@dyrected/core 2.5.29 → 2.5.32

package/dist/server.cjs

@@ -62,6 +62,10 @@ function sanitizeWhereClause(where, fields) {
         }
         continue;
       }
+      if (key === "id") {
+        result[key] = value;
+        continue;
+      }
       const fieldDef = fieldMap.get(key);
       if (!fieldDef) continue;
       if (fieldDef.admin?.filterable === false) continue;
@@ -531,6 +535,243 @@ function createReadonlyDb(db) {
   });
 }
 
+// src/auth/jexl.ts
+var import_jexl = __toESM(require("jexl"), 1);
+async function evaluateAccess(expression, context) {
+  if (expression === void 0 || expression === null) return false;
+  if (typeof expression === "boolean") return expression;
+  try {
+    const result = await import_jexl.default.eval(expression, context);
+    return !!result;
+  } catch (err) {
+    console.error("[dyrected/core] Jexl evaluation failed:", err);
+    return false;
+  }
+}
+
+// src/workflows.ts
+var WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
+var LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
+function publicMetadata(meta) {
+  const { availableTransitions: _availableTransitions, ...safe } = meta;
+  return safe;
+}
+function workflowCapabilities(workflow, user) {
+  const capabilities = new Set(Array.isArray(user?.capabilities) ? user.capabilities : []);
+  const roles = Array.isArray(user?.roles) ? user.roles : [];
+  for (const mapping of workflow.roles ?? []) {
+    if (roles.includes(mapping.role)) mapping.capabilities.forEach((capability) => capabilities.add(capability));
+  }
+  return capabilities;
+}
+function canViewWorkflowDraft(workflow, user) {
+  if (!user) return false;
+  const capabilities = workflowCapabilities(workflow, user);
+  if (capabilities.has("entry.edit")) return true;
+  return workflow.transitions.some(
+    (transition) => (transition.requiredCapabilities ?? []).some((capability) => capabilities.has(capability))
+  );
+}
+function availableWorkflowTransitions(workflow, state, user) {
+  const capabilities = workflowCapabilities(workflow, user);
+  return workflow.transitions.filter((transition) => {
+    const from = Array.isArray(transition.from) ? transition.from : [transition.from];
+    return from.includes(state) && (transition.requiredCapabilities ?? []).every((item) => capabilities.has(item));
+  });
+}
+function initializeWorkflowDocument(data, workflow) {
+  return {
+    ...data,
+    __workflow: { state: workflow.initialState, revision: 1 }
+  };
+}
+function materializeWorkflowDocument(doc, workflow, user) {
+  const meta = doc.__workflow;
+  if (!meta) return doc;
+  const { __published, __workflow, ...working } = doc;
+  if (!canViewWorkflowDraft(workflow, user)) {
+    if (!__published || typeof __published !== "object") return null;
+    return { id: doc.id, ...__published, _workflow: publicMetadata(meta) };
+  }
+  return {
+    ...working,
+    _workflow: {
+      ...meta,
+      availableTransitions: availableWorkflowTransitions(workflow, meta.state, user).map((item) => item.name)
+    }
+  };
+}
+function eventId() {
+  return globalThis.crypto?.randomUUID?.() ?? `evt_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+}
+function createLifecycleEvent(args) {
+  return {
+    id: eventId(),
+    name: args.name,
+    collection: args.collection,
+    documentId: args.documentId,
+    occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+    actorId: args.actorId,
+    payload: args.payload,
+    attempts: 0,
+    status: "pending"
+  };
+}
+async function persistEvent(db, event) {
+  await db.create({ collection: LIFECYCLE_EVENTS_COLLECTION, data: event });
+}
+async function dispatchLifecycleEvent(config, event) {
+  const db = config.db;
+  if (!db || !config.events?.handlers.length) return;
+  const maxAttempts = config.events.maxAttempts ?? 8;
+  const retryDelayMs = config.events.retryDelayMs ?? 1e3;
+  const attempts = event.attempts + 1;
+  try {
+    await db.update({ collection: LIFECYCLE_EVENTS_COLLECTION, id: event.id, data: { status: "processing", attempts } });
+    for (const handler of config.events.handlers) await handler({ ...event, status: "processing", attempts });
+    await db.update({
+      collection: LIFECYCLE_EVENTS_COLLECTION,
+      id: event.id,
+      data: { status: "delivered", attempts, deliveredAt: (/* @__PURE__ */ new Date()).toISOString(), lastError: null }
+    });
+  } catch (error) {
+    const exhausted = attempts >= maxAttempts;
+    await db.update({
+      collection: LIFECYCLE_EVENTS_COLLECTION,
+      id: event.id,
+      data: {
+        status: "failed",
+        attempts,
+        lastError: error instanceof Error ? error.message : String(error),
+        nextAttemptAt: exhausted ? null : new Date(Date.now() + retryDelayMs * 2 ** (attempts - 1)).toISOString()
+      }
+    });
+  }
+}
+async function saveWorkflowDraft(args) {
+  const { config, collection, id, originalDoc, data, user } = args;
+  const db = config.db;
+  const workflow = collection.workflow;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  const previous = originalDoc.__workflow;
+  const event = createLifecycleEvent({
+    name: "revision.created",
+    collection: collection.slug,
+    documentId: id,
+    actorId: user?.sub,
+    payload: { revision: previous.revision + 1, previousRevision: previous.revision }
+  });
+  const doc = await db.transaction(async (tx) => {
+    const nextMeta = {
+      ...previous,
+      state: originalDoc.__published ? workflow.draftState ?? workflow.initialState : previous.state,
+      revision: previous.revision + 1
+    };
+    const updated = await tx.update({ collection: collection.slug, id, data: { ...data, __workflow: nextMeta } });
+    await persistEvent(tx, event);
+    return updated;
+  });
+  void dispatchLifecycleEvent(config, event);
+  return { doc, event };
+}
+async function createWorkflowDocument(args) {
+  const { config, collection, data, user } = args;
+  const db = config.db;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  let event;
+  const doc = await db.transaction(async (tx) => {
+    const created = await tx.create({ collection: collection.slug, data });
+    event = createLifecycleEvent({
+      name: "revision.created",
+      collection: collection.slug,
+      documentId: created.id,
+      actorId: user?.sub,
+      payload: { revision: 1, previousRevision: null }
+    });
+    await persistEvent(tx, event);
+    return created;
+  });
+  void dispatchLifecycleEvent(config, event);
+  return { doc, event };
+}
+async function transitionWorkflow(args) {
+  const { config, collection, id, transitionName, expectedRevision, comment, user, req } = args;
+  const db = config.db;
+  const workflow = collection.workflow;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  const original = await db.findOne({ collection: collection.slug, id });
+  if (!original) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
+  const meta = original.__workflow;
+  if (!meta) throw Object.assign(new Error("Entry has no workflow metadata"), { statusCode: 409 });
+  if (expectedRevision !== void 0 && expectedRevision !== meta.revision) {
+    throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
+  }
+  const transition = workflow.transitions.find((item) => item.name === transitionName);
+  const fromStates = transition ? Array.isArray(transition.from) ? transition.from : [transition.from] : [];
+  if (!transition || !fromStates.includes(meta.state)) {
+    throw Object.assign(new Error(`Transition "${transitionName}" is not valid from "${meta.state}".`), { statusCode: 409 });
+  }
+  if (!availableWorkflowTransitions(workflow, meta.state, user).some((item) => item.name === transition.name)) {
+    throw Object.assign(new Error(`You do not have permission to perform "${transition.label}".`), { statusCode: 403 });
+  }
+  if (transition.requireComment && !comment?.trim()) {
+    throw Object.assign(new Error(`A comment is required for "${transition.label}".`), { statusCode: 400 });
+  }
+  const hookContext = { transition, from: meta.state, to: transition.to, doc: original, user, comment, req, db };
+  for (const hook of workflow.hooks?.beforeTransition ?? []) await hook(hookContext);
+  const events = [createLifecycleEvent({
+    name: "workflow.transitioned",
+    collection: collection.slug,
+    documentId: id,
+    actorId: user?.sub,
+    payload: { transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision, comment }
+  })];
+  const targetState = workflow.states.find((state) => state.name === transition.to);
+  if (targetState.published) {
+    events.push(createLifecycleEvent({ name: "entry.published", collection: collection.slug, documentId: id, actorId: user?.sub, payload: { revision: meta.revision } }));
+  } else if (transition.unpublish) {
+    events.push(createLifecycleEvent({ name: "entry.unpublished", collection: collection.slug, documentId: id, actorId: user?.sub, payload: { revision: meta.publishedRevision } }));
+  }
+  const updated = await db.transaction(async (tx) => {
+    const locked = await tx.findOne({ collection: collection.slug, id });
+    if (!locked) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
+    const lockedMeta = locked.__workflow;
+    if (lockedMeta.revision !== meta.revision || lockedMeta.state !== meta.state || expectedRevision !== void 0 && lockedMeta.revision !== expectedRevision) {
+      throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const { __published: _published, __workflow: _workflow, id: _id, ...working } = locked;
+    const nextMeta = {
+      ...lockedMeta,
+      state: transition.to,
+      ...targetState.published ? { publishedRevision: lockedMeta.revision, publishedAt: now, publishedBy: user?.sub } : {},
+      ...transition.unpublish ? { publishedRevision: void 0, publishedAt: void 0, publishedBy: void 0 } : {}
+    };
+    const data = { __workflow: nextMeta };
+    if (targetState.published) data.__published = working;
+    if (transition.unpublish) data.__published = null;
+    const next = await tx.update({ collection: collection.slug, id, data });
+    await tx.create({
+      collection: WORKFLOW_HISTORY_COLLECTION,
+      data: { collection: collection.slug, documentId: id, transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision, comment: comment ?? null, actorId: user?.sub ?? null, createdAt: now }
+    });
+    for (const event of events) await persistEvent(tx, event);
+    if (collection.audit) {
+      await tx.create({ collection: "__audit", data: { collection: collection.slug, documentId: id, operation: "workflow.transition", user: user?.sub ?? null, timestamp: now, changes: JSON.stringify({ transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision }) } });
+    }
+    return next;
+  });
+  for (const event of events) void dispatchLifecycleEvent(config, event);
+  for (const hook of workflow.hooks?.afterTransition ?? []) {
+    try {
+      await hook({ ...hookContext, doc: updated, event: events[0] });
+    } catch (error) {
+      console.error("[dyrected/workflow] afterTransition hook failed:", error);
+    }
+  }
+  return updated;
+}
+
 // src/controllers/collection.controller.ts
 var CollectionController = class {
   collection;
@@ -575,6 +816,9 @@ var CollectionController = class {
     if (beforeReadResult !== void 0) {
       where = beforeReadResult;
     }
+    if (this.collection.workflow && !canViewWorkflowDraft(this.collection.workflow, user)) {
+      where = where ? { AND: [where, { __published: { exists: true } }] } : { __published: { exists: true } };
+    }
     let result = await db.find({
       collection: this.collection.slug,
       limit,
@@ -595,7 +839,7 @@ var CollectionController = class {
         where
       });
     }
-    result.docs = result.docs.map((doc) => DefaultsService.apply(this.collection.fields, doc));
+    result.docs = result.docs.map((doc) => this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc).filter((doc) => doc !== null).map((doc) => DefaultsService.apply(this.collection.fields, doc));
     const processedDocs = [];
     for (const doc of result.docs) {
       const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
@@ -623,8 +867,12 @@ var CollectionController = class {
     const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 10;
     const user = c.get("user");
     if (!id) return c.json({ message: "Missing ID" }, 400);
-    const doc = await db.findOne({ collection: this.collection.slug, id });
+    let doc = await db.findOne({ collection: this.collection.slug, id });
     if (!doc) return c.json({ message: "Not Found" }, 404);
+    if (this.collection.workflow) {
+      doc = materializeWorkflowDocument(doc, this.collection.workflow, user);
+      if (!doc) return c.json({ message: "Not Found" }, 404);
+    }
     const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
     const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
       doc: docWithDefaults,
@@ -664,6 +912,9 @@ var CollectionController = class {
       createdBy: user?.sub ?? null,
       updatedBy: user?.sub ?? null
     };
+    if (this.collection.workflow) {
+      data = initializeWorkflowDocument(data, this.collection.workflow);
+    }
     if (this.collection.auth && data.password) {
       data.password = await hashPassword(data.password);
     }
@@ -675,7 +926,7 @@ var CollectionController = class {
       operation: "create",
       db: readonlyDb
     });
-    const doc = await db.create({ collection: this.collection.slug, data });
+    const doc = this.collection.workflow ? (await createWorkflowDocument({ config, collection: this.collection, data, user })).doc : await db.create({ collection: this.collection.slug, data });
     if (this.collection.audit && db) {
       AuditService.log(db, {
         operation: "create",
@@ -693,8 +944,9 @@ var CollectionController = class {
       operation: "create",
       db
     }, { isolated: true });
+    const responseDoc = this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc;
     const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
-      doc,
+      doc: responseDoc,
       req: c.req,
       user,
       db: readonlyDb
@@ -757,8 +1009,9 @@ var CollectionController = class {
       operation: "create",
       db
     }, { isolated: true });
+    const responseDoc = this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc;
     const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
-      doc,
+      doc: responseDoc,
       req: c.req,
       user,
       db: readonlyDb
@@ -800,7 +1053,7 @@ var CollectionController = class {
       operation: "update",
       db: readonlyDb
     });
-    const doc = await db.update({ collection: this.collection.slug, id, data });
+    const doc = this.collection.workflow ? (await saveWorkflowDraft({ config, collection: this.collection, id, originalDoc, data, user })).doc : await db.update({ collection: this.collection.slug, id, data });
     if (this.collection.audit && db) {
       AuditService.log(db, {
         operation: "update",
@@ -828,6 +1081,61 @@ var CollectionController = class {
     const finalDoc = await executeFieldAfterRead(this.collection.fields, readDoc, user, readonlyDb);
     return c.json(finalDoc);
   }
+  async transition(c) {
+    const config = c.get("config");
+    if (!config.db) return c.json({ message: "Database not configured" }, 500);
+    if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    const id = c.req.param("id");
+    const transitionName = c.req.param("transition");
+    const body = await c.req.json().catch(() => ({}));
+    try {
+      const doc = await transitionWorkflow({
+        config,
+        collection: this.collection,
+        id,
+        transitionName,
+        expectedRevision: body.expectedRevision,
+        comment: body.comment,
+        user: c.get("user"),
+        req: { query: c.req.query(), headers: c.req.header(), raw: c.req.raw }
+      });
+      return c.json(materializeWorkflowDocument(doc, this.collection.workflow, c.get("user")));
+    } catch (error) {
+      const status = typeof error.statusCode === "number" ? error.statusCode : 500;
+      return c.json({ error: true, message: error instanceof Error ? error.message : String(error) }, status);
+    }
+  }
+  async workflowHistory(c) {
+    const config = c.get("config");
+    if (!config.db) return c.json({ message: "Database not configured" }, 500);
+    if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    const documentId = c.req.param("id");
+    if (!documentId) return c.json({ message: "Missing ID" }, 400);
+    const document = await config.db.findOne({ collection: this.collection.slug, id: documentId });
+    if (!document) return c.json({ message: "Not Found" }, 404);
+    const readAccess = this.collection.access?.read;
+    if (readAccess !== void 0 && readAccess !== null) {
+      const args = { user: c.get("user"), req: c.req, doc: document };
+      const result2 = typeof readAccess === "function" ? await readAccess(args) : await evaluateAccess(readAccess, args);
+      let allowed = result2 === true;
+      if (result2 && typeof result2 === "object") {
+        const match = await config.db.find({
+          collection: this.collection.slug,
+          where: { AND: [{ id: { equals: documentId } }, result2] },
+          limit: 1
+        });
+        allowed = match.total > 0;
+      }
+      if (!allowed) return c.json({ error: true, message: `Access denied: read on ${this.collection.slug}` }, 403);
+    }
+    const result = await config.db.find({
+      collection: WORKFLOW_HISTORY_COLLECTION,
+      where: { collection: { equals: this.collection.slug }, documentId: { equals: documentId } },
+      sort: "-createdAt",
+      limit: Math.min(Number(c.req.query("limit")) || 50, 100)
+    });
+    return c.json(result);
+  }
   /**
    * POST /api/collections/:slug/:id/change-password
    *
@@ -1295,6 +1603,96 @@ async function verifyCollectionToken(token) {
   return payload;
 }
 
+// src/services/email-template.ts
+var emailTokens = {
+  colors: {
+    canvas: "#f6f7f2",
+    surface: "#ffffff",
+    text: "#171717",
+    muted: "#62665b",
+    subtle: "#8a8f82",
+    border: "#dde0d7",
+    accent: "#b6ff2e",
+    code: "#f1f3ec",
+    dangerSurface: "#fff2f0",
+    dangerBorder: "#ffc9c2",
+    dangerText: "#9f251b"
+  },
+  font: "Arial, 'Helvetica Neue', Helvetica, sans-serif",
+  mono: "'Courier New', Courier, monospace",
+  radius: { card: "12px", control: "6px" },
+  width: "600px"
+};
+function escapeHtml(value) {
+  return value.replace(/[&<>'"]/g, (character) => ({
+    "&": "&amp;",
+    "<": "&lt;",
+    ">": "&gt;",
+    "'": "&#39;",
+    '"': "&quot;"
+  })[character]);
+}
+function safeHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" || url.protocol === "http:" ? escapeHtml(url.toString()) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function heading(content) {
+  return `<h1 style="margin:0;font-family:${emailTokens.font};font-size:24px;line-height:1.25;font-weight:700;color:${emailTokens.colors.text}">${escapeHtml(content)}</h1>`;
+}
+function paragraph(content, margin = "0 0 16px") {
+  return `<p style="margin:${margin};font-family:${emailTokens.font};font-size:15px;line-height:1.6;color:${emailTokens.colors.muted}">${escapeHtml(content)}</p>`;
+}
+function sectionLabel(content) {
+  return `<p style="margin:0 0 8px;font-family:${emailTokens.font};font-size:11px;line-height:1.4;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:${emailTokens.colors.subtle}">${escapeHtml(content)}</p>`;
+}
+function divider() {
+  return `<table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%"><tr><td style="height:1px;background:${emailTokens.colors.border};font-size:0;line-height:0">&nbsp;</td></tr></table>`;
+}
+function spacer(height = 16) {
+  return table(row("&nbsp;", `height:${height}px;font-size:0;line-height:0`));
+}
+function row(content, cellStyle = "") {
+  return `<tr><td style="${cellStyle}">${content}</td></tr>`;
+}
+function table(content, style = "width:100%") {
+  return `<table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%" style="${style}">${content}</table>`;
+}
+function detailBox(content, monospace = false) {
+  const font = monospace ? emailTokens.mono : emailTokens.font;
+  return table(row(escapeHtml(content), `padding:14px 16px;font-family:${font};font-size:13px;line-height:1.5;font-weight:${monospace ? "400" : "700"};color:${emailTokens.colors.text};word-break:break-all`), `width:100%;background:${emailTokens.colors.code};border-radius:${emailTokens.radius.control}`);
+}
+function ctaButton(label, href) {
+  const safeHref = safeHttpUrl(href);
+  if (!safeHref) return "";
+  return table(row(
+    `<a href="${safeHref}" style="display:inline-block;padding:13px 22px;border-radius:${emailTokens.radius.control};background:${emailTokens.colors.accent};font-family:${emailTokens.font};font-size:14px;line-height:1.2;font-weight:700;color:${emailTokens.colors.text};text-decoration:none">${escapeHtml(label)}</a>`,
+    "padding:8px 0 24px"
+  ), "width:auto");
+}
+function alertBox(content) {
+  return table(row(escapeHtml(content), `padding:13px 16px;font-family:${emailTokens.font};font-size:13px;line-height:1.5;color:${emailTokens.colors.dangerText}`), `width:100%;background:${emailTokens.colors.dangerSurface};border:1px solid ${emailTokens.colors.dangerBorder};border-radius:${emailTokens.radius.control}`);
+}
+function layout({ preheader, title, content, footer }) {
+  return `<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"></head>
+  <body style="margin:0;padding:0;background:${emailTokens.colors.canvas}">
+    <div style="display:none;max-height:0;overflow:hidden;opacity:0;color:transparent">${escapeHtml(preheader)}</div>
+    ${table(row(
+    table(
+      row("&nbsp;", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${sectionLabel("Dyrected")}${heading(title)}`, "padding:30px 32px 24px") + row(content, "padding:0 32px 32px") + row(`${divider()}${paragraph(footer, "20px 0 6px")}${paragraph("Privacy: this message contains account-related information; please avoid forwarding it.", "0")}`, "padding:0 32px 28px"),
+      `width:100%;max-width:${emailTokens.width};background:${emailTokens.colors.surface};border:1px solid ${emailTokens.colors.border};border-radius:${emailTokens.radius.card};overflow:hidden`
+    ),
+    "padding:32px 12px"
+  ), `width:100%;background:${emailTokens.colors.canvas}`)}
+  </body>
+</html>`;
+}
+
 // src/services/email.service.ts
 var _devSend = null;
 var _devSendPromise = null;
@@ -1338,77 +1736,24 @@ function buildWelcomeEmail(config, args) {
   const custom = config.email?.templates?.welcome?.(args);
   return {
     subject: custom?.subject ?? "Welcome \u2014 your account is ready",
-    html: custom?.html ?? `
-      <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f9fafb;table-layout:fixed">
-        <tr>
-          <td align="center" style="padding:40px 16px">
-            <table cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;background-color:#ffffff;border-radius:12px;border:1px solid #e5e7eb;table-layout:fixed">
-              <tr>
-                <td style="padding:32px 32px 0">
-                  <p style="margin:0 0 4px;font-size:12px;font-weight:600;color:#6b7280;font-family:sans-serif;text-transform:uppercase;letter-spacing:0.05em">Dyrected</p>
-                  <h1 style="margin:0 0 24px;font-size:22px;font-weight:700;color:#111827;font-family:sans-serif">Welcome!</h1>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:0 32px">
-                  <p style="margin:0 0 12px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">Your account has been created. You can now log in with:</p>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f3f4f6;border-radius:6px;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-size:14px;font-weight:600;color:#111827;font-family:sans-serif;word-break:break-all">
-                        ${args.email}
-                      </td>
-                    </tr>
-                  </table>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:32px">
-                  <p style="margin:0;font-size:12px;color:#9ca3af;font-family:sans-serif">If you didn't create this account, you can safely ignore this email.</p>
-                </td>
-              </tr>
-            </table>
-          </td>
-        </tr>
-      </table>`
+    html: custom?.html ?? layout({
+      preheader: "Your Dyrected account is ready.",
+      title: "Welcome \u2014 your account is ready",
+      content: `${paragraph("Your account has been created. You can now log in with:")}${detailBox(args.email)}`,
+      footer: "If you didn't create this account, you can safely ignore this email."
+    })
   };
 }
 function buildInviteEmail(config, args) {
   const custom = config.email?.templates?.invite?.(args);
   return {
     subject: custom?.subject ?? "You've been invited",
-    html: custom?.html ?? `
-      <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f9fafb;table-layout:fixed">
-        <tr>
-          <td align="center" style="padding:40px 16px">
-            <table cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;background-color:#ffffff;border-radius:12px;border:1px solid #e5e7eb;table-layout:fixed">
-              <tr>
-                <td style="padding:32px 32px 0">
-                  <p style="margin:0 0 4px;font-size:12px;font-weight:600;color:#6b7280;font-family:sans-serif;text-transform:uppercase;letter-spacing:0.05em">Dyrected</p>
-                  <h1 style="margin:0 0 24px;font-size:22px;font-weight:700;color:#111827;font-family:sans-serif">You've been invited</h1>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:0 32px">
-                  ${args.invitedByEmail ? `<p style="margin:0 0 12px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">You were invited by <strong style="color:#111827">${args.invitedByEmail}</strong>.</p>` : ""}
-                  <p style="margin:0 0 16px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">Use the token below to accept your invitation. It expires in 7 days.</p>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f3f4f6;border-radius:6px;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-family:monospace;font-size:12px;color:#374151;word-break:break-all;white-space:normal;line-height:1.4">
-                        ${args.token}
-                      </td>
-                    </tr>
-                  </table>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:32px">
-                  <p style="margin:0;font-size:12px;color:#9ca3af;font-family:sans-serif">If you weren't expecting this invitation, you can safely ignore this email.</p>
-                </td>
-              </tr>
-            </table>
-          </td>
-        </tr>
-      </table>`
+    html: custom?.html ?? layout({
+      preheader: "You've been invited to join a Dyrected account.",
+      title: "You've been invited",
+      content: `${args.invitedByEmail ? paragraph(`You were invited by ${args.invitedByEmail}.`) : ""}${paragraph("Use the token below to accept your invitation. It expires in 7 days.")}${sectionLabel("Invitation token")}${detailBox(args.token, true)}`,
+      footer: "If you weren't expecting this invitation, you can safely ignore this email."
+    })
   };
 }
 function buildResetPasswordEmail(config, args) {
@@ -1416,95 +1761,24 @@ function buildResetPasswordEmail(config, args) {
   const resetLink = args.url;
   return {
     subject: custom?.subject ?? "Reset your password",
-    html: custom?.html ?? `
-      <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f9fafb;table-layout:fixed">
-        <tr>
-          <td align="center" style="padding:40px 16px">
-            <table cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;background-color:#ffffff;border-radius:12px;border:1px solid #e5e7eb;table-layout:fixed">
-              <tr>
-                <td style="padding:32px 32px 0">
-                  <p style="margin:0 0 4px;font-size:12px;font-weight:600;color:#6b7280;font-family:sans-serif;text-transform:uppercase;letter-spacing:0.05em">Dyrected</p>
-                  <h1 style="margin:0 0 24px;font-size:22px;font-weight:700;color:#111827;font-family:sans-serif">Reset your password</h1>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:0 32px">
-                  <p style="margin:0 0 24px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">We received a request to reset your password. Use the button below to set a new password. It will expire in 1 hour.</p>
-                  ${resetLink ? `
-                  <table cellpadding="0" cellspacing="0" border="0" style="margin-bottom:24px">
-                    <tr>
-                      <td style="border-radius:6px;background-color:#111827">
-                        <a href="${resetLink}" style="display:inline-block;padding:12px 28px;font-size:14px;font-weight:600;color:#ffffff;text-decoration:none;font-family:sans-serif;border-radius:6px">
-                          Reset Password
-                        </a>
-                      </td>
-                    </tr>
-                  </table>
-                  ` : ""}
-                  <p style="margin:0 0 8px;font-size:12px;color:#9ca3af;font-family:sans-serif">Or copy and paste this token manually in the admin dashboard:</p>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f3f4f6;border-radius:6px;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-family:monospace;font-size:12px;color:#374151;word-break:break-all;white-space:normal;line-height:1.4">
-                        ${args.token}
-                      </td>
-                    </tr>
-                  </table>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:32px">
-                  <p style="margin:0;font-size:12px;color:#9ca3af;font-family:sans-serif">If you didn't request a password reset, you can safely ignore this email.</p>
-                </td>
-              </tr>
-            </table>
-          </td>
-        </tr>
-      </table>`
+    html: custom?.html ?? layout({
+      preheader: "Reset your Dyrected password.",
+      title: "Reset your password",
+      content: `${paragraph("We received a request to reset your password. The reset link and token expire in 1 hour.")}${resetLink ? ctaButton("Reset password", resetLink) : ""}${sectionLabel(resetLink ? "Or use this token" : "Reset token")}${detailBox(args.token, true)}`,
+      footer: "If you didn't request a password reset, you can safely ignore this email."
+    })
   };
 }
 function buildPasswordChangedEmail(config, args) {
   const custom = config.email?.templates?.passwordChanged?.(args);
   return {
     subject: custom?.subject ?? "Your password has been changed",
-    html: custom?.html ?? `
-      <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f9fafb;table-layout:fixed">
-        <tr>
-          <td align="center" style="padding:40px 16px">
-            <table cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;background-color:#ffffff;border-radius:12px;border:1px solid #e5e7eb;table-layout:fixed">
-              <tr>
-                <td style="padding:32px 32px 0">
-                  <p style="margin:0 0 4px;font-size:12px;font-weight:600;color:#6b7280;font-family:sans-serif;text-transform:uppercase;letter-spacing:0.05em">Dyrected</p>
-                  <h1 style="margin:0 0 24px;font-size:22px;font-weight:700;color:#111827;font-family:sans-serif">Password changed</h1>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:0 32px">
-                  <p style="margin:0 0 12px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">The password for your account was just changed:</p>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f3f4f6;border-radius:6px;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-size:14px;font-weight:600;color:#111827;font-family:sans-serif;word-break:break-all">
-                        ${args.email}
-                      </td>
-                    </tr>
-                  </table>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;margin-top:16px;background-color:#fef2f2;border-radius:6px;border:1px solid #fecaca;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-size:13px;color:#b91c1c;line-height:1.5;font-family:sans-serif">
-                        If you did not make this change, please contact support immediately.
-                      </td>
-                    </tr>
-                  </table>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:32px">
-                  <p style="margin:0;font-size:12px;color:#9ca3af;font-family:sans-serif">This is an automated security notification.</p>
-                </td>
-              </tr>
-            </table>
-          </td>
-        </tr>
-      </table>`
+    html: custom?.html ?? layout({
+      preheader: "Your Dyrected password was changed.",
+      title: "Password changed",
+      content: `${paragraph("The password for this account was just changed:")}${detailBox(args.email)}${spacer()}${alertBox("If you did not make this change, please contact support immediately.")}`,
+      footer: "This is an automated security notification."
+    })
   };
 }
 
@@ -1888,7 +2162,76 @@ function generateOpenApi(config) {
       description: "Automatically generated OpenAPI specification for the Dyrected project."
     },
     components: {
-      schemas: {},
+      schemas: {
+        WorkflowMetadata: {
+          type: "object",
+          required: ["state", "revision"],
+          properties: {
+            state: { type: "string" },
+            revision: { type: "integer", minimum: 1 },
+            publishedRevision: { type: "integer", minimum: 1 },
+            publishedAt: { type: "string", format: "date-time" },
+            publishedBy: { type: "string" },
+            availableTransitions: { type: "array", items: { type: "string" } }
+          }
+        },
+        WorkflowTransitionRequest: {
+          type: "object",
+          properties: {
+            expectedRevision: { type: "integer", minimum: 1 },
+            comment: { type: "string" }
+          }
+        },
+        WorkflowHistoryEntry: {
+          type: "object",
+          required: [
+            "collection",
+            "documentId",
+            "transition",
+            "from",
+            "to",
+            "revision",
+            "createdAt"
+          ],
+          properties: {
+            id: { type: "string" },
+            collection: { type: "string" },
+            documentId: { type: "string" },
+            transition: { type: "string" },
+            from: { type: "string" },
+            to: { type: "string" },
+            revision: { type: "integer" },
+            comment: { type: "string", nullable: true },
+            actorId: { type: "string", nullable: true },
+            createdAt: { type: "string", format: "date-time" }
+          }
+        },
+        Error: {
+          type: "object",
+          properties: {
+            message: { type: "string" },
+            errors: {
+              type: "array",
+              items: { type: "object", additionalProperties: true }
+            }
+          }
+        },
+        AuthCredentials: {
+          type: "object",
+          required: ["email", "password"],
+          properties: {
+            email: { type: "string", format: "email" },
+            password: { type: "string" }
+          }
+        },
+        TokenResponse: {
+          type: "object",
+          properties: {
+            token: { type: "string" },
+            user: { type: "object", additionalProperties: true }
+          }
+        }
+      },
       securitySchemes: {
         ApiKeyAuth: {
           type: "apiKey",
@@ -1900,6 +2243,98 @@ function generateOpenApi(config) {
     paths: {},
     security: [{ ApiKeyAuth: [] }]
   };
+  spec.paths["/api/schemas"] = {
+    get: {
+      tags: ["System"],
+      summary: "Get the serialized Dyrected schema",
+      security: [],
+      responses: {
+        200: { description: "Collection and global schema definitions" }
+      }
+    }
+  };
+  spec.paths["/api/openapi.json"] = {
+    get: {
+      tags: ["System"],
+      summary: "Get the OpenAPI specification",
+      security: [],
+      responses: { 200: { description: "OpenAPI 3.0 document" } }
+    }
+  };
+  spec.paths["/api/docs"] = {
+    get: {
+      tags: ["System"],
+      summary: "Open interactive API documentation",
+      security: [],
+      responses: { 200: { description: "Swagger UI HTML" } }
+    }
+  };
+  spec.paths["/api/dyrected/options/{collection}/{field}"] = {
+    get: {
+      tags: ["System"],
+      summary: "Resolve dynamic field options",
+      parameters: [
+        {
+          name: "collection",
+          in: "path",
+          required: true,
+          schema: { type: "string" }
+        },
+        {
+          name: "field",
+          in: "path",
+          required: true,
+          schema: { type: "string" }
+        }
+      ],
+      responses: { 200: { description: "Resolved option items" } }
+    }
+  };
+  spec.paths["/api/preferences/{key}"] = {
+    get: {
+      tags: ["Preferences"],
+      summary: "Get an authenticated user preference",
+      parameters: [
+        { name: "key", in: "path", required: true, schema: { type: "string" } }
+      ],
+      responses: { 200: { description: "Preference value" } }
+    },
+    put: {
+      tags: ["Preferences"],
+      summary: "Set an authenticated user preference",
+      parameters: [
+        { name: "key", in: "path", required: true, schema: { type: "string" } }
+      ],
+      requestBody: {
+        required: true,
+        content: { "application/json": { schema: { type: "object" } } }
+      },
+      responses: { 200: { description: "Updated preference" } }
+    }
+  };
+  spec.paths["/api/preview-token"] = {
+    post: {
+      tags: ["Preview"],
+      summary: "Create a preview token",
+      responses: { 200: { description: "Short-lived preview token" } }
+    }
+  };
+  spec.paths["/api/preview-data"] = {
+    get: {
+      tags: ["Preview"],
+      summary: "Resolve preview data from a token",
+      security: [],
+      parameters: [
+        {
+          name: "token",
+          in: "query",
+          required: true,
+          schema: { type: "string" }
+        }
+      ],
+      responses: { 200: { description: "Preview document data" } }
+    }
+  };
   for (const collection of config.collections) {
     spec.components.schemas[collection.slug] = collectionToSchema(collection);
   }
@@ -1915,10 +2350,28 @@ function generateOpenApi(config) {
         tags: ["Collections"],
         summary: `Find ${labels.plural}`,
         parameters: [
-          { name: "limit", in: "query", schema: { type: "integer", default: 10 } },
-          { name: "page", in: "query", schema: { type: "integer", default: 1 } },
-          { name: "where", in: "query", schema: { type: "string" }, description: "JSON filter" },
-          { name: "sort", in: "query", schema: { type: "string" }, description: "Sort field (e.g. -createdAt)" }
+          {
+            name: "limit",
+            in: "query",
+            schema: { type: "integer", default: 10 }
+          },
+          {
+            name: "page",
+            in: "query",
+            schema: { type: "integer", default: 1 }
+          },
+          {
+            name: "where",
+            in: "query",
+            schema: { type: "string" },
+            description: "JSON filter"
+          },
+          {
+            name: "sort",
+            in: "query",
+            schema: { type: "string" },
+            description: "Sort field (e.g. -createdAt)"
+          }
         ],
         responses: {
           200: {
@@ -1928,7 +2381,10 @@ function generateOpenApi(config) {
                 schema: {
                   type: "object",
                   properties: {
-                    docs: { type: "array", items: { $ref: `#/components/schemas/${slug}` } },
+                    docs: {
+                      type: "array",
+                      items: { $ref: `#/components/schemas/${slug}` }
+                    },
                     total: { type: "integer" },
                     limit: { type: "integer" },
                     page: { type: "integer" }
@@ -1966,7 +2422,14 @@ function generateOpenApi(config) {
       get: {
         tags: ["Collections"],
         summary: `Get a single ${labels.singular}`,
-        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+        parameters: [
+          {
+            name: "id",
+            in: "path",
+            required: true,
+            schema: { type: "string" }
+          }
+        ],
         responses: {
           200: {
             description: "Success",
@@ -1981,7 +2444,14 @@ function generateOpenApi(config) {
       patch: {
         tags: ["Collections"],
         summary: `Update ${labels.singular}`,
-        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+        parameters: [
+          {
+            name: "id",
+            in: "path",
+            required: true,
+            schema: { type: "string" }
+          }
+        ],
         requestBody: {
           required: true,
           content: {
@@ -2004,12 +2474,288 @@ function generateOpenApi(config) {
       delete: {
         tags: ["Collections"],
         summary: `Delete ${labels.singular}`,
-        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+        parameters: [
+          {
+            name: "id",
+            in: "path",
+            required: true,
+            schema: { type: "string" }
+          }
+        ],
         responses: {
           204: { description: "Deleted" }
         }
       }
     };
+    spec.paths[`${path}/delete-many`] = {
+      delete: {
+        tags: ["Collections"],
+        summary: `Delete multiple ${labels.plural}`,
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                required: ["ids"],
+                properties: {
+                  ids: { type: "array", items: { type: "string" } }
+                }
+              }
+            }
+          }
+        },
+        responses: { 200: { description: "Deleted and failed document IDs" } }
+      }
+    };
+    spec.paths[`${path}/seed`] = {
+      post: {
+        tags: ["Collections"],
+        summary: `Seed initial ${labels.plural}`,
+        responses: { 200: { description: "Seeded documents" } }
+      }
+    };
+    if (collection.upload) {
+      spec.paths[`${path}/media`] = {
+        get: {
+          tags: ["Media"],
+          summary: `List ${labels.plural}`,
+          responses: { 200: { description: "Paginated media documents" } }
+        },
+        post: {
+          tags: ["Media"],
+          summary: `Upload ${labels.singular}`,
+          requestBody: {
+            required: true,
+            content: {
+              "multipart/form-data": {
+                schema: {
+                  type: "object",
+                  required: ["file"],
+                  properties: { file: { type: "string", format: "binary" } }
+                }
+              }
+            }
+          },
+          responses: { 201: { description: "Uploaded media document" } }
+        }
+      };
+      spec.paths[`${path}/media/{filename}`] = {
+        get: {
+          tags: ["Media"],
+          summary: `Serve ${labels.singular} bytes`,
+          parameters: [
+            {
+              name: "filename",
+              in: "path",
+              required: true,
+              schema: { type: "string" }
+            }
+          ],
+          security: [],
+          responses: {
+            200: { description: "Stored file" },
+            404: { description: "File not found" }
+          }
+        }
+      };
+    }
+    if (collection.auth) {
+      const publicAuthPost = (summary) => ({
+        tags: ["Authentication"],
+        summary,
+        security: [],
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: { type: "object", additionalProperties: true }
+            }
+          }
+        },
+        responses: {
+          200: { description: "Success" },
+          400: { description: "Invalid request" }
+        }
+      });
+      spec.paths[`${path}/login`] = {
+        post: {
+          ...publicAuthPost(`Log in to ${labels.plural}`),
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/AuthCredentials" }
+              }
+            }
+          },
+          responses: {
+            200: {
+              description: "Authenticated",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/TokenResponse" }
+                }
+              }
+            },
+            401: { description: "Invalid credentials" }
+          }
+        }
+      };
+      spec.paths[`${path}/logout`] = {
+        post: {
+          tags: ["Authentication"],
+          summary: `Log out of ${labels.plural}`,
+          responses: { 200: { description: "Logged out" } }
+        }
+      };
+      spec.paths[`${path}/init`] = {
+        get: {
+          tags: ["Authentication"],
+          summary: `Get ${labels.plural} initialization state`,
+          security: [],
+          responses: { 200: { description: "Initialization state" } }
+        }
+      };
+      spec.paths[`${path}/first-user`] = {
+        post: publicAuthPost(`Register the first ${labels.singular}`)
+      };
+      spec.paths[`${path}/me`] = {
+        get: {
+          tags: ["Authentication"],
+          summary: `Get the current ${labels.singular}`,
+          responses: { 200: { description: "Authenticated user" } }
+        }
+      };
+      spec.paths[`${path}/refresh-token`] = {
+        post: {
+          tags: ["Authentication"],
+          summary: "Refresh an authentication token",
+          responses: { 200: { description: "Refreshed token" } }
+        }
+      };
+      spec.paths[`${path}/forgot-password`] = {
+        post: publicAuthPost("Request a password reset")
+      };
+      spec.paths[`${path}/reset-password`] = {
+        post: publicAuthPost("Reset a password")
+      };
+      spec.paths[`${path}/invite`] = {
+        post: {
+          tags: ["Authentication"],
+          summary: `Invite a ${labels.singular}`,
+          responses: { 200: { description: "Invitation sent" } }
+        }
+      };
+      spec.paths[`${path}/accept-invite`] = {
+        post: publicAuthPost("Accept an invitation")
+      };
+      spec.paths[`${path}/{id}/change-password`] = {
+        post: {
+          tags: ["Authentication"],
+          summary: `Change a ${labels.singular} password`,
+          parameters: [
+            {
+              name: "id",
+              in: "path",
+              required: true,
+              schema: { type: "string" }
+            }
+          ],
+          responses: { 200: { description: "Password changed" } }
+        }
+      };
+    }
+    if (collection.workflow) {
+      spec.paths[`${path}/{id}/transitions/{transition}`] = {
+        post: {
+          tags: ["Workflows"],
+          summary: `Transition ${labels.singular} workflow`,
+          parameters: [
+            {
+              name: "id",
+              in: "path",
+              required: true,
+              schema: { type: "string" }
+            },
+            {
+              name: "transition",
+              in: "path",
+              required: true,
+              schema: {
+                type: "string",
+                enum: collection.workflow.transitions.map((item) => item.name)
+              }
+            }
+          ],
+          requestBody: {
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/WorkflowTransitionRequest"
+                }
+              }
+            }
+          },
+          responses: {
+            200: {
+              description: "Transition applied",
+              content: {
+                "application/json": {
+                  schema: { $ref: `#/components/schemas/${slug}` }
+                }
+              }
+            },
+            400: { description: "Required transition input is missing" },
+            403: { description: "Transition capability denied" },
+            409: { description: "Invalid state or stale revision" }
+          }
+        }
+      };
+      spec.paths[`${path}/{id}/workflow-history`] = {
+        get: {
+          tags: ["Workflows"],
+          summary: `Get ${labels.singular} workflow history`,
+          parameters: [
+            {
+              name: "id",
+              in: "path",
+              required: true,
+              schema: { type: "string" }
+            },
+            {
+              name: "limit",
+              in: "query",
+              schema: { type: "integer", default: 50, maximum: 100 }
+            }
+          ],
+          responses: {
+            200: {
+              description: "Workflow transition history",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    properties: {
+                      docs: {
+                        type: "array",
+                        items: {
+                          $ref: "#/components/schemas/WorkflowHistoryEntry"
+                        }
+                      },
+                      total: { type: "integer" },
+                      limit: { type: "integer" },
+                      page: { type: "integer" }
+                    }
+                  }
+                }
+              }
+            },
+            403: { description: "Collection read access denied" }
+          }
+        }
+      };
+    }
   }
   for (const global of config.globals) {
     const slug = global.slug;
@@ -2052,45 +2798,31 @@ function generateOpenApi(config) {
         }
       }
     };
+    spec.paths[`${path}/seed`] = {
+      post: {
+        tags: ["Globals"],
+        summary: `Seed ${global.label || slug}`,
+        responses: { 200: { description: "Seeded global" } }
+      }
+    };
   }
   if (config.storage) {
-    spec.paths["/api/media"] = {
+    spec.paths["/api/media/{filename}"] = {
       get: {
         tags: ["Media"],
-        summary: "List Media",
-        responses: {
-          200: {
-            description: "Success",
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  properties: {
-                    docs: { type: "array", items: { type: "object", additionalProperties: true } }
-                  }
-                }
-              }
-            }
-          }
-        }
-      },
-      post: {
-        tags: ["Media"],
-        summary: "Upload Media",
-        requestBody: {
-          content: {
-            "multipart/form-data": {
-              schema: {
-                type: "object",
-                properties: {
-                  file: { type: "string", format: "binary" }
-                }
-              }
-            }
+        summary: "Serve a stored file",
+        security: [],
+        parameters: [
+          {
+            name: "filename",
+            in: "path",
+            required: true,
+            schema: { type: "string" }
           }
-        },
+        ],
         responses: {
-          201: { description: "Uploaded" }
+          200: { description: "Stored file bytes" },
+          404: { description: "File not found" }
         }
       }
     };
@@ -2105,6 +2837,7 @@ function collectionToSchema(collection) {
       id: { type: "string" },
       createdAt: { type: "string", format: "date-time" },
       updatedAt: { type: "string", format: "date-time" },
+      ...collection.workflow ? { _workflow: { $ref: "#/components/schemas/WorkflowMetadata" } } : {},
       ...properties
     },
     required: ["id", ...required]
@@ -2122,7 +2855,13 @@ function fieldsToProperties(fields) {
   const props = {};
   const required = [];
   for (const field of fields) {
-    if (!field.name || field.type === "join" || field.type === "row") continue;
+    if (field.type === "row") {
+      const nested = fieldsToProperties(field.fields || []);
+      Object.assign(props, nested.properties);
+      required.push(...nested.required);
+      continue;
+    }
+    if (!field.name) continue;
     props[field.name] = fieldToSchema(field);
     if (field.required) {
       required.push(field.name);
@@ -2136,7 +2875,17 @@ function fieldToSchema(field) {
     case "text":
     case "textarea":
     case "email":
+      schema = { type: "string" };
+      break;
     case "url":
+      schema = {
+        oneOf: [
+          { type: "string" },
+          { type: "object", additionalProperties: true }
+        ]
+      };
+      break;
+    case "icon":
       schema = { type: "string" };
       break;
     case "number":
@@ -2146,20 +2895,45 @@ function fieldToSchema(field) {
       schema = { type: "boolean" };
       break;
     case "date":
+      schema = { type: "string", format: "date" };
+      break;
+    case "datetime":
       schema = { type: "string", format: "date-time" };
       break;
+    case "time":
+      schema = { type: "string", format: "time" };
+      break;
     case "select":
     case "radio":
-      schema = { type: "string", enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0 };
+      schema = {
+        type: "string",
+        enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0
+      };
       break;
     case "multiSelect":
       schema = {
         type: "array",
-        items: { type: "string", enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0 }
+        items: {
+          type: "string",
+          enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0
+        }
       };
       break;
     case "relationship":
-      schema = { type: "string", description: `ID of a ${field.relationTo} record` };
+    case "image": {
+      const valueSchema = {
+        type: "string",
+        description: `ID of a ${field.relationTo} record`
+      };
+      schema = field.hasMany ? { type: "array", items: valueSchema } : valueSchema;
+      break;
+    }
+    case "join":
+      schema = {
+        type: "array",
+        readOnly: true,
+        items: { type: "object", additionalProperties: true }
+      };
       break;
     case "object": {
       const { properties, required } = fieldsToProperties(field.fields || []);
@@ -2168,7 +2942,10 @@ function fieldToSchema(field) {
     }
     case "array": {
       const { properties, required } = fieldsToProperties(field.fields || []);
-      schema = { type: "array", items: { type: "object", properties, required } };
+      schema = {
+        type: "array",
+        items: { type: "object", properties, required }
+      };
       break;
     }
     case "json":
@@ -2249,20 +3026,6 @@ function getSwaggerHtml(specUrl = "/api/openapi.json") {
   `;
 }
 
-// src/auth/jexl.ts
-var import_jexl = __toESM(require("jexl"), 1);
-async function evaluateAccess(expression, context) {
-  if (expression === void 0 || expression === null) return false;
-  if (typeof expression === "boolean") return expression;
-  try {
-    const result = await import_jexl.default.eval(expression, context);
-    return !!result;
-  } catch (err) {
-    console.error("[dyrected/core] Jexl evaluation failed:", err);
-    return false;
-  }
-}
-
 // src/router.ts
 function accessGate(target, action) {
   return async (c, next) => {
@@ -2373,7 +3136,22 @@ function registerRoutes(app, config) {
       }))),
       upload: !!col.upload,
       auth: !!col.auth,
-      admin: col.admin
+      admin: col.admin,
+      workflow: col.workflow ? {
+        initialState: col.workflow.initialState,
+        draftState: col.workflow.draftState,
+        states: col.workflow.states,
+        transitions: col.workflow.transitions.map((t) => ({
+          name: t.name,
+          label: t.label,
+          from: t.from,
+          to: t.to,
+          requiredCapabilities: t.requiredCapabilities,
+          requireComment: t.requireComment,
+          unpublish: t.unpublish
+        })),
+        roles: col.workflow.roles
+      } : void 0
     })));
     const filteredGlobals = await Promise.all(globals.filter((glb) => !siteId || glb.shared || !glb.siteId || glb.siteId === siteId).map(async (glb) => ({
       slug: glb.slug,
@@ -2567,6 +3345,10 @@ function registerRoutes(app, config) {
     if (collection.auth) {
       app.post(`${path}/:id/change-password`, requireAuth(), (c) => controller.changePassword(c));
     }
+    if (collection.workflow) {
+      app.post(`${path}/:id/transitions/:transition`, requireAuth(), (c) => controller.transition(c));
+      app.get(`${path}/:id/workflow-history`, requireAuth(), (c) => controller.workflowHistory(c));
+    }
   }
   for (const global of config.globals) {
     const path = `/api/globals/${global.slug}`;
@@ -2578,6 +3360,41 @@ function registerRoutes(app, config) {
   const previewController = new PreviewController();
   app.post("/api/preview-token", requireAuth(), (c) => previewController.createToken(c));
   app.get("/api/preview-data", (c) => previewController.getData(c));
+  app.all("/api/collections/:slug/:id/*", requireAuth(), async (c) => {
+    const slug = c.req.param("slug");
+    const id = c.req.param("id");
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const config2 = c.get("config");
+    if (config2.collections.some((col) => col.slug === slug)) {
+      return c.json({ message: "Not Found" }, 404);
+    }
+    if (!config2.onSchemaFetch || !siteId) {
+      return c.json({ message: `Collection "${slug}" not found` }, 404);
+    }
+    const dynamic = await config2.onSchemaFetch(siteId);
+    const collection = dynamic.collections?.find((col) => col.slug === slug);
+    if (!collection?.workflow) {
+      return c.json({ message: `Collection "${slug}" not found or has no workflow` }, 404);
+    }
+    const controller = new CollectionController(collection);
+    const rawPath = c.req.path;
+    const method = c.req.method;
+    const transitionMatch = rawPath.match(/\/transitions\/([^/]+)$/);
+    if (transitionMatch && method === "POST") {
+      c.req.raw.__transition = transitionMatch[1];
+      const origParam = c.req.param.bind(c.req);
+      c.req.param = (key) => {
+        if (key === "transition") return transitionMatch[1];
+        if (key === "id") return id;
+        return origParam(key);
+      };
+      return controller.transition(c);
+    }
+    if (rawPath.endsWith("/workflow-history") && method === "GET") {
+      return controller.workflowHistory(c);
+    }
+    return c.json({ message: "Not Found" }, 404);
+  });
   app.all("/api/collections/:slug/:id?", async (c) => {
     const slug = c.req.param("slug");
     const id = c.req.param("id");
@@ -2686,10 +3503,47 @@ var AUDIT_COLLECTION = {
   ],
   admin: { hidden: true }
 };
+var WORKFLOW_HISTORY_COLLECTION_CONFIG = {
+  slug: WORKFLOW_HISTORY_COLLECTION,
+  labels: { singular: "Workflow transition", plural: "Workflow transitions" },
+  fields: [
+    { name: "collection", type: "text", required: true },
+    { name: "documentId", type: "text", required: true },
+    { name: "transition", type: "text", required: true },
+    { name: "from", type: "text", required: true },
+    { name: "to", type: "text", required: true },
+    { name: "revision", type: "number", required: true },
+    { name: "comment", type: "textarea" },
+    { name: "actorId", type: "text" },
+    { name: "createdAt", type: "date", required: true }
+  ],
+  access: { read: ({ user }) => !!user, create: () => false, update: () => false, delete: () => false },
+  admin: { hidden: true }
+};
+var LIFECYCLE_EVENTS_COLLECTION_CONFIG = {
+  slug: LIFECYCLE_EVENTS_COLLECTION,
+  labels: { singular: "Lifecycle event", plural: "Lifecycle events" },
+  fields: [
+    { name: "name", type: "text", required: true },
+    { name: "collection", type: "text", required: true },
+    { name: "documentId", type: "text", required: true },
+    { name: "occurredAt", type: "date", required: true },
+    { name: "actorId", type: "text" },
+    { name: "payload", type: "json", required: true },
+    { name: "attempts", type: "number", required: true },
+    { name: "status", type: "select", options: ["pending", "processing", "delivered", "failed"], required: true },
+    { name: "nextAttemptAt", type: "date" },
+    { name: "deliveredAt", type: "date" },
+    { name: "lastError", type: "textarea" }
+  ],
+  access: { read: ({ user }) => !!user?.roles?.includes("admin"), create: () => false, update: () => false, delete: () => false },
+  admin: { hidden: true }
+};
 function normalizeConfig(config) {
   const collections = config?.collections || [];
   const globals = config?.globals || [];
   const needsAudit = collections.some((col) => col.audit);
+  const needsWorkflow = collections.some((col) => col.workflow);
   const normalizedCollections = collections.map((col) => {
     let fields = col.fields || [];
     const existingFieldNames = new Set(fields.map((f) => f.name));
@@ -2784,9 +3638,17 @@ function normalizeConfig(config) {
     };
   });
   const hasAuditCollection = normalizedCollections.some((col) => col.slug === AUDIT_COLLECTION_SLUG);
+  const systemCollections = [];
+  if (needsAudit && !hasAuditCollection) systemCollections.push(AUDIT_COLLECTION);
+  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === WORKFLOW_HISTORY_COLLECTION)) {
+    systemCollections.push(WORKFLOW_HISTORY_COLLECTION_CONFIG);
+  }
+  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === LIFECYCLE_EVENTS_COLLECTION)) {
+    systemCollections.push(LIFECYCLE_EVENTS_COLLECTION_CONFIG);
+  }
   return {
     ...config,
-    collections: [...normalizedCollections, ...needsAudit && !hasAuditCollection ? [AUDIT_COLLECTION] : []],
+    collections: [...normalizedCollections, ...systemCollections],
     globals
   };
 }