@dyrected/core 2.5.42 → 2.5.44

package/dist/server.js

@@ -13,14 +13,14 @@ import {
   runCollectionHooks,
   saveWorkflowDraft,
   transitionWorkflow
-} from "./chunk-FCXE5CVC.js";
+} from "./chunk-44O2LDPT.js";
 
-// src/app.ts
+// src/app.js
 import { Hono } from "hono";
 import { cors } from "hono/cors";
 import { requestId } from "hono/request-id";
 
-// src/services/defaults.service.ts
+// src/services/defaults.service.js
 var DefaultsService = class {
   /**
    * Recursively apply default values to a data object based on field definitions.
@@ -28,12 +28,14 @@ var DefaultsService = class {
   static apply(fields, data = {}) {
     const result = { ...data || {} };
     fields.forEach((field) => {
-      if (field.type === "join") return;
+      if (field.type === "join")
+        return;
       if (field.type === "row" && field.fields) {
         Object.assign(result, this.apply(field.fields, data));
         return;
       }
-      if (!field.name) return;
+      if (!field.name)
+        return;
       let value = result[field.name];
       if ((value === void 0 || value === null) && field.renameTo) {
         const legacyValue = result[field.renameTo];
@@ -46,9 +48,12 @@ var DefaultsService = class {
         if (field.defaultValue !== void 0) {
           result[field.name] = field.defaultValue;
         } else {
-          if (field.type === "boolean") result[field.name] = false;
-          else if (field.type === "array") result[field.name] = [];
-          else if (field.type === "multiSelect") result[field.name] = [];
+          if (field.type === "boolean")
+            result[field.name] = false;
+          else if (field.type === "array")
+            result[field.name] = [];
+          else if (field.type === "multiSelect")
+            result[field.name] = [];
           else if (field.type === "object") {
             result[field.name] = this.apply(field.fields || [], {});
           }
@@ -63,7 +68,7 @@ var DefaultsService = class {
   }
 };
 
-// src/services/population.service.ts
+// src/services/population.service.js
 var PopulationService = class {
   db;
   collections;
@@ -116,29 +121,31 @@ var PopulationService = class {
         Object.assign(populatedDoc, rowPopulated);
         continue;
       }
-      if (!field.name) continue;
+      if (!field.name)
+        continue;
       const value = populatedDoc[field.name];
       if (field.type === "relationship" && field.relationTo && value) {
         const relatedCollection = this.collections.find((c) => c.slug === field.relationTo);
-        if (!relatedCollection) continue;
+        if (!relatedCollection)
+          continue;
         if (Array.isArray(value)) {
-          populatedDoc[field.name] = await Promise.all(
-            value.map(async (id) => {
-              if (!id) return id;
-              let doc = id;
-              if (typeof id === "string") {
-                doc = await this.db.findOne({ collection: field.relationTo, id });
-              }
-              if (!doc || typeof doc !== "object") return id;
-              const docWithDefaults = DefaultsService.apply(relatedCollection.fields, doc);
-              return this.populate({
-                data: docWithDefaults,
-                fields: relatedCollection.fields,
-                currentDepth: currentDepth + 1,
-                maxDepth
-              });
-            })
-          );
+          populatedDoc[field.name] = await Promise.all(value.map(async (id) => {
+            if (!id)
+              return id;
+            let doc = id;
+            if (typeof id === "string") {
+              doc = await this.db.findOne({ collection: field.relationTo, id });
+            }
+            if (!doc || typeof doc !== "object")
+              return id;
+            const docWithDefaults = DefaultsService.apply(relatedCollection.fields, doc);
+            return this.populate({
+              data: docWithDefaults,
+              fields: relatedCollection.fields,
+              currentDepth: currentDepth + 1,
+              maxDepth
+            });
+          }));
         } else if (value) {
           let doc = value;
           if (typeof value === "string") {
@@ -187,18 +194,17 @@ var PopulationService = class {
         });
       }
       if (field.type === "blocks" && field.blocks && Array.isArray(value)) {
-        populatedDoc[field.name] = await Promise.all(
-          value.map(async (blockData) => {
-            const blockConfig = field.blocks.find((b) => b.slug === blockData.blockType);
-            if (!blockConfig) return blockData;
-            return this.populate({
-              data: blockData,
-              fields: blockConfig.fields,
-              currentDepth,
-              maxDepth
-            });
-          })
-        );
+        populatedDoc[field.name] = await Promise.all(value.map(async (blockData) => {
+          const blockConfig = field.blocks.find((b) => b.slug === blockData.blockType);
+          if (!blockConfig)
+            return blockData;
+          return this.populate({
+            data: blockData,
+            fields: blockConfig.fields,
+            currentDepth,
+            maxDepth
+          });
+        }));
       }
     }
     return populatedDoc;
@@ -207,7 +213,8 @@ var PopulationService = class {
    * Helper to populate a PaginatedResult
    */
   async populateResult(result, fields, maxDepth) {
-    if (maxDepth <= 0) return result;
+    if (maxDepth <= 0)
+      return result;
     const populatedDocs = await this.populate({
       data: result.docs,
       fields,
@@ -221,7 +228,7 @@ var PopulationService = class {
   }
 };
 
-// src/services/audit.service.ts
+// src/services/audit.service.js
 var AuditService = class {
   /**
    * Writes a single entry to the __audit collection.
@@ -249,7 +256,7 @@ var AuditService = class {
   }
 };
 
-// src/auth/password.ts
+// src/auth/password.js
 import { promisify } from "util";
 import { scrypt, randomBytes, timingSafeEqual } from "crypto";
 var scryptAsync = promisify(scrypt);
@@ -262,23 +269,23 @@ async function hashPassword(plain) {
 }
 async function verifyPassword(plain, stored) {
   const [salt, storedHash] = stored.split(":");
-  if (!salt || !storedHash) return false;
+  if (!salt || !storedHash)
+    return false;
   const derivedKey = await scryptAsync(plain, salt, KEY_LEN);
   const storedBuffer = Buffer.from(storedHash, "hex");
-  if (derivedKey.length !== storedBuffer.length) return false;
+  if (derivedKey.length !== storedBuffer.length)
+    return false;
   return timingSafeEqual(derivedKey, storedBuffer);
 }
 
-// src/utils/readonly-db.ts
+// src/utils/readonly-db.js
 var WRITE_METHODS = ["create", "update", "delete", "updateGlobal", "execute"];
 function createReadonlyDb(db) {
   return new Proxy(db, {
     get(target, prop) {
       if (WRITE_METHODS.includes(prop)) {
         return () => {
-          throw new Error(
-            `[dyrected] Write operation "${String(prop)}" is not allowed in this hook phase. Use afterChange/afterDelete hooks for write operations.`
-          );
+          throw new Error(`[dyrected] Write operation "${String(prop)}" is not allowed in this hook phase. Use afterChange/afterDelete hooks for write operations.`);
         };
       }
       return Reflect.get(target, prop);
@@ -286,11 +293,13 @@ function createReadonlyDb(db) {
   });
 }
 
-// src/auth/jexl.ts
+// src/auth/jexl.js
 import jexl from "jexl";
 async function evaluateAccess(expression, context) {
-  if (expression === void 0 || expression === null) return false;
-  if (typeof expression === "boolean") return expression;
+  if (expression === void 0 || expression === null)
+    return false;
+  if (typeof expression === "boolean")
+    return expression;
   try {
     const result = await jexl.eval(expression, context);
     return !!result;
@@ -300,16 +309,61 @@ async function evaluateAccess(expression, context) {
   }
 }
 
-// src/controllers/collection.controller.ts
+// src/controllers/collection.controller.js
 var CollectionController = class {
   collection;
   constructor(collection) {
     this.collection = collection;
   }
+  getDelegatedProvider(c) {
+    const config = c.get("config");
+    const authCollectionSlug = config.adminAuth?.collectionSlug || "__admins";
+    if (this.collection.slug !== authCollectionSlug) {
+      return null;
+    }
+    return config.adminAuth?.providers?.find((p) => p.members) || null;
+  }
   async find(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
+    const provider = this.getDelegatedProvider(c);
+    if (provider && provider.members?.list) {
+      const limit2 = Number(c.req.query("limit")) || 10;
+      const page2 = Number(c.req.query("page")) || 1;
+      const sort2 = c.req.query("sort") || void 0;
+      let where2 = void 0;
+      const whereRaw2 = c.req.query("where");
+      if (whereRaw2) {
+        try {
+          where2 = JSON.parse(decodeURIComponent(whereRaw2));
+        } catch {
+        }
+      }
+      const paginatedResult = await provider.members.list({ limit: limit2, page: page2, sort: sort2, where: where2, req: c.req });
+      const mappedDocs = [];
+      for (const m of paginatedResult.docs) {
+        let localId = m.id;
+        const localDoc = await db.find({
+          collection: this.collection.slug,
+          where: m.id ? { externalSubject: { equals: m.id } } : { email: { equals: m.email } },
+          limit: 1
+        });
+        if (localDoc.docs[0]) {
+          localId = localDoc.docs[0].id;
+        }
+        mappedDocs.push({
+          ...m,
+          id: localId,
+          externalSubject: m.id
+        });
+      }
+      return c.json({
+        ...paginatedResult,
+        docs: mappedDocs
+      });
+    }
     const readonlyDb = createReadonlyDb(db);
     const limit = Number(c.req.query("limit")) || 10;
     const page = Number(c.req.query("page")) || 1;
@@ -328,7 +382,7 @@ var CollectionController = class {
       if (this.collection.admin?.filterable === false) {
         where = void 0;
       } else {
-        const { sanitizeWhereClause } = await import("./where-sanitizer-WJ2W2QCE.js");
+        const { sanitizeWhereClause } = await import("./where-sanitizer-7Q4JXMX6.js");
         where = sanitizeWhereClause(where, this.collection.fields);
         if (Object.keys(where).length === 0) {
           where = void 0;
@@ -367,11 +421,13 @@ var CollectionController = class {
         where
       });
     }
-    result.docs = result.docs.map((doc) => this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc).filter((doc) => doc !== null).map((doc) => DefaultsService.apply(this.collection.fields, doc));
+    result.docs = result.docs.map((doc) => this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc).filter((doc) => doc !== null);
     const processedDocs = [];
+    const readonlyDbForHooks = createReadonlyDb(db);
     for (const doc of result.docs) {
+      const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
       const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
-        doc,
+        doc: docWithDefaults,
         req: c.req,
         user,
         db: readonlyDb
@@ -389,17 +445,43 @@ var CollectionController = class {
   async findOne(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
+    const provider = this.getDelegatedProvider(c);
+    if (provider && (provider.members?.get || provider.members?.list)) {
+      const id2 = c.req.param("id");
+      if (!id2)
+        return c.json({ message: "Missing ID" }, 400);
+      const localDoc = await db.findOne({ collection: this.collection.slug, id: id2 });
+      const externalSubject = localDoc?.externalSubject || id2;
+      let member = null;
+      if (provider.members.get) {
+        member = await provider.members.get({ externalSubject, req: c.req });
+      } else if (provider.members.list) {
+        const listResult = await provider.members.list({ req: c.req });
+        member = listResult.docs.find((m) => m.id === externalSubject) || null;
+      }
+      if (!member)
+        return c.json({ message: "Not Found" }, 404);
+      return c.json({
+        ...member,
+        id: localDoc ? localDoc.id : member.id,
+        externalSubject: member.id
+      });
+    }
     const readonlyDb = createReadonlyDb(db);
     const id = c.req.param("id");
     const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 10;
     const user = c.get("user");
-    if (!id) return c.json({ message: "Missing ID" }, 400);
+    if (!id)
+      return c.json({ message: "Missing ID" }, 400);
     let doc = await db.findOne({ collection: this.collection.slug, id });
-    if (!doc) return c.json({ message: "Not Found" }, 404);
+    if (!doc)
+      return c.json({ message: "Not Found" }, 404);
     if (this.collection.workflow) {
       doc = materializeWorkflowDocument(doc, this.collection.workflow, user);
-      if (!doc) return c.json({ message: "Not Found" }, 404);
+      if (!doc)
+        return c.json({ message: "Not Found" }, 404);
     }
     const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
     const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
@@ -424,7 +506,22 @@ var CollectionController = class {
   async create(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
+    const provider = this.getDelegatedProvider(c);
+    if (provider && provider.members?.create) {
+      const contentType2 = c.req.header("Content-Type") || "";
+      if (contentType2.toLowerCase().includes("multipart/form-data")) {
+        return this.upload(c);
+      }
+      const body2 = await c.req.json();
+      const member = await provider.members.create({ data: body2, req: c.req });
+      return c.json({
+        ...member,
+        id: member.id,
+        externalSubject: member.id
+      }, 201);
+    }
     const readonlyDb = createReadonlyDb(db);
     const contentType = c.req.header("Content-Type") || "";
     if (contentType.toLowerCase().includes("multipart/form-data")) {
@@ -485,13 +582,16 @@ var CollectionController = class {
   async upload(c) {
     const config = c.get("config");
     const storage = config.storage;
-    if (!storage) return c.json({ message: "Storage not configured" }, 500);
+    if (!storage)
+      return c.json({ message: "Storage not configured" }, 500);
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const readonlyDb = createReadonlyDb(db);
     const formData = await c.req.formData();
     const file = formData.get("file");
-    if (!file) return c.json({ message: "No file uploaded" }, 400);
+    if (!file)
+      return c.json({ message: "No file uploaded" }, 400);
     const buffer = new Uint8Array(await file.arrayBuffer());
     const siteId = c.get("siteId");
     const workspaceId = c.get("workspaceId");
@@ -550,10 +650,27 @@ var CollectionController = class {
   async update(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
+    const provider = this.getDelegatedProvider(c);
+    if (provider && provider.members?.update) {
+      const id2 = c.req.param("id");
+      if (!id2)
+        return c.json({ message: "Missing ID" }, 400);
+      const body2 = await c.req.json();
+      const localDoc = await db.findOne({ collection: this.collection.slug, id: id2 });
+      const externalSubject = localDoc?.externalSubject || id2;
+      const member = await provider.members.update({ externalSubject, data: body2, req: c.req });
+      return c.json({
+        ...member,
+        id: localDoc ? localDoc.id : member.id,
+        externalSubject: member.id
+      });
+    }
     const readonlyDb = createReadonlyDb(db);
     const id = c.req.param("id");
-    if (!id) return c.json({ message: "Missing ID" }, 400);
+    if (!id)
+      return c.json({ message: "Missing ID" }, 400);
     const body = await c.req.json();
     const user = c.get("user");
     let data = { ...body };
@@ -567,7 +684,8 @@ var CollectionController = class {
       updatedBy: user?.sub ?? null
     });
     const originalDoc = await db.findOne({ collection: this.collection.slug, id });
-    if (!originalDoc) return c.json({ message: "Not Found" }, 404);
+    if (!originalDoc)
+      return c.json({ message: "Not Found" }, 404);
     let before = null;
     if (this.collection.audit) {
       before = originalDoc;
@@ -611,8 +729,10 @@ var CollectionController = class {
   }
   async transition(c) {
     const config = c.get("config");
-    if (!config.db) return c.json({ message: "Database not configured" }, 500);
-    if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    if (!config.db)
+      return c.json({ message: "Database not configured" }, 500);
+    if (!this.collection.workflow)
+      return c.json({ message: "Workflows are not enabled for this collection" }, 404);
     const id = c.req.param("id");
     const transitionName = c.req.param("transition");
     const body = await c.req.json().catch(() => ({}));
@@ -635,12 +755,16 @@ var CollectionController = class {
   }
   async workflowHistory(c) {
     const config = c.get("config");
-    if (!config.db) return c.json({ message: "Database not configured" }, 500);
-    if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    if (!config.db)
+      return c.json({ message: "Database not configured" }, 500);
+    if (!this.collection.workflow)
+      return c.json({ message: "Workflows are not enabled for this collection" }, 404);
     const documentId = c.req.param("id");
-    if (!documentId) return c.json({ message: "Missing ID" }, 400);
+    if (!documentId)
+      return c.json({ message: "Missing ID" }, 400);
     const document = await config.db.findOne({ collection: this.collection.slug, id: documentId });
-    if (!document) return c.json({ message: "Not Found" }, 404);
+    if (!document)
+      return c.json({ message: "Not Found" }, 404);
     const readAccess = this.collection.access?.read;
     if (readAccess !== void 0 && readAccess !== null) {
       const args = { user: c.get("user"), req: c.req, doc: document };
@@ -654,7 +778,8 @@ var CollectionController = class {
         });
         allowed = match.total > 0;
       }
-      if (!allowed) return c.json({ error: true, message: `Access denied: read on ${this.collection.slug}` }, 403);
+      if (!allowed)
+        return c.json({ error: true, message: `Access denied: read on ${this.collection.slug}` }, 403);
     }
     const result = await config.db.find({
       collection: WORKFLOW_HISTORY_COLLECTION,
@@ -678,14 +803,17 @@ var CollectionController = class {
   async changePassword(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     if (!this.collection.auth) {
       return c.json({ message: "This collection does not support authentication" }, 400);
     }
     const id = c.req.param("id");
-    if (!id) return c.json({ message: "Missing ID" }, 400);
+    if (!id)
+      return c.json({ message: "Missing ID" }, 400);
     const user = c.get("user");
-    if (!user) return c.json({ message: "Authentication required" }, 401);
+    if (!user)
+      return c.json({ message: "Authentication required" }, 401);
     const body = await c.req.json().catch(() => null);
     const { oldPassword, newPassword, confirmPassword } = body ?? {};
     if (!newPassword) {
@@ -707,7 +835,8 @@ var CollectionController = class {
         return c.json({ message: "Current password is required" }, 400);
       }
       const existing = await db.findOne({ collection: this.collection.slug, id });
-      if (!existing) return c.json({ message: "User not found" }, 404);
+      if (!existing)
+        return c.json({ message: "User not found" }, 404);
       const valid = await verifyPassword(oldPassword, existing.password);
       if (!valid) {
         return c.json({ message: "Invalid current password" }, 400);
@@ -738,13 +867,26 @@ var CollectionController = class {
   async delete(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
+    const provider = this.getDelegatedProvider(c);
+    if (provider && provider.members?.delete) {
+      const id2 = c.req.param("id");
+      if (!id2)
+        return c.json({ message: "Missing ID" }, 400);
+      const localDoc = await db.findOne({ collection: this.collection.slug, id: id2 });
+      const externalSubject = localDoc?.externalSubject || id2;
+      await provider.members.delete({ externalSubject, req: c.req });
+      return c.json({ message: "Deleted" });
+    }
     const readonlyDb = createReadonlyDb(db);
     const id = c.req.param("id");
-    if (!id) return c.json({ message: "Missing ID" }, 400);
+    if (!id)
+      return c.json({ message: "Missing ID" }, 400);
     const user = c.get("user");
     const doc = await db.findOne({ collection: this.collection.slug, id });
-    if (!doc) return c.json({ message: "Not Found" }, 404);
+    if (!doc)
+      return c.json({ message: "Not Found" }, 404);
     let before = null;
     if (this.collection.audit) {
       before = doc;
@@ -779,7 +921,8 @@ var CollectionController = class {
   async deleteMany(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const readonlyDb = createReadonlyDb(db);
     const user = c.get("user");
     let ids = [];
@@ -794,7 +937,8 @@ var CollectionController = class {
       const raw = c.req.queries("ids") ?? c.req.queries("ids[]") ?? [];
       ids = raw.filter(Boolean);
     }
-    if (!ids.length) return c.json({ message: "No IDs provided" }, 400);
+    if (!ids.length)
+      return c.json({ message: "No IDs provided" }, 400);
     const deleted = [];
     const failed = [];
     for (const id of ids) {
@@ -847,7 +991,8 @@ var CollectionController = class {
   async seed(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json();
     const initialData = body.data;
     if (!initialData || !Array.isArray(initialData)) {
@@ -867,7 +1012,7 @@ var CollectionController = class {
   }
 };
 
-// src/controllers/global.controller.ts
+// src/controllers/global.controller.js
 var GlobalController = class {
   global;
   constructor(global) {
@@ -876,7 +1021,8 @@ var GlobalController = class {
   async get(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const readonlyDb = createReadonlyDb(db);
     const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 10;
     const user = c.get("user");
@@ -920,7 +1066,8 @@ var GlobalController = class {
   async update(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const readonlyDb = createReadonlyDb(db);
     const body = await c.req.json();
     const user = c.get("user");
@@ -955,7 +1102,8 @@ var GlobalController = class {
   async seed(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json();
     const initialData = body.data;
     if (!initialData) {
@@ -971,20 +1119,23 @@ var GlobalController = class {
   }
 };
 function isFunctionallyEmpty(obj) {
-  if (obj === null || obj === void 0 || obj === "") return true;
+  if (obj === null || obj === void 0 || obj === "")
+    return true;
   if (Array.isArray(obj)) {
-    if (obj.length === 0) return true;
+    if (obj.length === 0)
+      return true;
     return obj.every(isFunctionallyEmpty);
   }
   if (typeof obj === "object") {
     const keys = Object.keys(obj);
-    if (keys.length === 0) return true;
+    if (keys.length === 0)
+      return true;
     return keys.every((key) => isFunctionallyEmpty(obj[key]));
   }
   return false;
 }
 
-// src/controllers/media.controller.ts
+// src/controllers/media.controller.js
 var MediaController = class {
   collection;
   constructor(collection = "media") {
@@ -1064,7 +1215,8 @@ var MediaController = class {
       }
     }
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const doc = await db.create({
       collection: this.collection,
       data: finalFileData
@@ -1073,7 +1225,8 @@ var MediaController = class {
   }
   async find(c) {
     const db = c.get("config").db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const limit = Number(c.req.query("limit")) || 10;
     const page = Number(c.req.query("page")) || 1;
     const result = await db.find({
@@ -1087,11 +1240,14 @@ var MediaController = class {
     const config = c.get("config");
     const storage = config.storage;
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const id = c.req.param("id");
-    if (!id) return c.json({ message: "Missing ID" }, 400);
+    if (!id)
+      return c.json({ message: "Missing ID" }, 400);
     const doc = await db.findOne({ collection: this.collection, id });
-    if (!doc) return c.json({ message: "Not Found" }, 404);
+    if (!doc)
+      return c.json({ message: "Not Found" }, 404);
     if (storage) {
       await storage.delete({ filename: doc.filename });
       if (doc.sizes) {
@@ -1112,26 +1268,26 @@ var MediaController = class {
       return c.json({ message: "Storage not configured for serving" }, 404);
     }
     const filename = c.req.param("filename");
-    if (!filename) return c.json({ message: "Missing filename" }, 400);
+    if (!filename)
+      return c.json({ message: "Missing filename" }, 400);
     let res = await storage.resolve({ filename });
     if (!res && !filename.includes("/")) {
       res = await storage.resolve({ filename: `default/${filename}` });
     }
-    if (!res) return c.json({ message: "Not Found" }, 404);
+    if (!res)
+      return c.json({ message: "Not Found" }, 404);
     c.header("Content-Type", res.mimeType);
     return c.body(res.buffer);
   }
 };
 
-// src/auth/token.ts
+// src/auth/token.js
 import { SignJWT, jwtVerify, decodeJwt } from "jose";
 import { TextEncoder } from "util";
 function getSecret() {
   const secret = process.env.DYRECTED_JWT_SECRET || process.env.JWT_SECRET;
   if (!secret) {
-    throw new Error(
-      "[dyrected/core] DYRECTED_JWT_SECRET is not set. Add it to your environment variables to enable auth collections."
-    );
+    throw new Error("[dyrected/core] DYRECTED_JWT_SECRET is not set. Add it to your environment variables to enable auth collections.");
   }
   return new TextEncoder().encode(secret);
 }
@@ -1144,7 +1300,7 @@ async function verifyCollectionToken(token) {
   return payload;
 }
 
-// src/services/email-template.ts
+// src/services/email-template.js
 var emailTokens = {
   colors: {
     canvas: "#f6f7f2",
@@ -1208,11 +1364,9 @@ function detailBox(content, monospace = false) {
 }
 function ctaButton(label, href) {
   const safeHref = safeHttpUrl(href);
-  if (!safeHref) return "";
-  return table(row(
-    `<a href="${safeHref}" style="display:inline-block;padding:13px 22px;border-radius:${emailTokens.radius.control};background:${emailTokens.colors.accent};font-family:${emailTokens.font};font-size:14px;line-height:1.2;font-weight:700;color:${emailTokens.colors.text};text-decoration:none">${escapeHtml(label)}</a>`,
-    "padding:8px 0 24px"
-  ), "width:auto");
+  if (!safeHref)
+    return "";
+  return table(row(`<a href="${safeHref}" style="display:inline-block;padding:13px 22px;border-radius:${emailTokens.radius.control};background:${emailTokens.colors.accent};font-family:${emailTokens.font};font-size:14px;line-height:1.2;font-weight:700;color:${emailTokens.colors.text};text-decoration:none">${escapeHtml(label)}</a>`, "padding:8px 0 24px"), "width:auto");
 }
 function alertBox(content) {
   return table(row(escapeHtml(content), `padding:13px 16px;font-family:${emailTokens.font};font-size:13px;line-height:1.5;color:${emailTokens.colors.dangerText}`), `width:100%;background:${emailTokens.colors.dangerSurface};border:1px solid ${emailTokens.colors.dangerBorder};border-radius:${emailTokens.radius.control}`);
@@ -1223,23 +1377,19 @@ function layout({ preheader, title, content, footer }) {
   <head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"></head>
   <body style="margin:0;padding:0;background:${emailTokens.colors.canvas}">
     <div style="display:none;max-height:0;overflow:hidden;opacity:0;color:transparent">${escapeHtml(preheader)}</div>
-    ${table(row(
-    table(
-      row("&nbsp;", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${sectionLabel("Dyrected")}${heading(title)}`, "padding:30px 32px 24px") + row(content, "padding:0 32px 32px") + row(`${divider()}${paragraph(footer, "20px 0 6px")}${paragraph("Privacy: this message contains account-related information; please avoid forwarding it.", "0")}`, "padding:0 32px 28px"),
-      `width:100%;max-width:${emailTokens.width};background:${emailTokens.colors.surface};border:1px solid ${emailTokens.colors.border};border-radius:${emailTokens.radius.card};overflow:hidden`
-    ),
-    "padding:32px 12px"
-  ), `width:100%;background:${emailTokens.colors.canvas}`)}
+    ${table(row(table(row("&nbsp;", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${sectionLabel("Dyrected")}${heading(title)}`, "padding:30px 32px 24px") + row(content, "padding:0 32px 32px") + row(`${divider()}${paragraph(footer, "20px 0 6px")}${paragraph("Privacy: this message contains account-related information; please avoid forwarding it.", "0")}`, "padding:0 32px 28px"), `width:100%;max-width:${emailTokens.width};background:${emailTokens.colors.surface};border:1px solid ${emailTokens.colors.border};border-radius:${emailTokens.radius.card};overflow:hidden`), "padding:32px 12px"), `width:100%;background:${emailTokens.colors.canvas}`)}
   </body>
 </html>`;
 }
 
-// src/services/email.service.ts
+// src/services/email.service.js
 var _devSend = null;
 var _devSendPromise = null;
 async function getDevSend() {
-  if (_devSend) return _devSend;
-  if (_devSendPromise) return _devSendPromise;
+  if (_devSend)
+    return _devSend;
+  if (_devSendPromise)
+    return _devSendPromise;
   _devSendPromise = (async () => {
     try {
       const nodemailer = await import("nodemailer");
@@ -1323,7 +1473,7 @@ function buildPasswordChangedEmail(config, args) {
   };
 }
 
-// src/controllers/auth.controller.ts
+// src/controllers/auth.controller.js
 var AuthController = class {
   collection;
   constructor(collection) {
@@ -1335,7 +1485,8 @@ var AuthController = class {
   // ---------------------------------------------------------------------------
   async init(c) {
     const db = c.get("config").db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const result = await db.find({
       collection: this.collection.slug,
       limit: 1
@@ -1351,7 +1502,8 @@ var AuthController = class {
   async registerFirstUser(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const check = await db.find({
       collection: this.collection.slug,
       limit: 1
@@ -1379,9 +1531,7 @@ var AuthController = class {
       collection: this.collection.slug
     });
     const { subject, html } = buildWelcomeEmail(config, { email: body.email });
-    sendEmail(config, { to: body.email, subject, html }).catch(
-      (err) => console.error("[dyrected/core] Failed to send welcome email:", err)
-    );
+    sendEmail(config, { to: body.email, subject, html }).catch((err) => console.error("[dyrected/core] Failed to send welcome email:", err));
     const { password: _, ...safeUser } = user;
     return c.json({ token, user: safeUser });
   }
@@ -1390,7 +1540,8 @@ var AuthController = class {
   // ---------------------------------------------------------------------------
   async login(c) {
     const db = c.get("config").db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json().catch(() => null);
     if (!body?.email || !body?.password) {
       return c.json({ error: true, message: "email and password are required." }, 400);
@@ -1429,7 +1580,8 @@ var AuthController = class {
   // ---------------------------------------------------------------------------
   async me(c) {
     const db = c.get("config").db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const requestUser = c.get("user");
     if (!requestUser) {
       return c.json({ error: true, message: "Authentication required." }, 401);
@@ -1464,7 +1616,8 @@ var AuthController = class {
   async forgotPassword(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json().catch(() => null);
     if (!body?.email) {
       return c.json({ error: true, message: "email is required." }, 400);
@@ -1476,10 +1629,7 @@ var AuthController = class {
     });
     const user = result.docs[0];
     if (user) {
-      const resetToken = await signCollectionToken(
-        { sub: user.id, email: user.email, collection: this.collection.slug, purpose: "reset" },
-        "1h"
-      );
+      const resetToken = await signCollectionToken({ sub: user.id, email: user.email, collection: this.collection.slug, purpose: "reset" }, "1h");
       const resetUrl = body?.resetUrl;
       const url = resetUrl ? `${resetUrl}${resetUrl.includes("?") ? "&" : "?"}token=${encodeURIComponent(resetToken)}` : void 0;
       try {
@@ -1502,7 +1652,8 @@ var AuthController = class {
   async resetPassword(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json().catch(() => null);
     if (!body?.token || !body?.password) {
       return c.json({ error: true, message: "token and password are required." }, 400);
@@ -1523,9 +1674,7 @@ var AuthController = class {
       data: { password: hashedPassword }
     });
     const { subject, html } = buildPasswordChangedEmail(config, { email: payload.email });
-    sendEmail(config, { to: payload.email, subject, html }).catch(
-      (err) => console.error("[dyrected/core] Failed to send password-changed email:", err)
-    );
+    sendEmail(config, { to: payload.email, subject, html }).catch((err) => console.error("[dyrected/core] Failed to send password-changed email:", err));
     return c.json({ success: true, message: "Password has been reset. You can now log in." });
   }
   // ---------------------------------------------------------------------------
@@ -1535,7 +1684,8 @@ var AuthController = class {
   async invite(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const requestUser = c.get("user");
     if (!requestUser) {
       return c.json({ error: true, message: "Authentication required." }, 401);
@@ -1552,10 +1702,7 @@ var AuthController = class {
     if (existing.total > 0) {
       return c.json({ error: true, message: "An account with that email already exists." }, 409);
     }
-    const inviteToken = await signCollectionToken(
-      { sub: body.email, email: body.email, collection: this.collection.slug, purpose: "invite" },
-      "7d"
-    );
+    const inviteToken = await signCollectionToken({ sub: body.email, email: body.email, collection: this.collection.slug, purpose: "invite" }, "7d");
     try {
       const { subject, html } = buildInviteEmail(config, {
         token: inviteToken,
@@ -1575,7 +1722,8 @@ var AuthController = class {
   async acceptInvite(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json().catch(() => null);
     if (!body?.token || !body?.password) {
       return c.json({ error: true, message: "token and password are required." }, 400);
@@ -1610,28 +1758,21 @@ var AuthController = class {
       collection: this.collection.slug
     });
     const { subject, html } = buildWelcomeEmail(config, { email: inviteeEmail });
-    sendEmail(config, { to: inviteeEmail, subject, html }).catch(
-      (err) => console.error("[dyrected/core] Failed to send welcome email:", err)
-    );
+    sendEmail(config, { to: inviteeEmail, subject, html }).catch((err) => console.error("[dyrected/core] Failed to send welcome email:", err));
     const { password: _, ...safeUser } = user;
     return c.json({ token: sessionToken, user: safeUser }, 201);
   }
 };
 
-// src/controllers/admin-auth.controller.ts
+// src/controllers/admin-auth.controller.js
 import { randomBytes as randomBytes2 } from "crypto";
 import { TextEncoder as TextEncoder2 } from "util";
-import {
-  SignJWT as SignJWT2,
-  createRemoteJWKSet,
-  jwtVerify as jwtVerify2,
-  decodeJwt as decodeJwt2
-} from "jose";
+import { SignJWT as SignJWT2, createRemoteJWKSet, jwtVerify as jwtVerify2, decodeJwt as decodeJwt2 } from "jose";
 var AdminAuthController = class {
+  config;
   constructor(config) {
     this.config = config;
   }
-  config;
   providers(c) {
     return c.json(getPublicAdminAuthConfig(this.config.adminAuth));
   }
@@ -1644,20 +1785,22 @@ var AdminAuthController = class {
     const siteId = this.getSiteId(c);
     const returnTo = this.normalizeReturnTo(c.req.query("returnTo"), c);
     if (provider.type === "oidc") {
-      const redirectUrl = await this.buildOidcStartUrl(
-        provider,
-        returnTo,
-        siteId,
-        new URL(c.req.url).origin
-      );
+      const redirectUrl = await this.buildOidcStartUrl(provider, returnTo, siteId, new URL(c.req.url).origin);
       return c.redirect(redirectUrl, 302);
     }
     if (!provider.startUrl) {
       return c.json({ error: true, message: "This provider does not expose a start URL." }, 400);
     }
-    const url = new URL(provider.startUrl);
+    const url = this.buildCustomProviderStartUrl(provider.startUrl, new URL(c.req.url).origin);
+    if (!url) {
+      return c.json({
+        error: true,
+        message: `Admin auth provider "${provider.id}" has an invalid start URL.`
+      }, 500);
+    }
     url.searchParams.set("returnTo", returnTo);
-    if (siteId) url.searchParams.set("siteId", siteId);
+    if (siteId)
+      url.searchParams.set("siteId", siteId);
     url.searchParams.set("provider", provider.id);
     return c.redirect(url.toString(), 302);
   }
@@ -1704,7 +1847,8 @@ var AdminAuthController = class {
     return c.json({ success: true, message: "Logged out. Discard your token." });
   }
   getProvider(config, id) {
-    if (config.adminAuth?.mode !== "external") return void 0;
+    if (config.adminAuth?.mode !== "external")
+      return void 0;
     return config.adminAuth.providers.find((provider) => provider.id === id);
   }
   async completeProviderAuth(requestConfig, provider, c) {
@@ -1716,7 +1860,8 @@ var AdminAuthController = class {
       throw new Error("Admin auth collection is not configured.");
     }
     const db = c.get("config").db;
-    if (!db) throw new Error("Database not configured.");
+    if (!db)
+      throw new Error("Database not configured.");
     let user = await this.findUserByExternalIdentity(db, adminCollection.slug, provider.id, identity.sub) ?? (identity.email ? (await db.find({
       collection: adminCollection.slug,
       where: { email: identity.email },
@@ -1776,7 +1921,8 @@ var AdminAuthController = class {
       },
       user
     });
-    if (resolved) return resolved;
+    if (resolved)
+      return resolved;
     return { allowed: true, roles: identity.roles, data: {} };
   }
   async buildUserData(identity, providerId, roles, extraData) {
@@ -1807,7 +1953,8 @@ var AdminAuthController = class {
   }
   async getRequestConfig(c) {
     const siteId = this.getSiteId(c);
-    if (!siteId || !this.config.onSchemaFetch) return this.config;
+    if (!siteId || !this.config.onSchemaFetch)
+      return this.config;
     const dynamic = await this.config.onSchemaFetch(siteId);
     return {
       ...this.config,
@@ -1838,7 +1985,8 @@ var AdminAuthController = class {
   async resolveOidcIdentity(provider, c) {
     const code = c.req.query("code");
     const state = c.req.query("state");
-    if (!code || !state) throw new Error("Missing OIDC callback parameters.");
+    if (!code || !state)
+      throw new Error("Missing OIDC callback parameters.");
     const parsedState = await this.verifyState(state, provider.id);
     const discovery = await this.getOidcDiscovery(provider);
     const redirectUri = provider.redirectUri || this.defaultCallbackPath(provider.id, new URL(c.req.url).origin);
@@ -1873,7 +2021,8 @@ var AdminAuthController = class {
       const userInfo = await fetch(provider.userInfoEndpoint || discovery.userinfo_endpoint, {
         headers: { Authorization: `Bearer ${tokenBody.access_token}` }
       });
-      if (!userInfo.ok) throw new Error("OIDC userinfo request failed.");
+      if (!userInfo.ok)
+        throw new Error("OIDC userinfo request failed.");
       claims = await userInfo.json();
     } else {
       throw new Error("OIDC provider did not return usable identity claims.");
@@ -1913,15 +2062,13 @@ var AdminAuthController = class {
       if (provider.audience) {
         const aud = claims.aud;
         const matches = Array.isArray(aud) ? aud.includes(provider.audience) : aud === provider.audience;
-        if (!matches) throw new Error("External auth audience mismatch.");
+        if (!matches)
+          throw new Error("External auth audience mismatch.");
       }
     }
     return {
       identity: this.mapClaims(claims, provider.claimMapping),
-      returnTo: this.normalizeReturnTo(
-        body?.returnTo || c.req.query("returnTo"),
-        c
-      )
+      returnTo: this.normalizeReturnTo(body?.returnTo || c.req.query("returnTo"), c)
     };
   }
   mapClaims(claims, mapping) {
@@ -1951,24 +2098,38 @@ var AdminAuthController = class {
     return typeof value === "string" ? value : void 0;
   }
   readStringArrayClaim(value) {
-    if (!value) return void 0;
+    if (!value)
+      return void 0;
     if (Array.isArray(value)) {
       return value.filter((entry) => typeof entry === "string");
     }
-    if (typeof value === "string") return [value];
+    if (typeof value === "string")
+      return [value];
     return void 0;
   }
   async getOidcDiscovery(provider) {
-    const discoveryUrl = new URL(
-      provider.issuer.replace(/\/$/, "") + "/.well-known/openid-configuration"
-    );
+    const discoveryUrl = new URL(provider.issuer.replace(/\/$/, "") + "/.well-known/openid-configuration");
     const response = await fetch(discoveryUrl.toString());
-    if (!response.ok) throw new Error("Failed to load OIDC discovery document.");
+    if (!response.ok)
+      throw new Error("Failed to load OIDC discovery document.");
     return response.json();
   }
   defaultCallbackPath(providerId, origin = "") {
     return `${origin}/api/admin/auth/${providerId}/callback`;
   }
+  buildCustomProviderStartUrl(startUrl, origin) {
+    const value = startUrl.trim();
+    if (!value || /^(undefined|null)(\/|$)/i.test(value))
+      return null;
+    try {
+      const url = new URL(value, origin);
+      if (url.protocol !== "http:" && url.protocol !== "https:")
+        return null;
+      return url;
+    } catch {
+      return null;
+    }
+  }
   async signState(payload) {
     return new SignJWT2(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("15m").sign(this.getStateSecret());
   }
@@ -1988,13 +2149,14 @@ var AdminAuthController = class {
     return new TextEncoder2().encode(secret);
   }
   normalizeReturnTo(returnTo, c) {
-    if (returnTo) return returnTo;
+    if (returnTo)
+      return returnTo;
     const url = new URL(c.req.url);
     return `${url.origin}/admin`;
   }
 };
 
-// src/controllers/preview.controller.ts
+// src/controllers/preview.controller.js
 import { SignJWT as SignJWT3, jwtVerify as jwtVerify3 } from "jose";
 import { TextEncoder as TextEncoder3 } from "util";
 var PreviewController = class {
@@ -2037,7 +2199,7 @@ var PreviewController = class {
   }
 };
 
-// src/middleware/auth.ts
+// src/middleware/auth.js
 function requireAuth() {
   return async (c, next) => {
     const authHeader = c.req.header("Authorization");
@@ -2069,7 +2231,7 @@ function optionalAuth() {
   };
 }
 
-// src/utils/swagger.ts
+// src/utils/swagger.js
 function getSwaggerHtml(specUrl = "/api/openapi.json") {
   return `
 <!DOCTYPE html>
@@ -2118,7 +2280,7 @@ function getSwaggerHtml(specUrl = "/api/openapi.json") {
   `;
 }
 
-// src/router.ts
+// src/router.js
 function accessGate(target, action) {
   return async (c, next) => {
     const user = c.get("user");
@@ -2135,7 +2297,8 @@ function accessGate(target, action) {
   };
 }
 async function checkAccess(access, accessArgs) {
-  if (access === void 0 || access === null) return true;
+  if (access === void 0 || access === null)
+    return true;
   if (typeof access === "function") {
     try {
       const result = await access(accessArgs);
@@ -2151,7 +2314,8 @@ async function checkAccess(access, accessArgs) {
   return true;
 }
 function serializeFieldForApi(f) {
-  if (!f) return f;
+  if (!f)
+    return f;
   const serialized = { ...f };
   if (serialized.admin?.hooks) {
     const hooks = { ...serialized.admin.hooks };
@@ -2184,8 +2348,10 @@ function registerRoutes(app, config) {
     let globals = [...config.globals];
     if (siteId && config.onSchemaFetch) {
       const dynamic = await config.onSchemaFetch(siteId);
-      if (dynamic.collections) collections = [...collections, ...dynamic.collections];
-      if (dynamic.globals) globals = [...globals, ...dynamic.globals];
+      if (dynamic.collections)
+        collections = [...collections, ...dynamic.collections];
+      if (dynamic.globals)
+        globals = [...globals, ...dynamic.globals];
       if (dynamic.admin) {
         config.admin = { ...config.admin, ...dynamic.admin };
       }
@@ -2196,8 +2362,10 @@ function registerRoutes(app, config) {
     const user = c.get("user");
     const accessArgs = { user, req: c.req, doc: null };
     const serializeAccess = async (access) => {
-      if (typeof access === "string") return access;
-      if (typeof access === "boolean") return access;
+      if (typeof access === "string")
+        return access;
+      if (typeof access === "boolean")
+        return access;
       return checkAccess(access, accessArgs);
     };
     const filteredCollections = await Promise.all(collections.filter((col) => !siteId || col.shared || !col.siteId || col.siteId === siteId).map(async (col) => ({
@@ -2290,7 +2458,8 @@ function registerRoutes(app, config) {
     let collections = [...config.collections];
     if (siteId && config.onSchemaFetch) {
       const dynamic = await config.onSchemaFetch(siteId);
-      if (dynamic.collections) collections = [...collections, ...dynamic.collections];
+      if (dynamic.collections)
+        collections = [...collections, ...dynamic.collections];
     }
     const user = c.get("user");
     let collection = collections.find((col) => col.slug === colSlug);
@@ -2309,7 +2478,8 @@ function registerRoutes(app, config) {
       let globals = [...config.globals];
       if (siteId && config.onSchemaFetch) {
         const dynamic = await config.onSchemaFetch(siteId);
-        if (dynamic.globals) globals = [...globals, ...dynamic.globals];
+        if (dynamic.globals)
+          globals = [...globals, ...dynamic.globals];
       }
       const glb = globals.find((g) => g.slug === colSlug);
       if (!glb) {
@@ -2367,9 +2537,12 @@ function registerRoutes(app, config) {
     const user = c.get("user");
     const key = c.req.param("key");
     const scope = c.req.query("scope");
-    if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
+    if (!user?.collection || !user.sub)
+      return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key)
+      return c.json({ error: true, message: "Preference key is required." }, 400);
     const getGlobalPreference = async () => {
       const globalDoc = await db.findOne({ collection: "__global_preferences", id: key });
       return globalDoc ? globalDoc.value : null;
@@ -2379,7 +2552,8 @@ function registerRoutes(app, config) {
       return c.json({ key, value: globalValue2 });
     }
     const doc = await db.findOne({ collection: user.collection, id: user.sub });
-    if (!doc) return c.json({ error: true, message: "User not found." }, 404);
+    if (!doc)
+      return c.json({ error: true, message: "User not found." }, 404);
     const preferences = typeof doc.__preferences === "object" && doc.__preferences !== null ? doc.__preferences : {};
     if (key in preferences) {
       return c.json({ key, value: preferences[key] ?? null });
@@ -2392,9 +2566,12 @@ function registerRoutes(app, config) {
     const user = c.get("user");
     const key = c.req.param("key");
     const scope = c.req.query("scope");
-    if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
+    if (!user?.collection || !user.sub)
+      return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key)
+      return c.json({ error: true, message: "Preference key is required." }, 400);
     const body = await c.req.json().catch(() => ({}));
     if (scope === "global") {
       const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
@@ -2417,7 +2594,8 @@ function registerRoutes(app, config) {
       return c.json({ key, value: body.value });
     }
     const doc = await db.findOne({ collection: user.collection, id: user.sub });
-    if (!doc) return c.json({ error: true, message: "User not found." }, 404);
+    if (!doc)
+      return c.json({ error: true, message: "User not found." }, 404);
     const preferences = typeof doc.__preferences === "object" && doc.__preferences !== null ? doc.__preferences : {};
     const nextPreferences = { ...preferences, [key]: body.value };
     await db.update({
@@ -2432,9 +2610,12 @@ function registerRoutes(app, config) {
     const user = c.get("user");
     const key = c.req.param("key");
     const scope = c.req.query("scope");
-    if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
+    if (!user?.collection || !user.sub)
+      return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key)
+      return c.json({ error: true, message: "Preference key is required." }, 400);
     if (scope === "global") {
       const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
       if (!isAdminUser) {
@@ -2444,7 +2625,8 @@ function registerRoutes(app, config) {
       return c.json({ success: true });
     }
     const doc = await db.findOne({ collection: user.collection, id: user.sub });
-    if (!doc) return c.json({ error: true, message: "User not found." }, 404);
+    if (!doc)
+      return c.json({ error: true, message: "User not found." }, 404);
     const preferences = typeof doc.__preferences === "object" && doc.__preferences !== null ? { ...doc.__preferences } : {};
     delete preferences[key];
     await db.update({
@@ -2480,7 +2662,8 @@ function registerRoutes(app, config) {
   app.post("/api/admin/auth/:provider/exchange", (c) => adminAuthController.exchange(c));
   app.post("/api/admin/logout", (c) => adminAuthController.logout(c));
   for (const collection of config.collections) {
-    if (!collection.auth) continue;
+    if (!collection.auth)
+      continue;
     const path = `/api/collections/${collection.slug}`;
     const authController = new AuthController(collection);
     app.post(`${path}/login`, (c) => authController.login(c));
@@ -2582,25 +2765,39 @@ function registerRoutes(app, config) {
         if (collection.auth && id) {
           const authController = new AuthController(collection);
           const method2 = c.req.method;
-          if (method2 === "POST" && id === "login") return authController.login(c);
-          if (method2 === "POST" && id === "logout") return authController.logout(c);
-          if (method2 === "GET" && id === "me") return authController.me(c);
-          if (method2 === "POST" && id === "refresh-token") return authController.refreshToken(c);
-          if (method2 === "POST" && id === "forgot-password") return authController.forgotPassword(c);
-          if (method2 === "POST" && id === "reset-password") return authController.resetPassword(c);
+          if (method2 === "POST" && id === "login")
+            return authController.login(c);
+          if (method2 === "POST" && id === "logout")
+            return authController.logout(c);
+          if (method2 === "GET" && id === "me")
+            return authController.me(c);
+          if (method2 === "POST" && id === "refresh-token")
+            return authController.refreshToken(c);
+          if (method2 === "POST" && id === "forgot-password")
+            return authController.forgotPassword(c);
+          if (method2 === "POST" && id === "reset-password")
+            return authController.resetPassword(c);
         }
         const controller = new CollectionController(collection);
         const method = c.req.method;
         if (id) {
-          if (method === "GET") return controller.findOne(c);
-          if (method === "PATCH") return controller.update(c);
-          if (method === "DELETE" && id === "delete-many") return controller.deleteMany(c);
-          if (method === "DELETE") return controller.delete(c);
-          if (method === "POST" && id === "media") return controller.create(c);
-          if (method === "POST" && id === "seed") return controller.seed(c);
+          if (method === "GET")
+            return controller.findOne(c);
+          if (method === "PATCH")
+            return controller.update(c);
+          if (method === "DELETE" && id === "delete-many")
+            return controller.deleteMany(c);
+          if (method === "DELETE")
+            return controller.delete(c);
+          if (method === "POST" && id === "media")
+            return controller.create(c);
+          if (method === "POST" && id === "seed")
+            return controller.seed(c);
         } else {
-          if (method === "GET") return controller.find(c);
-          if (method === "POST") return controller.create(c);
+          if (method === "GET")
+            return controller.find(c);
+          if (method === "POST")
+            return controller.create(c);
         }
       }
     }
@@ -2621,10 +2818,13 @@ function registerRoutes(app, config) {
         const controller = new GlobalController(global);
         const method = c.req.method;
         if (id) {
-          if (method === "POST" && id === "seed") return controller.seed(c);
+          if (method === "POST" && id === "seed")
+            return controller.seed(c);
         } else {
-          if (method === "GET") return controller.get(c);
-          if (method === "PATCH") return controller.update(c);
+          if (method === "GET")
+            return controller.get(c);
+          if (method === "PATCH")
+            return controller.update(c);
         }
       }
     }
@@ -2632,7 +2832,7 @@ function registerRoutes(app, config) {
   });
 }
 
-// src/app.ts
+// src/app.js
 async function createDyrectedApp(rawConfig) {
   const config = normalizeConfig(rawConfig);
   const app = new Hono();