@dyrected/core 2.5.28 → 2.5.30

package/dist/server.cjs

@@ -62,6 +62,10 @@ function sanitizeWhereClause(where, fields) {
         }
         continue;
       }
+      if (key === "id") {
+        result[key] = value;
+        continue;
+      }
       const fieldDef = fieldMap.get(key);
       if (!fieldDef) continue;
       if (fieldDef.admin?.filterable === false) continue;
@@ -531,6 +535,215 @@ function createReadonlyDb(db) {
   });
 }
 
+// src/workflows.ts
+var WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
+var LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
+function publicMetadata(meta) {
+  const { availableTransitions: _availableTransitions, ...safe } = meta;
+  return safe;
+}
+function workflowCapabilities(workflow, user) {
+  const capabilities = new Set(Array.isArray(user?.capabilities) ? user.capabilities : []);
+  const roles = Array.isArray(user?.roles) ? user.roles : [];
+  for (const mapping of workflow.roles ?? []) {
+    if (roles.includes(mapping.role)) mapping.capabilities.forEach((capability) => capabilities.add(capability));
+  }
+  return capabilities;
+}
+function availableWorkflowTransitions(workflow, state, user) {
+  const capabilities = workflowCapabilities(workflow, user);
+  return workflow.transitions.filter((transition) => {
+    const from = Array.isArray(transition.from) ? transition.from : [transition.from];
+    return from.includes(state) && (transition.requiredCapabilities ?? []).every((item) => capabilities.has(item));
+  });
+}
+function initializeWorkflowDocument(data, workflow) {
+  return {
+    ...data,
+    __workflow: { state: workflow.initialState, revision: 1 }
+  };
+}
+function materializeWorkflowDocument(doc, workflow, user) {
+  const meta = doc.__workflow;
+  if (!meta) return doc;
+  const { __published, __workflow, ...working } = doc;
+  if (!user) {
+    if (!__published || typeof __published !== "object") return null;
+    return { id: doc.id, ...__published, _workflow: publicMetadata(meta) };
+  }
+  return {
+    ...working,
+    _workflow: {
+      ...meta,
+      availableTransitions: availableWorkflowTransitions(workflow, meta.state, user).map((item) => item.name)
+    }
+  };
+}
+function eventId() {
+  return globalThis.crypto?.randomUUID?.() ?? `evt_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+}
+function createLifecycleEvent(args) {
+  return {
+    id: eventId(),
+    name: args.name,
+    collection: args.collection,
+    documentId: args.documentId,
+    occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+    actorId: args.actorId,
+    payload: args.payload,
+    attempts: 0,
+    status: "pending"
+  };
+}
+async function persistEvent(db, event) {
+  await db.create({ collection: LIFECYCLE_EVENTS_COLLECTION, data: event });
+}
+async function dispatchLifecycleEvent(config, event) {
+  const db = config.db;
+  if (!db || !config.events?.handlers.length) return;
+  const maxAttempts = config.events.maxAttempts ?? 8;
+  const retryDelayMs = config.events.retryDelayMs ?? 1e3;
+  const attempts = event.attempts + 1;
+  try {
+    await db.update({ collection: LIFECYCLE_EVENTS_COLLECTION, id: event.id, data: { status: "processing", attempts } });
+    for (const handler of config.events.handlers) await handler({ ...event, status: "processing", attempts });
+    await db.update({
+      collection: LIFECYCLE_EVENTS_COLLECTION,
+      id: event.id,
+      data: { status: "delivered", attempts, deliveredAt: (/* @__PURE__ */ new Date()).toISOString(), lastError: null }
+    });
+  } catch (error) {
+    const exhausted = attempts >= maxAttempts;
+    await db.update({
+      collection: LIFECYCLE_EVENTS_COLLECTION,
+      id: event.id,
+      data: {
+        status: "failed",
+        attempts,
+        lastError: error instanceof Error ? error.message : String(error),
+        nextAttemptAt: exhausted ? null : new Date(Date.now() + retryDelayMs * 2 ** (attempts - 1)).toISOString()
+      }
+    });
+  }
+}
+async function saveWorkflowDraft(args) {
+  const { config, collection, id, originalDoc, data, user } = args;
+  const db = config.db;
+  const workflow = collection.workflow;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  const previous = originalDoc.__workflow;
+  const event = createLifecycleEvent({
+    name: "revision.created",
+    collection: collection.slug,
+    documentId: id,
+    actorId: user?.sub,
+    payload: { revision: previous.revision + 1, previousRevision: previous.revision }
+  });
+  const doc = await db.transaction(async (tx) => {
+    const nextMeta = {
+      ...previous,
+      state: originalDoc.__published ? workflow.draftState ?? workflow.initialState : previous.state,
+      revision: previous.revision + 1
+    };
+    const updated = await tx.update({ collection: collection.slug, id, data: { ...data, __workflow: nextMeta } });
+    await persistEvent(tx, event);
+    return updated;
+  });
+  void dispatchLifecycleEvent(config, event);
+  return { doc, event };
+}
+async function createWorkflowDocument(args) {
+  const { config, collection, data, user } = args;
+  const db = config.db;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  let event;
+  const doc = await db.transaction(async (tx) => {
+    const created = await tx.create({ collection: collection.slug, data });
+    event = createLifecycleEvent({
+      name: "revision.created",
+      collection: collection.slug,
+      documentId: created.id,
+      actorId: user?.sub,
+      payload: { revision: 1, previousRevision: null }
+    });
+    await persistEvent(tx, event);
+    return created;
+  });
+  void dispatchLifecycleEvent(config, event);
+  return { doc, event };
+}
+async function transitionWorkflow(args) {
+  const { config, collection, id, transitionName, expectedRevision, comment, user, req } = args;
+  const db = config.db;
+  const workflow = collection.workflow;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  const original = await db.findOne({ collection: collection.slug, id });
+  if (!original) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
+  const meta = original.__workflow;
+  if (!meta) throw Object.assign(new Error("Entry has no workflow metadata"), { statusCode: 409 });
+  if (expectedRevision !== void 0 && expectedRevision !== meta.revision) {
+    throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
+  }
+  const transition = workflow.transitions.find((item) => item.name === transitionName);
+  const fromStates = transition ? Array.isArray(transition.from) ? transition.from : [transition.from] : [];
+  if (!transition || !fromStates.includes(meta.state)) {
+    throw Object.assign(new Error(`Transition "${transitionName}" is not valid from "${meta.state}".`), { statusCode: 409 });
+  }
+  if (!availableWorkflowTransitions(workflow, meta.state, user).some((item) => item.name === transition.name)) {
+    throw Object.assign(new Error(`You do not have permission to perform "${transition.label}".`), { statusCode: 403 });
+  }
+  if (transition.requireComment && !comment?.trim()) {
+    throw Object.assign(new Error(`A comment is required for "${transition.label}".`), { statusCode: 400 });
+  }
+  const hookContext = { transition, from: meta.state, to: transition.to, doc: original, user, comment, req, db };
+  for (const hook of workflow.hooks?.beforeTransition ?? []) await hook(hookContext);
+  const events = [createLifecycleEvent({
+    name: "workflow.transitioned",
+    collection: collection.slug,
+    documentId: id,
+    actorId: user?.sub,
+    payload: { transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision, comment }
+  })];
+  const targetState = workflow.states.find((state) => state.name === transition.to);
+  if (targetState.published) {
+    events.push(createLifecycleEvent({ name: "entry.published", collection: collection.slug, documentId: id, actorId: user?.sub, payload: { revision: meta.revision } }));
+  } else if (transition.unpublish) {
+    events.push(createLifecycleEvent({ name: "entry.unpublished", collection: collection.slug, documentId: id, actorId: user?.sub, payload: { revision: meta.publishedRevision } }));
+  }
+  const updated = await db.transaction(async (tx) => {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const { __published: _published, __workflow: _workflow, id: _id, ...working } = original;
+    const nextMeta = {
+      ...meta,
+      state: transition.to,
+      ...targetState.published ? { publishedRevision: meta.revision, publishedAt: now, publishedBy: user?.sub } : {},
+      ...transition.unpublish ? { publishedRevision: void 0, publishedAt: void 0, publishedBy: void 0 } : {}
+    };
+    const data = { __workflow: nextMeta };
+    if (targetState.published) data.__published = working;
+    if (transition.unpublish) data.__published = null;
+    const next = await tx.update({ collection: collection.slug, id, data });
+    await tx.create({
+      collection: WORKFLOW_HISTORY_COLLECTION,
+      data: { collection: collection.slug, documentId: id, transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision, comment: comment ?? null, actorId: user?.sub ?? null, createdAt: now }
+    });
+    for (const event of events) await persistEvent(tx, event);
+    if (collection.audit) {
+      await tx.create({ collection: "__audit", data: { collection: collection.slug, documentId: id, operation: "workflow.transition", user: user?.sub ?? null, timestamp: now, changes: JSON.stringify({ transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision }) } });
+    }
+    return next;
+  });
+  for (const event of events) void dispatchLifecycleEvent(config, event);
+  for (const hook of workflow.hooks?.afterTransition ?? []) {
+    try {
+      await hook({ ...hookContext, doc: updated, event: events[0] });
+    } catch (error) {
+      console.error("[dyrected/workflow] afterTransition hook failed:", error);
+    }
+  }
+  return updated;
+}
+
 // src/controllers/collection.controller.ts
 var CollectionController = class {
   collection;
@@ -575,6 +788,9 @@ var CollectionController = class {
     if (beforeReadResult !== void 0) {
       where = beforeReadResult;
     }
+    if (this.collection.workflow && !user) {
+      where = where ? { AND: [where, { __published: { exists: true } }] } : { __published: { exists: true } };
+    }
     let result = await db.find({
       collection: this.collection.slug,
       limit,
@@ -595,7 +811,7 @@ var CollectionController = class {
         where
       });
     }
-    result.docs = result.docs.map((doc) => DefaultsService.apply(this.collection.fields, doc));
+    result.docs = result.docs.map((doc) => this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc).filter((doc) => doc !== null).map((doc) => DefaultsService.apply(this.collection.fields, doc));
     const processedDocs = [];
     for (const doc of result.docs) {
       const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
@@ -623,8 +839,12 @@ var CollectionController = class {
     const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 10;
     const user = c.get("user");
     if (!id) return c.json({ message: "Missing ID" }, 400);
-    const doc = await db.findOne({ collection: this.collection.slug, id });
+    let doc = await db.findOne({ collection: this.collection.slug, id });
     if (!doc) return c.json({ message: "Not Found" }, 404);
+    if (this.collection.workflow) {
+      doc = materializeWorkflowDocument(doc, this.collection.workflow, user);
+      if (!doc) return c.json({ message: "Not Found" }, 404);
+    }
     const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
     const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
       doc: docWithDefaults,
@@ -664,6 +884,9 @@ var CollectionController = class {
       createdBy: user?.sub ?? null,
       updatedBy: user?.sub ?? null
     };
+    if (this.collection.workflow) {
+      data = initializeWorkflowDocument(data, this.collection.workflow);
+    }
     if (this.collection.auth && data.password) {
       data.password = await hashPassword(data.password);
     }
@@ -675,7 +898,7 @@ var CollectionController = class {
       operation: "create",
       db: readonlyDb
     });
-    const doc = await db.create({ collection: this.collection.slug, data });
+    const doc = this.collection.workflow ? (await createWorkflowDocument({ config, collection: this.collection, data, user })).doc : await db.create({ collection: this.collection.slug, data });
     if (this.collection.audit && db) {
       AuditService.log(db, {
         operation: "create",
@@ -693,8 +916,9 @@ var CollectionController = class {
       operation: "create",
       db
     }, { isolated: true });
+    const responseDoc = this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc;
     const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
-      doc,
+      doc: responseDoc,
       req: c.req,
       user,
       db: readonlyDb
@@ -757,8 +981,9 @@ var CollectionController = class {
       operation: "create",
       db
     }, { isolated: true });
+    const responseDoc = this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc;
     const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
-      doc,
+      doc: responseDoc,
       req: c.req,
       user,
       db: readonlyDb
@@ -800,7 +1025,7 @@ var CollectionController = class {
       operation: "update",
       db: readonlyDb
     });
-    const doc = await db.update({ collection: this.collection.slug, id, data });
+    const doc = this.collection.workflow ? (await saveWorkflowDraft({ config, collection: this.collection, id, originalDoc, data, user })).doc : await db.update({ collection: this.collection.slug, id, data });
     if (this.collection.audit && db) {
       AuditService.log(db, {
         operation: "update",
@@ -828,6 +1053,42 @@ var CollectionController = class {
     const finalDoc = await executeFieldAfterRead(this.collection.fields, readDoc, user, readonlyDb);
     return c.json(finalDoc);
   }
+  async transition(c) {
+    const config = c.get("config");
+    if (!config.db) return c.json({ message: "Database not configured" }, 500);
+    if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    const id = c.req.param("id");
+    const transitionName = c.req.param("transition");
+    const body = await c.req.json().catch(() => ({}));
+    try {
+      const doc = await transitionWorkflow({
+        config,
+        collection: this.collection,
+        id,
+        transitionName,
+        expectedRevision: body.expectedRevision,
+        comment: body.comment,
+        user: c.get("user"),
+        req: { query: c.req.query(), headers: c.req.header(), raw: c.req.raw }
+      });
+      return c.json(materializeWorkflowDocument(doc, this.collection.workflow, c.get("user")));
+    } catch (error) {
+      const status = typeof error.statusCode === "number" ? error.statusCode : 500;
+      return c.json({ error: true, message: error instanceof Error ? error.message : String(error) }, status);
+    }
+  }
+  async workflowHistory(c) {
+    const config = c.get("config");
+    if (!config.db) return c.json({ message: "Database not configured" }, 500);
+    if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    const result = await config.db.find({
+      collection: WORKFLOW_HISTORY_COLLECTION,
+      where: { collection: { equals: this.collection.slug }, documentId: { equals: c.req.param("id") } },
+      sort: "-createdAt",
+      limit: Math.min(Number(c.req.query("limit")) || 50, 100)
+    });
+    return c.json(result);
+  }
   /**
    * POST /api/collections/:slug/:id/change-password
    *
@@ -1295,6 +1556,96 @@ async function verifyCollectionToken(token) {
   return payload;
 }
 
+// src/services/email-template.ts
+var emailTokens = {
+  colors: {
+    canvas: "#f6f7f2",
+    surface: "#ffffff",
+    text: "#171717",
+    muted: "#62665b",
+    subtle: "#8a8f82",
+    border: "#dde0d7",
+    accent: "#b6ff2e",
+    code: "#f1f3ec",
+    dangerSurface: "#fff2f0",
+    dangerBorder: "#ffc9c2",
+    dangerText: "#9f251b"
+  },
+  font: "Arial, 'Helvetica Neue', Helvetica, sans-serif",
+  mono: "'Courier New', Courier, monospace",
+  radius: { card: "12px", control: "6px" },
+  width: "600px"
+};
+function escapeHtml(value) {
+  return value.replace(/[&<>'"]/g, (character) => ({
+    "&": "&amp;",
+    "<": "&lt;",
+    ">": "&gt;",
+    "'": "&#39;",
+    '"': "&quot;"
+  })[character]);
+}
+function safeHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" || url.protocol === "http:" ? escapeHtml(url.toString()) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function heading(content) {
+  return `<h1 style="margin:0;font-family:${emailTokens.font};font-size:24px;line-height:1.25;font-weight:700;color:${emailTokens.colors.text}">${escapeHtml(content)}</h1>`;
+}
+function paragraph(content, margin = "0 0 16px") {
+  return `<p style="margin:${margin};font-family:${emailTokens.font};font-size:15px;line-height:1.6;color:${emailTokens.colors.muted}">${escapeHtml(content)}</p>`;
+}
+function sectionLabel(content) {
+  return `<p style="margin:0 0 8px;font-family:${emailTokens.font};font-size:11px;line-height:1.4;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:${emailTokens.colors.subtle}">${escapeHtml(content)}</p>`;
+}
+function divider() {
+  return `<table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%"><tr><td style="height:1px;background:${emailTokens.colors.border};font-size:0;line-height:0">&nbsp;</td></tr></table>`;
+}
+function spacer(height = 16) {
+  return table(row("&nbsp;", `height:${height}px;font-size:0;line-height:0`));
+}
+function row(content, cellStyle = "") {
+  return `<tr><td style="${cellStyle}">${content}</td></tr>`;
+}
+function table(content, style = "width:100%") {
+  return `<table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%" style="${style}">${content}</table>`;
+}
+function detailBox(content, monospace = false) {
+  const font = monospace ? emailTokens.mono : emailTokens.font;
+  return table(row(escapeHtml(content), `padding:14px 16px;font-family:${font};font-size:13px;line-height:1.5;font-weight:${monospace ? "400" : "700"};color:${emailTokens.colors.text};word-break:break-all`), `width:100%;background:${emailTokens.colors.code};border-radius:${emailTokens.radius.control}`);
+}
+function ctaButton(label, href) {
+  const safeHref = safeHttpUrl(href);
+  if (!safeHref) return "";
+  return table(row(
+    `<a href="${safeHref}" style="display:inline-block;padding:13px 22px;border-radius:${emailTokens.radius.control};background:${emailTokens.colors.accent};font-family:${emailTokens.font};font-size:14px;line-height:1.2;font-weight:700;color:${emailTokens.colors.text};text-decoration:none">${escapeHtml(label)}</a>`,
+    "padding:8px 0 24px"
+  ), "width:auto");
+}
+function alertBox(content) {
+  return table(row(escapeHtml(content), `padding:13px 16px;font-family:${emailTokens.font};font-size:13px;line-height:1.5;color:${emailTokens.colors.dangerText}`), `width:100%;background:${emailTokens.colors.dangerSurface};border:1px solid ${emailTokens.colors.dangerBorder};border-radius:${emailTokens.radius.control}`);
+}
+function layout({ preheader, title, content, footer }) {
+  return `<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"></head>
+  <body style="margin:0;padding:0;background:${emailTokens.colors.canvas}">
+    <div style="display:none;max-height:0;overflow:hidden;opacity:0;color:transparent">${escapeHtml(preheader)}</div>
+    ${table(row(
+    table(
+      row("&nbsp;", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${sectionLabel("Dyrected")}${heading(title)}`, "padding:30px 32px 24px") + row(content, "padding:0 32px 32px") + row(`${divider()}${paragraph(footer, "20px 0 6px")}${paragraph("Privacy: this message contains account-related information; please avoid forwarding it.", "0")}`, "padding:0 32px 28px"),
+      `width:100%;max-width:${emailTokens.width};background:${emailTokens.colors.surface};border:1px solid ${emailTokens.colors.border};border-radius:${emailTokens.radius.card};overflow:hidden`
+    ),
+    "padding:32px 12px"
+  ), `width:100%;background:${emailTokens.colors.canvas}`)}
+  </body>
+</html>`;
+}
+
 // src/services/email.service.ts
 var _devSend = null;
 var _devSendPromise = null;
@@ -1338,77 +1689,24 @@ function buildWelcomeEmail(config, args) {
   const custom = config.email?.templates?.welcome?.(args);
   return {
     subject: custom?.subject ?? "Welcome \u2014 your account is ready",
-    html: custom?.html ?? `
-      <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f9fafb;table-layout:fixed">
-        <tr>
-          <td align="center" style="padding:40px 16px">
-            <table cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;background-color:#ffffff;border-radius:12px;border:1px solid #e5e7eb;table-layout:fixed">
-              <tr>
-                <td style="padding:32px 32px 0">
-                  <p style="margin:0 0 4px;font-size:12px;font-weight:600;color:#6b7280;font-family:sans-serif;text-transform:uppercase;letter-spacing:0.05em">Dyrected</p>
-                  <h1 style="margin:0 0 24px;font-size:22px;font-weight:700;color:#111827;font-family:sans-serif">Welcome!</h1>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:0 32px">
-                  <p style="margin:0 0 12px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">Your account has been created. You can now log in with:</p>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f3f4f6;border-radius:6px;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-size:14px;font-weight:600;color:#111827;font-family:sans-serif;word-break:break-all">
-                        ${args.email}
-                      </td>
-                    </tr>
-                  </table>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:32px">
-                  <p style="margin:0;font-size:12px;color:#9ca3af;font-family:sans-serif">If you didn't create this account, you can safely ignore this email.</p>
-                </td>
-              </tr>
-            </table>
-          </td>
-        </tr>
-      </table>`
+    html: custom?.html ?? layout({
+      preheader: "Your Dyrected account is ready.",
+      title: "Welcome \u2014 your account is ready",
+      content: `${paragraph("Your account has been created. You can now log in with:")}${detailBox(args.email)}`,
+      footer: "If you didn't create this account, you can safely ignore this email."
+    })
   };
 }
 function buildInviteEmail(config, args) {
   const custom = config.email?.templates?.invite?.(args);
   return {
     subject: custom?.subject ?? "You've been invited",
-    html: custom?.html ?? `
-      <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f9fafb;table-layout:fixed">
-        <tr>
-          <td align="center" style="padding:40px 16px">
-            <table cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;background-color:#ffffff;border-radius:12px;border:1px solid #e5e7eb;table-layout:fixed">
-              <tr>
-                <td style="padding:32px 32px 0">
-                  <p style="margin:0 0 4px;font-size:12px;font-weight:600;color:#6b7280;font-family:sans-serif;text-transform:uppercase;letter-spacing:0.05em">Dyrected</p>
-                  <h1 style="margin:0 0 24px;font-size:22px;font-weight:700;color:#111827;font-family:sans-serif">You've been invited</h1>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:0 32px">
-                  ${args.invitedByEmail ? `<p style="margin:0 0 12px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">You were invited by <strong style="color:#111827">${args.invitedByEmail}</strong>.</p>` : ""}
-                  <p style="margin:0 0 16px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">Use the token below to accept your invitation. It expires in 7 days.</p>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f3f4f6;border-radius:6px;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-family:monospace;font-size:12px;color:#374151;word-break:break-all;white-space:normal;line-height:1.4">
-                        ${args.token}
-                      </td>
-                    </tr>
-                  </table>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:32px">
-                  <p style="margin:0;font-size:12px;color:#9ca3af;font-family:sans-serif">If you weren't expecting this invitation, you can safely ignore this email.</p>
-                </td>
-              </tr>
-            </table>
-          </td>
-        </tr>
-      </table>`
+    html: custom?.html ?? layout({
+      preheader: "You've been invited to join a Dyrected account.",
+      title: "You've been invited",
+      content: `${args.invitedByEmail ? paragraph(`You were invited by ${args.invitedByEmail}.`) : ""}${paragraph("Use the token below to accept your invitation. It expires in 7 days.")}${sectionLabel("Invitation token")}${detailBox(args.token, true)}`,
+      footer: "If you weren't expecting this invitation, you can safely ignore this email."
+    })
   };
 }
 function buildResetPasswordEmail(config, args) {
@@ -1416,95 +1714,24 @@ function buildResetPasswordEmail(config, args) {
   const resetLink = args.url;
   return {
     subject: custom?.subject ?? "Reset your password",
-    html: custom?.html ?? `
-      <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f9fafb;table-layout:fixed">
-        <tr>
-          <td align="center" style="padding:40px 16px">
-            <table cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;background-color:#ffffff;border-radius:12px;border:1px solid #e5e7eb;table-layout:fixed">
-              <tr>
-                <td style="padding:32px 32px 0">
-                  <p style="margin:0 0 4px;font-size:12px;font-weight:600;color:#6b7280;font-family:sans-serif;text-transform:uppercase;letter-spacing:0.05em">Dyrected</p>
-                  <h1 style="margin:0 0 24px;font-size:22px;font-weight:700;color:#111827;font-family:sans-serif">Reset your password</h1>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:0 32px">
-                  <p style="margin:0 0 24px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">We received a request to reset your password. Use the button below to set a new password. It will expire in 1 hour.</p>
-                  ${resetLink ? `
-                  <table cellpadding="0" cellspacing="0" border="0" style="margin-bottom:24px">
-                    <tr>
-                      <td style="border-radius:6px;background-color:#111827">
-                        <a href="${resetLink}" style="display:inline-block;padding:12px 28px;font-size:14px;font-weight:600;color:#ffffff;text-decoration:none;font-family:sans-serif;border-radius:6px">
-                          Reset Password
-                        </a>
-                      </td>
-                    </tr>
-                  </table>
-                  ` : ""}
-                  <p style="margin:0 0 8px;font-size:12px;color:#9ca3af;font-family:sans-serif">Or copy and paste this token manually in the admin dashboard:</p>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f3f4f6;border-radius:6px;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-family:monospace;font-size:12px;color:#374151;word-break:break-all;white-space:normal;line-height:1.4">
-                        ${args.token}
-                      </td>
-                    </tr>
-                  </table>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:32px">
-                  <p style="margin:0;font-size:12px;color:#9ca3af;font-family:sans-serif">If you didn't request a password reset, you can safely ignore this email.</p>
-                </td>
-              </tr>
-            </table>
-          </td>
-        </tr>
-      </table>`
+    html: custom?.html ?? layout({
+      preheader: "Reset your Dyrected password.",
+      title: "Reset your password",
+      content: `${paragraph("We received a request to reset your password. The reset link and token expire in 1 hour.")}${resetLink ? ctaButton("Reset password", resetLink) : ""}${sectionLabel(resetLink ? "Or use this token" : "Reset token")}${detailBox(args.token, true)}`,
+      footer: "If you didn't request a password reset, you can safely ignore this email."
+    })
   };
 }
 function buildPasswordChangedEmail(config, args) {
   const custom = config.email?.templates?.passwordChanged?.(args);
   return {
     subject: custom?.subject ?? "Your password has been changed",
-    html: custom?.html ?? `
-      <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f9fafb;table-layout:fixed">
-        <tr>
-          <td align="center" style="padding:40px 16px">
-            <table cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;background-color:#ffffff;border-radius:12px;border:1px solid #e5e7eb;table-layout:fixed">
-              <tr>
-                <td style="padding:32px 32px 0">
-                  <p style="margin:0 0 4px;font-size:12px;font-weight:600;color:#6b7280;font-family:sans-serif;text-transform:uppercase;letter-spacing:0.05em">Dyrected</p>
-                  <h1 style="margin:0 0 24px;font-size:22px;font-weight:700;color:#111827;font-family:sans-serif">Password changed</h1>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:0 32px">
-                  <p style="margin:0 0 12px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">The password for your account was just changed:</p>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f3f4f6;border-radius:6px;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-size:14px;font-weight:600;color:#111827;font-family:sans-serif;word-break:break-all">
-                        ${args.email}
-                      </td>
-                    </tr>
-                  </table>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;margin-top:16px;background-color:#fef2f2;border-radius:6px;border:1px solid #fecaca;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-size:13px;color:#b91c1c;line-height:1.5;font-family:sans-serif">
-                        If you did not make this change, please contact support immediately.
-                      </td>
-                    </tr>
-                  </table>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:32px">
-                  <p style="margin:0;font-size:12px;color:#9ca3af;font-family:sans-serif">This is an automated security notification.</p>
-                </td>
-              </tr>
-            </table>
-          </td>
-        </tr>
-      </table>`
+    html: custom?.html ?? layout({
+      preheader: "Your Dyrected password was changed.",
+      title: "Password changed",
+      content: `${paragraph("The password for this account was just changed:")}${detailBox(args.email)}${spacer()}${alertBox("If you did not make this change, please contact support immediately.")}`,
+      footer: "This is an automated security notification."
+    })
   };
 }
 
@@ -2373,7 +2600,22 @@ function registerRoutes(app, config) {
       }))),
       upload: !!col.upload,
       auth: !!col.auth,
-      admin: col.admin
+      admin: col.admin,
+      workflow: col.workflow ? {
+        initialState: col.workflow.initialState,
+        draftState: col.workflow.draftState,
+        states: col.workflow.states,
+        transitions: col.workflow.transitions.map((t) => ({
+          name: t.name,
+          label: t.label,
+          from: t.from,
+          to: t.to,
+          requiredCapabilities: t.requiredCapabilities,
+          requireComment: t.requireComment,
+          unpublish: t.unpublish
+        })),
+        roles: col.workflow.roles
+      } : void 0
     })));
     const filteredGlobals = await Promise.all(globals.filter((glb) => !siteId || glb.shared || !glb.siteId || glb.siteId === siteId).map(async (glb) => ({
       slug: glb.slug,
@@ -2567,6 +2809,10 @@ function registerRoutes(app, config) {
     if (collection.auth) {
       app.post(`${path}/:id/change-password`, requireAuth(), (c) => controller.changePassword(c));
     }
+    if (collection.workflow) {
+      app.post(`${path}/:id/transitions/:transition`, requireAuth(), (c) => controller.transition(c));
+      app.get(`${path}/:id/workflow-history`, requireAuth(), (c) => controller.workflowHistory(c));
+    }
   }
   for (const global of config.globals) {
     const path = `/api/globals/${global.slug}`;
@@ -2578,6 +2824,41 @@ function registerRoutes(app, config) {
   const previewController = new PreviewController();
   app.post("/api/preview-token", requireAuth(), (c) => previewController.createToken(c));
   app.get("/api/preview-data", (c) => previewController.getData(c));
+  app.all("/api/collections/:slug/:id/*", requireAuth(), async (c) => {
+    const slug = c.req.param("slug");
+    const id = c.req.param("id");
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const config2 = c.get("config");
+    if (config2.collections.some((col) => col.slug === slug)) {
+      return c.json({ message: "Not Found" }, 404);
+    }
+    if (!config2.onSchemaFetch || !siteId) {
+      return c.json({ message: `Collection "${slug}" not found` }, 404);
+    }
+    const dynamic = await config2.onSchemaFetch(siteId);
+    const collection = dynamic.collections?.find((col) => col.slug === slug);
+    if (!collection?.workflow) {
+      return c.json({ message: `Collection "${slug}" not found or has no workflow` }, 404);
+    }
+    const controller = new CollectionController(collection);
+    const rawPath = c.req.path;
+    const method = c.req.method;
+    const transitionMatch = rawPath.match(/\/transitions\/([^/]+)$/);
+    if (transitionMatch && method === "POST") {
+      c.req.raw.__transition = transitionMatch[1];
+      const origParam = c.req.param.bind(c.req);
+      c.req.param = (key) => {
+        if (key === "transition") return transitionMatch[1];
+        if (key === "id") return id;
+        return origParam(key);
+      };
+      return controller.transition(c);
+    }
+    if (rawPath.endsWith("/workflow-history") && method === "GET") {
+      return controller.workflowHistory(c);
+    }
+    return c.json({ message: "Not Found" }, 404);
+  });
   app.all("/api/collections/:slug/:id?", async (c) => {
     const slug = c.req.param("slug");
     const id = c.req.param("id");
@@ -2686,10 +2967,47 @@ var AUDIT_COLLECTION = {
   ],
   admin: { hidden: true }
 };
+var WORKFLOW_HISTORY_COLLECTION_CONFIG = {
+  slug: WORKFLOW_HISTORY_COLLECTION,
+  labels: { singular: "Workflow transition", plural: "Workflow transitions" },
+  fields: [
+    { name: "collection", type: "text", required: true },
+    { name: "documentId", type: "text", required: true },
+    { name: "transition", type: "text", required: true },
+    { name: "from", type: "text", required: true },
+    { name: "to", type: "text", required: true },
+    { name: "revision", type: "number", required: true },
+    { name: "comment", type: "textarea" },
+    { name: "actorId", type: "text" },
+    { name: "createdAt", type: "date", required: true }
+  ],
+  access: { read: ({ user }) => !!user, create: () => false, update: () => false, delete: () => false },
+  admin: { hidden: true }
+};
+var LIFECYCLE_EVENTS_COLLECTION_CONFIG = {
+  slug: LIFECYCLE_EVENTS_COLLECTION,
+  labels: { singular: "Lifecycle event", plural: "Lifecycle events" },
+  fields: [
+    { name: "name", type: "text", required: true },
+    { name: "collection", type: "text", required: true },
+    { name: "documentId", type: "text", required: true },
+    { name: "occurredAt", type: "date", required: true },
+    { name: "actorId", type: "text" },
+    { name: "payload", type: "json", required: true },
+    { name: "attempts", type: "number", required: true },
+    { name: "status", type: "select", options: ["pending", "processing", "delivered", "failed"], required: true },
+    { name: "nextAttemptAt", type: "date" },
+    { name: "deliveredAt", type: "date" },
+    { name: "lastError", type: "textarea" }
+  ],
+  access: { read: ({ user }) => !!user?.roles?.includes("admin"), create: () => false, update: () => false, delete: () => false },
+  admin: { hidden: true }
+};
 function normalizeConfig(config) {
   const collections = config?.collections || [];
   const globals = config?.globals || [];
   const needsAudit = collections.some((col) => col.audit);
+  const needsWorkflow = collections.some((col) => col.workflow);
   const normalizedCollections = collections.map((col) => {
     let fields = col.fields || [];
     const existingFieldNames = new Set(fields.map((f) => f.name));
@@ -2784,9 +3102,17 @@ function normalizeConfig(config) {
     };
   });
   const hasAuditCollection = normalizedCollections.some((col) => col.slug === AUDIT_COLLECTION_SLUG);
+  const systemCollections = [];
+  if (needsAudit && !hasAuditCollection) systemCollections.push(AUDIT_COLLECTION);
+  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === WORKFLOW_HISTORY_COLLECTION)) {
+    systemCollections.push(WORKFLOW_HISTORY_COLLECTION_CONFIG);
+  }
+  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === LIFECYCLE_EVENTS_COLLECTION)) {
+    systemCollections.push(LIFECYCLE_EVENTS_COLLECTION_CONFIG);
+  }
   return {
     ...config,
-    collections: [...normalizedCollections, ...needsAudit && !hasAuditCollection ? [AUDIT_COLLECTION] : []],
+    collections: [...normalizedCollections, ...systemCollections],
     globals
   };
 }