@dyrected/core 2.5.59 → 2.5.61

package/dist/server.cjs

@@ -627,12 +627,16 @@ async function resolveAccess(config, access, args) {
     }
   }
   if (isNamedAccessPolicy(access)) {
-    const resolver = config.accessPolicies?.[access.policy];
-    if (!resolver) {
+    const policy = config.accessPolicies?.[access.policy];
+    if (policy === void 0) {
       console.error(`[dyrected/core] Unknown access policy "${access.policy}".`);
       return false;
     }
+    if (typeof policy === "string" || typeof policy === "boolean") {
+      return evaluateAccess(policy, args);
+    }
     try {
+      const resolver = policy;
       return await resolver({ ...args, params: access.params });
     } catch (err) {
       console.error(`[dyrected/core] Access policy "${access.policy}" failed:`, err);
@@ -775,14 +779,15 @@ async function applyFieldWriteAccess(context, data) {
       continue;
     }
     if (!field.name || !(field.name in result)) continue;
-    const canUpdate = await resolveBooleanAccess(context.config, field.access?.update, {
+    const writeRule = context.operation === "create" ? field.access?.create ?? field.access?.update : field.access?.update;
+    const canWrite = await resolveBooleanAccess(context.config, writeRule, {
       user: context.user,
       req: context.req,
       doc: context.doc,
       data: context.data,
       id: resolveFieldAccessId(context)
     });
-    if (!canUpdate) {
+    if (!canWrite) {
       delete result[field.name];
       continue;
     }
@@ -822,6 +827,20 @@ function mergeWhereConstraint(where, constraint) {
 // src/workflows.ts
 var WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
 var LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
+function simplePublishingWorkflow() {
+  return {
+    initialState: "draft",
+    draftState: "draft",
+    states: [
+      { name: "draft", label: "Draft", color: "neutral" },
+      { name: "published", label: "Published", color: "success", published: true }
+    ],
+    transitions: [
+      { name: "publish", label: "Publish", from: "draft", to: "published" },
+      { name: "unpublish", label: "Unpublish", from: "published", to: "draft", unpublish: true }
+    ]
+  };
+}
 function publicMetadata(meta) {
   const { availableTransitions: _availableTransitions, ...safe } = meta;
   return safe;
@@ -855,9 +874,23 @@ function initializeWorkflowDocument(data, workflow) {
     __workflow: { state: workflow.initialState, revision: 1 }
   };
 }
+function publishedStateName(workflow) {
+  return workflow.states.find((state) => state.published)?.name ?? workflow.states[workflow.states.length - 1]?.name ?? workflow.initialState;
+}
 function materializeWorkflowDocument(doc, workflow, user) {
   const meta = doc.__workflow;
-  if (!meta) return doc;
+  if (!meta) {
+    const { __published: _legacyPublished, __workflow: _legacyWorkflow, ...working2 } = doc;
+    const state = publishedStateName(workflow);
+    return {
+      ...working2,
+      _workflow: {
+        state,
+        revision: 1,
+        availableTransitions: availableWorkflowTransitions(workflow, state, user).map((item) => item.name)
+      }
+    };
+  }
   const { __published, __workflow, ...working } = doc;
   if (!canViewWorkflowDraft(workflow, user)) {
     if (!__published || typeof __published !== "object") return null;
@@ -1117,9 +1150,9 @@ var CollectionController = class {
       });
     }
     const readonlyDb = createReadonlyDb(db);
-    const limit = Number(c.req.query("limit")) || 10;
+    const limit = Math.min(Number(c.req.query("limit")) || 10, 100);
     const page = Number(c.req.query("page")) || 1;
-    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 2;
+    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const sort = c.req.query("sort") || void 0;
     const user = c.get("user");
     let where = void 0;
@@ -1165,7 +1198,8 @@ var CollectionController = class {
       limit,
       page,
       sort,
-      where
+      where,
+      fields: this.collection.fields
     });
     if (result.total === 0 && this.collection.initialData && !where && page === 1) {
       console.log(`[dyrected/core] Auto-seeding collection "${this.collection.slug}" from config.initialData`);
@@ -1177,7 +1211,8 @@ var CollectionController = class {
         limit,
         page,
         sort,
-        where
+        where,
+        fields: this.collection.fields
       });
     }
     result.docs = result.docs.map((doc) => this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc).filter((doc) => doc !== null);
@@ -1235,7 +1270,7 @@ var CollectionController = class {
     }
     const readonlyDb = createReadonlyDb(db);
     const id = c.req.param("id");
-    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 10;
+    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const user = c.get("user");
     if (!id) return c.json({ message: "Missing ID" }, 400);
     let doc = await db.findOne({ collection: this.collection.slug, id });
@@ -1324,7 +1359,8 @@ var CollectionController = class {
       fields: this.collection.fields,
       user,
       req: this.toHookRequestContext(c),
-      data
+      data,
+      operation: "create"
     }, data);
     data = await executeFieldBeforeChange(this.collection.fields, data, null, user, readonlyDb);
     data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
@@ -1419,7 +1455,8 @@ var CollectionController = class {
       fields: this.collection.fields,
       user,
       req: this.toHookRequestContext(c),
-      data
+      data,
+      operation: "create"
     }, data);
     data = await executeFieldBeforeChange(this.collection.fields, data, null, user, readonlyDb);
     data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
@@ -1841,7 +1878,7 @@ var GlobalController = class {
     const db = config.db;
     if (!db) return c.json({ message: "Database not configured" }, 500);
     const readonlyDb = createReadonlyDb(db);
-    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 10;
+    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const user = c.get("user");
     let query = void 0;
     const beforeReadResult = await runCollectionHooks(this.global.hooks?.beforeRead, {
@@ -3060,6 +3097,150 @@ var PreviewController = class {
   }
 };
 
+// src/controllers/audit.controller.ts
+var AuditController = class {
+  parseQuery(c) {
+    const limit = Math.min(Number(c.req.query("limit")) || 50, 100);
+    const page = Math.max(Number(c.req.query("page")) || 1, 1);
+    const sort = c.req.query("sort") || "-timestamp";
+    const whereRaw = c.req.query("where");
+    if (!whereRaw) {
+      return { limit, page, sort };
+    }
+    try {
+      return {
+        limit,
+        page,
+        sort,
+        where: JSON.parse(decodeURIComponent(whereRaw))
+      };
+    } catch {
+      return { limit, page, sort };
+    }
+  }
+  emptyResult(limit, page) {
+    return {
+      docs: [],
+      total: 0,
+      limit,
+      page,
+      totalPages: 0,
+      hasNextPage: false,
+      hasPrevPage: page > 1
+    };
+  }
+  async collectAccessibleDocumentIds(db, collection, constraint) {
+    const ids = [];
+    const limit = 100;
+    let page = 1;
+    while (true) {
+      const result = await db.find({
+        collection: collection.slug,
+        where: constraint,
+        limit,
+        page
+      });
+      for (const doc of result.docs) {
+        if (typeof doc?.id === "string" && doc.id.length > 0) {
+          ids.push(doc.id);
+        }
+      }
+      if (!result.hasNextPage || page >= result.totalPages) {
+        break;
+      }
+      page += 1;
+    }
+    return ids;
+  }
+  async buildCollectionAuditScope(c, collection) {
+    const config = c.get("config");
+    const auditAccess = collection.access?.readAudit ?? collection.access?.read;
+    const access = await resolveCollectionAccess(
+      config,
+      collection.slug,
+      "read",
+      auditAccess,
+      {
+        user: c.get("user"),
+        req: toHookRequestContext(c.req)
+      }
+    );
+    if (!access.allowed) {
+      return { denied: true, where: {} };
+    }
+    let where = { collection: { equals: collection.slug } };
+    if (access.constraint) {
+      const ids = await this.collectAccessibleDocumentIds(config.db, collection, access.constraint);
+      where = mergeWhereConstraint(where, { documentId: { in: ids } });
+    }
+    return { denied: false, where };
+  }
+  async getVisibleCollections(c) {
+    const config = c.get("config");
+    const collections = /* @__PURE__ */ new Map();
+    for (const collection of config.collections) {
+      collections.set(collection.slug, collection);
+    }
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    if (config.onSchemaFetch && siteId) {
+      const dynamic = await config.onSchemaFetch(siteId);
+      for (const collection of dynamic.collections || []) {
+        if (!collections.has(collection.slug)) {
+          collections.set(collection.slug, collection);
+        }
+      }
+    }
+    return Array.from(collections.values());
+  }
+  async findForCollection(c, collection) {
+    const config = c.get("config");
+    if (!config.db) return c.json({ message: "Database not configured" }, 500);
+    if (!collection.audit) return c.json({ message: "Audit is not enabled for this collection" }, 404);
+    const query = this.parseQuery(c);
+    const scope = await this.buildCollectionAuditScope(c, collection);
+    if (scope.denied) {
+      return c.json({ error: true, message: `Access denied: read on ${collection.slug}` }, 403);
+    }
+    const where = query.where ? mergeWhereConstraint(scope.where, query.where) : scope.where;
+    const result = await config.db.find({
+      collection: "__audit",
+      where,
+      limit: query.limit,
+      page: query.page,
+      sort: query.sort
+    });
+    return c.json(result);
+  }
+  async findAll(c) {
+    const config = c.get("config");
+    if (!config.db) return c.json({ message: "Database not configured" }, 500);
+    const query = this.parseQuery(c);
+    const collections = (await this.getVisibleCollections(c)).filter((collection) => collection.audit);
+    const scopes = [];
+    for (const collection of collections) {
+      const scope = await this.buildCollectionAuditScope(c, collection);
+      if (!scope.denied) {
+        scopes.push(scope.where);
+      }
+    }
+    if (scopes.length === 0) {
+      return c.json(this.emptyResult(query.limit, query.page));
+    }
+    let where = scopes.length === 1 ? scopes[0] : { OR: scopes };
+    if (query.where) {
+      where = mergeWhereConstraint(where, query.where);
+    }
+    const result = await config.db.find({
+      collection: "__audit",
+      where,
+      limit: query.limit,
+      page: query.page,
+      sort: query.sort
+    });
+    return c.json(result);
+  }
+};
+
 // src/middleware/auth.ts
 function getBearerToken(c) {
   const authHeader = c.req.header("Authorization");
@@ -3137,6 +3318,15 @@ function optionalAuth(config) {
 }
 
 // src/utils/openapi.ts
+function getCollectionLabels(collection) {
+  return collection.labels || { singular: collection.slug, plural: collection.slug };
+}
+function getCollectionTag(collection) {
+  return `Collection: ${getCollectionLabels(collection).plural}`;
+}
+function getGlobalTag(global) {
+  return `Global: ${global.label || global.slug}`;
+}
 function generateOpenApi(config) {
   const spec = {
     openapi: "3.0.0",
@@ -3168,15 +3358,7 @@ function generateOpenApi(config) {
         },
         WorkflowHistoryEntry: {
           type: "object",
-          required: [
-            "collection",
-            "documentId",
-            "transition",
-            "from",
-            "to",
-            "revision",
-            "createdAt"
-          ],
+          required: ["collection", "documentId", "transition", "from", "to", "revision", "createdAt"],
           properties: {
             id: { type: "string" },
             collection: { type: "string" },
@@ -3190,6 +3372,21 @@ function generateOpenApi(config) {
             createdAt: { type: "string", format: "date-time" }
           }
         },
+        AuditEntry: {
+          type: "object",
+          required: ["collection", "operation", "timestamp"],
+          properties: {
+            id: { type: "string" },
+            collection: { type: "string" },
+            documentId: { type: "string", nullable: true },
+            operation: { type: "string" },
+            user: { type: "string", nullable: true },
+            timestamp: { type: "string", format: "date-time" },
+            changes: {
+              oneOf: [{ type: "string" }, { type: "object", additionalProperties: true }, { type: "null" }]
+            }
+          }
+        },
         Error: {
           type: "object",
           properties: {
@@ -3278,17 +3475,13 @@ function generateOpenApi(config) {
     get: {
       tags: ["Preferences"],
       summary: "Get an authenticated user preference",
-      parameters: [
-        { name: "key", in: "path", required: true, schema: { type: "string" } }
-      ],
+      parameters: [{ name: "key", in: "path", required: true, schema: { type: "string" } }],
       responses: { 200: { description: "Preference value" } }
     },
     put: {
       tags: ["Preferences"],
       summary: "Set an authenticated user preference",
-      parameters: [
-        { name: "key", in: "path", required: true, schema: { type: "string" } }
-      ],
+      parameters: [{ name: "key", in: "path", required: true, schema: { type: "string" } }],
       requestBody: {
         required: true,
         content: { "application/json": { schema: { type: "object" } } }
@@ -3319,6 +3512,39 @@ function generateOpenApi(config) {
       responses: { 200: { description: "Preview document data" } }
     }
   };
+  spec.paths["/api/audit"] = {
+    get: {
+      tags: ["Audit"],
+      summary: "Get audit entries across all readable audited collections",
+      parameters: [
+        { name: "limit", in: "query", schema: { type: "integer", default: 50, maximum: 100 } },
+        { name: "page", in: "query", schema: { type: "integer", default: 1 } },
+        { name: "where", in: "query", schema: { type: "string" }, description: "JSON filter" },
+        { name: "sort", in: "query", schema: { type: "string", default: "-timestamp" } }
+      ],
+      responses: {
+        200: {
+          description: "Audit entries",
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                properties: {
+                  docs: {
+                    type: "array",
+                    items: { $ref: "#/components/schemas/AuditEntry" }
+                  },
+                  total: { type: "integer" },
+                  limit: { type: "integer" },
+                  page: { type: "integer" }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  };
   for (const collection of config.collections) {
     spec.components.schemas[collection.slug] = collectionToSchema(collection);
   }
@@ -3328,10 +3554,11 @@ function generateOpenApi(config) {
   for (const collection of config.collections) {
     const slug = collection.slug;
     const path = `/api/collections/${slug}`;
-    const labels = collection.labels || { singular: slug, plural: `${slug}s` };
+    const labels = getCollectionLabels(collection);
+    const collectionTag = getCollectionTag(collection);
     spec.paths[path] = {
       get: {
-        tags: ["Collections"],
+        tags: [collectionTag],
         summary: `Find ${labels.plural}`,
         parameters: [
           {
@@ -3380,7 +3607,7 @@ function generateOpenApi(config) {
         }
       },
       post: {
-        tags: ["Collections"],
+        tags: [collectionTag],
         summary: `Create ${labels.singular}`,
         requestBody: {
           required: true,
@@ -3404,7 +3631,7 @@ function generateOpenApi(config) {
     };
     spec.paths[`${path}/{id}`] = {
       get: {
-        tags: ["Collections"],
+        tags: [collectionTag],
         summary: `Get a single ${labels.singular}`,
         parameters: [
           {
@@ -3426,7 +3653,7 @@ function generateOpenApi(config) {
         }
       },
       patch: {
-        tags: ["Collections"],
+        tags: [collectionTag],
         summary: `Update ${labels.singular}`,
         parameters: [
           {
@@ -3456,7 +3683,7 @@ function generateOpenApi(config) {
         }
       },
       delete: {
-        tags: ["Collections"],
+        tags: [collectionTag],
         summary: `Delete ${labels.singular}`,
         parameters: [
           {
@@ -3473,7 +3700,7 @@ function generateOpenApi(config) {
     };
     spec.paths[`${path}/delete-many`] = {
       delete: {
-        tags: ["Collections"],
+        tags: [collectionTag],
         summary: `Delete multiple ${labels.plural}`,
         requestBody: {
           required: true,
@@ -3492,9 +3719,46 @@ function generateOpenApi(config) {
         responses: { 200: { description: "Deleted and failed document IDs" } }
       }
     };
+    if (collection.audit) {
+      spec.paths[`${path}/__audit`] = {
+        get: {
+          tags: [collectionTag],
+          summary: `Get ${labels.singular} audit entries`,
+          parameters: [
+            { name: "limit", in: "query", schema: { type: "integer", default: 50, maximum: 100 } },
+            { name: "page", in: "query", schema: { type: "integer", default: 1 } },
+            { name: "where", in: "query", schema: { type: "string" }, description: "JSON filter" },
+            { name: "sort", in: "query", schema: { type: "string", default: "-timestamp" } }
+          ],
+          responses: {
+            200: {
+              description: "Audit entries for this collection",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    properties: {
+                      docs: {
+                        type: "array",
+                        items: { $ref: "#/components/schemas/AuditEntry" }
+                      },
+                      total: { type: "integer" },
+                      limit: { type: "integer" },
+                      page: { type: "integer" }
+                    }
+                  }
+                }
+              }
+            },
+            403: { description: "Collection read access denied" },
+            404: { description: "Audit is not enabled for this collection" }
+          }
+        }
+      };
+    }
     spec.paths[`${path}/seed`] = {
       post: {
-        tags: ["Collections"],
+        tags: [collectionTag],
         summary: `Seed initial ${labels.plural}`,
         responses: { 200: { description: "Seeded documents" } }
       }
@@ -3502,12 +3766,12 @@ function generateOpenApi(config) {
     if (collection.upload) {
       spec.paths[`${path}/media`] = {
         get: {
-          tags: ["Media"],
+          tags: [collectionTag],
           summary: `List ${labels.plural}`,
           responses: { 200: { description: "Paginated media documents" } }
         },
         post: {
-          tags: ["Media"],
+          tags: [collectionTag],
           summary: `Upload ${labels.singular}`,
           requestBody: {
             required: true,
@@ -3526,7 +3790,7 @@ function generateOpenApi(config) {
       };
       spec.paths[`${path}/media/{filename}`] = {
         get: {
-          tags: ["Media"],
+          tags: [collectionTag],
           summary: `Serve ${labels.singular} bytes`,
           parameters: [
             {
@@ -3546,7 +3810,7 @@ function generateOpenApi(config) {
     }
     if (collection.auth) {
       const publicAuthPost = (summary) => ({
-        tags: ["Authentication"],
+        tags: [collectionTag],
         summary,
         security: [],
         requestBody: {
@@ -3588,14 +3852,14 @@ function generateOpenApi(config) {
       };
       spec.paths[`${path}/logout`] = {
         post: {
-          tags: ["Authentication"],
+          tags: [collectionTag],
           summary: `Log out of ${labels.plural}`,
           responses: { 200: { description: "Logged out" } }
         }
       };
       spec.paths[`${path}/init`] = {
         get: {
-          tags: ["Authentication"],
+          tags: [collectionTag],
           summary: `Get ${labels.plural} initialization state`,
           security: [],
           responses: { 200: { description: "Initialization state" } }
@@ -3606,14 +3870,14 @@ function generateOpenApi(config) {
       };
       spec.paths[`${path}/me`] = {
         get: {
-          tags: ["Authentication"],
+          tags: [collectionTag],
           summary: `Get the current ${labels.singular}`,
           responses: { 200: { description: "Authenticated user" } }
         }
       };
       spec.paths[`${path}/refresh-token`] = {
         post: {
-          tags: ["Authentication"],
+          tags: [collectionTag],
           summary: "Refresh an authentication token",
           responses: { 200: { description: "Refreshed token" } }
         }
@@ -3626,7 +3890,7 @@ function generateOpenApi(config) {
       };
       spec.paths[`${path}/invite`] = {
         post: {
-          tags: ["Authentication"],
+          tags: [collectionTag],
           summary: `Invite a ${labels.singular}`,
           responses: { 200: { description: "Invitation sent" } }
         }
@@ -3636,7 +3900,7 @@ function generateOpenApi(config) {
       };
       spec.paths[`${path}/{id}/change-password`] = {
         post: {
-          tags: ["Authentication"],
+          tags: [collectionTag],
           summary: `Change a ${labels.singular} password`,
           parameters: [
             {
@@ -3653,7 +3917,7 @@ function generateOpenApi(config) {
     if (collection.workflow) {
       spec.paths[`${path}/{id}/transitions/{transition}`] = {
         post: {
-          tags: ["Workflows"],
+          tags: [collectionTag],
           summary: `Transition ${labels.singular} workflow`,
           parameters: [
             {
@@ -3698,7 +3962,7 @@ function generateOpenApi(config) {
       };
       spec.paths[`${path}/{id}/workflow-history`] = {
         get: {
-          tags: ["Workflows"],
+          tags: [collectionTag],
           summary: `Get ${labels.singular} workflow history`,
           parameters: [
             {
@@ -3744,9 +4008,10 @@ function generateOpenApi(config) {
   for (const global of config.globals) {
     const slug = global.slug;
     const path = `/api/globals/${slug}`;
+    const globalTag = getGlobalTag(global);
     spec.paths[path] = {
       get: {
-        tags: ["Globals"],
+        tags: [globalTag],
         summary: `Get ${global.label || slug}`,
         responses: {
           200: {
@@ -3760,7 +4025,7 @@ function generateOpenApi(config) {
         }
       },
       patch: {
-        tags: ["Globals"],
+        tags: [globalTag],
         summary: `Update ${global.label || slug}`,
         requestBody: {
           required: true,
@@ -3784,7 +4049,7 @@ function generateOpenApi(config) {
     };
     spec.paths[`${path}/seed`] = {
       post: {
-        tags: ["Globals"],
+        tags: [globalTag],
         summary: `Seed ${global.label || slug}`,
         responses: { 200: { description: "Seeded global" } }
       }
@@ -3863,10 +4128,7 @@ function fieldToSchema(field) {
       break;
     case "url":
       schema = {
-        oneOf: [
-          { type: "string" },
-          { type: "object", additionalProperties: true }
-        ]
+        oneOf: [{ type: "string" }, { type: "object", additionalProperties: true }]
       };
       break;
     case "icon":
@@ -4061,6 +4323,7 @@ function serializeFieldForApi(f) {
   return serialized;
 }
 function registerRoutes(app, config) {
+  const optionsCache = /* @__PURE__ */ new Map();
   app.get("/api/schemas", optionalAuth(config), async (c) => {
     const siteId = c.req.header("X-Site-Id");
     let collections = [...config.collections];
@@ -4081,6 +4344,10 @@ function registerRoutes(app, config) {
     const serializeAccess = async (access) => {
       if (typeof access === "string") return access;
       if (typeof access === "boolean") return access;
+      if (access && typeof access === "object" && typeof access.policy === "string") {
+        const policy = config.accessPolicies?.[access.policy];
+        if (typeof policy === "string" || typeof policy === "boolean") return policy;
+      }
       return resolveBooleanAccess(config, access, accessArgs);
     };
     const filteredCollections = await Promise.all(collections.filter((col) => !siteId || col.shared || !col.siteId || col.siteId === siteId).map(async (col) => ({
@@ -4109,11 +4376,14 @@ function registerRoutes(app, config) {
         admin: f.admin,
         access: {
           read: await serializeAccess(f.access?.read),
+          create: await serializeAccess(f.access?.create),
           update: await serializeAccess(f.access?.update)
         }
       }))),
       upload: !!col.upload,
       auth: !!col.auth,
+      audit: !!col.audit,
+      drafts: !!col.drafts,
       admin: col.admin,
       workflow: col.workflow ? {
         initialState: col.workflow.initialState,
@@ -4216,10 +4486,12 @@ function registerRoutes(app, config) {
       return c.json({ error: true, message: `Field ${fieldName} not found in ${colSlug}` }, 404);
     }
     let resolver;
+    let cacheTTL;
     if (typeof field.options === "function") {
       resolver = field.options;
     } else if (field.options && typeof field.options === "object" && "resolve" in field.options) {
       resolver = field.options.resolve;
+      cacheTTL = field.options.cacheTTL;
     }
     if (!resolver) {
       return c.json({ error: true, message: `Field ${fieldName} in ${colSlug} is not dynamic` }, 400);
@@ -4232,11 +4504,32 @@ function registerRoutes(app, config) {
         headers: c.req.header(),
         raw: c.req.raw
       };
+      const shouldCache = typeof cacheTTL === "number" && cacheTTL > 0;
+      let cacheKey = "";
+      if (shouldCache) {
+        cacheKey = JSON.stringify([
+          siteId ?? "",
+          colSlug,
+          fieldName,
+          user?.id ?? null,
+          queryParams
+        ]);
+        const hit = optionsCache.get(cacheKey);
+        if (hit && hit.expires > Date.now()) {
+          return c.json(hit.value);
+        }
+      }
       const result = await resolver({
         db,
         user,
         req: reqContext
       });
+      if (shouldCache) {
+        optionsCache.set(cacheKey, {
+          expires: Date.now() + cacheTTL * 1e3,
+          value: result
+        });
+      }
       return c.json(result);
     } catch (err) {
       console.error(`[dyrected/core] Failed to resolve dynamic options for field ${fieldName}:`, err);
@@ -4381,6 +4674,7 @@ function registerRoutes(app, config) {
     app.post(`${path}/invite`, requireAuth(config), (c) => authController.invite(c));
     app.post(`${path}/accept-invite`, (c) => authController.acceptInvite(c));
   }
+  const auditController = new AuditController();
   for (const collection of config.collections) {
     const path = `/api/collections/${collection.slug}`;
     const controller = new CollectionController(collection);
@@ -4388,6 +4682,9 @@ function registerRoutes(app, config) {
     app.post(path, (c) => controller.create(c));
     app.post(`${path}/media`, (c) => controller.create(c));
     app.delete(`${path}/delete-many`, (c) => controller.deleteMany(c));
+    if (collection.audit) {
+      app.get(`${path}/__audit`, (c) => auditController.findForCollection(c, collection));
+    }
     app.get(`${path}/:id`, (c) => controller.findOne(c));
     app.patch(`${path}/:id`, (c) => controller.update(c));
     app.delete(`${path}/:id`, (c) => controller.delete(c));
@@ -4407,9 +4704,32 @@ function registerRoutes(app, config) {
     app.patch(path, (c) => controller.update(c));
     app.post(`${path}/seed`, (c) => controller.seed(c));
   }
+  if (!process.env.DYRECTED_JWT_SECRET) {
+    console.warn(
+      '[dyrected] DYRECTED_JWT_SECRET is not set \u2014 token-mode live preview is signing with an insecure default. Set DYRECTED_JWT_SECRET before relying on `previewMode: "token"` in production.'
+    );
+  }
   const previewController = new PreviewController();
   app.post("/api/preview-token", requireAuth(config), (c) => previewController.createToken(c));
   app.get("/api/preview-data", (c) => previewController.getData(c));
+  app.get("/api/audit", (c) => auditController.findAll(c));
+  app.get("/api/collections/:slug/__audit", async (c) => {
+    const slug = c.req.param("slug");
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const config2 = c.get("config");
+    if (config2.collections.some((col) => col.slug === slug)) {
+      return c.json({ message: "Not Found" }, 404);
+    }
+    if (!config2.onSchemaFetch || !siteId) {
+      return c.json({ message: `Collection "${slug}" not found` }, 404);
+    }
+    const dynamic = await config2.onSchemaFetch(siteId);
+    const collection = dynamic.collections?.find((col) => col.slug === slug);
+    if (!collection?.audit) {
+      return c.json({ message: `Collection "${slug}" not found or has no audit log` }, 404);
+    }
+    return auditController.findForCollection(c, collection);
+  });
   app.post("/api/collections/:slug/:id/transitions/:transition", requireAuth(config), async (c) => {
     const slug = c.req.param("slug");
     const siteId = c.req.header("X-Site-Id") || c.get("siteId");
@@ -4558,6 +4878,7 @@ var AUDIT_COLLECTION = {
     { name: "timestamp", type: "date", label: "Timestamp", required: true },
     { name: "changes", type: "json", label: "Changes" }
   ],
+  access: { read: () => false, create: () => false, update: () => false, delete: () => false },
   admin: { hidden: true }
 };
 var WORKFLOW_HISTORY_COLLECTION_CONFIG = {
@@ -4600,7 +4921,7 @@ function normalizeConfig(config) {
   const collections = config?.collections || [];
   const globals = config?.globals || [];
   const needsAudit = collections.some((col) => col.audit);
-  const needsWorkflow = collections.some((col) => col.workflow);
+  const needsWorkflow = collections.some((col) => col.workflow || col.drafts);
   const adminAuthCollectionSlug = getAdminAuthCollection({
     collections,
     adminAuth: config.adminAuth
@@ -4662,6 +4983,12 @@ function normalizeConfig(config) {
         if (field.name === "email") {
           return {
             ...field,
+            // Email is the login identifier. Keep the integrity constraints
+            // auth relies on even when the field is explicitly redefined, so a
+            // custom `email` field can never silently drop uniqueness.
+            required: true,
+            unique: true,
+            promoted: true,
             access: {
               ...field.access || {},
               update: "!id"
@@ -4671,6 +4998,9 @@ function normalizeConfig(config) {
         if (field.name === "password") {
           return {
             ...field,
+            // Password is required to authenticate; enforce it regardless of
+            // how the field was declared.
+            required: true,
             admin: { ...field.admin || {} },
             access: {
               ...field.access || {},
@@ -4726,8 +5056,10 @@ function normalizeConfig(config) {
     }
     const updatedFieldNames = new Set(fields.map((f) => f.name));
     const fieldsToInject = SYSTEM_FIELDS.filter((f) => !updatedFieldNames.has(f.name));
+    const workflow = col.workflow || (col.drafts ? simplePublishingWorkflow() : void 0);
     return {
       ...col,
+      workflow,
       fields: [...fields, ...fieldsToInject]
     };
   });