@kyro-cms/core 0.8.0 → 0.9.1

package/dist/{chunk-35U3FROB.js → chunk-22M4O4ZJ.js}

@@ -1,10 +1,13 @@
-import { createKyroServer } from './chunk-3AJE4SEG.js';
-import { createHonoApp } from './chunk-HXRD4B37.js';
-import { createWebhookService, API_KEY_COLLECTION, WEBHOOK_COLLECTION, WEBHOOK_DELIVERY_COLLECTION } from './chunk-QXIQWPAP.js';
-import { buildGraphQLSchema } from './chunk-REK7AYOC.js';
+import { createStorageSettingsGlobal } from './chunk-GAOXD3XT.js';
+import { createContext, createKyroServer } from './chunk-KPA4AN4R.js';
+import { buildGraphQLSchema } from './chunk-L5UKKZQN.js';
+import { getDefaultRegistry, createHonoApp, createS3Storage, createCloudinaryStorage, createFtpStorage } from './chunk-PU2Z5VWF.js';
+import { createWebhookService, WEBHOOK_COLLECTION, WEBHOOK_DELIVERY_COLLECTION } from './chunk-3UK5XBVJ.js';
+import { API_KEY_COLLECTION, extractApiKeyFromRequest, validateApiKey, createApiKeyContext } from './chunk-CJONKRHJ.js';
 import { KyroPubSub, createWSServer } from './chunk-3TPQ2BU6.js';
-import { AbstractBaseAdapter, applyRLS, DEFAULT_RLS_CONFIG, canAccessDocument } from './chunk-3ZFYL34R.js';
+import { AbstractBaseAdapter, applyRLS, DEFAULT_RLS_CONFIG, canAccessDocument } from './chunk-DYTZ6FQ7.js';
 import { z } from 'zod';
+import { parse, execute } from 'graphql';
 import { createRequire } from 'module';
 import { randomBytes } from 'crypto';
 
@@ -174,9 +177,9 @@ function validateFields(fields, context) {
         break;
       case "select":
       case "radio":
-        if (!field.options || field.options.length === 0) {
+        if ((!field.options || field.options.length === 0) && !field.dynamicOptions) {
           errors.push(`${context}: ${field.type} field "${fieldName}" has no options defined`);
-        } else {
+        } else if (field.options) {
           const values = field.options.map((o) => o.value);
           const uniqueValues = new Set(values);
           if (values.length !== uniqueValues.size) {
@@ -265,7 +268,7 @@ function validateRelationships(fields, collections) {
       const targets = Array.isArray(field.relationTo) ? field.relationTo : [field.relationTo];
       for (const target of targets) {
         if (!collectionSlugs.has(target)) {
-          errors.push(`Relationship field "${field.name}" references unknown collection "${target}"`);
+          console.warn(`[Kyro Config Warning]: Relationship field "${field.name}" references unknown collection "${target}". Select options will not be available until this collection is registered.`);
         }
       }
     }
@@ -365,7 +368,7 @@ function textToZod(field) {
   return schema;
 }
 function numberToZod(field) {
-  let schema = field.integer ? z.number().int() : z.number();
+  let schema = field.integer ? z.coerce.number().int() : z.coerce.number();
   if (field.min !== void 0) schema = schema.min(field.min);
   if (field.max !== void 0) schema = schema.max(field.max);
   if (field.step) {
@@ -424,12 +427,16 @@ function textareaToZod(field) {
   return schema;
 }
 function selectToZod(field) {
-  const values = field.options.map((opt) => opt.value);
   let schema;
-  if (field.hasMany) {
-    schema = z.array(z.enum(values));
+  if (field.options && field.options.length > 0) {
+    const values = field.options.map((opt) => opt.value);
+    if (field.hasMany) {
+      schema = z.array(z.enum(values));
+    } else {
+      schema = z.enum(values);
+    }
   } else {
-    schema = z.enum(values);
+    schema = field.hasMany ? z.array(z.string()) : z.string();
   }
   if (!field.required) schema = schema.optional().nullable();
   if (field.validate) schema = addCustomValidation(schema, field.validate);
@@ -459,10 +466,7 @@ function colorToZod(field) {
   return schema;
 }
 function richTextToZod(field) {
-  let schema = z.union([
-    z.array(z.record(z.any())),
-    z.string()
-  ]);
+  let schema = z.array(z.record(z.any()));
   if (!field.required) schema = schema.optional().nullable();
   if (field.validate) schema = addCustomValidation(schema, field.validate);
   return schema;
@@ -573,9 +577,9 @@ function blocksToZod(field) {
     const unknownSchema = z.object({
       blockType: z.string()
     }).catchall(z.any());
-    schema = z.array(z.union([knownSchema, unknownSchema]));
+    schema = z.array(z.union([knownSchema, unknownSchema, z.record(z.any())]));
   } else {
-    schema = z.array(z.object({ blockType: z.string() }).catchall(z.any()));
+    schema = z.array(z.union([z.object({ blockType: z.string() }).catchall(z.any()), z.record(z.any())]));
   }
   if (field.minRows) schema = schema.min(field.minRows);
   if (field.maxRows) schema = schema.max(field.maxRows);
@@ -721,6 +725,7 @@ function globalToZod(global) {
 
 // src/registry/index.ts
 var Registry = class {
+  storageProviders = getDefaultRegistry();
   collections = /* @__PURE__ */ new Map();
   globals = /* @__PURE__ */ new Map();
   plugins = [];
@@ -788,6 +793,19 @@ var Registry = class {
     if (this.initialized) {
       throw new Error("Cannot add globals after Registry has been initialized");
     }
+    this._addGlobalUnsafe(config);
+  }
+  /**
+   * Add a global after the registry is already initialized.
+   * Only for internal use (e.g. storage settings form built at startup).
+   */
+  addGlobalPostInit(config) {
+    if (this.globals.has(config.slug)) {
+      this.globals.delete(config.slug);
+    }
+    this._addGlobalUnsafe(config);
+  }
+  _addGlobalUnsafe(config) {
     if (this.globals.has(config.slug)) {
       console.warn(
         `[Registry] Duplicate global slug "${config.slug}" \u2014 skipping`
@@ -942,6 +960,17 @@ var Registry = class {
         admin: { readOnly: true, hidden: true }
       });
     }
+    if (config.versions?.drafts && !fields.some((f) => f.name === "publishStatus")) {
+      fields.push({
+        name: "publishStatus",
+        type: "select",
+        options: [
+          { value: "draft", label: "Draft" },
+          { value: "published", label: "Published" }
+        ],
+        admin: { readOnly: true, hidden: true }
+      });
+    }
     if (config.auth && !fields.some((f) => f.name === "password")) {
       fields.push({
         name: "password",
@@ -1086,6 +1115,296 @@ function createRegistry() {
   instance = new Registry();
   return instance;
 }
+
+// src/plugins/storage-s3.ts
+var s3Variants = {
+  aws: {
+    type: "aws",
+    configKey: "s3",
+    displayName: "S3 Compatible (AWS, Backblaze, Wasabi, etc.)",
+    configFields: [
+      { name: "bucket", type: "text", label: "Bucket Name", required: true },
+      { name: "region", type: "text", label: "Region", defaultValue: "us-east-1", admin: { placeholder: "us-east-1" } },
+      { name: "accessKeyId", type: "text", label: "Access Key ID", required: true },
+      { name: "secretAccessKey", type: "password", label: "Secret Access Key", required: true },
+      { name: "endpoint", type: "text", label: "Endpoint URL", admin: { placeholder: "https://s3.custom.com" } },
+      { name: "cdnUrl", type: "text", label: "CDN URL", admin: { placeholder: "https://cdn.example.com" } },
+      { name: "prefix", type: "text", label: "Path Prefix", admin: { placeholder: "uploads" } }
+    ]
+  },
+  r2: {
+    type: "r2",
+    configKey: "r2",
+    displayName: "Cloudflare R2",
+    configFields: [
+      { name: "accountId", type: "text", label: "Account ID", required: true, admin: { placeholder: "Your Cloudflare Account ID" } },
+      { name: "accessKeyId", type: "text", label: "Access Key ID", required: true },
+      { name: "secretAccessKey", type: "password", label: "Secret Access Key", required: true },
+      { name: "bucket", type: "text", label: "Bucket Name", required: true },
+      {
+        name: "publicDevUrl",
+        type: "text",
+        label: "Public Dev URL ID",
+        admin: {
+          placeholder: "pub-xxxxxxxxxxxxxxxx",
+          description: "Enter ONLY the ID (e.g., pub-b8d8c4cc8bcf4d868ddd95efc1b305aa). Do NOT include https:// or the full URL. Found in R2 Dashboard \u2192 Public Dev URL."
+        }
+      },
+      { name: "cdnUrl", type: "text", label: "Custom CDN URL", admin: { placeholder: "https://assets.example.com (optional)" } },
+      { name: "prefix", type: "text", label: "Path Prefix", admin: { placeholder: "uploads (optional)", description: "Optional prefix for all object keys. Do not use '/' as prefix." } }
+    ]
+  },
+  gcs: {
+    type: "gcs",
+    configKey: "gcs",
+    displayName: "Google Cloud Storage",
+    configFields: [
+      { name: "bucket", type: "text", label: "Bucket Name", required: true },
+      { name: "projectId", type: "text", label: "Project ID" },
+      { name: "clientEmail", type: "text", label: "Client Email" },
+      { name: "privateKey", type: "password", label: "Private Key" },
+      { name: "cdnUrl", type: "text", label: "CDN URL" },
+      { name: "prefix", type: "text", label: "Path Prefix" }
+    ]
+  },
+  digitalocean: {
+    type: "digitalocean",
+    configKey: "digitalocean",
+    displayName: "DigitalOcean Spaces",
+    configFields: [
+      { name: "bucket", type: "text", label: "Bucket Name", required: true },
+      { name: "region", type: "text", label: "Region", defaultValue: "nyc3" },
+      { name: "accessKeyId", type: "text", label: "Access Key ID", required: true },
+      { name: "secretAccessKey", type: "password", label: "Secret Access Key", required: true },
+      { name: "cdnUrl", type: "text", label: "CDN URL" },
+      { name: "prefix", type: "text", label: "Path Prefix" }
+    ]
+  },
+  backblaze: {
+    type: "backblaze",
+    configKey: "backblaze",
+    displayName: "Backblaze B2",
+    configFields: [
+      { name: "bucket", type: "text", label: "Bucket Name", required: true },
+      { name: "accountId", type: "text", label: "Account ID" },
+      { name: "applicationKeyId", type: "text", label: "Application Key ID", required: true },
+      { name: "applicationKey", type: "password", label: "Application Key", required: true },
+      { name: "cdnUrl", type: "text", label: "CDN URL" },
+      { name: "prefix", type: "text", label: "Path Prefix" }
+    ]
+  },
+  wasabi: {
+    type: "wasabi",
+    configKey: "wasabi",
+    displayName: "Wasabi",
+    configFields: [
+      { name: "bucket", type: "text", label: "Bucket Name", required: true },
+      { name: "region", type: "text", label: "Region", defaultValue: "us-east-1" },
+      { name: "accessKeyId", type: "text", label: "Access Key ID", required: true },
+      { name: "secretAccessKey", type: "password", label: "Secret Access Key", required: true },
+      { name: "cdnUrl", type: "text", label: "CDN URL" },
+      { name: "prefix", type: "text", label: "Path Prefix" }
+    ]
+  }
+};
+function getEndpoint(type, config) {
+  switch (type) {
+    case "r2":
+      return config?.endpoint || `https://${config?.accountId || ""}.r2.cloudflarestorage.com`;
+    case "digitalocean":
+      return config?.endpoint || `https://${config?.region || "nyc3"}.digitaloceanspaces.com`;
+    case "backblaze":
+      return config?.endpoint || `https://s3.backblazeb2.com`;
+    case "wasabi":
+      return config?.endpoint || `https://s3.${config?.region || "us-east-1"}.wasabisys.com`;
+    default:
+      return config?.endpoint;
+  }
+}
+function buildS3Config(type, c) {
+  return {
+    provider: type,
+    bucket: c?.bucket || "",
+    region: c?.region || "us-east-1",
+    accessKeyId: c?.accessKeyId || c?.clientEmail || c?.applicationKeyId || "",
+    secretAccessKey: c?.secretAccessKey || c?.privateKey || c?.applicationKey || "",
+    endpoint: getEndpoint(type, c),
+    cdnUrl: c?.cdnUrl,
+    prefix: c?.prefix,
+    accountId: c?.accountId,
+    publicDevUrl: c?.publicDevUrl
+  };
+}
+function buildS3ConfigFromStorageConfig(type, def, sc) {
+  const c = sc[def.configKey] || {};
+  return buildS3Config(type, c);
+}
+function buildS3ConfigFromRaw(type, def, raw) {
+  const c = raw?.[def.configKey] || raw;
+  return buildS3Config(type, c);
+}
+var s3StoragePlugin = {
+  name: "@kyro-cms/storage-s3",
+  version: "1.0.0",
+  description: "S3-compatible storage (AWS R2 GCS DigitalOcean Backblaze Wasabi)",
+  init: (kyro) => {
+    const registry = kyro.storageProviders;
+    if (!registry) return;
+    const pluginName = "@kyro-cms/storage-s3";
+    for (const v of Object.values(s3Variants)) {
+      registry.register({
+        type: v.type,
+        displayName: v.displayName,
+        pluginName,
+        configKey: v.configKey,
+        configFields: v.configFields,
+        extractConfig: (sc) => buildS3ConfigFromStorageConfig(v.type, v, sc),
+        extractRawConfig: (raw) => buildS3ConfigFromRaw(v.type, v, raw),
+        factory: (c) => createS3Storage(c)
+      });
+    }
+  }
+};
+
+// src/plugins/storage-cloudinary.ts
+var cloudinaryStoragePlugin = {
+  name: "@kyro-cms/storage-cloudinary",
+  version: "1.0.0",
+  description: "Cloudinary image and video storage",
+  init: (kyro) => {
+    const registry = kyro.storageProviders;
+    if (!registry) return;
+    registry.register({
+      type: "cloudinary",
+      displayName: "Cloudinary",
+      pluginName: "@kyro-cms/storage-cloudinary",
+      configKey: "cloudinary",
+      configFields: [
+        { name: "cloudName", type: "text", label: "Cloud Name", required: true },
+        { name: "apiKey", type: "text", label: "API Key", required: true },
+        { name: "apiSecret", type: "password", label: "API Secret", required: true },
+        { name: "folder", type: "text", label: "Folder", admin: { placeholder: "Optional folder path" } },
+        {
+          name: "uploadPreset",
+          type: "text",
+          label: "Upload Preset (optional)",
+          admin: { placeholder: "Leave empty for signed uploads", description: "If not set, uploads will be signed with API Secret" }
+        }
+      ],
+      extractConfig: (sc) => ({
+        cloudName: sc.cloudinary?.cloudName || "",
+        apiKey: sc.cloudinary?.apiKey || "",
+        apiSecret: sc.cloudinary?.apiSecret || "",
+        folder: sc.cloudinary?.folder,
+        uploadPreset: sc.cloudinary?.uploadPreset
+      }),
+      extractRawConfig: (c) => {
+        const cl = c?.cloudinary || c;
+        return {
+          cloudName: cl?.cloudName || "",
+          apiKey: cl?.apiKey || "",
+          apiSecret: cl?.apiSecret || "",
+          folder: cl?.folder,
+          uploadPreset: cl?.uploadPreset
+        };
+      },
+      factory: (c) => createCloudinaryStorage(c)
+    });
+  }
+};
+
+// src/plugins/storage-ftp.ts
+var ftpStoragePlugin = {
+  name: "@kyro-cms/storage-ftp",
+  version: "1.0.0",
+  description: "FTP/SFTP storage provider",
+  init: (kyro) => {
+    const registry = kyro.storageProviders;
+    if (!registry) return;
+    registry.register({
+      type: "ftp",
+      displayName: "FTP",
+      pluginName: "@kyro-cms/storage-ftp",
+      configKey: "ftp",
+      configFields: [
+        { name: "host", type: "text", label: "Host", required: true, admin: { placeholder: "ftp.example.com" } },
+        { name: "port", type: "number", label: "Port", defaultValue: 21, admin: { placeholder: "21 for FTP" } },
+        { name: "user", type: "text", label: "Username", required: true },
+        { name: "password", type: "password", label: "Password", required: true },
+        { name: "secure", type: "checkbox", label: "Use TLS/SSL", defaultValue: false, admin: { description: "Enable TLS/SSL for secure connections (FTP only)" } },
+        { name: "baseUrl", type: "text", label: "Base URL", required: true, admin: { placeholder: "https://files.example.com" } },
+        { name: "prefix", type: "text", label: "Path Prefix", admin: { placeholder: "uploads" } }
+      ],
+      extractConfig: (sc) => ({
+        host: sc.ftp?.host || "",
+        port: sc.ftp?.port || 21,
+        user: sc.ftp?.user || "",
+        password: sc.ftp?.password || "",
+        secure: sc.ftp?.secure || false,
+        baseUrl: sc.ftp?.baseUrl || "",
+        prefix: sc.ftp?.prefix,
+        type: "ftp"
+      }),
+      extractRawConfig: (c) => {
+        const ftp = c?.ftp || c;
+        return {
+          host: ftp?.host || "",
+          port: ftp?.port || 21,
+          user: ftp?.user || "",
+          password: ftp?.password || "",
+          secure: ftp?.secure || false,
+          baseUrl: ftp?.baseUrl || "",
+          prefix: ftp?.prefix,
+          type: "ftp"
+        };
+      },
+      factory: (c) => createFtpStorage(c)
+    });
+  }
+};
+var builtinStoragePlugins = [
+  s3StoragePlugin,
+  cloudinaryStoragePlugin,
+  ftpStoragePlugin
+];
+function updateFieldByPath(fields, path, updates) {
+  const parts = path.split(".");
+  if (parts.length === 0) return false;
+  const currentPart = parts[0];
+  const remainingPath = parts.slice(1).join(".");
+  for (const field of fields) {
+    if (field.name === currentPart) {
+      if (remainingPath) {
+        if (field.fields && Array.isArray(field.fields)) {
+          return updateFieldByPath(field.fields, remainingPath, updates);
+        }
+        if (field.type === "array" && field.fields && Array.isArray(field.fields)) {
+          return updateFieldByPath(field.fields, remainingPath, updates);
+        }
+        return false;
+      } else {
+        Object.assign(field, updates);
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function applyCollectionOverrides(collections, overrides) {
+  if (!overrides) return;
+  for (const col of collections) {
+    const override = overrides[col.slug];
+    if (override) {
+      const { fields: fieldOverrides, ...adminOverrides } = override;
+      col.admin = { ...col.admin, ...adminOverrides };
+      if (fieldOverrides && col.fields && Array.isArray(col.fields)) {
+        for (const [fieldPath, fieldUpdates] of Object.entries(fieldOverrides)) {
+          updateFieldByPath(col.fields, fieldPath, fieldUpdates);
+        }
+      }
+    }
+  }
+}
 var Kyro = class {
   registry;
   db;
@@ -1100,12 +1419,18 @@ var Kyro = class {
     this.db = config.adapter;
     this.pubsub = new KyroPubSub(this.registry);
     this.webhookService = createWebhookService(this.db);
+    if (config.collections && config.admin?.collectionOverrides) {
+      applyCollectionOverrides(config.collections, config.admin.collectionOverrides);
+    }
     if (config.collections) {
       this.registry.addCollections(config.collections);
     }
     if (config.globals) {
       this.registry.addGlobals(config.globals);
     }
+    for (const plugin of builtinStoragePlugins) {
+      this.registry.addPlugin(plugin);
+    }
     if (config.plugins) {
       for (const plugin of config.plugins) {
         this.registry.addPlugin(plugin);
@@ -1114,6 +1439,17 @@ var Kyro = class {
   }
   async init() {
     await this.registry.init();
+    const storageGlobal = createStorageSettingsGlobal(
+      this.registry.storageProviders,
+      (name) => this.registry.storageProviders.isPluginEnabled(name)
+    );
+    this.registry.addGlobalPostInit(storageGlobal);
+    const pluginSettingsGlobal = {
+      slug: "plugin-settings",
+      admin: { hidden: true },
+      fields: [{ name: "states", type: "json" }]
+    };
+    this.registry.addGlobalPostInit(pluginSettingsGlobal);
     if (!this.db) {
       throw new Error(
         `Database adapter is null \u2014 failed to load at startup. Check the server console for the exact error.`
@@ -1160,6 +1496,7 @@ var Kyro = class {
         { name: "nextRetryAt", type: "date" }
       ]
     };
+    const allGlobals = this.registry.getGlobals();
     await this.db.init(
       [
         ...this.registry.getCollections(),
@@ -1167,12 +1504,13 @@ var Kyro = class {
         webhookCollection,
         webhookDeliveryCollection
       ],
-      this.registry.getGlobals()
+      allGlobals
     );
+    await this.loadPluginState();
     this.pubsub.autoRegisterHooks();
     console.log("\u2705 Kyro CMS initialized");
     console.log(`   Collections: ${this.registry.getCollections().length}`);
-    console.log(`   Globals: ${this.registry.getGlobals().length}`);
+    console.log(`   Globals: ${allGlobals.length}`);
   }
   // ============================================================================
   // API Methods
@@ -1181,18 +1519,38 @@ var Kyro = class {
   async loadSettings() {
     if (this.settings) return this.settings;
     try {
-      const accessSettings = await this.db.findOne({
-        collection: "_globals",
-        where: { slug: "access-settings" }
+      const doc = await this.db.findOne({
+        collection: "_globals_access-settings",
+        where: {}
       });
-      if (accessSettings) {
-        this.settings = accessSettings.data;
+      if (doc) {
+        this.settings = { access: doc };
       }
     } catch (e) {
       console.log("\u26A0\uFE0F No access-settings found, using defaults");
     }
     return this.settings || {};
   }
+  async loadPluginState() {
+    const storageRegistry = this.registry.storageProviders;
+    const pluginNames = storageRegistry.getAllPluginNames();
+    let pluginStates = {};
+    try {
+      const doc = await this.db.findOne({
+        collection: "_globals_plugin-settings",
+        where: {}
+      });
+      if (doc && doc.states) {
+        pluginStates = doc.states;
+      }
+    } catch (e) {
+    }
+    for (const name of pluginNames) {
+      if (pluginStates[name] !== void 0) {
+        storageRegistry.setPluginEnabled(name, pluginStates[name]);
+      }
+    }
+  }
   getREST(options) {
     const authObj = typeof this.config.auth === "object" ? this.config.auth : null;
     const authSecret = authObj?.secret;
@@ -1210,33 +1568,196 @@ var Kyro = class {
     });
   }
   getGraphQL(options) {
-    return buildGraphQLSchema({
+    const defaultSchema = buildGraphQLSchema({
       registry: this.registry,
       db: this.db,
-      ...options,
-      settings: this.settings
+      settings: this.settings,
+      user: options?.user,
+      req: options?.req,
+      tenantID: options?.tenantID
     });
+    return {
+      fetch: async (request, _locals) => {
+        const apiKeyRaw = extractApiKeyFromRequest(request);
+        let gqlUser;
+        let apiKeyCtx;
+        if (apiKeyRaw && this.db) {
+          const apiKeyResult = await validateApiKey(apiKeyRaw, this.db);
+          if (!apiKeyResult.valid) {
+            return new Response(
+              JSON.stringify({ errors: [{ message: apiKeyResult.error || "Invalid API key" }] }),
+              { status: 401, headers: { "Content-Type": "application/json" } }
+            );
+          }
+          if (apiKeyResult.user) {
+            gqlUser = apiKeyResult.user;
+            apiKeyCtx = createApiKeyContext(apiKeyResult);
+          }
+        }
+        const mustRebuild = gqlUser !== options?.user || apiKeyCtx !== void 0;
+        const schema = mustRebuild ? buildGraphQLSchema({
+          registry: this.registry,
+          db: this.db,
+          settings: this.settings,
+          user: gqlUser,
+          req: request,
+          tenantID: options?.tenantID,
+          apiKey: apiKeyCtx
+        }) : defaultSchema;
+        const body = request.method === "POST" ? await request.json().catch(() => ({})) : {};
+        const query = body.query || "";
+        const variables = body.variables || {};
+        if (!query) {
+          return new Response(
+            JSON.stringify({ error: "No GraphQL query provided" }),
+            { status: 400, headers: { "Content-Type": "application/json" } }
+          );
+        }
+        try {
+          const document = parse(query);
+          const result = await execute({
+            schema,
+            document,
+            variableValues: variables,
+            contextValue: {
+              db: this.db,
+              registry: this.registry,
+              settings: this.settings,
+              user: gqlUser,
+              req: request,
+              tenantID: options?.tenantID
+            }
+          });
+          return new Response(JSON.stringify(result), {
+            status: 200,
+            headers: { "Content-Type": "application/json" }
+          });
+        } catch (err) {
+          return new Response(
+            JSON.stringify({ errors: [{ message: err.message }] }),
+            { status: 400, headers: { "Content-Type": "application/json" } }
+          );
+        }
+      },
+      schema: defaultSchema
+    };
   }
   getTRPC(options) {
-    return createKyroServer({
-      registry: this.registry,
-      db: this.db,
-      req: options?.req || { headers: {} },
-      ...options,
-      settings: this.settings
-    });
+    return {
+      fetch: async (request, locals) => {
+        const url = new URL(request.url);
+        const path = url.pathname.replace(/^\/api\/trpc\//, "");
+        const [slug, ...rest] = path.split(".");
+        let procedureName = rest.join(".");
+        procedureName = procedureName.replace(/\.(query|mutate|subscribe)$/, "");
+        if (!slug || !procedureName) {
+          return new Response(
+            JSON.stringify({
+              error: {
+                message: "Invalid tRPC path",
+                code: -32600,
+                data: { code: "BAD_REQUEST", httpStatus: 400 }
+              }
+            }),
+            { status: 400, headers: { "Content-Type": "application/json" } }
+          );
+        }
+        const ctx = await createContext({
+          db: this.db,
+          registry: this.registry,
+          req: request,
+          user: options?.user,
+          tenantID: options?.tenantID,
+          settings: this.settings
+        });
+        const kyroRouter = createKyroServer(ctx);
+        const collectionRouter = kyroRouter[slug];
+        if (!collectionRouter) {
+          return new Response(
+            JSON.stringify({
+              error: {
+                message: `Collection '${slug}' not found`,
+                code: -32601,
+                data: { code: "NOT_FOUND", httpStatus: 404 }
+              }
+            }),
+            { status: 404, headers: { "Content-Type": "application/json" } }
+          );
+        }
+        const procedure = collectionRouter[procedureName];
+        if (typeof procedure !== "function") {
+          return new Response(
+            JSON.stringify({
+              error: {
+                message: `Procedure '${procedureName}' not found`,
+                code: -32601,
+                data: { code: "NOT_FOUND", httpStatus: 404 }
+              }
+            }),
+            { status: 404, headers: { "Content-Type": "application/json" } }
+          );
+        }
+        try {
+          let raw = {};
+          if (request.method === "POST" || request.method === "PATCH") {
+            raw = await request.json().catch(() => ({}));
+          } else {
+            const qs = new URL(request.url).searchParams.get("input");
+            if (qs) {
+              try {
+                raw = JSON.parse(decodeURIComponent(qs));
+              } catch {
+              }
+            }
+          }
+          const input = raw?.["0"] ?? raw;
+          const result = await procedure({ ...input, collection: slug });
+          return new Response(JSON.stringify({ result: { data: result } }), {
+            status: 200,
+            headers: { "Content-Type": "application/json" }
+          });
+        } catch (err) {
+          const msg = err.message || "Internal error";
+          const httpStatus = msg.includes("not found") ? 404 : msg.includes("denied") || msg.includes("authentication required") ? 403 : msg.includes("conflict") ? 409 : 500;
+          const code = httpStatus === 404 ? -32601 : httpStatus === 403 ? -32001 : httpStatus === 409 ? -32002 : -32603;
+          return new Response(
+            JSON.stringify({
+              error: {
+                message: msg,
+                code,
+                data: {
+                  code: "INTERNAL_SERVER_ERROR",
+                  httpStatus
+                }
+              }
+            }),
+            { status: httpStatus, headers: { "Content-Type": "application/json" } }
+          );
+        }
+      },
+      router: null
+    };
+  }
+  getWS() {
+    return this.wsServer;
   }
   async startWebSocket(options) {
     const apiAccess = this.settings?.access?.apiAccess;
-    if (apiAccess?.websocketEnabled === false) {
+    if (apiAccess?.wsEnabled === false) {
       console.log("\u26A0\uFE0F WebSocket is disabled in settings");
       return null;
     }
+    const defaultVerifyToken = async (token) => {
+      const result = await validateApiKey(token, this.db);
+      if (!result.valid) throw new Error(result.error || "Invalid API key");
+      if (!result.user) throw new Error("API key has no associated user");
+      return result.user;
+    };
     this.wsServer = createWSServer({
       pubsub: this.pubsub,
       port: options?.port || 8080,
       requireAuth: options?.requireAuth ?? apiAccess?.requireAuth,
-      verifyToken: options?.verifyToken
+      verifyToken: options?.verifyToken || defaultVerifyToken
     });
     console.log(`\u{1F50C} WebSocket server started on port ${options?.port || 8080}`);
     return this.wsServer;
@@ -1361,13 +1882,6 @@ var LocalAdapter = class extends AbstractBaseAdapter {
   migrations = /* @__PURE__ */ new Map();
   draftsTableName = "kyro_drafts";
   versionsTableName = "kyro_versions";
-  tenantContext;
-  setTenantContext(context) {
-    this.tenantContext = context;
-  }
-  getTenantContext() {
-    return this.tenantContext;
-  }
   constructor(options) {
     super();
     this.path = options.path;
@@ -1381,6 +1895,34 @@ var LocalAdapter = class extends AbstractBaseAdapter {
     if (!this.db) {
       this.db = new DatabaseSync(this.path || ":memory:");
     }
+    if (this.db && typeof this.db.prepare === "function" && !this.db.prepare.__wrapped) {
+      const originalPrepare = this.db.prepare.bind(this.db);
+      const wrappedPrepare = (sql) => {
+        const stmt = originalPrepare(sql);
+        const serialize = (val) => {
+          if (typeof val === "boolean") return val ? 1 : 0;
+          if (val === void 0) return null;
+          return val;
+        };
+        return new Proxy(stmt, {
+          get(target, prop, receiver) {
+            if (prop === "all") {
+              return (...params) => target.all(...params.map(serialize));
+            }
+            if (prop === "get") {
+              return (...params) => target.get(...params.map(serialize));
+            }
+            if (prop === "run") {
+              return (...params) => target.run(...params.map(serialize));
+            }
+            const val = Reflect.get(target, prop, receiver);
+            return typeof val === "function" ? val.bind(target) : val;
+          }
+        });
+      };
+      wrappedPrepare.__wrapped = true;
+      this.db.prepare = wrappedPrepare;
+    }
     this.db.exec("PRAGMA journal_mode = WAL");
     this.db.exec("PRAGMA foreign_keys = ON");
     this.connected = true;
@@ -1408,8 +1950,8 @@ var LocalAdapter = class extends AbstractBaseAdapter {
     }
     columns.push(`${this.col("createdAt")} TEXT DEFAULT (datetime('now'))`);
     columns.push(`${this.col("updatedAt")} TEXT DEFAULT (datetime('now'))`);
-    columns.push(`_status TEXT DEFAULT 'published'`);
-    columns.push(`_has_draft INTEGER DEFAULT 0`);
+    columns.push(`publishStatus TEXT DEFAULT 'draft'`);
+    columns.push(`hasDraft INTEGER DEFAULT 0`);
     if (config.tenantScoped) {
       columns.push(`tenant_id TEXT NOT NULL`);
     }
@@ -1417,7 +1959,7 @@ var LocalAdapter = class extends AbstractBaseAdapter {
     if (existingColumns.length === 0) {
       const createSQL = `CREATE TABLE IF NOT EXISTS ${name} (${columns.join(", ")})`;
       this.db.exec(createSQL);
-      this.db.exec(`CREATE INDEX IF NOT EXISTS idx_${name}__status ON ${name}(_status)`);
+      this.db.exec(`CREATE INDEX IF NOT EXISTS idx_${name}_publishStatus ON ${name}(publishStatus)`);
       for (const field of flattenFields(config.fields)) {
         if (field.name && field.indexed) {
           this.db.exec(
@@ -1436,9 +1978,9 @@ var LocalAdapter = class extends AbstractBaseAdapter {
         const colName = colDef.split(" ")[0].replace(/^"/, "").replace(/"$/, "");
         if (!existingSet.has(colName) && colName !== "id") {
           try {
-            if (colName === "_status") {
+            if (colName === "publishStatus") {
               this.db.exec(`ALTER TABLE ${name} ADD COLUMN ${this.col(colName)} TEXT DEFAULT 'published'`);
-            } else if (colName === "_has_draft") {
+            } else if (colName === "hasDraft") {
               this.db.exec(`ALTER TABLE ${name} ADD COLUMN ${this.col(colName)} INTEGER DEFAULT 0`);
             } else {
               this.db.exec(`ALTER TABLE ${name} ADD COLUMN ${this.col(colName)} TEXT`);
@@ -1471,7 +2013,7 @@ var LocalAdapter = class extends AbstractBaseAdapter {
       `CREATE INDEX IF NOT EXISTS idx_${this.versionsTableName}_doc ON ${this.versionsTableName}(collection_slug, document_id)`
     );
     this.db.exec(
-      `CREATE INDEX IF NOT EXISTS idx_${this.versionsTableName}_status ON ${this.versionsTableName}(status)`
+      `CREATE INDEX IF NOT EXISTS idx_${this.versionsTableName}publishStatus ON ${this.versionsTableName}(status)`
     );
   }
   ensureDraftsTable() {
@@ -1572,7 +2114,7 @@ var LocalAdapter = class extends AbstractBaseAdapter {
       effectiveWhere = rlsQuery.where || {};
     }
     if (!draft && config.versions?.drafts) {
-      conditions.push(`_status = ?`);
+      conditions.push(`publishStatus = ?`);
       params.push("published");
     }
     if (tenantID && config.tenantScoped) {
@@ -1617,7 +2159,7 @@ var LocalAdapter = class extends AbstractBaseAdapter {
     }
     if (draft) {
       docs = await Promise.all(docs.map(async (doc) => {
-        if (doc._has_draft) {
+        if (doc.hasDraft) {
           const versions = await this.findVersions({
             collection: slug,
             documentId: doc.id,
@@ -1625,7 +2167,7 @@ var LocalAdapter = class extends AbstractBaseAdapter {
             sort: "-createdAt"
           });
           if (versions.docs.length > 0 && versions.docs[0].status === "draft") {
-            return { ...doc, ...versions.docs[0].data, _has_draft: true, _status: doc._status };
+            return { ...doc, ...versions.docs[0].data, hasDraft: true, publishStatus: doc.publishStatus };
           }
         }
         return doc;
@@ -1659,7 +2201,7 @@ var LocalAdapter = class extends AbstractBaseAdapter {
       }
     }
     if (!draft && config.versions?.drafts) {
-      sql += ` AND _status = ?`;
+      sql += ` AND publishStatus = ?`;
       params.push("published");
     }
     if (tenantID && config.tenantScoped) {
@@ -1669,7 +2211,7 @@ var LocalAdapter = class extends AbstractBaseAdapter {
     const row = this.db.prepare(sql).get(...params);
     if (!row) return null;
     let doc = this.rowToDoc(row, config);
-    if (draft && doc._has_draft) {
+    if (draft && doc.hasDraft) {
       const versions = await this.findVersions({
         collection: slug,
         documentId: doc.id,
@@ -1677,7 +2219,7 @@ var LocalAdapter = class extends AbstractBaseAdapter {
         sort: "-createdAt"
       });
       if (versions.docs.length > 0 && versions.docs[0].status === "draft") {
-        doc = { ...doc, ...versions.docs[0].data, _has_draft: true, _status: doc._status };
+        doc = { ...doc, ...versions.docs[0].data, hasDraft: true, publishStatus: doc.publishStatus };
       }
     }
     return doc;
@@ -1708,7 +2250,7 @@ var LocalAdapter = class extends AbstractBaseAdapter {
     const quotedColumns = filteredColumns.map((c) => this.col(c));
     const placeholders = filteredColumns.map(() => "?").join(", ");
     const values = Object.values(filteredData).map(
-      (v) => typeof v === "object" ? JSON.stringify(v) : v
+      (v) => v !== null && typeof v === "object" ? JSON.stringify(v) : v
     );
     this.db.prepare(
       `INSERT OR REPLACE INTO ${tableName} (${quotedColumns.join(", ")}) VALUES (${placeholders})`
@@ -1788,7 +2330,7 @@ var LocalAdapter = class extends AbstractBaseAdapter {
       const conditions = [];
       const params = [];
       if (!args.draft && globalConfig.versions) {
-        conditions.push("_status = 'published'");
+        conditions.push("publishStatus = 'published'");
       }
       if (conditions.length > 0) {
         sql += ` WHERE ${conditions.join(" AND ")}`;
@@ -1797,7 +2339,7 @@ var LocalAdapter = class extends AbstractBaseAdapter {
       const result2 = this.db.prepare(sql).get(...params);
       if (result2) {
         let doc = this.rowToDoc(result2, globalConfig);
-        if (args.draft && doc._has_draft) {
+        if (args.draft && doc.hasDraft) {
           const versions = await this.findVersions({
             collection: args.collection,
             documentId: parsed.globalSlug,
@@ -1805,7 +2347,7 @@ var LocalAdapter = class extends AbstractBaseAdapter {
             sort: "-createdAt"
           });
           if (versions.docs.length > 0 && versions.docs[0].status === "draft") {
-            doc = { ...doc, ...versions.docs[0].data, _has_draft: true, _status: doc._status };
+            doc = { ...doc, ...versions.docs[0].data, hasDraft: true, publishStatus: doc.publishStatus };
           }
         }
         return doc;
@@ -2147,6 +2689,8 @@ var LocalAdapter = class extends AbstractBaseAdapter {
     if (config.tenantScoped) {
       doc.tenantID = row.tenant_id;
     }
+    doc.publishStatus = row.publishStatus ?? "published";
+    doc.hasDraft = row.hasDraft ? Boolean(row.hasDraft) : false;
     return doc;
   }
   generateId() {
@@ -2232,5 +2776,5 @@ function createLocalAdapter(options) {
 }
 
 export { ConfigValidationError, Kyro, LocalAdapter, Registry, collectionToCreateZod, collectionToUpdateZod, collectionToWhereZod, collectionToZod, createKyro, createLocalAdapter, createRegistry, fieldToZod, getRegistry, globalToZod, resetRegistry, validateCollection, validateConfig, validateFields, validateGlobal };
-//# sourceMappingURL=chunk-35U3FROB.js.map
-//# sourceMappingURL=chunk-35U3FROB.js.map
+//# sourceMappingURL=chunk-22M4O4ZJ.js.map
+//# sourceMappingURL=chunk-22M4O4ZJ.js.map