@dyrected/core 2.5.42 → 2.5.44

package/dist/server.cjs

@@ -30,7 +30,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// src/utils/where-sanitizer.ts
+// src/utils/where-sanitizer.js
 var where_sanitizer_exports = {};
 __export(where_sanitizer_exports, {
   sanitizeWhereClause: () => sanitizeWhereClause
@@ -67,9 +67,12 @@ function sanitizeWhereClause(where, fields) {
         continue;
       }
       const fieldDef = fieldMap.get(key);
-      if (!fieldDef) continue;
-      if (fieldDef.admin?.filterable === false) continue;
-      if (NEVER_FILTERABLE_TYPES.includes(fieldDef.type)) continue;
+      if (!fieldDef)
+        continue;
+      if (fieldDef.admin?.filterable === false)
+        continue;
+      if (NEVER_FILTERABLE_TYPES.includes(fieldDef.type))
+        continue;
       result[key] = value;
     }
     return result;
@@ -78,7 +81,7 @@ function sanitizeWhereClause(where, fields) {
 }
 var NEVER_FILTERABLE_TYPES;
 var init_where_sanitizer = __esm({
-  "src/utils/where-sanitizer.ts"() {
+  "src/utils/where-sanitizer.js"() {
     "use strict";
     NEVER_FILTERABLE_TYPES = [
       "password",
@@ -105,12 +108,12 @@ __export(server_exports, {
 });
 module.exports = __toCommonJS(server_exports);
 
-// src/app.ts
+// src/app.js
 var import_hono = require("hono");
 var import_cors = require("hono/cors");
 var import_request_id = require("hono/request-id");
 
-// src/services/defaults.service.ts
+// src/services/defaults.service.js
 var DefaultsService = class {
   /**
    * Recursively apply default values to a data object based on field definitions.
@@ -118,12 +121,14 @@ var DefaultsService = class {
   static apply(fields, data = {}) {
     const result = { ...data || {} };
     fields.forEach((field) => {
-      if (field.type === "join") return;
+      if (field.type === "join")
+        return;
       if (field.type === "row" && field.fields) {
         Object.assign(result, this.apply(field.fields, data));
         return;
       }
-      if (!field.name) return;
+      if (!field.name)
+        return;
       let value = result[field.name];
       if ((value === void 0 || value === null) && field.renameTo) {
         const legacyValue = result[field.renameTo];
@@ -136,9 +141,12 @@ var DefaultsService = class {
         if (field.defaultValue !== void 0) {
           result[field.name] = field.defaultValue;
         } else {
-          if (field.type === "boolean") result[field.name] = false;
-          else if (field.type === "array") result[field.name] = [];
-          else if (field.type === "multiSelect") result[field.name] = [];
+          if (field.type === "boolean")
+            result[field.name] = false;
+          else if (field.type === "array")
+            result[field.name] = [];
+          else if (field.type === "multiSelect")
+            result[field.name] = [];
           else if (field.type === "object") {
             result[field.name] = this.apply(field.fields || [], {});
           }
@@ -153,7 +161,7 @@ var DefaultsService = class {
   }
 };
 
-// src/services/population.service.ts
+// src/services/population.service.js
 var PopulationService = class {
   db;
   collections;
@@ -206,29 +214,31 @@ var PopulationService = class {
         Object.assign(populatedDoc, rowPopulated);
         continue;
       }
-      if (!field.name) continue;
+      if (!field.name)
+        continue;
       const value = populatedDoc[field.name];
       if (field.type === "relationship" && field.relationTo && value) {
         const relatedCollection = this.collections.find((c) => c.slug === field.relationTo);
-        if (!relatedCollection) continue;
+        if (!relatedCollection)
+          continue;
         if (Array.isArray(value)) {
-          populatedDoc[field.name] = await Promise.all(
-            value.map(async (id) => {
-              if (!id) return id;
-              let doc = id;
-              if (typeof id === "string") {
-                doc = await this.db.findOne({ collection: field.relationTo, id });
-              }
-              if (!doc || typeof doc !== "object") return id;
-              const docWithDefaults = DefaultsService.apply(relatedCollection.fields, doc);
-              return this.populate({
-                data: docWithDefaults,
-                fields: relatedCollection.fields,
-                currentDepth: currentDepth + 1,
-                maxDepth
-              });
-            })
-          );
+          populatedDoc[field.name] = await Promise.all(value.map(async (id) => {
+            if (!id)
+              return id;
+            let doc = id;
+            if (typeof id === "string") {
+              doc = await this.db.findOne({ collection: field.relationTo, id });
+            }
+            if (!doc || typeof doc !== "object")
+              return id;
+            const docWithDefaults = DefaultsService.apply(relatedCollection.fields, doc);
+            return this.populate({
+              data: docWithDefaults,
+              fields: relatedCollection.fields,
+              currentDepth: currentDepth + 1,
+              maxDepth
+            });
+          }));
         } else if (value) {
           let doc = value;
           if (typeof value === "string") {
@@ -277,18 +287,17 @@ var PopulationService = class {
         });
       }
       if (field.type === "blocks" && field.blocks && Array.isArray(value)) {
-        populatedDoc[field.name] = await Promise.all(
-          value.map(async (blockData) => {
-            const blockConfig = field.blocks.find((b) => b.slug === blockData.blockType);
-            if (!blockConfig) return blockData;
-            return this.populate({
-              data: blockData,
-              fields: blockConfig.fields,
-              currentDepth,
-              maxDepth
-            });
-          })
-        );
+        populatedDoc[field.name] = await Promise.all(value.map(async (blockData) => {
+          const blockConfig = field.blocks.find((b) => b.slug === blockData.blockType);
+          if (!blockConfig)
+            return blockData;
+          return this.populate({
+            data: blockData,
+            fields: blockConfig.fields,
+            currentDepth,
+            maxDepth
+          });
+        }));
       }
     }
     return populatedDoc;
@@ -297,7 +306,8 @@ var PopulationService = class {
    * Helper to populate a PaginatedResult
    */
   async populateResult(result, fields, maxDepth) {
-    if (maxDepth <= 0) return result;
+    if (maxDepth <= 0)
+      return result;
     const populatedDocs = await this.populate({
       data: result.docs,
       fields,
@@ -311,7 +321,7 @@ var PopulationService = class {
   }
 };
 
-// src/services/audit.service.ts
+// src/services/audit.service.js
 var AuditService = class {
   /**
    * Writes a single entry to the __audit collection.
@@ -339,7 +349,7 @@ var AuditService = class {
   }
 };
 
-// src/auth/password.ts
+// src/auth/password.js
 var import_node_util = require("util");
 var import_node_crypto = require("crypto");
 var scryptAsync = (0, import_node_util.promisify)(import_node_crypto.scrypt);
@@ -352,14 +362,16 @@ async function hashPassword(plain) {
 }
 async function verifyPassword(plain, stored) {
   const [salt, storedHash] = stored.split(":");
-  if (!salt || !storedHash) return false;
+  if (!salt || !storedHash)
+    return false;
   const derivedKey = await scryptAsync(plain, salt, KEY_LEN);
   const storedBuffer = Buffer.from(storedHash, "hex");
-  if (derivedKey.length !== storedBuffer.length) return false;
+  if (derivedKey.length !== storedBuffer.length)
+    return false;
   return (0, import_node_crypto.timingSafeEqual)(derivedKey, storedBuffer);
 }
 
-// src/utils/hooks.ts
+// src/utils/hooks.js
 async function runCollectionHooks(hooks, args, options = {}) {
   if (!hooks || hooks.length === 0) {
     return args.data ?? args.doc ?? void 0;
@@ -386,10 +398,12 @@ async function runCollectionHooks(hooks, args, options = {}) {
   return currentPayload;
 }
 async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
-  if (!data || typeof data !== "object") return data;
+  if (!data || typeof data !== "object")
+    return data;
   const result = { ...data };
   for (const field of fields) {
-    if (!field.name) continue;
+    if (!field.name)
+      continue;
     const value = result[field.name];
     const origValue = originalDoc?.[field.name];
     let updatedValue = value;
@@ -409,21 +423,13 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
     }
     if (updatedValue !== void 0 && updatedValue !== null) {
       if (field.type === "object" && field.fields) {
-        result[field.name] = await executeFieldBeforeChange(
-          field.fields,
-          updatedValue,
-          origValue,
-          user,
-          db
-        );
+        result[field.name] = await executeFieldBeforeChange(field.fields, updatedValue, origValue, user, db);
       } else if (field.type === "array" && field.fields && Array.isArray(updatedValue)) {
         const arrayResult = [];
         for (let i = 0; i < updatedValue.length; i++) {
           const item = updatedValue[i];
           const origItem = Array.isArray(origValue) ? origValue[i] : null;
-          arrayResult.push(
-            await executeFieldBeforeChange(field.fields, item, origItem, user, db)
-          );
+          arrayResult.push(await executeFieldBeforeChange(field.fields, item, origItem, user, db));
         }
         result[field.name] = arrayResult;
       } else if (field.type === "blocks" && field.blocks && Array.isArray(updatedValue)) {
@@ -431,19 +437,9 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
         for (let i = 0; i < updatedValue.length; i++) {
           const blockData = updatedValue[i];
           const origBlock = Array.isArray(origValue) ? origValue[i] : null;
-          const blockConfig = field.blocks.find(
-            (b) => b.slug === blockData.blockType
-          );
+          const blockConfig = field.blocks.find((b) => b.slug === blockData.blockType);
           if (blockConfig) {
-            blocksResult.push(
-              await executeFieldBeforeChange(
-                blockConfig.fields,
-                blockData,
-                origBlock,
-                user,
-                db
-              )
-            );
+            blocksResult.push(await executeFieldBeforeChange(blockConfig.fields, blockData, origBlock, user, db));
           } else {
             blocksResult.push(blockData);
           }
@@ -455,10 +451,12 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
   return result;
 }
 async function executeFieldAfterRead(fields, doc, user, db) {
-  if (!doc || typeof doc !== "object") return doc;
+  if (!doc || typeof doc !== "object")
+    return doc;
   const result = { ...doc };
   for (const field of fields) {
-    if (!field.name) continue;
+    if (!field.name)
+      continue;
     const value = result[field.name];
     let updatedValue = value;
     if (field.hooks?.afterRead) {
@@ -476,41 +474,20 @@ async function executeFieldAfterRead(fields, doc, user, db) {
     }
     if (updatedValue !== void 0 && updatedValue !== null) {
       if (field.type === "object" && field.fields) {
-        result[field.name] = await executeFieldAfterRead(
-          field.fields,
-          updatedValue,
-          user,
-          db
-        );
+        result[field.name] = await executeFieldAfterRead(field.fields, updatedValue, user, db);
       } else if (field.type === "array" && field.fields && Array.isArray(updatedValue)) {
         const arrayResult = [];
         for (const item of updatedValue) {
-          arrayResult.push(
-            await executeFieldAfterRead(
-              field.fields,
-              item,
-              user,
-              db
-            )
-          );
+          arrayResult.push(await executeFieldAfterRead(field.fields, item, user, db));
         }
         result[field.name] = arrayResult;
       } else if (field.type === "blocks" && field.blocks && Array.isArray(updatedValue)) {
         const blocksResult = [];
         for (const blockData of updatedValue) {
           const typedBlock = blockData;
-          const blockConfig = field.blocks.find(
-            (b) => b.slug === typedBlock.blockType
-          );
+          const blockConfig = field.blocks.find((b) => b.slug === typedBlock.blockType);
           if (blockConfig) {
-            blocksResult.push(
-              await executeFieldAfterRead(
-                blockConfig.fields,
-                typedBlock,
-                user,
-                db
-              )
-            );
+            blocksResult.push(await executeFieldAfterRead(blockConfig.fields, typedBlock, user, db));
           } else {
             blocksResult.push(blockData);
           }
@@ -522,16 +499,14 @@ async function executeFieldAfterRead(fields, doc, user, db) {
   return result;
 }
 
-// src/utils/readonly-db.ts
+// src/utils/readonly-db.js
 var WRITE_METHODS = ["create", "update", "delete", "updateGlobal", "execute"];
 function createReadonlyDb(db) {
   return new Proxy(db, {
     get(target, prop) {
       if (WRITE_METHODS.includes(prop)) {
         return () => {
-          throw new Error(
-            `[dyrected] Write operation "${String(prop)}" is not allowed in this hook phase. Use afterChange/afterDelete hooks for write operations.`
-          );
+          throw new Error(`[dyrected] Write operation "${String(prop)}" is not allowed in this hook phase. Use afterChange/afterDelete hooks for write operations.`);
         };
       }
       return Reflect.get(target, prop);
@@ -539,11 +514,13 @@ function createReadonlyDb(db) {
   });
 }
 
-// src/auth/jexl.ts
+// src/auth/jexl.js
 var import_jexl = __toESM(require("jexl"), 1);
 async function evaluateAccess(expression, context) {
-  if (expression === void 0 || expression === null) return false;
-  if (typeof expression === "boolean") return expression;
+  if (expression === void 0 || expression === null)
+    return false;
+  if (typeof expression === "boolean")
+    return expression;
   try {
     const result = await import_jexl.default.eval(expression, context);
     return !!result;
@@ -553,7 +530,7 @@ async function evaluateAccess(expression, context) {
   }
 }
 
-// src/workflows.ts
+// src/workflows.js
 var WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
 var LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
 function publicMetadata(meta) {
@@ -564,17 +541,18 @@ function workflowCapabilities(workflow, user) {
   const capabilities = new Set(Array.isArray(user?.capabilities) ? user.capabilities : []);
   const roles = Array.isArray(user?.roles) ? user.roles : [];
   for (const mapping of workflow.roles ?? []) {
-    if (roles.includes(mapping.role)) mapping.capabilities.forEach((capability) => capabilities.add(capability));
+    if (roles.includes(mapping.role))
+      mapping.capabilities.forEach((capability) => capabilities.add(capability));
   }
   return capabilities;
 }
 function canViewWorkflowDraft(workflow, user) {
-  if (!user) return false;
+  if (!user)
+    return false;
   const capabilities = workflowCapabilities(workflow, user);
-  if (capabilities.has("entry.edit")) return true;
-  return workflow.transitions.some(
-    (transition) => (transition.requiredCapabilities ?? []).some((capability) => capabilities.has(capability))
-  );
+  if (capabilities.has("entry.edit"))
+    return true;
+  return workflow.transitions.some((transition) => (transition.requiredCapabilities ?? []).some((capability) => capabilities.has(capability)));
 }
 function availableWorkflowTransitions(workflow, state, user) {
   const capabilities = workflowCapabilities(workflow, user);
@@ -591,10 +569,12 @@ function initializeWorkflowDocument(data, workflow) {
 }
 function materializeWorkflowDocument(doc, workflow, user) {
   const meta = doc.__workflow;
-  if (!meta) return doc;
+  if (!meta)
+    return doc;
   const { __published, __workflow, ...working } = doc;
   if (!canViewWorkflowDraft(workflow, user)) {
-    if (!__published || typeof __published !== "object") return null;
+    if (!__published || typeof __published !== "object")
+      return null;
     return { id: doc.id, ...__published, _workflow: publicMetadata(meta) };
   }
   return {
@@ -626,13 +606,15 @@ async function persistEvent(db, event) {
 }
 async function dispatchLifecycleEvent(config, event) {
   const db = config.db;
-  if (!db || !config.events?.handlers.length) return;
+  if (!db || !config.events?.handlers.length)
+    return;
   const maxAttempts = config.events.maxAttempts ?? 8;
   const retryDelayMs = config.events.retryDelayMs ?? 1e3;
   const attempts = event.attempts + 1;
   try {
     await db.update({ collection: LIFECYCLE_EVENTS_COLLECTION, id: event.id, data: { status: "processing", attempts } });
-    for (const handler of config.events.handlers) await handler({ ...event, status: "processing", attempts });
+    for (const handler of config.events.handlers)
+      await handler({ ...event, status: "processing", attempts });
     await db.update({
       collection: LIFECYCLE_EVENTS_COLLECTION,
       id: event.id,
@@ -656,7 +638,8 @@ async function saveWorkflowDraft(args) {
   const { config, collection, id, originalDoc, data, user } = args;
   const db = config.db;
   const workflow = collection.workflow;
-  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  if (!db.transaction)
+    throw new Error(`The configured database adapter does not support workflow transactions.`);
   const previous = originalDoc.__workflow;
   const event = createLifecycleEvent({
     name: "revision.created",
@@ -681,7 +664,8 @@ async function saveWorkflowDraft(args) {
 async function createWorkflowDocument(args) {
   const { config, collection, data, user } = args;
   const db = config.db;
-  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  if (!db.transaction)
+    throw new Error(`The configured database adapter does not support workflow transactions.`);
   let event;
   const doc = await db.transaction(async (tx) => {
     const created = await tx.create({ collection: collection.slug, data });
@@ -702,11 +686,14 @@ async function transitionWorkflow(args) {
   const { config, collection, id, transitionName, expectedRevision, comment, user, req } = args;
   const db = config.db;
   const workflow = collection.workflow;
-  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  if (!db.transaction)
+    throw new Error(`The configured database adapter does not support workflow transactions.`);
   const original = await db.findOne({ collection: collection.slug, id });
-  if (!original) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
+  if (!original)
+    throw Object.assign(new Error("Not Found"), { statusCode: 404 });
   const meta = original.__workflow;
-  if (!meta) throw Object.assign(new Error("Entry has no workflow metadata"), { statusCode: 409 });
+  if (!meta)
+    throw Object.assign(new Error("Entry has no workflow metadata"), { statusCode: 409 });
   if (expectedRevision !== void 0 && expectedRevision !== meta.revision) {
     throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
   }
@@ -722,7 +709,8 @@ async function transitionWorkflow(args) {
     throw Object.assign(new Error(`A comment is required for "${transition.label}".`), { statusCode: 400 });
   }
   const hookContext = { transition, from: meta.state, to: transition.to, doc: original, user, comment, req, db };
-  for (const hook of workflow.hooks?.beforeTransition ?? []) await hook(hookContext);
+  for (const hook of workflow.hooks?.beforeTransition ?? [])
+    await hook(hookContext);
   const events = [createLifecycleEvent({
     name: "workflow.transitioned",
     collection: collection.slug,
@@ -738,7 +726,8 @@ async function transitionWorkflow(args) {
   }
   const updated = await db.transaction(async (tx) => {
     const locked = await tx.findOne({ collection: collection.slug, id });
-    if (!locked) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
+    if (!locked)
+      throw Object.assign(new Error("Not Found"), { statusCode: 404 });
     const lockedMeta = locked.__workflow;
     if (lockedMeta.revision !== meta.revision || lockedMeta.state !== meta.state || expectedRevision !== void 0 && lockedMeta.revision !== expectedRevision) {
       throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
@@ -752,20 +741,24 @@ async function transitionWorkflow(args) {
       ...transition.unpublish ? { publishedRevision: void 0, publishedAt: void 0, publishedBy: void 0 } : {}
     };
     const data = { __workflow: nextMeta };
-    if (targetState.published) data.__published = working;
-    if (transition.unpublish) data.__published = null;
+    if (targetState.published)
+      data.__published = working;
+    if (transition.unpublish)
+      data.__published = null;
     const next = await tx.update({ collection: collection.slug, id, data });
     await tx.create({
       collection: WORKFLOW_HISTORY_COLLECTION,
       data: { collection: collection.slug, documentId: id, transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision, comment: comment ?? null, actorId: user?.sub ?? null, createdAt: now }
     });
-    for (const event of events) await persistEvent(tx, event);
+    for (const event of events)
+      await persistEvent(tx, event);
     if (collection.audit) {
       await tx.create({ collection: "__audit", data: { collection: collection.slug, documentId: id, operation: "workflow.transition", user: user?.sub ?? null, timestamp: now, changes: JSON.stringify({ transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision }) } });
     }
     return next;
   });
-  for (const event of events) void dispatchLifecycleEvent(config, event);
+  for (const event of events)
+    void dispatchLifecycleEvent(config, event);
   for (const hook of workflow.hooks?.afterTransition ?? []) {
     try {
       await hook({ ...hookContext, doc: updated, event: events[0] });
@@ -776,16 +769,61 @@ async function transitionWorkflow(args) {
   return updated;
 }
 
-// src/controllers/collection.controller.ts
+// src/controllers/collection.controller.js
 var CollectionController = class {
   collection;
   constructor(collection) {
     this.collection = collection;
   }
+  getDelegatedProvider(c) {
+    const config = c.get("config");
+    const authCollectionSlug = config.adminAuth?.collectionSlug || "__admins";
+    if (this.collection.slug !== authCollectionSlug) {
+      return null;
+    }
+    return config.adminAuth?.providers?.find((p) => p.members) || null;
+  }
   async find(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
+    const provider = this.getDelegatedProvider(c);
+    if (provider && provider.members?.list) {
+      const limit2 = Number(c.req.query("limit")) || 10;
+      const page2 = Number(c.req.query("page")) || 1;
+      const sort2 = c.req.query("sort") || void 0;
+      let where2 = void 0;
+      const whereRaw2 = c.req.query("where");
+      if (whereRaw2) {
+        try {
+          where2 = JSON.parse(decodeURIComponent(whereRaw2));
+        } catch {
+        }
+      }
+      const paginatedResult = await provider.members.list({ limit: limit2, page: page2, sort: sort2, where: where2, req: c.req });
+      const mappedDocs = [];
+      for (const m of paginatedResult.docs) {
+        let localId = m.id;
+        const localDoc = await db.find({
+          collection: this.collection.slug,
+          where: m.id ? { externalSubject: { equals: m.id } } : { email: { equals: m.email } },
+          limit: 1
+        });
+        if (localDoc.docs[0]) {
+          localId = localDoc.docs[0].id;
+        }
+        mappedDocs.push({
+          ...m,
+          id: localId,
+          externalSubject: m.id
+        });
+      }
+      return c.json({
+        ...paginatedResult,
+        docs: mappedDocs
+      });
+    }
     const readonlyDb = createReadonlyDb(db);
     const limit = Number(c.req.query("limit")) || 10;
     const page = Number(c.req.query("page")) || 1;
@@ -843,11 +881,13 @@ var CollectionController = class {
         where
       });
     }
-    result.docs = result.docs.map((doc) => this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc).filter((doc) => doc !== null).map((doc) => DefaultsService.apply(this.collection.fields, doc));
+    result.docs = result.docs.map((doc) => this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc).filter((doc) => doc !== null);
     const processedDocs = [];
+    const readonlyDbForHooks = createReadonlyDb(db);
     for (const doc of result.docs) {
+      const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
       const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
-        doc,
+        doc: docWithDefaults,
         req: c.req,
         user,
         db: readonlyDb
@@ -865,17 +905,43 @@ var CollectionController = class {
   async findOne(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
+    const provider = this.getDelegatedProvider(c);
+    if (provider && (provider.members?.get || provider.members?.list)) {
+      const id2 = c.req.param("id");
+      if (!id2)
+        return c.json({ message: "Missing ID" }, 400);
+      const localDoc = await db.findOne({ collection: this.collection.slug, id: id2 });
+      const externalSubject = localDoc?.externalSubject || id2;
+      let member = null;
+      if (provider.members.get) {
+        member = await provider.members.get({ externalSubject, req: c.req });
+      } else if (provider.members.list) {
+        const listResult = await provider.members.list({ req: c.req });
+        member = listResult.docs.find((m) => m.id === externalSubject) || null;
+      }
+      if (!member)
+        return c.json({ message: "Not Found" }, 404);
+      return c.json({
+        ...member,
+        id: localDoc ? localDoc.id : member.id,
+        externalSubject: member.id
+      });
+    }
     const readonlyDb = createReadonlyDb(db);
     const id = c.req.param("id");
     const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 10;
     const user = c.get("user");
-    if (!id) return c.json({ message: "Missing ID" }, 400);
+    if (!id)
+      return c.json({ message: "Missing ID" }, 400);
     let doc = await db.findOne({ collection: this.collection.slug, id });
-    if (!doc) return c.json({ message: "Not Found" }, 404);
+    if (!doc)
+      return c.json({ message: "Not Found" }, 404);
     if (this.collection.workflow) {
       doc = materializeWorkflowDocument(doc, this.collection.workflow, user);
-      if (!doc) return c.json({ message: "Not Found" }, 404);
+      if (!doc)
+        return c.json({ message: "Not Found" }, 404);
     }
     const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
     const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
@@ -900,7 +966,22 @@ var CollectionController = class {
   async create(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
+    const provider = this.getDelegatedProvider(c);
+    if (provider && provider.members?.create) {
+      const contentType2 = c.req.header("Content-Type") || "";
+      if (contentType2.toLowerCase().includes("multipart/form-data")) {
+        return this.upload(c);
+      }
+      const body2 = await c.req.json();
+      const member = await provider.members.create({ data: body2, req: c.req });
+      return c.json({
+        ...member,
+        id: member.id,
+        externalSubject: member.id
+      }, 201);
+    }
     const readonlyDb = createReadonlyDb(db);
     const contentType = c.req.header("Content-Type") || "";
     if (contentType.toLowerCase().includes("multipart/form-data")) {
@@ -961,13 +1042,16 @@ var CollectionController = class {
   async upload(c) {
     const config = c.get("config");
     const storage = config.storage;
-    if (!storage) return c.json({ message: "Storage not configured" }, 500);
+    if (!storage)
+      return c.json({ message: "Storage not configured" }, 500);
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const readonlyDb = createReadonlyDb(db);
     const formData = await c.req.formData();
     const file = formData.get("file");
-    if (!file) return c.json({ message: "No file uploaded" }, 400);
+    if (!file)
+      return c.json({ message: "No file uploaded" }, 400);
     const buffer = new Uint8Array(await file.arrayBuffer());
     const siteId = c.get("siteId");
     const workspaceId = c.get("workspaceId");
@@ -1026,10 +1110,27 @@ var CollectionController = class {
   async update(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
+    const provider = this.getDelegatedProvider(c);
+    if (provider && provider.members?.update) {
+      const id2 = c.req.param("id");
+      if (!id2)
+        return c.json({ message: "Missing ID" }, 400);
+      const body2 = await c.req.json();
+      const localDoc = await db.findOne({ collection: this.collection.slug, id: id2 });
+      const externalSubject = localDoc?.externalSubject || id2;
+      const member = await provider.members.update({ externalSubject, data: body2, req: c.req });
+      return c.json({
+        ...member,
+        id: localDoc ? localDoc.id : member.id,
+        externalSubject: member.id
+      });
+    }
     const readonlyDb = createReadonlyDb(db);
     const id = c.req.param("id");
-    if (!id) return c.json({ message: "Missing ID" }, 400);
+    if (!id)
+      return c.json({ message: "Missing ID" }, 400);
     const body = await c.req.json();
     const user = c.get("user");
     let data = { ...body };
@@ -1043,7 +1144,8 @@ var CollectionController = class {
       updatedBy: user?.sub ?? null
     });
     const originalDoc = await db.findOne({ collection: this.collection.slug, id });
-    if (!originalDoc) return c.json({ message: "Not Found" }, 404);
+    if (!originalDoc)
+      return c.json({ message: "Not Found" }, 404);
     let before = null;
     if (this.collection.audit) {
       before = originalDoc;
@@ -1087,8 +1189,10 @@ var CollectionController = class {
   }
   async transition(c) {
     const config = c.get("config");
-    if (!config.db) return c.json({ message: "Database not configured" }, 500);
-    if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    if (!config.db)
+      return c.json({ message: "Database not configured" }, 500);
+    if (!this.collection.workflow)
+      return c.json({ message: "Workflows are not enabled for this collection" }, 404);
     const id = c.req.param("id");
     const transitionName = c.req.param("transition");
     const body = await c.req.json().catch(() => ({}));
@@ -1111,12 +1215,16 @@ var CollectionController = class {
   }
   async workflowHistory(c) {
     const config = c.get("config");
-    if (!config.db) return c.json({ message: "Database not configured" }, 500);
-    if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    if (!config.db)
+      return c.json({ message: "Database not configured" }, 500);
+    if (!this.collection.workflow)
+      return c.json({ message: "Workflows are not enabled for this collection" }, 404);
     const documentId = c.req.param("id");
-    if (!documentId) return c.json({ message: "Missing ID" }, 400);
+    if (!documentId)
+      return c.json({ message: "Missing ID" }, 400);
     const document = await config.db.findOne({ collection: this.collection.slug, id: documentId });
-    if (!document) return c.json({ message: "Not Found" }, 404);
+    if (!document)
+      return c.json({ message: "Not Found" }, 404);
     const readAccess = this.collection.access?.read;
     if (readAccess !== void 0 && readAccess !== null) {
       const args = { user: c.get("user"), req: c.req, doc: document };
@@ -1130,7 +1238,8 @@ var CollectionController = class {
         });
         allowed = match.total > 0;
       }
-      if (!allowed) return c.json({ error: true, message: `Access denied: read on ${this.collection.slug}` }, 403);
+      if (!allowed)
+        return c.json({ error: true, message: `Access denied: read on ${this.collection.slug}` }, 403);
     }
     const result = await config.db.find({
       collection: WORKFLOW_HISTORY_COLLECTION,
@@ -1154,14 +1263,17 @@ var CollectionController = class {
   async changePassword(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     if (!this.collection.auth) {
       return c.json({ message: "This collection does not support authentication" }, 400);
     }
     const id = c.req.param("id");
-    if (!id) return c.json({ message: "Missing ID" }, 400);
+    if (!id)
+      return c.json({ message: "Missing ID" }, 400);
     const user = c.get("user");
-    if (!user) return c.json({ message: "Authentication required" }, 401);
+    if (!user)
+      return c.json({ message: "Authentication required" }, 401);
     const body = await c.req.json().catch(() => null);
     const { oldPassword, newPassword, confirmPassword } = body ?? {};
     if (!newPassword) {
@@ -1183,7 +1295,8 @@ var CollectionController = class {
         return c.json({ message: "Current password is required" }, 400);
       }
       const existing = await db.findOne({ collection: this.collection.slug, id });
-      if (!existing) return c.json({ message: "User not found" }, 404);
+      if (!existing)
+        return c.json({ message: "User not found" }, 404);
       const valid = await verifyPassword(oldPassword, existing.password);
       if (!valid) {
         return c.json({ message: "Invalid current password" }, 400);
@@ -1214,13 +1327,26 @@ var CollectionController = class {
   async delete(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
+    const provider = this.getDelegatedProvider(c);
+    if (provider && provider.members?.delete) {
+      const id2 = c.req.param("id");
+      if (!id2)
+        return c.json({ message: "Missing ID" }, 400);
+      const localDoc = await db.findOne({ collection: this.collection.slug, id: id2 });
+      const externalSubject = localDoc?.externalSubject || id2;
+      await provider.members.delete({ externalSubject, req: c.req });
+      return c.json({ message: "Deleted" });
+    }
     const readonlyDb = createReadonlyDb(db);
     const id = c.req.param("id");
-    if (!id) return c.json({ message: "Missing ID" }, 400);
+    if (!id)
+      return c.json({ message: "Missing ID" }, 400);
     const user = c.get("user");
     const doc = await db.findOne({ collection: this.collection.slug, id });
-    if (!doc) return c.json({ message: "Not Found" }, 404);
+    if (!doc)
+      return c.json({ message: "Not Found" }, 404);
     let before = null;
     if (this.collection.audit) {
       before = doc;
@@ -1255,7 +1381,8 @@ var CollectionController = class {
   async deleteMany(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const readonlyDb = createReadonlyDb(db);
     const user = c.get("user");
     let ids = [];
@@ -1270,7 +1397,8 @@ var CollectionController = class {
       const raw = c.req.queries("ids") ?? c.req.queries("ids[]") ?? [];
       ids = raw.filter(Boolean);
     }
-    if (!ids.length) return c.json({ message: "No IDs provided" }, 400);
+    if (!ids.length)
+      return c.json({ message: "No IDs provided" }, 400);
     const deleted = [];
     const failed = [];
     for (const id of ids) {
@@ -1323,7 +1451,8 @@ var CollectionController = class {
   async seed(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json();
     const initialData = body.data;
     if (!initialData || !Array.isArray(initialData)) {
@@ -1343,7 +1472,7 @@ var CollectionController = class {
   }
 };
 
-// src/controllers/global.controller.ts
+// src/controllers/global.controller.js
 var GlobalController = class {
   global;
   constructor(global) {
@@ -1352,7 +1481,8 @@ var GlobalController = class {
   async get(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const readonlyDb = createReadonlyDb(db);
     const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 10;
     const user = c.get("user");
@@ -1396,7 +1526,8 @@ var GlobalController = class {
   async update(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const readonlyDb = createReadonlyDb(db);
     const body = await c.req.json();
     const user = c.get("user");
@@ -1431,7 +1562,8 @@ var GlobalController = class {
   async seed(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json();
     const initialData = body.data;
     if (!initialData) {
@@ -1447,20 +1579,23 @@ var GlobalController = class {
   }
 };
 function isFunctionallyEmpty(obj) {
-  if (obj === null || obj === void 0 || obj === "") return true;
+  if (obj === null || obj === void 0 || obj === "")
+    return true;
   if (Array.isArray(obj)) {
-    if (obj.length === 0) return true;
+    if (obj.length === 0)
+      return true;
     return obj.every(isFunctionallyEmpty);
   }
   if (typeof obj === "object") {
     const keys = Object.keys(obj);
-    if (keys.length === 0) return true;
+    if (keys.length === 0)
+      return true;
     return keys.every((key) => isFunctionallyEmpty(obj[key]));
   }
   return false;
 }
 
-// src/controllers/media.controller.ts
+// src/controllers/media.controller.js
 var MediaController = class {
   collection;
   constructor(collection = "media") {
@@ -1540,7 +1675,8 @@ var MediaController = class {
       }
     }
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const doc = await db.create({
       collection: this.collection,
       data: finalFileData
@@ -1549,7 +1685,8 @@ var MediaController = class {
   }
   async find(c) {
     const db = c.get("config").db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const limit = Number(c.req.query("limit")) || 10;
     const page = Number(c.req.query("page")) || 1;
     const result = await db.find({
@@ -1563,11 +1700,14 @@ var MediaController = class {
     const config = c.get("config");
     const storage = config.storage;
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const id = c.req.param("id");
-    if (!id) return c.json({ message: "Missing ID" }, 400);
+    if (!id)
+      return c.json({ message: "Missing ID" }, 400);
     const doc = await db.findOne({ collection: this.collection, id });
-    if (!doc) return c.json({ message: "Not Found" }, 404);
+    if (!doc)
+      return c.json({ message: "Not Found" }, 404);
     if (storage) {
       await storage.delete({ filename: doc.filename });
       if (doc.sizes) {
@@ -1588,26 +1728,26 @@ var MediaController = class {
       return c.json({ message: "Storage not configured for serving" }, 404);
     }
     const filename = c.req.param("filename");
-    if (!filename) return c.json({ message: "Missing filename" }, 400);
+    if (!filename)
+      return c.json({ message: "Missing filename" }, 400);
     let res = await storage.resolve({ filename });
     if (!res && !filename.includes("/")) {
       res = await storage.resolve({ filename: `default/${filename}` });
     }
-    if (!res) return c.json({ message: "Not Found" }, 404);
+    if (!res)
+      return c.json({ message: "Not Found" }, 404);
     c.header("Content-Type", res.mimeType);
     return c.body(res.buffer);
   }
 };
 
-// src/auth/token.ts
+// src/auth/token.js
 var import_jose = require("jose");
 var import_node_util2 = require("util");
 function getSecret() {
   const secret = process.env.DYRECTED_JWT_SECRET || process.env.JWT_SECRET;
   if (!secret) {
-    throw new Error(
-      "[dyrected/core] DYRECTED_JWT_SECRET is not set. Add it to your environment variables to enable auth collections."
-    );
+    throw new Error("[dyrected/core] DYRECTED_JWT_SECRET is not set. Add it to your environment variables to enable auth collections.");
   }
   return new import_node_util2.TextEncoder().encode(secret);
 }
@@ -1620,7 +1760,7 @@ async function verifyCollectionToken(token) {
   return payload;
 }
 
-// src/services/email-template.ts
+// src/services/email-template.js
 var emailTokens = {
   colors: {
     canvas: "#f6f7f2",
@@ -1684,11 +1824,9 @@ function detailBox(content, monospace = false) {
 }
 function ctaButton(label, href) {
   const safeHref = safeHttpUrl(href);
-  if (!safeHref) return "";
-  return table(row(
-    `<a href="${safeHref}" style="display:inline-block;padding:13px 22px;border-radius:${emailTokens.radius.control};background:${emailTokens.colors.accent};font-family:${emailTokens.font};font-size:14px;line-height:1.2;font-weight:700;color:${emailTokens.colors.text};text-decoration:none">${escapeHtml(label)}</a>`,
-    "padding:8px 0 24px"
-  ), "width:auto");
+  if (!safeHref)
+    return "";
+  return table(row(`<a href="${safeHref}" style="display:inline-block;padding:13px 22px;border-radius:${emailTokens.radius.control};background:${emailTokens.colors.accent};font-family:${emailTokens.font};font-size:14px;line-height:1.2;font-weight:700;color:${emailTokens.colors.text};text-decoration:none">${escapeHtml(label)}</a>`, "padding:8px 0 24px"), "width:auto");
 }
 function alertBox(content) {
   return table(row(escapeHtml(content), `padding:13px 16px;font-family:${emailTokens.font};font-size:13px;line-height:1.5;color:${emailTokens.colors.dangerText}`), `width:100%;background:${emailTokens.colors.dangerSurface};border:1px solid ${emailTokens.colors.dangerBorder};border-radius:${emailTokens.radius.control}`);
@@ -1699,23 +1837,19 @@ function layout({ preheader, title, content, footer }) {
   <head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"></head>
   <body style="margin:0;padding:0;background:${emailTokens.colors.canvas}">
     <div style="display:none;max-height:0;overflow:hidden;opacity:0;color:transparent">${escapeHtml(preheader)}</div>
-    ${table(row(
-    table(
-      row("&nbsp;", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${sectionLabel("Dyrected")}${heading(title)}`, "padding:30px 32px 24px") + row(content, "padding:0 32px 32px") + row(`${divider()}${paragraph(footer, "20px 0 6px")}${paragraph("Privacy: this message contains account-related information; please avoid forwarding it.", "0")}`, "padding:0 32px 28px"),
-      `width:100%;max-width:${emailTokens.width};background:${emailTokens.colors.surface};border:1px solid ${emailTokens.colors.border};border-radius:${emailTokens.radius.card};overflow:hidden`
-    ),
-    "padding:32px 12px"
-  ), `width:100%;background:${emailTokens.colors.canvas}`)}
+    ${table(row(table(row("&nbsp;", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${sectionLabel("Dyrected")}${heading(title)}`, "padding:30px 32px 24px") + row(content, "padding:0 32px 32px") + row(`${divider()}${paragraph(footer, "20px 0 6px")}${paragraph("Privacy: this message contains account-related information; please avoid forwarding it.", "0")}`, "padding:0 32px 28px"), `width:100%;max-width:${emailTokens.width};background:${emailTokens.colors.surface};border:1px solid ${emailTokens.colors.border};border-radius:${emailTokens.radius.card};overflow:hidden`), "padding:32px 12px"), `width:100%;background:${emailTokens.colors.canvas}`)}
   </body>
 </html>`;
 }
 
-// src/services/email.service.ts
+// src/services/email.service.js
 var _devSend = null;
 var _devSendPromise = null;
 async function getDevSend() {
-  if (_devSend) return _devSend;
-  if (_devSendPromise) return _devSendPromise;
+  if (_devSend)
+    return _devSend;
+  if (_devSendPromise)
+    return _devSendPromise;
   _devSendPromise = (async () => {
     try {
       const nodemailer = await import("nodemailer");
@@ -1799,7 +1933,7 @@ function buildPasswordChangedEmail(config, args) {
   };
 }
 
-// src/controllers/auth.controller.ts
+// src/controllers/auth.controller.js
 var AuthController = class {
   collection;
   constructor(collection) {
@@ -1811,7 +1945,8 @@ var AuthController = class {
   // ---------------------------------------------------------------------------
   async init(c) {
     const db = c.get("config").db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const result = await db.find({
       collection: this.collection.slug,
       limit: 1
@@ -1827,7 +1962,8 @@ var AuthController = class {
   async registerFirstUser(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const check = await db.find({
       collection: this.collection.slug,
       limit: 1
@@ -1855,9 +1991,7 @@ var AuthController = class {
       collection: this.collection.slug
     });
     const { subject, html } = buildWelcomeEmail(config, { email: body.email });
-    sendEmail(config, { to: body.email, subject, html }).catch(
-      (err) => console.error("[dyrected/core] Failed to send welcome email:", err)
-    );
+    sendEmail(config, { to: body.email, subject, html }).catch((err) => console.error("[dyrected/core] Failed to send welcome email:", err));
     const { password: _, ...safeUser } = user;
     return c.json({ token, user: safeUser });
   }
@@ -1866,7 +2000,8 @@ var AuthController = class {
   // ---------------------------------------------------------------------------
   async login(c) {
     const db = c.get("config").db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json().catch(() => null);
     if (!body?.email || !body?.password) {
       return c.json({ error: true, message: "email and password are required." }, 400);
@@ -1905,7 +2040,8 @@ var AuthController = class {
   // ---------------------------------------------------------------------------
   async me(c) {
     const db = c.get("config").db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const requestUser = c.get("user");
     if (!requestUser) {
       return c.json({ error: true, message: "Authentication required." }, 401);
@@ -1940,7 +2076,8 @@ var AuthController = class {
   async forgotPassword(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json().catch(() => null);
     if (!body?.email) {
       return c.json({ error: true, message: "email is required." }, 400);
@@ -1952,10 +2089,7 @@ var AuthController = class {
     });
     const user = result.docs[0];
     if (user) {
-      const resetToken = await signCollectionToken(
-        { sub: user.id, email: user.email, collection: this.collection.slug, purpose: "reset" },
-        "1h"
-      );
+      const resetToken = await signCollectionToken({ sub: user.id, email: user.email, collection: this.collection.slug, purpose: "reset" }, "1h");
       const resetUrl = body?.resetUrl;
       const url = resetUrl ? `${resetUrl}${resetUrl.includes("?") ? "&" : "?"}token=${encodeURIComponent(resetToken)}` : void 0;
       try {
@@ -1978,7 +2112,8 @@ var AuthController = class {
   async resetPassword(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json().catch(() => null);
     if (!body?.token || !body?.password) {
       return c.json({ error: true, message: "token and password are required." }, 400);
@@ -1999,9 +2134,7 @@ var AuthController = class {
       data: { password: hashedPassword }
     });
     const { subject, html } = buildPasswordChangedEmail(config, { email: payload.email });
-    sendEmail(config, { to: payload.email, subject, html }).catch(
-      (err) => console.error("[dyrected/core] Failed to send password-changed email:", err)
-    );
+    sendEmail(config, { to: payload.email, subject, html }).catch((err) => console.error("[dyrected/core] Failed to send password-changed email:", err));
     return c.json({ success: true, message: "Password has been reset. You can now log in." });
   }
   // ---------------------------------------------------------------------------
@@ -2011,7 +2144,8 @@ var AuthController = class {
   async invite(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const requestUser = c.get("user");
     if (!requestUser) {
       return c.json({ error: true, message: "Authentication required." }, 401);
@@ -2028,10 +2162,7 @@ var AuthController = class {
     if (existing.total > 0) {
       return c.json({ error: true, message: "An account with that email already exists." }, 409);
     }
-    const inviteToken = await signCollectionToken(
-      { sub: body.email, email: body.email, collection: this.collection.slug, purpose: "invite" },
-      "7d"
-    );
+    const inviteToken = await signCollectionToken({ sub: body.email, email: body.email, collection: this.collection.slug, purpose: "invite" }, "7d");
     try {
       const { subject, html } = buildInviteEmail(config, {
         token: inviteToken,
@@ -2051,7 +2182,8 @@ var AuthController = class {
   async acceptInvite(c) {
     const config = c.get("config");
     const db = config.db;
-    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json().catch(() => null);
     if (!body?.token || !body?.password) {
       return c.json({ error: true, message: "token and password are required." }, 400);
@@ -2086,20 +2218,18 @@ var AuthController = class {
       collection: this.collection.slug
     });
     const { subject, html } = buildWelcomeEmail(config, { email: inviteeEmail });
-    sendEmail(config, { to: inviteeEmail, subject, html }).catch(
-      (err) => console.error("[dyrected/core] Failed to send welcome email:", err)
-    );
+    sendEmail(config, { to: inviteeEmail, subject, html }).catch((err) => console.error("[dyrected/core] Failed to send welcome email:", err));
     const { password: _, ...safeUser } = user;
     return c.json({ token: sessionToken, user: safeUser }, 201);
   }
 };
 
-// src/controllers/admin-auth.controller.ts
+// src/controllers/admin-auth.controller.js
 var import_node_crypto2 = require("crypto");
 var import_node_util3 = require("util");
 var import_jose2 = require("jose");
 
-// src/utils/admin-auth.ts
+// src/utils/admin-auth.js
 function getAdminAuthCollection(config) {
   const requestedSlug = config.adminAuth?.collectionSlug;
   if (requestedSlug) {
@@ -2123,16 +2253,17 @@ function getPublicAdminAuthConfig(adminAuth) {
 }
 function humanizeProviderName(id, type) {
   const cleaned = id.replace(/[-_]+/g, " ").trim();
-  if (!cleaned) return type.toUpperCase();
+  if (!cleaned)
+    return type.toUpperCase();
   return cleaned.replace(/\b\w/g, (char) => char.toUpperCase());
 }
 
-// src/controllers/admin-auth.controller.ts
+// src/controllers/admin-auth.controller.js
 var AdminAuthController = class {
+  config;
   constructor(config) {
     this.config = config;
   }
-  config;
   providers(c) {
     return c.json(getPublicAdminAuthConfig(this.config.adminAuth));
   }
@@ -2145,20 +2276,22 @@ var AdminAuthController = class {
     const siteId = this.getSiteId(c);
     const returnTo = this.normalizeReturnTo(c.req.query("returnTo"), c);
     if (provider.type === "oidc") {
-      const redirectUrl = await this.buildOidcStartUrl(
-        provider,
-        returnTo,
-        siteId,
-        new URL(c.req.url).origin
-      );
+      const redirectUrl = await this.buildOidcStartUrl(provider, returnTo, siteId, new URL(c.req.url).origin);
       return c.redirect(redirectUrl, 302);
     }
     if (!provider.startUrl) {
       return c.json({ error: true, message: "This provider does not expose a start URL." }, 400);
     }
-    const url = new URL(provider.startUrl);
+    const url = this.buildCustomProviderStartUrl(provider.startUrl, new URL(c.req.url).origin);
+    if (!url) {
+      return c.json({
+        error: true,
+        message: `Admin auth provider "${provider.id}" has an invalid start URL.`
+      }, 500);
+    }
     url.searchParams.set("returnTo", returnTo);
-    if (siteId) url.searchParams.set("siteId", siteId);
+    if (siteId)
+      url.searchParams.set("siteId", siteId);
     url.searchParams.set("provider", provider.id);
     return c.redirect(url.toString(), 302);
   }
@@ -2205,7 +2338,8 @@ var AdminAuthController = class {
     return c.json({ success: true, message: "Logged out. Discard your token." });
   }
   getProvider(config, id) {
-    if (config.adminAuth?.mode !== "external") return void 0;
+    if (config.adminAuth?.mode !== "external")
+      return void 0;
     return config.adminAuth.providers.find((provider) => provider.id === id);
   }
   async completeProviderAuth(requestConfig, provider, c) {
@@ -2217,7 +2351,8 @@ var AdminAuthController = class {
       throw new Error("Admin auth collection is not configured.");
     }
     const db = c.get("config").db;
-    if (!db) throw new Error("Database not configured.");
+    if (!db)
+      throw new Error("Database not configured.");
     let user = await this.findUserByExternalIdentity(db, adminCollection.slug, provider.id, identity.sub) ?? (identity.email ? (await db.find({
       collection: adminCollection.slug,
       where: { email: identity.email },
@@ -2277,7 +2412,8 @@ var AdminAuthController = class {
       },
       user
     });
-    if (resolved) return resolved;
+    if (resolved)
+      return resolved;
     return { allowed: true, roles: identity.roles, data: {} };
   }
   async buildUserData(identity, providerId, roles, extraData) {
@@ -2308,7 +2444,8 @@ var AdminAuthController = class {
   }
   async getRequestConfig(c) {
     const siteId = this.getSiteId(c);
-    if (!siteId || !this.config.onSchemaFetch) return this.config;
+    if (!siteId || !this.config.onSchemaFetch)
+      return this.config;
     const dynamic = await this.config.onSchemaFetch(siteId);
     return {
       ...this.config,
@@ -2339,7 +2476,8 @@ var AdminAuthController = class {
   async resolveOidcIdentity(provider, c) {
     const code = c.req.query("code");
     const state = c.req.query("state");
-    if (!code || !state) throw new Error("Missing OIDC callback parameters.");
+    if (!code || !state)
+      throw new Error("Missing OIDC callback parameters.");
     const parsedState = await this.verifyState(state, provider.id);
     const discovery = await this.getOidcDiscovery(provider);
     const redirectUri = provider.redirectUri || this.defaultCallbackPath(provider.id, new URL(c.req.url).origin);
@@ -2374,7 +2512,8 @@ var AdminAuthController = class {
       const userInfo = await fetch(provider.userInfoEndpoint || discovery.userinfo_endpoint, {
         headers: { Authorization: `Bearer ${tokenBody.access_token}` }
       });
-      if (!userInfo.ok) throw new Error("OIDC userinfo request failed.");
+      if (!userInfo.ok)
+        throw new Error("OIDC userinfo request failed.");
       claims = await userInfo.json();
     } else {
       throw new Error("OIDC provider did not return usable identity claims.");
@@ -2414,15 +2553,13 @@ var AdminAuthController = class {
       if (provider.audience) {
         const aud = claims.aud;
         const matches = Array.isArray(aud) ? aud.includes(provider.audience) : aud === provider.audience;
-        if (!matches) throw new Error("External auth audience mismatch.");
+        if (!matches)
+          throw new Error("External auth audience mismatch.");
       }
     }
     return {
       identity: this.mapClaims(claims, provider.claimMapping),
-      returnTo: this.normalizeReturnTo(
-        body?.returnTo || c.req.query("returnTo"),
-        c
-      )
+      returnTo: this.normalizeReturnTo(body?.returnTo || c.req.query("returnTo"), c)
     };
   }
   mapClaims(claims, mapping) {
@@ -2452,24 +2589,38 @@ var AdminAuthController = class {
     return typeof value === "string" ? value : void 0;
   }
   readStringArrayClaim(value) {
-    if (!value) return void 0;
+    if (!value)
+      return void 0;
     if (Array.isArray(value)) {
       return value.filter((entry) => typeof entry === "string");
     }
-    if (typeof value === "string") return [value];
+    if (typeof value === "string")
+      return [value];
     return void 0;
   }
   async getOidcDiscovery(provider) {
-    const discoveryUrl = new URL(
-      provider.issuer.replace(/\/$/, "") + "/.well-known/openid-configuration"
-    );
+    const discoveryUrl = new URL(provider.issuer.replace(/\/$/, "") + "/.well-known/openid-configuration");
     const response = await fetch(discoveryUrl.toString());
-    if (!response.ok) throw new Error("Failed to load OIDC discovery document.");
+    if (!response.ok)
+      throw new Error("Failed to load OIDC discovery document.");
     return response.json();
   }
   defaultCallbackPath(providerId, origin = "") {
     return `${origin}/api/admin/auth/${providerId}/callback`;
   }
+  buildCustomProviderStartUrl(startUrl, origin) {
+    const value = startUrl.trim();
+    if (!value || /^(undefined|null)(\/|$)/i.test(value))
+      return null;
+    try {
+      const url = new URL(value, origin);
+      if (url.protocol !== "http:" && url.protocol !== "https:")
+        return null;
+      return url;
+    } catch {
+      return null;
+    }
+  }
   async signState(payload) {
     return new import_jose2.SignJWT(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("15m").sign(this.getStateSecret());
   }
@@ -2489,13 +2640,14 @@ var AdminAuthController = class {
     return new import_node_util3.TextEncoder().encode(secret);
   }
   normalizeReturnTo(returnTo, c) {
-    if (returnTo) return returnTo;
+    if (returnTo)
+      return returnTo;
     const url = new URL(c.req.url);
     return `${url.origin}/admin`;
   }
 };
 
-// src/controllers/preview.controller.ts
+// src/controllers/preview.controller.js
 var import_jose3 = require("jose");
 var import_node_util4 = require("util");
 var PreviewController = class {
@@ -2538,7 +2690,7 @@ var PreviewController = class {
   }
 };
 
-// src/middleware/auth.ts
+// src/middleware/auth.js
 function requireAuth() {
   return async (c, next) => {
     const authHeader = c.req.header("Authorization");
@@ -2570,7 +2722,7 @@ function optionalAuth() {
   };
 }
 
-// src/utils/openapi.ts
+// src/utils/openapi.js
 function generateOpenApi(config) {
   const spec = {
     openapi: "3.0.0",
@@ -3279,7 +3431,8 @@ function fieldsToProperties(fields) {
       required.push(...nested.required);
       continue;
     }
-    if (!field.name) continue;
+    if (!field.name)
+      continue;
     props[field.name] = fieldToSchema(field);
     if (field.required) {
       required.push(field.name);
@@ -3391,11 +3544,12 @@ function fieldToSchema(field) {
     default:
       schema = { type: "string" };
   }
-  if (field.label) schema.description = field.label;
+  if (field.label)
+    schema.description = field.label;
   return schema;
 }
 
-// src/utils/swagger.ts
+// src/utils/swagger.js
 function getSwaggerHtml(specUrl = "/api/openapi.json") {
   return `
 <!DOCTYPE html>
@@ -3444,7 +3598,7 @@ function getSwaggerHtml(specUrl = "/api/openapi.json") {
   `;
 }
 
-// src/router.ts
+// src/router.js
 function accessGate(target, action) {
   return async (c, next) => {
     const user = c.get("user");
@@ -3461,7 +3615,8 @@ function accessGate(target, action) {
   };
 }
 async function checkAccess(access, accessArgs) {
-  if (access === void 0 || access === null) return true;
+  if (access === void 0 || access === null)
+    return true;
   if (typeof access === "function") {
     try {
       const result = await access(accessArgs);
@@ -3477,7 +3632,8 @@ async function checkAccess(access, accessArgs) {
   return true;
 }
 function serializeFieldForApi(f) {
-  if (!f) return f;
+  if (!f)
+    return f;
   const serialized = { ...f };
   if (serialized.admin?.hooks) {
     const hooks = { ...serialized.admin.hooks };
@@ -3510,8 +3666,10 @@ function registerRoutes(app, config) {
     let globals = [...config.globals];
     if (siteId && config.onSchemaFetch) {
       const dynamic = await config.onSchemaFetch(siteId);
-      if (dynamic.collections) collections = [...collections, ...dynamic.collections];
-      if (dynamic.globals) globals = [...globals, ...dynamic.globals];
+      if (dynamic.collections)
+        collections = [...collections, ...dynamic.collections];
+      if (dynamic.globals)
+        globals = [...globals, ...dynamic.globals];
       if (dynamic.admin) {
         config.admin = { ...config.admin, ...dynamic.admin };
       }
@@ -3522,8 +3680,10 @@ function registerRoutes(app, config) {
     const user = c.get("user");
     const accessArgs = { user, req: c.req, doc: null };
     const serializeAccess = async (access) => {
-      if (typeof access === "string") return access;
-      if (typeof access === "boolean") return access;
+      if (typeof access === "string")
+        return access;
+      if (typeof access === "boolean")
+        return access;
       return checkAccess(access, accessArgs);
     };
     const filteredCollections = await Promise.all(collections.filter((col) => !siteId || col.shared || !col.siteId || col.siteId === siteId).map(async (col) => ({
@@ -3616,7 +3776,8 @@ function registerRoutes(app, config) {
     let collections = [...config.collections];
     if (siteId && config.onSchemaFetch) {
       const dynamic = await config.onSchemaFetch(siteId);
-      if (dynamic.collections) collections = [...collections, ...dynamic.collections];
+      if (dynamic.collections)
+        collections = [...collections, ...dynamic.collections];
     }
     const user = c.get("user");
     let collection = collections.find((col) => col.slug === colSlug);
@@ -3635,7 +3796,8 @@ function registerRoutes(app, config) {
       let globals = [...config.globals];
       if (siteId && config.onSchemaFetch) {
         const dynamic = await config.onSchemaFetch(siteId);
-        if (dynamic.globals) globals = [...globals, ...dynamic.globals];
+        if (dynamic.globals)
+          globals = [...globals, ...dynamic.globals];
       }
       const glb = globals.find((g) => g.slug === colSlug);
       if (!glb) {
@@ -3693,9 +3855,12 @@ function registerRoutes(app, config) {
     const user = c.get("user");
     const key = c.req.param("key");
     const scope = c.req.query("scope");
-    if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
+    if (!user?.collection || !user.sub)
+      return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key)
+      return c.json({ error: true, message: "Preference key is required." }, 400);
     const getGlobalPreference = async () => {
       const globalDoc = await db.findOne({ collection: "__global_preferences", id: key });
       return globalDoc ? globalDoc.value : null;
@@ -3705,7 +3870,8 @@ function registerRoutes(app, config) {
       return c.json({ key, value: globalValue2 });
     }
     const doc = await db.findOne({ collection: user.collection, id: user.sub });
-    if (!doc) return c.json({ error: true, message: "User not found." }, 404);
+    if (!doc)
+      return c.json({ error: true, message: "User not found." }, 404);
     const preferences = typeof doc.__preferences === "object" && doc.__preferences !== null ? doc.__preferences : {};
     if (key in preferences) {
       return c.json({ key, value: preferences[key] ?? null });
@@ -3718,9 +3884,12 @@ function registerRoutes(app, config) {
     const user = c.get("user");
     const key = c.req.param("key");
     const scope = c.req.query("scope");
-    if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
+    if (!user?.collection || !user.sub)
+      return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key)
+      return c.json({ error: true, message: "Preference key is required." }, 400);
     const body = await c.req.json().catch(() => ({}));
     if (scope === "global") {
       const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
@@ -3743,7 +3912,8 @@ function registerRoutes(app, config) {
       return c.json({ key, value: body.value });
     }
     const doc = await db.findOne({ collection: user.collection, id: user.sub });
-    if (!doc) return c.json({ error: true, message: "User not found." }, 404);
+    if (!doc)
+      return c.json({ error: true, message: "User not found." }, 404);
     const preferences = typeof doc.__preferences === "object" && doc.__preferences !== null ? doc.__preferences : {};
     const nextPreferences = { ...preferences, [key]: body.value };
     await db.update({
@@ -3758,9 +3928,12 @@ function registerRoutes(app, config) {
     const user = c.get("user");
     const key = c.req.param("key");
     const scope = c.req.query("scope");
-    if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
+    if (!db)
+      return c.json({ message: "Database not configured" }, 500);
+    if (!user?.collection || !user.sub)
+      return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key)
+      return c.json({ error: true, message: "Preference key is required." }, 400);
     if (scope === "global") {
       const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
       if (!isAdminUser) {
@@ -3770,7 +3943,8 @@ function registerRoutes(app, config) {
       return c.json({ success: true });
     }
     const doc = await db.findOne({ collection: user.collection, id: user.sub });
-    if (!doc) return c.json({ error: true, message: "User not found." }, 404);
+    if (!doc)
+      return c.json({ error: true, message: "User not found." }, 404);
     const preferences = typeof doc.__preferences === "object" && doc.__preferences !== null ? { ...doc.__preferences } : {};
     delete preferences[key];
     await db.update({
@@ -3806,7 +3980,8 @@ function registerRoutes(app, config) {
   app.post("/api/admin/auth/:provider/exchange", (c) => adminAuthController.exchange(c));
   app.post("/api/admin/logout", (c) => adminAuthController.logout(c));
   for (const collection of config.collections) {
-    if (!collection.auth) continue;
+    if (!collection.auth)
+      continue;
     const path = `/api/collections/${collection.slug}`;
     const authController = new AuthController(collection);
     app.post(`${path}/login`, (c) => authController.login(c));
@@ -3908,25 +4083,39 @@ function registerRoutes(app, config) {
         if (collection.auth && id) {
           const authController = new AuthController(collection);
           const method2 = c.req.method;
-          if (method2 === "POST" && id === "login") return authController.login(c);
-          if (method2 === "POST" && id === "logout") return authController.logout(c);
-          if (method2 === "GET" && id === "me") return authController.me(c);
-          if (method2 === "POST" && id === "refresh-token") return authController.refreshToken(c);
-          if (method2 === "POST" && id === "forgot-password") return authController.forgotPassword(c);
-          if (method2 === "POST" && id === "reset-password") return authController.resetPassword(c);
+          if (method2 === "POST" && id === "login")
+            return authController.login(c);
+          if (method2 === "POST" && id === "logout")
+            return authController.logout(c);
+          if (method2 === "GET" && id === "me")
+            return authController.me(c);
+          if (method2 === "POST" && id === "refresh-token")
+            return authController.refreshToken(c);
+          if (method2 === "POST" && id === "forgot-password")
+            return authController.forgotPassword(c);
+          if (method2 === "POST" && id === "reset-password")
+            return authController.resetPassword(c);
         }
         const controller = new CollectionController(collection);
         const method = c.req.method;
         if (id) {
-          if (method === "GET") return controller.findOne(c);
-          if (method === "PATCH") return controller.update(c);
-          if (method === "DELETE" && id === "delete-many") return controller.deleteMany(c);
-          if (method === "DELETE") return controller.delete(c);
-          if (method === "POST" && id === "media") return controller.create(c);
-          if (method === "POST" && id === "seed") return controller.seed(c);
+          if (method === "GET")
+            return controller.findOne(c);
+          if (method === "PATCH")
+            return controller.update(c);
+          if (method === "DELETE" && id === "delete-many")
+            return controller.deleteMany(c);
+          if (method === "DELETE")
+            return controller.delete(c);
+          if (method === "POST" && id === "media")
+            return controller.create(c);
+          if (method === "POST" && id === "seed")
+            return controller.seed(c);
         } else {
-          if (method === "GET") return controller.find(c);
-          if (method === "POST") return controller.create(c);
+          if (method === "GET")
+            return controller.find(c);
+          if (method === "POST")
+            return controller.create(c);
         }
       }
     }
@@ -3947,10 +4136,13 @@ function registerRoutes(app, config) {
         const controller = new GlobalController(global);
         const method = c.req.method;
         if (id) {
-          if (method === "POST" && id === "seed") return controller.seed(c);
+          if (method === "POST" && id === "seed")
+            return controller.seed(c);
         } else {
-          if (method === "GET") return controller.get(c);
-          if (method === "PATCH") return controller.update(c);
+          if (method === "GET")
+            return controller.get(c);
+          if (method === "PATCH")
+            return controller.update(c);
         }
       }
     }
@@ -3958,7 +4150,7 @@ function registerRoutes(app, config) {
   });
 }
 
-// src/utils/config.ts
+// src/utils/config.js
 var AUDIT_COLLECTION_SLUG = "__audit";
 var SYSTEM_FIELDS = [
   {
@@ -4172,7 +4364,8 @@ function normalizeConfig(config) {
   });
   const hasAuditCollection = normalizedCollections.some((col) => col.slug === AUDIT_COLLECTION_SLUG);
   const systemCollections = [];
-  if (needsAudit && !hasAuditCollection) systemCollections.push(AUDIT_COLLECTION);
+  if (needsAudit && !hasAuditCollection)
+    systemCollections.push(AUDIT_COLLECTION);
   if (needsWorkflow && !normalizedCollections.some((col) => col.slug === WORKFLOW_HISTORY_COLLECTION)) {
     systemCollections.push(WORKFLOW_HISTORY_COLLECTION_CONFIG);
   }
@@ -4186,7 +4379,7 @@ function normalizeConfig(config) {
   };
 }
 
-// src/app.ts
+// src/app.js
 async function createDyrectedApp(rawConfig) {
   const config = normalizeConfig(rawConfig);
   const app = new import_hono.Hono();