@dyrected/core 2.5.29 → 2.5.32

package/dist/server.js

@@ -1,9 +1,17 @@
 import {
+  WORKFLOW_HISTORY_COLLECTION,
+  canViewWorkflowDraft,
+  createWorkflowDocument,
   executeFieldAfterRead,
   executeFieldBeforeChange,
+  generateOpenApi,
+  initializeWorkflowDocument,
+  materializeWorkflowDocument,
   normalizeConfig,
-  runCollectionHooks
-} from "./chunk-SUGK7UYL.js";
+  runCollectionHooks,
+  saveWorkflowDraft,
+  transitionWorkflow
+} from "./chunk-YDOBB7MY.js";
 
 // src/app.ts
 import { Hono } from "hono";
@@ -276,6 +284,20 @@ function createReadonlyDb(db) {
   });
 }
 
+// src/auth/jexl.ts
+import jexl from "jexl";
+async function evaluateAccess(expression, context) {
+  if (expression === void 0 || expression === null) return false;
+  if (typeof expression === "boolean") return expression;
+  try {
+    const result = await jexl.eval(expression, context);
+    return !!result;
+  } catch (err) {
+    console.error("[dyrected/core] Jexl evaluation failed:", err);
+    return false;
+  }
+}
+
 // src/controllers/collection.controller.ts
 var CollectionController = class {
   collection;
@@ -304,7 +326,7 @@ var CollectionController = class {
       if (this.collection.admin?.filterable === false) {
         where = void 0;
       } else {
-        const { sanitizeWhereClause } = await import("./where-sanitizer-DQIWTQZW.js");
+        const { sanitizeWhereClause } = await import("./where-sanitizer-WJ2W2QCE.js");
         where = sanitizeWhereClause(where, this.collection.fields);
         if (Object.keys(where).length === 0) {
           where = void 0;
@@ -320,6 +342,9 @@ var CollectionController = class {
     if (beforeReadResult !== void 0) {
       where = beforeReadResult;
     }
+    if (this.collection.workflow && !canViewWorkflowDraft(this.collection.workflow, user)) {
+      where = where ? { AND: [where, { __published: { exists: true } }] } : { __published: { exists: true } };
+    }
     let result = await db.find({
       collection: this.collection.slug,
       limit,
@@ -340,7 +365,7 @@ var CollectionController = class {
         where
       });
     }
-    result.docs = result.docs.map((doc) => DefaultsService.apply(this.collection.fields, doc));
+    result.docs = result.docs.map((doc) => this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc).filter((doc) => doc !== null).map((doc) => DefaultsService.apply(this.collection.fields, doc));
     const processedDocs = [];
     for (const doc of result.docs) {
       const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
@@ -368,8 +393,12 @@ var CollectionController = class {
     const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 10;
     const user = c.get("user");
     if (!id) return c.json({ message: "Missing ID" }, 400);
-    const doc = await db.findOne({ collection: this.collection.slug, id });
+    let doc = await db.findOne({ collection: this.collection.slug, id });
     if (!doc) return c.json({ message: "Not Found" }, 404);
+    if (this.collection.workflow) {
+      doc = materializeWorkflowDocument(doc, this.collection.workflow, user);
+      if (!doc) return c.json({ message: "Not Found" }, 404);
+    }
     const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
     const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
       doc: docWithDefaults,
@@ -409,6 +438,9 @@ var CollectionController = class {
       createdBy: user?.sub ?? null,
       updatedBy: user?.sub ?? null
     };
+    if (this.collection.workflow) {
+      data = initializeWorkflowDocument(data, this.collection.workflow);
+    }
     if (this.collection.auth && data.password) {
       data.password = await hashPassword(data.password);
     }
@@ -420,7 +452,7 @@ var CollectionController = class {
       operation: "create",
       db: readonlyDb
     });
-    const doc = await db.create({ collection: this.collection.slug, data });
+    const doc = this.collection.workflow ? (await createWorkflowDocument({ config, collection: this.collection, data, user })).doc : await db.create({ collection: this.collection.slug, data });
     if (this.collection.audit && db) {
       AuditService.log(db, {
         operation: "create",
@@ -438,8 +470,9 @@ var CollectionController = class {
       operation: "create",
       db
     }, { isolated: true });
+    const responseDoc = this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc;
     const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
-      doc,
+      doc: responseDoc,
       req: c.req,
       user,
       db: readonlyDb
@@ -502,8 +535,9 @@ var CollectionController = class {
       operation: "create",
       db
     }, { isolated: true });
+    const responseDoc = this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc;
     const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
-      doc,
+      doc: responseDoc,
       req: c.req,
       user,
       db: readonlyDb
@@ -545,7 +579,7 @@ var CollectionController = class {
       operation: "update",
       db: readonlyDb
     });
-    const doc = await db.update({ collection: this.collection.slug, id, data });
+    const doc = this.collection.workflow ? (await saveWorkflowDraft({ config, collection: this.collection, id, originalDoc, data, user })).doc : await db.update({ collection: this.collection.slug, id, data });
     if (this.collection.audit && db) {
       AuditService.log(db, {
         operation: "update",
@@ -573,6 +607,61 @@ var CollectionController = class {
     const finalDoc = await executeFieldAfterRead(this.collection.fields, readDoc, user, readonlyDb);
     return c.json(finalDoc);
   }
+  async transition(c) {
+    const config = c.get("config");
+    if (!config.db) return c.json({ message: "Database not configured" }, 500);
+    if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    const id = c.req.param("id");
+    const transitionName = c.req.param("transition");
+    const body = await c.req.json().catch(() => ({}));
+    try {
+      const doc = await transitionWorkflow({
+        config,
+        collection: this.collection,
+        id,
+        transitionName,
+        expectedRevision: body.expectedRevision,
+        comment: body.comment,
+        user: c.get("user"),
+        req: { query: c.req.query(), headers: c.req.header(), raw: c.req.raw }
+      });
+      return c.json(materializeWorkflowDocument(doc, this.collection.workflow, c.get("user")));
+    } catch (error) {
+      const status = typeof error.statusCode === "number" ? error.statusCode : 500;
+      return c.json({ error: true, message: error instanceof Error ? error.message : String(error) }, status);
+    }
+  }
+  async workflowHistory(c) {
+    const config = c.get("config");
+    if (!config.db) return c.json({ message: "Database not configured" }, 500);
+    if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    const documentId = c.req.param("id");
+    if (!documentId) return c.json({ message: "Missing ID" }, 400);
+    const document = await config.db.findOne({ collection: this.collection.slug, id: documentId });
+    if (!document) return c.json({ message: "Not Found" }, 404);
+    const readAccess = this.collection.access?.read;
+    if (readAccess !== void 0 && readAccess !== null) {
+      const args = { user: c.get("user"), req: c.req, doc: document };
+      const result2 = typeof readAccess === "function" ? await readAccess(args) : await evaluateAccess(readAccess, args);
+      let allowed = result2 === true;
+      if (result2 && typeof result2 === "object") {
+        const match = await config.db.find({
+          collection: this.collection.slug,
+          where: { AND: [{ id: { equals: documentId } }, result2] },
+          limit: 1
+        });
+        allowed = match.total > 0;
+      }
+      if (!allowed) return c.json({ error: true, message: `Access denied: read on ${this.collection.slug}` }, 403);
+    }
+    const result = await config.db.find({
+      collection: WORKFLOW_HISTORY_COLLECTION,
+      where: { collection: { equals: this.collection.slug }, documentId: { equals: documentId } },
+      sort: "-createdAt",
+      limit: Math.min(Number(c.req.query("limit")) || 50, 100)
+    });
+    return c.json(result);
+  }
   /**
    * POST /api/collections/:slug/:id/change-password
    *
@@ -1040,6 +1129,96 @@ async function verifyCollectionToken(token) {
   return payload;
 }
 
+// src/services/email-template.ts
+var emailTokens = {
+  colors: {
+    canvas: "#f6f7f2",
+    surface: "#ffffff",
+    text: "#171717",
+    muted: "#62665b",
+    subtle: "#8a8f82",
+    border: "#dde0d7",
+    accent: "#b6ff2e",
+    code: "#f1f3ec",
+    dangerSurface: "#fff2f0",
+    dangerBorder: "#ffc9c2",
+    dangerText: "#9f251b"
+  },
+  font: "Arial, 'Helvetica Neue', Helvetica, sans-serif",
+  mono: "'Courier New', Courier, monospace",
+  radius: { card: "12px", control: "6px" },
+  width: "600px"
+};
+function escapeHtml(value) {
+  return value.replace(/[&<>'"]/g, (character) => ({
+    "&": "&amp;",
+    "<": "&lt;",
+    ">": "&gt;",
+    "'": "&#39;",
+    '"': "&quot;"
+  })[character]);
+}
+function safeHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" || url.protocol === "http:" ? escapeHtml(url.toString()) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function heading(content) {
+  return `<h1 style="margin:0;font-family:${emailTokens.font};font-size:24px;line-height:1.25;font-weight:700;color:${emailTokens.colors.text}">${escapeHtml(content)}</h1>`;
+}
+function paragraph(content, margin = "0 0 16px") {
+  return `<p style="margin:${margin};font-family:${emailTokens.font};font-size:15px;line-height:1.6;color:${emailTokens.colors.muted}">${escapeHtml(content)}</p>`;
+}
+function sectionLabel(content) {
+  return `<p style="margin:0 0 8px;font-family:${emailTokens.font};font-size:11px;line-height:1.4;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:${emailTokens.colors.subtle}">${escapeHtml(content)}</p>`;
+}
+function divider() {
+  return `<table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%"><tr><td style="height:1px;background:${emailTokens.colors.border};font-size:0;line-height:0">&nbsp;</td></tr></table>`;
+}
+function spacer(height = 16) {
+  return table(row("&nbsp;", `height:${height}px;font-size:0;line-height:0`));
+}
+function row(content, cellStyle = "") {
+  return `<tr><td style="${cellStyle}">${content}</td></tr>`;
+}
+function table(content, style = "width:100%") {
+  return `<table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%" style="${style}">${content}</table>`;
+}
+function detailBox(content, monospace = false) {
+  const font = monospace ? emailTokens.mono : emailTokens.font;
+  return table(row(escapeHtml(content), `padding:14px 16px;font-family:${font};font-size:13px;line-height:1.5;font-weight:${monospace ? "400" : "700"};color:${emailTokens.colors.text};word-break:break-all`), `width:100%;background:${emailTokens.colors.code};border-radius:${emailTokens.radius.control}`);
+}
+function ctaButton(label, href) {
+  const safeHref = safeHttpUrl(href);
+  if (!safeHref) return "";
+  return table(row(
+    `<a href="${safeHref}" style="display:inline-block;padding:13px 22px;border-radius:${emailTokens.radius.control};background:${emailTokens.colors.accent};font-family:${emailTokens.font};font-size:14px;line-height:1.2;font-weight:700;color:${emailTokens.colors.text};text-decoration:none">${escapeHtml(label)}</a>`,
+    "padding:8px 0 24px"
+  ), "width:auto");
+}
+function alertBox(content) {
+  return table(row(escapeHtml(content), `padding:13px 16px;font-family:${emailTokens.font};font-size:13px;line-height:1.5;color:${emailTokens.colors.dangerText}`), `width:100%;background:${emailTokens.colors.dangerSurface};border:1px solid ${emailTokens.colors.dangerBorder};border-radius:${emailTokens.radius.control}`);
+}
+function layout({ preheader, title, content, footer }) {
+  return `<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"></head>
+  <body style="margin:0;padding:0;background:${emailTokens.colors.canvas}">
+    <div style="display:none;max-height:0;overflow:hidden;opacity:0;color:transparent">${escapeHtml(preheader)}</div>
+    ${table(row(
+    table(
+      row("&nbsp;", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${sectionLabel("Dyrected")}${heading(title)}`, "padding:30px 32px 24px") + row(content, "padding:0 32px 32px") + row(`${divider()}${paragraph(footer, "20px 0 6px")}${paragraph("Privacy: this message contains account-related information; please avoid forwarding it.", "0")}`, "padding:0 32px 28px"),
+      `width:100%;max-width:${emailTokens.width};background:${emailTokens.colors.surface};border:1px solid ${emailTokens.colors.border};border-radius:${emailTokens.radius.card};overflow:hidden`
+    ),
+    "padding:32px 12px"
+  ), `width:100%;background:${emailTokens.colors.canvas}`)}
+  </body>
+</html>`;
+}
+
 // src/services/email.service.ts
 var _devSend = null;
 var _devSendPromise = null;
@@ -1083,77 +1262,24 @@ function buildWelcomeEmail(config, args) {
   const custom = config.email?.templates?.welcome?.(args);
   return {
     subject: custom?.subject ?? "Welcome \u2014 your account is ready",
-    html: custom?.html ?? `
-      <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f9fafb;table-layout:fixed">
-        <tr>
-          <td align="center" style="padding:40px 16px">
-            <table cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;background-color:#ffffff;border-radius:12px;border:1px solid #e5e7eb;table-layout:fixed">
-              <tr>
-                <td style="padding:32px 32px 0">
-                  <p style="margin:0 0 4px;font-size:12px;font-weight:600;color:#6b7280;font-family:sans-serif;text-transform:uppercase;letter-spacing:0.05em">Dyrected</p>
-                  <h1 style="margin:0 0 24px;font-size:22px;font-weight:700;color:#111827;font-family:sans-serif">Welcome!</h1>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:0 32px">
-                  <p style="margin:0 0 12px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">Your account has been created. You can now log in with:</p>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f3f4f6;border-radius:6px;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-size:14px;font-weight:600;color:#111827;font-family:sans-serif;word-break:break-all">
-                        ${args.email}
-                      </td>
-                    </tr>
-                  </table>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:32px">
-                  <p style="margin:0;font-size:12px;color:#9ca3af;font-family:sans-serif">If you didn't create this account, you can safely ignore this email.</p>
-                </td>
-              </tr>
-            </table>
-          </td>
-        </tr>
-      </table>`
+    html: custom?.html ?? layout({
+      preheader: "Your Dyrected account is ready.",
+      title: "Welcome \u2014 your account is ready",
+      content: `${paragraph("Your account has been created. You can now log in with:")}${detailBox(args.email)}`,
+      footer: "If you didn't create this account, you can safely ignore this email."
+    })
   };
 }
 function buildInviteEmail(config, args) {
   const custom = config.email?.templates?.invite?.(args);
   return {
     subject: custom?.subject ?? "You've been invited",
-    html: custom?.html ?? `
-      <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f9fafb;table-layout:fixed">
-        <tr>
-          <td align="center" style="padding:40px 16px">
-            <table cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;background-color:#ffffff;border-radius:12px;border:1px solid #e5e7eb;table-layout:fixed">
-              <tr>
-                <td style="padding:32px 32px 0">
-                  <p style="margin:0 0 4px;font-size:12px;font-weight:600;color:#6b7280;font-family:sans-serif;text-transform:uppercase;letter-spacing:0.05em">Dyrected</p>
-                  <h1 style="margin:0 0 24px;font-size:22px;font-weight:700;color:#111827;font-family:sans-serif">You've been invited</h1>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:0 32px">
-                  ${args.invitedByEmail ? `<p style="margin:0 0 12px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">You were invited by <strong style="color:#111827">${args.invitedByEmail}</strong>.</p>` : ""}
-                  <p style="margin:0 0 16px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">Use the token below to accept your invitation. It expires in 7 days.</p>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f3f4f6;border-radius:6px;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-family:monospace;font-size:12px;color:#374151;word-break:break-all;white-space:normal;line-height:1.4">
-                        ${args.token}
-                      </td>
-                    </tr>
-                  </table>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:32px">
-                  <p style="margin:0;font-size:12px;color:#9ca3af;font-family:sans-serif">If you weren't expecting this invitation, you can safely ignore this email.</p>
-                </td>
-              </tr>
-            </table>
-          </td>
-        </tr>
-      </table>`
+    html: custom?.html ?? layout({
+      preheader: "You've been invited to join a Dyrected account.",
+      title: "You've been invited",
+      content: `${args.invitedByEmail ? paragraph(`You were invited by ${args.invitedByEmail}.`) : ""}${paragraph("Use the token below to accept your invitation. It expires in 7 days.")}${sectionLabel("Invitation token")}${detailBox(args.token, true)}`,
+      footer: "If you weren't expecting this invitation, you can safely ignore this email."
+    })
   };
 }
 function buildResetPasswordEmail(config, args) {
@@ -1161,95 +1287,24 @@ function buildResetPasswordEmail(config, args) {
   const resetLink = args.url;
   return {
     subject: custom?.subject ?? "Reset your password",
-    html: custom?.html ?? `
-      <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f9fafb;table-layout:fixed">
-        <tr>
-          <td align="center" style="padding:40px 16px">
-            <table cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;background-color:#ffffff;border-radius:12px;border:1px solid #e5e7eb;table-layout:fixed">
-              <tr>
-                <td style="padding:32px 32px 0">
-                  <p style="margin:0 0 4px;font-size:12px;font-weight:600;color:#6b7280;font-family:sans-serif;text-transform:uppercase;letter-spacing:0.05em">Dyrected</p>
-                  <h1 style="margin:0 0 24px;font-size:22px;font-weight:700;color:#111827;font-family:sans-serif">Reset your password</h1>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:0 32px">
-                  <p style="margin:0 0 24px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">We received a request to reset your password. Use the button below to set a new password. It will expire in 1 hour.</p>
-                  ${resetLink ? `
-                  <table cellpadding="0" cellspacing="0" border="0" style="margin-bottom:24px">
-                    <tr>
-                      <td style="border-radius:6px;background-color:#111827">
-                        <a href="${resetLink}" style="display:inline-block;padding:12px 28px;font-size:14px;font-weight:600;color:#ffffff;text-decoration:none;font-family:sans-serif;border-radius:6px">
-                          Reset Password
-                        </a>
-                      </td>
-                    </tr>
-                  </table>
-                  ` : ""}
-                  <p style="margin:0 0 8px;font-size:12px;color:#9ca3af;font-family:sans-serif">Or copy and paste this token manually in the admin dashboard:</p>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f3f4f6;border-radius:6px;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-family:monospace;font-size:12px;color:#374151;word-break:break-all;white-space:normal;line-height:1.4">
-                        ${args.token}
-                      </td>
-                    </tr>
-                  </table>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:32px">
-                  <p style="margin:0;font-size:12px;color:#9ca3af;font-family:sans-serif">If you didn't request a password reset, you can safely ignore this email.</p>
-                </td>
-              </tr>
-            </table>
-          </td>
-        </tr>
-      </table>`
+    html: custom?.html ?? layout({
+      preheader: "Reset your Dyrected password.",
+      title: "Reset your password",
+      content: `${paragraph("We received a request to reset your password. The reset link and token expire in 1 hour.")}${resetLink ? ctaButton("Reset password", resetLink) : ""}${sectionLabel(resetLink ? "Or use this token" : "Reset token")}${detailBox(args.token, true)}`,
+      footer: "If you didn't request a password reset, you can safely ignore this email."
+    })
   };
 }
 function buildPasswordChangedEmail(config, args) {
   const custom = config.email?.templates?.passwordChanged?.(args);
   return {
     subject: custom?.subject ?? "Your password has been changed",
-    html: custom?.html ?? `
-      <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f9fafb;table-layout:fixed">
-        <tr>
-          <td align="center" style="padding:40px 16px">
-            <table cellpadding="0" cellspacing="0" border="0" style="width:100%;max-width:600px;background-color:#ffffff;border-radius:12px;border:1px solid #e5e7eb;table-layout:fixed">
-              <tr>
-                <td style="padding:32px 32px 0">
-                  <p style="margin:0 0 4px;font-size:12px;font-weight:600;color:#6b7280;font-family:sans-serif;text-transform:uppercase;letter-spacing:0.05em">Dyrected</p>
-                  <h1 style="margin:0 0 24px;font-size:22px;font-weight:700;color:#111827;font-family:sans-serif">Password changed</h1>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:0 32px">
-                  <p style="margin:0 0 12px;font-size:14px;color:#4b5563;line-height:1.6;font-family:sans-serif">The password for your account was just changed:</p>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;background-color:#f3f4f6;border-radius:6px;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-size:14px;font-weight:600;color:#111827;font-family:sans-serif;word-break:break-all">
-                        ${args.email}
-                      </td>
-                    </tr>
-                  </table>
-                  <table cellpadding="0" cellspacing="0" border="0" style="width:100%;margin-top:16px;background-color:#fef2f2;border-radius:6px;border:1px solid #fecaca;table-layout:fixed">
-                    <tr>
-                      <td style="padding:12px 16px;font-size:13px;color:#b91c1c;line-height:1.5;font-family:sans-serif">
-                        If you did not make this change, please contact support immediately.
-                      </td>
-                    </tr>
-                  </table>
-                </td>
-              </tr>
-              <tr>
-                <td style="padding:32px">
-                  <p style="margin:0;font-size:12px;color:#9ca3af;font-family:sans-serif">This is an automated security notification.</p>
-                </td>
-              </tr>
-            </table>
-          </td>
-        </tr>
-      </table>`
+    html: custom?.html ?? layout({
+      preheader: "Your Dyrected password was changed.",
+      title: "Password changed",
+      content: `${paragraph("The password for this account was just changed:")}${detailBox(args.email)}${spacer()}${alertBox("If you did not make this change, please contact support immediately.")}`,
+      footer: "This is an automated security notification."
+    })
   };
 }
 
@@ -1623,328 +1678,6 @@ function optionalAuth() {
   };
 }
 
-// src/utils/openapi.ts
-function generateOpenApi(config) {
-  const spec = {
-    openapi: "3.0.0",
-    info: {
-      title: "Dyrected API",
-      version: "1.0.0",
-      description: "Automatically generated OpenAPI specification for the Dyrected project."
-    },
-    components: {
-      schemas: {},
-      securitySchemes: {
-        ApiKeyAuth: {
-          type: "apiKey",
-          in: "header",
-          name: "x-api-key"
-        }
-      }
-    },
-    paths: {},
-    security: [{ ApiKeyAuth: [] }]
-  };
-  for (const collection of config.collections) {
-    spec.components.schemas[collection.slug] = collectionToSchema(collection);
-  }
-  for (const global of config.globals) {
-    spec.components.schemas[global.slug] = globalToSchema(global);
-  }
-  for (const collection of config.collections) {
-    const slug = collection.slug;
-    const path = `/api/collections/${slug}`;
-    const labels = collection.labels || { singular: slug, plural: `${slug}s` };
-    spec.paths[path] = {
-      get: {
-        tags: ["Collections"],
-        summary: `Find ${labels.plural}`,
-        parameters: [
-          { name: "limit", in: "query", schema: { type: "integer", default: 10 } },
-          { name: "page", in: "query", schema: { type: "integer", default: 1 } },
-          { name: "where", in: "query", schema: { type: "string" }, description: "JSON filter" },
-          { name: "sort", in: "query", schema: { type: "string" }, description: "Sort field (e.g. -createdAt)" }
-        ],
-        responses: {
-          200: {
-            description: "Success",
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  properties: {
-                    docs: { type: "array", items: { $ref: `#/components/schemas/${slug}` } },
-                    total: { type: "integer" },
-                    limit: { type: "integer" },
-                    page: { type: "integer" }
-                  }
-                }
-              }
-            }
-          }
-        }
-      },
-      post: {
-        tags: ["Collections"],
-        summary: `Create ${labels.singular}`,
-        requestBody: {
-          required: true,
-          content: {
-            "application/json": {
-              schema: { $ref: `#/components/schemas/${slug}` }
-            }
-          }
-        },
-        responses: {
-          201: {
-            description: "Created",
-            content: {
-              "application/json": {
-                schema: { $ref: `#/components/schemas/${slug}` }
-              }
-            }
-          }
-        }
-      }
-    };
-    spec.paths[`${path}/{id}`] = {
-      get: {
-        tags: ["Collections"],
-        summary: `Get a single ${labels.singular}`,
-        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
-        responses: {
-          200: {
-            description: "Success",
-            content: {
-              "application/json": {
-                schema: { $ref: `#/components/schemas/${slug}` }
-              }
-            }
-          }
-        }
-      },
-      patch: {
-        tags: ["Collections"],
-        summary: `Update ${labels.singular}`,
-        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
-        requestBody: {
-          required: true,
-          content: {
-            "application/json": {
-              schema: { $ref: `#/components/schemas/${slug}` }
-            }
-          }
-        },
-        responses: {
-          200: {
-            description: "Updated",
-            content: {
-              "application/json": {
-                schema: { $ref: `#/components/schemas/${slug}` }
-              }
-            }
-          }
-        }
-      },
-      delete: {
-        tags: ["Collections"],
-        summary: `Delete ${labels.singular}`,
-        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
-        responses: {
-          204: { description: "Deleted" }
-        }
-      }
-    };
-  }
-  for (const global of config.globals) {
-    const slug = global.slug;
-    const path = `/api/globals/${slug}`;
-    spec.paths[path] = {
-      get: {
-        tags: ["Globals"],
-        summary: `Get ${global.label || slug}`,
-        responses: {
-          200: {
-            description: "Success",
-            content: {
-              "application/json": {
-                schema: { $ref: `#/components/schemas/${slug}` }
-              }
-            }
-          }
-        }
-      },
-      patch: {
-        tags: ["Globals"],
-        summary: `Update ${global.label || slug}`,
-        requestBody: {
-          required: true,
-          content: {
-            "application/json": {
-              schema: { $ref: `#/components/schemas/${slug}` }
-            }
-          }
-        },
-        responses: {
-          200: {
-            description: "Updated",
-            content: {
-              "application/json": {
-                schema: { $ref: `#/components/schemas/${slug}` }
-              }
-            }
-          }
-        }
-      }
-    };
-  }
-  if (config.storage) {
-    spec.paths["/api/media"] = {
-      get: {
-        tags: ["Media"],
-        summary: "List Media",
-        responses: {
-          200: {
-            description: "Success",
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  properties: {
-                    docs: { type: "array", items: { type: "object", additionalProperties: true } }
-                  }
-                }
-              }
-            }
-          }
-        }
-      },
-      post: {
-        tags: ["Media"],
-        summary: "Upload Media",
-        requestBody: {
-          content: {
-            "multipart/form-data": {
-              schema: {
-                type: "object",
-                properties: {
-                  file: { type: "string", format: "binary" }
-                }
-              }
-            }
-          }
-        },
-        responses: {
-          201: { description: "Uploaded" }
-        }
-      }
-    };
-  }
-  return spec;
-}
-function collectionToSchema(collection) {
-  const { properties, required } = fieldsToProperties(collection.fields);
-  return {
-    type: "object",
-    properties: {
-      id: { type: "string" },
-      createdAt: { type: "string", format: "date-time" },
-      updatedAt: { type: "string", format: "date-time" },
-      ...properties
-    },
-    required: ["id", ...required]
-  };
-}
-function globalToSchema(global) {
-  const { properties, required } = fieldsToProperties(global.fields);
-  return {
-    type: "object",
-    properties,
-    required
-  };
-}
-function fieldsToProperties(fields) {
-  const props = {};
-  const required = [];
-  for (const field of fields) {
-    if (!field.name || field.type === "join" || field.type === "row") continue;
-    props[field.name] = fieldToSchema(field);
-    if (field.required) {
-      required.push(field.name);
-    }
-  }
-  return { properties: props, required };
-}
-function fieldToSchema(field) {
-  let schema = {};
-  switch (field.type) {
-    case "text":
-    case "textarea":
-    case "email":
-    case "url":
-      schema = { type: "string" };
-      break;
-    case "number":
-      schema = { type: "number" };
-      break;
-    case "boolean":
-      schema = { type: "boolean" };
-      break;
-    case "date":
-      schema = { type: "string", format: "date-time" };
-      break;
-    case "select":
-    case "radio":
-      schema = { type: "string", enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0 };
-      break;
-    case "multiSelect":
-      schema = {
-        type: "array",
-        items: { type: "string", enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0 }
-      };
-      break;
-    case "relationship":
-      schema = { type: "string", description: `ID of a ${field.relationTo} record` };
-      break;
-    case "object": {
-      const { properties, required } = fieldsToProperties(field.fields || []);
-      schema = { type: "object", properties, required };
-      break;
-    }
-    case "array": {
-      const { properties, required } = fieldsToProperties(field.fields || []);
-      schema = { type: "array", items: { type: "object", properties, required } };
-      break;
-    }
-    case "json":
-    case "richText":
-      schema = { type: "object", additionalProperties: true };
-      break;
-    case "blocks":
-      schema = {
-        type: "array",
-        items: {
-          oneOf: field.blocks?.map((block) => {
-            const { properties, required } = fieldsToProperties(block.fields);
-            return {
-              type: "object",
-              properties: {
-                blockType: { type: "string", enum: [block.slug] },
-                ...properties
-              },
-              required: ["blockType", ...required]
-            };
-          })
-        }
-      };
-      break;
-    default:
-      schema = { type: "string" };
-  }
-  if (field.label) schema.description = field.label;
-  return schema;
-}
-
 // src/utils/swagger.ts
 function getSwaggerHtml(specUrl = "/api/openapi.json") {
   return `
@@ -1994,20 +1727,6 @@ function getSwaggerHtml(specUrl = "/api/openapi.json") {
   `;
 }
 
-// src/auth/jexl.ts
-import jexl from "jexl";
-async function evaluateAccess(expression, context) {
-  if (expression === void 0 || expression === null) return false;
-  if (typeof expression === "boolean") return expression;
-  try {
-    const result = await jexl.eval(expression, context);
-    return !!result;
-  } catch (err) {
-    console.error("[dyrected/core] Jexl evaluation failed:", err);
-    return false;
-  }
-}
-
 // src/router.ts
 function accessGate(target, action) {
   return async (c, next) => {
@@ -2118,7 +1837,22 @@ function registerRoutes(app, config) {
       }))),
       upload: !!col.upload,
       auth: !!col.auth,
-      admin: col.admin
+      admin: col.admin,
+      workflow: col.workflow ? {
+        initialState: col.workflow.initialState,
+        draftState: col.workflow.draftState,
+        states: col.workflow.states,
+        transitions: col.workflow.transitions.map((t) => ({
+          name: t.name,
+          label: t.label,
+          from: t.from,
+          to: t.to,
+          requiredCapabilities: t.requiredCapabilities,
+          requireComment: t.requireComment,
+          unpublish: t.unpublish
+        })),
+        roles: col.workflow.roles
+      } : void 0
     })));
     const filteredGlobals = await Promise.all(globals.filter((glb) => !siteId || glb.shared || !glb.siteId || glb.siteId === siteId).map(async (glb) => ({
       slug: glb.slug,
@@ -2312,6 +2046,10 @@ function registerRoutes(app, config) {
     if (collection.auth) {
       app.post(`${path}/:id/change-password`, requireAuth(), (c) => controller.changePassword(c));
     }
+    if (collection.workflow) {
+      app.post(`${path}/:id/transitions/:transition`, requireAuth(), (c) => controller.transition(c));
+      app.get(`${path}/:id/workflow-history`, requireAuth(), (c) => controller.workflowHistory(c));
+    }
   }
   for (const global of config.globals) {
     const path = `/api/globals/${global.slug}`;
@@ -2323,6 +2061,41 @@ function registerRoutes(app, config) {
   const previewController = new PreviewController();
   app.post("/api/preview-token", requireAuth(), (c) => previewController.createToken(c));
   app.get("/api/preview-data", (c) => previewController.getData(c));
+  app.all("/api/collections/:slug/:id/*", requireAuth(), async (c) => {
+    const slug = c.req.param("slug");
+    const id = c.req.param("id");
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const config2 = c.get("config");
+    if (config2.collections.some((col) => col.slug === slug)) {
+      return c.json({ message: "Not Found" }, 404);
+    }
+    if (!config2.onSchemaFetch || !siteId) {
+      return c.json({ message: `Collection "${slug}" not found` }, 404);
+    }
+    const dynamic = await config2.onSchemaFetch(siteId);
+    const collection = dynamic.collections?.find((col) => col.slug === slug);
+    if (!collection?.workflow) {
+      return c.json({ message: `Collection "${slug}" not found or has no workflow` }, 404);
+    }
+    const controller = new CollectionController(collection);
+    const rawPath = c.req.path;
+    const method = c.req.method;
+    const transitionMatch = rawPath.match(/\/transitions\/([^/]+)$/);
+    if (transitionMatch && method === "POST") {
+      c.req.raw.__transition = transitionMatch[1];
+      const origParam = c.req.param.bind(c.req);
+      c.req.param = (key) => {
+        if (key === "transition") return transitionMatch[1];
+        if (key === "id") return id;
+        return origParam(key);
+      };
+      return controller.transition(c);
+    }
+    if (rawPath.endsWith("/workflow-history") && method === "GET") {
+      return controller.workflowHistory(c);
+    }
+    return c.json({ message: "Not Found" }, 404);
+  });
   app.all("/api/collections/:slug/:id?", async (c) => {
     const slug = c.req.param("slug");
     const id = c.req.param("id");