@kyro-cms/core 0.9.1 → 0.9.2

package/dist/{chunk-PU2Z5VWF.js → chunk-IPTZM3VE.js}

@@ -1,15 +1,15 @@
-import { PasswordPolicy, ConfigService, EmailTransport } from './chunk-TXSZFA4G.js';
+import { PasswordPolicy, ConfigService, EmailTransport } from './chunk-6UNONDW7.js';
 import { usersCollection } from './chunk-XEB7PH2E.js';
 import { SQLiteAuthAdapter } from './chunk-Q72BOAPK.js';
 import { createAuditContext } from './chunk-P2YW545G.js';
 import { WEBHOOK_EVENTS } from './chunk-3UK5XBVJ.js';
 import { API_KEY_COLLECTION, generateApiKey, generateApiKeyPrefix, evaluateAccess, hasApiKeyPermission, extractApiKeyFromRequest, validateApiKey, createApiKeyContext } from './chunk-CJONKRHJ.js';
-import { genId, DrizzleAdapter } from './chunk-EJN2PAOE.js';
-import { PostgresAuthAdapter } from './chunk-FOPGUM27.js';
-import { MongoDBAdapter } from './chunk-VO35MNPH.js';
+import { genId, DrizzleAdapter } from './chunk-V7KZQIZ6.js';
+import { PostgresAuthAdapter } from './chunk-CJX74IYK.js';
+import { MongoDBAdapter } from './chunk-PQ72Z6WC.js';
 import { MongoDBAuthAdapter } from './chunk-7OGPN7MP.js';
 import { hasPermission } from './chunk-L4EZKIEX.js';
-import { __esm, __export, __toCommonJS, __require } from './chunk-Z6ZWNWWR.js';
+import { __esm, __export, __toCommonJS } from './chunk-4CV4JOE5.js';
 import crypto, { randomBytes, createHash } from 'crypto';
 import { createStorage } from 'unstorage';
 import fsDriver from 'unstorage/drivers/fs';
@@ -20,6 +20,7 @@ import sharp from 'sharp';
 import { mkdir, readdir, stat, rename, unlink, writeFile } from 'fs/promises';
 import process2 from 'process';
 import { S3Client, ListObjectsV2Command, DeleteObjectsCommand, DeleteObjectCommand, PutObjectCommand, HeadObjectCommand, CopyObjectCommand } from '@aws-sdk/client-s3';
+import { NodeHttpHandler } from '@smithy/node-http-handler';
 import { Readable } from 'stream';
 import { Client } from 'basic-ftp';
 import { zodToJsonSchema } from 'zod-to-json-schema';
@@ -31,8 +32,8 @@ async function loadSecrets() {
   if (dbAdapter) {
     try {
       const result = await dbAdapter.findOne({
-        collection: "_globals",
-        where: { slug: "system" }
+        collection: "_globals_system",
+        where: {}
       });
       if (result) {
         cachedSecrets = {
@@ -442,6 +443,9 @@ function createTenantContextFromUser(user) {
   };
 }
 
+// src/api/rest/hono-app.ts
+init_secret();
+
 // src/auth/security/in-memory-rate-limit.ts
 var InMemoryRateLimiter = class {
   storage = /* @__PURE__ */ new Map();
@@ -2223,7 +2227,7 @@ function createS3Storage(config) {
     tls: true,
     // R2 requires specific SSL configuration
     ...config.provider === "r2" && {
-      requestHandler: new (__require("@smithy/node-http-handler")).NodeHttpHandler({
+      requestHandler: new NodeHttpHandler({
         connectionTimeout: 1e4,
         socketTimeout: 1e4
       })
@@ -2846,9 +2850,7 @@ var MediaService = class _MediaService {
       storage2 = await resolveProviderWithConfig(options.storageConfig);
     } else {
       const configService = new ConfigService(db);
-      if (typeof db?.select === "function") {
-        await configService.load();
-      }
+      await configService.load();
       storage2 = await resolveProvider(configService);
     }
     const service = new _MediaService(db, storage2, options);
@@ -3050,7 +3052,7 @@ var MediaService = class _MediaService {
         ]
       );
     } else {
-      const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+      const { media: mediaSchema } = await import('./media-7WDX4BDJ.js');
       const mime = storageResult.mimeType;
       const mediaType = mime.startsWith("image/") ? "image" : mime.startsWith("video/") ? "video" : mime.startsWith("audio/") ? "audio" : mime.startsWith("application/pdf") ? "document" : ["application/zip", "application/x-zip", "application/x-tar", "application/gzip", "application/x-7z"].includes(mime) ? "archive" : "other";
       await this.db.insert(mediaSchema).values({
@@ -3112,7 +3114,7 @@ var MediaService = class _MediaService {
         id
       ]);
     } else {
-      const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+      const { media: mediaSchema } = await import('./media-7WDX4BDJ.js');
       const { eq } = await import('drizzle-orm');
       const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
       if (row) item = this.rowToMedia(row);
@@ -3128,7 +3130,7 @@ var MediaService = class _MediaService {
     if (this.dialect === "sqlite") {
       await this.sqliteRun(`DELETE FROM ${this.mediaTable} WHERE id = ?`, [id]);
     } else {
-      const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+      const { media: mediaSchema } = await import('./media-7WDX4BDJ.js');
       const { eq } = await import('drizzle-orm');
       await this.db.delete(mediaSchema).where(eq(mediaSchema.id, id));
     }
@@ -3143,7 +3145,7 @@ var MediaService = class _MediaService {
         id
       ]);
     } else {
-      const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+      const { media: mediaSchema } = await import('./media-7WDX4BDJ.js');
       const { eq } = await import('drizzle-orm');
       const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
       if (row) item = this.rowToMedia(row);
@@ -3178,7 +3180,7 @@ var MediaService = class _MediaService {
         [...vals, this.now(), id]
       );
     } else {
-      const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+      const { media: mediaSchema } = await import('./media-7WDX4BDJ.js');
       const { eq } = await import('drizzle-orm');
       await this.db.update(mediaSchema).set({ ...updateData, updatedAt: this.now() }).where(eq(mediaSchema.id, id));
     }
@@ -3197,7 +3199,7 @@ var MediaService = class _MediaService {
       );
       return row2 ? this.rowToMedia(row2) : null;
     }
-    const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+    const { media: mediaSchema } = await import('./media-7WDX4BDJ.js');
     const { eq } = await import('drizzle-orm');
     const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
     return row ? this.rowToMedia(row) : null;
@@ -3245,7 +3247,7 @@ var MediaService = class _MediaService {
         totalPages: Math.ceil(totalDocs2 / limit)
       };
     }
-    const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+    const { media: mediaSchema } = await import('./media-7WDX4BDJ.js');
     const { like, or, and, asc, desc, eq, sql } = await import('drizzle-orm');
     const conditions = [];
     if (search) {
@@ -3324,7 +3326,7 @@ var MediaService = class _MediaService {
       );
       return row ? this.rowToMedia(row) : null;
     }
-    const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+    const { media: mediaSchema } = await import('./media-7WDX4BDJ.js');
     const { eq } = await import('drizzle-orm');
     const [updated] = await this.db.update(mediaSchema).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq(mediaSchema.id, id)).returning();
     return updated ? this.rowToMedia(updated) : null;
@@ -3346,7 +3348,7 @@ var MediaService = class _MediaService {
         );
       }
     } else {
-      const { media: mediaSchema } = await import('./media-GPPTZ43E.js');
+      const { media: mediaSchema } = await import('./media-7WDX4BDJ.js');
       const { eq } = await import('drizzle-orm');
       for (const id of ids) {
         await this.db.update(mediaSchema).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq(mediaSchema.id, id));
@@ -3361,7 +3363,7 @@ var MediaService = class _MediaService {
       );
       return rows.map((r) => r.path).filter((f) => f && f !== "").sort();
     }
-    const { media: mediaSchema, mediaFolders: folderSchema } = await import('./media-GPPTZ43E.js');
+    const { media: mediaSchema, mediaFolders: folderSchema } = await import('./media-7WDX4BDJ.js');
     const { eq, sql } = await import('drizzle-orm');
     const fromMedia = await this.db.select({ folder: mediaSchema.folder }).from(mediaSchema).groupBy(mediaSchema.folder);
     const fromFolders = await this.db.select({ path: folderSchema.path }).from(folderSchema);
@@ -3381,7 +3383,7 @@ var MediaService = class _MediaService {
         [fullPath, name, parentPath || null, now]
       );
     } else {
-      const { mediaFolders: folderSchema } = await import('./media-GPPTZ43E.js');
+      const { mediaFolders: folderSchema } = await import('./media-7WDX4BDJ.js');
       await this.db.insert(folderSchema).values({
         path: fullPath,
         name,
@@ -3402,7 +3404,7 @@ var MediaService = class _MediaService {
         [folder, `${folder}/%`]
       );
     } else {
-      const { mediaFolders: folderSchema } = await import('./media-GPPTZ43E.js');
+      const { mediaFolders: folderSchema } = await import('./media-7WDX4BDJ.js');
       const { like, or, eq } = await import('drizzle-orm');
       await this.db.delete(folderSchema).where(
         or(
@@ -3416,6 +3418,38 @@ var MediaService = class _MediaService {
 function formatZodErrors(errors) {
   return errors.map((e) => `${e.path.join(".")}: ${e.message}`).join(", ");
 }
+function normalizeEmptyStrings(data, fields) {
+  if (!data || typeof data !== "object") return;
+  for (const field of fields) {
+    if (!field.name || !(field.name in data)) continue;
+    const val = data[field.name];
+    if (val === "") {
+      const isTextual = field.type === "text" || field.type === "textarea" || field.type === "code" || field.type === "markdown" || field.type === "email" || field.type === "password" || field.type === "color";
+      if (!isTextual) data[field.name] = null;
+    }
+    if (field.type === "tabs" && field.name && Array.isArray(field.tabs) && data[field.name] && typeof data[field.name] === "object") {
+      for (const tab of field.tabs) {
+        if (Array.isArray(tab.fields)) normalizeEmptyStrings(data[field.name], tab.fields);
+      }
+    } else if ((field.type === "group" || field.type === "collapsible") && field.name && Array.isArray(field.fields) && data[field.name] && typeof data[field.name] === "object") {
+      normalizeEmptyStrings(data[field.name], field.fields);
+    } else if (field.type === "array" && field.name && Array.isArray(field.fields) && Array.isArray(data[field.name])) {
+      for (const item of data[field.name]) {
+        if (item && typeof item === "object") normalizeEmptyStrings(item, field.fields);
+      }
+    } else if (field.type === "blocks" && field.name && Array.isArray(field.blocks) && Array.isArray(data[field.name])) {
+      for (const item of data[field.name]) {
+        if (!item || typeof item !== "object") continue;
+        const blockTypeStr = item.type || item.blockType;
+        if (!blockTypeStr) continue;
+        const blockDef = field.blocks.find((b) => b.slug === blockTypeStr);
+        if (!blockDef || !Array.isArray(blockDef.fields)) continue;
+        const target = item.data && typeof item.data === "object" ? item.data : item;
+        normalizeEmptyStrings(target, blockDef.fields);
+      }
+    }
+  }
+}
 function convertRichtextFields(fields, data) {
   if (!data || typeof data !== "object") return;
   for (const field of fields) {
@@ -3437,6 +3471,16 @@ function convertRichtextFields(fields, data) {
       for (const item of data[field.name]) {
         if (item && typeof item === "object") convertRichtextFields(field.fields, item);
       }
+    } else if (field.type === "blocks" && field.name && Array.isArray(field.blocks) && Array.isArray(data[field.name])) {
+      for (const item of data[field.name]) {
+        if (!item || typeof item !== "object") continue;
+        const blockTypeStr = item.type || item.blockType;
+        if (!blockTypeStr) continue;
+        const blockDef = field.blocks.find((b) => b.slug === blockTypeStr);
+        if (!blockDef || !Array.isArray(blockDef.fields)) continue;
+        const target = item.data && typeof item.data === "object" ? item.data : item;
+        convertRichtextFields(blockDef.fields, target);
+      }
     }
   }
 }
@@ -3533,7 +3577,7 @@ async function checkCollectionAccess(collection, operation, req, ctxUser, ctxTen
       };
     }
   }
-  if (ctxUser) {
+  if (ctxUser && !(apiKeyContext?.permissions?.length > 0)) {
     const resource = collection.slug;
     const action = operation === "read" ? "read" : operation === "create" ? "create" : operation === "update" ? "update" : "delete";
     const permission = `${resource}:${action}`;
@@ -3729,6 +3773,13 @@ function createHonoApp(options) {
     baseUrl: process.env.KYRO_BASE_URL || "http://localhost:4321",
     rateLimiter
   });
+  EmailTransport.fromConfig(db).then((transport) => {
+    if (transport) {
+      authRoutes.email = transport;
+    }
+  }).catch((err) => {
+    console.error("[Email] Failed to initialize transport from config:", err);
+  });
   app.post("/api/auth/login", async (c) => authRoutes.login(c.req.raw));
   app.post("/api/auth/register", async (c) => authRoutes.register(c.req.raw));
   app.post("/api/auth/logout", async (c) => authRoutes.logout(c.req.raw));
@@ -4804,15 +4855,13 @@ function createHonoApp(options) {
   });
   app.get("/api/keys", async (c) => {
     try {
-      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      const { user: ctxUser, tenantID: ctxTenantID } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
       if (!ctxUser || !hasPermission(ctxUser, "users:read")) {
         return c.json({ error: "Forbidden" }, 403);
       }
       const page = parseInt(c.req.query("page") || "1");
       const limit = Math.min(parseInt(c.req.query("limit") || "50"), 100);
-      console.log("[ApiKeys] Querying", API_KEY_COLLECTION, { page, limit });
-      const result = await db.find({ collection: API_KEY_COLLECTION, where: {}, page, limit });
-      console.log("[ApiKeys] Result:", result);
+      const result = await db.find({ collection: API_KEY_COLLECTION, where: {}, page, limit, tenantID: ctxTenantID });
       const docs = (result.docs || []).map((doc) => ({
         id: doc.id,
         name: doc.name,
@@ -5205,36 +5254,6 @@ function createHonoApp(options) {
         return c.json({ error: error.message }, 500);
       }
     });
-    app.get(`${basePath}/:id/draft`, async (c) => {
-      try {
-        const {
-          user: ctxUser,
-          tenantID: ctxTenantID,
-          apiKeyContext
-        } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
-        const access = await checkCollectionAccess(
-          collection,
-          "read",
-          c.req.raw,
-          ctxUser,
-          ctxTenantID,
-          apiKeyContext,
-          enablePublicAccess,
-          defaultCollectionAccess
-        );
-        if (!access.allowed) {
-          return c.json({ error: access.error }, access.status || 403);
-        }
-        const draft = await db.findDraft({
-          collection: slug,
-          documentId: c.req.param("id"),
-          tenantID: ctxTenantID
-        });
-        return c.json({ data: draft });
-      } catch (error) {
-        return c.json({ error: error.message }, 500);
-      }
-    });
     app.put(`${basePath}/:id/draft`, async (c) => {
       try {
         const {
@@ -5273,13 +5292,12 @@ function createHonoApp(options) {
         } else {
           finalData = body.data ?? omitRevisionFields(body);
         }
-        const draft = await db.upsertDraft({
+        const version = await db.updateLatestVersion({
           collection: slug,
           documentId: id,
-          tenantID: ctxTenantID,
           data: finalData,
-          baseUpdatedAt,
-          draftUpdatedAt: body.draftUpdatedAt
+          status: "draft",
+          tenantID: ctxTenantID
         });
         if (ctxUser) {
           sessionAuthAdapter?.createAuditLog({
@@ -5291,7 +5309,7 @@ function createHonoApp(options) {
             metadata: { type: "draft_save" }
           });
         }
-        return c.json({ data: draft, message: "Draft saved successfully" });
+        return c.json({ data: version, message: "Draft saved successfully" });
       } catch (error) {
         return c.json({ error: error.message }, 500);
       }
@@ -5316,11 +5334,6 @@ function createHonoApp(options) {
         if (!access.allowed) {
           return c.json({ error: access.error }, access.status || 403);
         }
-        await db.deleteDraft({
-          collection: slug,
-          documentId: c.req.param("id"),
-          tenantID: ctxTenantID
-        });
         if (ctxUser) {
           sessionAuthAdapter?.createAuditLog({
             action: "document_update",
@@ -5412,14 +5425,7 @@ function createHonoApp(options) {
         auditApiKeyUsage(sessionAuthAdapter, apiKeyContext, basePath, "POST", c.req.raw);
         const body = await c.req.json();
         let validated = body;
-        for (const field of collection.fields) {
-          if (field.name && validated[field.name] === "") {
-            const isTextual = field.type === "text" || field.type === "textarea" || field.type === "code" || field.type === "markdown" || field.type === "email" || field.type === "password" || field.type === "color";
-            if (!isTextual) {
-              validated[field.name] = null;
-            }
-          }
-        }
+        normalizeEmptyStrings(validated, collection.fields);
         convertRichtextFields(collection.fields, validated);
         const hookReq = c.req.raw;
         if (collection.hooks?.beforeValidate) {
@@ -5445,10 +5451,7 @@ function createHonoApp(options) {
           validated.tenantID = ctxTenantID;
         }
         const isDraftEnabled = collection.versions?.drafts === true;
-        if (isDraftEnabled) {
-          validated.publishStatus = "draft";
-          validated.hasDraft = false;
-        }
+        validated.status = isDraftEnabled ? "draft" : "published";
         if (collection.hooks?.beforeChange) {
           for (const hook of collection.hooks.beforeChange) {
             const hookResult = await hook({
@@ -5467,6 +5470,17 @@ function createHonoApp(options) {
           data: validated,
           tenantID: ctxTenantID
         });
+        if (isDraftEnabled) {
+          await db.createVersion({
+            collection: slug,
+            documentId: doc.id,
+            data: validated,
+            status: "draft",
+            createdBy: ctxUser?.id,
+            changeDescription: "Created",
+            tenantID: ctxTenantID
+          });
+        }
         if (collection.hooks?.afterChange) {
           for (const hook of collection.hooks.afterChange) {
             await hook({
@@ -5532,11 +5546,6 @@ function createHonoApp(options) {
         const id = c.req.param("id");
         const body = await c.req.json();
         const baseUpdatedAt = readBaseUpdatedAt(body);
-        console.log(`[PATCH] ${slug}/${id}`, {
-          baseUpdatedAt,
-          bodyKeys: Object.keys(body),
-          tenantID: ctxTenantID
-        });
         const originalDoc = await db.findByID({
           collection: slug,
           id,
@@ -5554,14 +5563,7 @@ function createHonoApp(options) {
             ([_, v]) => v !== "null" && v !== void 0
           )
         );
-        for (const field of collection.fields) {
-          if (field.name && validated[field.name] === "") {
-            const isTextual = field.type === "text" || field.type === "textarea" || field.type === "code" || field.type === "markdown" || field.type === "email" || field.type === "password" || field.type === "color";
-            if (!isTextual) {
-              validated[field.name] = null;
-            }
-          }
-        }
+        normalizeEmptyStrings(validated, collection.fields);
         convertRichtextFields(collection.fields, validated);
         const hookReq = c.req.raw;
         if (collection.hooks?.beforeValidate) {
@@ -5594,37 +5596,44 @@ function createHonoApp(options) {
             if (hookResult) Object.assign(validated, hookResult);
           }
         }
-        console.log(`[PATCH] Validated data:`, Object.keys(validated));
+        const isDraft = c.req.header("X-Draft") === "true";
         const isDraftEnabled = collection.versions?.drafts === true;
-        const isAlreadyPublished = originalDoc.publishStatus === "published";
+        const isAutosave = c.req.query("autosave") === "true";
         let doc;
-        if (isDraftEnabled && isAlreadyPublished) {
+        if (isDraftEnabled && isDraft) {
           await db.createVersion({
             collection: slug,
             documentId: id,
             data: validated,
             status: "draft",
+            autosave: isAutosave,
             createdBy: ctxUser?.id,
-            changeDescription: "Manual save (Draft)",
+            changeDescription: isAutosave ? "Autosave" : "Draft saved",
             tenantID: ctxTenantID
           });
+        } else if (isDraftEnabled) {
           await db.update({
             collection: slug,
             id,
-            data: { hasDraft: true },
-            // Keep old data, just set flag
+            data: { ...validated, status: "published" },
+            tenantID: ctxTenantID
+          });
+          await db.createVersion({
+            collection: slug,
+            documentId: id,
+            data: validated,
+            status: "published",
+            createdBy: ctxUser?.id,
+            changeDescription: "Published",
             tenantID: ctxTenantID
           });
         } else {
-          const saveData = isDraftEnabled ? { ...validated, publishStatus: "draft", hasDraft: false } : validated;
-          console.log(`[PATCH] About to call db.update for ${slug}/${id} with keys:`, Object.keys(saveData));
           await db.update({
             collection: slug,
             id,
-            data: saveData,
+            data: validated,
             tenantID: ctxTenantID
           });
-          console.log(`[PATCH] db.update SUCCEEDED for ${slug}/${id}`);
         }
         doc = await db.findByID({
           collection: slug,
@@ -5632,25 +5641,6 @@ function createHonoApp(options) {
           tenantID: ctxTenantID,
           draft: true
         });
-        if (isDraftEnabled) {
-          if (!isAlreadyPublished) {
-            await db.createVersion({
-              collection: slug,
-              documentId: id,
-              data: validated,
-              status: "draft",
-              createdBy: ctxUser?.id,
-              changeDescription: "Manual save",
-              tenantID: ctxTenantID
-            });
-          }
-        } else {
-          await db.deleteDraft({
-            collection: slug,
-            documentId: id,
-            tenantID: ctxTenantID
-          });
-        }
         if (collection.hooks?.afterChange) {
           for (const hook of collection.hooks.afterChange) {
             await hook({
@@ -5722,7 +5712,6 @@ function createHonoApp(options) {
           db.setTenantContext({ tenantId: ctxTenantID, userId: ctxUser?.id ?? "", role: ctxUser?.role, isSuperAdmin: ctxUser?.role === "super_admin" });
         }
         const id = c.req.param("id");
-        console.log(`[DELETE] Deleting ${slug}/${id}`);
         const hookReq = c.req.raw;
         const originalDoc = await db.findByID({
           collection: slug,
@@ -5750,11 +5739,6 @@ function createHonoApp(options) {
           id,
           tenantID: ctxTenantID
         });
-        await db.deleteDraft({
-          collection: slug,
-          documentId: id,
-          tenantID: ctxTenantID
-        });
         if (collection.hooks?.afterDelete) {
           for (const hook of collection.hooks.afterDelete) {
             await hook({
@@ -5796,7 +5780,6 @@ function createHonoApp(options) {
     });
     app.post(`${basePath}/:id/duplicate`, async (c) => {
       try {
-        console.log(`[Duplicate] Request for ${slug}`);
         const {
           user: ctxUser,
           tenantID: ctxTenantID,
@@ -5813,11 +5796,9 @@ function createHonoApp(options) {
           defaultCollectionAccess
         );
         if (!access.allowed) {
-          console.log("[Duplicate] Access denied:", access.error);
           return c.json({ error: access.error }, access.status || 403);
         }
         const id = c.req.param("id");
-        console.log(`[Duplicate] ID: ${id}`);
         const originalDoc = await db.findByID({
           collection: slug,
           id,
@@ -5825,14 +5806,11 @@ function createHonoApp(options) {
           draft: true
         });
         if (!originalDoc) {
-          console.log("[Duplicate] Document not found");
           return c.json({ error: "Document not found" }, 404);
         }
-        console.log(`[Duplicate] Original doc:`, originalDoc);
         const { id: _oldId, createdAt: _oldCreated, updatedAt: _oldUpdated, ...docData } = originalDoc;
         const timestamp = Date.now().toString(36);
         const newSlug = `${originalDoc.slug || "document"}-copy-${timestamp}`;
-        console.log(`[Duplicate] New slug: ${newSlug}`);
         const newDoc = await db.create({
           collection: slug,
           data: {
@@ -5842,7 +5820,6 @@ function createHonoApp(options) {
           },
           tenantID: ctxTenantID
         });
-        console.log(`[Duplicate] Created successfully:`, newDoc.id);
         return c.json({ data: newDoc, message: "Document duplicated successfully" });
       } catch (error) {
         console.error("[Duplicate] Error:", error);
@@ -5882,7 +5859,7 @@ function createHonoApp(options) {
         const doc = await db.update({
           collection: slug,
           id,
-          data: { ...version.data, publishStatus: "draft", hasDraft: false },
+          data: { ...version.data, status: "draft" },
           tenantID: ctxTenantID
         });
         return c.json({
@@ -5927,7 +5904,7 @@ function createHonoApp(options) {
           const doc = await db.update({
             collection: slug,
             id: c.req.param("id"),
-            data: { ...version.data, publishStatus: "draft", hasDraft: false },
+            data: { ...version.data, status: "draft" },
             tenantID: ctxTenantID
           });
           return c.json({
@@ -5978,9 +5955,9 @@ function createHonoApp(options) {
         if (baseUpdatedAt && originalDoc.updatedAt && baseUpdatedAt !== originalDoc.updatedAt) {
           return c.json(buildConflictResponse(baseUpdatedAt, originalDoc), 409);
         }
-        let publishData = { publishStatus: "published", hasDraft: false };
+        let publishData = { status: "published" };
         let finalContent = originalDoc;
-        if (originalDoc.hasDraft) {
+        if (collection.versions?.drafts) {
           const versions = await db.findVersions({
             collection: slug,
             documentId: id,
@@ -5988,9 +5965,10 @@ function createHonoApp(options) {
             sort: "-createdAt",
             tenantID: ctxTenantID
           });
-          if (versions.docs.length > 0 && versions.docs[0].status === "draft") {
-            finalContent = { ...originalDoc, ...versions.docs[0].data };
-            publishData = { ...versions.docs[0].data, ...publishData };
+          if (versions.docs.length > 0) {
+            const latestVersion = versions.docs[0];
+            finalContent = { ...originalDoc, ...latestVersion.data };
+            publishData = { ...latestVersion.data, ...publishData };
           }
         }
         const doc = await db.update({
@@ -6003,18 +5981,13 @@ function createHonoApp(options) {
           await db.createVersion({
             collection: slug,
             documentId: id,
-            data: { ...finalContent, publishStatus: "published" },
+            data: { ...finalContent, status: "published" },
             status: "published",
             createdBy: ctxUser?.id,
             changeDescription: "Published",
             tenantID: ctxTenantID
           });
         }
-        await db.deleteDraft({
-          collection: slug,
-          documentId: id,
-          tenantID: ctxTenantID
-        });
         if (webhookService) {
           webhookService.trigger(getWebhookEvent(slug, "update"), {
             collection: slug,
@@ -6062,7 +6035,7 @@ function createHonoApp(options) {
         const doc = await db.update({
           collection: slug,
           id,
-          data: { publishStatus: "draft" },
+          data: { status: "draft" },
           tenantID: ctxTenantID
         });
         if (webhookService) {
@@ -6097,7 +6070,7 @@ function createHonoApp(options) {
         if (!access.allowed) {
           return c.json({ error: access.error }, access.status || 403);
         }
-        const isDraftRequest = c.req.query("draft") === "true" && !!ctxUser;
+        const isDraftRequest = !!ctxUser;
         let doc = await db.findOne({
           collection: `_globals_${slug}`,
           where: {},
@@ -6145,23 +6118,16 @@ function createHonoApp(options) {
         const cleaned = Object.fromEntries(
           Object.entries(body).filter(([_, v]) => v !== null && v !== "null" && v !== void 0)
         );
-        for (const field of globalConfig.fields) {
-          if (field.name && cleaned[field.name] === "") {
-            const isTextual = field.type === "text" || field.type === "textarea" || field.type === "code" || field.type === "markdown" || field.type === "email" || field.type === "password" || field.type === "color";
-            if (!isTextual) {
-              cleaned[field.name] = null;
-            }
-          }
-        }
+        normalizeEmptyStrings(cleaned, globalConfig.fields);
         convertRichtextFields(globalConfig.fields, cleaned);
-        const schema = registry.getZodSchema(slug);
+        const schema = registry.getUpdateZodSchema(slug);
         let validated;
         try {
           validated = schema.parse(cleaned);
         } catch (zodErr) {
           return c.json({ error: `Validation failed: ${formatZodErrors(zodErr.errors)}`, details: zodErr.errors }, 400);
         }
-        const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["id", "createdAt", "updatedAt", "publishStatus", "hasDraft", "baseUpdatedAt", "_baseUpdatedAt"]);
+        const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["id", "createdAt", "updatedAt", "status", "baseUpdatedAt", "_baseUpdatedAt"]);
         const userData = Object.fromEntries(
           Object.entries(validated).filter(([k]) => !SYSTEM_FIELDS.has(k))
         );
@@ -6172,49 +6138,68 @@ function createHonoApp(options) {
           tenantID: ctxTenantID,
           draft: true
         });
+        const isDraft = c.req.header("X-Draft") === "true";
         const isDraftEnabled = globalConfig.versions?.drafts === true;
-        const isAlreadyPublished = originalDoc?.publishStatus === "published";
+        const isAutosave = c.req.query("autosave") === "true";
         let doc;
-        if (isDraftEnabled && isAlreadyPublished) {
+        if (isDraftEnabled && isDraft) {
           await db.createVersion({
             collection: collectionSlug,
             documentId: slug,
             data: userData,
             status: "draft",
+            autosave: isAutosave,
             createdBy: ctxUser?.id,
-            changeDescription: "Manual save (Draft)",
+            changeDescription: isAutosave ? "Autosave" : "Manual save",
             tenantID: ctxTenantID
           });
-          doc = await db.update({
-            collection: collectionSlug,
-            id: slug,
-            data: { hasDraft: true },
-            tenantID: ctxTenantID
-          });
-        } else {
-          const saveData = isDraftEnabled ? { ...userData, publishStatus: "draft", hasDraft: false } : { ...userData, publishStatus: "published", hasDraft: false };
+          if (!originalDoc) {
+            doc = await db.create({
+              collection: collectionSlug,
+              data: { ...userData, id: slug, status: "draft" },
+              tenantID: ctxTenantID
+            });
+          } else {
+            doc = originalDoc;
+          }
+        } else if (isDraftEnabled && !isDraft) {
+          const publishStatus = "published";
           if (originalDoc) {
             doc = await db.update({
               collection: collectionSlug,
               id: slug,
-              data: saveData,
+              data: { ...userData, status: publishStatus },
               tenantID: ctxTenantID
             });
           } else {
             doc = await db.create({
               collection: collectionSlug,
-              data: { ...saveData, id: slug },
+              data: { ...userData, id: slug, status: publishStatus },
               tenantID: ctxTenantID
             });
           }
-          if (isDraftEnabled) {
-            await db.createVersion({
+          await db.createVersion({
+            collection: collectionSlug,
+            documentId: slug,
+            data: userData,
+            status: publishStatus,
+            autosave: false,
+            createdBy: ctxUser?.id,
+            changeDescription: "Published",
+            tenantID: ctxTenantID
+          });
+        } else {
+          if (originalDoc) {
+            doc = await db.update({
               collection: collectionSlug,
-              documentId: slug,
+              id: slug,
               data: userData,
-              status: "draft",
-              createdBy: ctxUser?.id,
-              changeDescription: "Manual save",
+              tenantID: ctxTenantID
+            });
+          } else {
+            doc = await db.create({
+              collection: collectionSlug,
+              data: { ...userData, id: slug },
               tenantID: ctxTenantID
             });
           }
@@ -6223,6 +6208,13 @@ function createHonoApp(options) {
           mediaService = null;
           mediaServiceInitError = null;
         }
+        if (slug === "email-settings") {
+          const newEmailTransport = await EmailTransport.fromConfig(db);
+          authRoutes.email = newEmailTransport || void 0;
+        }
+        if (slug === "system") {
+          await loadSecrets();
+        }
         if (ctxUser) {
           sessionAuthAdapter?.createAuditLog({
             action: "settings_change",
@@ -6256,9 +6248,9 @@ function createHonoApp(options) {
           draft: true
         });
         if (!originalDoc) return c.json({ error: "Global not found" }, 404);
-        let publishData = { publishStatus: "published", hasDraft: false };
+        let publishData = { status: "published" };
         let finalContent = originalDoc;
-        if (originalDoc.hasDraft) {
+        if (globalConfig.versions?.drafts) {
           const versions = await db.findVersions({
             collection: collectionSlug,
             documentId: slug,
@@ -6266,7 +6258,7 @@ function createHonoApp(options) {
             sort: "-createdAt",
             tenantID: ctxTenantID
           });
-          if (versions.docs.length > 0 && versions.docs[0].status === "draft") {
+          if (versions.docs.length > 0) {
             finalContent = { ...originalDoc, ...versions.docs[0].data };
             publishData = { ...versions.docs[0].data, ...publishData };
           }
@@ -6281,7 +6273,7 @@ function createHonoApp(options) {
           await db.createVersion({
             collection: collectionSlug,
             documentId: slug,
-            data: { ...finalContent, publishStatus: "published" },
+            data: { ...finalContent, status: "published" },
             status: "published",
             createdBy: ctxUser?.id,
             changeDescription: "Published",
@@ -6301,7 +6293,7 @@ function createHonoApp(options) {
         const doc = await db.update({
           collection: `_globals_${slug}`,
           id: slug,
-          data: { publishStatus: "draft", hasDraft: false },
+          data: { status: "draft" },
           tenantID: ctxTenantID
         });
         return c.json({ data: doc, message: "Unpublished successfully" });
@@ -6361,9 +6353,13 @@ function createHonoApp(options) {
         const doc = await db.update({
           collection: collectionSlug,
           id: slug,
-          data: { ...version.data, publishStatus: "draft", hasDraft: false },
+          data: { ...version.data, status: "draft" },
           tenantID: ctxTenantID
         });
+        return c.json({
+          data: doc,
+          message: "Version restored successfully"
+        });
         return c.json({ data: doc, message: "Restored successfully" });
       } catch (error) {
         return c.json({ error: error.message }, 500);
@@ -6466,5 +6462,5 @@ function createRESTAPI(registry, db, options) {
 }
 
 export { AuditLogger, AuthRoutes, InMemoryAuditLogger, InMemoryRateLimiter, MediaService, createAuditContext2 as createAuditContext, createCloudinaryStorage, createFtpStorage, createHonoApp, createLocalStorage, createRESTAPI, createS3Storage, getAppSecret, getDefaultRegistry, getEncryptionKey, getSessionConfig, init_secret, loadSecrets, resolveProvider, setDbAdapter };
-//# sourceMappingURL=chunk-PU2Z5VWF.js.map
-//# sourceMappingURL=chunk-PU2Z5VWF.js.map
+//# sourceMappingURL=chunk-IPTZM3VE.js.map
+//# sourceMappingURL=chunk-IPTZM3VE.js.map