@kyro-cms/core 0.5.4 → 0.5.5

package/dist/{chunk-SYRDCLH7.cjs → chunk-R2YHJN6W.cjs}

@@ -1,11 +1,13 @@
 'use strict';
 
-var chunkEVEJC22G_cjs = require('./chunk-EVEJC22G.cjs');
+var chunkRDRJVCL5_cjs = require('./chunk-RDRJVCL5.cjs');
 var chunkADLJSJSN_cjs = require('./chunk-ADLJSJSN.cjs');
 var chunkIBG6V56E_cjs = require('./chunk-IBG6V56E.cjs');
 var chunkVJT6P4N6_cjs = require('./chunk-VJT6P4N6.cjs');
 var chunkR3XIBBAW_cjs = require('./chunk-R3XIBBAW.cjs');
-var chunk7SXPHG3M_cjs = require('./chunk-7SXPHG3M.cjs');
+var chunkWVPOPOEQ_cjs = require('./chunk-WVPOPOEQ.cjs');
+var chunkRALQO47U_cjs = require('./chunk-RALQO47U.cjs');
+var chunkXAEBVZTI_cjs = require('./chunk-XAEBVZTI.cjs');
 var chunkG7VZBCD6_cjs = require('./chunk-G7VZBCD6.cjs');
 var crypto = require('crypto');
 var unstorage = require('unstorage');
@@ -952,7 +954,7 @@ var AuthRoutes = class {
   constructor(config) {
     this.authAdapter = config.redis;
     this.email = config.email;
-    this.passwordPolicy = config.passwordPolicy || new chunkEVEJC22G_cjs.PasswordPolicy();
+    this.passwordPolicy = config.passwordPolicy || new chunkRDRJVCL5_cjs.PasswordPolicy();
     this.lockout = config.lockout;
     this.rateLimiter = config.rateLimiter;
     this.auditLogger = config.auditLogger;
@@ -1017,6 +1019,7 @@ var AuthRoutes = class {
         201
       );
     } catch (error) {
+      console.error("[AuthRoutes.register] Registration error:", error);
       return this.errorResponse("Registration failed", 500);
     }
   }
@@ -2668,6 +2671,7 @@ async function processImage(buffer) {
 }
 
 // src/storage/MediaService.ts
+var _mediaTablesEnsured = false;
 var MediaService = class _MediaService {
   db;
   storage;
@@ -2679,60 +2683,98 @@ var MediaService = class _MediaService {
     this.db = db;
     this.storage = storage2;
     this.dialect = options?.dialect || "sqlite";
-    this.genId = options?.genId || chunk7SXPHG3M_cjs.genId;
+    this.genId = options?.genId || chunkWVPOPOEQ_cjs.genId;
   }
   static async init(db, options) {
     let storage2;
     if (options?.storageConfig) {
       storage2 = await resolveProviderWithConfig(options.storageConfig);
     } else {
-      const configService = new chunkEVEJC22G_cjs.ConfigService(db);
+      const configService = new chunkRDRJVCL5_cjs.ConfigService(db);
       if (typeof db?.select === "function") {
         await configService.load();
       }
       storage2 = await resolveProvider(configService);
     }
     const service = new _MediaService(db, storage2, options);
-    service.ensureTables();
+    await service.ensureTables();
     return service;
   }
-  ensureTables() {
-    if (this.dialect !== "sqlite") return;
-    this.db.exec(`
-      CREATE TABLE IF NOT EXISTS media (
-        id TEXT PRIMARY KEY,
-        filename TEXT NOT NULL UNIQUE,
-        title TEXT,
-        original_name TEXT NOT NULL,
-        mime_type TEXT NOT NULL,
-        file_size INTEGER NOT NULL,
-        width INTEGER,
-        height INTEGER,
-        url TEXT NOT NULL UNIQUE,
-        thumbnail_url TEXT,
-        folder TEXT,
-        provider TEXT NOT NULL,
-        alt TEXT,
-        caption TEXT,
-        metadata TEXT,
-        created_at TEXT NOT NULL,
-        updated_at TEXT NOT NULL
-      );
-      CREATE INDEX IF NOT EXISTS idx_media_folder ON media(folder);
-      CREATE INDEX IF NOT EXISTS idx_media_provider ON media(provider);
-      CREATE INDEX IF NOT EXISTS idx_media_filename ON media(filename);
-      CREATE INDEX IF NOT EXISTS idx_media_folders_path ON media_folders(path);
-    `);
-    this.db.exec(`
-      CREATE TABLE IF NOT EXISTS media_folders (
-        id TEXT PRIMARY KEY,
-        name TEXT NOT NULL,
-        path TEXT NOT NULL,
-        parent_path TEXT,
-        created_at TEXT
-      );
-      CREATE INDEX IF NOT EXISTS idx_media_folders_path ON media_folders(path);
-    `);
+  async ensureTables() {
+    if (this.dialect === "sqlite") {
+      this.db.exec(`
+        CREATE TABLE IF NOT EXISTS media (
+          id TEXT PRIMARY KEY,
+          filename TEXT NOT NULL UNIQUE,
+          title TEXT,
+          original_name TEXT NOT NULL,
+          mime_type TEXT NOT NULL,
+          file_size INTEGER NOT NULL,
+          width INTEGER,
+          height INTEGER,
+          url TEXT NOT NULL UNIQUE,
+          thumbnail_url TEXT,
+          folder TEXT,
+          provider TEXT NOT NULL,
+          alt TEXT,
+          caption TEXT,
+          metadata TEXT,
+          created_at TEXT NOT NULL,
+          updated_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_media_folder ON media(folder);
+        CREATE INDEX IF NOT EXISTS idx_media_provider ON media(provider);
+        CREATE INDEX IF NOT EXISTS idx_media_filename ON media(filename);
+      `);
+      this.db.exec(`
+        CREATE TABLE IF NOT EXISTS media_folders (
+          id TEXT PRIMARY KEY,
+          name TEXT NOT NULL,
+          path TEXT NOT NULL,
+          parent_path TEXT,
+          created_at TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_media_folders_path ON media_folders(path);
+      `);
+    } else if (this.dialect === "postgres") {
+      if (_mediaTablesEnsured) return;
+      const { sql } = await import('drizzle-orm');
+      await this.db.execute(sql`
+        CREATE TABLE IF NOT EXISTS "media" (
+          "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+          "filename" VARCHAR(255) NOT NULL UNIQUE,
+          "title" VARCHAR(255),
+          "original_name" VARCHAR(255) NOT NULL,
+          "mime_type" VARCHAR(100),
+          "file_size" INTEGER,
+          "width" INTEGER,
+          "height" INTEGER,
+          "url" TEXT NOT NULL UNIQUE,
+          "thumbnail_url" TEXT,
+          "folder" VARCHAR(255),
+          "provider" VARCHAR(50) NOT NULL,
+          "alt" TEXT,
+          "caption" TEXT,
+          "metadata" JSONB,
+          "created_at" TIMESTAMP NOT NULL DEFAULT NOW(),
+          "updated_at" TIMESTAMP NOT NULL DEFAULT NOW()
+        )
+      `);
+      await this.db.execute(sql`CREATE INDEX IF NOT EXISTS "idx_media_folder" ON "media" ("folder")`);
+      await this.db.execute(sql`CREATE INDEX IF NOT EXISTS "idx_media_provider" ON "media" ("provider")`);
+      await this.db.execute(sql`CREATE INDEX IF NOT EXISTS "idx_media_filename" ON "media" ("filename")`);
+      await this.db.execute(sql`
+        CREATE TABLE IF NOT EXISTS "media_folders" (
+          "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+          "name" VARCHAR(255) NOT NULL,
+          "path" TEXT NOT NULL,
+          "parent_path" TEXT,
+          "created_at" TIMESTAMP NOT NULL DEFAULT NOW()
+        )
+      `);
+      await this.db.execute(sql`CREATE INDEX IF NOT EXISTS "idx_media_folders_path" ON "media_folders" ("path")`);
+      _mediaTablesEnsured = true;
+    }
   }
   now() {
     return (/* @__PURE__ */ new Date()).toISOString();
@@ -2853,13 +2895,15 @@ var MediaService = class _MediaService {
         ]
       );
     } else {
-      const { media: mediaSchema } = await import('./media-WKP5AOX2.cjs');
+      const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+      const mime = storageResult.mimeType;
+      const mediaType = mime.startsWith("image/") ? "image" : mime.startsWith("video/") ? "video" : mime.startsWith("audio/") ? "audio" : mime.startsWith("application/pdf") ? "document" : ["application/zip", "application/x-zip", "application/x-tar", "application/gzip", "application/x-7z"].includes(mime) ? "archive" : "other";
       await this.db.insert(mediaSchema).values({
         id,
         filename: storageResult.filename,
         title: file.name.replace(/\.[^/.]+$/, ""),
         originalName: file.name,
-        mimeType: storageResult.mimeType,
+        mimeType: mime,
         fileSize: storageResult.size,
         width,
         height,
@@ -2867,6 +2911,10 @@ var MediaService = class _MediaService {
         thumbnailUrl,
         folder: folder || "",
         provider: this.storage.name,
+        type: mediaType,
+        status: "active",
+        alt: null,
+        caption: null,
         createdAt: /* @__PURE__ */ new Date(),
         updatedAt: /* @__PURE__ */ new Date()
       }).returning();
@@ -2909,8 +2957,9 @@ var MediaService = class _MediaService {
         id
       ]);
     } else {
-      const { media: mediaSchema } = await import('./media-WKP5AOX2.cjs');
-      const [row] = await this.db.select().from(mediaSchema).where(mediaSchema.id.equals(id));
+      const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+      const { eq } = await import('drizzle-orm');
+      const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
       if (row) item = this.rowToMedia(row);
     }
     if (!item) return;
@@ -2924,8 +2973,9 @@ var MediaService = class _MediaService {
     if (this.dialect === "sqlite") {
       await this.sqliteRun(`DELETE FROM ${this.mediaTable} WHERE id = ?`, [id]);
     } else {
-      const { media: mediaSchema } = await import('./media-WKP5AOX2.cjs');
-      await this.db.delete(mediaSchema).where(mediaSchema.id.equals(id));
+      const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+      const { eq } = await import('drizzle-orm');
+      await this.db.delete(mediaSchema).where(eq(mediaSchema.id, id));
     }
   }
   async deleteFile(url) {
@@ -2938,8 +2988,9 @@ var MediaService = class _MediaService {
         id
       ]);
     } else {
-      const { media: mediaSchema } = await import('./media-WKP5AOX2.cjs');
-      const [row] = await this.db.select().from(mediaSchema).where(mediaSchema.id.equals(id));
+      const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+      const { eq } = await import('drizzle-orm');
+      const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
       if (row) item = this.rowToMedia(row);
     }
     if (!item) return null;
@@ -2972,8 +3023,9 @@ var MediaService = class _MediaService {
         [...vals, this.now(), id]
       );
     } else {
-      const { media: mediaSchema } = await import('./media-WKP5AOX2.cjs');
-      await this.db.update(mediaSchema).set({ ...updateData, updatedAt: this.now() }).where(mediaSchema.id.equals(id));
+      const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+      const { eq } = await import('drizzle-orm');
+      await this.db.update(mediaSchema).set({ ...updateData, updatedAt: this.now() }).where(eq(mediaSchema.id, id));
     }
     return {
       ...item,
@@ -2990,8 +3042,9 @@ var MediaService = class _MediaService {
       );
       return row2 ? this.rowToMedia(row2) : null;
     }
-    const { media: mediaSchema } = await import('./media-WKP5AOX2.cjs');
-    const [row] = await this.db.select().from(mediaSchema).where(mediaSchema.id.equals(id));
+    const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+    const { eq } = await import('drizzle-orm');
+    const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
     return row ? this.rowToMedia(row) : null;
   }
   async find(params = {}) {
@@ -3037,8 +3090,8 @@ var MediaService = class _MediaService {
         totalPages: Math.ceil(totalDocs2 / limit)
       };
     }
-    const { media: mediaSchema } = await import('./media-WKP5AOX2.cjs');
-    const { like, or, and, asc, desc, eq, sql } = await import('drizzle-orm/pg-core');
+    const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+    const { like, or, and, asc, desc, eq, sql } = await import('drizzle-orm');
     const conditions = [];
     if (search) {
       conditions.push(
@@ -3062,7 +3115,17 @@ var MediaService = class _MediaService {
       );
     }
     const whereClause = conditions.length > 0 ? and(...conditions) : void 0;
-    const order = sortDir === "asc" ? asc(mediaSchema[sortCol]) : desc(mediaSchema[sortCol]);
+    const sortKey = {
+      created_at: "createdAt",
+      updated_at: "updatedAt",
+      title: "title",
+      filename: "filename",
+      file_size: "fileSize",
+      mime_type: "mimeType",
+      original_name: "originalName"
+    };
+    const col = mediaSchema[sortKey[sortCol] || "createdAt"];
+    const order = sortDir === "asc" ? asc(col) : desc(col);
     const docs = await this.db.select().from(mediaSchema).where(whereClause).orderBy(order).limit(limit).offset(offset);
     const [{ count }] = await this.db.select({ count: sql`count(*)` }).from(mediaSchema).where(whereClause);
     const totalDocs = Number(count);
@@ -3106,8 +3169,9 @@ var MediaService = class _MediaService {
       );
       return row ? this.rowToMedia(row) : null;
     }
-    const { media: mediaSchema } = await import('./media-WKP5AOX2.cjs');
-    const [updated] = await this.db.update(mediaSchema).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(mediaSchema.id.equals(id)).returning();
+    const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+    const { eq } = await import('drizzle-orm');
+    const [updated] = await this.db.update(mediaSchema).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq(mediaSchema.id, id)).returning();
     return updated ? this.rowToMedia(updated) : null;
   }
   async updateMany(ids, data) {
@@ -3127,9 +3191,10 @@ var MediaService = class _MediaService {
         );
       }
     } else {
-      const { media: mediaSchema } = await import('./media-WKP5AOX2.cjs');
+      const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+      const { eq } = await import('drizzle-orm');
       for (const id of ids) {
-        await this.db.update(mediaSchema).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(mediaSchema.id.equals(id));
+        await this.db.update(mediaSchema).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq(mediaSchema.id, id));
       }
     }
   }
@@ -3141,8 +3206,8 @@ var MediaService = class _MediaService {
       );
       return rows.map((r) => r.path).filter((f) => f && f !== "").sort();
     }
-    const { media: mediaSchema, mediaFolders: folderSchema } = await import('./media-WKP5AOX2.cjs');
-    const { eq, sql } = await import('drizzle-orm/pg-core');
+    const { media: mediaSchema, mediaFolders: folderSchema } = await import('./media-XNTUFJZR.cjs');
+    const { eq, sql } = await import('drizzle-orm');
     const fromMedia = await this.db.select({ folder: mediaSchema.folder }).from(mediaSchema).groupBy(mediaSchema.folder);
     const fromFolders = await this.db.select({ path: folderSchema.path }).from(folderSchema);
     const allPaths = /* @__PURE__ */ new Set([
@@ -3161,7 +3226,7 @@ var MediaService = class _MediaService {
         [fullPath, name, parentPath || null, now]
       );
     } else {
-      const { mediaFolders: folderSchema } = await import('./media-WKP5AOX2.cjs');
+      const { mediaFolders: folderSchema } = await import('./media-XNTUFJZR.cjs');
       await this.db.insert(folderSchema).values({
         path: fullPath,
         name,
@@ -3182,8 +3247,8 @@ var MediaService = class _MediaService {
         [folder, `${folder}/%`]
       );
     } else {
-      const { mediaFolders: folderSchema } = await import('./media-WKP5AOX2.cjs');
-      const { like, or, eq } = await import('./media-WKP5AOX2.cjs');
+      const { mediaFolders: folderSchema } = await import('./media-XNTUFJZR.cjs');
+      const { like, or, eq } = await import('drizzle-orm');
       await this.db.delete(folderSchema).where(
         or(
           eq(folderSchema.path, folder),
@@ -3551,6 +3616,18 @@ async function resolveAuthContext(req, authMw, staticUser, staticTenantID) {
     authType: result.authType
   };
 }
+function createDefaultAuthAdapter(db, rootDir) {
+  if (db instanceof chunkWVPOPOEQ_cjs.DrizzleAdapter && db.dialect === "postgres") {
+    return new chunkRALQO47U_cjs.PostgresAuthAdapter({ db: db.client });
+  }
+  if (db instanceof chunkXAEBVZTI_cjs.MongoDBAdapter) {
+    return new chunkXAEBVZTI_cjs.MongoDBAuthAdapter({ db: db.db });
+  }
+  const defaultAuthDbPath = path.resolve(rootDir, "data", "kyro.db");
+  return new chunkRDRJVCL5_cjs.SQLiteAuthAdapter({
+    path: process.env.KYRO_AUTH_DB_PATH || defaultAuthDbPath
+  });
+}
 function createHonoApp(options) {
   const {
     registry,
@@ -3577,10 +3654,7 @@ function createHonoApp(options) {
   apiAccess?.requireAuth;
   const cwd = process.cwd();
   const rootDir = cwd.endsWith("admin") ? path.resolve(cwd, "..") : cwd;
-  const defaultAuthDbPath = path.resolve(rootDir, "data", "kyro.db");
-  const sessionAuthAdapter = authAdapter || new chunkEVEJC22G_cjs.SQLiteAuthAdapter({
-    path: process.env.KYRO_AUTH_DB_PATH || defaultAuthDbPath
-  });
+  const sessionAuthAdapter = authAdapter || createDefaultAuthAdapter(db, rootDir);
   const authMw = authSecret ? createAuthMiddleware({
     db,
     userLookup: async (userId) => {
@@ -4080,7 +4154,9 @@ function createHonoApp(options) {
     }
     if (!mediaService) {
       try {
-        mediaService = await MediaService.init(db);
+        const dialect = db instanceof chunkWVPOPOEQ_cjs.DrizzleAdapter ? db.dialect : "sqlite";
+        const mediaDb = dialect === "postgres" && db instanceof chunkWVPOPOEQ_cjs.DrizzleAdapter ? db.client : db;
+        mediaService = await MediaService.init(mediaDb, { dialect });
       } catch (error) {
         console.error("[getMedia] Init error:", error);
         mediaServiceInitError = error;
@@ -4091,6 +4167,8 @@ function createHonoApp(options) {
   };
   app.get("/api/media", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const page = parseInt(c.req.query("page") || "1");
       const limit = parseInt(c.req.query("limit") || "30");
@@ -4101,11 +4179,13 @@ function createHonoApp(options) {
       return c.json(result);
     } catch (error) {
       console.error("[Media] find error:", error);
-      return c.json({ error: error.message, stack: error.stack }, 500);
+      return c.json({ error: error.message }, 500);
     }
   });
   app.post("/api/media/upload", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const contentType = c.req.header("content-type") || "";
       if (contentType.includes("multipart/form-data")) {
@@ -4127,6 +4207,8 @@ function createHonoApp(options) {
   });
   app.get("/api/media/folders", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const folders = await service.listFolders();
       return c.json(folders);
@@ -4137,6 +4219,8 @@ function createHonoApp(options) {
   });
   app.post("/api/media/folders", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const body = await c.req.json();
       const { name, parentPath } = body;
@@ -4155,6 +4239,8 @@ function createHonoApp(options) {
   });
   app.delete("/api/media/folders", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const path2 = c.req.query("path");
       if (!path2) {
@@ -4169,6 +4255,8 @@ function createHonoApp(options) {
   });
   app.delete("/api/media/:id", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const id = c.req.param("id");
       await service.delete(id);
@@ -4180,6 +4268,8 @@ function createHonoApp(options) {
   });
   app.get("/api/media/resize", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const url = c.req.query("url");
       const w = parseInt(c.req.query("w") || "0");
       const h = parseInt(c.req.query("h") || "0");
@@ -4221,6 +4311,8 @@ function createHonoApp(options) {
   });
   app.get("/api/media/:id", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const id = c.req.param("id");
       const doc = await service.findById(id);
@@ -4233,6 +4325,8 @@ function createHonoApp(options) {
   });
   app.patch("/api/media/:id", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const id = c.req.param("id");
       const body = await c.req.json();
@@ -4248,6 +4342,8 @@ function createHonoApp(options) {
   });
   app.get("/api/media/test", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       return c.json({
         status: service ? "initialized" : "failed",
@@ -4267,6 +4363,8 @@ function createHonoApp(options) {
   });
   app.get("/api/storage-status", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       let configured = false;
       let provider = "local";
       if (db) {
@@ -4309,7 +4407,9 @@ function createHonoApp(options) {
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     });
   });
-  app.get("/api/collections", (c) => {
+  app.get("/api/collections", async (c) => {
+    const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+    if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
     const collections2 = registry.getCollections().map((col) => ({
       slug: col.slug,
       label: col.label || col.slug,
@@ -5530,6 +5630,10 @@ function createHonoApp(options) {
         } catch (zodErr) {
           return c.json({ error: "Validation failed", details: zodErr.errors }, 400);
         }
+        const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["id", "createdAt", "updatedAt", "_status", "_has_draft"]);
+        const userData = Object.fromEntries(
+          Object.entries(validated).filter(([k]) => !SYSTEM_FIELDS.has(k))
+        );
         const collectionSlug = `_globals_${slug}`;
         const originalDoc = await db.findOne({
           collection: collectionSlug,
@@ -5544,8 +5648,7 @@ function createHonoApp(options) {
           await db.createVersion({
             collection: collectionSlug,
             documentId: slug,
-            // Global ID is the slug
-            data: validated,
+            data: userData,
             status: "draft",
             createdBy: ctxUser?.id,
             changeDescription: "Manual save (Draft)",
@@ -5558,7 +5661,7 @@ function createHonoApp(options) {
             tenantID: ctxTenantID
           });
         } else {
-          const saveData = isDraftEnabled ? { ...validated, _status: "draft", _has_draft: false } : { ...validated, _status: "published", _has_draft: false };
+          const saveData = isDraftEnabled ? { ...userData, _status: "draft", _has_draft: false } : { ...userData, _status: "published", _has_draft: false };
           if (originalDoc) {
             doc = await db.update({
               collection: collectionSlug,
@@ -5577,7 +5680,7 @@ function createHonoApp(options) {
             await db.createVersion({
               collection: collectionSlug,
               documentId: slug,
-              data: validated,
+              data: userData,
               status: "draft",
               createdBy: ctxUser?.id,
               changeDescription: "Manual save",
@@ -5764,7 +5867,7 @@ function createHonoApp(options) {
             mailgun: body.mailgun,
             ses: body.ses
           };
-          const transport = new chunkEVEJC22G_cjs.EmailTransport(transportConfig);
+          const transport = new chunkRDRJVCL5_cjs.EmailTransport(transportConfig);
           const recipient = body.testEmail || body.testEmailSection && body.testEmailSection.testEmail;
           if (!recipient) {
             return c.json({ error: "No test recipient email provided" }, 400);
@@ -5838,5 +5941,5 @@ exports.init_secret = init_secret;
 exports.loadSecrets = loadSecrets;
 exports.resolveProvider = resolveProvider;
 exports.setDbAdapter = setDbAdapter;
-//# sourceMappingURL=chunk-SYRDCLH7.cjs.map
-//# sourceMappingURL=chunk-SYRDCLH7.cjs.map
+//# sourceMappingURL=chunk-R2YHJN6W.cjs.map
+//# sourceMappingURL=chunk-R2YHJN6W.cjs.map