@dyrected/core 2.18.0 → 2.18.1

package/dist/server.cjs

@@ -6491,1229 +6491,1782 @@ async function buildCollectionSearchWhere(args) {
   return clauses.length === 1 ? clauses[0] : { OR: clauses };
 }
 
-// src/controllers/collection.controller.ts
-init_access_control();
+// src/types/navigation.ts
+var CURRENT_NAV_PREFERENCES_VERSION = 1;
+var DEFAULT_USER_NAV_PREFERENCES = {
+  _version: CURRENT_NAV_PREFERENCES_VERSION,
+  pinned: [],
+  hidden: [],
+  groupOrder: [],
+  itemOrder: {},
+  groups: [],
+  items: []
+};
 
-// src/utils/action-mutation.ts
-function resolveActionMutation(mutation, ctx) {
-  if (!mutation) return { ...ctx.input ?? {} };
-  return resolveValue(mutation, ctx);
-}
-function resolveValue(value, ctx) {
-  if (typeof value === "string") return resolveExpression(value, ctx);
-  if (Array.isArray(value)) return value.map((item) => resolveValue(item, ctx));
-  if (isPlainObject2(value)) {
-    const out = {};
-    for (const [key, entry] of Object.entries(value)) {
-      out[key] = resolveValue(entry, ctx);
-    }
-    return out;
+// src/utils/navigation-reconciler.ts
+var normalizeKey = (val) => (val || "").toLowerCase().replace(/[^a-z0-9]/g, "-");
+function reconcileNavigation(baseTree, prefs, schemas, options) {
+  if (!baseTree) {
+    return {
+      groups: [],
+      ungrouped: [],
+      pinnedItems: []
+    };
   }
-  return value;
-}
-function resolveExpression(expression, ctx) {
-  if (expression === "now()") return (/* @__PURE__ */ new Date()).toISOString();
-  const inputPath = expression.match(/^input\.([A-Za-z0-9_.-]+)$/)?.[1];
-  if (inputPath !== void 0) return getPath(ctx.input, inputPath);
-  const docPath = expression.match(/^doc\.([A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*)$/)?.[1];
-  if (docPath !== void 0) return getPath(ctx.doc, docPath);
-  const userPath = expression.match(/^user\.([A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*)$/)?.[1];
-  if (userPath !== void 0 && ctx.user) return getPath(ctx.user, userPath);
-  return expression;
-}
-function getPath(source, path) {
-  let cursor = source;
-  for (const segment of path.split(".")) {
-    if (!cursor || typeof cursor !== "object") return void 0;
-    cursor = cursor[segment];
+  const includeHidden = options?.includeHidden ?? false;
+  const effectivePrefs = prefs || DEFAULT_USER_NAV_PREFERENCES;
+  const hiddenSet = new Set(effectivePrefs.hidden || []);
+  const knownCollectionSlugs = new Set((schemas?.collections || []).map((c) => c.slug));
+  const knownGlobalSlugs = new Set((schemas?.globals || []).map((g) => g.slug));
+  const groupsList = [];
+  const findGroup = (query) => {
+    const qNorm = normalizeKey(query);
+    return groupsList.find(
+      (g) => g.id === query || g.slug === query || g.name === query || normalizeKey(g.id) === qNorm || normalizeKey(g.slug) === qNorm || normalizeKey(g.name) === qNorm
+    );
+  };
+  for (const g of baseTree.groups || []) {
+    groupsList.push({
+      ...g,
+      items: (g.items || []).map((item) => ({ ...item }))
+    });
   }
-  return cursor;
-}
-function isPlainObject2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-// src/utils/id.ts
-var import_node_crypto2 = require("crypto");
-var NANOID_ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-";
-var BASE62_ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
-var CROCKFORD_BASE32 = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-var COMMON_SLUG_PREFIXES = {
-  users: "usr",
-  members: "mem",
-  accounts: "acc",
-  applications: "app",
-  customers: "cus",
-  products: "prd",
-  orders: "ord",
-  reports: "rpt",
-  sessions: "ses",
-  transactions: "txn",
-  wallets: "wal",
-  media: "med",
-  files: "fil",
-  posts: "post",
-  pages: "page",
-  tags: "tag",
-  categories: "cat",
-  comments: "com"
-};
-function nanoid(size = 21, alphabet = NANOID_ALPHABET) {
-  const mask = (2 << 31 - Math.clz32(alphabet.length - 1 | 1)) - 1;
-  const step = Math.ceil(1.6 * mask * size / alphabet.length);
-  let id = "";
-  while (true) {
-    const bytes = (0, import_node_crypto2.randomBytes)(step);
-    for (let i = 0; i < step; i++) {
-      const byte = bytes[i] & mask;
-      if (alphabet[byte]) {
-        id += alphabet[byte];
-        if (id.length === size) return id;
-      }
+  for (const ug of effectivePrefs.groups || []) {
+    const existing = findGroup(ug.slug || ug.name);
+    if (!existing) {
+      groupsList.push({
+        id: ug.slug ? `group_${ug.slug}` : `group_${normalizeKey(ug.name)}`,
+        name: ug.name,
+        slug: ug.slug || normalizeKey(ug.name),
+        icon: ug.icon || "Folder",
+        defaultExpanded: ug.defaultExpanded ?? true,
+        order: ug.order ?? 100,
+        items: []
+      });
     }
   }
-}
-function encodeUlidTime(now2, len = 10) {
-  let str = "";
-  let time = Math.floor(now2);
-  for (let i = len - 1; i >= 0; i--) {
-    const mod = time % 32;
-    str = CROCKFORD_BASE32[mod] + str;
-    time = (time - mod) / 32;
-  }
-  return str;
-}
-function encodeUlidRandom(bytes) {
-  let str = "";
-  let bitBuffer = 0;
-  let bitsInBuffer = 0;
-  for (let i = 0; i < bytes.length; i++) {
-    bitBuffer = bitBuffer << 8 | bytes[i];
-    bitsInBuffer += 8;
-    while (bitsInBuffer >= 5) {
-      bitsInBuffer -= 5;
-      const index = bitBuffer >> bitsInBuffer & 31;
-      str += CROCKFORD_BASE32[index];
+  for (const itemOpt of effectivePrefs.items || []) {
+    const targetGroup = typeof itemOpt.group === "object" ? itemOpt.group?.name : itemOpt.group;
+    const groupKey = targetGroup || "Custom";
+    let group = findGroup(groupKey);
+    if (!group) {
+      group = {
+        id: `group_${normalizeKey(groupKey)}`,
+        name: groupKey,
+        slug: normalizeKey(groupKey),
+        icon: "Folder",
+        defaultExpanded: true,
+        order: 99,
+        items: []
+      };
+      groupsList.push(group);
+    }
+    const itemId = itemOpt.slug ? `workspace_${itemOpt.slug}` : itemOpt.collection ? `collection_${itemOpt.collection}` : `custom_${Math.random()}`;
+    for (const otherGroup of groupsList) {
+      if (otherGroup !== group) {
+        otherGroup.items = otherGroup.items.filter((i) => i.slug !== itemOpt.slug && i.id !== itemId);
+      }
+    }
+    const existingIndex = group.items.findIndex((i) => i.id === itemId || i.slug === itemOpt.slug);
+    const existingItem = existingIndex >= 0 ? group.items[existingIndex] : void 0;
+    const col = schemas?.collections?.find((c) => c.slug === itemOpt.collection);
+    const colViews = col?.views || [];
+    const baseViews = existingItem?.views || [];
+    const userViews = itemOpt.views || [];
+    const userViewSlugs = new Set(userViews.map((v) => v.slug));
+    let mergedViews = [
+      ...baseViews.filter((v) => !userViewSlugs.has(v.slug)),
+      ...userViews
+    ];
+    if (mergedViews.length === 0 && itemOpt.collection) {
+      if (colViews.length > 0) {
+        mergedViews = [...colViews];
+      } else {
+        mergedViews = [
+          {
+            slug: "default",
+            label: col?.label || col?.labels?.plural || itemOpt.label || "All Records",
+            layout: "table",
+            collection: itemOpt.collection
+          }
+        ];
+      }
+    }
+    mergedViews = mergedViews.map((v) => ({
+      ...v,
+      collection: v.collection || itemOpt.collection || existingItem?.collection
+    }));
+    const compiledItem = {
+      id: itemId,
+      type: itemOpt.slug ? "workspace" : itemOpt.collection ? "collection" : itemOpt.global ? "global" : "workspace",
+      slug: itemOpt.slug || itemOpt.collection || itemOpt.global || "item",
+      label: itemOpt.label || itemOpt.slug || "Item",
+      icon: itemOpt.icon || existingItem?.icon || col?.admin?.icon || "Briefcase",
+      group: group.name,
+      order: itemOpt.order ?? existingItem?.order ?? 100,
+      views: mergedViews,
+      collection: itemOpt.collection || existingItem?.collection,
+      global: itemOpt.global || existingItem?.global,
+      badge: itemOpt.badge || existingItem?.badge,
+      access: itemOpt.access || existingItem?.access
+    };
+    if (existingIndex >= 0) {
+      group.items[existingIndex] = compiledItem;
+    } else {
+      group.items.push(compiledItem);
     }
   }
-  return str;
-}
-function ulid(seedTime = Date.now()) {
-  const timePart = encodeUlidTime(seedTime);
-  const randPart = encodeUlidRandom((0, import_node_crypto2.randomBytes)(10));
-  return timePart + randPart;
-}
-function uuid() {
-  return (0, import_node_crypto2.randomUUID)();
-}
-function resolvePrefix(slug, explicitPrefix) {
-  if (explicitPrefix && typeof explicitPrefix === "string" && explicitPrefix.trim().length > 0) {
-    const cleaned = explicitPrefix.trim().toLowerCase().replace(/[^a-z0-9_]/g, "");
-    if (cleaned.length > 0) return cleaned;
-  }
-  if (!slug || typeof slug !== "string") return "col";
-  const s = slug.trim().toLowerCase();
-  if (COMMON_SLUG_PREFIXES[s]) return COMMON_SLUG_PREFIXES[s];
-  const pieces = s.split(/[-_]/).filter(Boolean);
-  if (pieces.length > 1 && pieces[0].length >= 2) {
-    const first2 = pieces[0].replace(/[^a-z0-9]/g, "");
-    if (first2.length >= 2) return first2.slice(0, 4);
-  }
-  const cleanWord = s.replace(/[^a-z0-9]/g, "");
-  if (cleanWord.length <= 4) return cleanWord || "col";
-  return cleanWord.slice(0, 3) || "col";
-}
-function prefixedId(prefix = "col", size = 16) {
-  const cleanPrefix = (prefix || "col").toLowerCase().replace(/[^a-z0-9_]/g, "") || "col";
-  return `${cleanPrefix}_${nanoid(size, BASE62_ALPHABET)}`;
-}
-function generateId(options) {
-  if (typeof options === "string") {
-    return prefixedId(resolvePrefix(options));
-  }
-  const opts = options || {};
-  const type = opts.type || "prefixed-nanoid";
-  switch (type) {
-    case "uuid":
-      return uuid();
-    case "ulid":
-      return ulid();
-    case "nanoid":
-      return nanoid(opts.size || 21);
-    case "prefixed-nanoid":
-    default:
-      return prefixedId(opts.prefix || "col", opts.size || 16);
-  }
-}
-function generateDocumentId(collectionOrSlug) {
-  if (!collectionOrSlug) {
-    return prefixedId("col");
+  const allAvailableItems = [];
+  const reconciledGroups = [];
+  for (const group of groupsList) {
+    const isGroupHidden = hiddenSet.has(group.id) || !!group.slug && hiddenSet.has(group.slug) || hiddenSet.has(group.name);
+    if (!includeHidden && isGroupHidden) {
+      continue;
+    }
+    const visibleItems = [];
+    for (const item of group.items) {
+      const isItemHidden = hiddenSet.has(item.id) || !!item.slug && hiddenSet.has(item.slug);
+      if (!includeHidden && isItemHidden) {
+        continue;
+      }
+      const allViews = item.views || [];
+      const visibleViews = includeHidden ? allViews : allViews.filter((v) => {
+        const compoundKey = `${item.slug}_${v.slug}`;
+        return !hiddenSet.has(compoundKey) && !hiddenSet.has(v.slug);
+      });
+      let isTombstone = false;
+      if (schemas && schemas.collections && schemas.collections.length > 0) {
+        if (item.collection && !knownCollectionSlugs.has(item.collection)) {
+          isTombstone = true;
+        }
+      }
+      if (schemas && schemas.globals && schemas.globals.length > 0) {
+        if (item.global && !knownGlobalSlugs.has(item.global)) {
+          isTombstone = true;
+        }
+      }
+      const processedItem = {
+        ...item,
+        views: visibleViews,
+        ...isTombstone ? { isTombstone: true } : {}
+      };
+      visibleItems.push(processedItem);
+      allAvailableItems.push(processedItem);
+    }
+    const groupKey = group.slug || group.name;
+    const itemOrderList = effectivePrefs.itemOrder?.[group.id] || effectivePrefs.itemOrder?.[groupKey];
+    if (itemOrderList && itemOrderList.length > 0) {
+      visibleItems.sort((a, b) => {
+        const aIdx = itemOrderList.indexOf(a.id) >= 0 ? itemOrderList.indexOf(a.id) : a.slug ? itemOrderList.indexOf(a.slug) : -1;
+        const bIdx = itemOrderList.indexOf(b.id) >= 0 ? itemOrderList.indexOf(b.id) : b.slug ? itemOrderList.indexOf(b.slug) : -1;
+        if (aIdx >= 0 && bIdx >= 0) return aIdx - bIdx;
+        if (aIdx >= 0) return -1;
+        if (bIdx >= 0) return 1;
+        return (a.order ?? 100) - (b.order ?? 100);
+      });
+    } else {
+      visibleItems.sort((a, b) => (a.order ?? 100) - (b.order ?? 100));
+    }
+    reconciledGroups.push({
+      ...group,
+      items: visibleItems
+    });
   }
-  if (typeof collectionOrSlug === "string") {
-    const prefix2 = resolvePrefix(collectionOrSlug);
-    return prefixedId(prefix2);
+  if (effectivePrefs.groupOrder && effectivePrefs.groupOrder.length > 0) {
+    reconciledGroups.sort((a, b) => {
+      const aIdx = effectivePrefs.groupOrder.indexOf(a.id) >= 0 ? effectivePrefs.groupOrder.indexOf(a.id) : a.slug ? effectivePrefs.groupOrder.indexOf(a.slug) : effectivePrefs.groupOrder.indexOf(a.name);
+      const bIdx = effectivePrefs.groupOrder.indexOf(b.id) >= 0 ? effectivePrefs.groupOrder.indexOf(b.id) : b.slug ? effectivePrefs.groupOrder.indexOf(b.slug) : effectivePrefs.groupOrder.indexOf(b.name);
+      if (aIdx >= 0 && bIdx >= 0) return aIdx - bIdx;
+      if (aIdx >= 0) return -1;
+      if (bIdx >= 0) return 1;
+      return (a.order ?? 100) - (b.order ?? 100);
+    });
+  } else {
+    reconciledGroups.sort((a, b) => (a.order ?? 100) - (b.order ?? 100));
   }
-  if (typeof collectionOrSlug.idGenerator === "function") {
-    return collectionOrSlug.idGenerator(collectionOrSlug.slug);
+  const reconciledUngrouped = (baseTree.ungrouped || []).filter((item) => {
+    const isItemHidden = hiddenSet.has(item.id) || !!item.slug && hiddenSet.has(item.slug);
+    return includeHidden || !isItemHidden;
+  }).map((item) => {
+    const allViews = item.views || [];
+    const visibleViews = includeHidden ? allViews : allViews.filter((v) => {
+      const compoundKey = `${item.slug}_${v.slug}`;
+      return !hiddenSet.has(compoundKey) && !hiddenSet.has(v.slug);
+    });
+    const processed = { ...item, views: visibleViews };
+    allAvailableItems.push(processed);
+    return processed;
+  });
+  const pinnedItems = [];
+  for (const pin of effectivePrefs.pinned || []) {
+    const match = allAvailableItems.find((i) => i.slug === pin.slug || i.id === pin.slug);
+    if (match) {
+      pinnedItems.push({
+        ...match,
+        id: `pin_${match.id}`,
+        label: pin.label || match.label,
+        icon: pin.icon || match.icon
+      });
+    } else {
+      pinnedItems.push({
+        id: `pin_${pin.slug}`,
+        type: pin.type,
+        slug: pin.slug,
+        label: pin.label || pin.slug,
+        icon: pin.icon || "Star",
+        order: 0,
+        views: []
+      });
+    }
   }
-  const type = collectionOrSlug.idType || "prefixed-nanoid";
-  const prefix = resolvePrefix(collectionOrSlug.slug, collectionOrSlug.idPrefix);
-  return generateId({ prefix, type });
-}
-
-// src/workflows.ts
-var WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
-var LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
-function simplePublishingWorkflow() {
   return {
-    initialState: "draft",
-    draftState: "draft",
-    states: [
-      { name: "draft", label: "Draft", color: "neutral" },
-      { name: "published", label: "Published", color: "success", published: true }
-    ],
-    transitions: [
-      { name: "publish", label: "Publish", from: ["draft", "published"], to: "published" },
-      { name: "unpublish", label: "Unpublish", from: "published", to: "draft", unpublish: true }
-    ]
-    // Intentionally no `roles`: this lightweight workflow (synthesized from
-    // `drafts: true`) does no capability-based gating. Draft visibility for a
-    // no-roles workflow is handled in `canViewWorkflowDraft`.
+    groups: reconciledGroups,
+    ungrouped: reconciledUngrouped,
+    pinnedItems
   };
 }
-function publicMetadata(meta) {
-  const { availableTransitions: _availableTransitions, ...safe } = meta;
-  return safe;
-}
-function workflowCapabilities(workflow, user) {
-  const capabilities = new Set(Array.isArray(user?.capabilities) ? user.capabilities : []);
-  const roles = Array.isArray(user?.roles) ? user.roles : typeof user?.role === "string" ? [user.role] : [];
-  for (const mapping of workflow.roles ?? []) {
-    if (roles.includes(mapping.role)) mapping.capabilities.forEach((capability) => capabilities.add(capability));
+
+// src/utils/navigation.ts
+var RESERVED_NAVIGATION_SLUGS = /* @__PURE__ */ new Set([
+  "collections",
+  "globals",
+  "setup",
+  "api",
+  "login",
+  "logout",
+  "settings",
+  "admin",
+  "preferences",
+  "auth"
+]);
+function assertValidNavigationSlugs(navigation) {
+  for (const item of navigation) {
+    if (item.slug) {
+      const normalizedSlug = item.slug.toLowerCase().trim().replace(/^\//, "");
+      if (RESERVED_NAVIGATION_SLUGS.has(normalizedSlug)) {
+        throw new Error(
+          `[Dyrected Config] The slug '${item.slug}' in navigation item '${item.label || item.slug}' is a reserved system path and cannot be used as an operational workspace slug.`
+        );
+      }
+    }
   }
-  return capabilities;
 }
-function canViewWorkflowDraft(workflow, user) {
-  if (!user) return false;
-  const capabilities = workflowCapabilities(workflow, user);
-  if (capabilities.has("entry.edit")) return true;
-  if (workflow.transitions.some(
-    (transition) => (transition.requiredCapabilities ?? []).some((capability) => capabilities.has(capability))
-  )) {
-    return true;
+function resolveGroupMeta(groupProp, defaultGroupName = "Collections") {
+  if (!groupProp) {
+    return { name: defaultGroupName };
   }
-  if (!workflow.roles || workflow.roles.length === 0) return true;
-  return false;
-}
-function availableWorkflowTransitions(workflow, state, user) {
-  const capabilities = workflowCapabilities(workflow, user);
-  return workflow.transitions.filter((transition) => {
-    const from = Array.isArray(transition.from) ? transition.from : [transition.from];
-    return from.includes(state) && (transition.requiredCapabilities ?? []).every((item) => capabilities.has(item));
-  });
-}
-function initializeWorkflowDocument(data, workflow) {
-  return {
-    ...data,
-    __workflow: { state: workflow.initialState, revision: 1 }
-  };
-}
-function publishedStateName(workflow) {
-  return workflow.states.find((state) => state.published)?.name ?? workflow.states[workflow.states.length - 1]?.name ?? workflow.initialState;
+  if (typeof groupProp === "string") {
+    return { name: groupProp };
+  }
+  return { name: groupProp.name, meta: groupProp };
 }
-function materializeWorkflowDocument(doc, workflow, user) {
-  const meta = doc.__workflow;
-  const publishedState = publishedStateName(workflow);
-  if (!meta) {
-    const { __published: _legacyPublished, __workflow: _legacyWorkflow, ...working2 } = doc;
-    const state = publishedStateName(workflow);
-    return {
-      ...working2,
-      _workflow: {
-        state,
-        revision: 1,
-        availableTransitions: availableWorkflowTransitions(workflow, state, user).map((item) => item.name)
-      }
-    };
+function compileNavigation(config) {
+  const collections = config.collections || [];
+  const globals = config.globals || [];
+  const explicitNav = config.admin?.navigation || [];
+  assertValidNavigationSlugs(explicitNav);
+  const collectionsBySlug = /* @__PURE__ */ new Map();
+  for (const col of collections) {
+    collectionsBySlug.set(col.slug, col);
   }
-  const { __published, __workflow, ...working } = doc;
-  if (!canViewWorkflowDraft(workflow, user)) {
-    if (!__published || typeof __published !== "object") {
-      if (meta.state === publishedState) {
-        return { ...working, _workflow: publicMetadata(meta) };
+  const globalsBySlug = /* @__PURE__ */ new Map();
+  for (const gl of globals) {
+    globalsBySlug.set(gl.slug, gl);
+  }
+  const mentionedCollections = /* @__PURE__ */ new Set();
+  const mentionedGlobals = /* @__PURE__ */ new Set();
+  const injectedViewsByCollection = /* @__PURE__ */ new Map();
+  for (const item of explicitNav) {
+    if (item.addToCollection) {
+      const existing = injectedViewsByCollection.get(item.addToCollection) || [];
+      if (item.views && item.views.length > 0) {
+        injectedViewsByCollection.set(item.addToCollection, [...existing, ...item.views]);
       }
-      return null;
     }
-    return { id: doc.id, ...__published, _workflow: publicMetadata(meta) };
+    if (item.collection) mentionedCollections.add(item.collection);
+    if (item.global) mentionedGlobals.add(item.global);
   }
-  return {
-    ...working,
-    _workflow: {
-      ...meta,
-      availableTransitions: availableWorkflowTransitions(workflow, meta.state, user).map((item) => item.name)
+  const groupMetadataMap = /* @__PURE__ */ new Map();
+  const itemsByGroup = /* @__PURE__ */ new Map();
+  const ungroupedItems = [];
+  const registerItem = (groupName, item) => {
+    if (!groupName) {
+      ungroupedItems.push(item);
+    } else {
+      const list = itemsByGroup.get(groupName) || [];
+      list.push(item);
+      itemsByGroup.set(groupName, list);
     }
   };
-}
-function eventId() {
-  return globalThis.crypto?.randomUUID?.() ?? `evt_${Date.now()}_${Math.random().toString(36).slice(2)}`;
-}
-function createLifecycleEvent(args) {
-  return {
-    id: eventId(),
-    name: args.name,
-    collection: args.collection,
-    documentId: args.documentId,
-    occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
-    actorId: args.actorId,
-    payload: args.payload,
-    attempts: 0,
-    status: "pending"
-  };
-}
-async function persistEvent(db, event) {
-  await db.create({ collection: LIFECYCLE_EVENTS_COLLECTION, data: event });
-}
-async function dispatchLifecycleEvent(config, event) {
-  const db = config.db;
-  if (!db || !config.events?.handlers.length) return;
-  const maxAttempts = config.events.maxAttempts ?? 8;
-  const retryDelayMs = config.events.retryDelayMs ?? 1e3;
-  const attempts = event.attempts + 1;
-  try {
-    await db.update({
-      collection: LIFECYCLE_EVENTS_COLLECTION,
-      id: event.id,
-      data: { status: "processing", attempts }
-    });
-    for (const handler of config.events.handlers) await handler({ ...event, status: "processing", attempts });
-    await db.update({
-      collection: LIFECYCLE_EVENTS_COLLECTION,
-      id: event.id,
-      data: { status: "delivered", attempts, deliveredAt: (/* @__PURE__ */ new Date()).toISOString(), lastError: null }
-    });
-  } catch (error) {
-    const exhausted = attempts >= maxAttempts;
-    await db.update({
-      collection: LIFECYCLE_EVENTS_COLLECTION,
-      id: event.id,
-      data: {
-        status: "failed",
-        attempts,
-        lastError: error instanceof Error ? error.message : String(error),
-        nextAttemptAt: exhausted ? null : new Date(Date.now() + retryDelayMs * 2 ** (attempts - 1)).toISOString()
-      }
-    });
-  }
-}
-async function saveWorkflowDraft(args) {
-  const { config, collection, id, originalDoc, data, user, beforeCommit } = args;
-  const db = config.db;
-  const workflow = collection.workflow;
-  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
-  const previous = originalDoc.__workflow;
-  const isLegacyPublishedDoc = !previous;
-  const baselineRevision = previous?.revision ?? 1;
-  const event = createLifecycleEvent({
-    name: "revision.created",
-    collection: collection.slug,
-    documentId: id,
-    actorId: user?.sub,
-    payload: {
-      revision: baselineRevision + 1,
-      previousRevision: isLegacyPublishedDoc ? baselineRevision : previous?.revision ?? null
+  for (const item of explicitNav) {
+    if (item.addToCollection && !item.slug && !item.collection && !item.global && !item.dashboard && !item.href) {
+      continue;
     }
-  });
-  const doc = await db.transaction(async (tx) => {
-    const nextMeta = {
-      ...previous ?? {},
-      state: isLegacyPublishedDoc ? workflow.draftState ?? workflow.initialState : originalDoc.__published ? workflow.draftState ?? workflow.initialState : previous.state,
-      revision: baselineRevision + 1,
-      ...isLegacyPublishedDoc ? { publishedRevision: baselineRevision } : {}
-    };
-    const updateData = {
-      ...data,
-      __workflow: nextMeta
-    };
-    if (isLegacyPublishedDoc) {
-      const { __workflow: _legacyWorkflow, __published: _legacyPublished, ...publishedSnapshot } = originalDoc;
-      updateData.__published = publishedSnapshot;
+    const { name: groupName, meta: groupMeta } = resolveGroupMeta(item.group, void 0);
+    if (groupName && groupMeta) {
+      groupMetadataMap.set(groupName, { ...groupMetadataMap.get(groupName) || {}, ...groupMeta });
     }
-    const updated = await tx.update({ collection: collection.slug, id, data: updateData });
-    await persistEvent(tx, event);
-    await beforeCommit?.(tx, updated);
-    return updated;
-  });
-  void dispatchLifecycleEvent(config, event);
-  return { doc, event };
-}
-async function createWorkflowDocument(args) {
-  const { config, collection, data, user, beforeCommit } = args;
-  const db = config.db;
-  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
-  let event;
-  const doc = await db.transaction(async (tx) => {
-    const created = await tx.create({ collection: collection.slug, data });
-    event = createLifecycleEvent({
-      name: "revision.created",
-      collection: collection.slug,
-      documentId: created.id,
-      actorId: user?.sub,
-      payload: { revision: 1, previousRevision: null }
-    });
-    await persistEvent(tx, event);
-    await beforeCommit?.(tx, created);
-    return created;
-  });
-  void dispatchLifecycleEvent(config, event);
-  return { doc, event };
-}
-async function transitionWorkflow(args) {
-  const { config, collection, id, transitionName, expectedRevision, comment, input, user, req } = args;
-  const db = config.db;
-  const workflow = collection.workflow;
-  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
-  const original = await db.findOne({ collection: collection.slug, id });
-  if (!original) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
-  const meta = original.__workflow;
-  if (!meta) throw Object.assign(new Error("Entry has no workflow metadata"), { statusCode: 409 });
-  if (expectedRevision !== void 0 && expectedRevision !== meta.revision) {
-    throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), {
-      statusCode: 409
-    });
-  }
-  const transition = workflow.transitions.find((item) => item.name === transitionName);
-  const fromStates = transition ? Array.isArray(transition.from) ? transition.from : [transition.from] : [];
-  if (!transition || !fromStates.includes(meta.state)) {
-    throw Object.assign(new Error(`Transition "${transitionName}" is not valid from "${meta.state}".`), {
-      statusCode: 409
-    });
-  }
-  if (!availableWorkflowTransitions(workflow, meta.state, user).some((item) => item.name === transition.name)) {
-    throw Object.assign(new Error(`You do not have permission to perform "${transition.label}".`), { statusCode: 403 });
-  }
-  if (transition.requireComment && !comment?.trim()) {
-    throw Object.assign(new Error(`A comment is required for "${transition.label}".`), { statusCode: 400 });
-  }
-  const hookContext = { transition, from: meta.state, to: transition.to, doc: original, user, comment, input, req, db };
-  for (const hook of workflow.hooks?.beforeTransition ?? []) await hook(hookContext);
-  const events = [
-    createLifecycleEvent({
-      name: "workflow.transitioned",
-      collection: collection.slug,
-      documentId: id,
-      actorId: user?.sub,
-      payload: { transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision, comment }
-    })
-  ];
-  const targetState = workflow.states.find((state) => state.name === transition.to);
-  if (targetState.published) {
-    events.push(
-      createLifecycleEvent({
-        name: "entry.published",
-        collection: collection.slug,
-        documentId: id,
-        actorId: user?.sub,
-        payload: { revision: meta.revision }
-      })
-    );
-  } else if (transition.unpublish) {
-    events.push(
-      createLifecycleEvent({
-        name: "entry.unpublished",
-        collection: collection.slug,
-        documentId: id,
-        actorId: user?.sub,
-        payload: { revision: meta.publishedRevision }
-      })
-    );
-  }
-  const updated = await db.transaction(async (tx) => {
-    const locked = await tx.findOne({ collection: collection.slug, id });
-    if (!locked) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
-    const lockedMeta = locked.__workflow;
-    if (lockedMeta.revision !== meta.revision || lockedMeta.state !== meta.state || expectedRevision !== void 0 && lockedMeta.revision !== expectedRevision) {
-      throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), {
-        statusCode: 409
+    if (item.dashboard) {
+      registerItem(groupName, {
+        id: "dashboard",
+        type: "dashboard",
+        slug: "dashboard",
+        label: item.label || "Dashboard",
+        icon: item.icon || "LayoutDashboard",
+        group: groupName,
+        order: item.order ?? 0,
+        views: [],
+        access: item.access
       });
+      continue;
     }
-    const now2 = (/* @__PURE__ */ new Date()).toISOString();
-    const { __published: _published, __workflow: _workflow, id: _id, ...working } = locked;
-    const nextMeta = {
-      ...lockedMeta,
-      state: transition.to,
-      ...targetState.published ? { publishedRevision: lockedMeta.revision, publishedAt: now2, publishedBy: user?.sub } : {},
-      ...transition.unpublish ? { publishedRevision: void 0, publishedAt: void 0, publishedBy: void 0 } : {}
-    };
-    const data = { __workflow: nextMeta };
-    if (targetState.published) data.__published = working;
-    if (transition.unpublish) data.__published = null;
-    const next = await tx.update({ collection: collection.slug, id, data });
-    if (transition.onTransition) {
-      await transition.onTransition({
-        transition,
-        from: lockedMeta.state,
-        to: transition.to,
-        doc: locked,
-        input,
-        comment,
-        user,
-        req,
-        tx
+    if (item.collection) {
+      const col = collectionsBySlug.get(item.collection);
+      const combinedViews = [
+        ...col?.views || [],
+        ...injectedViewsByCollection.get(item.collection) || [],
+        ...item.views || []
+      ];
+      registerItem(groupName, {
+        id: item.slug || `collection_${item.collection}`,
+        type: item.slug ? "workspace" : "collection",
+        slug: item.slug || item.collection,
+        collection: item.collection,
+        label: item.label || col?.labels?.plural || item.collection,
+        icon: item.icon || col?.admin?.icon || "Folder",
+        group: groupName,
+        order: item.order ?? col?.admin?.order ?? 100,
+        views: combinedViews,
+        badge: item.badge,
+        access: item.access || col?.access?.read
       });
+      continue;
     }
-    await tx.create({
-      collection: WORKFLOW_HISTORY_COLLECTION,
-      data: {
-        collection: collection.slug,
-        documentId: id,
-        transition: transition.name,
-        from: lockedMeta.state,
-        to: transition.to,
-        revision: lockedMeta.revision,
-        comment: comment ?? null,
-        actorId: user?.sub ?? null,
-        createdAt: now2
-      }
-    });
-    for (const event of events) await persistEvent(tx, event);
-    if (collection.audit) {
-      await tx.create({
-        collection: "__audit",
-        data: {
-          collection: collection.slug,
-          documentId: id,
-          operation: "workflow.transition",
-          user: user?.sub ?? null,
-          timestamp: now2,
-          changes: JSON.stringify({
-            transition: transition.name,
-            from: lockedMeta.state,
-            to: transition.to,
-            revision: lockedMeta.revision
-          })
-        }
+    if (item.global) {
+      const gl = globalsBySlug.get(item.global);
+      registerItem(groupName, {
+        id: item.slug || `global_${item.global}`,
+        type: "global",
+        slug: item.slug || item.global,
+        global: item.global,
+        label: item.label || gl?.label || item.global,
+        icon: item.icon || "Settings",
+        group: groupName,
+        order: item.order ?? 100,
+        views: [],
+        badge: item.badge,
+        access: item.access
       });
+      continue;
     }
-    return next;
-  });
-  for (const event of events) void dispatchLifecycleEvent(config, event);
-  for (const hook of workflow.hooks?.afterTransition ?? []) {
-    try {
-      await hook({ ...hookContext, doc: updated, event: events[0] });
-    } catch (error) {
-      try {
-        const obs = config?.__observability;
-        obs?.recordWorkflowHookFailure?.({
-          collection: collection.slug,
-          transition: transition.name
-        });
-        const logger = config?.logger;
-        if (logger && typeof logger.child === "function") {
-          logger.child({ component: "workflow" }).error({
-            err: error,
-            msg: "afterTransition hook failed",
-            collection: collection.slug,
-            transition: transition.name,
-            documentId: id
-          });
-        } else if (logger && typeof logger.error === "function") {
-          logger.error({
-            err: error,
-            msg: "afterTransition hook failed",
-            collection: collection.slug,
-            transition: transition.name,
-            documentId: id
-          });
-        } else {
-          console.error("afterTransition hook failed:", error);
-        }
-      } catch {
-        console.error("afterTransition hook failed:", error);
-      }
+    if (item.href) {
+      registerItem(groupName, {
+        id: `link_${item.slug || item.href}`,
+        type: "link",
+        slug: item.slug || "link",
+        label: item.label || "Link",
+        href: item.href,
+        icon: item.icon || "ExternalLink",
+        group: groupName,
+        order: item.order ?? 100,
+        views: [],
+        badge: item.badge,
+        access: item.access
+      });
+      continue;
     }
+    const workspaceSlug = item.slug || "workspace";
+    registerItem(groupName, {
+      id: `workspace_${workspaceSlug}`,
+      type: "workspace",
+      slug: workspaceSlug,
+      label: item.label || workspaceSlug,
+      icon: item.icon || "Briefcase",
+      group: groupName,
+      order: item.order ?? 100,
+      views: item.views || [],
+      badge: item.badge,
+      access: item.access
+    });
   }
-  return updated;
-}
-
-// src/detail.ts
-function normalizeDetailItem(item) {
-  if (typeof item === "string") {
-    return {
-      type: "field",
-      field: item
-    };
+  for (const col of collections) {
+    if (mentionedCollections.has(col.slug)) continue;
+    if (col.admin?.hidden) continue;
+    const groupProp = col.admin?.group;
+    const { name: groupName, meta: groupMeta } = resolveGroupMeta(groupProp, "Collections");
+    if (groupMeta) {
+      groupMetadataMap.set(groupName, { ...groupMetadataMap.get(groupName) || {}, ...groupMeta });
+    }
+    const combinedViews = [
+      ...col.views || [],
+      ...injectedViewsByCollection.get(col.slug) || []
+    ];
+    registerItem(groupName, {
+      id: `collection_${col.slug}`,
+      type: "collection",
+      slug: col.slug,
+      collection: col.slug,
+      label: col.labels?.plural || col.slug,
+      icon: col.admin?.icon || "Folder",
+      group: groupName,
+      order: col?.admin?.order ?? 100,
+      views: combinedViews,
+      access: col.access?.read
+    });
   }
-  return item;
-}
-async function evaluateDetailComputed(detail, doc, user, db) {
-  if (!doc || !detail || !Array.isArray(detail)) {
-    return doc;
+  for (const gl of globals) {
+    if (mentionedGlobals.has(gl.slug)) continue;
+    const groupName = "Configuration";
+    registerItem(groupName, {
+      id: `global_${gl.slug}`,
+      type: "global",
+      slug: gl.slug,
+      global: gl.slug,
+      label: gl.label || gl.slug,
+      icon: "Settings",
+      group: groupName,
+      order: 100,
+      views: []
+    });
   }
-  const computedItems = [];
-  const extractComputed = (items) => {
-    for (const rawItem of items) {
-      if (!rawItem) continue;
-      const item = normalizeDetailItem(rawItem);
-      if (item.type === "computed") {
-        const id = item.id || item.label?.toLowerCase().replace(/[^a-z0-9]+/g, "_");
-        if (id) {
-          computedItems.push({
-            id,
-            label: item.label,
-            expression: item.expression,
-            handler: item.handler
-          });
+  const sortAndSpliceItems = (items) => {
+    const sorted = [...items].sort((a, b) => a.order - b.order);
+    const explicitMap = /* @__PURE__ */ new Map();
+    for (const opt of explicitNav) {
+      if (opt.slug) explicitMap.set(opt.slug, opt);
+      if (opt.collection) explicitMap.set(opt.collection, opt);
+      if (opt.global) explicitMap.set(opt.global, opt);
+    }
+    for (const opt of explicitNav) {
+      const itemKey = opt.slug || opt.collection || opt.global;
+      if (!itemKey) continue;
+      if (opt.after) {
+        const itemIdx = sorted.findIndex((i) => i.slug === itemKey);
+        const targetIdx = sorted.findIndex((i) => i.slug === opt.after);
+        if (itemIdx !== -1 && targetIdx !== -1 && itemIdx !== targetIdx) {
+          const [moved] = sorted.splice(itemIdx, 1);
+          const newTargetIdx = sorted.findIndex((i) => i.slug === opt.after);
+          sorted.splice(newTargetIdx + 1, 0, moved);
         }
-      } else if (item.type === "section" || item.type === "grid" || item.type === "repeat") {
-        if (item.items && Array.isArray(item.items)) {
-          extractComputed(item.items);
+      } else if (opt.before) {
+        const itemIdx = sorted.findIndex((i) => i.slug === itemKey);
+        const targetIdx = sorted.findIndex((i) => i.slug === opt.before);
+        if (itemIdx !== -1 && targetIdx !== -1 && itemIdx !== targetIdx) {
+          const [moved] = sorted.splice(itemIdx, 1);
+          const newTargetIdx = sorted.findIndex((i) => i.slug === opt.before);
+          sorted.splice(newTargetIdx, 0, moved);
         }
-      } else if (item.type === "tabs" && item.tabs && Array.isArray(item.tabs)) {
-        for (const tab of item.tabs) {
-          if (tab.items) extractComputed(tab.items);
+      } else if (opt.position === "first") {
+        const itemIdx = sorted.findIndex((i) => i.slug === itemKey);
+        if (itemIdx > 0) {
+          const [moved] = sorted.splice(itemIdx, 1);
+          sorted.unshift(moved);
+        }
+      } else if (opt.position === "last") {
+        const itemIdx = sorted.findIndex((i) => i.slug === itemKey);
+        if (itemIdx !== -1 && itemIdx < sorted.length - 1) {
+          const [moved] = sorted.splice(itemIdx, 1);
+          sorted.push(moved);
         }
       }
     }
+    return sorted;
   };
-  extractComputed(detail);
-  if (computedItems.length === 0) return doc;
-  const evaluated = {};
-  for (const item of computedItems) {
-    try {
-      if (typeof item.handler === "function") {
-        evaluated[item.id] = await item.handler({ doc, user, db });
-      } else if (item.expression) {
-        evaluated[item.id] = await evaluateJexl(item.expression, { doc, user });
-      }
-    } catch (_err) {
-      evaluated[item.id] = null;
-    }
+  const compiledGroups = [];
+  for (const [groupName, rawItems] of itemsByGroup.entries()) {
+    const meta = groupMetadataMap.get(groupName);
+    const sortedItems = sortAndSpliceItems(rawItems);
+    compiledGroups.push({
+      id: `group_${groupName.toLowerCase().replace(/\s+/g, "_")}`,
+      name: groupName,
+      slug: meta?.slug || groupName.toLowerCase().replace(/\s+/g, "-"),
+      icon: meta?.icon,
+      defaultExpanded: meta?.defaultExpanded ?? true,
+      order: meta?.order ?? 100,
+      items: sortedItems
+    });
   }
+  compiledGroups.sort((a, b) => a.order - b.order);
   return {
-    ...doc,
-    _meta: {
-      ...doc._meta || {},
-      computed: evaluated
-    }
+    groups: compiledGroups,
+    ungrouped: sortAndSpliceItems(ungroupedItems)
   };
 }
-
-// src/controllers/collection.controller.ts
-init_rag_service();
-var import_http_exception2 = require("hono/http-exception");
-
-// src/utils/tenant.ts
-var import_http_exception = require("hono/http-exception");
-function getAllowedSitesForUser(user, payload) {
-  const raw = user?.allowedSites ?? user?.siteIds ?? user?.siteAccess ?? (user?.siteId ? [user.siteId] : void 0) ?? payload?.allowedSites ?? payload?.siteIds ?? payload?.siteAccess ?? (payload?.siteId ? [payload.siteId] : void 0);
-  if (Array.isArray(raw)) {
-    return raw.filter((s) => typeof s === "string" && s.trim().length > 0);
+function pruneNavigationForUser(tree, user) {
+  const userRoles = /* @__PURE__ */ new Set();
+  if (user?.role) userRoles.add(user.role);
+  if (Array.isArray(user?.roles)) {
+    for (const r of user.roles) userRoles.add(r);
   }
-  return void 0;
-}
-function isSiteAuthorized(user, payload, requestedSiteId) {
-  const allowedSites = getAllowedSitesForUser(user, payload);
-  if (!allowedSites || allowedSites.length === 0) {
+  const isAllowed = (item) => {
+    if (!item.access) return true;
+    if (Array.isArray(item.access)) {
+      if (item.access.length === 0) return true;
+      return item.access.some((role) => userRoles.has(role));
+    }
     return true;
+  };
+  const prunedGroups = [];
+  for (const group of tree.groups) {
+    const visibleItems = group.items.filter(isAllowed);
+    if (visibleItems.length > 0) {
+      prunedGroups.push({
+        ...group,
+        items: visibleItems
+      });
+    }
   }
-  if (!requestedSiteId) {
-    return false;
-  }
-  return allowedSites.includes(requestedSiteId);
+  return {
+    groups: prunedGroups,
+    ungrouped: tree.ungrouped.filter(isAllowed)
+  };
 }
-function resolveAuthorizedSiteId(c) {
-  const user = typeof c.get === "function" ? c.get("user") : void 0;
-  const tokenPayload = typeof c.get === "function" ? c.get("authTokenPayload") : void 0;
-  const requestedSiteId = (typeof c.req?.header === "function" ? c.req.header("X-Site-Id") : void 0) || (typeof c.get === "function" ? c.get("siteId") : void 0);
-  const allowedSites = getAllowedSitesForUser(user, tokenPayload);
-  if (Array.isArray(allowedSites) && allowedSites.length > 0) {
-    if (!requestedSiteId) {
-      return allowedSites[0];
-    }
-    if (!allowedSites.includes(requestedSiteId)) {
-      throw new import_http_exception.HTTPException(403, {
-        message: `Forbidden: User is not authorized to access site "${requestedSiteId}".`
-      });
+function resolveAllCollectionViews(collection, config) {
+  const views = [...collection.views ?? []];
+  const seenSlugs = new Set(views.map((v) => v.slug));
+  const explicitNav = config?.admin?.navigation;
+  if (Array.isArray(explicitNav)) {
+    for (const item of explicitNav) {
+      if (!item) continue;
+      const itemCol = item.collection || item.addToCollection;
+      if (Array.isArray(item.views)) {
+        for (const view of item.views) {
+          if (!view || !view.slug) continue;
+          const targetCol = view.collection || itemCol;
+          if (targetCol === collection.slug && !seenSlugs.has(view.slug)) {
+            views.push(view);
+            seenSlugs.add(view.slug);
+          }
+        }
+      }
     }
-    return requestedSiteId;
   }
-  return requestedSiteId || "default";
+  return views;
 }
 
 // src/controllers/collection.controller.ts
-var CollectionController = class {
-  collection;
-  constructor(collection) {
-    this.collection = collection;
-  }
-  checkTenantAccess(c) {
-    let siteId;
-    try {
-      const hasSiteHeader = Boolean(c.req.header("X-Site-Id") || c.get("siteId"));
-      const allowedSites = getAllowedSitesForUser(c.get("user"), c.get("authTokenPayload"));
-      if (hasSiteHeader || allowedSites && allowedSites.length > 0) {
-        siteId = resolveAuthorizedSiteId(c);
-      }
-    } catch (err) {
-      if (err instanceof import_http_exception2.HTTPException) {
-        return {
-          ok: false,
-          response: c.json({ error: true, message: err.message }, err.status)
-        };
-      }
-      throw err;
+init_access_control();
+
+// src/utils/action-mutation.ts
+function resolveActionMutation(mutation, ctx) {
+  if (!mutation) return { ...ctx.input ?? {} };
+  return resolveValue(mutation, ctx);
+}
+function resolveValue(value, ctx) {
+  if (typeof value === "string") return resolveExpression(value, ctx);
+  if (Array.isArray(value)) return value.map((item) => resolveValue(item, ctx));
+  if (isPlainObject2(value)) {
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+      out[key] = resolveValue(entry, ctx);
     }
-    if (this.collection.siteId && !this.collection.shared) {
-      if (!siteId || this.collection.siteId !== siteId) {
-        return {
-          ok: false,
-          response: c.json(
-            { error: true, message: `Collection "${this.collection.slug}" not found in project.` },
-            404
-          )
-        };
+    return out;
+  }
+  return value;
+}
+function resolveExpression(expression, ctx) {
+  if (expression === "now()") return (/* @__PURE__ */ new Date()).toISOString();
+  const inputPath = expression.match(/^input\.([A-Za-z0-9_.-]+)$/)?.[1];
+  if (inputPath !== void 0) return getPath(ctx.input, inputPath);
+  const docPath = expression.match(/^doc\.([A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*)$/)?.[1];
+  if (docPath !== void 0) return getPath(ctx.doc, docPath);
+  const userPath = expression.match(/^user\.([A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*)$/)?.[1];
+  if (userPath !== void 0 && ctx.user) return getPath(ctx.user, userPath);
+  return expression;
+}
+function getPath(source, path) {
+  let cursor = source;
+  for (const segment of path.split(".")) {
+    if (!cursor || typeof cursor !== "object") return void 0;
+    cursor = cursor[segment];
+  }
+  return cursor;
+}
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/utils/id.ts
+var import_node_crypto2 = require("crypto");
+var NANOID_ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-";
+var BASE62_ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+var CROCKFORD_BASE32 = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+var COMMON_SLUG_PREFIXES = {
+  users: "usr",
+  members: "mem",
+  accounts: "acc",
+  applications: "app",
+  customers: "cus",
+  products: "prd",
+  orders: "ord",
+  reports: "rpt",
+  sessions: "ses",
+  transactions: "txn",
+  wallets: "wal",
+  media: "med",
+  files: "fil",
+  posts: "post",
+  pages: "page",
+  tags: "tag",
+  categories: "cat",
+  comments: "com"
+};
+function nanoid(size = 21, alphabet = NANOID_ALPHABET) {
+  const mask = (2 << 31 - Math.clz32(alphabet.length - 1 | 1)) - 1;
+  const step = Math.ceil(1.6 * mask * size / alphabet.length);
+  let id = "";
+  while (true) {
+    const bytes = (0, import_node_crypto2.randomBytes)(step);
+    for (let i = 0; i < step; i++) {
+      const byte = bytes[i] & mask;
+      if (alphabet[byte]) {
+        id += alphabet[byte];
+        if (id.length === size) return id;
       }
     }
-    return { ok: true };
   }
-  getDelegatedProvider(c) {
-    const config = c.get("config");
-    const authCollection = getAdminAuthCollection(config);
-    if (!authCollection || this.collection.slug !== authCollection.slug) {
-      return null;
+}
+function encodeUlidTime(now2, len = 10) {
+  let str = "";
+  let time = Math.floor(now2);
+  for (let i = len - 1; i >= 0; i--) {
+    const mod = time % 32;
+    str = CROCKFORD_BASE32[mod] + str;
+    time = (time - mod) / 32;
+  }
+  return str;
+}
+function encodeUlidRandom(bytes) {
+  let str = "";
+  let bitBuffer = 0;
+  let bitsInBuffer = 0;
+  for (let i = 0; i < bytes.length; i++) {
+    bitBuffer = bitBuffer << 8 | bytes[i];
+    bitsInBuffer += 8;
+    while (bitsInBuffer >= 5) {
+      bitsInBuffer -= 5;
+      const index = bitBuffer >> bitsInBuffer & 31;
+      str += CROCKFORD_BASE32[index];
     }
-    return config.adminAuth?.providers?.find((p) => p.members) || null;
   }
-  toHookRequestContext(c) {
-    return toHookRequestContext(c.req);
+  return str;
+}
+function ulid(seedTime = Date.now()) {
+  const timePart = encodeUlidTime(seedTime);
+  const randPart = encodeUlidRandom((0, import_node_crypto2.randomBytes)(10));
+  return timePart + randPart;
+}
+function uuid() {
+  return (0, import_node_crypto2.randomUUID)();
+}
+function resolvePrefix(slug, explicitPrefix) {
+  if (explicitPrefix && typeof explicitPrefix === "string" && explicitPrefix.trim().length > 0) {
+    const cleaned = explicitPrefix.trim().toLowerCase().replace(/[^a-z0-9_]/g, "");
+    if (cleaned.length > 0) return cleaned;
   }
-  sanitizeDoc(doc) {
-    if (!doc || typeof doc !== "object") return doc;
-    if (this.collection.auth) {
-      const {
-        password: _p,
-        salt: _s,
-        resetPasswordToken: _rpt,
-        resetPasswordExpires: _rpe,
-        loginAttempts: _la,
-        lockUntil: _lu,
-        ...safeDoc
-      } = doc;
-      return safeDoc;
-    }
-    return doc;
+  if (!slug || typeof slug !== "string") return "col";
+  const s = slug.trim().toLowerCase();
+  if (COMMON_SLUG_PREFIXES[s]) return COMMON_SLUG_PREFIXES[s];
+  const pieces = s.split(/[-_]/).filter(Boolean);
+  if (pieces.length > 1 && pieces[0].length >= 2) {
+    const first2 = pieces[0].replace(/[^a-z0-9]/g, "");
+    if (first2.length >= 2) return first2.slice(0, 4);
   }
-  async evaluateAccess(c, action, options = {}) {
-    const config = c.get("config");
-    return resolveCollectionAccess(
-      config,
-      this.collection.slug,
-      action,
-      this.collection.access?.[action],
-      {
-        id: options.id,
-        user: c.get("user"),
-        req: this.toHookRequestContext(c),
-        doc: options.doc ?? void 0,
-        data: options.data
-      }
-    );
+  const cleanWord = s.replace(/[^a-z0-9]/g, "");
+  if (cleanWord.length <= 4) return cleanWord || "col";
+  return cleanWord.slice(0, 3) || "col";
+}
+function prefixedId(prefix = "col", size = 16) {
+  const cleanPrefix = (prefix || "col").toLowerCase().replace(/[^a-z0-9_]/g, "") || "col";
+  return `${cleanPrefix}_${nanoid(size, BASE62_ALPHABET)}`;
+}
+function generateId(options) {
+  if (typeof options === "string") {
+    return prefixedId(resolvePrefix(options));
   }
-  async find(c) {
-    const tenantCheck = this.checkTenantAccess(c);
-    if (!tenantCheck.ok) return tenantCheck.response;
-    const config = c.get("config");
-    const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
-    const provider = this.getDelegatedProvider(c);
-    if (provider && provider.members?.list) {
-      const hookReq = this.toHookRequestContext(c);
-      const limit2 = Number(c.req.query("limit")) || 10;
-      const page2 = Number(c.req.query("page")) || 1;
-      const sort2 = c.req.query("sort") || void 0;
-      const search2 = c.req.query("search") || void 0;
-      let where2 = void 0;
-      const whereRaw2 = c.req.query("where");
-      if (whereRaw2) {
-        try {
-          where2 = JSON.parse(decodeURIComponent(whereRaw2));
-        } catch {
-        }
-      }
-      const searchWhere2 = await buildCollectionSearchWhere({
-        collection: this.collection,
-        search: search2,
-        db: createReadonlyDb(db),
-        collections: config.collections
-      });
-      if (searchWhere2) {
-        where2 = mergeWhereConstraint(where2, searchWhere2);
+  const opts = options || {};
+  const type = opts.type || "prefixed-nanoid";
+  switch (type) {
+    case "uuid":
+      return uuid();
+    case "ulid":
+      return ulid();
+    case "nanoid":
+      return nanoid(opts.size || 21);
+    case "prefixed-nanoid":
+    default:
+      return prefixedId(opts.prefix || "col", opts.size || 16);
+  }
+}
+function generateDocumentId(collectionOrSlug) {
+  if (!collectionOrSlug) {
+    return prefixedId("col");
+  }
+  if (typeof collectionOrSlug === "string") {
+    const prefix2 = resolvePrefix(collectionOrSlug);
+    return prefixedId(prefix2);
+  }
+  if (typeof collectionOrSlug.idGenerator === "function") {
+    return collectionOrSlug.idGenerator(collectionOrSlug.slug);
+  }
+  const type = collectionOrSlug.idType || "prefixed-nanoid";
+  const prefix = resolvePrefix(collectionOrSlug.slug, collectionOrSlug.idPrefix);
+  return generateId({ prefix, type });
+}
+
+// src/workflows.ts
+var WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
+var LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
+function simplePublishingWorkflow() {
+  return {
+    initialState: "draft",
+    draftState: "draft",
+    states: [
+      { name: "draft", label: "Draft", color: "neutral" },
+      { name: "published", label: "Published", color: "success", published: true }
+    ],
+    transitions: [
+      { name: "publish", label: "Publish", from: ["draft", "published"], to: "published" },
+      { name: "unpublish", label: "Unpublish", from: "published", to: "draft", unpublish: true }
+    ]
+    // Intentionally no `roles`: this lightweight workflow (synthesized from
+    // `drafts: true`) does no capability-based gating. Draft visibility for a
+    // no-roles workflow is handled in `canViewWorkflowDraft`.
+  };
+}
+function publicMetadata(meta) {
+  const { availableTransitions: _availableTransitions, ...safe } = meta;
+  return safe;
+}
+function workflowCapabilities(workflow, user) {
+  const capabilities = new Set(Array.isArray(user?.capabilities) ? user.capabilities : []);
+  const roles = Array.isArray(user?.roles) ? user.roles : typeof user?.role === "string" ? [user.role] : [];
+  for (const mapping of workflow.roles ?? []) {
+    if (roles.includes(mapping.role)) mapping.capabilities.forEach((capability) => capabilities.add(capability));
+  }
+  return capabilities;
+}
+function canViewWorkflowDraft(workflow, user) {
+  if (!user) return false;
+  const capabilities = workflowCapabilities(workflow, user);
+  if (capabilities.has("entry.edit")) return true;
+  if (workflow.transitions.some(
+    (transition) => (transition.requiredCapabilities ?? []).some((capability) => capabilities.has(capability))
+  )) {
+    return true;
+  }
+  if (!workflow.roles || workflow.roles.length === 0) return true;
+  return false;
+}
+function availableWorkflowTransitions(workflow, state, user) {
+  const capabilities = workflowCapabilities(workflow, user);
+  return workflow.transitions.filter((transition) => {
+    const from = Array.isArray(transition.from) ? transition.from : [transition.from];
+    return from.includes(state) && (transition.requiredCapabilities ?? []).every((item) => capabilities.has(item));
+  });
+}
+function initializeWorkflowDocument(data, workflow) {
+  return {
+    ...data,
+    __workflow: { state: workflow.initialState, revision: 1 }
+  };
+}
+function publishedStateName(workflow) {
+  return workflow.states.find((state) => state.published)?.name ?? workflow.states[workflow.states.length - 1]?.name ?? workflow.initialState;
+}
+function materializeWorkflowDocument(doc, workflow, user) {
+  const meta = doc.__workflow;
+  const publishedState = publishedStateName(workflow);
+  if (!meta) {
+    const { __published: _legacyPublished, __workflow: _legacyWorkflow, ...working2 } = doc;
+    const state = publishedStateName(workflow);
+    return {
+      ...working2,
+      _workflow: {
+        state,
+        revision: 1,
+        availableTransitions: availableWorkflowTransitions(workflow, state, user).map((item) => item.name)
       }
-      const paginatedResult = await provider.members.list({
-        limit: limit2,
-        page: page2,
-        sort: sort2,
-        where: where2,
-        req: hookReq
-      });
-      const mappedDocs = [];
-      for (const m of paginatedResult.docs) {
-        let localId = m.id;
-        const localDoc = await db.find({
-          collection: this.collection.slug,
-          where: m.id ? { externalSubject: { equals: m.id } } : { email: { equals: m.email } },
-          limit: 1
-        });
-        if (localDoc.docs[0]) {
-          localId = localDoc.docs[0].id;
-        }
-        mappedDocs.push({
-          ...m,
-          id: localId,
-          externalSubject: m.id
-        });
+    };
+  }
+  const { __published, __workflow, ...working } = doc;
+  if (!canViewWorkflowDraft(workflow, user)) {
+    if (!__published || typeof __published !== "object") {
+      if (meta.state === publishedState) {
+        return { ...working, _workflow: publicMetadata(meta) };
       }
-      return c.json({
-        ...paginatedResult,
-        docs: mappedDocs
-      });
+      return null;
     }
-    const readonlyDb = createReadonlyDb(db);
-    const limit = Math.min(Number(c.req.query("limit")) || 10, 100);
-    const page = Number(c.req.query("page")) || 1;
-    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
-    const sort = c.req.query("sort") || void 0;
-    const search = c.req.query("search") || void 0;
-    const user = c.get("user");
-    let where = void 0;
-    const whereRaw = c.req.query("where");
-    if (whereRaw) {
-      try {
-        where = JSON.parse(decodeURIComponent(whereRaw));
-      } catch {
-      }
+    return { id: doc.id, ...__published, _workflow: publicMetadata(meta) };
+  }
+  return {
+    ...working,
+    _workflow: {
+      ...meta,
+      availableTransitions: availableWorkflowTransitions(workflow, meta.state, user).map((item) => item.name)
     }
-    if (where) {
-      if (this.collection.admin?.filterable === false) {
-        where = void 0;
-      } else {
-        const { sanitizeWhereClause: sanitizeWhereClause2 } = await Promise.resolve().then(() => (init_where_sanitizer(), where_sanitizer_exports));
-        where = sanitizeWhereClause2(where, this.collection.fields);
-        if (Object.keys(where).length === 0) {
-          where = void 0;
-        }
+  };
+}
+function eventId() {
+  return globalThis.crypto?.randomUUID?.() ?? `evt_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+}
+function createLifecycleEvent(args) {
+  return {
+    id: eventId(),
+    name: args.name,
+    collection: args.collection,
+    documentId: args.documentId,
+    occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+    actorId: args.actorId,
+    payload: args.payload,
+    attempts: 0,
+    status: "pending"
+  };
+}
+async function persistEvent(db, event) {
+  await db.create({ collection: LIFECYCLE_EVENTS_COLLECTION, data: event });
+}
+async function dispatchLifecycleEvent(config, event) {
+  const db = config.db;
+  if (!db || !config.events?.handlers.length) return;
+  const maxAttempts = config.events.maxAttempts ?? 8;
+  const retryDelayMs = config.events.retryDelayMs ?? 1e3;
+  const attempts = event.attempts + 1;
+  try {
+    await db.update({
+      collection: LIFECYCLE_EVENTS_COLLECTION,
+      id: event.id,
+      data: { status: "processing", attempts }
+    });
+    for (const handler of config.events.handlers) await handler({ ...event, status: "processing", attempts });
+    await db.update({
+      collection: LIFECYCLE_EVENTS_COLLECTION,
+      id: event.id,
+      data: { status: "delivered", attempts, deliveredAt: (/* @__PURE__ */ new Date()).toISOString(), lastError: null }
+    });
+  } catch (error) {
+    const exhausted = attempts >= maxAttempts;
+    await db.update({
+      collection: LIFECYCLE_EVENTS_COLLECTION,
+      id: event.id,
+      data: {
+        status: "failed",
+        attempts,
+        lastError: error instanceof Error ? error.message : String(error),
+        nextAttemptAt: exhausted ? null : new Date(Date.now() + retryDelayMs * 2 ** (attempts - 1)).toISOString()
       }
-    }
-    const searchWhere = await buildCollectionSearchWhere({
-      collection: this.collection,
-      search,
-      db: readonlyDb,
-      collections: config.collections
     });
-    if (searchWhere) {
-      where = mergeWhereConstraint(where, searchWhere);
-    }
-    const beforeReadResult = await runCollectionHooks(
-      this.collection.hooks?.beforeRead,
-      {
-        req: c.req,
-        query: where,
-        user,
-        db: readonlyDb
-      },
-      {
-        surface: "collection.beforeRead",
-        path: `collection:${this.collection.slug}.hooks.beforeRead`
-      }
-    );
-    if (beforeReadResult !== void 0) {
-      where = beforeReadResult;
-    }
-    if (this.collection.workflow && !canViewWorkflowDraft(this.collection.workflow, user)) {
-      const publicWorkflowState = publishedStateName(this.collection.workflow);
-      where = where ? {
-        AND: [
-          where,
-          {
-            OR: [
-              { __published: { exists: true } },
-              { __workflow: { exists: false } },
-              { "__workflow.state": { equals: publicWorkflowState } }
-            ]
-          }
-        ]
-      } : {
-        OR: [
-          { __published: { exists: true } },
-          { __workflow: { exists: false } },
-          { "__workflow.state": { equals: publicWorkflowState } }
-        ]
-      };
-    }
-    const access = await this.evaluateAccess(c, "read");
-    if (!access.allowed) {
-      return c.json(
-        {
-          error: true,
-          message: `Access denied: read on ${this.collection.slug}`
-        },
-        403
-      );
+  }
+}
+async function saveWorkflowDraft(args) {
+  const { config, collection, id, originalDoc, data, user, beforeCommit } = args;
+  const db = config.db;
+  const workflow = collection.workflow;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  const previous = originalDoc.__workflow;
+  const isLegacyPublishedDoc = !previous;
+  const baselineRevision = previous?.revision ?? 1;
+  const event = createLifecycleEvent({
+    name: "revision.created",
+    collection: collection.slug,
+    documentId: id,
+    actorId: user?.sub,
+    payload: {
+      revision: baselineRevision + 1,
+      previousRevision: isLegacyPublishedDoc ? baselineRevision : previous?.revision ?? null
     }
-    if (access.constraint) {
-      where = mergeWhereConstraint(where, access.constraint);
+  });
+  const doc = await db.transaction(async (tx) => {
+    const nextMeta = {
+      ...previous ?? {},
+      state: isLegacyPublishedDoc ? workflow.draftState ?? workflow.initialState : originalDoc.__published ? workflow.draftState ?? workflow.initialState : previous.state,
+      revision: baselineRevision + 1,
+      ...isLegacyPublishedDoc ? { publishedRevision: baselineRevision } : {}
+    };
+    const updateData = {
+      ...data,
+      __workflow: nextMeta
+    };
+    if (isLegacyPublishedDoc) {
+      const { __workflow: _legacyWorkflow, __published: _legacyPublished, ...publishedSnapshot } = originalDoc;
+      updateData.__published = publishedSnapshot;
     }
-    let result = await db.find({
-      collection: this.collection.slug,
-      limit,
-      page,
-      sort,
-      where,
-      fields: this.collection.fields
+    const updated = await tx.update({ collection: collection.slug, id, data: updateData });
+    await persistEvent(tx, event);
+    await beforeCommit?.(tx, updated);
+    return updated;
+  });
+  void dispatchLifecycleEvent(config, event);
+  return { doc, event };
+}
+async function createWorkflowDocument(args) {
+  const { config, collection, data, user, beforeCommit } = args;
+  const db = config.db;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  let event;
+  const doc = await db.transaction(async (tx) => {
+    const created = await tx.create({ collection: collection.slug, data });
+    event = createLifecycleEvent({
+      name: "revision.created",
+      collection: collection.slug,
+      documentId: created.id,
+      actorId: user?.sub,
+      payload: { revision: 1, previousRevision: null }
     });
-    if (result.total === 0 && this.collection.initialData && !where && page === 1) {
-      getRequestLogger(c, "collection").info({
-        msg: "Auto-seeding collection from config.initialData",
-        collection: this.collection.slug
+    await persistEvent(tx, event);
+    await beforeCommit?.(tx, created);
+    return created;
+  });
+  void dispatchLifecycleEvent(config, event);
+  return { doc, event };
+}
+async function transitionWorkflow(args) {
+  const { config, collection, id, transitionName, expectedRevision, comment, input, user, req } = args;
+  const db = config.db;
+  const workflow = collection.workflow;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  const original = await db.findOne({ collection: collection.slug, id });
+  if (!original) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
+  const meta = original.__workflow;
+  if (!meta) throw Object.assign(new Error("Entry has no workflow metadata"), { statusCode: 409 });
+  if (expectedRevision !== void 0 && expectedRevision !== meta.revision) {
+    throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), {
+      statusCode: 409
+    });
+  }
+  const transition = workflow.transitions.find((item) => item.name === transitionName);
+  const fromStates = transition ? Array.isArray(transition.from) ? transition.from : [transition.from] : [];
+  if (!transition || !fromStates.includes(meta.state)) {
+    throw Object.assign(new Error(`Transition "${transitionName}" is not valid from "${meta.state}".`), {
+      statusCode: 409
+    });
+  }
+  if (!availableWorkflowTransitions(workflow, meta.state, user).some((item) => item.name === transition.name)) {
+    throw Object.assign(new Error(`You do not have permission to perform "${transition.label}".`), { statusCode: 403 });
+  }
+  if (transition.requireComment && !comment?.trim()) {
+    throw Object.assign(new Error(`A comment is required for "${transition.label}".`), { statusCode: 400 });
+  }
+  const hookContext = { transition, from: meta.state, to: transition.to, doc: original, user, comment, input, req, db };
+  for (const hook of workflow.hooks?.beforeTransition ?? []) await hook(hookContext);
+  const events = [
+    createLifecycleEvent({
+      name: "workflow.transitioned",
+      collection: collection.slug,
+      documentId: id,
+      actorId: user?.sub,
+      payload: { transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision, comment }
+    })
+  ];
+  const targetState = workflow.states.find((state) => state.name === transition.to);
+  if (targetState.published) {
+    events.push(
+      createLifecycleEvent({
+        name: "entry.published",
+        collection: collection.slug,
+        documentId: id,
+        actorId: user?.sub,
+        payload: { revision: meta.revision }
+      })
+    );
+  } else if (transition.unpublish) {
+    events.push(
+      createLifecycleEvent({
+        name: "entry.unpublished",
+        collection: collection.slug,
+        documentId: id,
+        actorId: user?.sub,
+        payload: { revision: meta.publishedRevision }
+      })
+    );
+  }
+  const updated = await db.transaction(async (tx) => {
+    const locked = await tx.findOne({ collection: collection.slug, id });
+    if (!locked) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
+    const lockedMeta = locked.__workflow;
+    if (lockedMeta.revision !== meta.revision || lockedMeta.state !== meta.state || expectedRevision !== void 0 && lockedMeta.revision !== expectedRevision) {
+      throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), {
+        statusCode: 409
       });
-      for (const data of this.collection.initialData) {
-        await db.create({ collection: this.collection.slug, data });
+    }
+    const now2 = (/* @__PURE__ */ new Date()).toISOString();
+    const { __published: _published, __workflow: _workflow, id: _id, ...working } = locked;
+    const nextMeta = {
+      ...lockedMeta,
+      state: transition.to,
+      ...targetState.published ? { publishedRevision: lockedMeta.revision, publishedAt: now2, publishedBy: user?.sub } : {},
+      ...transition.unpublish ? { publishedRevision: void 0, publishedAt: void 0, publishedBy: void 0 } : {}
+    };
+    const data = { __workflow: nextMeta };
+    if (targetState.published) data.__published = working;
+    if (transition.unpublish) data.__published = null;
+    const next = await tx.update({ collection: collection.slug, id, data });
+    if (transition.onTransition) {
+      await transition.onTransition({
+        transition,
+        from: lockedMeta.state,
+        to: transition.to,
+        doc: locked,
+        input,
+        comment,
+        user,
+        req,
+        tx
+      });
+    }
+    await tx.create({
+      collection: WORKFLOW_HISTORY_COLLECTION,
+      data: {
+        collection: collection.slug,
+        documentId: id,
+        transition: transition.name,
+        from: lockedMeta.state,
+        to: transition.to,
+        revision: lockedMeta.revision,
+        comment: comment ?? null,
+        actorId: user?.sub ?? null,
+        createdAt: now2
       }
-      result = await db.find({
-        collection: this.collection.slug,
-        limit,
-        page,
-        sort,
-        where,
-        fields: this.collection.fields
+    });
+    for (const event of events) await persistEvent(tx, event);
+    if (collection.audit) {
+      await tx.create({
+        collection: "__audit",
+        data: {
+          collection: collection.slug,
+          documentId: id,
+          operation: "workflow.transition",
+          user: user?.sub ?? null,
+          timestamp: now2,
+          changes: JSON.stringify({
+            transition: transition.name,
+            from: lockedMeta.state,
+            to: transition.to,
+            revision: lockedMeta.revision
+          })
+        }
       });
     }
-    result.docs = result.docs.map(
-      (doc) => this.collection.workflow ? materializeWorkflowDocument(
-        doc,
-        this.collection.workflow,
-        user
-      ) : doc
-    ).filter((doc) => doc !== null);
-    const processedDocs = [];
-    for (const doc of result.docs) {
-      const docWithDefaults = DefaultsService.apply(
-        this.collection.fields,
-        doc
-      );
-      const docWithCollectionHooks = await runCollectionHooks(
-        this.collection.hooks?.afterRead,
-        {
-          doc: docWithDefaults,
-          req: c.req,
-          user,
-          db: readonlyDb
+    return next;
+  });
+  for (const event of events) void dispatchLifecycleEvent(config, event);
+  for (const hook of workflow.hooks?.afterTransition ?? []) {
+    try {
+      await hook({ ...hookContext, doc: updated, event: events[0] });
+    } catch (error) {
+      try {
+        const obs = config?.__observability;
+        obs?.recordWorkflowHookFailure?.({
+          collection: collection.slug,
+          transition: transition.name
+        });
+        const logger = config?.logger;
+        if (logger && typeof logger.child === "function") {
+          logger.child({ component: "workflow" }).error({
+            err: error,
+            msg: "afterTransition hook failed",
+            collection: collection.slug,
+            transition: transition.name,
+            documentId: id
+          });
+        } else if (logger && typeof logger.error === "function") {
+          logger.error({
+            err: error,
+            msg: "afterTransition hook failed",
+            collection: collection.slug,
+            transition: transition.name,
+            documentId: id
+          });
+        } else {
+          console.error("afterTransition hook failed:", error);
         }
-      );
-      const docWithFieldHooks = await executeFieldAfterRead(
-        this.collection.fields,
-        docWithCollectionHooks,
-        user,
-        readonlyDb
-      );
-      const docWithFieldAccess = await applyFieldReadAccess(
-        {
-          config,
-          fields: this.collection.fields,
-          user,
-          req: this.toHookRequestContext(c),
-          doc: docWithFieldHooks
-        },
-        docWithFieldHooks
-      );
-      processedDocs.push(docWithFieldAccess);
-    }
-    result.docs = processedDocs;
-    if (depth > 0) {
-      const populationService = new PopulationService(db, config.collections);
-      result = await populationService.populateResult(
-        result,
-        this.collection.fields,
-        depth
-      );
-    }
-    if (this.collection.auth && result.docs && Array.isArray(result.docs)) {
-      result.docs = result.docs.map((d) => this.sanitizeDoc(d));
+      } catch {
+        console.error("afterTransition hook failed:", error);
+      }
     }
-    return c.json(result);
   }
-  async findOne(c) {
-    const tenantCheck = this.checkTenantAccess(c);
-    if (!tenantCheck.ok) return tenantCheck.response;
-    const config = c.get("config");
-    const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
-    const provider = this.getDelegatedProvider(c);
-    if (provider && (provider.members?.get || provider.members?.list)) {
-      const hookReq = this.toHookRequestContext(c);
-      const id2 = c.req.param("id");
-      if (!id2) return c.json({ message: "Missing ID" }, 400);
-      const localDoc = await db.findOne({
-        collection: this.collection.slug,
-        id: id2
-      });
-      const externalSubject = localDoc?.externalSubject || id2;
-      if (provider.members.get) {
-        const member = await provider.members.get({
-          externalSubject,
-          req: hookReq
-        });
-        if (member) {
-          return c.json({
-            ...member,
-            id: localDoc ? localDoc.id : member.id,
-            externalSubject: member.id
+  return updated;
+}
+
+// src/detail.ts
+function normalizeDetailItem(item) {
+  if (typeof item === "string") {
+    return {
+      type: "field",
+      field: item
+    };
+  }
+  return item;
+}
+async function evaluateDetailComputed(detail, doc, user, db) {
+  if (!doc || !detail || !Array.isArray(detail)) {
+    return doc;
+  }
+  const computedItems = [];
+  const extractComputed = (items) => {
+    for (const rawItem of items) {
+      if (!rawItem) continue;
+      const item = normalizeDetailItem(rawItem);
+      if (item.type === "computed") {
+        const id = item.id || item.label?.toLowerCase().replace(/[^a-z0-9]+/g, "_");
+        if (id) {
+          computedItems.push({
+            id,
+            label: item.label,
+            expression: item.expression,
+            handler: item.handler
           });
         }
-      } else if (provider.members.list) {
-        const listResult = await provider.members.list({ req: hookReq });
-        const matched = listResult.docs.find((m) => m.id === externalSubject || m.id === id2);
-        if (matched) {
-          return c.json({
-            ...matched,
-            id: localDoc ? localDoc.id : matched.id,
-            externalSubject: matched.id
-          });
+      } else if (item.type === "section" || item.type === "grid" || item.type === "repeat") {
+        if (item.items && Array.isArray(item.items)) {
+          extractComputed(item.items);
+        }
+      } else if (item.type === "tabs" && item.tabs && Array.isArray(item.tabs)) {
+        for (const tab of item.tabs) {
+          if (tab.items) extractComputed(tab.items);
         }
       }
     }
-    const id = c.req.param("id");
-    if (!id) return c.json({ message: "Missing ID" }, 400);
-    const depth = Number.parseInt(c.req.query("depth") || "0", 10);
-    const user = c.get("user");
-    const doc = await db.findOne({
-      collection: this.collection.slug,
-      id
-    });
-    if (!doc) {
-      return c.json({ message: "Document not found" }, 404);
-    }
-    let effectiveDoc = doc;
-    if (this.collection.workflow) {
-      effectiveDoc = materializeWorkflowDocument(
-        doc,
-        this.collection.workflow,
-        user
-      );
-      if (!effectiveDoc) return c.json({ message: "Document not found" }, 404);
-    }
-    const access = await this.evaluateAccess(c, "read", { id, doc: effectiveDoc });
-    if (!access.allowed) {
-      return c.json(
-        {
-          error: true,
-          message: `Access denied: read on ${this.collection.slug}`
-        },
-        403
-      );
-    }
-    const docWithDefaults = DefaultsService.apply(
-      this.collection.fields,
-      effectiveDoc
-    );
-    const readonlyDb = createReadonlyDb(db);
-    const docWithCollectionHooks = await runCollectionHooks(
-      this.collection.hooks?.afterRead,
-      {
-        doc: docWithDefaults,
-        req: c.req,
-        user,
-        db: readonlyDb
+  };
+  extractComputed(detail);
+  if (computedItems.length === 0) return doc;
+  const evaluated = {};
+  for (const item of computedItems) {
+    try {
+      if (typeof item.handler === "function") {
+        evaluated[item.id] = await item.handler({ doc, user, db });
+      } else if (item.expression) {
+        evaluated[item.id] = await evaluateJexl(item.expression, { doc, user });
       }
-    );
-    const docWithFieldHooks = await executeFieldAfterRead(
-      this.collection.fields,
-      docWithCollectionHooks,
-      user,
-      readonlyDb
-    );
-    const docWithFieldAccess = await applyFieldReadAccess(
-      {
-        config,
-        fields: this.collection.fields,
-        user,
-        req: this.toHookRequestContext(c),
-        doc: docWithFieldHooks
-      },
-      docWithFieldHooks
-    );
-    let finalDoc = docWithFieldAccess;
-    if (depth > 0 && docWithFieldAccess) {
-      const populationService = new PopulationService(db, config.collections);
-      finalDoc = await populationService.populate({
-        data: docWithFieldAccess,
-        fields: this.collection.fields,
-        currentDepth: 0,
-        maxDepth: depth
-      });
+    } catch (_err) {
+      evaluated[item.id] = null;
     }
-    if (finalDoc && this.collection.detail) {
-      finalDoc = await evaluateDetailComputed(this.collection.detail, finalDoc, user, readonlyDb);
+  }
+  return {
+    ...doc,
+    _meta: {
+      ...doc._meta || {},
+      computed: evaluated
     }
-    return c.json(this.sanitizeDoc(finalDoc));
+  };
+}
+
+// src/controllers/collection.controller.ts
+init_rag_service();
+var import_http_exception2 = require("hono/http-exception");
+
+// src/utils/tenant.ts
+var import_http_exception = require("hono/http-exception");
+function getAllowedSitesForUser(user, payload) {
+  const raw = user?.allowedSites ?? user?.siteIds ?? user?.siteAccess ?? (user?.siteId ? [user.siteId] : void 0) ?? payload?.allowedSites ?? payload?.siteIds ?? payload?.siteAccess ?? (payload?.siteId ? [payload.siteId] : void 0);
+  if (Array.isArray(raw)) {
+    return raw.filter((s) => typeof s === "string" && s.trim().length > 0);
   }
-  async create(c) {
-    const tenantCheck = this.checkTenantAccess(c);
+  return void 0;
+}
+function isSiteAuthorized(user, payload, requestedSiteId) {
+  const allowedSites = getAllowedSitesForUser(user, payload);
+  if (!allowedSites || allowedSites.length === 0) {
+    return true;
+  }
+  if (!requestedSiteId) {
+    return false;
+  }
+  return allowedSites.includes(requestedSiteId);
+}
+function resolveAuthorizedSiteId(c) {
+  const user = typeof c.get === "function" ? c.get("user") : void 0;
+  const tokenPayload = typeof c.get === "function" ? c.get("authTokenPayload") : void 0;
+  const requestedSiteId = (typeof c.req?.header === "function" ? c.req.header("X-Site-Id") : void 0) || (typeof c.get === "function" ? c.get("siteId") : void 0);
+  const allowedSites = getAllowedSitesForUser(user, tokenPayload);
+  if (Array.isArray(allowedSites) && allowedSites.length > 0) {
+    if (!requestedSiteId) {
+      return allowedSites[0];
+    }
+    if (!allowedSites.includes(requestedSiteId)) {
+      throw new import_http_exception.HTTPException(403, {
+        message: `Forbidden: User is not authorized to access site "${requestedSiteId}".`
+      });
+    }
+    return requestedSiteId;
+  }
+  return requestedSiteId || "default";
+}
+
+// src/controllers/collection.controller.ts
+var CollectionController = class {
+  collection;
+  constructor(collection) {
+    this.collection = collection;
+  }
+  checkTenantAccess(c) {
+    let siteId;
+    try {
+      const hasSiteHeader = Boolean(c.req.header("X-Site-Id") || c.get("siteId"));
+      const allowedSites = getAllowedSitesForUser(c.get("user"), c.get("authTokenPayload"));
+      if (hasSiteHeader || allowedSites && allowedSites.length > 0) {
+        siteId = resolveAuthorizedSiteId(c);
+      }
+    } catch (err) {
+      if (err instanceof import_http_exception2.HTTPException) {
+        return {
+          ok: false,
+          response: c.json({ error: true, message: err.message }, err.status)
+        };
+      }
+      throw err;
+    }
+    if (this.collection.siteId && !this.collection.shared) {
+      if (!siteId || this.collection.siteId !== siteId) {
+        return {
+          ok: false,
+          response: c.json(
+            { error: true, message: `Collection "${this.collection.slug}" not found in project.` },
+            404
+          )
+        };
+      }
+    }
+    return { ok: true };
+  }
+  getDelegatedProvider(c) {
+    const config = c.get("config");
+    const authCollection = getAdminAuthCollection(config);
+    if (!authCollection || this.collection.slug !== authCollection.slug) {
+      return null;
+    }
+    return config.adminAuth?.providers?.find((p) => p.members) || null;
+  }
+  toHookRequestContext(c) {
+    return toHookRequestContext(c.req);
+  }
+  sanitizeDoc(doc) {
+    if (!doc || typeof doc !== "object") return doc;
+    if (this.collection.auth) {
+      const {
+        password: _p,
+        salt: _s,
+        resetPasswordToken: _rpt,
+        resetPasswordExpires: _rpe,
+        loginAttempts: _la,
+        lockUntil: _lu,
+        ...safeDoc
+      } = doc;
+      return safeDoc;
+    }
+    return doc;
+  }
+  async evaluateAccess(c, action, options = {}) {
+    const config = c.get("config");
+    return resolveCollectionAccess(
+      config,
+      this.collection.slug,
+      action,
+      this.collection.access?.[action],
+      {
+        id: options.id,
+        user: c.get("user"),
+        req: this.toHookRequestContext(c),
+        doc: options.doc ?? void 0,
+        data: options.data
+      }
+    );
+  }
+  async find(c) {
+    const tenantCheck = this.checkTenantAccess(c);
     if (!tenantCheck.ok) return tenantCheck.response;
     const config = c.get("config");
     const db = config.db;
     if (!db) return c.json({ message: "Database not configured" }, 500);
     const provider = this.getDelegatedProvider(c);
-    if (provider && provider.members?.create) {
+    if (provider && provider.members?.list) {
       const hookReq = this.toHookRequestContext(c);
-      const contentType2 = c.req.header("Content-Type") || "";
-      if (contentType2.toLowerCase().includes("multipart/form-data")) {
-        return this.upload(c);
+      const limit2 = Number(c.req.query("limit")) || 10;
+      const page2 = Number(c.req.query("page")) || 1;
+      const sort2 = c.req.query("sort") || void 0;
+      const search2 = c.req.query("search") || void 0;
+      let where2 = void 0;
+      const whereRaw2 = c.req.query("where");
+      if (whereRaw2) {
+        try {
+          where2 = JSON.parse(decodeURIComponent(whereRaw2));
+        } catch {
+        }
       }
-      const body2 = await c.req.json();
-      const member = await provider.members.create({
-        data: body2,
+      const searchWhere2 = await buildCollectionSearchWhere({
+        collection: this.collection,
+        search: search2,
+        db: createReadonlyDb(db),
+        collections: config.collections
+      });
+      if (searchWhere2) {
+        where2 = mergeWhereConstraint(where2, searchWhere2);
+      }
+      const paginatedResult = await provider.members.list({
+        limit: limit2,
+        page: page2,
+        sort: sort2,
+        where: where2,
         req: hookReq
       });
-      return c.json(
-        {
-          ...member,
-          id: member.id,
-          externalSubject: member.id
-        },
-        201
-      );
+      const mappedDocs = [];
+      for (const m of paginatedResult.docs) {
+        let localId = m.id;
+        const localDoc = await db.find({
+          collection: this.collection.slug,
+          where: m.id ? { externalSubject: { equals: m.id } } : { email: { equals: m.email } },
+          limit: 1
+        });
+        if (localDoc.docs[0]) {
+          localId = localDoc.docs[0].id;
+        }
+        mappedDocs.push({
+          ...m,
+          id: localId,
+          externalSubject: m.id
+        });
+      }
+      return c.json({
+        ...paginatedResult,
+        docs: mappedDocs
+      });
     }
     const readonlyDb = createReadonlyDb(db);
-    const contentType = c.req.header("Content-Type") || "";
-    if (contentType.toLowerCase().includes("multipart/form-data")) {
-      return this.upload(c);
-    }
-    const body = await c.req.json();
+    const limit = Math.min(Number(c.req.query("limit")) || 10, 100);
+    const page = Number(c.req.query("page")) || 1;
+    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
+    const sort = c.req.query("sort") || void 0;
+    const search = c.req.query("search") || void 0;
     const user = c.get("user");
-    const now2 = (/* @__PURE__ */ new Date()).toISOString();
-    let data = {
-      ...body,
-      createdAt: now2,
-      updatedAt: now2,
-      createdBy: user?.sub ?? null,
-      updatedBy: user?.sub ?? null
-    };
-    data = DefaultsService.apply(this.collection.fields, data);
-    data = normalizeMoneyFields(this.collection.fields, data);
-    if (this.collection.workflow) {
-      data = initializeWorkflowDocument(data, this.collection.workflow);
+    let where = void 0;
+    const whereRaw = c.req.query("where");
+    if (whereRaw) {
+      try {
+        where = JSON.parse(decodeURIComponent(whereRaw));
+      } catch {
+      }
     }
-    const createAccess = await this.evaluateAccess(c, "create", { data });
-    if (!createAccess.allowed) {
-      return c.json(
-        {
-          error: true,
-          message: `Access denied: create on ${this.collection.slug}`
-        },
-        403
-      );
+    if (where) {
+      if (this.collection.admin?.filterable === false) {
+        where = void 0;
+      } else {
+        const { sanitizeWhereClause: sanitizeWhereClause2 } = await Promise.resolve().then(() => (init_where_sanitizer(), where_sanitizer_exports));
+        where = sanitizeWhereClause2(where, this.collection.fields);
+        if (Object.keys(where).length === 0) {
+          where = void 0;
+        }
+      }
     }
-    if (this.collection.auth && data.password) {
-      data.password = await hashPassword(data.password);
+    const searchWhere = await buildCollectionSearchWhere({
+      collection: this.collection,
+      search,
+      db: readonlyDb,
+      collections: config.collections
+    });
+    if (searchWhere) {
+      where = mergeWhereConstraint(where, searchWhere);
     }
-    data = await applyFieldWriteAccess(
+    const beforeReadResult = await runCollectionHooks(
+      this.collection.hooks?.beforeRead,
       {
-        config,
-        fields: this.collection.fields,
+        req: c.req,
+        query: where,
         user,
-        req: this.toHookRequestContext(c),
-        data,
-        operation: "create"
+        db: readonlyDb
       },
-      data
-    );
-    data = await executeFieldBeforeChange(
-      this.collection.fields,
-      data,
-      null,
-      user,
-      readonlyDb
+      {
+        surface: "collection.beforeRead",
+        path: `collection:${this.collection.slug}.hooks.beforeRead`
+      }
     );
-    data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
-      data,
-      req: c.req,
-      user,
-      operation: "create",
-      db: readonlyDb
-    }, {
-      surface: "collection.beforeChange",
-      path: `collection:${this.collection.slug}.hooks.beforeChange`
-    });
-    if (!data.id) {
-      data = { ...data, id: generateDocumentId(this.collection) };
+    if (beforeReadResult !== void 0) {
+      where = beforeReadResult;
     }
-    const beforeCommit = this.buildBeforeCommit(c, "create", user);
-    const doc = this.collection.workflow ? (await createWorkflowDocument({
-      config,
-      collection: this.collection,
-      data,
-      user,
-      beforeCommit
-    })).doc : await this.persistInTransaction(
-      db,
-      beforeCommit,
-      (writer) => writer.create({ collection: this.collection.slug, data })
-    );
-    if (this.collection.audit && db) {
-      AuditService.log(db, {
-        operation: "create",
+    if (this.collection.workflow && !canViewWorkflowDraft(this.collection.workflow, user)) {
+      const publicWorkflowState = publishedStateName(this.collection.workflow);
+      where = where ? {
+        AND: [
+          where,
+          {
+            OR: [
+              { __published: { exists: true } },
+              { __workflow: { exists: false } },
+              { "__workflow.state": { equals: publicWorkflowState } }
+            ]
+          }
+        ]
+      } : {
+        OR: [
+          { __published: { exists: true } },
+          { __workflow: { exists: false } },
+          { "__workflow.state": { equals: publicWorkflowState } }
+        ]
+      };
+    }
+    const access = await this.evaluateAccess(c, "read");
+    if (!access.allowed) {
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: read on ${this.collection.slug}`
+        },
+        403
+      );
+    }
+    if (access.constraint) {
+      where = mergeWhereConstraint(where, access.constraint);
+    }
+    let result = await db.find({
+      collection: this.collection.slug,
+      limit,
+      page,
+      sort,
+      where,
+      fields: this.collection.fields
+    });
+    if (result.total === 0 && this.collection.initialData && !where && page === 1) {
+      getRequestLogger(c, "collection").info({
+        msg: "Auto-seeding collection from config.initialData",
+        collection: this.collection.slug
+      });
+      for (const data of this.collection.initialData) {
+        await db.create({ collection: this.collection.slug, data });
+      }
+      result = await db.find({
         collection: this.collection.slug,
-        documentId: doc.id,
-        user: user ? { id: user.sub, collection: user.collection, email: user.email } : void 0,
-        before: null,
-        after: doc
-      }, config);
+        limit,
+        page,
+        sort,
+        where,
+        fields: this.collection.fields
+      });
     }
-    await runCollectionHooks(
-      this.collection.hooks?.afterChange,
-      {
+    result.docs = result.docs.map(
+      (doc) => this.collection.workflow ? materializeWorkflowDocument(
         doc,
+        this.collection.workflow,
+        user
+      ) : doc
+    ).filter((doc) => doc !== null);
+    const processedDocs = [];
+    for (const doc of result.docs) {
+      const docWithDefaults = DefaultsService.apply(
+        this.collection.fields,
+        doc
+      );
+      const docWithCollectionHooks = await runCollectionHooks(
+        this.collection.hooks?.afterRead,
+        {
+          doc: docWithDefaults,
+          req: c.req,
+          user,
+          db: readonlyDb
+        }
+      );
+      const docWithFieldHooks = await executeFieldAfterRead(
+        this.collection.fields,
+        docWithCollectionHooks,
         user,
-        req: c.req,
-        operation: "create",
-        db
-      },
-      { isolated: true }
-    );
-    if (db && config) {
-      const siteId = resolveAuthorizedSiteId(c);
-      RAGService.indexDocument({
-        db,
-        config,
+        readonlyDb
+      );
+      const docWithFieldAccess = await applyFieldReadAccess(
+        {
+          config,
+          fields: this.collection.fields,
+          user,
+          req: this.toHookRequestContext(c),
+          doc: docWithFieldHooks
+        },
+        docWithFieldHooks
+      );
+      processedDocs.push(docWithFieldAccess);
+    }
+    result.docs = processedDocs;
+    if (depth > 0) {
+      const populationService = new PopulationService(db, config.collections);
+      result = await populationService.populateResult(
+        result,
+        this.collection.fields,
+        depth
+      );
+    }
+    if (this.collection.auth && result.docs && Array.isArray(result.docs)) {
+      result.docs = result.docs.map((d) => this.sanitizeDoc(d));
+    }
+    return c.json(result);
+  }
+  async findOne(c) {
+    const tenantCheck = this.checkTenantAccess(c);
+    if (!tenantCheck.ok) return tenantCheck.response;
+    const config = c.get("config");
+    const db = config.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const provider = this.getDelegatedProvider(c);
+    if (provider && (provider.members?.get || provider.members?.list)) {
+      const hookReq = this.toHookRequestContext(c);
+      const id2 = c.req.param("id");
+      if (!id2) return c.json({ message: "Missing ID" }, 400);
+      const localDoc = await db.findOne({
         collection: this.collection.slug,
-        doc,
-        projectId: siteId
-      }).catch((err) => console.error(`[dyrected/rag] Auto-index create failed:`, err?.message || err));
+        id: id2
+      });
+      const externalSubject = localDoc?.externalSubject || id2;
+      if (provider.members.get) {
+        const member = await provider.members.get({
+          externalSubject,
+          req: hookReq
+        });
+        if (member) {
+          return c.json({
+            ...member,
+            id: localDoc ? localDoc.id : member.id,
+            externalSubject: member.id
+          });
+        }
+      } else if (provider.members.list) {
+        const listResult = await provider.members.list({ req: hookReq });
+        const matched = listResult.docs.find((m) => m.id === externalSubject || m.id === id2);
+        if (matched) {
+          return c.json({
+            ...matched,
+            id: localDoc ? localDoc.id : matched.id,
+            externalSubject: matched.id
+          });
+        }
+      }
     }
-    const responseDoc = this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc;
-    const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
-      doc: responseDoc,
-      req: c.req,
-      user,
-      db: readonlyDb
-    }, {
-      surface: "collection.afterRead",
-      path: `collection:${this.collection.slug}.hooks.afterRead`
+    const id = c.req.param("id");
+    if (!id) return c.json({ message: "Missing ID" }, 400);
+    const depth = Number.parseInt(c.req.query("depth") || "0", 10);
+    const user = c.get("user");
+    const doc = await db.findOne({
+      collection: this.collection.slug,
+      id
     });
-    const finalDoc = await executeFieldAfterRead(
+    if (!doc) {
+      return c.json({ message: "Document not found" }, 404);
+    }
+    let effectiveDoc = doc;
+    if (this.collection.workflow) {
+      effectiveDoc = materializeWorkflowDocument(
+        doc,
+        this.collection.workflow,
+        user
+      );
+      if (!effectiveDoc) return c.json({ message: "Document not found" }, 404);
+    }
+    const access = await this.evaluateAccess(c, "read", { id, doc: effectiveDoc });
+    if (!access.allowed) {
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: read on ${this.collection.slug}`
+        },
+        403
+      );
+    }
+    const docWithDefaults = DefaultsService.apply(
       this.collection.fields,
-      readDoc,
+      effectiveDoc
+    );
+    const readonlyDb = createReadonlyDb(db);
+    const docWithCollectionHooks = await runCollectionHooks(
+      this.collection.hooks?.afterRead,
+      {
+        doc: docWithDefaults,
+        req: c.req,
+        user,
+        db: readonlyDb
+      }
+    );
+    const docWithFieldHooks = await executeFieldAfterRead(
+      this.collection.fields,
+      docWithCollectionHooks,
       user,
       readonlyDb
     );
-    const accessibleDoc = await applyFieldReadAccess(
+    const docWithFieldAccess = await applyFieldReadAccess(
       {
         config,
         fields: this.collection.fields,
         user,
         req: this.toHookRequestContext(c),
-        doc: finalDoc
+        doc: docWithFieldHooks
+      },
+      docWithFieldHooks
+    );
+    let finalDoc = docWithFieldAccess;
+    if (depth > 0 && docWithFieldAccess) {
+      const populationService = new PopulationService(db, config.collections);
+      finalDoc = await populationService.populate({
+        data: docWithFieldAccess,
+        fields: this.collection.fields,
+        currentDepth: 0,
+        maxDepth: depth
+      });
+    }
+    if (finalDoc && this.collection.detail) {
+      finalDoc = await evaluateDetailComputed(this.collection.detail, finalDoc, user, readonlyDb);
+    }
+    return c.json(this.sanitizeDoc(finalDoc));
+  }
+  async create(c) {
+    const tenantCheck = this.checkTenantAccess(c);
+    if (!tenantCheck.ok) return tenantCheck.response;
+    const config = c.get("config");
+    const db = config.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const provider = this.getDelegatedProvider(c);
+    if (provider && provider.members?.create) {
+      const hookReq = this.toHookRequestContext(c);
+      const contentType2 = c.req.header("Content-Type") || "";
+      if (contentType2.toLowerCase().includes("multipart/form-data")) {
+        return this.upload(c);
+      }
+      const body2 = await c.req.json();
+      const member = await provider.members.create({
+        data: body2,
+        req: hookReq
+      });
+      return c.json(
+        {
+          ...member,
+          id: member.id,
+          externalSubject: member.id
+        },
+        201
+      );
+    }
+    const readonlyDb = createReadonlyDb(db);
+    const contentType = c.req.header("Content-Type") || "";
+    if (contentType.toLowerCase().includes("multipart/form-data")) {
+      return this.upload(c);
+    }
+    const body = await c.req.json();
+    const user = c.get("user");
+    const now2 = (/* @__PURE__ */ new Date()).toISOString();
+    let data = {
+      ...body,
+      createdAt: now2,
+      updatedAt: now2,
+      createdBy: user?.sub ?? null,
+      updatedBy: user?.sub ?? null
+    };
+    data = DefaultsService.apply(this.collection.fields, data);
+    data = normalizeMoneyFields(this.collection.fields, data);
+    if (this.collection.workflow) {
+      data = initializeWorkflowDocument(data, this.collection.workflow);
+    }
+    const createAccess = await this.evaluateAccess(c, "create", { data });
+    if (!createAccess.allowed) {
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: create on ${this.collection.slug}`
+        },
+        403
+      );
+    }
+    if (this.collection.auth && data.password) {
+      data.password = await hashPassword(data.password);
+    }
+    data = await applyFieldWriteAccess(
+      {
+        config,
+        fields: this.collection.fields,
+        user,
+        req: this.toHookRequestContext(c),
+        data,
+        operation: "create"
+      },
+      data
+    );
+    data = await executeFieldBeforeChange(
+      this.collection.fields,
+      data,
+      null,
+      user,
+      readonlyDb
+    );
+    data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
+      data,
+      req: c.req,
+      user,
+      operation: "create",
+      db: readonlyDb
+    }, {
+      surface: "collection.beforeChange",
+      path: `collection:${this.collection.slug}.hooks.beforeChange`
+    });
+    if (!data.id) {
+      data = { ...data, id: generateDocumentId(this.collection) };
+    }
+    const beforeCommit = this.buildBeforeCommit(c, "create", user);
+    const doc = this.collection.workflow ? (await createWorkflowDocument({
+      config,
+      collection: this.collection,
+      data,
+      user,
+      beforeCommit
+    })).doc : await this.persistInTransaction(
+      db,
+      beforeCommit,
+      (writer) => writer.create({ collection: this.collection.slug, data })
+    );
+    if (this.collection.audit && db) {
+      AuditService.log(db, {
+        operation: "create",
+        collection: this.collection.slug,
+        documentId: doc.id,
+        user: user ? { id: user.sub, collection: user.collection, email: user.email } : void 0,
+        before: null,
+        after: doc
+      }, config);
+    }
+    await runCollectionHooks(
+      this.collection.hooks?.afterChange,
+      {
+        doc,
+        user,
+        req: c.req,
+        operation: "create",
+        db
+      },
+      { isolated: true }
+    );
+    if (db && config) {
+      const siteId = resolveAuthorizedSiteId(c);
+      RAGService.indexDocument({
+        db,
+        config,
+        collection: this.collection.slug,
+        doc,
+        projectId: siteId
+      }).catch((err) => console.error(`[dyrected/rag] Auto-index create failed:`, err?.message || err));
+    }
+    const responseDoc = this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc;
+    const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
+      doc: responseDoc,
+      req: c.req,
+      user,
+      db: readonlyDb
+    }, {
+      surface: "collection.afterRead",
+      path: `collection:${this.collection.slug}.hooks.afterRead`
+    });
+    const finalDoc = await executeFieldAfterRead(
+      this.collection.fields,
+      readDoc,
+      user,
+      readonlyDb
+    );
+    const accessibleDoc = await applyFieldReadAccess(
+      {
+        config,
+        fields: this.collection.fields,
+        user,
+        req: this.toHookRequestContext(c),
+        doc: finalDoc
       },
       finalDoc
     );
@@ -8085,13 +8638,14 @@ var CollectionController = class {
     const config = c.get("config");
     const db = config.db;
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!this.collection.views?.length && !this.collection.actions?.length) {
+    const allViews = resolveAllCollectionViews(this.collection, config);
+    if (!allViews.length && !this.collection.actions?.length) {
       return c.json({ error: true, message: `Collection ${this.collection.slug} has no views or actions` }, 404);
     }
     const actionName = c.req.param("action");
     const viewSlugParam = c.req.param("viewSlug");
     let action;
-    for (const view2 of this.collection.views ?? []) {
+    for (const view2 of allViews) {
       if (viewSlugParam && view2.slug !== viewSlugParam) continue;
       const match = view2.actions?.find((candidate) => candidate.name === actionName);
       if (match) {
@@ -8120,7 +8674,7 @@ var CollectionController = class {
     const input = body?.input ?? {};
     const user = c.get("user");
     const accessArgs = { user, req: this.toHookRequestContext(c) };
-    const view = viewSlugParam ? this.collection.views?.find((candidate) => candidate.slug === viewSlugParam) : void 0;
+    const view = viewSlugParam ? allViews.find((candidate) => candidate.slug === viewSlugParam) : void 0;
     if (view?.access) {
       const allowed = await resolveBooleanAccess(config, view.access.update ?? view.access.read ?? true, {
         ...accessArgs,
@@ -13750,762 +14304,231 @@ function generateOpenApi(config) {
     };
   }
   if (config.storage) {
-    spec.paths["/api/media/{filename}"] = {
-      get: {
-        tags: ["Media"],
-        summary: "Serve a stored file",
-        security: [],
-        parameters: [
-          {
-            name: "filename",
-            in: "path",
-            required: true,
-            schema: { type: "string" }
-          }
-        ],
-        responses: {
-          200: { description: "Stored file bytes" },
-          404: { description: "File not found" }
-        }
-      }
-    };
-  }
-  return spec;
-}
-function collectionToSchema(collection) {
-  const { properties, required } = fieldsToProperties(collection.fields);
-  return {
-    type: "object",
-    properties: {
-      id: { type: "string" },
-      createdAt: { type: "string", format: "date-time" },
-      updatedAt: { type: "string", format: "date-time" },
-      ...collection.workflow ? { _workflow: { $ref: "#/components/schemas/WorkflowMetadata" } } : {},
-      ...properties
-    },
-    required: ["id", ...required]
-  };
-}
-function globalToSchema(global) {
-  const { properties, required } = fieldsToProperties(global.fields);
-  return {
-    type: "object",
-    properties,
-    required
-  };
-}
-function fieldsToProperties(fields) {
-  const props = {};
-  const required = [];
-  for (const field of fields) {
-    if (field.type === "row") {
-      const nested = fieldsToProperties(field.fields || []);
-      Object.assign(props, nested.properties);
-      required.push(...nested.required);
-      continue;
-    }
-    if (!field.name) continue;
-    props[field.name] = fieldToSchema(field);
-    if (field.required) {
-      required.push(field.name);
-    }
-  }
-  return { properties: props, required };
-}
-function fieldToSchema(field) {
-  let schema;
-  switch (field.type) {
-    case "text":
-    case "textarea":
-    case "email":
-      schema = { type: "string" };
-      break;
-    case "url":
-      schema = {
-        oneOf: [
-          { type: "string" },
-          { type: "object", additionalProperties: true }
-        ]
-      };
-      break;
-    case "icon":
-      schema = { type: "string" };
-      break;
-    case "number":
-      schema = { type: "number" };
-      break;
-    case "money":
-      schema = { type: "integer", description: "Amount in minor units (for example kobo or cents)." };
-      break;
-    case "boolean":
-      schema = { type: "boolean" };
-      break;
-    case "date":
-      schema = { type: "string", format: "date" };
-      break;
-    case "datetime":
-      schema = { type: "string", format: "date-time" };
-      break;
-    case "time":
-      schema = { type: "string", format: "time" };
-      break;
-    case "select":
-    case "radio":
-      schema = {
-        type: "string",
-        enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0
-      };
-      break;
-    case "multiSelect":
-      schema = {
-        type: "array",
-        items: {
-          type: "string",
-          enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0
-        }
-      };
-      break;
-    case "relationship":
-    case "image": {
-      const valueSchema = {
-        type: "string",
-        description: `ID of a ${field.relationTo} record`
-      };
-      schema = field.hasMany ? { type: "array", items: valueSchema } : valueSchema;
-      break;
-    }
-    case "join":
-      schema = {
-        type: "array",
-        readOnly: true,
-        items: { type: "object", additionalProperties: true }
-      };
-      break;
-    case "object": {
-      const { properties, required } = fieldsToProperties(field.fields || []);
-      schema = { type: "object", properties, required };
-      break;
-    }
-    case "array": {
-      const { properties, required } = fieldsToProperties(field.fields || []);
-      schema = {
-        type: "array",
-        items: { type: "object", properties, required }
-      };
-      break;
-    }
-    case "json":
-    case "richText":
-      schema = { type: "object", additionalProperties: true };
-      break;
-    case "blocks":
-      schema = {
-        type: "array",
-        items: {
-          oneOf: field.blocks?.map((block) => {
-            const { properties, required } = fieldsToProperties(block.fields);
-            return {
-              type: "object",
-              properties: {
-                blockType: { type: "string", enum: [block.slug] },
-                ...properties
-              },
-              required: ["blockType", ...required]
-            };
-          })
-        }
-      };
-      break;
-    default:
-      schema = { type: "string" };
-  }
-  if (field.label) schema.description = field.label;
-  return schema;
-}
-
-// src/utils/swagger.ts
-function getSwaggerHtml(specUrl) {
-  return `
-<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <meta name="description" content="SwaggerUI" />
-  <title>Dyrected API Documentation</title>
-  <link rel="stylesheet" href="https://unpkg.com/swagger-ui-dist@5.11.0/swagger-ui.css" />
-</head>
-<body>
-<div id="swagger-ui"></div>
-<script src="https://unpkg.com/swagger-ui-dist@5.11.0/swagger-ui-bundle.js" charset="UTF-8"></script>
-<script src="https://unpkg.com/swagger-ui-dist@5.11.0/swagger-ui-standalone-preset.js" charset="UTF-8"></script>
-<script>
-  window.onload = () => {
-    // Forward the apikey query param when loading the spec and making API calls
-    const params = new URLSearchParams(window.location.search);
-    const apiKey = params.get('apikey');
-    // Resolve the spec relative to this docs page so any mount prefix
-    // (e.g. "/dyrected/api/docs") is preserved. Falls back to an explicit URL
-    // when one is supplied by the caller.
-    const explicitSpecUrl = ${JSON.stringify(specUrl ?? "")};
-    const specUrl = explicitSpecUrl || (window.location.pathname.replace(/\\/docs\\/?$/, '') + '/openapi.json');
-    const specUrlWithKey = apiKey ? specUrl + '?apikey=' + encodeURIComponent(apiKey) : specUrl;
-
-    window.ui = SwaggerUIBundle({
-      url: specUrlWithKey,
-      dom_id: '#swagger-ui',
-      presets: [
-        SwaggerUIBundle.presets.apis,
-        SwaggerUIStandalonePreset
-      ],
-      layout: "BaseLayout",
-      deepLinking: true,
-      showExtensions: true,
-      showCommonExtensions: true,
-      // Inject x-api-key header on every request made from the Swagger UI
-      requestInterceptor: (request) => {
-        if (apiKey) {
-          request.headers['x-api-key'] = apiKey;
-        }
-        return request;
-      }
-    });
-  };
-</script>
-</body>
-</html>
-  `;
-}
-
-// src/types/navigation.ts
-var CURRENT_NAV_PREFERENCES_VERSION = 1;
-var DEFAULT_USER_NAV_PREFERENCES = {
-  _version: CURRENT_NAV_PREFERENCES_VERSION,
-  pinned: [],
-  hidden: [],
-  groupOrder: [],
-  itemOrder: {},
-  groups: [],
-  items: []
-};
-
-// src/utils/navigation-reconciler.ts
-var normalizeKey = (val) => (val || "").toLowerCase().replace(/[^a-z0-9]/g, "-");
-function reconcileNavigation(baseTree, prefs, schemas, options) {
-  if (!baseTree) {
-    return {
-      groups: [],
-      ungrouped: [],
-      pinnedItems: []
-    };
-  }
-  const includeHidden = options?.includeHidden ?? false;
-  const effectivePrefs = prefs || DEFAULT_USER_NAV_PREFERENCES;
-  const hiddenSet = new Set(effectivePrefs.hidden || []);
-  const knownCollectionSlugs = new Set((schemas?.collections || []).map((c) => c.slug));
-  const knownGlobalSlugs = new Set((schemas?.globals || []).map((g) => g.slug));
-  const groupsList = [];
-  const findGroup = (query) => {
-    const qNorm = normalizeKey(query);
-    return groupsList.find(
-      (g) => g.id === query || g.slug === query || g.name === query || normalizeKey(g.id) === qNorm || normalizeKey(g.slug) === qNorm || normalizeKey(g.name) === qNorm
-    );
-  };
-  for (const g of baseTree.groups || []) {
-    groupsList.push({
-      ...g,
-      items: (g.items || []).map((item) => ({ ...item }))
-    });
-  }
-  for (const ug of effectivePrefs.groups || []) {
-    const existing = findGroup(ug.slug || ug.name);
-    if (!existing) {
-      groupsList.push({
-        id: ug.slug ? `group_${ug.slug}` : `group_${normalizeKey(ug.name)}`,
-        name: ug.name,
-        slug: ug.slug || normalizeKey(ug.name),
-        icon: ug.icon || "Folder",
-        defaultExpanded: ug.defaultExpanded ?? true,
-        order: ug.order ?? 100,
-        items: []
-      });
-    }
-  }
-  for (const itemOpt of effectivePrefs.items || []) {
-    const targetGroup = typeof itemOpt.group === "object" ? itemOpt.group?.name : itemOpt.group;
-    const groupKey = targetGroup || "Custom";
-    let group = findGroup(groupKey);
-    if (!group) {
-      group = {
-        id: `group_${normalizeKey(groupKey)}`,
-        name: groupKey,
-        slug: normalizeKey(groupKey),
-        icon: "Folder",
-        defaultExpanded: true,
-        order: 99,
-        items: []
-      };
-      groupsList.push(group);
-    }
-    const itemId = itemOpt.slug ? `workspace_${itemOpt.slug}` : itemOpt.collection ? `collection_${itemOpt.collection}` : `custom_${Math.random()}`;
-    for (const otherGroup of groupsList) {
-      if (otherGroup !== group) {
-        otherGroup.items = otherGroup.items.filter((i) => i.slug !== itemOpt.slug && i.id !== itemId);
-      }
-    }
-    const existingIndex = group.items.findIndex((i) => i.id === itemId || i.slug === itemOpt.slug);
-    const existingItem = existingIndex >= 0 ? group.items[existingIndex] : void 0;
-    const col = schemas?.collections?.find((c) => c.slug === itemOpt.collection);
-    const colViews = col?.views || [];
-    const baseViews = existingItem?.views || [];
-    const userViews = itemOpt.views || [];
-    const userViewSlugs = new Set(userViews.map((v) => v.slug));
-    let mergedViews = [
-      ...baseViews.filter((v) => !userViewSlugs.has(v.slug)),
-      ...userViews
-    ];
-    if (mergedViews.length === 0 && itemOpt.collection) {
-      if (colViews.length > 0) {
-        mergedViews = [...colViews];
-      } else {
-        mergedViews = [
-          {
-            slug: "default",
-            label: col?.label || col?.labels?.plural || itemOpt.label || "All Records",
-            layout: "table",
-            collection: itemOpt.collection
-          }
-        ];
-      }
-    }
-    mergedViews = mergedViews.map((v) => ({
-      ...v,
-      collection: v.collection || itemOpt.collection || existingItem?.collection
-    }));
-    const compiledItem = {
-      id: itemId,
-      type: itemOpt.slug ? "workspace" : itemOpt.collection ? "collection" : itemOpt.global ? "global" : "workspace",
-      slug: itemOpt.slug || itemOpt.collection || itemOpt.global || "item",
-      label: itemOpt.label || itemOpt.slug || "Item",
-      icon: itemOpt.icon || existingItem?.icon || col?.admin?.icon || "Briefcase",
-      group: group.name,
-      order: itemOpt.order ?? existingItem?.order ?? 100,
-      views: mergedViews,
-      collection: itemOpt.collection || existingItem?.collection,
-      global: itemOpt.global || existingItem?.global,
-      badge: itemOpt.badge || existingItem?.badge,
-      access: itemOpt.access || existingItem?.access
-    };
-    if (existingIndex >= 0) {
-      group.items[existingIndex] = compiledItem;
-    } else {
-      group.items.push(compiledItem);
-    }
-  }
-  const allAvailableItems = [];
-  const reconciledGroups = [];
-  for (const group of groupsList) {
-    const isGroupHidden = hiddenSet.has(group.id) || !!group.slug && hiddenSet.has(group.slug) || hiddenSet.has(group.name);
-    if (!includeHidden && isGroupHidden) {
-      continue;
-    }
-    const visibleItems = [];
-    for (const item of group.items) {
-      const isItemHidden = hiddenSet.has(item.id) || !!item.slug && hiddenSet.has(item.slug);
-      if (!includeHidden && isItemHidden) {
-        continue;
-      }
-      const allViews = item.views || [];
-      const visibleViews = includeHidden ? allViews : allViews.filter((v) => {
-        const compoundKey = `${item.slug}_${v.slug}`;
-        return !hiddenSet.has(compoundKey) && !hiddenSet.has(v.slug);
-      });
-      let isTombstone = false;
-      if (schemas && schemas.collections && schemas.collections.length > 0) {
-        if (item.collection && !knownCollectionSlugs.has(item.collection)) {
-          isTombstone = true;
-        }
-      }
-      if (schemas && schemas.globals && schemas.globals.length > 0) {
-        if (item.global && !knownGlobalSlugs.has(item.global)) {
-          isTombstone = true;
-        }
-      }
-      const processedItem = {
-        ...item,
-        views: visibleViews,
-        ...isTombstone ? { isTombstone: true } : {}
-      };
-      visibleItems.push(processedItem);
-      allAvailableItems.push(processedItem);
-    }
-    const groupKey = group.slug || group.name;
-    const itemOrderList = effectivePrefs.itemOrder?.[group.id] || effectivePrefs.itemOrder?.[groupKey];
-    if (itemOrderList && itemOrderList.length > 0) {
-      visibleItems.sort((a, b) => {
-        const aIdx = itemOrderList.indexOf(a.id) >= 0 ? itemOrderList.indexOf(a.id) : a.slug ? itemOrderList.indexOf(a.slug) : -1;
-        const bIdx = itemOrderList.indexOf(b.id) >= 0 ? itemOrderList.indexOf(b.id) : b.slug ? itemOrderList.indexOf(b.slug) : -1;
-        if (aIdx >= 0 && bIdx >= 0) return aIdx - bIdx;
-        if (aIdx >= 0) return -1;
-        if (bIdx >= 0) return 1;
-        return (a.order ?? 100) - (b.order ?? 100);
-      });
-    } else {
-      visibleItems.sort((a, b) => (a.order ?? 100) - (b.order ?? 100));
-    }
-    reconciledGroups.push({
-      ...group,
-      items: visibleItems
-    });
-  }
-  if (effectivePrefs.groupOrder && effectivePrefs.groupOrder.length > 0) {
-    reconciledGroups.sort((a, b) => {
-      const aIdx = effectivePrefs.groupOrder.indexOf(a.id) >= 0 ? effectivePrefs.groupOrder.indexOf(a.id) : a.slug ? effectivePrefs.groupOrder.indexOf(a.slug) : effectivePrefs.groupOrder.indexOf(a.name);
-      const bIdx = effectivePrefs.groupOrder.indexOf(b.id) >= 0 ? effectivePrefs.groupOrder.indexOf(b.id) : b.slug ? effectivePrefs.groupOrder.indexOf(b.slug) : effectivePrefs.groupOrder.indexOf(b.name);
-      if (aIdx >= 0 && bIdx >= 0) return aIdx - bIdx;
-      if (aIdx >= 0) return -1;
-      if (bIdx >= 0) return 1;
-      return (a.order ?? 100) - (b.order ?? 100);
-    });
-  } else {
-    reconciledGroups.sort((a, b) => (a.order ?? 100) - (b.order ?? 100));
-  }
-  const reconciledUngrouped = (baseTree.ungrouped || []).filter((item) => {
-    const isItemHidden = hiddenSet.has(item.id) || !!item.slug && hiddenSet.has(item.slug);
-    return includeHidden || !isItemHidden;
-  }).map((item) => {
-    const allViews = item.views || [];
-    const visibleViews = includeHidden ? allViews : allViews.filter((v) => {
-      const compoundKey = `${item.slug}_${v.slug}`;
-      return !hiddenSet.has(compoundKey) && !hiddenSet.has(v.slug);
-    });
-    const processed = { ...item, views: visibleViews };
-    allAvailableItems.push(processed);
-    return processed;
-  });
-  const pinnedItems = [];
-  for (const pin of effectivePrefs.pinned || []) {
-    const match = allAvailableItems.find((i) => i.slug === pin.slug || i.id === pin.slug);
-    if (match) {
-      pinnedItems.push({
-        ...match,
-        id: `pin_${match.id}`,
-        label: pin.label || match.label,
-        icon: pin.icon || match.icon
-      });
-    } else {
-      pinnedItems.push({
-        id: `pin_${pin.slug}`,
-        type: pin.type,
-        slug: pin.slug,
-        label: pin.label || pin.slug,
-        icon: pin.icon || "Star",
-        order: 0,
-        views: []
-      });
-    }
-  }
-  return {
-    groups: reconciledGroups,
-    ungrouped: reconciledUngrouped,
-    pinnedItems
-  };
-}
-
-// src/utils/navigation.ts
-var RESERVED_NAVIGATION_SLUGS = /* @__PURE__ */ new Set([
-  "collections",
-  "globals",
-  "setup",
-  "api",
-  "login",
-  "logout",
-  "settings",
-  "admin",
-  "preferences",
-  "auth"
-]);
-function assertValidNavigationSlugs(navigation) {
-  for (const item of navigation) {
-    if (item.slug) {
-      const normalizedSlug = item.slug.toLowerCase().trim().replace(/^\//, "");
-      if (RESERVED_NAVIGATION_SLUGS.has(normalizedSlug)) {
-        throw new Error(
-          `[Dyrected Config] The slug '${item.slug}' in navigation item '${item.label || item.slug}' is a reserved system path and cannot be used as an operational workspace slug.`
-        );
-      }
-    }
-  }
-}
-function resolveGroupMeta(groupProp, defaultGroupName = "Collections") {
-  if (!groupProp) {
-    return { name: defaultGroupName };
-  }
-  if (typeof groupProp === "string") {
-    return { name: groupProp };
-  }
-  return { name: groupProp.name, meta: groupProp };
-}
-function compileNavigation(config) {
-  const collections = config.collections || [];
-  const globals = config.globals || [];
-  const explicitNav = config.admin?.navigation || [];
-  assertValidNavigationSlugs(explicitNav);
-  const collectionsBySlug = /* @__PURE__ */ new Map();
-  for (const col of collections) {
-    collectionsBySlug.set(col.slug, col);
-  }
-  const globalsBySlug = /* @__PURE__ */ new Map();
-  for (const gl of globals) {
-    globalsBySlug.set(gl.slug, gl);
-  }
-  const mentionedCollections = /* @__PURE__ */ new Set();
-  const mentionedGlobals = /* @__PURE__ */ new Set();
-  const injectedViewsByCollection = /* @__PURE__ */ new Map();
-  for (const item of explicitNav) {
-    if (item.addToCollection) {
-      const existing = injectedViewsByCollection.get(item.addToCollection) || [];
-      if (item.views && item.views.length > 0) {
-        injectedViewsByCollection.set(item.addToCollection, [...existing, ...item.views]);
-      }
-    }
-    if (item.collection) mentionedCollections.add(item.collection);
-    if (item.global) mentionedGlobals.add(item.global);
-  }
-  const groupMetadataMap = /* @__PURE__ */ new Map();
-  const itemsByGroup = /* @__PURE__ */ new Map();
-  const ungroupedItems = [];
-  const registerItem = (groupName, item) => {
-    if (!groupName) {
-      ungroupedItems.push(item);
-    } else {
-      const list = itemsByGroup.get(groupName) || [];
-      list.push(item);
-      itemsByGroup.set(groupName, list);
-    }
-  };
-  for (const item of explicitNav) {
-    if (item.addToCollection && !item.slug && !item.collection && !item.global && !item.dashboard && !item.href) {
-      continue;
-    }
-    const { name: groupName, meta: groupMeta } = resolveGroupMeta(item.group, void 0);
-    if (groupName && groupMeta) {
-      groupMetadataMap.set(groupName, { ...groupMetadataMap.get(groupName) || {}, ...groupMeta });
-    }
-    if (item.dashboard) {
-      registerItem(groupName, {
-        id: "dashboard",
-        type: "dashboard",
-        slug: "dashboard",
-        label: item.label || "Dashboard",
-        icon: item.icon || "LayoutDashboard",
-        group: groupName,
-        order: item.order ?? 0,
-        views: [],
-        access: item.access
-      });
-      continue;
-    }
-    if (item.collection) {
-      const col = collectionsBySlug.get(item.collection);
-      const combinedViews = [
-        ...col?.views || [],
-        ...injectedViewsByCollection.get(item.collection) || [],
-        ...item.views || []
-      ];
-      registerItem(groupName, {
-        id: item.slug || `collection_${item.collection}`,
-        type: item.slug ? "workspace" : "collection",
-        slug: item.slug || item.collection,
-        collection: item.collection,
-        label: item.label || col?.labels?.plural || item.collection,
-        icon: item.icon || col?.admin?.icon || "Folder",
-        group: groupName,
-        order: item.order ?? col?.admin?.order ?? 100,
-        views: combinedViews,
-        badge: item.badge,
-        access: item.access || col?.access?.read
-      });
-      continue;
-    }
-    if (item.global) {
-      const gl = globalsBySlug.get(item.global);
-      registerItem(groupName, {
-        id: item.slug || `global_${item.global}`,
-        type: "global",
-        slug: item.slug || item.global,
-        global: item.global,
-        label: item.label || gl?.label || item.global,
-        icon: item.icon || "Settings",
-        group: groupName,
-        order: item.order ?? 100,
-        views: [],
-        badge: item.badge,
-        access: item.access
-      });
-      continue;
-    }
-    if (item.href) {
-      registerItem(groupName, {
-        id: `link_${item.slug || item.href}`,
-        type: "link",
-        slug: item.slug || "link",
-        label: item.label || "Link",
-        href: item.href,
-        icon: item.icon || "ExternalLink",
-        group: groupName,
-        order: item.order ?? 100,
-        views: [],
-        badge: item.badge,
-        access: item.access
-      });
-      continue;
-    }
-    const workspaceSlug = item.slug || "workspace";
-    registerItem(groupName, {
-      id: `workspace_${workspaceSlug}`,
-      type: "workspace",
-      slug: workspaceSlug,
-      label: item.label || workspaceSlug,
-      icon: item.icon || "Briefcase",
-      group: groupName,
-      order: item.order ?? 100,
-      views: item.views || [],
-      badge: item.badge,
-      access: item.access
-    });
-  }
-  for (const col of collections) {
-    if (mentionedCollections.has(col.slug)) continue;
-    if (col.admin?.hidden) continue;
-    const groupProp = col.admin?.group;
-    const { name: groupName, meta: groupMeta } = resolveGroupMeta(groupProp, "Collections");
-    if (groupMeta) {
-      groupMetadataMap.set(groupName, { ...groupMetadataMap.get(groupName) || {}, ...groupMeta });
-    }
-    const combinedViews = [
-      ...col.views || [],
-      ...injectedViewsByCollection.get(col.slug) || []
-    ];
-    registerItem(groupName, {
-      id: `collection_${col.slug}`,
-      type: "collection",
-      slug: col.slug,
-      collection: col.slug,
-      label: col.labels?.plural || col.slug,
-      icon: col.admin?.icon || "Folder",
-      group: groupName,
-      order: col?.admin?.order ?? 100,
-      views: combinedViews,
-      access: col.access?.read
-    });
-  }
-  for (const gl of globals) {
-    if (mentionedGlobals.has(gl.slug)) continue;
-    const groupName = "Configuration";
-    registerItem(groupName, {
-      id: `global_${gl.slug}`,
-      type: "global",
-      slug: gl.slug,
-      global: gl.slug,
-      label: gl.label || gl.slug,
-      icon: "Settings",
-      group: groupName,
-      order: 100,
-      views: []
-    });
-  }
-  const sortAndSpliceItems = (items) => {
-    const sorted = [...items].sort((a, b) => a.order - b.order);
-    const explicitMap = /* @__PURE__ */ new Map();
-    for (const opt of explicitNav) {
-      if (opt.slug) explicitMap.set(opt.slug, opt);
-      if (opt.collection) explicitMap.set(opt.collection, opt);
-      if (opt.global) explicitMap.set(opt.global, opt);
-    }
-    for (const opt of explicitNav) {
-      const itemKey = opt.slug || opt.collection || opt.global;
-      if (!itemKey) continue;
-      if (opt.after) {
-        const itemIdx = sorted.findIndex((i) => i.slug === itemKey);
-        const targetIdx = sorted.findIndex((i) => i.slug === opt.after);
-        if (itemIdx !== -1 && targetIdx !== -1 && itemIdx !== targetIdx) {
-          const [moved] = sorted.splice(itemIdx, 1);
-          const newTargetIdx = sorted.findIndex((i) => i.slug === opt.after);
-          sorted.splice(newTargetIdx + 1, 0, moved);
-        }
-      } else if (opt.before) {
-        const itemIdx = sorted.findIndex((i) => i.slug === itemKey);
-        const targetIdx = sorted.findIndex((i) => i.slug === opt.before);
-        if (itemIdx !== -1 && targetIdx !== -1 && itemIdx !== targetIdx) {
-          const [moved] = sorted.splice(itemIdx, 1);
-          const newTargetIdx = sorted.findIndex((i) => i.slug === opt.before);
-          sorted.splice(newTargetIdx, 0, moved);
-        }
-      } else if (opt.position === "first") {
-        const itemIdx = sorted.findIndex((i) => i.slug === itemKey);
-        if (itemIdx > 0) {
-          const [moved] = sorted.splice(itemIdx, 1);
-          sorted.unshift(moved);
-        }
-      } else if (opt.position === "last") {
-        const itemIdx = sorted.findIndex((i) => i.slug === itemKey);
-        if (itemIdx !== -1 && itemIdx < sorted.length - 1) {
-          const [moved] = sorted.splice(itemIdx, 1);
-          sorted.push(moved);
+    spec.paths["/api/media/{filename}"] = {
+      get: {
+        tags: ["Media"],
+        summary: "Serve a stored file",
+        security: [],
+        parameters: [
+          {
+            name: "filename",
+            in: "path",
+            required: true,
+            schema: { type: "string" }
+          }
+        ],
+        responses: {
+          200: { description: "Stored file bytes" },
+          404: { description: "File not found" }
         }
       }
-    }
-    return sorted;
-  };
-  const compiledGroups = [];
-  for (const [groupName, rawItems] of itemsByGroup.entries()) {
-    const meta = groupMetadataMap.get(groupName);
-    const sortedItems = sortAndSpliceItems(rawItems);
-    compiledGroups.push({
-      id: `group_${groupName.toLowerCase().replace(/\s+/g, "_")}`,
-      name: groupName,
-      slug: meta?.slug || groupName.toLowerCase().replace(/\s+/g, "-"),
-      icon: meta?.icon,
-      defaultExpanded: meta?.defaultExpanded ?? true,
-      order: meta?.order ?? 100,
-      items: sortedItems
-    });
+    };
   }
-  compiledGroups.sort((a, b) => a.order - b.order);
+  return spec;
+}
+function collectionToSchema(collection) {
+  const { properties, required } = fieldsToProperties(collection.fields);
   return {
-    groups: compiledGroups,
-    ungrouped: sortAndSpliceItems(ungroupedItems)
+    type: "object",
+    properties: {
+      id: { type: "string" },
+      createdAt: { type: "string", format: "date-time" },
+      updatedAt: { type: "string", format: "date-time" },
+      ...collection.workflow ? { _workflow: { $ref: "#/components/schemas/WorkflowMetadata" } } : {},
+      ...properties
+    },
+    required: ["id", ...required]
   };
 }
-function pruneNavigationForUser(tree, user) {
-  const userRoles = /* @__PURE__ */ new Set();
-  if (user?.role) userRoles.add(user.role);
-  if (Array.isArray(user?.roles)) {
-    for (const r of user.roles) userRoles.add(r);
+function globalToSchema(global) {
+  const { properties, required } = fieldsToProperties(global.fields);
+  return {
+    type: "object",
+    properties,
+    required
+  };
+}
+function fieldsToProperties(fields) {
+  const props = {};
+  const required = [];
+  for (const field of fields) {
+    if (field.type === "row") {
+      const nested = fieldsToProperties(field.fields || []);
+      Object.assign(props, nested.properties);
+      required.push(...nested.required);
+      continue;
+    }
+    if (!field.name) continue;
+    props[field.name] = fieldToSchema(field);
+    if (field.required) {
+      required.push(field.name);
+    }
   }
-  const isAllowed = (item) => {
-    if (!item.access) return true;
-    if (Array.isArray(item.access)) {
-      if (item.access.length === 0) return true;
-      return item.access.some((role) => userRoles.has(role));
+  return { properties: props, required };
+}
+function fieldToSchema(field) {
+  let schema;
+  switch (field.type) {
+    case "text":
+    case "textarea":
+    case "email":
+      schema = { type: "string" };
+      break;
+    case "url":
+      schema = {
+        oneOf: [
+          { type: "string" },
+          { type: "object", additionalProperties: true }
+        ]
+      };
+      break;
+    case "icon":
+      schema = { type: "string" };
+      break;
+    case "number":
+      schema = { type: "number" };
+      break;
+    case "money":
+      schema = { type: "integer", description: "Amount in minor units (for example kobo or cents)." };
+      break;
+    case "boolean":
+      schema = { type: "boolean" };
+      break;
+    case "date":
+      schema = { type: "string", format: "date" };
+      break;
+    case "datetime":
+      schema = { type: "string", format: "date-time" };
+      break;
+    case "time":
+      schema = { type: "string", format: "time" };
+      break;
+    case "select":
+    case "radio":
+      schema = {
+        type: "string",
+        enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0
+      };
+      break;
+    case "multiSelect":
+      schema = {
+        type: "array",
+        items: {
+          type: "string",
+          enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0
+        }
+      };
+      break;
+    case "relationship":
+    case "image": {
+      const valueSchema = {
+        type: "string",
+        description: `ID of a ${field.relationTo} record`
+      };
+      schema = field.hasMany ? { type: "array", items: valueSchema } : valueSchema;
+      break;
     }
-    return true;
-  };
-  const prunedGroups = [];
-  for (const group of tree.groups) {
-    const visibleItems = group.items.filter(isAllowed);
-    if (visibleItems.length > 0) {
-      prunedGroups.push({
-        ...group,
-        items: visibleItems
-      });
+    case "join":
+      schema = {
+        type: "array",
+        readOnly: true,
+        items: { type: "object", additionalProperties: true }
+      };
+      break;
+    case "object": {
+      const { properties, required } = fieldsToProperties(field.fields || []);
+      schema = { type: "object", properties, required };
+      break;
+    }
+    case "array": {
+      const { properties, required } = fieldsToProperties(field.fields || []);
+      schema = {
+        type: "array",
+        items: { type: "object", properties, required }
+      };
+      break;
     }
+    case "json":
+    case "richText":
+      schema = { type: "object", additionalProperties: true };
+      break;
+    case "blocks":
+      schema = {
+        type: "array",
+        items: {
+          oneOf: field.blocks?.map((block) => {
+            const { properties, required } = fieldsToProperties(block.fields);
+            return {
+              type: "object",
+              properties: {
+                blockType: { type: "string", enum: [block.slug] },
+                ...properties
+              },
+              required: ["blockType", ...required]
+            };
+          })
+        }
+      };
+      break;
+    default:
+      schema = { type: "string" };
   }
-  return {
-    groups: prunedGroups,
-    ungrouped: tree.ungrouped.filter(isAllowed)
+  if (field.label) schema.description = field.label;
+  return schema;
+}
+
+// src/utils/swagger.ts
+function getSwaggerHtml(specUrl) {
+  return `
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <meta name="description" content="SwaggerUI" />
+  <title>Dyrected API Documentation</title>
+  <link rel="stylesheet" href="https://unpkg.com/swagger-ui-dist@5.11.0/swagger-ui.css" />
+</head>
+<body>
+<div id="swagger-ui"></div>
+<script src="https://unpkg.com/swagger-ui-dist@5.11.0/swagger-ui-bundle.js" charset="UTF-8"></script>
+<script src="https://unpkg.com/swagger-ui-dist@5.11.0/swagger-ui-standalone-preset.js" charset="UTF-8"></script>
+<script>
+  window.onload = () => {
+    // Forward the apikey query param when loading the spec and making API calls
+    const params = new URLSearchParams(window.location.search);
+    const apiKey = params.get('apikey');
+    // Resolve the spec relative to this docs page so any mount prefix
+    // (e.g. "/dyrected/api/docs") is preserved. Falls back to an explicit URL
+    // when one is supplied by the caller.
+    const explicitSpecUrl = ${JSON.stringify(specUrl ?? "")};
+    const specUrl = explicitSpecUrl || (window.location.pathname.replace(/\\/docs\\/?$/, '') + '/openapi.json');
+    const specUrlWithKey = apiKey ? specUrl + '?apikey=' + encodeURIComponent(apiKey) : specUrl;
+
+    window.ui = SwaggerUIBundle({
+      url: specUrlWithKey,
+      dom_id: '#swagger-ui',
+      presets: [
+        SwaggerUIBundle.presets.apis,
+        SwaggerUIStandalonePreset
+      ],
+      layout: "BaseLayout",
+      deepLinking: true,
+      showExtensions: true,
+      showCommonExtensions: true,
+      // Inject x-api-key header on every request made from the Swagger UI
+      requestInterceptor: (request) => {
+        if (apiKey) {
+          request.headers['x-api-key'] = apiKey;
+        }
+        return request;
+      }
+    });
   };
+</script>
+</body>
+</html>
+  `;
 }
 
 // src/router.ts
@@ -15506,10 +15529,11 @@ function registerRoutes(app, config) {
     app.post(`${path}/media`, (c) => controller.create(c));
     app.delete(`${path}/delete-many`, (c) => controller.deleteMany(c));
     app.post(`${path}/aggregate`, (c) => controller.aggregate(c));
-    if (collection.views?.length) {
+    const allViews = resolveAllCollectionViews(collection, config);
+    if (allViews.length) {
       app.post(`${path}/views/:viewSlug/actions/:action`, optionalAuth(config), (c) => controller.runViewAction(c));
     }
-    if (collection.views?.length || collection.actions?.length) {
+    if (allViews.length || collection.actions?.length) {
       app.post(`${path}/actions/:action`, optionalAuth(config), (c) => controller.runViewAction(c));
     }
     if (collection.audit) {