUrl || "http://localhost:3000"}
+`;
+  const importantNotes = `
+\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+IMPORTANT NOTES \u2014 READ BEFORE ACTING
+\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+- \`client.collection(slug)\` is the primary API entrypoint. Do NOT use \`client.collections\`.
+- Blocks are stored as \`[{ blockType: '<slug>', ...fields }]\` \u2014 always switch on \`blockType\` when rendering.
+- MARKETING INDEPENDENCE: Always use a dynamic \`pages\` collection with a catch-all route. Marketing should create pages without a developer. (Exceptions: Special pages like Contact or those with complex forms may use static routes).
+- AUTO-SEEDING: Use \`initialData\` in all data fetches to ensure the site is never empty on first load.
+- Globals use \`client.global(slug).get()\` and \`client.global(slug).update(data)\`.
+- Relationship fields are populated to the specified \`depth\` (default: 1). Set \`depth: 0\` for IDs only.
+`;
+  const strategy = `
+\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+PHASE 0 \u2014 DATA PRESERVATION & STRATEGY
+\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+1. BACKUP: If an existing site is provided, you MUST extract all current content (text, assets, structure) and save it into a \`migration/\` folder as structured .md files BEFORE modifying any code. Never lose data.
+2. DISCOVERY: If NO existing site is provided, STOP and ask the user:
+   - "What are your core content types (e.g. Services, Team, Blog)?"
+   - "How do you want your marketing team to manage the page layouts?"
+3. ARCHITECTURAL CREATIVITY: Design the CMS for longevity. Use \`blocks\` for flexible page builders, \`globals\` for site settings, and \`collections\` for repeated content.
+
+STEP 1 \u2014 CONTENT MODEL (dyrected.config.ts)
+\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+Use \`defineCollection\`, \`defineGlobal\`, and \`defineConfig\` from '@dyrected/core'.
+
+SUPPORTED FIELD TYPES:
+  Primitive  : text | textarea | richText | number | boolean | date | email | url | json
+  Choice     : select | multiSelect           (requires \`options: [{ label, value }]\`)
+  Structural : array | object                 (requires nested \`fields: [...]\`)
+  Relation   : relationship                   (requires \`collection: '<slug>'\`)
+  Media      : image                          (use a relationship to an upload collection)
+  Blocks     : blocks                         (requires \`blocks: [{ slug, labels, fields }]\`)
+
+COLLECTION OPTIONS:
+  \`upload: true\`   \u2014 turns this collection into a media library (file uploads)
+  \`auth: true\`     \u2014 adds login/register/me endpoints; password field is auto-added
+  \`admin.group\`    \u2014 groups this collection under a sidebar heading
+  \`admin.useAsTitle\` \u2014 field to use as the display title in the admin list view
+  \`admin.hidden\`   \u2014 hide from sidebar (useful for internal/system collections)
+
+FIELD OPTIONS:
+  \`required\`        \u2014 validation
+  \`unique\`          \u2014 database-level uniqueness
+  \`defaultValue\`    \u2014 fallback value
+  \`admin.condition\` \u2014 "expression" \u2014 Jexl string expression to show/hide field (e.g. "status == \\"published\\"")
+  \`admin.layout\`    \u2014 "radio" | "dropdown" \u2014 Visual layout for select/multiSelect
+  \`admin.direction\` \u2014 "vertical" | "horizontal" \u2014 Layout direction for radio groups
+  \`admin.readOnly\`  \u2014 display-only in the form
+  \`admin.hidden\`    \u2014 completely hidden from editor UI
+  \`access.read\`     \u2014 ({ user }) => boolean \u2014 field-level read access
+  \`access.update\`   \u2014 ({ user }) => boolean \u2014 field-level write access
+  \`hooks.beforeChange\` \u2014 [async (value) => newValue] \u2014 transform value before save
+  \`hooks.afterRead\`    \u2014 [async (value) => newValue] \u2014 transform value after read
+
+BLOCKS EXPLAINED:
+  A \`blocks\` field stores an ordered array of typed content blocks.
+  Each block has a \`blockType\` discriminator and its own set of fields.
+  The admin UI renders a drag-and-drop block editor automatically.
+  On the frontend, iterate the array and switch on \`block.blockType\`.
+
+COMPLETE EXAMPLE:
+\`\`\`typescript
+import { defineCollection, defineGlobal, defineConfig } from '@dyrected/core'
+
+// \u2500\u2500 Media \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+const media = defineCollection({
+  slug: 'media',
+  labels: { singular: 'Media Item', plural: 'Media' },
+  upload: true,
+  fields: [
+    { name: 'alt', type: 'text', label: 'Alt Text' },
+    { name: 'caption', type: 'textarea', label: 'Caption' },
+  ],
+})
+
+// \u2500\u2500 Authentication collection \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+const customers = defineCollection({
+  slug: 'customers',
+  labels: { singular: 'Customer', plural: 'Customers' },
+  auth: true,                  // adds /customers/login, /customers/me, etc.
+  admin: { group: 'Membership' },
+  fields: [
+    { name: 'name', type: 'text', required: true },
+    { name: 'email', type: 'email', required: true, unique: true },
+    // 'password' is auto-added when auth: true
+    { name: 'avatar', type: 'relationship', relationTo: 'media' },
+    { name: 'role', type: 'select', admin: { layout: 'radio' }, options: [
+        { label: 'Member', value: 'member' },
+        { label: 'VIP', value: 'vip' },
+    ]},
+  ],
+})
+
+// \u2500\u2500 Pages with blocks \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+const pages = defineCollection({
+  slug: 'pages',
+  labels: { singular: 'Page', plural: 'Pages' },
+  admin: { useAsTitle: 'title', group: 'Content' },
+  fields: [
+    { name: 'title', type: 'text', required: true },
+    { name: 'slug',  type: 'text', required: true, unique: true },
+    { name: 'seo', type: 'object', fields: [
+        { name: 'metaTitle',       type: 'text' },
+        { name: 'metaDescription', type: 'textarea' },
+        { name: 'ogImage',         type: 'relationship', relationTo: 'media' },
+    ]},
+    {
+      name: 'layout',
+      type: 'blocks',
+      label: 'Page Layout',
+      blocks: [
+        {
+          slug: 'hero',
+          labels: { singular: 'Hero', plural: 'Heroes' },
+          fields: [
+            { name: 'heading',    type: 'text',         required: true },
+            { name: 'subheading', type: 'textarea' },
+            { name: 'image',      type: 'relationship', relationTo: 'media' },
+            { name: 'ctaLabel',   type: 'text' },
+            { name: 'ctaLink',    type: 'url' },
+          ],
+        },
+        {
+          slug: 'richContent',
+          labels: { singular: 'Rich Content', plural: 'Rich Content Blocks' },
+          fields: [
+            { name: 'content', type: 'richText', required: true },
+          ],
+        },
+      ],
+    },
+  ],
+})
+
+export default defineConfig({
+  collections: [media, customers, pages],
+  admin: {
+    branding: {
+      primaryColor: '#4f46e5',
+      logo: '/logo.png',
+    }
+  }
+})
+\`\`\`
+
+${isSelfHosted ? "" : `
+\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+STEP 2 \u2014 CHOOSE YOUR MODE
+\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+The developer can choose between two modes:
+
+1. CLOUD MODE (Managed)
+   - Use the SITE CREDENTIALS above.
+   - Point baseUrl to ${config2.baseUrl}.
+   - Content is stored in Dyrected Cloud.
+
+2. SELF-HOSTED MODE (Core)
+   - Do NOT use apiKey/siteId (unless for proxying).
+   - Use a database adapter like \`SqliteAdapter\` from '@dyrected/db-sqlite'.
+   - Content is stored locally in the developer's project.
+`}
+
+\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+STEP ${isSelfHosted ? "2" : "3"} \u2014 MOUNTING THE ADMIN UI
+\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+The Admin UI can be mounted on any path (e.g. /cms-admin).
+Pass the \`basename\` prop to the \`<AdminUI />\` component to match your route.
+
+\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+STEP ${isSelfHosted ? "3" : "4"} \u2014 FRONTEND IMPLEMENTATION
+\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501
+`;
+  const frameworks = {
+    next: `Install \`@dyrected/sdk\` (or \`@dyrected/next\` if you want Next.js server helpers).
+
+SDK CLIENT SETUP (\`lib/dyrected.ts\`):
+\`\`\`ts
+import { createClient } from '@dyrected/sdk'
+
+export const dyrected = createClient({
+  baseUrl: '${config2.baseUrl || "http://localhost:3000"}',${isSelfHosted ? "" : `
+  apiKey:  '${config2.apiKey}',
+  siteId:  '${config2.siteId}',`}
+})
+\`\`\``,
+    nuxt: `Install \`@dyrected/nuxt\` and add it to \`nuxt.config.ts\`:
+\`\`\`ts
+export default defineNuxtConfig({
+  modules: ['@dyrected/nuxt'],
+  dyrected: {
+    baseUrl: '${config2.baseUrl || "http://localhost:3000"}',${isSelfHosted ? "" : `
+    apiKey:  '${config2.apiKey}',
+    siteId:  '${config2.siteId}',`}
+  },
+})
+\`\`\`
+
+MOUNTING THE ADMIN DASHBOARD (\`pages/cms-admin.vue\`):
+\`\`\`vue
+<script setup lang="ts">
+definePageMeta({ layout: false })
+</script>
+
+<template>
+  <ClientOnly>
+    <DyrectedAdmin basename="/cms-admin" />
+  </ClientOnly>
+</template>
+\`\`\`
+`,
+    react: `Install \`@dyrected/sdk\`:
+
+CLIENT SETUP (\`lib/dyrected.ts\`):
+\`\`\`ts
+import { createClient } from '@dyrected/sdk'
+
+export const dyrected = createClient({
+  baseUrl: '${config2.baseUrl || "http://localhost:3000"}',${isSelfHosted ? "" : `
+  apiKey:  '${config2.apiKey}',
+  siteId:  '${config2.siteId}',`}
+})
+\`\`\`
+`,
+    vue: `Install \`@dyrected/sdk\`:
+
+CLIENT SETUP (\`lib/dyrected.ts\`):
+\`\`\`ts
+import { createClient } from '@dyrected/sdk'
+
+export const dyrected = createClient({
+  baseUrl: '${config2.baseUrl || "http://localhost:3000"}',${isSelfHosted ? "" : `
+  apiKey:  '${config2.apiKey}',
+  siteId:  '${config2.siteId}',`}
+})
+\`\`\`
+`
+  };
+  return baseIntro + credentials + importantNotes + strategy + (frameworks[activeTab] || frameworks.next) + `
+
+  API Reference: ${config2.baseUrl || "http://localhost:3000"}/api/docs`;
+}
+
 // src/index.ts
-function defineCollection(config) {
-  return config;
+function defineCollection(config2) {
+  return config2;
 }
-function defineGlobal(config) {
-  return config;
+function defineGlobal(config2) {
+  return config2;
 }
-function defineConfig(config) {
-  return config;
+function defineConfig(config2) {
+  return config2;
 }
 export {
   MediaService,
@@ -355,5 +1969,6 @@ export {
   createDyrectedApp,
   defineCollection,
   defineConfig,
-  defineGlobal
+  defineGlobal,
+  generateAIPrompt
 };