@kyro-cms/core 0.9.7 → 0.9.9

package/dist/chunk-5RPRLTTN.js

@@ -0,0 +1,861 @@
+import { hasApiKeyPermission, evaluateAccess } from './chunk-3AKCVYDB.js';
+import { hasPermission } from './chunk-L4EZKIEX.js';
+import { GraphQLScalarType, Kind, GraphQLObjectType, GraphQLString, GraphQLInputObjectType, GraphQLBoolean, GraphQLInt, GraphQLList, GraphQLNonNull, GraphQLSchema, GraphQLFloat } from 'graphql';
+export { printSchema } from 'graphql';
+
+var RelationLoader = class {
+  db;
+  tenantID;
+  user;
+  caches = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  waiting = /* @__PURE__ */ new Map();
+  flushScheduled = false;
+  constructor(opts) {
+    this.db = opts.db;
+    this.tenantID = opts.tenantID;
+    this.user = opts.user;
+  }
+  getCacheKey(collection) {
+    return collection;
+  }
+  async load(collection, id) {
+    const key = this.getCacheKey(collection);
+    let cache = this.caches.get(key);
+    if (!cache) {
+      cache = /* @__PURE__ */ new Map();
+      this.caches.set(key, cache);
+    }
+    if (cache.has(id)) {
+      return cache.get(id);
+    }
+    let pendingSet = this.pending.get(key);
+    if (!pendingSet) {
+      pendingSet = /* @__PURE__ */ new Set();
+      this.pending.set(key, pendingSet);
+    }
+    pendingSet.add(id);
+    cache.set(id, void 0);
+    if (!this.flushScheduled) {
+      this.flushScheduled = true;
+      queueMicrotask(() => {
+        this.flushScheduled = false;
+        this.flushAll();
+      });
+    }
+    return new Promise((resolve) => {
+      this.waiting.set(`${key}:${id}`, resolve);
+    });
+  }
+  async flushAll() {
+    for (const [key, ids] of this.pending) {
+      if (ids.size === 0) continue;
+      const cache = this.caches.get(key);
+      const docs = await this.db.find({
+        collection: key,
+        where: { id: { in: Array.from(ids) } },
+        limit: ids.size,
+        tenantID: this.tenantID,
+        draft: !!this.user
+      });
+      for (const doc of docs.docs || []) {
+        if (doc && doc.id) {
+          cache.set(doc.id, doc);
+          const resolve = this.waiting.get(`${key}:${doc.id}`);
+          if (resolve) {
+            resolve(doc);
+            this.waiting.delete(`${key}:${doc.id}`);
+          }
+        }
+      }
+    }
+    for (const [keyId, resolve] of this.waiting) {
+      resolve(void 0);
+    }
+    this.waiting.clear();
+    this.pending.clear();
+  }
+  resolveOne(collection, id) {
+    return this.caches.get(this.getCacheKey(collection))?.get(id);
+  }
+};
+var GraphQLJSON = new GraphQLScalarType({
+  name: "JSON",
+  description: "Arbitrary JSON value",
+  serialize(value) {
+    return value;
+  },
+  parseValue(value) {
+    return value;
+  },
+  parseLiteral(ast) {
+    switch (ast.kind) {
+      case Kind.STRING:
+        return ast.value;
+      case Kind.INT:
+      case Kind.FLOAT:
+        return parseFloat(ast.value);
+      case Kind.BOOLEAN:
+        return ast.value;
+      case Kind.OBJECT: {
+        const obj = {};
+        for (const field of ast.fields) {
+          obj[field.name.value] = GraphQLJSON.parseLiteral(field.value);
+        }
+        return obj;
+      }
+      case Kind.LIST:
+        return ast.values.map((v) => GraphQLJSON.parseLiteral(v));
+      case Kind.NULL:
+        return null;
+      default:
+        return null;
+    }
+  }
+});
+function depthLimit(maxDepth) {
+  return (validationContext) => {
+    let depth = 0;
+    return {
+      Field() {
+        depth++;
+        if (depth > maxDepth) {
+          validationContext.reportError(
+            new Error(`Query exceeds max depth of ${maxDepth}`)
+          );
+        }
+      },
+      leaveField() {
+        depth--;
+      }
+    };
+  };
+}
+function toPascal(slug) {
+  return slug.split(/[-_]/).map((s) => s.charAt(0).toUpperCase() + s.slice(1)).join("");
+}
+function toCamel(slug) {
+  const p = toPascal(slug);
+  return p.charAt(0).toLowerCase() + p.slice(1);
+}
+function toSingular(slug) {
+  return slug.endsWith("s") && slug.length > 1 ? slug.slice(0, -1) : slug;
+}
+async function checkGraphQLAccess(collection, operation, context) {
+  const accessRule = collection.access?.[operation];
+  if (context.apiKey) {
+    if (context.apiKey.permissions?.length > 0) {
+      const resource = collection.slug;
+      const action = operation === "read" ? "read" : operation === "create" ? "create" : "update";
+      const permission = `${resource}:${action}`;
+      if (!hasApiKeyPermission(context.apiKey.permissions, permission) && !hasApiKeyPermission(context.apiKey.permissions, `${resource}:admin`)) {
+        return { allowed: false };
+      }
+      return { allowed: true };
+    }
+    if (accessRule) {
+      const result2 = await evaluateAccess(accessRule, {
+        req: context.req,
+        user: context.user,
+        tenantID: context.tenantID
+      });
+      if (typeof result2 === "boolean") {
+        return { allowed: result2 };
+      }
+      return { allowed: true, extraWhere: result2 };
+    }
+    return { allowed: true };
+  }
+  if (context.user) {
+    const resource = collection.slug;
+    const action = operation === "read" ? "read" : operation === "create" ? "create" : operation === "update" ? "update" : "delete";
+    const permission = `${resource}:${action}`;
+    const userHasPermission = hasPermission(
+      { id: context.user.id, email: context.user.email, role: context.user.role },
+      permission
+    );
+    if (!userHasPermission && !hasPermission(
+      { id: context.user.id, email: context.user.email, role: context.user.role },
+      `${resource}:admin`
+    )) {
+      if (!accessRule) {
+        return { allowed: false };
+      }
+    }
+  }
+  if (!accessRule) {
+    if (!context.user) {
+      return { allowed: false };
+    }
+    return { allowed: true };
+  }
+  const result = await evaluateAccess(accessRule, {
+    req: context.req,
+    user: context.user,
+    tenantID: context.tenantID
+  });
+  if (typeof result === "boolean") {
+    return { allowed: result };
+  }
+  return { allowed: true, extraWhere: result };
+}
+async function checkGlobalAccess(global, operation, context) {
+  const accessRule = global.access?.[operation];
+  if (context.apiKey) {
+    if (context.apiKey.permissions?.length > 0) {
+      const resource = global.slug;
+      const permission = `${resource}:${operation}`;
+      if (!hasApiKeyPermission(context.apiKey.permissions, permission) && !hasApiKeyPermission(context.apiKey.permissions, `${resource}:admin`) && !hasApiKeyPermission(context.apiKey.permissions, `${resource}:*`)) {
+        return { allowed: false };
+      }
+      return { allowed: true };
+    }
+    if (accessRule) {
+      const result2 = await evaluateAccess(accessRule, {
+        req: context.req,
+        user: context.user,
+        tenantID: context.tenantID
+      });
+      return { allowed: typeof result2 === "boolean" ? result2 : true };
+    }
+    return { allowed: true };
+  }
+  if (!accessRule) {
+    if (!context.user) {
+      return { allowed: false };
+    }
+    const userRole = context.user.role;
+    if (userRole === "super_admin" || userRole === "admin") {
+      return { allowed: true };
+    }
+    return { allowed: false };
+  }
+  const result = await evaluateAccess(accessRule, {
+    req: context.req,
+    user: context.user,
+    tenantID: context.tenantID
+  });
+  if (typeof result === "boolean") {
+    return { allowed: result };
+  }
+  return { allowed: true };
+}
+function resolveMediaUrl(url, origin) {
+  if (!url) return null;
+  if (url.startsWith("http://") || url.startsWith("https://") || url.startsWith("blob:") || url.startsWith("data:")) return url;
+  const base = (process.env.KYRO_BASE_URL || origin || "http://localhost:4321").replace(/\/+$/, "");
+  return `${base}${url.startsWith("/") ? "" : "/"}${url}`;
+}
+function processMediaDoc(doc, origin) {
+  if (!doc) return doc;
+  if (doc.url) doc.url = resolveMediaUrl(doc.url, origin);
+  if (doc.thumbnailUrl) doc.thumbnailUrl = resolveMediaUrl(doc.thumbnailUrl, origin);
+  return doc;
+}
+function fieldToGraphQLType(field, registry, collectionTypes, isInputType = false) {
+  switch (field.type) {
+    case "text":
+    case "email":
+    case "password":
+    case "textarea":
+    case "color":
+    case "code":
+    case "markdown":
+    case "date":
+    case "select":
+    case "radio":
+      return GraphQLString;
+    case "upload": {
+      const uploadField = field;
+      if (isInputType) {
+        return uploadField.hasMany ? new GraphQLList(GraphQLString) : GraphQLString;
+      }
+      if (uploadField.relationTo && collectionTypes?.[uploadField.relationTo]) {
+        const refType = collectionTypes[uploadField.relationTo];
+        return uploadField.hasMany ? new GraphQLList(refType) : refType;
+      }
+      return GraphQLJSON;
+    }
+    case "image": {
+      if (isInputType) return GraphQLString;
+      const imageField = field;
+      if (imageField.relationTo && collectionTypes?.[imageField.relationTo]) {
+        return collectionTypes[imageField.relationTo];
+      }
+      return GraphQLJSON;
+    }
+    case "number":
+      return field.integer ? GraphQLInt : GraphQLFloat;
+    case "checkbox":
+      return GraphQLBoolean;
+    case "json":
+    case "richtext":
+    case "blocks":
+    case "tabs":
+      return isInputType ? GraphQLJSON : GraphQLJSON;
+    case "relationship":
+      if (typeof field.relationTo === "string") {
+        if (isInputType) {
+          return field.hasMany ? new GraphQLList(GraphQLString) : GraphQLString;
+        }
+        if (collectionTypes?.[field.relationTo]) {
+          return field.hasMany ? new GraphQLList(collectionTypes[field.relationTo]) : collectionTypes[field.relationTo];
+        }
+        const relatedCollection = registry.getCollection(field.relationTo);
+        if (relatedCollection) {
+          return new GraphQLObjectType({
+            name: `${toPascal(field.relationTo)}Ref`,
+            fields: () => ({
+              id: { type: GraphQLString },
+              ...buildFieldsFromCollection(relatedCollection, registry, collectionTypes)
+            })
+          });
+        }
+      }
+      return GraphQLString;
+    case "array":
+      return new GraphQLList(GraphQLString);
+    case "group":
+      return isInputType ? GraphQLJSON : GraphQLJSON;
+    default:
+      return GraphQLString;
+  }
+}
+function buildFieldsFromCollection(config, registry, collectionTypes) {
+  const fields = {};
+  for (const field of config.fields) {
+    if (field.name && field.admin?.hidden !== true) {
+      const fieldConfig = buildFieldConfig(field, registry, collectionTypes);
+      if (fieldConfig) {
+        fields[field.name] = fieldConfig;
+      }
+    }
+  }
+  return fields;
+}
+function buildFieldConfig(field, registry, collectionTypes) {
+  if (!field.name) return null;
+  const deprecationReason = field.deprecated || void 0;
+  if (field.type === "upload") {
+    const gqlType2 = fieldToGraphQLType(field, registry, collectionTypes, false);
+    const uploadField = field;
+    return {
+      type: field.required ? new GraphQLNonNull(gqlType2) : gqlType2,
+      description: field.admin?.description || field.label,
+      deprecationReason,
+      resolve: async (source, args, ctx) => {
+        const loader = ctx?.relationLoader;
+        const value = source?.[uploadField.name];
+        const origin = ctx?.req?.url ? new URL(ctx.req.url).origin : void 0;
+        if (!value) return null;
+        if (uploadField.hasMany) {
+          const items = Array.isArray(value) ? value : [];
+          return Promise.all(items.map(async (item) => {
+            const id2 = typeof item === "string" ? item : item?.id;
+            if (!id2) return processMediaDoc(item, origin);
+            if (typeof item === "object" && item?.url) return processMediaDoc(item, origin);
+            if (loader) {
+              const cached = loader.resolveOne(uploadField.relationTo, id2);
+              if (cached) return processMediaDoc(cached, origin);
+              const loaded = await loader.load(uploadField.relationTo, id2);
+              if (loaded) return processMediaDoc(loaded, origin);
+            }
+            return { id: id2 };
+          }));
+        }
+        const id = typeof value === "string" ? value : value?.id;
+        if (!id) return processMediaDoc(value, origin);
+        if (typeof value === "object" && value?.url) return processMediaDoc(value, origin);
+        if (loader) {
+          const cached = loader.resolveOne(uploadField.relationTo, id);
+          if (cached) return processMediaDoc(cached, origin);
+          const loaded = await loader.load(uploadField.relationTo, id);
+          if (loaded) return processMediaDoc(loaded, origin);
+        }
+        return { id };
+      }
+    };
+  }
+  if (field.type === "relationship" && !field.hasMany) {
+    const gqlType2 = fieldToGraphQLType(field, registry, collectionTypes, false);
+    return {
+      type: field.required ? new GraphQLNonNull(gqlType2) : gqlType2,
+      description: field.admin?.description || field.label,
+      deprecationReason,
+      resolve: async (source, args, ctx) => {
+        const loader = ctx?.relationLoader;
+        const relField = field;
+        const id = source?.[relField.name];
+        if (!id) return null;
+        if (loader && typeof id === "string") {
+          const cached = loader.resolveOne(relField.relationTo, id);
+          if (cached) return cached;
+          const loaded = await loader.load(relField.relationTo, id);
+          if (loaded) return loaded;
+        }
+        return { id };
+      }
+    };
+  }
+  if (field.type === "relationship" && field.hasMany) {
+    const gqlType2 = fieldToGraphQLType(field, registry, collectionTypes, false);
+    return {
+      type: gqlType2,
+      description: field.admin?.description || field.label,
+      deprecationReason,
+      resolve: async (source, args, ctx) => {
+        const loader = ctx?.relationLoader;
+        const relField = field;
+        const ids = source?.[relField.name] || [];
+        if (!ids.length) return [];
+        if (loader) {
+          const results = [];
+          for (const id of ids) {
+            const cached = loader.resolveOne(relField.relationTo, id);
+            if (cached) results.push(cached);
+            else {
+              const loaded = await loader.load(relField.relationTo, id);
+              results.push(loaded || { id });
+            }
+          }
+          return results;
+        }
+        return ids.map((id) => ({ id }));
+      }
+    };
+  }
+  const gqlType = fieldToGraphQLType(field, registry, collectionTypes, false);
+  return {
+    type: field.required ? new GraphQLNonNull(gqlType) : gqlType,
+    description: field.admin?.description || field.label,
+    deprecationReason
+  };
+}
+function buildGraphQLSchema(options) {
+  const { registry, db, user, req, tenantID, apiKey, settings } = options;
+  const apiAccess = settings?.access?.apiAccess;
+  if (apiAccess?.graphqlEnabled === false) {
+    throw new Error("GraphQL API is disabled");
+  }
+  const collections = registry.getCollections();
+  const globals = registry.getGlobals();
+  const collectionTypes = {};
+  const collectionInputTypes = {};
+  for (const collection of collections) {
+    collectionTypes[collection.slug] = new GraphQLObjectType({
+      name: toPascal(toSingular(collection.slug)),
+      fields: () => ({
+        id: { type: GraphQLString },
+        ...buildFieldsFromCollection(collection, registry, collectionTypes),
+        ...collection.timestamps ? {
+          createdAt: { type: GraphQLString },
+          updatedAt: { type: GraphQLString }
+        } : {},
+        ...collection.tenantScoped ? {
+          tenantID: { type: GraphQLString }
+        } : {}
+      })
+    });
+    const inputFields = {};
+    for (const field of collection.fields) {
+      if (field.name && field.name !== "id") {
+        inputFields[field.name] = {
+          type: fieldToGraphQLType(field, registry, collectionTypes, true)
+        };
+      }
+    }
+    collectionInputTypes[collection.slug] = new GraphQLInputObjectType({
+      name: `${toPascal(toSingular(collection.slug))}Input`,
+      fields: () => inputFields
+    });
+  }
+  const globalTypes = {};
+  const globalInputTypes = {};
+  for (const global of globals) {
+    globalTypes[global.slug] = new GraphQLObjectType({
+      name: `${toPascal(global.slug)}Global`,
+      fields: () => ({
+        id: { type: GraphQLString },
+        ...buildFieldsFromCollection(
+          { slug: global.slug, fields: global.fields },
+          registry,
+          collectionTypes
+        )
+      })
+    });
+    globalInputTypes[global.slug] = new GraphQLInputObjectType({
+      name: `${toPascal(global.slug)}GlobalInput`,
+      fields: () => {
+        const inputFields = {};
+        for (const field of global.fields) {
+          if (field.name && field.name !== "id") {
+            inputFields[field.name] = {
+              type: fieldToGraphQLType(field, registry, collectionTypes, true)
+            };
+          }
+        }
+        return inputFields;
+      }
+    });
+  }
+  const queryFields = {};
+  for (const collection of collections) {
+    const type = collectionTypes[collection.slug];
+    if (!type) continue;
+    queryFields[toCamel(collection.slug)] = {
+      type: new GraphQLObjectType({
+        name: `${toPascal(toSingular(collection.slug))}FindResult`,
+        fields: {
+          docs: { type: new GraphQLList(type) },
+          totalDocs: { type: GraphQLInt },
+          page: { type: GraphQLInt },
+          totalPages: { type: GraphQLInt },
+          hasNextPage: { type: GraphQLBoolean },
+          hasPrevPage: { type: GraphQLBoolean }
+        }
+      }),
+      args: {
+        where: { type: GraphQLString },
+        sort: { type: GraphQLString },
+        limit: { type: GraphQLInt },
+        page: { type: GraphQLInt },
+        draft: { type: GraphQLBoolean }
+      },
+      resolve: async (_, args, context) => {
+        const access = await checkGraphQLAccess(collection, "read", {
+          user: context.user,
+          req: context.req,
+          tenantID: context.tenantID,
+          apiKey: context.apiKey
+        });
+        if (!access.allowed) {
+          throw new Error("Access denied");
+        }
+        if (context.tenantID) {
+          db.setTenantContext({ tenantId: context.tenantID, userId: context.user?.id ?? "", role: context.user?.role, isSuperAdmin: context.user?.role === "super_admin" });
+        }
+        let where = {};
+        if (args.where) {
+          try {
+            where = JSON.parse(args.where);
+          } catch {
+          }
+        }
+        if (access.extraWhere) {
+          where = { ...where, ...access.extraWhere };
+        }
+        const isDraft = args.draft ?? !!context.user;
+        return db.find({
+          collection: collection.slug,
+          where,
+          sort: args.sort,
+          limit: args.limit || 10,
+          page: args.page || 1,
+          tenantID: context.tenantID,
+          draft: isDraft
+        });
+      }
+    };
+    queryFields[toCamel(toSingular(collection.slug))] = {
+      type,
+      args: {
+        id: { type: GraphQLString },
+        slug: { type: GraphQLString },
+        draft: { type: GraphQLBoolean }
+      },
+      resolve: async (_, args, context) => {
+        if (!args.id && !args.slug) {
+          throw new Error("Either id or slug is required");
+        }
+        const access = await checkGraphQLAccess(collection, "read", {
+          user: context.user,
+          req: context.req,
+          tenantID: context.tenantID,
+          apiKey: context.apiKey
+        });
+        if (!access.allowed) {
+          throw new Error("Access denied");
+        }
+        if (context.tenantID) {
+          db.setTenantContext({ tenantId: context.tenantID, userId: context.user?.id ?? "", role: context.user?.role, isSuperAdmin: context.user?.role === "super_admin" });
+        }
+        const isDraft = args.draft ?? !!context.user;
+        if (args.id) {
+          return db.findByID({
+            collection: collection.slug,
+            id: args.id,
+            tenantID: context.tenantID,
+            draft: isDraft
+          });
+        }
+        const result = await db.find({
+          collection: collection.slug,
+          where: { slug: { equals: args.slug } },
+          limit: 1,
+          page: 1,
+          tenantID: context.tenantID,
+          draft: isDraft
+        });
+        return result.docs?.[0] || null;
+      }
+    };
+    queryFields[`count${toPascal(collection.slug)}`] = {
+      type: new GraphQLObjectType({
+        name: `${toPascal(toSingular(collection.slug))}Count`,
+        fields: {
+          totalDocs: { type: GraphQLInt }
+        }
+      }),
+      args: {
+        where: { type: GraphQLString }
+      },
+      resolve: async (_, args, context) => {
+        const access = await checkGraphQLAccess(collection, "read", {
+          user: context.user,
+          req: context.req,
+          tenantID: context.tenantID,
+          apiKey: context.apiKey
+        });
+        if (!access.allowed) {
+          return { totalDocs: 0 };
+        }
+        let where = {};
+        if (args.where) {
+          try {
+            where = JSON.parse(args.where);
+          } catch {
+          }
+        }
+        const count = await db.count({
+          collection: collection.slug,
+          where,
+          tenantID: context.tenantID
+        });
+        return { totalDocs: count };
+      }
+    };
+  }
+  for (const global of globals) {
+    const type = globalTypes[global.slug];
+    if (!type) continue;
+    queryFields[toCamel(toSingular(global.slug))] = {
+      type,
+      resolve: async (_, args, context) => {
+        const access = await checkGlobalAccess(global, "read", {
+          user: context.user,
+          req: context.req,
+          tenantID: context.tenantID,
+          apiKey: context.apiKey
+        });
+        if (!access.allowed) {
+          throw new Error("Access denied: cannot read global");
+        }
+        if (context.tenantID) {
+          db.setTenantContext({ tenantId: context.tenantID, userId: context.user?.id ?? "", role: context.user?.role, isSuperAdmin: context.user?.role === "super_admin" });
+        }
+        return db.findOne({
+          collection: `_globals_${global.slug}`,
+          where: {},
+          tenantID: context.tenantID
+        });
+      }
+    };
+  }
+  const Query = new GraphQLObjectType({
+    name: "Query",
+    fields: queryFields
+  });
+  const mutationFields = {};
+  for (const collection of collections) {
+    const type = collectionTypes[collection.slug];
+    const inputType = collectionInputTypes[collection.slug];
+    if (!type || !inputType) continue;
+    mutationFields[`create${toPascal(toSingular(collection.slug))}`] = {
+      type: new GraphQLObjectType({
+        name: `${toPascal(toSingular(collection.slug))}CreateResult`,
+        fields: {
+          doc: { type },
+          message: { type: GraphQLString }
+        }
+      }),
+      args: {
+        data: { type: new GraphQLNonNull(inputType) }
+      },
+      resolve: async (_, args, context) => {
+        const access = await checkGraphQLAccess(collection, "create", {
+          user: context.user,
+          req: context.req,
+          tenantID: context.tenantID,
+          apiKey: context.apiKey
+        });
+        if (!access.allowed) {
+          throw new Error("Access denied: cannot create");
+        }
+        if (context.tenantID) {
+          db.setTenantContext({ tenantId: context.tenantID, userId: context.user?.id ?? "", role: context.user?.role, isSuperAdmin: context.user?.role === "super_admin" });
+        }
+        const schema = registry.getCreateZodSchema(collection.slug);
+        const validated = schema.parse(args.data);
+        const doc = await db.create({
+          collection: collection.slug,
+          data: validated,
+          tenantID: context.tenantID
+        });
+        return { doc, message: "Created successfully" };
+      }
+    };
+    mutationFields[`update${toPascal(toSingular(collection.slug))}`] = {
+      type: new GraphQLObjectType({
+        name: `${toPascal(toSingular(collection.slug))}UpdateResult`,
+        fields: {
+          doc: { type },
+          message: { type: GraphQLString }
+        }
+      }),
+      args: {
+        id: { type: new GraphQLNonNull(GraphQLString) },
+        data: { type: new GraphQLNonNull(inputType) },
+        baseUpdatedAt: { type: GraphQLString }
+      },
+      resolve: async (_, args, context) => {
+        const access = await checkGraphQLAccess(collection, "update", {
+          user: context.user,
+          req: context.req,
+          tenantID: context.tenantID,
+          apiKey: context.apiKey
+        });
+        if (!access.allowed) {
+          throw new Error("Access denied: cannot update");
+        }
+        if (context.tenantID) {
+          db.setTenantContext({ tenantId: context.tenantID, userId: context.user?.id ?? "", role: context.user?.role, isSuperAdmin: context.user?.role === "super_admin" });
+        }
+        if (args.baseUpdatedAt) {
+          const originalDoc = await db.findByID({
+            collection: collection.slug,
+            id: args.id,
+            tenantID: context.tenantID,
+            draft: true
+          });
+          if (originalDoc && originalDoc.updatedAt && args.baseUpdatedAt !== originalDoc.updatedAt) {
+            throw new Error(`Revision conflict: document has changed since ${args.baseUpdatedAt}. Current updatedAt: ${originalDoc.updatedAt}`);
+          }
+        }
+        const schema = registry.getUpdateZodSchema(collection.slug);
+        const validated = schema.parse(args.data);
+        const doc = await db.update({
+          collection: collection.slug,
+          id: args.id,
+          data: validated,
+          tenantID: context.tenantID
+        });
+        return { doc, message: "Updated successfully" };
+      }
+    };
+    mutationFields[`delete${toPascal(toSingular(collection.slug))}`] = {
+      type: new GraphQLObjectType({
+        name: `${toPascal(toSingular(collection.slug))}DeleteResult`,
+        fields: {
+          doc: { type },
+          message: { type: GraphQLString }
+        }
+      }),
+      args: {
+        id: { type: new GraphQLNonNull(GraphQLString) }
+      },
+      resolve: async (_, args, context) => {
+        const access = await checkGraphQLAccess(collection, "delete", {
+          user: context.user,
+          req: context.req,
+          tenantID: context.tenantID,
+          apiKey: context.apiKey
+        });
+        if (!access.allowed) {
+          throw new Error("Access denied: cannot delete");
+        }
+        if (context.tenantID) {
+          db.setTenantContext({ tenantId: context.tenantID, userId: context.user?.id ?? "", role: context.user?.role, isSuperAdmin: context.user?.role === "super_admin" });
+        }
+        const doc = await db.delete({
+          collection: collection.slug,
+          id: args.id,
+          tenantID: context.tenantID
+        });
+        return { doc, message: "Deleted successfully" };
+      }
+    };
+  }
+  for (const global of globals) {
+    const inputType = globalInputTypes[global.slug];
+    if (!inputType) continue;
+    mutationFields[`update${toPascal(global.slug)}`] = {
+      type: new GraphQLObjectType({
+        name: `${toPascal(global.slug)}UpdateResult`,
+        fields: {
+          doc: { type: globalTypes[global.slug] || GraphQLString },
+          message: { type: GraphQLString }
+        }
+      }),
+      args: {
+        data: { type: new GraphQLNonNull(inputType) }
+      },
+      resolve: async (_, args, context) => {
+        const access = await checkGlobalAccess(global, "update", {
+          user: context.user,
+          req: context.req,
+          tenantID: context.tenantID,
+          apiKey: context.apiKey
+        });
+        if (!access.allowed) {
+          throw new Error("Access denied: cannot update global");
+        }
+        if (context.tenantID) {
+          db.setTenantContext({ tenantId: context.tenantID, userId: context.user?.id ?? "", role: context.user?.role, isSuperAdmin: context.user?.role === "super_admin" });
+        }
+        const doc = await db.findOne({
+          collection: `_globals_${global.slug}`,
+          where: {},
+          tenantID: context.tenantID
+        });
+        let result;
+        if (doc) {
+          result = await db.update({
+            collection: `_globals_${global.slug}`,
+            id: doc.id,
+            data: args.data,
+            tenantID: context.tenantID
+          });
+        } else {
+          result = await db.create({
+            collection: `_globals_${global.slug}`,
+            data: args.data,
+            tenantID: context.tenantID
+          });
+        }
+        return { doc: result, message: "Updated successfully" };
+      }
+    };
+  }
+  const Mutation = new GraphQLObjectType({
+    name: "Mutation",
+    fields: mutationFields
+  });
+  return new GraphQLSchema({
+    query: Query,
+    mutation: Mutation
+  });
+}
+function createGraphQLSchema(registry, db, options) {
+  return buildGraphQLSchema({
+    registry,
+    db,
+    user: options?.user,
+    req: options?.req,
+    tenantID: options?.tenantID,
+    apiKey: options?.apiKey
+  });
+}
+
+export { RelationLoader, buildGraphQLSchema, createGraphQLSchema, depthLimit };
+//# sourceMappingURL=chunk-5RPRLTTN.js.map
+//# sourceMappingURL=chunk-5RPRLTTN.js.map