@dyrected/core 2.5.29 → 2.5.30

package/dist/server.d.cts

@@ -1,9 +1,10 @@
 import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './index-Bp7PDOYG.cjs';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './index-DTrpTru7.cjs';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
+import 'lucide-react';
 
 interface DyrectedContext {
     Variables: {
@@ -191,6 +192,32 @@ declare class CollectionController {
     }, 400, "json">) | (Response & hono.TypedResponse<{
         message: string;
     }, 404, "json">)>;
+    transition(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
+        message: string;
+    }, 500, "json">) | (Response & hono.TypedResponse<{
+        message: string;
+    }, 404, "json">) | (Response & hono.TypedResponse<{
+        [x: string]: any;
+        id: string;
+    } | null, hono_utils_http_status.ContentfulStatusCode, "json">) | (Response & hono.TypedResponse<{
+        error: true;
+        message: string;
+    }, 400, "json">)>;
+    workflowHistory(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
+        docs: {
+            [x: string]: any;
+        }[];
+        total: number;
+        limit: number;
+        page: number;
+        totalPages: number;
+        hasNextPage: boolean;
+        hasPrevPage: boolean;
+    }, hono_utils_http_status.ContentfulStatusCode, "json">) | (Response & hono.TypedResponse<{
+        message: string;
+    }, 500, "json">) | (Response & hono.TypedResponse<{
+        message: string;
+    }, 404, "json">)>;
     /**
      * POST /api/collections/:slug/:id/change-password
      *

package/dist/server.d.ts

@@ -1,9 +1,10 @@
 import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './index-Bp7PDOYG.js';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './index-DTrpTru7.js';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
+import 'lucide-react';
 
 interface DyrectedContext {
     Variables: {
@@ -191,6 +192,32 @@ declare class CollectionController {
     }, 400, "json">) | (Response & hono.TypedResponse<{
         message: string;
     }, 404, "json">)>;
+    transition(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
+        message: string;
+    }, 500, "json">) | (Response & hono.TypedResponse<{
+        message: string;
+    }, 404, "json">) | (Response & hono.TypedResponse<{
+        [x: string]: any;
+        id: string;
+    } | null, hono_utils_http_status.ContentfulStatusCode, "json">) | (Response & hono.TypedResponse<{
+        error: true;
+        message: string;
+    }, 400, "json">)>;
+    workflowHistory(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
+        docs: {
+            [x: string]: any;
+        }[];
+        total: number;
+        limit: number;
+        page: number;
+        totalPages: number;
+        hasNextPage: boolean;
+        hasPrevPage: boolean;
+    }, hono_utils_http_status.ContentfulStatusCode, "json">) | (Response & hono.TypedResponse<{
+        message: string;
+    }, 500, "json">) | (Response & hono.TypedResponse<{
+        message: string;
+    }, 404, "json">)>;
     /**
      * POST /api/collections/:slug/:id/change-password
      *

package/dist/server.js

@@ -1,9 +1,15 @@
 import {
+  WORKFLOW_HISTORY_COLLECTION,
+  createWorkflowDocument,
   executeFieldAfterRead,
   executeFieldBeforeChange,
+  initializeWorkflowDocument,
+  materializeWorkflowDocument,
   normalizeConfig,
-  runCollectionHooks
-} from "./chunk-SUGK7UYL.js";
+  runCollectionHooks,
+  saveWorkflowDraft,
+  transitionWorkflow
+} from "./chunk-CQDVPMEU.js";
 
 // src/app.ts
 import { Hono } from "hono";
@@ -304,7 +310,7 @@ var CollectionController = class {
       if (this.collection.admin?.filterable === false) {
         where = void 0;
       } else {
-        const { sanitizeWhereClause } = await import("./where-sanitizer-DQIWTQZW.js");
+        const { sanitizeWhereClause } = await import("./where-sanitizer-WJ2W2QCE.js");
         where = sanitizeWhereClause(where, this.collection.fields);
         if (Object.keys(where).length === 0) {
           where = void 0;
@@ -320,6 +326,9 @@ var CollectionController = class {
     if (beforeReadResult !== void 0) {
       where = beforeReadResult;
     }
+    if (this.collection.workflow && !user) {
+      where = where ? { AND: [where, { __published: { exists: true } }] } : { __published: { exists: true } };
+    }
     let result = await db.find({
       collection: this.collection.slug,
       limit,
@@ -340,7 +349,7 @@ var CollectionController = class {
         where
       });
     }
-    result.docs = result.docs.map((doc) => DefaultsService.apply(this.collection.fields, doc));
+    result.docs = result.docs.map((doc) => this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc).filter((doc) => doc !== null).map((doc) => DefaultsService.apply(this.collection.fields, doc));
     const processedDocs = [];
     for (const doc of result.docs) {
       const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
@@ -368,8 +377,12 @@ var CollectionController = class {
     const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 10;
     const user = c.get("user");
     if (!id) return c.json({ message: "Missing ID" }, 400);
-    const doc = await db.findOne({ collection: this.collection.slug, id });
+    let doc = await db.findOne({ collection: this.collection.slug, id });
     if (!doc) return c.json({ message: "Not Found" }, 404);
+    if (this.collection.workflow) {
+      doc = materializeWorkflowDocument(doc, this.collection.workflow, user);
+      if (!doc) return c.json({ message: "Not Found" }, 404);
+    }
     const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
     const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
       doc: docWithDefaults,
@@ -409,6 +422,9 @@ var CollectionController = class {
       createdBy: user?.sub ?? null,
       updatedBy: user?.sub ?? null
     };
+    if (this.collection.workflow) {
+      data = initializeWorkflowDocument(data, this.collection.workflow);
+    }
     if (this.collection.auth && data.password) {
       data.password = await hashPassword(data.password);
     }
@@ -420,7 +436,7 @@ var CollectionController = class {
       operation: "create",
       db: readonlyDb
     });
-    const doc = await db.create({ collection: this.collection.slug, data });
+    const doc = this.collection.workflow ? (await createWorkflowDocument({ config, collection: this.collection, data, user })).doc : await db.create({ collection: this.collection.slug, data });
     if (this.collection.audit && db) {
       AuditService.log(db, {
         operation: "create",
@@ -438,8 +454,9 @@ var CollectionController = class {
       operation: "create",
       db
     }, { isolated: true });
+    const responseDoc = this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc;
     const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
-      doc,
+      doc: responseDoc,
       req: c.req,
       user,
       db: readonlyDb
@@ -502,8 +519,9 @@ var CollectionController = class {
       operation: "create",
       db
     }, { isolated: true });
+    const responseDoc = this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc;
     const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
-      doc,
+      doc: responseDoc,
       req: c.req,
       user,
       db: readonlyDb
@@ -545,7 +563,7 @@ var CollectionController = class {
       operation: "update",
       db: readonlyDb
     });
-    const doc = await db.update({ collection: this.collection.slug, id, data });
+    const doc = this.collection.workflow ? (await saveWorkflowDraft({ config, collection: this.collection, id, originalDoc, data, user })).doc : await db.update({ collection: this.collection.slug, id, data });
     if (this.collection.audit && db) {
       AuditService.log(db, {
         operation: "update",
@@ -573,6 +591,42 @@ var CollectionController = class {
     const finalDoc = await executeFieldAfterRead(this.collection.fields, readDoc, user, readonlyDb);
     return c.json(finalDoc);
   }
+  async transition(c) {
+    const config = c.get("config");
+    if (!config.db) return c.json({ message: "Database not configured" }, 500);
+    if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    const id = c.req.param("id");
+    const transitionName = c.req.param("transition");
+    const body = await c.req.json().catch(() => ({}));
+    try {
+      const doc = await transitionWorkflow({
+        config,
+        collection: this.collection,
+        id,
+        transitionName,
+        expectedRevision: body.expectedRevision,
+        comment: body.comment,
+        user: c.get("user"),
+        req: { query: c.req.query(), headers: c.req.header(), raw: c.req.raw }
+      });
+      return c.json(materializeWorkflowDocument(doc, this.collection.workflow, c.get("user")));
+    } catch (error) {
+      const status = typeof error.statusCode === "number" ? error.statusCode : 500;
+      return c.json({ error: true, message: error instanceof Error ? error.message : String(error) }, status);
+    }
+  }
+  async workflowHistory(c) {
+    const config = c.get("config");
+    if (!config.db) return c.json({ message: "Database not configured" }, 500);
+    if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    const result = await config.db.find({
+      collection: WORKFLOW_HISTORY_COLLECTION,
+      where: { collection: { equals: this.collection.slug }, documentId: { equals: c.req.param("id") } },
+      sort: "-createdAt",
+      limit: Math.min(Number(c.req.query("limit")) || 50, 100)
+    });
+    return c.json(result);
+  }
   /**
    * POST /api/collections/:slug/:id/change-password
    *
@@ -1040,6 +1094,96 @@ async function verifyCollectionToken(token) {
   return payload;
 }
 
+// src/services/email-template.ts
+var emailTokens = {
+  colors: {
+    canvas: "#f6f7f2",
+    surface: "#ffffff",
+    text: "#171717",
+    muted: "#62665b",
+    subtle: "#8a8f82",
+    border: "#dde0d7",
+    accent: "#b6ff2e",
+    code: "#f1f3ec",
+    dangerSurface: "#fff2f0",
+    dangerBorder: "#ffc9c2",
+    dangerText: "#9f251b"
+  },
+  font: "Arial, 'Helvetica Neue', Helvetica, sans-serif",
+  mono: "'Courier New', Courier, monospace",
+  radius: { card: "12px", control: "6px" },
+  width: "600px"
+};
+function escapeHtml(value) {
+  return value.replace(/[&<>'"]/g, (character) => ({
+    "&": "&amp;",
+    "<": "&lt;",
+    ">": "&gt;",
+    "'": "&#39;",
+    '"': "&quot;"
+  })[character]);
+}
+function safeHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" || url.protocol === "http:" ? escapeHtml(url.toString()) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function heading(content) {
+  return `<h1 style="margin:0;font-family:${emailTokens.font};font-size:24px;line-height:1.25;font-weight:700;color:${emailTokens.colors.text}">${escapeHtml(content)}</h1>`;
+}
+function paragraph(content, margin = "0 0 16px") {
+  return `<p style="margin:${margin};font-family:${emailTokens.font};font-size:15px;line-height:1.6;color:${emailTokens.colors.muted}">${escapeHtml(content)}</p>`;
+}
+function sectionLabel(content) {
+  return `<p style="margin:0 0 8px;font-family:${emailTokens.font};font-size:11px;line-height:1.4;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:${emailTokens.colors.subtle}">${escapeHtml(content)}</p>`;
+}
+function divider() {
+  return `<table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%"><tr><td style="height:1px;background:${emailTokens.colors.border};font-size:0;line-height:0">&nbsp;</td></tr></table>`;
+}
+function spacer(height = 16) {
+  return table(row("&nbsp;", `height:${height}px;font-size:0;line-height:0`));
+}
+function row(content, cellStyle = "") {
+  return `<tr><td style="${cellStyle}">${content}</td></tr>`;
+}
+function table(content, style = "width:100%") {
+  return `<table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%" style="${style}">${content}</table>`;
+}
+function detailBox(content, monospace = false) {
+  const font = monospace ? emailTokens.mono : emailTokens.font;
+  return table(row(escapeHtml(content), `padding:14px 16px;font-family:${font};font-size:13px;line-height:1.5;font-weight:${monospace ? "400" : "700"};color:${emailTokens.colors.text};word-break:break-all`), `width:100%;background:${emailTokens.colors.code};border-radius:${emailTokens.radius.control}`);
+}
+function ctaButton(label, href) {
+  const safeHref = safeHttpUrl(href);
+  if (!safeHref) return "";
+  return table(row(
+    `<a href="${safeHref}" style="display:inline-block;padding:13px 22px;border-radius:${emailTokens.radius.control};background:${emailTokens.colors.accent};font-family:${emailTokens.font};font-size:14px;line-height:1.2;font-weight:700;color:${emailTokens.colors.text};text-decoration:none">${escapeHtml(label)}</a>`,
+    "padding:8px 0 24px"
+  ), "width:auto");
+}
+function alertBox(content) {
+  return table(row(escapeHtml(content), `padding:13px 16px;font-family:${emailTokens.font};font-size:13px;line-height:1.5;color:${emailTokens.colors.dangerText}`), `width:100%;background:${emailTokens.colors.dangerSurface};border:1px solid ${emailTokens.colors.dangerBorder};border-radius:${emailTokens.radius.control}`);
+}
+function layout({ preheader, title, content, footer }) {
+  return `<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"></head>
+  <body style="margin:0;padding:0;background:${emailTokens.colors.canvas}">
+    <div style="display:none;max-height:0;overflow:hidden;opacity:0;color:transparent">${escapeHtml(preheader)}</div>
+    ${table(row(
+    table(
+      row("&nbsp;", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${sectionLabel("Dyrected")}${heading(title)}`, "padding:30px 32px 24px") + row(content, "padding:0 32px 32px") + row(`${divider()}${paragraph(footer, "20px 0 6px")}${paragraph("Privacy: this message contains account-related information; please avoid forwarding it.", "0")}`, "padding:0 32px 28px"),
+      `width:100%;max-width:${emailTokens.width};background:${emailTokens.colors.surface};border:1px solid ${emailTokens.colors.border};border-radius:${emailTokens.radius.card};overflow:hidden`
+    ),
+    "padding:32px 12px"
+  ), `width:100%;background:${emailTokens.colors.canvas}`)}
+  </body>
+</html>`;
+}
+
 // src/services/email.service.ts
 var _devSend = null;
 var _devSendPromise = null;
@@ -1083,77 +1227,24 @@ function buildWelcomeEmail(config, args) {
   const custom = config.email?.templates?.welcome?.(args);
   return {
     subject: custom?.subject ?? "Welcome \u2014 your account is ready",
-    html: custom?.html ?? `
-      <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f9fafb;table-layout:fixed">
-        <tr>
-          <td align="center" style="padding:40px 16px">
-            <table cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;background-color:#ffffff;border-radius:12px;border:1px solid #e5e7eb;table-layout:fixed">
-              <tr>
-                <td style="padding:32px 32px 0">
-                  <p style="margin:0 0 4px;font-size:12px;font-weight:600;color:#6b7280;font-family:sans-serif;text-transform:uppercase;letter-spacing:0.05em">Dyrected</p>
-                  <h1 style="margin:0 0 24px;font-size:22px;font-weight:700;color:#111827;font-family:sans-serif">Welcome!</h1>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:0 32px">
-                  <p style="margin:0 0 12px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">Your account has been created. You can now log in with:</p>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f3f4f6;border-radius:6px;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-size:14px;font-weight:600;color:#111827;font-family:sans-serif;word-break:break-all">
-                        ${args.email}
-                      </td>
-                    </tr>
-                  </table>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:32px">
-                  <p style="margin:0;font-size:12px;color:#9ca3af;font-family:sans-serif">If you didn't create this account, you can safely ignore this email.</p>
-                </td>
-              </tr>
-            </table>
-          </td>
-        </tr>
-      </table>`
+    html: custom?.html ?? layout({
+      preheader: "Your Dyrected account is ready.",
+      title: "Welcome \u2014 your account is ready",
+      content: `${paragraph("Your account has been created. You can now log in with:")}${detailBox(args.email)}`,
+      footer: "If you didn't create this account, you can safely ignore this email."
+    })
   };
 }
 function buildInviteEmail(config, args) {
   const custom = config.email?.templates?.invite?.(args);
   return {
     subject: custom?.subject ?? "You've been invited",
-    html: custom?.html ?? `
-      <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f9fafb;table-layout:fixed">
-        <tr>
-          <td align="center" style="padding:40px 16px">
-            <table cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;background-color:#ffffff;border-radius:12px;border:1px solid #e5e7eb;table-layout:fixed">
-              <tr>
-                <td style="padding:32px 32px 0">
-                  <p style="margin:0 0 4px;font-size:12px;font-weight:600;color:#6b7280;font-family:sans-serif;text-transform:uppercase;letter-spacing:0.05em">Dyrected</p>
-                  <h1 style="margin:0 0 24px;font-size:22px;font-weight:700;color:#111827;font-family:sans-serif">You've been invited</h1>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:0 32px">
-                  ${args.invitedByEmail ? `<p style="margin:0 0 12px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">You were invited by <strong style="color:#111827">${args.invitedByEmail}</strong>.</p>` : ""}
-                  <p style="margin:0 0 16px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">Use the token below to accept your invitation. It expires in 7 days.</p>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f3f4f6;border-radius:6px;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-family:monospace;font-size:12px;color:#374151;word-break:break-all;white-space:normal;line-height:1.4">
-                        ${args.token}
-                      </td>
-                    </tr>
-                  </table>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:32px">
-                  <p style="margin:0;font-size:12px;color:#9ca3af;font-family:sans-serif">If you weren't expecting this invitation, you can safely ignore this email.</p>
-                </td>
-              </tr>
-            </table>
-          </td>
-        </tr>
-      </table>`
+    html: custom?.html ?? layout({
+      preheader: "You've been invited to join a Dyrected account.",
+      title: "You've been invited",
+      content: `${args.invitedByEmail ? paragraph(`You were invited by ${args.invitedByEmail}.`) : ""}${paragraph("Use the token below to accept your invitation. It expires in 7 days.")}${sectionLabel("Invitation token")}${detailBox(args.token, true)}`,
+      footer: "If you weren't expecting this invitation, you can safely ignore this email."
+    })
   };
 }
 function buildResetPasswordEmail(config, args) {
@@ -1161,95 +1252,24 @@ function buildResetPasswordEmail(config, args) {
   const resetLink = args.url;
   return {
     subject: custom?.subject ?? "Reset your password",
-    html: custom?.html ?? `
-      <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f9fafb;table-layout:fixed">
-        <tr>
-          <td align="center" style="padding:40px 16px">
-            <table cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;background-color:#ffffff;border-radius:12px;border:1px solid #e5e7eb;table-layout:fixed">
-              <tr>
-                <td style="padding:32px 32px 0">
-                  <p style="margin:0 0 4px;font-size:12px;font-weight:600;color:#6b7280;font-family:sans-serif;text-transform:uppercase;letter-spacing:0.05em">Dyrected</p>
-                  <h1 style="margin:0 0 24px;font-size:22px;font-weight:700;color:#111827;font-family:sans-serif">Reset your password</h1>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:0 32px">
-                  <p style="margin:0 0 24px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">We received a request to reset your password. Use the button below to set a new password. It will expire in 1 hour.</p>
-                  ${resetLink ? `
-                  <table cellpadding="0" cellspacing="0" border="0" style="margin-bottom:24px">
-                    <tr>
-                      <td style="border-radius:6px;background-color:#111827">
-                        <a href="${resetLink}" style="display:inline-block;padding:12px 28px;font-size:14px;font-weight:600;color:#ffffff;text-decoration:none;font-family:sans-serif;border-radius:6px">
-                          Reset Password
-                        </a>
-                      </td>
-                    </tr>
-                  </table>
-                  ` : ""}
-                  <p style="margin:0 0 8px;font-size:12px;color:#9ca3af;font-family:sans-serif">Or copy and paste this token manually in the admin dashboard:</p>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f3f4f6;border-radius:6px;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-family:monospace;font-size:12px;color:#374151;word-break:break-all;white-space:normal;line-height:1.4">
-                        ${args.token}
-                      </td>
-                    </tr>
-                  </table>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:32px">
-                  <p style="margin:0;font-size:12px;color:#9ca3af;font-family:sans-serif">If you didn't request a password reset, you can safely ignore this email.</p>
-                </td>
-              </tr>
-            </table>
-          </td>
-        </tr>
-      </table>`
+    html: custom?.html ?? layout({
+      preheader: "Reset your Dyrected password.",
+      title: "Reset your password",
+      content: `${paragraph("We received a request to reset your password. The reset link and token expire in 1 hour.")}${resetLink ? ctaButton("Reset password", resetLink) : ""}${sectionLabel(resetLink ? "Or use this token" : "Reset token")}${detailBox(args.token, true)}`,
+      footer: "If you didn't request a password reset, you can safely ignore this email."
+    })
   };
 }
 function buildPasswordChangedEmail(config, args) {
   const custom = config.email?.templates?.passwordChanged?.(args);
   return {
     subject: custom?.subject ?? "Your password has been changed",
-    html: custom?.html ?? `
-      <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f9fafb;table-layout:fixed">
-        <tr>
-          <td align="center" style="padding:40px 16px">
-            <table cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;background-color:#ffffff;border-radius:12px;border:1px solid #e5e7eb;table-layout:fixed">
-              <tr>
-                <td style="padding:32px 32px 0">
-                  <p style="margin:0 0 4px;font-size:12px;font-weight:600;color:#6b7280;font-family:sans-serif;text-transform:uppercase;letter-spacing:0.05em">Dyrected</p>
-                  <h1 style="margin:0 0 24px;font-size:22px;font-weight:700;color:#111827;font-family:sans-serif">Password changed</h1>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:0 32px">
-                  <p style="margin:0 0 12px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">The password for your account was just changed:</p>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f3f4f6;border-radius:6px;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-size:14px;font-weight:600;color:#111827;font-family:sans-serif;word-break:break-all">
-                        ${args.email}
-                      </td>
-                    </tr>
-                  </table>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;margin-top:16px;background-color:#fef2f2;border-radius:6px;border:1px solid #fecaca;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-size:13px;color:#b91c1c;line-height:1.5;font-family:sans-serif">
-                        If you did not make this change, please contact support immediately.
-                      </td>
-                    </tr>
-                  </table>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:32px">
-                  <p style="margin:0;font-size:12px;color:#9ca3af;font-family:sans-serif">This is an automated security notification.</p>
-                </td>
-              </tr>
-            </table>
-          </td>
-        </tr>
-      </table>`
+    html: custom?.html ?? layout({
+      preheader: "Your Dyrected password was changed.",
+      title: "Password changed",
+      content: `${paragraph("The password for this account was just changed:")}${detailBox(args.email)}${spacer()}${alertBox("If you did not make this change, please contact support immediately.")}`,
+      footer: "This is an automated security notification."
+    })
   };
 }
 
@@ -2118,7 +2138,22 @@ function registerRoutes(app, config) {
       }))),
       upload: !!col.upload,
       auth: !!col.auth,
-      admin: col.admin
+      admin: col.admin,
+      workflow: col.workflow ? {
+        initialState: col.workflow.initialState,
+        draftState: col.workflow.draftState,
+        states: col.workflow.states,
+        transitions: col.workflow.transitions.map((t) => ({
+          name: t.name,
+          label: t.label,
+          from: t.from,
+          to: t.to,
+          requiredCapabilities: t.requiredCapabilities,
+          requireComment: t.requireComment,
+          unpublish: t.unpublish
+        })),
+        roles: col.workflow.roles
+      } : void 0
     })));
     const filteredGlobals = await Promise.all(globals.filter((glb) => !siteId || glb.shared || !glb.siteId || glb.siteId === siteId).map(async (glb) => ({
       slug: glb.slug,
@@ -2312,6 +2347,10 @@ function registerRoutes(app, config) {
     if (collection.auth) {
       app.post(`${path}/:id/change-password`, requireAuth(), (c) => controller.changePassword(c));
     }
+    if (collection.workflow) {
+      app.post(`${path}/:id/transitions/:transition`, requireAuth(), (c) => controller.transition(c));
+      app.get(`${path}/:id/workflow-history`, requireAuth(), (c) => controller.workflowHistory(c));
+    }
   }
   for (const global of config.globals) {
     const path = `/api/globals/${global.slug}`;
@@ -2323,6 +2362,41 @@ function registerRoutes(app, config) {
   const previewController = new PreviewController();
   app.post("/api/preview-token", requireAuth(), (c) => previewController.createToken(c));
   app.get("/api/preview-data", (c) => previewController.getData(c));
+  app.all("/api/collections/:slug/:id/*", requireAuth(), async (c) => {
+    const slug = c.req.param("slug");
+    const id = c.req.param("id");
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const config2 = c.get("config");
+    if (config2.collections.some((col) => col.slug === slug)) {
+      return c.json({ message: "Not Found" }, 404);
+    }
+    if (!config2.onSchemaFetch || !siteId) {
+      return c.json({ message: `Collection "${slug}" not found` }, 404);
+    }
+    const dynamic = await config2.onSchemaFetch(siteId);
+    const collection = dynamic.collections?.find((col) => col.slug === slug);
+    if (!collection?.workflow) {
+      return c.json({ message: `Collection "${slug}" not found or has no workflow` }, 404);
+    }
+    const controller = new CollectionController(collection);
+    const rawPath = c.req.path;
+    const method = c.req.method;
+    const transitionMatch = rawPath.match(/\/transitions\/([^/]+)$/);
+    if (transitionMatch && method === "POST") {
+      c.req.raw.__transition = transitionMatch[1];
+      const origParam = c.req.param.bind(c.req);
+      c.req.param = (key) => {
+        if (key === "transition") return transitionMatch[1];
+        if (key === "id") return id;
+        return origParam(key);
+      };
+      return controller.transition(c);
+    }
+    if (rawPath.endsWith("/workflow-history") && method === "GET") {
+      return controller.workflowHistory(c);
+    }
+    return c.json({ message: "Not Found" }, 404);
+  });
   app.all("/api/collections/:slug/:id?", async (c) => {
     const slug = c.req.param("slug");
     const id = c.req.param("id");

package/dist/where-sanitizer-WJ2W2QCE.js

@@ -0,0 +1,54 @@
+// src/utils/where-sanitizer.ts
+var NEVER_FILTERABLE_TYPES = [
+  "password",
+  "richText",
+  "json",
+  "file",
+  "image",
+  "join",
+  "collapsible"
+];
+function sanitizeWhereClause(where, fields) {
+  const fieldMap = /* @__PURE__ */ new Map();
+  function addFieldsToMap(fList, prefix = "") {
+    for (const f of fList) {
+      if ("name" in f && f.name) {
+        fieldMap.set(prefix + f.name, f);
+      }
+      if (f.type === "object" || f.type === "row" || f.type === "array") {
+        if ("fields" in f && Array.isArray(f.fields)) {
+          addFieldsToMap(f.fields, f.type === "object" || f.type === "array" ? `${prefix}${f.name}.` : prefix);
+        }
+      }
+    }
+  }
+  addFieldsToMap(fields);
+  function walk(node) {
+    const result = {};
+    for (const [key, value] of Object.entries(node)) {
+      if (key === "AND" || key === "OR") {
+        if (Array.isArray(value)) {
+          const processed = value.map((v) => walk(v)).filter((v) => Object.keys(v).length > 0);
+          if (processed.length > 0) {
+            result[key] = processed;
+          }
+        }
+        continue;
+      }
+      if (key === "id") {
+        result[key] = value;
+        continue;
+      }
+      const fieldDef = fieldMap.get(key);
+      if (!fieldDef) continue;
+      if (fieldDef.admin?.filterable === false) continue;
+      if (NEVER_FILTERABLE_TYPES.includes(fieldDef.type)) continue;
+      result[key] = value;
+    }
+    return result;
+  }
+  return walk(where);
+}
+export {
+  sanitizeWhereClause
+};