fix: stabilize infrastructure, bypass account scopes in emergency mode, and sanitize document serialization

src/app/actions/appwrite.ts

@@ -22,7 +22,8 @@ export async function createDocumentServer(collectionId: string, data: any) {
         const databases = new Databases(client);
         const result = await databases.createDocument(DATABASE_ID, collectionId, ID.unique(), data);
         revalidatePath('/');
-        return { success: true, data: result };
+        // Sanitizar para Next.js
+        return { success: true, data: { ...result } };
     } catch (error: any) {
         console.error('Error creating document:', error);
         return { success: false, error: error.message };
@@ -35,7 +36,8 @@ export async function updateDocumentServer(collectionId: string, documentId: str
         const databases = new Databases(client);
         const result = await databases.updateDocument(DATABASE_ID, collectionId, documentId, data);
         revalidatePath('/');
-        return { success: true, data: result };
+        // Sanitizar para Next.js
+        return { success: true, data: { ...result } };
     } catch (error: any) {
         console.error('Error updating document:', error);
         return { success: false, error: error.message };

src/app/api/publications/route.ts

@@ -31,7 +31,26 @@ async function requireAuth() {
       { status: 401 }
     )};
   }
+  
   try {
+    // Si es modo bypass (admin-emergency), no podemos llamar a account.get() con la API Key
+    const cookieStore = await require('@/lib/appwrite.server').cookies(); 
+    const PROJECT_ID = process.env.NEXT_PUBLIC_APPWRITE_PROJECT_ID || '69b84df5003bd8957c5c';
+    const sessionCookie = cookieStore.get(`a_session_${PROJECT_ID.toLowerCase()}`);
+    
+    if (sessionCookie?.value === "admin-bypass-session") {
+        return { 
+            user: { 
+                $id: "admin-emergency",
+                name: "Administrador (Emergencia)", 
+                email: "admin@almeira.com.co",
+                prefs: { role: 'admin' } 
+            }, 
+            session, 
+            error: null 
+        };
+    }
+
     const user = await session.account.get();
     return { user, session, error: null };
   } catch {

src/lib/preferences.ts

@@ -10,6 +10,16 @@ export interface UserPreferences {
  */
 export async function getUserPreferences(): Promise<UserPreferences> {
     try {
+        const PROJECT_ID = process.env.NEXT_PUBLIC_APPWRITE_PROJECT_ID || '69b84df5003bd8957c5c';
+        const { cookies } = await import('next/headers');
+        const cookieStore = await cookies();
+        const sessionCookie = cookieStore.get(`a_session_${PROJECT_ID.toLowerCase()}`);
+        
+        // En modo bypass no hay preferencias persistidas reales que valga la pena pedir a account.get()
+        if (sessionCookie?.value === "admin-bypass-session") {
+            return {};
+        }
+
         const sessionClient = await createSessionClient();
         if (!sessionClient) return {};