@dyrected/core 2.5.60 → 2.5.61

package/dist/chunk-35NM2WPO.js

@@ -0,0 +1,1658 @@
+// src/workflows.ts
+var WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
+var LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
+function publishingWorkflow() {
+  return {
+    initialState: "draft",
+    draftState: "draft",
+    states: [
+      { name: "draft", label: "Draft", color: "neutral" },
+      { name: "in_review", label: "In review", color: "warning" },
+      { name: "published", label: "Published", color: "success", published: true }
+    ],
+    transitions: [
+      { name: "submit", label: "Submit for review", from: "draft", to: "in_review", requiredCapabilities: ["entry.submit"] },
+      { name: "publish", label: "Publish", from: "in_review", to: "published", requiredCapabilities: ["entry.publish"] },
+      { name: "reject", label: "Request changes", from: "in_review", to: "draft", requiredCapabilities: ["entry.publish"], requireComment: true },
+      { name: "unpublish", label: "Unpublish", from: "published", to: "draft", requiredCapabilities: ["entry.unpublish"], unpublish: true }
+    ],
+    roles: [
+      { role: "editor", capabilities: ["entry.edit", "entry.submit"] },
+      { role: "publisher", capabilities: ["entry.edit", "entry.submit", "entry.publish", "entry.unpublish"] },
+      { role: "admin", capabilities: ["entry.edit", "entry.submit", "entry.publish", "entry.unpublish"] }
+    ]
+  };
+}
+function simplePublishingWorkflow() {
+  return {
+    initialState: "draft",
+    draftState: "draft",
+    states: [
+      { name: "draft", label: "Draft", color: "neutral" },
+      { name: "published", label: "Published", color: "success", published: true }
+    ],
+    transitions: [
+      { name: "publish", label: "Publish", from: "draft", to: "published" },
+      { name: "unpublish", label: "Unpublish", from: "published", to: "draft", unpublish: true }
+    ]
+  };
+}
+function publicMetadata(meta) {
+  const { availableTransitions: _availableTransitions, ...safe } = meta;
+  return safe;
+}
+function workflowCapabilities(workflow, user) {
+  const capabilities = new Set(Array.isArray(user?.capabilities) ? user.capabilities : []);
+  const roles = Array.isArray(user?.roles) ? user.roles : [];
+  for (const mapping of workflow.roles ?? []) {
+    if (roles.includes(mapping.role)) mapping.capabilities.forEach((capability) => capabilities.add(capability));
+  }
+  return capabilities;
+}
+function canViewWorkflowDraft(workflow, user) {
+  if (!user) return false;
+  const capabilities = workflowCapabilities(workflow, user);
+  if (capabilities.has("entry.edit")) return true;
+  return workflow.transitions.some(
+    (transition) => (transition.requiredCapabilities ?? []).some((capability) => capabilities.has(capability))
+  );
+}
+function availableWorkflowTransitions(workflow, state, user) {
+  const capabilities = workflowCapabilities(workflow, user);
+  return workflow.transitions.filter((transition) => {
+    const from = Array.isArray(transition.from) ? transition.from : [transition.from];
+    return from.includes(state) && (transition.requiredCapabilities ?? []).every((item) => capabilities.has(item));
+  });
+}
+function initializeWorkflowDocument(data, workflow) {
+  return {
+    ...data,
+    __workflow: { state: workflow.initialState, revision: 1 }
+  };
+}
+function publishedStateName(workflow) {
+  return workflow.states.find((state) => state.published)?.name ?? workflow.states[workflow.states.length - 1]?.name ?? workflow.initialState;
+}
+function materializeWorkflowDocument(doc, workflow, user) {
+  const meta = doc.__workflow;
+  if (!meta) {
+    const { __published: _legacyPublished, __workflow: _legacyWorkflow, ...working2 } = doc;
+    const state = publishedStateName(workflow);
+    return {
+      ...working2,
+      _workflow: {
+        state,
+        revision: 1,
+        availableTransitions: availableWorkflowTransitions(workflow, state, user).map((item) => item.name)
+      }
+    };
+  }
+  const { __published, __workflow, ...working } = doc;
+  if (!canViewWorkflowDraft(workflow, user)) {
+    if (!__published || typeof __published !== "object") return null;
+    return { id: doc.id, ...__published, _workflow: publicMetadata(meta) };
+  }
+  return {
+    ...working,
+    _workflow: {
+      ...meta,
+      availableTransitions: availableWorkflowTransitions(workflow, meta.state, user).map((item) => item.name)
+    }
+  };
+}
+function eventId() {
+  return globalThis.crypto?.randomUUID?.() ?? `evt_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+}
+function createLifecycleEvent(args) {
+  return {
+    id: eventId(),
+    name: args.name,
+    collection: args.collection,
+    documentId: args.documentId,
+    occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+    actorId: args.actorId,
+    payload: args.payload,
+    attempts: 0,
+    status: "pending"
+  };
+}
+async function persistEvent(db, event) {
+  await db.create({ collection: LIFECYCLE_EVENTS_COLLECTION, data: event });
+}
+async function dispatchLifecycleEvent(config, event) {
+  const db = config.db;
+  if (!db || !config.events?.handlers.length) return;
+  const maxAttempts = config.events.maxAttempts ?? 8;
+  const retryDelayMs = config.events.retryDelayMs ?? 1e3;
+  const attempts = event.attempts + 1;
+  try {
+    await db.update({ collection: LIFECYCLE_EVENTS_COLLECTION, id: event.id, data: { status: "processing", attempts } });
+    for (const handler of config.events.handlers) await handler({ ...event, status: "processing", attempts });
+    await db.update({
+      collection: LIFECYCLE_EVENTS_COLLECTION,
+      id: event.id,
+      data: { status: "delivered", attempts, deliveredAt: (/* @__PURE__ */ new Date()).toISOString(), lastError: null }
+    });
+  } catch (error) {
+    const exhausted = attempts >= maxAttempts;
+    await db.update({
+      collection: LIFECYCLE_EVENTS_COLLECTION,
+      id: event.id,
+      data: {
+        status: "failed",
+        attempts,
+        lastError: error instanceof Error ? error.message : String(error),
+        nextAttemptAt: exhausted ? null : new Date(Date.now() + retryDelayMs * 2 ** (attempts - 1)).toISOString()
+      }
+    });
+  }
+}
+async function dispatchPendingLifecycleEvents(config, limit = 50) {
+  if (!config.db || !config.events?.handlers.length) return 0;
+  const maxAttempts = config.events.maxAttempts ?? 8;
+  const result = await config.db.find({
+    collection: LIFECYCLE_EVENTS_COLLECTION,
+    where: { status: { in: ["pending", "failed"] } },
+    sort: "occurredAt",
+    limit
+  });
+  const now = Date.now();
+  const due = result.docs.filter(
+    (doc) => Number(doc.attempts ?? 0) < maxAttempts && (!doc.nextAttemptAt || new Date(doc.nextAttemptAt).getTime() <= now)
+  );
+  for (const event of due) await dispatchLifecycleEvent(config, event);
+  return due.length;
+}
+async function saveWorkflowDraft(args) {
+  const { config, collection, id, originalDoc, data, user } = args;
+  const db = config.db;
+  const workflow = collection.workflow;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  const previous = originalDoc.__workflow;
+  const event = createLifecycleEvent({
+    name: "revision.created",
+    collection: collection.slug,
+    documentId: id,
+    actorId: user?.sub,
+    payload: { revision: previous.revision + 1, previousRevision: previous.revision }
+  });
+  const doc = await db.transaction(async (tx) => {
+    const nextMeta = {
+      ...previous,
+      state: originalDoc.__published ? workflow.draftState ?? workflow.initialState : previous.state,
+      revision: previous.revision + 1
+    };
+    const updated = await tx.update({ collection: collection.slug, id, data: { ...data, __workflow: nextMeta } });
+    await persistEvent(tx, event);
+    return updated;
+  });
+  void dispatchLifecycleEvent(config, event);
+  return { doc, event };
+}
+async function createWorkflowDocument(args) {
+  const { config, collection, data, user } = args;
+  const db = config.db;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  let event;
+  const doc = await db.transaction(async (tx) => {
+    const created = await tx.create({ collection: collection.slug, data });
+    event = createLifecycleEvent({
+      name: "revision.created",
+      collection: collection.slug,
+      documentId: created.id,
+      actorId: user?.sub,
+      payload: { revision: 1, previousRevision: null }
+    });
+    await persistEvent(tx, event);
+    return created;
+  });
+  void dispatchLifecycleEvent(config, event);
+  return { doc, event };
+}
+async function transitionWorkflow(args) {
+  const { config, collection, id, transitionName, expectedRevision, comment, user, req } = args;
+  const db = config.db;
+  const workflow = collection.workflow;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  const original = await db.findOne({ collection: collection.slug, id });
+  if (!original) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
+  const meta = original.__workflow;
+  if (!meta) throw Object.assign(new Error("Entry has no workflow metadata"), { statusCode: 409 });
+  if (expectedRevision !== void 0 && expectedRevision !== meta.revision) {
+    throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
+  }
+  const transition = workflow.transitions.find((item) => item.name === transitionName);
+  const fromStates = transition ? Array.isArray(transition.from) ? transition.from : [transition.from] : [];
+  if (!transition || !fromStates.includes(meta.state)) {
+    throw Object.assign(new Error(`Transition "${transitionName}" is not valid from "${meta.state}".`), { statusCode: 409 });
+  }
+  if (!availableWorkflowTransitions(workflow, meta.state, user).some((item) => item.name === transition.name)) {
+    throw Object.assign(new Error(`You do not have permission to perform "${transition.label}".`), { statusCode: 403 });
+  }
+  if (transition.requireComment && !comment?.trim()) {
+    throw Object.assign(new Error(`A comment is required for "${transition.label}".`), { statusCode: 400 });
+  }
+  const hookContext = { transition, from: meta.state, to: transition.to, doc: original, user, comment, req, db };
+  for (const hook of workflow.hooks?.beforeTransition ?? []) await hook(hookContext);
+  const events = [createLifecycleEvent({
+    name: "workflow.transitioned",
+    collection: collection.slug,
+    documentId: id,
+    actorId: user?.sub,
+    payload: { transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision, comment }
+  })];
+  const targetState = workflow.states.find((state) => state.name === transition.to);
+  if (targetState.published) {
+    events.push(createLifecycleEvent({ name: "entry.published", collection: collection.slug, documentId: id, actorId: user?.sub, payload: { revision: meta.revision } }));
+  } else if (transition.unpublish) {
+    events.push(createLifecycleEvent({ name: "entry.unpublished", collection: collection.slug, documentId: id, actorId: user?.sub, payload: { revision: meta.publishedRevision } }));
+  }
+  const updated = await db.transaction(async (tx) => {
+    const locked = await tx.findOne({ collection: collection.slug, id });
+    if (!locked) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
+    const lockedMeta = locked.__workflow;
+    if (lockedMeta.revision !== meta.revision || lockedMeta.state !== meta.state || expectedRevision !== void 0 && lockedMeta.revision !== expectedRevision) {
+      throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const { __published: _published, __workflow: _workflow, id: _id, ...working } = locked;
+    const nextMeta = {
+      ...lockedMeta,
+      state: transition.to,
+      ...targetState.published ? { publishedRevision: lockedMeta.revision, publishedAt: now, publishedBy: user?.sub } : {},
+      ...transition.unpublish ? { publishedRevision: void 0, publishedAt: void 0, publishedBy: void 0 } : {}
+    };
+    const data = { __workflow: nextMeta };
+    if (targetState.published) data.__published = working;
+    if (transition.unpublish) data.__published = null;
+    const next = await tx.update({ collection: collection.slug, id, data });
+    await tx.create({
+      collection: WORKFLOW_HISTORY_COLLECTION,
+      data: { collection: collection.slug, documentId: id, transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision, comment: comment ?? null, actorId: user?.sub ?? null, createdAt: now }
+    });
+    for (const event of events) await persistEvent(tx, event);
+    if (collection.audit) {
+      await tx.create({ collection: "__audit", data: { collection: collection.slug, documentId: id, operation: "workflow.transition", user: user?.sub ?? null, timestamp: now, changes: JSON.stringify({ transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision }) } });
+    }
+    return next;
+  });
+  for (const event of events) void dispatchLifecycleEvent(config, event);
+  for (const hook of workflow.hooks?.afterTransition ?? []) {
+    try {
+      await hook({ ...hookContext, doc: updated, event: events[0] });
+    } catch (error) {
+      console.error("[dyrected/workflow] afterTransition hook failed:", error);
+    }
+  }
+  return updated;
+}
+
+// src/utils/admin-auth.ts
+function getAdminAuthCollection(config) {
+  const adminCollection = resolveAdminAuthCollection(config.collections, config.adminAuth?.collectionSlug);
+  return adminCollection ?? null;
+}
+function resolveAdminAuthCollection(collections, collectionSlug) {
+  const adminsCollection = collections.find((collection) => collection.slug === "__admins");
+  if (adminsCollection) return adminsCollection;
+  if (collectionSlug) {
+    const requestedCollection = collections.find((collection) => collection.slug === collectionSlug);
+    if (requestedCollection) return requestedCollection;
+  }
+  return collections.find((collection) => collection.auth);
+}
+function getPublicAdminAuthConfig(adminAuth, collections) {
+  const providers = (adminAuth?.providers ?? []).map((provider) => ({
+    id: provider.id,
+    type: provider.type,
+    displayName: provider.displayName || humanizeProviderName(provider.id, provider.type),
+    autoRedirect: provider.autoRedirect
+  }));
+  const resolvedCollectionSlug = collections ? resolveAdminAuthCollection(collections, adminAuth?.collectionSlug)?.slug : adminAuth?.collectionSlug;
+  return {
+    mode: adminAuth?.mode ?? "local",
+    collectionSlug: resolvedCollectionSlug,
+    provisioningMode: adminAuth?.provisioningMode,
+    providers
+  };
+}
+function humanizeProviderName(id, type) {
+  const cleaned = id.replace(/[-_]+/g, " ").trim();
+  if (!cleaned) return type.toUpperCase();
+  return cleaned.replace(/\b\w/g, (char) => char.toUpperCase());
+}
+
+// src/utils/config.ts
+var AUDIT_COLLECTION_SLUG = "__audit";
+var SYSTEM_FIELDS = [
+  {
+    name: "createdAt",
+    type: "date",
+    label: "Created At",
+    admin: { readOnly: true, hidden: true }
+  },
+  {
+    name: "updatedAt",
+    type: "date",
+    label: "Updated At",
+    admin: { readOnly: true, hidden: true }
+  },
+  {
+    name: "createdBy",
+    type: "text",
+    label: "Created By",
+    admin: { readOnly: true, hidden: true }
+  },
+  {
+    name: "updatedBy",
+    type: "text",
+    label: "Updated By",
+    admin: { readOnly: true, hidden: true }
+  }
+];
+var AUDIT_COLLECTION = {
+  slug: AUDIT_COLLECTION_SLUG,
+  labels: { singular: "Audit Log", plural: "Audit Logs" },
+  fields: [
+    { name: "collection", type: "text", label: "Collection", required: true },
+    { name: "documentId", type: "text", label: "Document ID" },
+    { name: "operation", type: "select", label: "Operation", options: ["create", "update", "delete"], required: true },
+    { name: "user", type: "text", label: "User ID" },
+    { name: "timestamp", type: "date", label: "Timestamp", required: true },
+    { name: "changes", type: "json", label: "Changes" }
+  ],
+  access: { read: () => false, create: () => false, update: () => false, delete: () => false },
+  admin: { hidden: true }
+};
+var WORKFLOW_HISTORY_COLLECTION_CONFIG = {
+  slug: WORKFLOW_HISTORY_COLLECTION,
+  labels: { singular: "Workflow transition", plural: "Workflow transitions" },
+  fields: [
+    { name: "collection", type: "text", required: true },
+    { name: "documentId", type: "text", required: true },
+    { name: "transition", type: "text", required: true },
+    { name: "from", type: "text", required: true },
+    { name: "to", type: "text", required: true },
+    { name: "revision", type: "number", required: true },
+    { name: "comment", type: "textarea" },
+    { name: "actorId", type: "text" },
+    { name: "createdAt", type: "date", required: true }
+  ],
+  access: { read: ({ user }) => !!user, create: () => false, update: () => false, delete: () => false },
+  admin: { hidden: true }
+};
+var LIFECYCLE_EVENTS_COLLECTION_CONFIG = {
+  slug: LIFECYCLE_EVENTS_COLLECTION,
+  labels: { singular: "Lifecycle event", plural: "Lifecycle events" },
+  fields: [
+    { name: "name", type: "text", required: true },
+    { name: "collection", type: "text", required: true },
+    { name: "documentId", type: "text", required: true },
+    { name: "occurredAt", type: "date", required: true },
+    { name: "actorId", type: "text" },
+    { name: "payload", type: "json", required: true },
+    { name: "attempts", type: "number", required: true },
+    { name: "status", type: "select", options: ["pending", "processing", "delivered", "failed"], required: true },
+    { name: "nextAttemptAt", type: "date" },
+    { name: "deliveredAt", type: "date" },
+    { name: "lastError", type: "textarea" }
+  ],
+  access: { read: ({ user }) => !!user?.roles?.includes("admin"), create: () => false, update: () => false, delete: () => false },
+  admin: { hidden: true }
+};
+function normalizeConfig(config) {
+  const collections = config?.collections || [];
+  const globals = config?.globals || [];
+  const needsAudit = collections.some((col) => col.audit);
+  const needsWorkflow = collections.some((col) => col.workflow || col.drafts);
+  const adminAuthCollectionSlug = getAdminAuthCollection({
+    collections,
+    adminAuth: config.adminAuth
+  })?.slug;
+  const normalizedCollections = collections.map((col) => {
+    let fields = col.fields || [];
+    const existingFieldNames = new Set(fields.map((f) => f.name));
+    if (col.auth) {
+      if (!existingFieldNames.has("email")) {
+        fields = [
+          ...fields,
+          {
+            name: "email",
+            type: "email",
+            label: "Email",
+            required: true,
+            unique: true,
+            promoted: true,
+            access: {
+              update: "!id"
+            }
+          }
+        ];
+      }
+      if (!existingFieldNames.has("password")) {
+        fields = [
+          ...fields,
+          {
+            name: "password",
+            type: "text",
+            label: "Password",
+            required: true,
+            access: {
+              update: "!id || user.id == id"
+            }
+          }
+        ];
+      }
+      if (!existingFieldNames.has("roles")) {
+        fields = [
+          ...fields,
+          {
+            name: "roles",
+            type: "select",
+            label: "Roles",
+            defaultValue: [],
+            options: [
+              { value: "admin", label: "Admin" },
+              { value: "editor", label: "Editor" },
+              { value: "viewer", label: "Viewer" }
+            ],
+            access: {
+              update: "user.roles && 'admin' in user.roles"
+            }
+          }
+        ];
+      }
+      fields = fields.map((field) => {
+        if (field.name === "email") {
+          return {
+            ...field,
+            // Email is the login identifier. Keep the integrity constraints
+            // auth relies on even when the field is explicitly redefined, so a
+            // custom `email` field can never silently drop uniqueness.
+            required: true,
+            unique: true,
+            promoted: true,
+            access: {
+              ...field.access || {},
+              update: "!id"
+            }
+          };
+        }
+        if (field.name === "password") {
+          return {
+            ...field,
+            // Password is required to authenticate; enforce it regardless of
+            // how the field was declared.
+            required: true,
+            admin: { ...field.admin || {} },
+            access: {
+              ...field.access || {},
+              update: "!id || user.id == id"
+            }
+          };
+        }
+        if (field.name === "roles") {
+          return {
+            ...field,
+            access: {
+              ...field.access || {},
+              // Must be an admin; cannot edit own roles (no self-elevation).
+              update: "user.roles && 'admin' in user.roles && user.id != id"
+            }
+          };
+        }
+        return field;
+      });
+    }
+    if (adminAuthCollectionSlug && col.slug === adminAuthCollectionSlug && config.adminAuth?.mode === "external") {
+      const externalAdminFields = [
+        {
+          name: "authProvider",
+          type: "text",
+          label: "Auth Provider",
+          admin: { readOnly: true, hidden: true }
+        },
+        {
+          name: "externalSubject",
+          type: "text",
+          label: "External Subject",
+          admin: { readOnly: true, hidden: true }
+        },
+        {
+          name: "authSource",
+          type: "text",
+          label: "Auth Source",
+          admin: { readOnly: true, hidden: true }
+        },
+        {
+          name: "lastLoginAt",
+          type: "date",
+          label: "Last Login At",
+          admin: { readOnly: true, hidden: true }
+        }
+      ];
+      for (const field of externalAdminFields) {
+        if (!existingFieldNames.has(field.name)) {
+          fields = [...fields, field];
+        }
+      }
+    }
+    const updatedFieldNames = new Set(fields.map((f) => f.name));
+    const fieldsToInject = SYSTEM_FIELDS.filter((f) => !updatedFieldNames.has(f.name));
+    const workflow = col.workflow || (col.drafts ? simplePublishingWorkflow() : void 0);
+    return {
+      ...col,
+      workflow,
+      fields: [...fields, ...fieldsToInject]
+    };
+  });
+  const hasAuditCollection = normalizedCollections.some((col) => col.slug === AUDIT_COLLECTION_SLUG);
+  const systemCollections = [];
+  if (needsAudit && !hasAuditCollection) systemCollections.push(AUDIT_COLLECTION);
+  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === WORKFLOW_HISTORY_COLLECTION)) {
+    systemCollections.push(WORKFLOW_HISTORY_COLLECTION_CONFIG);
+  }
+  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === LIFECYCLE_EVENTS_COLLECTION)) {
+    systemCollections.push(LIFECYCLE_EVENTS_COLLECTION_CONFIG);
+  }
+  return {
+    ...config,
+    collections: [...normalizedCollections, ...systemCollections],
+    globals
+  };
+}
+
+// src/utils/hooks.ts
+async function runCollectionHooks(hooks, args, options = {}) {
+  if (!hooks || hooks.length === 0) {
+    return args.data ?? args.doc ?? void 0;
+  }
+  let currentPayload = args.data ?? args.doc ?? void 0;
+  for (const hook of hooks) {
+    try {
+      const result = await hook({
+        ...args,
+        data: args.data !== void 0 ? currentPayload : void 0,
+        doc: args.doc !== void 0 ? currentPayload : void 0
+      });
+      if (result !== void 0) {
+        currentPayload = result;
+      }
+    } catch (err) {
+      if (options.isolated) {
+        console.error("[dyrected/core] Side-effect hook failed (error isolated \u2014 DB write was successful):", err);
+      } else {
+        throw err;
+      }
+    }
+  }
+  return currentPayload;
+}
+async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
+  if (!data || typeof data !== "object") return data;
+  const result = { ...data };
+  for (const field of fields) {
+    if (!field.name) continue;
+    const value = result[field.name];
+    const origValue = originalDoc?.[field.name];
+    let updatedValue = value;
+    if (field.hooks?.beforeChange) {
+      for (const hook of field.hooks.beforeChange) {
+        const typedHook = hook;
+        const hookArgs = {
+          value: updatedValue,
+          originalDoc: originalDoc ?? void 0,
+          data: result,
+          user,
+          db
+        };
+        updatedValue = await typedHook(hookArgs);
+      }
+      result[field.name] = updatedValue;
+    }
+    if (updatedValue !== void 0 && updatedValue !== null) {
+      if (field.type === "object" && field.fields) {
+        result[field.name] = await executeFieldBeforeChange(
+          field.fields,
+          updatedValue,
+          origValue,
+          user,
+          db
+        );
+      } else if (field.type === "array" && field.fields && Array.isArray(updatedValue)) {
+        const arrayResult = [];
+        for (let i = 0; i < updatedValue.length; i++) {
+          const item = updatedValue[i];
+          const origItem = Array.isArray(origValue) ? origValue[i] : null;
+          arrayResult.push(
+            await executeFieldBeforeChange(field.fields, item, origItem, user, db)
+          );
+        }
+        result[field.name] = arrayResult;
+      } else if (field.type === "blocks" && field.blocks && Array.isArray(updatedValue)) {
+        const blocksResult = [];
+        for (let i = 0; i < updatedValue.length; i++) {
+          const blockData = updatedValue[i];
+          const origBlock = Array.isArray(origValue) ? origValue[i] : null;
+          const blockConfig = field.blocks.find(
+            (b) => b.slug === blockData.blockType
+          );
+          if (blockConfig) {
+            blocksResult.push(
+              await executeFieldBeforeChange(
+                blockConfig.fields,
+                blockData,
+                origBlock,
+                user,
+                db
+              )
+            );
+          } else {
+            blocksResult.push(blockData);
+          }
+        }
+        result[field.name] = blocksResult;
+      }
+    }
+  }
+  return result;
+}
+async function executeFieldAfterRead(fields, doc, user, db) {
+  if (!doc || typeof doc !== "object") return doc;
+  const result = { ...doc };
+  for (const field of fields) {
+    if (!field.name) continue;
+    const value = result[field.name];
+    let updatedValue = value;
+    if (field.hooks?.afterRead) {
+      for (const hook of field.hooks.afterRead) {
+        const typedHook = hook;
+        const hookArgs = {
+          value: updatedValue,
+          doc: result,
+          user,
+          db
+        };
+        updatedValue = await typedHook(hookArgs);
+      }
+      result[field.name] = updatedValue;
+    }
+    if (updatedValue !== void 0 && updatedValue !== null) {
+      if (field.type === "object" && field.fields) {
+        result[field.name] = await executeFieldAfterRead(
+          field.fields,
+          updatedValue,
+          user,
+          db
+        );
+      } else if (field.type === "array" && field.fields && Array.isArray(updatedValue)) {
+        const arrayResult = [];
+        for (const item of updatedValue) {
+          arrayResult.push(
+            await executeFieldAfterRead(
+              field.fields,
+              item,
+              user,
+              db
+            )
+          );
+        }
+        result[field.name] = arrayResult;
+      } else if (field.type === "blocks" && field.blocks && Array.isArray(updatedValue)) {
+        const blocksResult = [];
+        for (const blockData of updatedValue) {
+          const typedBlock = blockData;
+          const blockConfig = field.blocks.find(
+            (b) => b.slug === typedBlock.blockType
+          );
+          if (blockConfig) {
+            blocksResult.push(
+              await executeFieldAfterRead(
+                blockConfig.fields,
+                typedBlock,
+                user,
+                db
+              )
+            );
+          } else {
+            blocksResult.push(blockData);
+          }
+        }
+        result[field.name] = blocksResult;
+      }
+    }
+  }
+  return result;
+}
+
+// src/utils/openapi.ts
+function getCollectionLabels(collection) {
+  return collection.labels || { singular: collection.slug, plural: collection.slug };
+}
+function getCollectionTag(collection) {
+  return `Collection: ${getCollectionLabels(collection).plural}`;
+}
+function getGlobalTag(global) {
+  return `Global: ${global.label || global.slug}`;
+}
+function generateOpenApi(config) {
+  const spec = {
+    openapi: "3.0.0",
+    info: {
+      title: "Dyrected API",
+      version: "1.0.0",
+      description: "Automatically generated OpenAPI specification for the Dyrected project."
+    },
+    components: {
+      schemas: {
+        WorkflowMetadata: {
+          type: "object",
+          required: ["state", "revision"],
+          properties: {
+            state: { type: "string" },
+            revision: { type: "integer", minimum: 1 },
+            publishedRevision: { type: "integer", minimum: 1 },
+            publishedAt: { type: "string", format: "date-time" },
+            publishedBy: { type: "string" },
+            availableTransitions: { type: "array", items: { type: "string" } }
+          }
+        },
+        WorkflowTransitionRequest: {
+          type: "object",
+          properties: {
+            expectedRevision: { type: "integer", minimum: 1 },
+            comment: { type: "string" }
+          }
+        },
+        WorkflowHistoryEntry: {
+          type: "object",
+          required: ["collection", "documentId", "transition", "from", "to", "revision", "createdAt"],
+          properties: {
+            id: { type: "string" },
+            collection: { type: "string" },
+            documentId: { type: "string" },
+            transition: { type: "string" },
+            from: { type: "string" },
+            to: { type: "string" },
+            revision: { type: "integer" },
+            comment: { type: "string", nullable: true },
+            actorId: { type: "string", nullable: true },
+            createdAt: { type: "string", format: "date-time" }
+          }
+        },
+        AuditEntry: {
+          type: "object",
+          required: ["collection", "operation", "timestamp"],
+          properties: {
+            id: { type: "string" },
+            collection: { type: "string" },
+            documentId: { type: "string", nullable: true },
+            operation: { type: "string" },
+            user: { type: "string", nullable: true },
+            timestamp: { type: "string", format: "date-time" },
+            changes: {
+              oneOf: [{ type: "string" }, { type: "object", additionalProperties: true }, { type: "null" }]
+            }
+          }
+        },
+        Error: {
+          type: "object",
+          properties: {
+            message: { type: "string" },
+            errors: {
+              type: "array",
+              items: { type: "object", additionalProperties: true }
+            }
+          }
+        },
+        AuthCredentials: {
+          type: "object",
+          required: ["email", "password"],
+          properties: {
+            email: { type: "string", format: "email" },
+            password: { type: "string" }
+          }
+        },
+        TokenResponse: {
+          type: "object",
+          properties: {
+            token: { type: "string" },
+            user: { type: "object", additionalProperties: true }
+          }
+        }
+      },
+      securitySchemes: {
+        ApiKeyAuth: {
+          type: "apiKey",
+          in: "header",
+          name: "x-api-key"
+        }
+      }
+    },
+    paths: {},
+    security: [{ ApiKeyAuth: [] }]
+  };
+  spec.paths["/api/schemas"] = {
+    get: {
+      tags: ["System"],
+      summary: "Get the serialized Dyrected schema",
+      security: [],
+      responses: {
+        200: { description: "Collection and global schema definitions" }
+      }
+    }
+  };
+  spec.paths["/api/openapi.json"] = {
+    get: {
+      tags: ["System"],
+      summary: "Get the OpenAPI specification",
+      security: [],
+      responses: { 200: { description: "OpenAPI 3.0 document" } }
+    }
+  };
+  spec.paths["/api/docs"] = {
+    get: {
+      tags: ["System"],
+      summary: "Open interactive API documentation",
+      security: [],
+      responses: { 200: { description: "Swagger UI HTML" } }
+    }
+  };
+  spec.paths["/api/dyrected/options/{collection}/{field}"] = {
+    get: {
+      tags: ["System"],
+      summary: "Resolve dynamic field options",
+      parameters: [
+        {
+          name: "collection",
+          in: "path",
+          required: true,
+          schema: { type: "string" }
+        },
+        {
+          name: "field",
+          in: "path",
+          required: true,
+          schema: { type: "string" }
+        }
+      ],
+      responses: { 200: { description: "Resolved option items" } }
+    }
+  };
+  spec.paths["/api/preferences/{key}"] = {
+    get: {
+      tags: ["Preferences"],
+      summary: "Get an authenticated user preference",
+      parameters: [{ name: "key", in: "path", required: true, schema: { type: "string" } }],
+      responses: { 200: { description: "Preference value" } }
+    },
+    put: {
+      tags: ["Preferences"],
+      summary: "Set an authenticated user preference",
+      parameters: [{ name: "key", in: "path", required: true, schema: { type: "string" } }],
+      requestBody: {
+        required: true,
+        content: { "application/json": { schema: { type: "object" } } }
+      },
+      responses: { 200: { description: "Updated preference" } }
+    }
+  };
+  spec.paths["/api/preview-token"] = {
+    post: {
+      tags: ["Preview"],
+      summary: "Create a preview token",
+      responses: { 200: { description: "Short-lived preview token" } }
+    }
+  };
+  spec.paths["/api/preview-data"] = {
+    get: {
+      tags: ["Preview"],
+      summary: "Resolve preview data from a token",
+      security: [],
+      parameters: [
+        {
+          name: "token",
+          in: "query",
+          required: true,
+          schema: { type: "string" }
+        }
+      ],
+      responses: { 200: { description: "Preview document data" } }
+    }
+  };
+  spec.paths["/api/audit"] = {
+    get: {
+      tags: ["Audit"],
+      summary: "Get audit entries across all readable audited collections",
+      parameters: [
+        { name: "limit", in: "query", schema: { type: "integer", default: 50, maximum: 100 } },
+        { name: "page", in: "query", schema: { type: "integer", default: 1 } },
+        { name: "where", in: "query", schema: { type: "string" }, description: "JSON filter" },
+        { name: "sort", in: "query", schema: { type: "string", default: "-timestamp" } }
+      ],
+      responses: {
+        200: {
+          description: "Audit entries",
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                properties: {
+                  docs: {
+                    type: "array",
+                    items: { $ref: "#/components/schemas/AuditEntry" }
+                  },
+                  total: { type: "integer" },
+                  limit: { type: "integer" },
+                  page: { type: "integer" }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  };
+  for (const collection of config.collections) {
+    spec.components.schemas[collection.slug] = collectionToSchema(collection);
+  }
+  for (const global of config.globals) {
+    spec.components.schemas[global.slug] = globalToSchema(global);
+  }
+  for (const collection of config.collections) {
+    const slug = collection.slug;
+    const path = `/api/collections/${slug}`;
+    const labels = getCollectionLabels(collection);
+    const collectionTag = getCollectionTag(collection);
+    spec.paths[path] = {
+      get: {
+        tags: [collectionTag],
+        summary: `Find ${labels.plural}`,
+        parameters: [
+          {
+            name: "limit",
+            in: "query",
+            schema: { type: "integer", default: 10 }
+          },
+          {
+            name: "page",
+            in: "query",
+            schema: { type: "integer", default: 1 }
+          },
+          {
+            name: "where",
+            in: "query",
+            schema: { type: "string" },
+            description: "JSON filter"
+          },
+          {
+            name: "sort",
+            in: "query",
+            schema: { type: "string" },
+            description: "Sort field (e.g. -createdAt)"
+          }
+        ],
+        responses: {
+          200: {
+            description: "Success",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    docs: {
+                      type: "array",
+                      items: { $ref: `#/components/schemas/${slug}` }
+                    },
+                    total: { type: "integer" },
+                    limit: { type: "integer" },
+                    page: { type: "integer" }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      post: {
+        tags: [collectionTag],
+        summary: `Create ${labels.singular}`,
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: { $ref: `#/components/schemas/${slug}` }
+            }
+          }
+        },
+        responses: {
+          201: {
+            description: "Created",
+            content: {
+              "application/json": {
+                schema: { $ref: `#/components/schemas/${slug}` }
+              }
+            }
+          }
+        }
+      }
+    };
+    spec.paths[`${path}/{id}`] = {
+      get: {
+        tags: [collectionTag],
+        summary: `Get a single ${labels.singular}`,
+        parameters: [
+          {
+            name: "id",
+            in: "path",
+            required: true,
+            schema: { type: "string" }
+          }
+        ],
+        responses: {
+          200: {
+            description: "Success",
+            content: {
+              "application/json": {
+                schema: { $ref: `#/components/schemas/${slug}` }
+              }
+            }
+          }
+        }
+      },
+      patch: {
+        tags: [collectionTag],
+        summary: `Update ${labels.singular}`,
+        parameters: [
+          {
+            name: "id",
+            in: "path",
+            required: true,
+            schema: { type: "string" }
+          }
+        ],
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: { $ref: `#/components/schemas/${slug}` }
+            }
+          }
+        },
+        responses: {
+          200: {
+            description: "Updated",
+            content: {
+              "application/json": {
+                schema: { $ref: `#/components/schemas/${slug}` }
+              }
+            }
+          }
+        }
+      },
+      delete: {
+        tags: [collectionTag],
+        summary: `Delete ${labels.singular}`,
+        parameters: [
+          {
+            name: "id",
+            in: "path",
+            required: true,
+            schema: { type: "string" }
+          }
+        ],
+        responses: {
+          204: { description: "Deleted" }
+        }
+      }
+    };
+    spec.paths[`${path}/delete-many`] = {
+      delete: {
+        tags: [collectionTag],
+        summary: `Delete multiple ${labels.plural}`,
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                required: ["ids"],
+                properties: {
+                  ids: { type: "array", items: { type: "string" } }
+                }
+              }
+            }
+          }
+        },
+        responses: { 200: { description: "Deleted and failed document IDs" } }
+      }
+    };
+    if (collection.audit) {
+      spec.paths[`${path}/__audit`] = {
+        get: {
+          tags: [collectionTag],
+          summary: `Get ${labels.singular} audit entries`,
+          parameters: [
+            { name: "limit", in: "query", schema: { type: "integer", default: 50, maximum: 100 } },
+            { name: "page", in: "query", schema: { type: "integer", default: 1 } },
+            { name: "where", in: "query", schema: { type: "string" }, description: "JSON filter" },
+            { name: "sort", in: "query", schema: { type: "string", default: "-timestamp" } }
+          ],
+          responses: {
+            200: {
+              description: "Audit entries for this collection",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    properties: {
+                      docs: {
+                        type: "array",
+                        items: { $ref: "#/components/schemas/AuditEntry" }
+                      },
+                      total: { type: "integer" },
+                      limit: { type: "integer" },
+                      page: { type: "integer" }
+                    }
+                  }
+                }
+              }
+            },
+            403: { description: "Collection read access denied" },
+            404: { description: "Audit is not enabled for this collection" }
+          }
+        }
+      };
+    }
+    spec.paths[`${path}/seed`] = {
+      post: {
+        tags: [collectionTag],
+        summary: `Seed initial ${labels.plural}`,
+        responses: { 200: { description: "Seeded documents" } }
+      }
+    };
+    if (collection.upload) {
+      spec.paths[`${path}/media`] = {
+        get: {
+          tags: [collectionTag],
+          summary: `List ${labels.plural}`,
+          responses: { 200: { description: "Paginated media documents" } }
+        },
+        post: {
+          tags: [collectionTag],
+          summary: `Upload ${labels.singular}`,
+          requestBody: {
+            required: true,
+            content: {
+              "multipart/form-data": {
+                schema: {
+                  type: "object",
+                  required: ["file"],
+                  properties: { file: { type: "string", format: "binary" } }
+                }
+              }
+            }
+          },
+          responses: { 201: { description: "Uploaded media document" } }
+        }
+      };
+      spec.paths[`${path}/media/{filename}`] = {
+        get: {
+          tags: [collectionTag],
+          summary: `Serve ${labels.singular} bytes`,
+          parameters: [
+            {
+              name: "filename",
+              in: "path",
+              required: true,
+              schema: { type: "string" }
+            }
+          ],
+          security: [],
+          responses: {
+            200: { description: "Stored file" },
+            404: { description: "File not found" }
+          }
+        }
+      };
+    }
+    if (collection.auth) {
+      const publicAuthPost = (summary) => ({
+        tags: [collectionTag],
+        summary,
+        security: [],
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: { type: "object", additionalProperties: true }
+            }
+          }
+        },
+        responses: {
+          200: { description: "Success" },
+          400: { description: "Invalid request" }
+        }
+      });
+      spec.paths[`${path}/login`] = {
+        post: {
+          ...publicAuthPost(`Log in to ${labels.plural}`),
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/AuthCredentials" }
+              }
+            }
+          },
+          responses: {
+            200: {
+              description: "Authenticated",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/TokenResponse" }
+                }
+              }
+            },
+            401: { description: "Invalid credentials" }
+          }
+        }
+      };
+      spec.paths[`${path}/logout`] = {
+        post: {
+          tags: [collectionTag],
+          summary: `Log out of ${labels.plural}`,
+          responses: { 200: { description: "Logged out" } }
+        }
+      };
+      spec.paths[`${path}/init`] = {
+        get: {
+          tags: [collectionTag],
+          summary: `Get ${labels.plural} initialization state`,
+          security: [],
+          responses: { 200: { description: "Initialization state" } }
+        }
+      };
+      spec.paths[`${path}/first-user`] = {
+        post: publicAuthPost(`Register the first ${labels.singular}`)
+      };
+      spec.paths[`${path}/me`] = {
+        get: {
+          tags: [collectionTag],
+          summary: `Get the current ${labels.singular}`,
+          responses: { 200: { description: "Authenticated user" } }
+        }
+      };
+      spec.paths[`${path}/refresh-token`] = {
+        post: {
+          tags: [collectionTag],
+          summary: "Refresh an authentication token",
+          responses: { 200: { description: "Refreshed token" } }
+        }
+      };
+      spec.paths[`${path}/forgot-password`] = {
+        post: publicAuthPost("Request a password reset")
+      };
+      spec.paths[`${path}/reset-password`] = {
+        post: publicAuthPost("Reset a password")
+      };
+      spec.paths[`${path}/invite`] = {
+        post: {
+          tags: [collectionTag],
+          summary: `Invite a ${labels.singular}`,
+          responses: { 200: { description: "Invitation sent" } }
+        }
+      };
+      spec.paths[`${path}/accept-invite`] = {
+        post: publicAuthPost("Accept an invitation")
+      };
+      spec.paths[`${path}/{id}/change-password`] = {
+        post: {
+          tags: [collectionTag],
+          summary: `Change a ${labels.singular} password`,
+          parameters: [
+            {
+              name: "id",
+              in: "path",
+              required: true,
+              schema: { type: "string" }
+            }
+          ],
+          responses: { 200: { description: "Password changed" } }
+        }
+      };
+    }
+    if (collection.workflow) {
+      spec.paths[`${path}/{id}/transitions/{transition}`] = {
+        post: {
+          tags: [collectionTag],
+          summary: `Transition ${labels.singular} workflow`,
+          parameters: [
+            {
+              name: "id",
+              in: "path",
+              required: true,
+              schema: { type: "string" }
+            },
+            {
+              name: "transition",
+              in: "path",
+              required: true,
+              schema: {
+                type: "string",
+                enum: collection.workflow.transitions.map((item) => item.name)
+              }
+            }
+          ],
+          requestBody: {
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/WorkflowTransitionRequest"
+                }
+              }
+            }
+          },
+          responses: {
+            200: {
+              description: "Transition applied",
+              content: {
+                "application/json": {
+                  schema: { $ref: `#/components/schemas/${slug}` }
+                }
+              }
+            },
+            400: { description: "Required transition input is missing" },
+            403: { description: "Transition capability denied" },
+            409: { description: "Invalid state or stale revision" }
+          }
+        }
+      };
+      spec.paths[`${path}/{id}/workflow-history`] = {
+        get: {
+          tags: [collectionTag],
+          summary: `Get ${labels.singular} workflow history`,
+          parameters: [
+            {
+              name: "id",
+              in: "path",
+              required: true,
+              schema: { type: "string" }
+            },
+            {
+              name: "limit",
+              in: "query",
+              schema: { type: "integer", default: 50, maximum: 100 }
+            }
+          ],
+          responses: {
+            200: {
+              description: "Workflow transition history",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    properties: {
+                      docs: {
+                        type: "array",
+                        items: {
+                          $ref: "#/components/schemas/WorkflowHistoryEntry"
+                        }
+                      },
+                      total: { type: "integer" },
+                      limit: { type: "integer" },
+                      page: { type: "integer" }
+                    }
+                  }
+                }
+              }
+            },
+            403: { description: "Collection read access denied" }
+          }
+        }
+      };
+    }
+  }
+  for (const global of config.globals) {
+    const slug = global.slug;
+    const path = `/api/globals/${slug}`;
+    const globalTag = getGlobalTag(global);
+    spec.paths[path] = {
+      get: {
+        tags: [globalTag],
+        summary: `Get ${global.label || slug}`,
+        responses: {
+          200: {
+            description: "Success",
+            content: {
+              "application/json": {
+                schema: { $ref: `#/components/schemas/${slug}` }
+              }
+            }
+          }
+        }
+      },
+      patch: {
+        tags: [globalTag],
+        summary: `Update ${global.label || slug}`,
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: { $ref: `#/components/schemas/${slug}` }
+            }
+          }
+        },
+        responses: {
+          200: {
+            description: "Updated",
+            content: {
+              "application/json": {
+                schema: { $ref: `#/components/schemas/${slug}` }
+              }
+            }
+          }
+        }
+      }
+    };
+    spec.paths[`${path}/seed`] = {
+      post: {
+        tags: [globalTag],
+        summary: `Seed ${global.label || slug}`,
+        responses: { 200: { description: "Seeded global" } }
+      }
+    };
+  }
+  if (config.storage) {
+    spec.paths["/api/media/{filename}"] = {
+      get: {
+        tags: ["Media"],
+        summary: "Serve a stored file",
+        security: [],
+        parameters: [
+          {
+            name: "filename",
+            in: "path",
+            required: true,
+            schema: { type: "string" }
+          }
+        ],
+        responses: {
+          200: { description: "Stored file bytes" },
+          404: { description: "File not found" }
+        }
+      }
+    };
+  }
+  return spec;
+}
+function collectionToSchema(collection) {
+  const { properties, required } = fieldsToProperties(collection.fields);
+  return {
+    type: "object",
+    properties: {
+      id: { type: "string" },
+      createdAt: { type: "string", format: "date-time" },
+      updatedAt: { type: "string", format: "date-time" },
+      ...collection.workflow ? { _workflow: { $ref: "#/components/schemas/WorkflowMetadata" } } : {},
+      ...properties
+    },
+    required: ["id", ...required]
+  };
+}
+function globalToSchema(global) {
+  const { properties, required } = fieldsToProperties(global.fields);
+  return {
+    type: "object",
+    properties,
+    required
+  };
+}
+function fieldsToProperties(fields) {
+  const props = {};
+  const required = [];
+  for (const field of fields) {
+    if (field.type === "row") {
+      const nested = fieldsToProperties(field.fields || []);
+      Object.assign(props, nested.properties);
+      required.push(...nested.required);
+      continue;
+    }
+    if (!field.name) continue;
+    props[field.name] = fieldToSchema(field);
+    if (field.required) {
+      required.push(field.name);
+    }
+  }
+  return { properties: props, required };
+}
+function fieldToSchema(field) {
+  let schema = {};
+  switch (field.type) {
+    case "text":
+    case "textarea":
+    case "email":
+      schema = { type: "string" };
+      break;
+    case "url":
+      schema = {
+        oneOf: [{ type: "string" }, { type: "object", additionalProperties: true }]
+      };
+      break;
+    case "icon":
+      schema = { type: "string" };
+      break;
+    case "number":
+      schema = { type: "number" };
+      break;
+    case "boolean":
+      schema = { type: "boolean" };
+      break;
+    case "date":
+      schema = { type: "string", format: "date" };
+      break;
+    case "datetime":
+      schema = { type: "string", format: "date-time" };
+      break;
+    case "time":
+      schema = { type: "string", format: "time" };
+      break;
+    case "select":
+    case "radio":
+      schema = {
+        type: "string",
+        enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0
+      };
+      break;
+    case "multiSelect":
+      schema = {
+        type: "array",
+        items: {
+          type: "string",
+          enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0
+        }
+      };
+      break;
+    case "relationship":
+    case "image": {
+      const valueSchema = {
+        type: "string",
+        description: `ID of a ${field.relationTo} record`
+      };
+      schema = field.hasMany ? { type: "array", items: valueSchema } : valueSchema;
+      break;
+    }
+    case "join":
+      schema = {
+        type: "array",
+        readOnly: true,
+        items: { type: "object", additionalProperties: true }
+      };
+      break;
+    case "object": {
+      const { properties, required } = fieldsToProperties(field.fields || []);
+      schema = { type: "object", properties, required };
+      break;
+    }
+    case "array": {
+      const { properties, required } = fieldsToProperties(field.fields || []);
+      schema = {
+        type: "array",
+        items: { type: "object", properties, required }
+      };
+      break;
+    }
+    case "json":
+    case "richText":
+      schema = { type: "object", additionalProperties: true };
+      break;
+    case "blocks":
+      schema = {
+        type: "array",
+        items: {
+          oneOf: field.blocks?.map((block) => {
+            const { properties, required } = fieldsToProperties(block.fields);
+            return {
+              type: "object",
+              properties: {
+                blockType: { type: "string", enum: [block.slug] },
+                ...properties
+              },
+              required: ["blockType", ...required]
+            };
+          })
+        }
+      };
+      break;
+    default:
+      schema = { type: "string" };
+  }
+  if (field.label) schema.description = field.label;
+  return schema;
+}
+
+export {
+  WORKFLOW_HISTORY_COLLECTION,
+  LIFECYCLE_EVENTS_COLLECTION,
+  publishingWorkflow,
+  simplePublishingWorkflow,
+  workflowCapabilities,
+  canViewWorkflowDraft,
+  availableWorkflowTransitions,
+  initializeWorkflowDocument,
+  materializeWorkflowDocument,
+  createLifecycleEvent,
+  dispatchLifecycleEvent,
+  dispatchPendingLifecycleEvents,
+  saveWorkflowDraft,
+  createWorkflowDocument,
+  transitionWorkflow,
+  getAdminAuthCollection,
+  resolveAdminAuthCollection,
+  getPublicAdminAuthConfig,
+  normalizeConfig,
+  runCollectionHooks,
+  executeFieldBeforeChange,
+  executeFieldAfterRead,
+  generateOpenApi
+};