@dyrected/core 2.5.30 → 2.5.32

package/dist/server.cjs

@@ -535,6 +535,20 @@ function createReadonlyDb(db) {
   });
 }
 
+// src/auth/jexl.ts
+var import_jexl = __toESM(require("jexl"), 1);
+async function evaluateAccess(expression, context) {
+  if (expression === void 0 || expression === null) return false;
+  if (typeof expression === "boolean") return expression;
+  try {
+    const result = await import_jexl.default.eval(expression, context);
+    return !!result;
+  } catch (err) {
+    console.error("[dyrected/core] Jexl evaluation failed:", err);
+    return false;
+  }
+}
+
 // src/workflows.ts
 var WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
 var LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
@@ -550,6 +564,14 @@ function workflowCapabilities(workflow, user) {
   }
   return capabilities;
 }
+function canViewWorkflowDraft(workflow, user) {
+  if (!user) return false;
+  const capabilities = workflowCapabilities(workflow, user);
+  if (capabilities.has("entry.edit")) return true;
+  return workflow.transitions.some(
+    (transition) => (transition.requiredCapabilities ?? []).some((capability) => capabilities.has(capability))
+  );
+}
 function availableWorkflowTransitions(workflow, state, user) {
   const capabilities = workflowCapabilities(workflow, user);
   return workflow.transitions.filter((transition) => {
@@ -567,7 +589,7 @@ function materializeWorkflowDocument(doc, workflow, user) {
   const meta = doc.__workflow;
   if (!meta) return doc;
   const { __published, __workflow, ...working } = doc;
-  if (!user) {
+  if (!canViewWorkflowDraft(workflow, user)) {
     if (!__published || typeof __published !== "object") return null;
     return { id: doc.id, ...__published, _workflow: publicMetadata(meta) };
   }
@@ -711,12 +733,18 @@ async function transitionWorkflow(args) {
     events.push(createLifecycleEvent({ name: "entry.unpublished", collection: collection.slug, documentId: id, actorId: user?.sub, payload: { revision: meta.publishedRevision } }));
   }
   const updated = await db.transaction(async (tx) => {
+    const locked = await tx.findOne({ collection: collection.slug, id });
+    if (!locked) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
+    const lockedMeta = locked.__workflow;
+    if (lockedMeta.revision !== meta.revision || lockedMeta.state !== meta.state || expectedRevision !== void 0 && lockedMeta.revision !== expectedRevision) {
+      throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
+    }
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const { __published: _published, __workflow: _workflow, id: _id, ...working } = original;
+    const { __published: _published, __workflow: _workflow, id: _id, ...working } = locked;
     const nextMeta = {
-      ...meta,
+      ...lockedMeta,
       state: transition.to,
-      ...targetState.published ? { publishedRevision: meta.revision, publishedAt: now, publishedBy: user?.sub } : {},
+      ...targetState.published ? { publishedRevision: lockedMeta.revision, publishedAt: now, publishedBy: user?.sub } : {},
       ...transition.unpublish ? { publishedRevision: void 0, publishedAt: void 0, publishedBy: void 0 } : {}
     };
     const data = { __workflow: nextMeta };
@@ -725,11 +753,11 @@ async function transitionWorkflow(args) {
     const next = await tx.update({ collection: collection.slug, id, data });
     await tx.create({
       collection: WORKFLOW_HISTORY_COLLECTION,
-      data: { collection: collection.slug, documentId: id, transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision, comment: comment ?? null, actorId: user?.sub ?? null, createdAt: now }
+      data: { collection: collection.slug, documentId: id, transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision, comment: comment ?? null, actorId: user?.sub ?? null, createdAt: now }
     });
     for (const event of events) await persistEvent(tx, event);
     if (collection.audit) {
-      await tx.create({ collection: "__audit", data: { collection: collection.slug, documentId: id, operation: "workflow.transition", user: user?.sub ?? null, timestamp: now, changes: JSON.stringify({ transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision }) } });
+      await tx.create({ collection: "__audit", data: { collection: collection.slug, documentId: id, operation: "workflow.transition", user: user?.sub ?? null, timestamp: now, changes: JSON.stringify({ transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision }) } });
     }
     return next;
   });
@@ -788,7 +816,7 @@ var CollectionController = class {
     if (beforeReadResult !== void 0) {
       where = beforeReadResult;
     }
-    if (this.collection.workflow && !user) {
+    if (this.collection.workflow && !canViewWorkflowDraft(this.collection.workflow, user)) {
       where = where ? { AND: [where, { __published: { exists: true } }] } : { __published: { exists: true } };
     }
     let result = await db.find({
@@ -1081,9 +1109,28 @@ var CollectionController = class {
     const config = c.get("config");
     if (!config.db) return c.json({ message: "Database not configured" }, 500);
     if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    const documentId = c.req.param("id");
+    if (!documentId) return c.json({ message: "Missing ID" }, 400);
+    const document = await config.db.findOne({ collection: this.collection.slug, id: documentId });
+    if (!document) return c.json({ message: "Not Found" }, 404);
+    const readAccess = this.collection.access?.read;
+    if (readAccess !== void 0 && readAccess !== null) {
+      const args = { user: c.get("user"), req: c.req, doc: document };
+      const result2 = typeof readAccess === "function" ? await readAccess(args) : await evaluateAccess(readAccess, args);
+      let allowed = result2 === true;
+      if (result2 && typeof result2 === "object") {
+        const match = await config.db.find({
+          collection: this.collection.slug,
+          where: { AND: [{ id: { equals: documentId } }, result2] },
+          limit: 1
+        });
+        allowed = match.total > 0;
+      }
+      if (!allowed) return c.json({ error: true, message: `Access denied: read on ${this.collection.slug}` }, 403);
+    }
     const result = await config.db.find({
       collection: WORKFLOW_HISTORY_COLLECTION,
-      where: { collection: { equals: this.collection.slug }, documentId: { equals: c.req.param("id") } },
+      where: { collection: { equals: this.collection.slug }, documentId: { equals: documentId } },
       sort: "-createdAt",
       limit: Math.min(Number(c.req.query("limit")) || 50, 100)
     });
@@ -2115,7 +2162,76 @@ function generateOpenApi(config) {
       description: "Automatically generated OpenAPI specification for the Dyrected project."
     },
     components: {
-      schemas: {},
+      schemas: {
+        WorkflowMetadata: {
+          type: "object",
+          required: ["state", "revision"],
+          properties: {
+            state: { type: "string" },
+            revision: { type: "integer", minimum: 1 },
+            publishedRevision: { type: "integer", minimum: 1 },
+            publishedAt: { type: "string", format: "date-time" },
+            publishedBy: { type: "string" },
+            availableTransitions: { type: "array", items: { type: "string" } }
+          }
+        },
+        WorkflowTransitionRequest: {
+          type: "object",
+          properties: {
+            expectedRevision: { type: "integer", minimum: 1 },
+            comment: { type: "string" }
+          }
+        },
+        WorkflowHistoryEntry: {
+          type: "object",
+          required: [
+            "collection",
+            "documentId",
+            "transition",
+            "from",
+            "to",
+            "revision",
+            "createdAt"
+          ],
+          properties: {
+            id: { type: "string" },
+            collection: { type: "string" },
+            documentId: { type: "string" },
+            transition: { type: "string" },
+            from: { type: "string" },
+            to: { type: "string" },
+            revision: { type: "integer" },
+            comment: { type: "string", nullable: true },
+            actorId: { type: "string", nullable: true },
+            createdAt: { type: "string", format: "date-time" }
+          }
+        },
+        Error: {
+          type: "object",
+          properties: {
+            message: { type: "string" },
+            errors: {
+              type: "array",
+              items: { type: "object", additionalProperties: true }
+            }
+          }
+        },
+        AuthCredentials: {
+          type: "object",
+          required: ["email", "password"],
+          properties: {
+            email: { type: "string", format: "email" },
+            password: { type: "string" }
+          }
+        },
+        TokenResponse: {
+          type: "object",
+          properties: {
+            token: { type: "string" },
+            user: { type: "object", additionalProperties: true }
+          }
+        }
+      },
       securitySchemes: {
         ApiKeyAuth: {
           type: "apiKey",
@@ -2127,6 +2243,98 @@ function generateOpenApi(config) {
     paths: {},
     security: [{ ApiKeyAuth: [] }]
   };
+  spec.paths["/api/schemas"] = {
+    get: {
+      tags: ["System"],
+      summary: "Get the serialized Dyrected schema",
+      security: [],
+      responses: {
+        200: { description: "Collection and global schema definitions" }
+      }
+    }
+  };
+  spec.paths["/api/openapi.json"] = {
+    get: {
+      tags: ["System"],
+      summary: "Get the OpenAPI specification",
+      security: [],
+      responses: { 200: { description: "OpenAPI 3.0 document" } }
+    }
+  };
+  spec.paths["/api/docs"] = {
+    get: {
+      tags: ["System"],
+      summary: "Open interactive API documentation",
+      security: [],
+      responses: { 200: { description: "Swagger UI HTML" } }
+    }
+  };
+  spec.paths["/api/dyrected/options/{collection}/{field}"] = {
+    get: {
+      tags: ["System"],
+      summary: "Resolve dynamic field options",
+      parameters: [
+        {
+          name: "collection",
+          in: "path",
+          required: true,
+          schema: { type: "string" }
+        },
+        {
+          name: "field",
+          in: "path",
+          required: true,
+          schema: { type: "string" }
+        }
+      ],
+      responses: { 200: { description: "Resolved option items" } }
+    }
+  };
+  spec.paths["/api/preferences/{key}"] = {
+    get: {
+      tags: ["Preferences"],
+      summary: "Get an authenticated user preference",
+      parameters: [
+        { name: "key", in: "path", required: true, schema: { type: "string" } }
+      ],
+      responses: { 200: { description: "Preference value" } }
+    },
+    put: {
+      tags: ["Preferences"],
+      summary: "Set an authenticated user preference",
+      parameters: [
+        { name: "key", in: "path", required: true, schema: { type: "string" } }
+      ],
+      requestBody: {
+        required: true,
+        content: { "application/json": { schema: { type: "object" } } }
+      },
+      responses: { 200: { description: "Updated preference" } }
+    }
+  };
+  spec.paths["/api/preview-token"] = {
+    post: {
+      tags: ["Preview"],
+      summary: "Create a preview token",
+      responses: { 200: { description: "Short-lived preview token" } }
+    }
+  };
+  spec.paths["/api/preview-data"] = {
+    get: {
+      tags: ["Preview"],
+      summary: "Resolve preview data from a token",
+      security: [],
+      parameters: [
+        {
+          name: "token",
+          in: "query",
+          required: true,
+          schema: { type: "string" }
+        }
+      ],
+      responses: { 200: { description: "Preview document data" } }
+    }
+  };
   for (const collection of config.collections) {
     spec.components.schemas[collection.slug] = collectionToSchema(collection);
   }
@@ -2142,10 +2350,28 @@ function generateOpenApi(config) {
         tags: ["Collections"],
         summary: `Find ${labels.plural}`,
         parameters: [
-          { name: "limit", in: "query", schema: { type: "integer", default: 10 } },
-          { name: "page", in: "query", schema: { type: "integer", default: 1 } },
-          { name: "where", in: "query", schema: { type: "string" }, description: "JSON filter" },
-          { name: "sort", in: "query", schema: { type: "string" }, description: "Sort field (e.g. -createdAt)" }
+          {
+            name: "limit",
+            in: "query",
+            schema: { type: "integer", default: 10 }
+          },
+          {
+            name: "page",
+            in: "query",
+            schema: { type: "integer", default: 1 }
+          },
+          {
+            name: "where",
+            in: "query",
+            schema: { type: "string" },
+            description: "JSON filter"
+          },
+          {
+            name: "sort",
+            in: "query",
+            schema: { type: "string" },
+            description: "Sort field (e.g. -createdAt)"
+          }
         ],
         responses: {
           200: {
@@ -2155,7 +2381,10 @@ function generateOpenApi(config) {
                 schema: {
                   type: "object",
                   properties: {
-                    docs: { type: "array", items: { $ref: `#/components/schemas/${slug}` } },
+                    docs: {
+                      type: "array",
+                      items: { $ref: `#/components/schemas/${slug}` }
+                    },
                     total: { type: "integer" },
                     limit: { type: "integer" },
                     page: { type: "integer" }
@@ -2193,7 +2422,14 @@ function generateOpenApi(config) {
       get: {
         tags: ["Collections"],
         summary: `Get a single ${labels.singular}`,
-        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+        parameters: [
+          {
+            name: "id",
+            in: "path",
+            required: true,
+            schema: { type: "string" }
+          }
+        ],
         responses: {
           200: {
             description: "Success",
@@ -2208,7 +2444,14 @@ function generateOpenApi(config) {
       patch: {
         tags: ["Collections"],
         summary: `Update ${labels.singular}`,
-        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+        parameters: [
+          {
+            name: "id",
+            in: "path",
+            required: true,
+            schema: { type: "string" }
+          }
+        ],
         requestBody: {
           required: true,
           content: {
@@ -2231,12 +2474,288 @@ function generateOpenApi(config) {
       delete: {
         tags: ["Collections"],
         summary: `Delete ${labels.singular}`,
-        parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+        parameters: [
+          {
+            name: "id",
+            in: "path",
+            required: true,
+            schema: { type: "string" }
+          }
+        ],
         responses: {
           204: { description: "Deleted" }
         }
       }
     };
+    spec.paths[`${path}/delete-many`] = {
+      delete: {
+        tags: ["Collections"],
+        summary: `Delete multiple ${labels.plural}`,
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                required: ["ids"],
+                properties: {
+                  ids: { type: "array", items: { type: "string" } }
+                }
+              }
+            }
+          }
+        },
+        responses: { 200: { description: "Deleted and failed document IDs" } }
+      }
+    };
+    spec.paths[`${path}/seed`] = {
+      post: {
+        tags: ["Collections"],
+        summary: `Seed initial ${labels.plural}`,
+        responses: { 200: { description: "Seeded documents" } }
+      }
+    };
+    if (collection.upload) {
+      spec.paths[`${path}/media`] = {
+        get: {
+          tags: ["Media"],
+          summary: `List ${labels.plural}`,
+          responses: { 200: { description: "Paginated media documents" } }
+        },
+        post: {
+          tags: ["Media"],
+          summary: `Upload ${labels.singular}`,
+          requestBody: {
+            required: true,
+            content: {
+              "multipart/form-data": {
+                schema: {
+                  type: "object",
+                  required: ["file"],
+                  properties: { file: { type: "string", format: "binary" } }
+                }
+              }
+            }
+          },
+          responses: { 201: { description: "Uploaded media document" } }
+        }
+      };
+      spec.paths[`${path}/media/{filename}`] = {
+        get: {
+          tags: ["Media"],
+          summary: `Serve ${labels.singular} bytes`,
+          parameters: [
+            {
+              name: "filename",
+              in: "path",
+              required: true,
+              schema: { type: "string" }
+            }
+          ],
+          security: [],
+          responses: {
+            200: { description: "Stored file" },
+            404: { description: "File not found" }
+          }
+        }
+      };
+    }
+    if (collection.auth) {
+      const publicAuthPost = (summary) => ({
+        tags: ["Authentication"],
+        summary,
+        security: [],
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: { type: "object", additionalProperties: true }
+            }
+          }
+        },
+        responses: {
+          200: { description: "Success" },
+          400: { description: "Invalid request" }
+        }
+      });
+      spec.paths[`${path}/login`] = {
+        post: {
+          ...publicAuthPost(`Log in to ${labels.plural}`),
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/AuthCredentials" }
+              }
+            }
+          },
+          responses: {
+            200: {
+              description: "Authenticated",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/TokenResponse" }
+                }
+              }
+            },
+            401: { description: "Invalid credentials" }
+          }
+        }
+      };
+      spec.paths[`${path}/logout`] = {
+        post: {
+          tags: ["Authentication"],
+          summary: `Log out of ${labels.plural}`,
+          responses: { 200: { description: "Logged out" } }
+        }
+      };
+      spec.paths[`${path}/init`] = {
+        get: {
+          tags: ["Authentication"],
+          summary: `Get ${labels.plural} initialization state`,
+          security: [],
+          responses: { 200: { description: "Initialization state" } }
+        }
+      };
+      spec.paths[`${path}/first-user`] = {
+        post: publicAuthPost(`Register the first ${labels.singular}`)
+      };
+      spec.paths[`${path}/me`] = {
+        get: {
+          tags: ["Authentication"],
+          summary: `Get the current ${labels.singular}`,
+          responses: { 200: { description: "Authenticated user" } }
+        }
+      };
+      spec.paths[`${path}/refresh-token`] = {
+        post: {
+          tags: ["Authentication"],
+          summary: "Refresh an authentication token",
+          responses: { 200: { description: "Refreshed token" } }
+        }
+      };
+      spec.paths[`${path}/forgot-password`] = {
+        post: publicAuthPost("Request a password reset")
+      };
+      spec.paths[`${path}/reset-password`] = {
+        post: publicAuthPost("Reset a password")
+      };
+      spec.paths[`${path}/invite`] = {
+        post: {
+          tags: ["Authentication"],
+          summary: `Invite a ${labels.singular}`,
+          responses: { 200: { description: "Invitation sent" } }
+        }
+      };
+      spec.paths[`${path}/accept-invite`] = {
+        post: publicAuthPost("Accept an invitation")
+      };
+      spec.paths[`${path}/{id}/change-password`] = {
+        post: {
+          tags: ["Authentication"],
+          summary: `Change a ${labels.singular} password`,
+          parameters: [
+            {
+              name: "id",
+              in: "path",
+              required: true,
+              schema: { type: "string" }
+            }
+          ],
+          responses: { 200: { description: "Password changed" } }
+        }
+      };
+    }
+    if (collection.workflow) {
+      spec.paths[`${path}/{id}/transitions/{transition}`] = {
+        post: {
+          tags: ["Workflows"],
+          summary: `Transition ${labels.singular} workflow`,
+          parameters: [
+            {
+              name: "id",
+              in: "path",
+              required: true,
+              schema: { type: "string" }
+            },
+            {
+              name: "transition",
+              in: "path",
+              required: true,
+              schema: {
+                type: "string",
+                enum: collection.workflow.transitions.map((item) => item.name)
+              }
+            }
+          ],
+          requestBody: {
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/WorkflowTransitionRequest"
+                }
+              }
+            }
+          },
+          responses: {
+            200: {
+              description: "Transition applied",
+              content: {
+                "application/json": {
+                  schema: { $ref: `#/components/schemas/${slug}` }
+                }
+              }
+            },
+            400: { description: "Required transition input is missing" },
+            403: { description: "Transition capability denied" },
+            409: { description: "Invalid state or stale revision" }
+          }
+        }
+      };
+      spec.paths[`${path}/{id}/workflow-history`] = {
+        get: {
+          tags: ["Workflows"],
+          summary: `Get ${labels.singular} workflow history`,
+          parameters: [
+            {
+              name: "id",
+              in: "path",
+              required: true,
+              schema: { type: "string" }
+            },
+            {
+              name: "limit",
+              in: "query",
+              schema: { type: "integer", default: 50, maximum: 100 }
+            }
+          ],
+          responses: {
+            200: {
+              description: "Workflow transition history",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    properties: {
+                      docs: {
+                        type: "array",
+                        items: {
+                          $ref: "#/components/schemas/WorkflowHistoryEntry"
+                        }
+                      },
+                      total: { type: "integer" },
+                      limit: { type: "integer" },
+                      page: { type: "integer" }
+                    }
+                  }
+                }
+              }
+            },
+            403: { description: "Collection read access denied" }
+          }
+        }
+      };
+    }
   }
   for (const global of config.globals) {
     const slug = global.slug;
@@ -2279,45 +2798,31 @@ function generateOpenApi(config) {
         }
       }
     };
+    spec.paths[`${path}/seed`] = {
+      post: {
+        tags: ["Globals"],
+        summary: `Seed ${global.label || slug}`,
+        responses: { 200: { description: "Seeded global" } }
+      }
+    };
   }
   if (config.storage) {
-    spec.paths["/api/media"] = {
+    spec.paths["/api/media/{filename}"] = {
       get: {
         tags: ["Media"],
-        summary: "List Media",
-        responses: {
-          200: {
-            description: "Success",
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  properties: {
-                    docs: { type: "array", items: { type: "object", additionalProperties: true } }
-                  }
-                }
-              }
-            }
-          }
-        }
-      },
-      post: {
-        tags: ["Media"],
-        summary: "Upload Media",
-        requestBody: {
-          content: {
-            "multipart/form-data": {
-              schema: {
-                type: "object",
-                properties: {
-                  file: { type: "string", format: "binary" }
-                }
-              }
-            }
+        summary: "Serve a stored file",
+        security: [],
+        parameters: [
+          {
+            name: "filename",
+            in: "path",
+            required: true,
+            schema: { type: "string" }
           }
-        },
+        ],
         responses: {
-          201: { description: "Uploaded" }
+          200: { description: "Stored file bytes" },
+          404: { description: "File not found" }
         }
       }
     };
@@ -2332,6 +2837,7 @@ function collectionToSchema(collection) {
       id: { type: "string" },
       createdAt: { type: "string", format: "date-time" },
       updatedAt: { type: "string", format: "date-time" },
+      ...collection.workflow ? { _workflow: { $ref: "#/components/schemas/WorkflowMetadata" } } : {},
       ...properties
     },
     required: ["id", ...required]
@@ -2349,7 +2855,13 @@ function fieldsToProperties(fields) {
   const props = {};
   const required = [];
   for (const field of fields) {
-    if (!field.name || field.type === "join" || field.type === "row") continue;
+    if (field.type === "row") {
+      const nested = fieldsToProperties(field.fields || []);
+      Object.assign(props, nested.properties);
+      required.push(...nested.required);
+      continue;
+    }
+    if (!field.name) continue;
     props[field.name] = fieldToSchema(field);
     if (field.required) {
       required.push(field.name);
@@ -2363,7 +2875,17 @@ function fieldToSchema(field) {
     case "text":
     case "textarea":
     case "email":
+      schema = { type: "string" };
+      break;
     case "url":
+      schema = {
+        oneOf: [
+          { type: "string" },
+          { type: "object", additionalProperties: true }
+        ]
+      };
+      break;
+    case "icon":
       schema = { type: "string" };
       break;
     case "number":
@@ -2373,20 +2895,45 @@ function fieldToSchema(field) {
       schema = { type: "boolean" };
       break;
     case "date":
+      schema = { type: "string", format: "date" };
+      break;
+    case "datetime":
       schema = { type: "string", format: "date-time" };
       break;
+    case "time":
+      schema = { type: "string", format: "time" };
+      break;
     case "select":
     case "radio":
-      schema = { type: "string", enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0 };
+      schema = {
+        type: "string",
+        enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0
+      };
       break;
     case "multiSelect":
       schema = {
         type: "array",
-        items: { type: "string", enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0 }
+        items: {
+          type: "string",
+          enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0
+        }
       };
       break;
     case "relationship":
-      schema = { type: "string", description: `ID of a ${field.relationTo} record` };
+    case "image": {
+      const valueSchema = {
+        type: "string",
+        description: `ID of a ${field.relationTo} record`
+      };
+      schema = field.hasMany ? { type: "array", items: valueSchema } : valueSchema;
+      break;
+    }
+    case "join":
+      schema = {
+        type: "array",
+        readOnly: true,
+        items: { type: "object", additionalProperties: true }
+      };
       break;
     case "object": {
       const { properties, required } = fieldsToProperties(field.fields || []);
@@ -2395,7 +2942,10 @@ function fieldToSchema(field) {
     }
     case "array": {
       const { properties, required } = fieldsToProperties(field.fields || []);
-      schema = { type: "array", items: { type: "object", properties, required } };
+      schema = {
+        type: "array",
+        items: { type: "object", properties, required }
+      };
       break;
     }
     case "json":
@@ -2476,20 +3026,6 @@ function getSwaggerHtml(specUrl = "/api/openapi.json") {
   `;
 }
 
-// src/auth/jexl.ts
-var import_jexl = __toESM(require("jexl"), 1);
-async function evaluateAccess(expression, context) {
-  if (expression === void 0 || expression === null) return false;
-  if (typeof expression === "boolean") return expression;
-  try {
-    const result = await import_jexl.default.eval(expression, context);
-    return !!result;
-  } catch (err) {
-    console.error("[dyrected/core] Jexl evaluation failed:", err);
-    return false;
-  }
-}
-
 // src/router.ts
 function accessGate(target, action) {
   return async (c, next) => {