@kyro-cms/core 0.5.4 → 0.6.0

package/dist/{chunk-SO25EHOE.js → chunk-AM4JKIPP.js}

@@ -1,9 +1,11 @@
-import { PasswordPolicy, ConfigService, SQLiteAuthAdapter, EmailTransport } from './chunk-WH4Y5MT6.js';
+import { PasswordPolicy, ConfigService, EmailTransport, SQLiteAuthAdapter } from './chunk-TP5YQFIX.js';
 import { createAuditContext } from './chunk-P2YW545G.js';
 import { WEBHOOK_EVENTS, extractApiKeyFromRequest, validateApiKey, createApiKeyContext, API_KEY_COLLECTION, generateApiKey, generateApiKeyPrefix, hasApiKeyPermission } from './chunk-QXIQWPAP.js';
 import { buildGraphQLSchema } from './chunk-REK7AYOC.js';
 import { evaluateAccess } from './chunk-SDMNUYVU.js';
-import { genId } from './chunk-L4E76X2K.js';
+import { genId, DrizzleAdapter } from './chunk-6WXQRYTW.js';
+import { PostgresAuthAdapter } from './chunk-TVVYZ2TH.js';
+import { MongoDBAdapter, MongoDBAuthAdapter } from './chunk-QKVA2SOG.js';
 import { __esm, __export, __toCommonJS, __require } from './chunk-Z6ZWNWWR.js';
 import crypto, { randomBytes, createHash } from 'crypto';
 import { createStorage } from 'unstorage';
@@ -1008,6 +1010,7 @@ var AuthRoutes = class {
         201
       );
     } catch (error) {
+      console.error("[AuthRoutes.register] Registration error:", error);
       return this.errorResponse("Registration failed", 500);
     }
   }
@@ -2659,6 +2662,7 @@ async function processImage(buffer) {
 }
 
 // src/storage/MediaService.ts
+var _mediaTablesEnsured = false;
 var MediaService = class _MediaService {
   db;
   storage;
@@ -2684,46 +2688,84 @@ var MediaService = class _MediaService {
       storage2 = await resolveProvider(configService);
     }
     const service = new _MediaService(db, storage2, options);
-    service.ensureTables();
+    await service.ensureTables();
     return service;
   }
-  ensureTables() {
-    if (this.dialect !== "sqlite") return;
-    this.db.exec(`
-      CREATE TABLE IF NOT EXISTS media (
-        id TEXT PRIMARY KEY,
-        filename TEXT NOT NULL UNIQUE,
-        title TEXT,
-        original_name TEXT NOT NULL,
-        mime_type TEXT NOT NULL,
-        file_size INTEGER NOT NULL,
-        width INTEGER,
-        height INTEGER,
-        url TEXT NOT NULL UNIQUE,
-        thumbnail_url TEXT,
-        folder TEXT,
-        provider TEXT NOT NULL,
-        alt TEXT,
-        caption TEXT,
-        metadata TEXT,
-        created_at TEXT NOT NULL,
-        updated_at TEXT NOT NULL
-      );
-      CREATE INDEX IF NOT EXISTS idx_media_folder ON media(folder);
-      CREATE INDEX IF NOT EXISTS idx_media_provider ON media(provider);
-      CREATE INDEX IF NOT EXISTS idx_media_filename ON media(filename);
-      CREATE INDEX IF NOT EXISTS idx_media_folders_path ON media_folders(path);
-    `);
-    this.db.exec(`
-      CREATE TABLE IF NOT EXISTS media_folders (
-        id TEXT PRIMARY KEY,
-        name TEXT NOT NULL,
-        path TEXT NOT NULL,
-        parent_path TEXT,
-        created_at TEXT
-      );
-      CREATE INDEX IF NOT EXISTS idx_media_folders_path ON media_folders(path);
-    `);
+  async ensureTables() {
+    if (this.dialect === "sqlite") {
+      this.db.exec(`
+        CREATE TABLE IF NOT EXISTS media (
+          id TEXT PRIMARY KEY,
+          filename TEXT NOT NULL UNIQUE,
+          title TEXT,
+          original_name TEXT NOT NULL,
+          mime_type TEXT NOT NULL,
+          file_size INTEGER NOT NULL,
+          width INTEGER,
+          height INTEGER,
+          url TEXT NOT NULL UNIQUE,
+          thumbnail_url TEXT,
+          folder TEXT,
+          provider TEXT NOT NULL,
+          alt TEXT,
+          caption TEXT,
+          metadata TEXT,
+          created_at TEXT NOT NULL,
+          updated_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_media_folder ON media(folder);
+        CREATE INDEX IF NOT EXISTS idx_media_provider ON media(provider);
+        CREATE INDEX IF NOT EXISTS idx_media_filename ON media(filename);
+      `);
+      this.db.exec(`
+        CREATE TABLE IF NOT EXISTS media_folders (
+          id TEXT PRIMARY KEY,
+          name TEXT NOT NULL,
+          path TEXT NOT NULL,
+          parent_path TEXT,
+          created_at TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_media_folders_path ON media_folders(path);
+      `);
+    } else if (this.dialect === "postgres") {
+      if (_mediaTablesEnsured) return;
+      const { sql } = await import('drizzle-orm');
+      await this.db.execute(sql`
+        CREATE TABLE IF NOT EXISTS "media" (
+          "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+          "filename" VARCHAR(255) NOT NULL UNIQUE,
+          "title" VARCHAR(255),
+          "original_name" VARCHAR(255) NOT NULL,
+          "mime_type" VARCHAR(100),
+          "file_size" INTEGER,
+          "width" INTEGER,
+          "height" INTEGER,
+          "url" TEXT NOT NULL UNIQUE,
+          "thumbnail_url" TEXT,
+          "folder" VARCHAR(255),
+          "provider" VARCHAR(50) NOT NULL,
+          "alt" TEXT,
+          "caption" TEXT,
+          "metadata" JSONB,
+          "created_at" TIMESTAMP NOT NULL DEFAULT NOW(),
+          "updated_at" TIMESTAMP NOT NULL DEFAULT NOW()
+        )
+      `);
+      await this.db.execute(sql`CREATE INDEX IF NOT EXISTS "idx_media_folder" ON "media" ("folder")`);
+      await this.db.execute(sql`CREATE INDEX IF NOT EXISTS "idx_media_provider" ON "media" ("provider")`);
+      await this.db.execute(sql`CREATE INDEX IF NOT EXISTS "idx_media_filename" ON "media" ("filename")`);
+      await this.db.execute(sql`
+        CREATE TABLE IF NOT EXISTS "media_folders" (
+          "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+          "name" VARCHAR(255) NOT NULL,
+          "path" TEXT NOT NULL,
+          "parent_path" TEXT,
+          "created_at" TIMESTAMP NOT NULL DEFAULT NOW()
+        )
+      `);
+      await this.db.execute(sql`CREATE INDEX IF NOT EXISTS "idx_media_folders_path" ON "media_folders" ("path")`);
+      _mediaTablesEnsured = true;
+    }
   }
   now() {
     return (/* @__PURE__ */ new Date()).toISOString();
@@ -2844,13 +2886,15 @@ var MediaService = class _MediaService {
         ]
       );
     } else {
-      const { media: mediaSchema } = await import('./media-HOT3O7RW.js');
+      const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+      const mime = storageResult.mimeType;
+      const mediaType = mime.startsWith("image/") ? "image" : mime.startsWith("video/") ? "video" : mime.startsWith("audio/") ? "audio" : mime.startsWith("application/pdf") ? "document" : ["application/zip", "application/x-zip", "application/x-tar", "application/gzip", "application/x-7z"].includes(mime) ? "archive" : "other";
       await this.db.insert(mediaSchema).values({
         id,
         filename: storageResult.filename,
         title: file.name.replace(/\.[^/.]+$/, ""),
         originalName: file.name,
-        mimeType: storageResult.mimeType,
+        mimeType: mime,
         fileSize: storageResult.size,
         width,
         height,
@@ -2858,6 +2902,10 @@ var MediaService = class _MediaService {
         thumbnailUrl,
         folder: folder || "",
         provider: this.storage.name,
+        type: mediaType,
+        status: "active",
+        alt: null,
+        caption: null,
         createdAt: /* @__PURE__ */ new Date(),
         updatedAt: /* @__PURE__ */ new Date()
       }).returning();
@@ -2900,8 +2948,9 @@ var MediaService = class _MediaService {
         id
       ]);
     } else {
-      const { media: mediaSchema } = await import('./media-HOT3O7RW.js');
-      const [row] = await this.db.select().from(mediaSchema).where(mediaSchema.id.equals(id));
+      const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+      const { eq } = await import('drizzle-orm');
+      const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
       if (row) item = this.rowToMedia(row);
     }
     if (!item) return;
@@ -2915,8 +2964,9 @@ var MediaService = class _MediaService {
     if (this.dialect === "sqlite") {
       await this.sqliteRun(`DELETE FROM ${this.mediaTable} WHERE id = ?`, [id]);
     } else {
-      const { media: mediaSchema } = await import('./media-HOT3O7RW.js');
-      await this.db.delete(mediaSchema).where(mediaSchema.id.equals(id));
+      const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+      const { eq } = await import('drizzle-orm');
+      await this.db.delete(mediaSchema).where(eq(mediaSchema.id, id));
     }
   }
   async deleteFile(url) {
@@ -2929,8 +2979,9 @@ var MediaService = class _MediaService {
         id
       ]);
     } else {
-      const { media: mediaSchema } = await import('./media-HOT3O7RW.js');
-      const [row] = await this.db.select().from(mediaSchema).where(mediaSchema.id.equals(id));
+      const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+      const { eq } = await import('drizzle-orm');
+      const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
       if (row) item = this.rowToMedia(row);
     }
     if (!item) return null;
@@ -2963,8 +3014,9 @@ var MediaService = class _MediaService {
         [...vals, this.now(), id]
       );
     } else {
-      const { media: mediaSchema } = await import('./media-HOT3O7RW.js');
-      await this.db.update(mediaSchema).set({ ...updateData, updatedAt: this.now() }).where(mediaSchema.id.equals(id));
+      const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+      const { eq } = await import('drizzle-orm');
+      await this.db.update(mediaSchema).set({ ...updateData, updatedAt: this.now() }).where(eq(mediaSchema.id, id));
     }
     return {
       ...item,
@@ -2981,8 +3033,9 @@ var MediaService = class _MediaService {
       );
       return row2 ? this.rowToMedia(row2) : null;
     }
-    const { media: mediaSchema } = await import('./media-HOT3O7RW.js');
-    const [row] = await this.db.select().from(mediaSchema).where(mediaSchema.id.equals(id));
+    const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+    const { eq } = await import('drizzle-orm');
+    const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
     return row ? this.rowToMedia(row) : null;
   }
   async find(params = {}) {
@@ -3028,8 +3081,8 @@ var MediaService = class _MediaService {
         totalPages: Math.ceil(totalDocs2 / limit)
       };
     }
-    const { media: mediaSchema } = await import('./media-HOT3O7RW.js');
-    const { like, or, and, asc, desc, eq, sql } = await import('drizzle-orm/pg-core');
+    const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+    const { like, or, and, asc, desc, eq, sql } = await import('drizzle-orm');
     const conditions = [];
     if (search) {
       conditions.push(
@@ -3053,7 +3106,17 @@ var MediaService = class _MediaService {
       );
     }
     const whereClause = conditions.length > 0 ? and(...conditions) : void 0;
-    const order = sortDir === "asc" ? asc(mediaSchema[sortCol]) : desc(mediaSchema[sortCol]);
+    const sortKey = {
+      created_at: "createdAt",
+      updated_at: "updatedAt",
+      title: "title",
+      filename: "filename",
+      file_size: "fileSize",
+      mime_type: "mimeType",
+      original_name: "originalName"
+    };
+    const col = mediaSchema[sortKey[sortCol] || "createdAt"];
+    const order = sortDir === "asc" ? asc(col) : desc(col);
     const docs = await this.db.select().from(mediaSchema).where(whereClause).orderBy(order).limit(limit).offset(offset);
     const [{ count }] = await this.db.select({ count: sql`count(*)` }).from(mediaSchema).where(whereClause);
     const totalDocs = Number(count);
@@ -3097,8 +3160,9 @@ var MediaService = class _MediaService {
       );
       return row ? this.rowToMedia(row) : null;
     }
-    const { media: mediaSchema } = await import('./media-HOT3O7RW.js');
-    const [updated] = await this.db.update(mediaSchema).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(mediaSchema.id.equals(id)).returning();
+    const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+    const { eq } = await import('drizzle-orm');
+    const [updated] = await this.db.update(mediaSchema).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq(mediaSchema.id, id)).returning();
     return updated ? this.rowToMedia(updated) : null;
   }
   async updateMany(ids, data) {
@@ -3118,9 +3182,10 @@ var MediaService = class _MediaService {
         );
       }
     } else {
-      const { media: mediaSchema } = await import('./media-HOT3O7RW.js');
+      const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+      const { eq } = await import('drizzle-orm');
       for (const id of ids) {
-        await this.db.update(mediaSchema).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(mediaSchema.id.equals(id));
+        await this.db.update(mediaSchema).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq(mediaSchema.id, id));
       }
     }
   }
@@ -3132,8 +3197,8 @@ var MediaService = class _MediaService {
       );
       return rows.map((r) => r.path).filter((f) => f && f !== "").sort();
     }
-    const { media: mediaSchema, mediaFolders: folderSchema } = await import('./media-HOT3O7RW.js');
-    const { eq, sql } = await import('drizzle-orm/pg-core');
+    const { media: mediaSchema, mediaFolders: folderSchema } = await import('./media-GPPTZ43E.js');
+    const { eq, sql } = await import('drizzle-orm');
     const fromMedia = await this.db.select({ folder: mediaSchema.folder }).from(mediaSchema).groupBy(mediaSchema.folder);
     const fromFolders = await this.db.select({ path: folderSchema.path }).from(folderSchema);
     const allPaths = /* @__PURE__ */ new Set([
@@ -3152,7 +3217,7 @@ var MediaService = class _MediaService {
         [fullPath, name, parentPath || null, now]
       );
     } else {
-      const { mediaFolders: folderSchema } = await import('./media-HOT3O7RW.js');
+      const { mediaFolders: folderSchema } = await import('./media-GPPTZ43E.js');
       await this.db.insert(folderSchema).values({
         path: fullPath,
         name,
@@ -3173,8 +3238,8 @@ var MediaService = class _MediaService {
         [folder, `${folder}/%`]
       );
     } else {
-      const { mediaFolders: folderSchema } = await import('./media-HOT3O7RW.js');
-      const { like, or, eq } = await import('./media-HOT3O7RW.js');
+      const { mediaFolders: folderSchema } = await import('./media-GPPTZ43E.js');
+      const { like, or, eq } = await import('drizzle-orm');
       await this.db.delete(folderSchema).where(
         or(
           eq(folderSchema.path, folder),
@@ -3542,6 +3607,18 @@ async function resolveAuthContext(req, authMw, staticUser, staticTenantID) {
     authType: result.authType
   };
 }
+function createDefaultAuthAdapter(db, rootDir) {
+  if (db instanceof DrizzleAdapter && db.dialect === "postgres") {
+    return new PostgresAuthAdapter({ db: db.client });
+  }
+  if (db instanceof MongoDBAdapter) {
+    return new MongoDBAuthAdapter({ db: db.db });
+  }
+  const defaultAuthDbPath = resolve(rootDir, "data", "kyro.db");
+  return new SQLiteAuthAdapter({
+    path: process.env.KYRO_AUTH_DB_PATH || defaultAuthDbPath
+  });
+}
 function createHonoApp(options) {
   const {
     registry,
@@ -3568,10 +3645,7 @@ function createHonoApp(options) {
   apiAccess?.requireAuth;
   const cwd = process.cwd();
   const rootDir = cwd.endsWith("admin") ? resolve(cwd, "..") : cwd;
-  const defaultAuthDbPath = resolve(rootDir, "data", "kyro.db");
-  const sessionAuthAdapter = authAdapter || new SQLiteAuthAdapter({
-    path: process.env.KYRO_AUTH_DB_PATH || defaultAuthDbPath
-  });
+  const sessionAuthAdapter = authAdapter || createDefaultAuthAdapter(db, rootDir);
   const authMw = authSecret ? createAuthMiddleware({
     db,
     userLookup: async (userId) => {
@@ -4071,7 +4145,9 @@ function createHonoApp(options) {
     }
     if (!mediaService) {
       try {
-        mediaService = await MediaService.init(db);
+        const dialect = db instanceof DrizzleAdapter ? db.dialect : "sqlite";
+        const mediaDb = dialect === "postgres" && db instanceof DrizzleAdapter ? db.client : db;
+        mediaService = await MediaService.init(mediaDb, { dialect });
       } catch (error) {
         console.error("[getMedia] Init error:", error);
         mediaServiceInitError = error;
@@ -4082,6 +4158,8 @@ function createHonoApp(options) {
   };
   app.get("/api/media", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const page = parseInt(c.req.query("page") || "1");
       const limit = parseInt(c.req.query("limit") || "30");
@@ -4092,11 +4170,13 @@ function createHonoApp(options) {
       return c.json(result);
     } catch (error) {
       console.error("[Media] find error:", error);
-      return c.json({ error: error.message, stack: error.stack }, 500);
+      return c.json({ error: error.message }, 500);
     }
   });
   app.post("/api/media/upload", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const contentType = c.req.header("content-type") || "";
       if (contentType.includes("multipart/form-data")) {
@@ -4118,6 +4198,8 @@ function createHonoApp(options) {
   });
   app.get("/api/media/folders", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const folders = await service.listFolders();
       return c.json(folders);
@@ -4128,6 +4210,8 @@ function createHonoApp(options) {
   });
   app.post("/api/media/folders", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const body = await c.req.json();
       const { name, parentPath } = body;
@@ -4146,6 +4230,8 @@ function createHonoApp(options) {
   });
   app.delete("/api/media/folders", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const path2 = c.req.query("path");
       if (!path2) {
@@ -4160,6 +4246,8 @@ function createHonoApp(options) {
   });
   app.delete("/api/media/:id", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const id = c.req.param("id");
       await service.delete(id);
@@ -4171,6 +4259,8 @@ function createHonoApp(options) {
   });
   app.get("/api/media/resize", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const url = c.req.query("url");
       const w = parseInt(c.req.query("w") || "0");
       const h = parseInt(c.req.query("h") || "0");
@@ -4212,6 +4302,8 @@ function createHonoApp(options) {
   });
   app.get("/api/media/:id", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const id = c.req.param("id");
       const doc = await service.findById(id);
@@ -4224,6 +4316,8 @@ function createHonoApp(options) {
   });
   app.patch("/api/media/:id", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       const id = c.req.param("id");
       const body = await c.req.json();
@@ -4239,6 +4333,8 @@ function createHonoApp(options) {
   });
   app.get("/api/media/test", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       const service = await getMedia();
       return c.json({
         status: service ? "initialized" : "failed",
@@ -4258,6 +4354,8 @@ function createHonoApp(options) {
   });
   app.get("/api/storage-status", async (c) => {
     try {
+      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
       let configured = false;
       let provider = "local";
       if (db) {
@@ -4300,7 +4398,9 @@ function createHonoApp(options) {
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     });
   });
-  app.get("/api/collections", (c) => {
+  app.get("/api/collections", async (c) => {
+    const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+    if (!ctxUser) return c.json({ error: "Authentication required" }, 401);
     const collections2 = registry.getCollections().map((col) => ({
       slug: col.slug,
       label: col.label || col.slug,
@@ -5521,6 +5621,10 @@ function createHonoApp(options) {
         } catch (zodErr) {
           return c.json({ error: "Validation failed", details: zodErr.errors }, 400);
         }
+        const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["id", "createdAt", "updatedAt", "_status", "_has_draft"]);
+        const userData = Object.fromEntries(
+          Object.entries(validated).filter(([k]) => !SYSTEM_FIELDS.has(k))
+        );
         const collectionSlug = `_globals_${slug}`;
         const originalDoc = await db.findOne({
           collection: collectionSlug,
@@ -5535,8 +5639,7 @@ function createHonoApp(options) {
           await db.createVersion({
             collection: collectionSlug,
             documentId: slug,
-            // Global ID is the slug
-            data: validated,
+            data: userData,
             status: "draft",
             createdBy: ctxUser?.id,
             changeDescription: "Manual save (Draft)",
@@ -5549,7 +5652,7 @@ function createHonoApp(options) {
             tenantID: ctxTenantID
           });
         } else {
-          const saveData = isDraftEnabled ? { ...validated, _status: "draft", _has_draft: false } : { ...validated, _status: "published", _has_draft: false };
+          const saveData = isDraftEnabled ? { ...userData, _status: "draft", _has_draft: false } : { ...userData, _status: "published", _has_draft: false };
           if (originalDoc) {
             doc = await db.update({
               collection: collectionSlug,
@@ -5568,7 +5671,7 @@ function createHonoApp(options) {
             await db.createVersion({
               collection: collectionSlug,
               documentId: slug,
-              data: validated,
+              data: userData,
               status: "draft",
               createdBy: ctxUser?.id,
               changeDescription: "Manual save",
@@ -5814,5 +5917,5 @@ function createRESTAPI(registry, db, options) {
 }
 
 export { AuditLogger, AuthRoutes, InMemoryAuditLogger, InMemoryRateLimiter, MediaService, createAuditContext2 as createAuditContext, createHonoApp, createLocalStorage, createRESTAPI, getAppSecret, getEncryptionKey, getSessionConfig, init_secret, loadSecrets, resolveProvider, setDbAdapter };
-//# sourceMappingURL=chunk-SO25EHOE.js.map
-//# sourceMappingURL=chunk-SO25EHOE.js.map
+//# sourceMappingURL=chunk-AM4JKIPP.js.map
+//# sourceMappingURL=chunk-AM4JKIPP.js.map