@kyro-cms/core 0.9.1 → 0.9.4

package/dist/{chunk-RSF3UU7H.cjs → chunk-CNKT4PME.cjs}

@@ -1,17 +1,17 @@
 'use strict';
 
-var chunkWNCYAKF3_cjs = require('./chunk-WNCYAKF3.cjs');
+var chunkY7AQK4R4_cjs = require('./chunk-Y7AQK4R4.cjs');
 var chunkKC2GDBLS_cjs = require('./chunk-KC2GDBLS.cjs');
 var chunkIDVRRRAK_cjs = require('./chunk-IDVRRRAK.cjs');
 var chunkADLJSJSN_cjs = require('./chunk-ADLJSJSN.cjs');
 var chunkQFLB4EIJ_cjs = require('./chunk-QFLB4EIJ.cjs');
 var chunk4M7X5HAB_cjs = require('./chunk-4M7X5HAB.cjs');
-var chunkCOIASRDK_cjs = require('./chunk-COIASRDK.cjs');
-var chunkC36TMDTY_cjs = require('./chunk-C36TMDTY.cjs');
-var chunkV2TVSCV5_cjs = require('./chunk-V2TVSCV5.cjs');
+var chunkRFFSZSCL_cjs = require('./chunk-RFFSZSCL.cjs');
+var chunk7OS7TX2Q_cjs = require('./chunk-7OS7TX2Q.cjs');
+var chunkQ23GAMLE_cjs = require('./chunk-Q23GAMLE.cjs');
 var chunkGXFOGU7N_cjs = require('./chunk-GXFOGU7N.cjs');
 var chunkNKPKR5BW_cjs = require('./chunk-NKPKR5BW.cjs');
-var chunkG7VZBCD6_cjs = require('./chunk-G7VZBCD6.cjs');
+var chunkCZLDE2OZ_cjs = require('./chunk-CZLDE2OZ.cjs');
 var crypto = require('crypto');
 var unstorage = require('unstorage');
 var fsDriver = require('unstorage/drivers/fs');
@@ -22,6 +22,7 @@ var sharp = require('sharp');
 var promises = require('fs/promises');
 var process2 = require('process');
 var clientS3 = require('@aws-sdk/client-s3');
+var nodeHttpHandler = require('@smithy/node-http-handler');
 var stream = require('stream');
 var basicFtp = require('basic-ftp');
 var zodToJsonSchema = require('zod-to-json-schema');
@@ -41,8 +42,8 @@ async function loadSecrets() {
   if (dbAdapter) {
     try {
       const result = await dbAdapter.findOne({
-        collection: "_globals",
-        where: { slug: "system" }
+        collection: "_globals_system",
+        where: {}
       });
       if (result) {
         cachedSecrets = {
@@ -91,7 +92,7 @@ function getSessionConfig() {
   };
 }
 var dbAdapter, cachedSecrets;
-var init_secret = chunkG7VZBCD6_cjs.__esm({
+var init_secret = chunkCZLDE2OZ_cjs.__esm({
   "src/lib/secret.ts"() {
     dbAdapter = null;
     cachedSecrets = null;
@@ -100,7 +101,7 @@ var init_secret = chunkG7VZBCD6_cjs.__esm({
 
 // src/api/rest/auth-session.ts
 var auth_session_exports = {};
-chunkG7VZBCD6_cjs.__export(auth_session_exports, {
+chunkCZLDE2OZ_cjs.__export(auth_session_exports, {
   SESSION_CONFIG: () => SESSION_CONFIG,
   clearSessionCookie: () => clearSessionCookie,
   createSession: () => createSession,
@@ -366,7 +367,7 @@ async function getCurrentUser(request) {
   return session;
 }
 var sessionConfig, SESSION_CONFIG, SESSION_COOKIE_NAME, storage;
-var init_auth_session = chunkG7VZBCD6_cjs.__esm({
+var init_auth_session = chunkCZLDE2OZ_cjs.__esm({
   "src/api/rest/auth-session.ts"() {
     init_secret();
     sessionConfig = getSessionConfig();
@@ -452,6 +453,9 @@ function createTenantContextFromUser(user) {
   };
 }
 
+// src/api/rest/hono-app.ts
+init_secret();
+
 // src/auth/security/in-memory-rate-limit.ts
 var InMemoryRateLimiter = class {
   storage = /* @__PURE__ */ new Map();
@@ -959,7 +963,7 @@ var AuthRoutes = class {
   constructor(config) {
     this.authAdapter = config.redis;
     this.email = config.email;
-    this.passwordPolicy = config.passwordPolicy || new chunkWNCYAKF3_cjs.PasswordPolicy();
+    this.passwordPolicy = config.passwordPolicy || new chunkY7AQK4R4_cjs.PasswordPolicy();
     this.lockout = config.lockout;
     this.rateLimiter = config.rateLimiter;
     this.auditLogger = config.auditLogger;
@@ -1450,7 +1454,7 @@ var AuthRoutes = class {
       return this.errorResponse("No session", 401);
     }
     try {
-      const updatedSession = await (init_auth_session(), chunkG7VZBCD6_cjs.__toCommonJS(auth_session_exports)).refreshSession(sessionId, req);
+      const updatedSession = await (init_auth_session(), chunkCZLDE2OZ_cjs.__toCommonJS(auth_session_exports)).refreshSession(sessionId, req);
       if (!updatedSession) {
         return this.errorResponse("Session not found", 404);
       }
@@ -2233,7 +2237,7 @@ function createS3Storage(config) {
     tls: true,
     // R2 requires specific SSL configuration
     ...config.provider === "r2" && {
-      requestHandler: new (chunkG7VZBCD6_cjs.__require("@smithy/node-http-handler")).NodeHttpHandler({
+      requestHandler: new nodeHttpHandler.NodeHttpHandler({
         connectionTimeout: 1e4,
         socketTimeout: 1e4
       })
@@ -2848,17 +2852,15 @@ var MediaService = class _MediaService {
     this.db = db;
     this.storage = storage2;
     this.dialect = options?.dialect || "sqlite";
-    this.genId = options?.genId || chunkCOIASRDK_cjs.genId;
+    this.genId = options?.genId || chunkRFFSZSCL_cjs.genId;
   }
   static async init(db, options) {
     let storage2;
     if (options?.storageConfig) {
       storage2 = await resolveProviderWithConfig(options.storageConfig);
     } else {
-      const configService = new chunkWNCYAKF3_cjs.ConfigService(db);
-      if (typeof db?.select === "function") {
-        await configService.load();
-      }
+      const configService = new chunkY7AQK4R4_cjs.ConfigService(db);
+      await configService.load();
       storage2 = await resolveProvider(configService);
     }
     const service = new _MediaService(db, storage2, options);
@@ -3060,7 +3062,7 @@ var MediaService = class _MediaService {
         ]
       );
     } else {
-      const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+      const { media: mediaSchema } = await import('./media-TUSLVRQ6.cjs');
       const mime = storageResult.mimeType;
       const mediaType = mime.startsWith("image/") ? "image" : mime.startsWith("video/") ? "video" : mime.startsWith("audio/") ? "audio" : mime.startsWith("application/pdf") ? "document" : ["application/zip", "application/x-zip", "application/x-tar", "application/gzip", "application/x-7z"].includes(mime) ? "archive" : "other";
       await this.db.insert(mediaSchema).values({
@@ -3122,7 +3124,7 @@ var MediaService = class _MediaService {
         id
       ]);
     } else {
-      const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+      const { media: mediaSchema } = await import('./media-TUSLVRQ6.cjs');
       const { eq } = await import('drizzle-orm');
       const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
       if (row) item = this.rowToMedia(row);
@@ -3138,7 +3140,7 @@ var MediaService = class _MediaService {
     if (this.dialect === "sqlite") {
       await this.sqliteRun(`DELETE FROM ${this.mediaTable} WHERE id = ?`, [id]);
     } else {
-      const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+      const { media: mediaSchema } = await import('./media-TUSLVRQ6.cjs');
       const { eq } = await import('drizzle-orm');
       await this.db.delete(mediaSchema).where(eq(mediaSchema.id, id));
     }
@@ -3153,7 +3155,7 @@ var MediaService = class _MediaService {
         id
       ]);
     } else {
-      const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+      const { media: mediaSchema } = await import('./media-TUSLVRQ6.cjs');
       const { eq } = await import('drizzle-orm');
       const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
       if (row) item = this.rowToMedia(row);
@@ -3188,7 +3190,7 @@ var MediaService = class _MediaService {
         [...vals, this.now(), id]
       );
     } else {
-      const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+      const { media: mediaSchema } = await import('./media-TUSLVRQ6.cjs');
       const { eq } = await import('drizzle-orm');
       await this.db.update(mediaSchema).set({ ...updateData, updatedAt: this.now() }).where(eq(mediaSchema.id, id));
     }
@@ -3207,7 +3209,7 @@ var MediaService = class _MediaService {
       );
       return row2 ? this.rowToMedia(row2) : null;
     }
-    const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+    const { media: mediaSchema } = await import('./media-TUSLVRQ6.cjs');
     const { eq } = await import('drizzle-orm');
     const [row] = await this.db.select().from(mediaSchema).where(eq(mediaSchema.id, id));
     return row ? this.rowToMedia(row) : null;
@@ -3255,7 +3257,7 @@ var MediaService = class _MediaService {
         totalPages: Math.ceil(totalDocs2 / limit)
       };
     }
-    const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+    const { media: mediaSchema } = await import('./media-TUSLVRQ6.cjs');
     const { like, or, and, asc, desc, eq, sql } = await import('drizzle-orm');
     const conditions = [];
     if (search) {
@@ -3334,7 +3336,7 @@ var MediaService = class _MediaService {
       );
       return row ? this.rowToMedia(row) : null;
     }
-    const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+    const { media: mediaSchema } = await import('./media-TUSLVRQ6.cjs');
     const { eq } = await import('drizzle-orm');
     const [updated] = await this.db.update(mediaSchema).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq(mediaSchema.id, id)).returning();
     return updated ? this.rowToMedia(updated) : null;
@@ -3356,7 +3358,7 @@ var MediaService = class _MediaService {
         );
       }
     } else {
-      const { media: mediaSchema } = await import('./media-XNTUFJZR.cjs');
+      const { media: mediaSchema } = await import('./media-TUSLVRQ6.cjs');
       const { eq } = await import('drizzle-orm');
       for (const id of ids) {
         await this.db.update(mediaSchema).set({ ...data, updatedAt: /* @__PURE__ */ new Date() }).where(eq(mediaSchema.id, id));
@@ -3371,7 +3373,7 @@ var MediaService = class _MediaService {
       );
       return rows.map((r) => r.path).filter((f) => f && f !== "").sort();
     }
-    const { media: mediaSchema, mediaFolders: folderSchema } = await import('./media-XNTUFJZR.cjs');
+    const { media: mediaSchema, mediaFolders: folderSchema } = await import('./media-TUSLVRQ6.cjs');
     const { eq, sql } = await import('drizzle-orm');
     const fromMedia = await this.db.select({ folder: mediaSchema.folder }).from(mediaSchema).groupBy(mediaSchema.folder);
     const fromFolders = await this.db.select({ path: folderSchema.path }).from(folderSchema);
@@ -3391,7 +3393,7 @@ var MediaService = class _MediaService {
         [fullPath, name, parentPath || null, now]
       );
     } else {
-      const { mediaFolders: folderSchema } = await import('./media-XNTUFJZR.cjs');
+      const { mediaFolders: folderSchema } = await import('./media-TUSLVRQ6.cjs');
       await this.db.insert(folderSchema).values({
         path: fullPath,
         name,
@@ -3412,7 +3414,7 @@ var MediaService = class _MediaService {
         [folder, `${folder}/%`]
       );
     } else {
-      const { mediaFolders: folderSchema } = await import('./media-XNTUFJZR.cjs');
+      const { mediaFolders: folderSchema } = await import('./media-TUSLVRQ6.cjs');
       const { like, or, eq } = await import('drizzle-orm');
       await this.db.delete(folderSchema).where(
         or(
@@ -3426,6 +3428,38 @@ var MediaService = class _MediaService {
 function formatZodErrors(errors) {
   return errors.map((e) => `${e.path.join(".")}: ${e.message}`).join(", ");
 }
+function normalizeEmptyStrings(data, fields) {
+  if (!data || typeof data !== "object") return;
+  for (const field of fields) {
+    if (!field.name || !(field.name in data)) continue;
+    const val = data[field.name];
+    if (val === "") {
+      const isTextual = field.type === "text" || field.type === "textarea" || field.type === "code" || field.type === "markdown" || field.type === "email" || field.type === "password" || field.type === "color";
+      if (!isTextual) data[field.name] = null;
+    }
+    if (field.type === "tabs" && field.name && Array.isArray(field.tabs) && data[field.name] && typeof data[field.name] === "object") {
+      for (const tab of field.tabs) {
+        if (Array.isArray(tab.fields)) normalizeEmptyStrings(data[field.name], tab.fields);
+      }
+    } else if ((field.type === "group" || field.type === "collapsible") && field.name && Array.isArray(field.fields) && data[field.name] && typeof data[field.name] === "object") {
+      normalizeEmptyStrings(data[field.name], field.fields);
+    } else if (field.type === "array" && field.name && Array.isArray(field.fields) && Array.isArray(data[field.name])) {
+      for (const item of data[field.name]) {
+        if (item && typeof item === "object") normalizeEmptyStrings(item, field.fields);
+      }
+    } else if (field.type === "blocks" && field.name && Array.isArray(field.blocks) && Array.isArray(data[field.name])) {
+      for (const item of data[field.name]) {
+        if (!item || typeof item !== "object") continue;
+        const blockTypeStr = item.type || item.blockType;
+        if (!blockTypeStr) continue;
+        const blockDef = field.blocks.find((b) => b.slug === blockTypeStr);
+        if (!blockDef || !Array.isArray(blockDef.fields)) continue;
+        const target = item.data && typeof item.data === "object" ? item.data : item;
+        normalizeEmptyStrings(target, blockDef.fields);
+      }
+    }
+  }
+}
 function convertRichtextFields(fields, data) {
   if (!data || typeof data !== "object") return;
   for (const field of fields) {
@@ -3447,6 +3481,16 @@ function convertRichtextFields(fields, data) {
       for (const item of data[field.name]) {
         if (item && typeof item === "object") convertRichtextFields(field.fields, item);
       }
+    } else if (field.type === "blocks" && field.name && Array.isArray(field.blocks) && Array.isArray(data[field.name])) {
+      for (const item of data[field.name]) {
+        if (!item || typeof item !== "object") continue;
+        const blockTypeStr = item.type || item.blockType;
+        if (!blockTypeStr) continue;
+        const blockDef = field.blocks.find((b) => b.slug === blockTypeStr);
+        if (!blockDef || !Array.isArray(blockDef.fields)) continue;
+        const target = item.data && typeof item.data === "object" ? item.data : item;
+        convertRichtextFields(blockDef.fields, target);
+      }
     }
   }
 }
@@ -3543,7 +3587,7 @@ async function checkCollectionAccess(collection, operation, req, ctxUser, ctxTen
       };
     }
   }
-  if (ctxUser) {
+  if (ctxUser && !(apiKeyContext?.permissions?.length > 0)) {
     const resource = collection.slug;
     const action = operation === "read" ? "read" : operation === "create" ? "create" : operation === "update" ? "update" : "delete";
     const permission = `${resource}:${action}`;
@@ -3629,10 +3673,10 @@ async function resolveAuthContext(req, authMw, staticUser, staticTenantID) {
   };
 }
 function createDefaultAuthAdapter(db, rootDir) {
-  if (db instanceof chunkCOIASRDK_cjs.DrizzleAdapter && db.dialect === "postgres") {
-    return new chunkC36TMDTY_cjs.PostgresAuthAdapter({ db: db.client });
+  if (db instanceof chunkRFFSZSCL_cjs.DrizzleAdapter && db.dialect === "postgres") {
+    return new chunk7OS7TX2Q_cjs.PostgresAuthAdapter({ db: db.client });
   }
-  if (db instanceof chunkV2TVSCV5_cjs.MongoDBAdapter) {
+  if (db instanceof chunkQ23GAMLE_cjs.MongoDBAdapter) {
     return new chunkGXFOGU7N_cjs.MongoDBAuthAdapter({ db: db.db });
   }
   const defaultAuthDbPath = path.resolve(rootDir, "data", "kyro.db");
@@ -3739,6 +3783,13 @@ function createHonoApp(options) {
     baseUrl: process.env.KYRO_BASE_URL || "http://localhost:4321",
     rateLimiter
   });
+  chunkY7AQK4R4_cjs.EmailTransport.fromConfig(db).then((transport) => {
+    if (transport) {
+      authRoutes.email = transport;
+    }
+  }).catch((err) => {
+    console.error("[Email] Failed to initialize transport from config:", err);
+  });
   app.post("/api/auth/login", async (c) => authRoutes.login(c.req.raw));
   app.post("/api/auth/register", async (c) => authRoutes.register(c.req.raw));
   app.post("/api/auth/logout", async (c) => authRoutes.logout(c.req.raw));
@@ -4137,8 +4188,8 @@ function createHonoApp(options) {
     }
     if (!mediaService) {
       try {
-        const dialect = db instanceof chunkCOIASRDK_cjs.DrizzleAdapter ? db.dialect : "sqlite";
-        const mediaDb = dialect === "postgres" && db instanceof chunkCOIASRDK_cjs.DrizzleAdapter ? db.client : db;
+        const dialect = db instanceof chunkRFFSZSCL_cjs.DrizzleAdapter ? db.dialect : "sqlite";
+        const mediaDb = dialect === "postgres" && db instanceof chunkRFFSZSCL_cjs.DrizzleAdapter ? db.client : db;
         mediaService = await MediaService.init(mediaDb, { dialect });
       } catch (error) {
         console.error("[getMedia] Init error:", error);
@@ -4814,15 +4865,13 @@ function createHonoApp(options) {
   });
   app.get("/api/keys", async (c) => {
     try {
-      const { user: ctxUser } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
+      const { user: ctxUser, tenantID: ctxTenantID } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
       if (!ctxUser || !chunkNKPKR5BW_cjs.hasPermission(ctxUser, "users:read")) {
         return c.json({ error: "Forbidden" }, 403);
       }
       const page = parseInt(c.req.query("page") || "1");
       const limit = Math.min(parseInt(c.req.query("limit") || "50"), 100);
-      console.log("[ApiKeys] Querying", chunk4M7X5HAB_cjs.API_KEY_COLLECTION, { page, limit });
-      const result = await db.find({ collection: chunk4M7X5HAB_cjs.API_KEY_COLLECTION, where: {}, page, limit });
-      console.log("[ApiKeys] Result:", result);
+      const result = await db.find({ collection: chunk4M7X5HAB_cjs.API_KEY_COLLECTION, where: {}, page, limit, tenantID: ctxTenantID });
       const docs = (result.docs || []).map((doc) => ({
         id: doc.id,
         name: doc.name,
@@ -5215,36 +5264,6 @@ function createHonoApp(options) {
         return c.json({ error: error.message }, 500);
       }
     });
-    app.get(`${basePath}/:id/draft`, async (c) => {
-      try {
-        const {
-          user: ctxUser,
-          tenantID: ctxTenantID,
-          apiKeyContext
-        } = await resolveAuthContext(c.req.raw, authMw, user, tenantID);
-        const access = await checkCollectionAccess(
-          collection,
-          "read",
-          c.req.raw,
-          ctxUser,
-          ctxTenantID,
-          apiKeyContext,
-          enablePublicAccess,
-          defaultCollectionAccess
-        );
-        if (!access.allowed) {
-          return c.json({ error: access.error }, access.status || 403);
-        }
-        const draft = await db.findDraft({
-          collection: slug,
-          documentId: c.req.param("id"),
-          tenantID: ctxTenantID
-        });
-        return c.json({ data: draft });
-      } catch (error) {
-        return c.json({ error: error.message }, 500);
-      }
-    });
     app.put(`${basePath}/:id/draft`, async (c) => {
       try {
         const {
@@ -5283,13 +5302,12 @@ function createHonoApp(options) {
         } else {
           finalData = body.data ?? omitRevisionFields(body);
         }
-        const draft = await db.upsertDraft({
+        const version = await db.updateLatestVersion({
           collection: slug,
           documentId: id,
-          tenantID: ctxTenantID,
           data: finalData,
-          baseUpdatedAt,
-          draftUpdatedAt: body.draftUpdatedAt
+          status: "draft",
+          tenantID: ctxTenantID
         });
         if (ctxUser) {
           sessionAuthAdapter?.createAuditLog({
@@ -5301,7 +5319,7 @@ function createHonoApp(options) {
             metadata: { type: "draft_save" }
           });
         }
-        return c.json({ data: draft, message: "Draft saved successfully" });
+        return c.json({ data: version, message: "Draft saved successfully" });
       } catch (error) {
         return c.json({ error: error.message }, 500);
       }
@@ -5326,11 +5344,6 @@ function createHonoApp(options) {
         if (!access.allowed) {
           return c.json({ error: access.error }, access.status || 403);
         }
-        await db.deleteDraft({
-          collection: slug,
-          documentId: c.req.param("id"),
-          tenantID: ctxTenantID
-        });
         if (ctxUser) {
           sessionAuthAdapter?.createAuditLog({
             action: "document_update",
@@ -5422,14 +5435,7 @@ function createHonoApp(options) {
         auditApiKeyUsage(sessionAuthAdapter, apiKeyContext, basePath, "POST", c.req.raw);
         const body = await c.req.json();
         let validated = body;
-        for (const field of collection.fields) {
-          if (field.name && validated[field.name] === "") {
-            const isTextual = field.type === "text" || field.type === "textarea" || field.type === "code" || field.type === "markdown" || field.type === "email" || field.type === "password" || field.type === "color";
-            if (!isTextual) {
-              validated[field.name] = null;
-            }
-          }
-        }
+        normalizeEmptyStrings(validated, collection.fields);
         convertRichtextFields(collection.fields, validated);
         const hookReq = c.req.raw;
         if (collection.hooks?.beforeValidate) {
@@ -5455,10 +5461,7 @@ function createHonoApp(options) {
           validated.tenantID = ctxTenantID;
         }
         const isDraftEnabled = collection.versions?.drafts === true;
-        if (isDraftEnabled) {
-          validated.publishStatus = "draft";
-          validated.hasDraft = false;
-        }
+        validated.status = isDraftEnabled ? "draft" : "published";
         if (collection.hooks?.beforeChange) {
           for (const hook of collection.hooks.beforeChange) {
             const hookResult = await hook({
@@ -5477,6 +5480,17 @@ function createHonoApp(options) {
           data: validated,
           tenantID: ctxTenantID
         });
+        if (isDraftEnabled) {
+          await db.createVersion({
+            collection: slug,
+            documentId: doc.id,
+            data: validated,
+            status: "draft",
+            createdBy: ctxUser?.id,
+            changeDescription: "Created",
+            tenantID: ctxTenantID
+          });
+        }
         if (collection.hooks?.afterChange) {
           for (const hook of collection.hooks.afterChange) {
             await hook({
@@ -5542,11 +5556,6 @@ function createHonoApp(options) {
         const id = c.req.param("id");
         const body = await c.req.json();
         const baseUpdatedAt = readBaseUpdatedAt(body);
-        console.log(`[PATCH] ${slug}/${id}`, {
-          baseUpdatedAt,
-          bodyKeys: Object.keys(body),
-          tenantID: ctxTenantID
-        });
         const originalDoc = await db.findByID({
           collection: slug,
           id,
@@ -5564,14 +5573,7 @@ function createHonoApp(options) {
             ([_, v]) => v !== "null" && v !== void 0
           )
         );
-        for (const field of collection.fields) {
-          if (field.name && validated[field.name] === "") {
-            const isTextual = field.type === "text" || field.type === "textarea" || field.type === "code" || field.type === "markdown" || field.type === "email" || field.type === "password" || field.type === "color";
-            if (!isTextual) {
-              validated[field.name] = null;
-            }
-          }
-        }
+        normalizeEmptyStrings(validated, collection.fields);
         convertRichtextFields(collection.fields, validated);
         const hookReq = c.req.raw;
         if (collection.hooks?.beforeValidate) {
@@ -5604,37 +5606,44 @@ function createHonoApp(options) {
             if (hookResult) Object.assign(validated, hookResult);
           }
         }
-        console.log(`[PATCH] Validated data:`, Object.keys(validated));
+        const isDraft = c.req.header("X-Draft") === "true";
         const isDraftEnabled = collection.versions?.drafts === true;
-        const isAlreadyPublished = originalDoc.publishStatus === "published";
+        const isAutosave = c.req.query("autosave") === "true";
         let doc;
-        if (isDraftEnabled && isAlreadyPublished) {
+        if (isDraftEnabled && isDraft) {
           await db.createVersion({
             collection: slug,
             documentId: id,
             data: validated,
             status: "draft",
+            autosave: isAutosave,
             createdBy: ctxUser?.id,
-            changeDescription: "Manual save (Draft)",
+            changeDescription: isAutosave ? "Autosave" : "Draft saved",
             tenantID: ctxTenantID
           });
+        } else if (isDraftEnabled) {
           await db.update({
             collection: slug,
             id,
-            data: { hasDraft: true },
-            // Keep old data, just set flag
+            data: { ...validated, status: "published" },
+            tenantID: ctxTenantID
+          });
+          await db.createVersion({
+            collection: slug,
+            documentId: id,
+            data: validated,
+            status: "published",
+            createdBy: ctxUser?.id,
+            changeDescription: "Published",
             tenantID: ctxTenantID
           });
         } else {
-          const saveData = isDraftEnabled ? { ...validated, publishStatus: "draft", hasDraft: false } : validated;
-          console.log(`[PATCH] About to call db.update for ${slug}/${id} with keys:`, Object.keys(saveData));
           await db.update({
             collection: slug,
             id,
-            data: saveData,
+            data: validated,
             tenantID: ctxTenantID
           });
-          console.log(`[PATCH] db.update SUCCEEDED for ${slug}/${id}`);
         }
         doc = await db.findByID({
           collection: slug,
@@ -5642,25 +5651,6 @@ function createHonoApp(options) {
           tenantID: ctxTenantID,
           draft: true
         });
-        if (isDraftEnabled) {
-          if (!isAlreadyPublished) {
-            await db.createVersion({
-              collection: slug,
-              documentId: id,
-              data: validated,
-              status: "draft",
-              createdBy: ctxUser?.id,
-              changeDescription: "Manual save",
-              tenantID: ctxTenantID
-            });
-          }
-        } else {
-          await db.deleteDraft({
-            collection: slug,
-            documentId: id,
-            tenantID: ctxTenantID
-          });
-        }
         if (collection.hooks?.afterChange) {
           for (const hook of collection.hooks.afterChange) {
             await hook({
@@ -5732,7 +5722,6 @@ function createHonoApp(options) {
           db.setTenantContext({ tenantId: ctxTenantID, userId: ctxUser?.id ?? "", role: ctxUser?.role, isSuperAdmin: ctxUser?.role === "super_admin" });
         }
         const id = c.req.param("id");
-        console.log(`[DELETE] Deleting ${slug}/${id}`);
         const hookReq = c.req.raw;
         const originalDoc = await db.findByID({
           collection: slug,
@@ -5760,11 +5749,6 @@ function createHonoApp(options) {
           id,
           tenantID: ctxTenantID
         });
-        await db.deleteDraft({
-          collection: slug,
-          documentId: id,
-          tenantID: ctxTenantID
-        });
         if (collection.hooks?.afterDelete) {
           for (const hook of collection.hooks.afterDelete) {
             await hook({
@@ -5806,7 +5790,6 @@ function createHonoApp(options) {
     });
     app.post(`${basePath}/:id/duplicate`, async (c) => {
       try {
-        console.log(`[Duplicate] Request for ${slug}`);
         const {
           user: ctxUser,
           tenantID: ctxTenantID,
@@ -5823,11 +5806,9 @@ function createHonoApp(options) {
           defaultCollectionAccess
         );
         if (!access.allowed) {
-          console.log("[Duplicate] Access denied:", access.error);
           return c.json({ error: access.error }, access.status || 403);
         }
         const id = c.req.param("id");
-        console.log(`[Duplicate] ID: ${id}`);
         const originalDoc = await db.findByID({
           collection: slug,
           id,
@@ -5835,14 +5816,11 @@ function createHonoApp(options) {
           draft: true
         });
         if (!originalDoc) {
-          console.log("[Duplicate] Document not found");
           return c.json({ error: "Document not found" }, 404);
         }
-        console.log(`[Duplicate] Original doc:`, originalDoc);
         const { id: _oldId, createdAt: _oldCreated, updatedAt: _oldUpdated, ...docData } = originalDoc;
         const timestamp = Date.now().toString(36);
         const newSlug = `${originalDoc.slug || "document"}-copy-${timestamp}`;
-        console.log(`[Duplicate] New slug: ${newSlug}`);
         const newDoc = await db.create({
           collection: slug,
           data: {
@@ -5852,7 +5830,6 @@ function createHonoApp(options) {
           },
           tenantID: ctxTenantID
         });
-        console.log(`[Duplicate] Created successfully:`, newDoc.id);
         return c.json({ data: newDoc, message: "Document duplicated successfully" });
       } catch (error) {
         console.error("[Duplicate] Error:", error);
@@ -5892,7 +5869,7 @@ function createHonoApp(options) {
         const doc = await db.update({
           collection: slug,
           id,
-          data: { ...version.data, publishStatus: "draft", hasDraft: false },
+          data: { ...version.data, status: "draft" },
           tenantID: ctxTenantID
         });
         return c.json({
@@ -5937,7 +5914,7 @@ function createHonoApp(options) {
           const doc = await db.update({
             collection: slug,
             id: c.req.param("id"),
-            data: { ...version.data, publishStatus: "draft", hasDraft: false },
+            data: { ...version.data, status: "draft" },
             tenantID: ctxTenantID
           });
           return c.json({
@@ -5988,9 +5965,9 @@ function createHonoApp(options) {
         if (baseUpdatedAt && originalDoc.updatedAt && baseUpdatedAt !== originalDoc.updatedAt) {
           return c.json(buildConflictResponse(baseUpdatedAt, originalDoc), 409);
         }
-        let publishData = { publishStatus: "published", hasDraft: false };
+        let publishData = { status: "published" };
         let finalContent = originalDoc;
-        if (originalDoc.hasDraft) {
+        if (collection.versions?.drafts) {
           const versions = await db.findVersions({
             collection: slug,
             documentId: id,
@@ -5998,9 +5975,10 @@ function createHonoApp(options) {
             sort: "-createdAt",
             tenantID: ctxTenantID
           });
-          if (versions.docs.length > 0 && versions.docs[0].status === "draft") {
-            finalContent = { ...originalDoc, ...versions.docs[0].data };
-            publishData = { ...versions.docs[0].data, ...publishData };
+          if (versions.docs.length > 0) {
+            const latestVersion = versions.docs[0];
+            finalContent = { ...originalDoc, ...latestVersion.data };
+            publishData = { ...latestVersion.data, ...publishData };
           }
         }
         const doc = await db.update({
@@ -6013,18 +5991,13 @@ function createHonoApp(options) {
           await db.createVersion({
             collection: slug,
             documentId: id,
-            data: { ...finalContent, publishStatus: "published" },
+            data: { ...finalContent, status: "published" },
             status: "published",
             createdBy: ctxUser?.id,
             changeDescription: "Published",
             tenantID: ctxTenantID
           });
         }
-        await db.deleteDraft({
-          collection: slug,
-          documentId: id,
-          tenantID: ctxTenantID
-        });
         if (webhookService) {
           webhookService.trigger(getWebhookEvent(slug, "update"), {
             collection: slug,
@@ -6072,7 +6045,7 @@ function createHonoApp(options) {
         const doc = await db.update({
           collection: slug,
           id,
-          data: { publishStatus: "draft" },
+          data: { status: "draft" },
           tenantID: ctxTenantID
         });
         if (webhookService) {
@@ -6107,7 +6080,7 @@ function createHonoApp(options) {
         if (!access.allowed) {
           return c.json({ error: access.error }, access.status || 403);
         }
-        const isDraftRequest = c.req.query("draft") === "true" && !!ctxUser;
+        const isDraftRequest = !!ctxUser;
         let doc = await db.findOne({
           collection: `_globals_${slug}`,
           where: {},
@@ -6155,23 +6128,16 @@ function createHonoApp(options) {
         const cleaned = Object.fromEntries(
           Object.entries(body).filter(([_, v]) => v !== null && v !== "null" && v !== void 0)
         );
-        for (const field of globalConfig.fields) {
-          if (field.name && cleaned[field.name] === "") {
-            const isTextual = field.type === "text" || field.type === "textarea" || field.type === "code" || field.type === "markdown" || field.type === "email" || field.type === "password" || field.type === "color";
-            if (!isTextual) {
-              cleaned[field.name] = null;
-            }
-          }
-        }
+        normalizeEmptyStrings(cleaned, globalConfig.fields);
         convertRichtextFields(globalConfig.fields, cleaned);
-        const schema = registry.getZodSchema(slug);
+        const schema = registry.getUpdateZodSchema(slug);
         let validated;
         try {
           validated = schema.parse(cleaned);
         } catch (zodErr) {
           return c.json({ error: `Validation failed: ${formatZodErrors(zodErr.errors)}`, details: zodErr.errors }, 400);
         }
-        const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["id", "createdAt", "updatedAt", "publishStatus", "hasDraft", "baseUpdatedAt", "_baseUpdatedAt"]);
+        const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["id", "createdAt", "updatedAt", "status", "baseUpdatedAt", "_baseUpdatedAt"]);
         const userData = Object.fromEntries(
           Object.entries(validated).filter(([k]) => !SYSTEM_FIELDS.has(k))
         );
@@ -6182,49 +6148,68 @@ function createHonoApp(options) {
           tenantID: ctxTenantID,
           draft: true
         });
+        const isDraft = c.req.header("X-Draft") === "true";
         const isDraftEnabled = globalConfig.versions?.drafts === true;
-        const isAlreadyPublished = originalDoc?.publishStatus === "published";
+        const isAutosave = c.req.query("autosave") === "true";
         let doc;
-        if (isDraftEnabled && isAlreadyPublished) {
+        if (isDraftEnabled && isDraft) {
           await db.createVersion({
             collection: collectionSlug,
             documentId: slug,
             data: userData,
             status: "draft",
+            autosave: isAutosave,
             createdBy: ctxUser?.id,
-            changeDescription: "Manual save (Draft)",
+            changeDescription: isAutosave ? "Autosave" : "Manual save",
             tenantID: ctxTenantID
           });
-          doc = await db.update({
-            collection: collectionSlug,
-            id: slug,
-            data: { hasDraft: true },
-            tenantID: ctxTenantID
-          });
-        } else {
-          const saveData = isDraftEnabled ? { ...userData, publishStatus: "draft", hasDraft: false } : { ...userData, publishStatus: "published", hasDraft: false };
+          if (!originalDoc) {
+            doc = await db.create({
+              collection: collectionSlug,
+              data: { ...userData, id: slug, status: "draft" },
+              tenantID: ctxTenantID
+            });
+          } else {
+            doc = originalDoc;
+          }
+        } else if (isDraftEnabled && !isDraft) {
+          const publishStatus = "published";
           if (originalDoc) {
             doc = await db.update({
               collection: collectionSlug,
               id: slug,
-              data: saveData,
+              data: { ...userData, status: publishStatus },
               tenantID: ctxTenantID
             });
           } else {
             doc = await db.create({
               collection: collectionSlug,
-              data: { ...saveData, id: slug },
+              data: { ...userData, id: slug, status: publishStatus },
               tenantID: ctxTenantID
             });
           }
-          if (isDraftEnabled) {
-            await db.createVersion({
+          await db.createVersion({
+            collection: collectionSlug,
+            documentId: slug,
+            data: userData,
+            status: publishStatus,
+            autosave: false,
+            createdBy: ctxUser?.id,
+            changeDescription: "Published",
+            tenantID: ctxTenantID
+          });
+        } else {
+          if (originalDoc) {
+            doc = await db.update({
               collection: collectionSlug,
-              documentId: slug,
+              id: slug,
               data: userData,
-              status: "draft",
-              createdBy: ctxUser?.id,
-              changeDescription: "Manual save",
+              tenantID: ctxTenantID
+            });
+          } else {
+            doc = await db.create({
+              collection: collectionSlug,
+              data: { ...userData, id: slug },
               tenantID: ctxTenantID
             });
           }
@@ -6233,6 +6218,13 @@ function createHonoApp(options) {
           mediaService = null;
           mediaServiceInitError = null;
         }
+        if (slug === "email-settings") {
+          const newEmailTransport = await chunkY7AQK4R4_cjs.EmailTransport.fromConfig(db);
+          authRoutes.email = newEmailTransport || void 0;
+        }
+        if (slug === "system") {
+          await loadSecrets();
+        }
         if (ctxUser) {
           sessionAuthAdapter?.createAuditLog({
             action: "settings_change",
@@ -6266,9 +6258,9 @@ function createHonoApp(options) {
           draft: true
         });
         if (!originalDoc) return c.json({ error: "Global not found" }, 404);
-        let publishData = { publishStatus: "published", hasDraft: false };
+        let publishData = { status: "published" };
         let finalContent = originalDoc;
-        if (originalDoc.hasDraft) {
+        if (globalConfig.versions?.drafts) {
           const versions = await db.findVersions({
             collection: collectionSlug,
             documentId: slug,
@@ -6276,7 +6268,7 @@ function createHonoApp(options) {
             sort: "-createdAt",
             tenantID: ctxTenantID
           });
-          if (versions.docs.length > 0 && versions.docs[0].status === "draft") {
+          if (versions.docs.length > 0) {
             finalContent = { ...originalDoc, ...versions.docs[0].data };
             publishData = { ...versions.docs[0].data, ...publishData };
           }
@@ -6291,7 +6283,7 @@ function createHonoApp(options) {
           await db.createVersion({
             collection: collectionSlug,
             documentId: slug,
-            data: { ...finalContent, publishStatus: "published" },
+            data: { ...finalContent, status: "published" },
             status: "published",
             createdBy: ctxUser?.id,
             changeDescription: "Published",
@@ -6311,7 +6303,7 @@ function createHonoApp(options) {
         const doc = await db.update({
           collection: `_globals_${slug}`,
           id: slug,
-          data: { publishStatus: "draft", hasDraft: false },
+          data: { status: "draft" },
           tenantID: ctxTenantID
         });
         return c.json({ data: doc, message: "Unpublished successfully" });
@@ -6371,9 +6363,13 @@ function createHonoApp(options) {
         const doc = await db.update({
           collection: collectionSlug,
           id: slug,
-          data: { ...version.data, publishStatus: "draft", hasDraft: false },
+          data: { ...version.data, status: "draft" },
           tenantID: ctxTenantID
         });
+        return c.json({
+          data: doc,
+          message: "Version restored successfully"
+        });
         return c.json({ data: doc, message: "Restored successfully" });
       } catch (error) {
         return c.json({ error: error.message }, 500);
@@ -6417,7 +6413,7 @@ function createHonoApp(options) {
             mailgun: body.mailgun,
             ses: body.ses
           };
-          const transport = new chunkWNCYAKF3_cjs.EmailTransport(transportConfig);
+          const transport = new chunkY7AQK4R4_cjs.EmailTransport(transportConfig);
           const recipient = body.testEmail || body.testEmailSection && body.testEmailSection.testEmail;
           if (!recipient) {
             return c.json({ error: "No test recipient email provided" }, 400);
@@ -6495,5 +6491,5 @@ exports.init_secret = init_secret;
 exports.loadSecrets = loadSecrets;
 exports.resolveProvider = resolveProvider;
 exports.setDbAdapter = setDbAdapter;
-//# sourceMappingURL=chunk-RSF3UU7H.cjs.map
-//# sourceMappingURL=chunk-RSF3UU7H.cjs.map
+//# sourceMappingURL=chunk-CNKT4PME.cjs.map
+//# sourceMappingURL=chunk-CNKT4PME.cjs.map