@dyrected/core 2.5.60 → 2.5.61

package/dist/index.cjs

@@ -24,6 +24,7 @@ __export(index_exports, {
   LIFECYCLE_EVENT_NAMES: () => LIFECYCLE_EVENT_NAMES,
   WORKFLOW_HISTORY_COLLECTION: () => WORKFLOW_HISTORY_COLLECTION,
   availableWorkflowTransitions: () => availableWorkflowTransitions,
+  buildSqlOrderBy: () => buildSqlOrderBy,
   canViewWorkflowDraft: () => canViewWorkflowDraft,
   createLifecycleEvent: () => createLifecycleEvent,
   createWorkflowDocument: () => createWorkflowDocument,
@@ -65,6 +66,7 @@ __export(index_exports, {
   initializeWorkflowDocument: () => initializeWorkflowDocument,
   materializeWorkflowDocument: () => materializeWorkflowDocument,
   normalizeConfig: () => normalizeConfig,
+  numericFieldNames: () => numericFieldNames,
   parseMongoWhere: () => parseMongoWhere,
   parseSort: () => parseSort,
   parseSqlWhere: () => parseSqlWhere,
@@ -72,6 +74,7 @@ __export(index_exports, {
   resolveAdminAuthCollection: () => resolveAdminAuthCollection,
   runCollectionHooks: () => runCollectionHooks,
   saveWorkflowDraft: () => saveWorkflowDraft,
+  simplePublishingWorkflow: () => simplePublishingWorkflow,
   transitionWorkflow: () => transitionWorkflow,
   workflowCapabilities: () => workflowCapabilities
 });
@@ -110,6 +113,20 @@ function publishingWorkflow() {
     ]
   };
 }
+function simplePublishingWorkflow() {
+  return {
+    initialState: "draft",
+    draftState: "draft",
+    states: [
+      { name: "draft", label: "Draft", color: "neutral" },
+      { name: "published", label: "Published", color: "success", published: true }
+    ],
+    transitions: [
+      { name: "publish", label: "Publish", from: "draft", to: "published" },
+      { name: "unpublish", label: "Unpublish", from: "published", to: "draft", unpublish: true }
+    ]
+  };
+}
 function publicMetadata(meta) {
   const { availableTransitions: _availableTransitions, ...safe } = meta;
   return safe;
@@ -143,9 +160,23 @@ function initializeWorkflowDocument(data, workflow) {
     __workflow: { state: workflow.initialState, revision: 1 }
   };
 }
+function publishedStateName(workflow) {
+  return workflow.states.find((state) => state.published)?.name ?? workflow.states[workflow.states.length - 1]?.name ?? workflow.initialState;
+}
 function materializeWorkflowDocument(doc, workflow, user) {
   const meta = doc.__workflow;
-  if (!meta) return doc;
+  if (!meta) {
+    const { __published: _legacyPublished, __workflow: _legacyWorkflow, ...working2 } = doc;
+    const state = publishedStateName(workflow);
+    return {
+      ...working2,
+      _workflow: {
+        state,
+        revision: 1,
+        availableTransitions: availableWorkflowTransitions(workflow, state, user).map((item) => item.name)
+      }
+    };
+  }
   const { __published, __workflow, ...working } = doc;
   if (!canViewWorkflowDraft(workflow, user)) {
     if (!__published || typeof __published !== "object") return null;
@@ -463,7 +494,7 @@ function normalizeConfig(config) {
   const collections = config?.collections || [];
   const globals = config?.globals || [];
   const needsAudit = collections.some((col) => col.audit);
-  const needsWorkflow = collections.some((col) => col.workflow);
+  const needsWorkflow = collections.some((col) => col.workflow || col.drafts);
   const adminAuthCollectionSlug = getAdminAuthCollection({
     collections,
     adminAuth: config.adminAuth
@@ -598,8 +629,10 @@ function normalizeConfig(config) {
     }
     const updatedFieldNames = new Set(fields.map((f) => f.name));
     const fieldsToInject = SYSTEM_FIELDS.filter((f) => !updatedFieldNames.has(f.name));
+    const workflow = col.workflow || (col.drafts ? simplePublishingWorkflow() : void 0);
     return {
       ...col,
+      workflow,
       fields: [...fields, ...fieldsToInject]
     };
   });
@@ -623,7 +656,7 @@ function normalizeConfig(config) {
 function assertNever(op, context) {
   throw new Error(`[dyrected/core] Unhandled where operator "${op}" in ${context}`);
 }
-function parseSqlWhere(where, getJsonField, placeholder = "?") {
+function parseSqlWhere(where, getJsonField, placeholder = "?", likeOperator = "LIKE") {
   const params = [];
   let pgIndex = 1;
   function next() {
@@ -685,10 +718,10 @@ function parseSqlWhere(where, getJsonField, placeholder = "?") {
         return `${c} <= ${next()}`;
       case "contains":
         params.push(`%${operand}%`);
-        return `${c} LIKE ${next()}`;
+        return `${c} ${likeOperator} ${next()}`;
       case "starts_with":
         params.push(`${operand}%`);
-        return `${c} LIKE ${next()}`;
+        return `${c} ${likeOperator} ${next()}`;
       case "exists":
         return operand ? `${c} IS NOT NULL` : `${c} IS NULL`;
       default:
@@ -793,6 +826,33 @@ function parseSort(sort, fallback = { field: "createdAt", direction: "DESC" }) {
   }).filter((clause) => Boolean(clause));
   return clauses.length > 0 ? clauses : [fallback];
 }
+function numericFieldNames(fields) {
+  const names = /* @__PURE__ */ new Set();
+  for (const field of fields ?? []) {
+    if (field.type === "number" && "name" in field && field.name) {
+      names.add(field.name);
+    }
+  }
+  return names;
+}
+var TIMESTAMP_COLUMNS = {
+  createdat: "created_at",
+  created_at: "created_at",
+  updatedat: "updated_at",
+  updated_at: "updated_at"
+};
+function buildSqlOrderBy(sort, existingColumns, numericFields, dialect) {
+  return parseSort(sort).map(({ field, direction }) => {
+    const timestamp = TIMESTAMP_COLUMNS[field.toLowerCase()];
+    if (timestamp) return `${dialect.quoteIdent(timestamp)} ${direction}`;
+    if (existingColumns.includes(field) && field !== "id" && field !== "data") {
+      return `${dialect.quoteIdent(field)} ${direction}`;
+    }
+    const extracted = dialect.jsonExtract(field);
+    const expr = numericFields.has(field) ? dialect.castNumeric(extracted) : extracted;
+    return `${expr} ${direction}`;
+  }).join(", ");
+}
 
 // src/utils/hooks.ts
 async function runCollectionHooks(hooks, args, options = {}) {
@@ -1916,6 +1976,7 @@ function defineTab(args) {
   LIFECYCLE_EVENT_NAMES,
   WORKFLOW_HISTORY_COLLECTION,
   availableWorkflowTransitions,
+  buildSqlOrderBy,
   canViewWorkflowDraft,
   createLifecycleEvent,
   createWorkflowDocument,
@@ -1957,6 +2018,7 @@ function defineTab(args) {
   initializeWorkflowDocument,
   materializeWorkflowDocument,
   normalizeConfig,
+  numericFieldNames,
   parseMongoWhere,
   parseSort,
   parseSqlWhere,
@@ -1964,6 +2026,7 @@ function defineTab(args) {
   resolveAdminAuthCollection,
   runCollectionHooks,
   saveWorkflowDraft,
+  simplePublishingWorkflow,
   transitionWorkflow,
   workflowCapabilities
 });

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, W as WorkflowConfig, a as AuthenticatedUser, b as WorkflowTransition, L as LifecycleEventName, c as LifecycleEvent, d as BaseDocument, H as HookRequestContext, e as ArrayField, f as BlocksField, g as BooleanField, h as DateField, i as DateTimeField, E as EmailField, G as GlobalConfig, I as IconField, j as ImageField, J as JoinField, k as JsonField, M as MultiSelectField, N as NumberField, O as ObjectField, R as RadioField, l as RelationshipField, m as RichTextField, n as RowField, S as SelectField, T as TextField, o as TextareaField, p as TimeField, U as UrlField } from './app-config-C0twGIaF.cjs';
-export { q as AccessFunction, r as AccessFunctionArgs, s as AccessPolicyResolver, t as AccessResult, u as AccessRule, v as AdminAuthAccessResolution, w as AdminAuthClaimMapping, x as AdminAuthMember, y as AdminAuthProvider, z as AdminAuthProviderMembersConfig, K as AdminAuthProvisioningMode, Q as AdminAuthResolveAccessArgs, V as AdminAuthResolvedIdentity, X as AdminConfig, Y as AdminDashboardComponentSlots, Z as AdminIconName, _ as BaseAdminAuthProvider, $ as BaseFieldAdmin, a0 as BlockVariant, a1 as BooleanFieldAdmin, a2 as CharacterLimitFieldAdmin, a3 as CharacterLimitFieldConfig, a4 as CollectionAfterChangeHook, a5 as CollectionAfterDeleteHook, a6 as CollectionAfterReadHook, a7 as CollectionAfterTransitionHook, a8 as CollectionBeforeChangeHook, a9 as CollectionBeforeDeleteHook, aa as CollectionBeforeReadHook, ab as CollectionBeforeTransitionHook, ac as CollectionListComponentSlots, ad as CustomAdminAuthProvider, ae as DatabaseAdapter, af as DynamicOptionItem, ag as DynamicOptionsConfig, ah as DynamicOptionsResolver, ai as DynamicOptionsResolverArgs, aj as EmailFieldAdmin, ak as FieldAdminHooks, al as FieldAdminOnChangeHook, am as FieldAdminOnChangeHookArgs, an as FieldAdminOptionsHook, ao as FieldAdminOptionsHookArgs, ap as FieldAdminOptionsHookResult, aq as FieldAfterReadHook, ar as FieldAfterReadHookArgs, as as FieldBase, at as FieldBeforeChangeHook, au as FieldBeforeChangeHookArgs, av as FieldHook, aw as FieldHooks, ax as FieldType, ay as FileData, az as GlobalAfterChangeHook, aA as GlobalAfterReadHook, aB as GlobalBeforeChangeHook, aC as GlobalBeforeReadHook, aD as HeadingLevel, aE as HookFunction, aF as IconFieldAdmin, aG as ImageService, aH as LIFECYCLE_EVENT_NAMES, aI as LifecycleEventHandler, aJ as MultiSelectFieldAdmin, aK as NamedAccessPolicy, aL as NumberFieldAdmin, aM as NumberLimitFieldAdmin, aN as NumberLimitFieldConfig, aO as OIDCAdminAuthProvider, aP as PaginatedResult, aQ as PublicAdminAuthProvider, aR as RadioFieldAdmin, aS as ReadonlyDatabaseAdapter, aT as RichTextFeature, aU as RichTextFieldConfig, aV as SelectFieldAdmin, aW as StorageAdapter, aX as TextFieldAdmin, aY as TextareaFieldAdmin, aZ as TypedField, a_ as UploadConfig, a$ as UrlFieldAdmin, b0 as UrlLinkValue, b1 as WordLimitFieldAdmin, b2 as WordLimitFieldConfig, b3 as WorkflowMetadata, b4 as WorkflowRole, b5 as WorkflowState, b6 as WorkflowTransitionContext } from './app-config-C0twGIaF.cjs';
+import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, W as WorkflowConfig, a as AuthenticatedUser, b as WorkflowTransition, L as LifecycleEventName, c as LifecycleEvent, d as BaseDocument, H as HookRequestContext, e as ArrayField, f as BlocksField, g as BooleanField, h as DateField, i as DateTimeField, E as EmailField, G as GlobalConfig, I as IconField, j as ImageField, J as JoinField, k as JsonField, M as MultiSelectField, N as NumberField, O as ObjectField, R as RadioField, l as RelationshipField, m as RichTextField, n as RowField, S as SelectField, T as TextField, o as TextareaField, p as TimeField, U as UrlField } from './app-config-C0uxEU7Q.cjs';
+export { q as AccessFunction, r as AccessFunctionArgs, s as AccessPolicyResolver, t as AccessResult, u as AccessRule, v as AdminAuthAccessResolution, w as AdminAuthClaimMapping, x as AdminAuthMember, y as AdminAuthProvider, z as AdminAuthProviderMembersConfig, K as AdminAuthProvisioningMode, Q as AdminAuthResolveAccessArgs, V as AdminAuthResolvedIdentity, X as AdminConfig, Y as AdminDashboardComponentSlots, Z as AdminIconName, _ as BaseAdminAuthProvider, $ as BaseFieldAdmin, a0 as BlockVariant, a1 as BooleanFieldAdmin, a2 as BooleanFormat, a3 as CharacterLimitFieldAdmin, a4 as CharacterLimitFieldConfig, a5 as CollectionAfterChangeHook, a6 as CollectionAfterDeleteHook, a7 as CollectionAfterReadHook, a8 as CollectionAfterTransitionHook, a9 as CollectionBeforeChangeHook, aa as CollectionBeforeDeleteHook, ab as CollectionBeforeReadHook, ac as CollectionBeforeTransitionHook, ad as CollectionListComponentSlots, ae as CustomAdminAuthProvider, af as DatabaseAdapter, ag as DateFieldAdmin, ah as DateFormat, ai as DisplayTone, aj as DynamicOptionItem, ak as DynamicOptionsConfig, al as DynamicOptionsResolver, am as DynamicOptionsResolverArgs, an as EmailFieldAdmin, ao as FieldAdminHooks, ap as FieldAdminOnChangeHook, aq as FieldAdminOnChangeHookArgs, ar as FieldAdminOptionsHook, as as FieldAdminOptionsHookArgs, at as FieldAdminOptionsHookResult, au as FieldAfterReadHook, av as FieldAfterReadHookArgs, aw as FieldBase, ax as FieldBeforeChangeHook, ay as FieldBeforeChangeHookArgs, az as FieldHook, aA as FieldHooks, aB as FieldType, aC as FileData, aD as GlobalAfterChangeHook, aE as GlobalAfterReadHook, aF as GlobalBeforeChangeHook, aG as GlobalBeforeReadHook, aH as HeadingLevel, aI as HookFunction, aJ as IconFieldAdmin, aK as ImageService, aL as JsonFieldAdmin, aM as JsonFormat, aN as LIFECYCLE_EVENT_NAMES, aO as LifecycleEventHandler, aP as LinkFormat, aQ as MultiSelectFieldAdmin, aR as NamedAccessPolicy, aS as NumberFieldAdmin, aT as NumberFormat, aU as NumberLimitFieldAdmin, aV as NumberLimitFieldConfig, aW as OIDCAdminAuthProvider, aX as OptionFormat, aY as PaginatedResult, aZ as PublicAdminAuthProvider, a_ as RadioFieldAdmin, a$ as ReadonlyDatabaseAdapter, b0 as RichTextFeature, b1 as RichTextFieldConfig, b2 as SelectFieldAdmin, b3 as StorageAdapter, b4 as TextFieldAdmin, b5 as TextFormat, b6 as TextareaFieldAdmin, b7 as TypedField, b8 as UploadConfig, b9 as UrlFieldAdmin, ba as UrlLinkValue, bb as WordLimitFieldAdmin, bc as WordLimitFieldConfig, bd as WorkflowMetadata, be as WorkflowRole, bf as WorkflowState, bg as WorkflowTransitionContext } from './app-config-C0uxEU7Q.cjs';
 import 'lucide-react';
 
 type Prettify<T> = {
@@ -140,7 +140,13 @@ interface SqlWhereResult {
  *                        MySQL:    (f) => `JSON_UNQUOTE(JSON_EXTRACT(data, '$.${f}'))`
  * @param placeholder   '?' for SQLite/MySQL, 'pg' for auto-incrementing Postgres $1/$2/…
  */
-declare function parseSqlWhere(where: WhereClause, getJsonField: (field: string) => string, placeholder?: '?' | 'pg'): SqlWhereResult;
+declare function parseSqlWhere(where: WhereClause, getJsonField: (field: string) => string, placeholder?: '?' | 'pg', 
+/**
+ * SQL keyword used for `contains`/`starts_with`. Postgres `LIKE` is
+ * case-sensitive, so the Postgres adapter passes `'ILIKE'` to keep substring
+ * matching case-insensitive like SQLite and MySQL.
+ */
+likeOperator?: 'LIKE' | 'ILIKE'): SqlWhereResult;
 /**
  * Translates a WhereClause into a MongoDB filter object.
  * Handles nested OR/AND via $or/$and, and all operators via $eq/$in/$gt etc.
@@ -153,6 +159,41 @@ interface SortClause {
     direction: SortDirection;
 }
 declare function parseSort(sort: string | undefined, fallback?: SortClause): SortClause[];
+/**
+ * Collects the names of top-level fields declared as numbers. SQL adapters use
+ * this to decide which JSON-extracted sort fields need a numeric cast.
+ */
+declare function numericFieldNames(fields?: Field[]): Set<string>;
+/**
+ * Dialect hooks for turning a parsed sort into a SQL `ORDER BY` body.
+ * Each SQL adapter supplies its own quoting, JSON extraction, and numeric cast.
+ */
+interface SqlSortDialect {
+    /** Quote a real column identifier (e.g. `"created_at"` or \`created_at\`). */
+    quoteIdent: (identifier: string) => string;
+    /** SQL expression that reads a top-level field out of the JSON `data` column. */
+    jsonExtract: (field: string) => string;
+    /**
+     * Wrap a JSON-extracted expression so it sorts numerically instead of
+     * lexicographically. Adapters whose JSON extraction already preserves number
+     * types (SQLite) can return the expression unchanged.
+     */
+    castNumeric: (expr: string) => string;
+}
+/**
+ * Builds the `ORDER BY` body shared by the SQL adapters.
+ *
+ * Real (promoted) columns and the `created_at`/`updated_at` timestamps are
+ * ordered by their typed column directly. Everything else is read out of the
+ * JSON `data` column — and when a field is declared as a `number`, its extracted
+ * value is cast so it orders by magnitude rather than as text ("9" < "10").
+ *
+ * @param sort            The raw sort string (e.g. `"-createdAt"`, `"priority,-views"`).
+ * @param existingColumns Real column names present on the table.
+ * @param numericFields   Names of top-level fields declared with `type: 'number'`.
+ * @param dialect         Adapter-specific quoting, extraction, and numeric cast.
+ */
+declare function buildSqlOrderBy(sort: string | undefined, existingColumns: string[], numericFields: Set<string>, dialect: SqlSortDialect): string;
 
 type AnyHookFn = (args: any) => any;
 /**
@@ -201,6 +242,7 @@ declare function generateOpenApi(config: DyrectedConfig): any;
 declare const WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
 declare const LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
 declare function publishingWorkflow(): WorkflowConfig;
+declare function simplePublishingWorkflow(): WorkflowConfig;
 declare function workflowCapabilities(workflow: WorkflowConfig, user?: AuthenticatedUser): Set<string>;
 declare function canViewWorkflowDraft(workflow: WorkflowConfig, user?: AuthenticatedUser): boolean;
 declare function availableWorkflowTransitions(workflow: WorkflowConfig, state: string, user?: AuthenticatedUser): WorkflowTransition[];
@@ -497,4 +539,4 @@ declare function defineTab<const T extends readonly Field[]>(args: {
     fields: T;
 }): T;
 
-export { AdminAuthConfig, ArrayField, type AuthDocFields, AuthenticatedUser, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, DateField, DateTimeField, DyrectedConfig, EmailField, Field, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MultiSelectField, NumberField, ObjectField, type Prettify, PublicAdminAuthConfig, RadioField, RelationshipField, RichTextField, RowField, SelectField, type SortClause, type SortDirection, type SqlWhereResult, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhereClause, type WhereOperator, type WhereOperatorName, WorkflowConfig, WorkflowTransition, availableWorkflowTransitions, canViewWorkflowDraft, createLifecycleEvent, createWorkflowDocument, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, executeFieldAfterRead, executeFieldBeforeChange, generateOpenApi, getAdminAuthCollection, getPublicAdminAuthConfig, initializeWorkflowDocument, materializeWorkflowDocument, normalizeConfig, parseMongoWhere, parseSort, parseSqlWhere, publishingWorkflow, resolveAdminAuthCollection, runCollectionHooks, saveWorkflowDraft, transitionWorkflow, workflowCapabilities };
+export { AdminAuthConfig, ArrayField, type AuthDocFields, AuthenticatedUser, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, DateField, DateTimeField, DyrectedConfig, EmailField, Field, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MultiSelectField, NumberField, ObjectField, type Prettify, PublicAdminAuthConfig, RadioField, RelationshipField, RichTextField, RowField, SelectField, type SortClause, type SortDirection, type SqlSortDialect, type SqlWhereResult, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhereClause, type WhereOperator, type WhereOperatorName, WorkflowConfig, WorkflowTransition, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, createLifecycleEvent, createWorkflowDocument, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, executeFieldAfterRead, executeFieldBeforeChange, generateOpenApi, getAdminAuthCollection, getPublicAdminAuthConfig, initializeWorkflowDocument, materializeWorkflowDocument, normalizeConfig, numericFieldNames, parseMongoWhere, parseSort, parseSqlWhere, publishingWorkflow, resolveAdminAuthCollection, runCollectionHooks, saveWorkflowDraft, simplePublishingWorkflow, transitionWorkflow, workflowCapabilities };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, W as WorkflowConfig, a as AuthenticatedUser, b as WorkflowTransition, L as LifecycleEventName, c as LifecycleEvent, d as BaseDocument, H as HookRequestContext, e as ArrayField, f as BlocksField, g as BooleanField, h as DateField, i as DateTimeField, E as EmailField, G as GlobalConfig, I as IconField, j as ImageField, J as JoinField, k as JsonField, M as MultiSelectField, N as NumberField, O as ObjectField, R as RadioField, l as RelationshipField, m as RichTextField, n as RowField, S as SelectField, T as TextField, o as TextareaField, p as TimeField, U as UrlField } from './app-config-C0twGIaF.js';
-export { q as AccessFunction, r as AccessFunctionArgs, s as AccessPolicyResolver, t as AccessResult, u as AccessRule, v as AdminAuthAccessResolution, w as AdminAuthClaimMapping, x as AdminAuthMember, y as AdminAuthProvider, z as AdminAuthProviderMembersConfig, K as AdminAuthProvisioningMode, Q as AdminAuthResolveAccessArgs, V as AdminAuthResolvedIdentity, X as AdminConfig, Y as AdminDashboardComponentSlots, Z as AdminIconName, _ as BaseAdminAuthProvider, $ as BaseFieldAdmin, a0 as BlockVariant, a1 as BooleanFieldAdmin, a2 as CharacterLimitFieldAdmin, a3 as CharacterLimitFieldConfig, a4 as CollectionAfterChangeHook, a5 as CollectionAfterDeleteHook, a6 as CollectionAfterReadHook, a7 as CollectionAfterTransitionHook, a8 as CollectionBeforeChangeHook, a9 as CollectionBeforeDeleteHook, aa as CollectionBeforeReadHook, ab as CollectionBeforeTransitionHook, ac as CollectionListComponentSlots, ad as CustomAdminAuthProvider, ae as DatabaseAdapter, af as DynamicOptionItem, ag as DynamicOptionsConfig, ah as DynamicOptionsResolver, ai as DynamicOptionsResolverArgs, aj as EmailFieldAdmin, ak as FieldAdminHooks, al as FieldAdminOnChangeHook, am as FieldAdminOnChangeHookArgs, an as FieldAdminOptionsHook, ao as FieldAdminOptionsHookArgs, ap as FieldAdminOptionsHookResult, aq as FieldAfterReadHook, ar as FieldAfterReadHookArgs, as as FieldBase, at as FieldBeforeChangeHook, au as FieldBeforeChangeHookArgs, av as FieldHook, aw as FieldHooks, ax as FieldType, ay as FileData, az as GlobalAfterChangeHook, aA as GlobalAfterReadHook, aB as GlobalBeforeChangeHook, aC as GlobalBeforeReadHook, aD as HeadingLevel, aE as HookFunction, aF as IconFieldAdmin, aG as ImageService, aH as LIFECYCLE_EVENT_NAMES, aI as LifecycleEventHandler, aJ as MultiSelectFieldAdmin, aK as NamedAccessPolicy, aL as NumberFieldAdmin, aM as NumberLimitFieldAdmin, aN as NumberLimitFieldConfig, aO as OIDCAdminAuthProvider, aP as PaginatedResult, aQ as PublicAdminAuthProvider, aR as RadioFieldAdmin, aS as ReadonlyDatabaseAdapter, aT as RichTextFeature, aU as RichTextFieldConfig, aV as SelectFieldAdmin, aW as StorageAdapter, aX as TextFieldAdmin, aY as TextareaFieldAdmin, aZ as TypedField, a_ as UploadConfig, a$ as UrlFieldAdmin, b0 as UrlLinkValue, b1 as WordLimitFieldAdmin, b2 as WordLimitFieldConfig, b3 as WorkflowMetadata, b4 as WorkflowRole, b5 as WorkflowState, b6 as WorkflowTransitionContext } from './app-config-C0twGIaF.js';
+import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, W as WorkflowConfig, a as AuthenticatedUser, b as WorkflowTransition, L as LifecycleEventName, c as LifecycleEvent, d as BaseDocument, H as HookRequestContext, e as ArrayField, f as BlocksField, g as BooleanField, h as DateField, i as DateTimeField, E as EmailField, G as GlobalConfig, I as IconField, j as ImageField, J as JoinField, k as JsonField, M as MultiSelectField, N as NumberField, O as ObjectField, R as RadioField, l as RelationshipField, m as RichTextField, n as RowField, S as SelectField, T as TextField, o as TextareaField, p as TimeField, U as UrlField } from './app-config-C0uxEU7Q.js';
+export { q as AccessFunction, r as AccessFunctionArgs, s as AccessPolicyResolver, t as AccessResult, u as AccessRule, v as AdminAuthAccessResolution, w as AdminAuthClaimMapping, x as AdminAuthMember, y as AdminAuthProvider, z as AdminAuthProviderMembersConfig, K as AdminAuthProvisioningMode, Q as AdminAuthResolveAccessArgs, V as AdminAuthResolvedIdentity, X as AdminConfig, Y as AdminDashboardComponentSlots, Z as AdminIconName, _ as BaseAdminAuthProvider, $ as BaseFieldAdmin, a0 as BlockVariant, a1 as BooleanFieldAdmin, a2 as BooleanFormat, a3 as CharacterLimitFieldAdmin, a4 as CharacterLimitFieldConfig, a5 as CollectionAfterChangeHook, a6 as CollectionAfterDeleteHook, a7 as CollectionAfterReadHook, a8 as CollectionAfterTransitionHook, a9 as CollectionBeforeChangeHook, aa as CollectionBeforeDeleteHook, ab as CollectionBeforeReadHook, ac as CollectionBeforeTransitionHook, ad as CollectionListComponentSlots, ae as CustomAdminAuthProvider, af as DatabaseAdapter, ag as DateFieldAdmin, ah as DateFormat, ai as DisplayTone, aj as DynamicOptionItem, ak as DynamicOptionsConfig, al as DynamicOptionsResolver, am as DynamicOptionsResolverArgs, an as EmailFieldAdmin, ao as FieldAdminHooks, ap as FieldAdminOnChangeHook, aq as FieldAdminOnChangeHookArgs, ar as FieldAdminOptionsHook, as as FieldAdminOptionsHookArgs, at as FieldAdminOptionsHookResult, au as FieldAfterReadHook, av as FieldAfterReadHookArgs, aw as FieldBase, ax as FieldBeforeChangeHook, ay as FieldBeforeChangeHookArgs, az as FieldHook, aA as FieldHooks, aB as FieldType, aC as FileData, aD as GlobalAfterChangeHook, aE as GlobalAfterReadHook, aF as GlobalBeforeChangeHook, aG as GlobalBeforeReadHook, aH as HeadingLevel, aI as HookFunction, aJ as IconFieldAdmin, aK as ImageService, aL as JsonFieldAdmin, aM as JsonFormat, aN as LIFECYCLE_EVENT_NAMES, aO as LifecycleEventHandler, aP as LinkFormat, aQ as MultiSelectFieldAdmin, aR as NamedAccessPolicy, aS as NumberFieldAdmin, aT as NumberFormat, aU as NumberLimitFieldAdmin, aV as NumberLimitFieldConfig, aW as OIDCAdminAuthProvider, aX as OptionFormat, aY as PaginatedResult, aZ as PublicAdminAuthProvider, a_ as RadioFieldAdmin, a$ as ReadonlyDatabaseAdapter, b0 as RichTextFeature, b1 as RichTextFieldConfig, b2 as SelectFieldAdmin, b3 as StorageAdapter, b4 as TextFieldAdmin, b5 as TextFormat, b6 as TextareaFieldAdmin, b7 as TypedField, b8 as UploadConfig, b9 as UrlFieldAdmin, ba as UrlLinkValue, bb as WordLimitFieldAdmin, bc as WordLimitFieldConfig, bd as WorkflowMetadata, be as WorkflowRole, bf as WorkflowState, bg as WorkflowTransitionContext } from './app-config-C0uxEU7Q.js';
 import 'lucide-react';
 
 type Prettify<T> = {
@@ -140,7 +140,13 @@ interface SqlWhereResult {
  *                        MySQL:    (f) => `JSON_UNQUOTE(JSON_EXTRACT(data, '$.${f}'))`
  * @param placeholder   '?' for SQLite/MySQL, 'pg' for auto-incrementing Postgres $1/$2/…
  */
-declare function parseSqlWhere(where: WhereClause, getJsonField: (field: string) => string, placeholder?: '?' | 'pg'): SqlWhereResult;
+declare function parseSqlWhere(where: WhereClause, getJsonField: (field: string) => string, placeholder?: '?' | 'pg', 
+/**
+ * SQL keyword used for `contains`/`starts_with`. Postgres `LIKE` is
+ * case-sensitive, so the Postgres adapter passes `'ILIKE'` to keep substring
+ * matching case-insensitive like SQLite and MySQL.
+ */
+likeOperator?: 'LIKE' | 'ILIKE'): SqlWhereResult;
 /**
  * Translates a WhereClause into a MongoDB filter object.
  * Handles nested OR/AND via $or/$and, and all operators via $eq/$in/$gt etc.
@@ -153,6 +159,41 @@ interface SortClause {
     direction: SortDirection;
 }
 declare function parseSort(sort: string | undefined, fallback?: SortClause): SortClause[];
+/**
+ * Collects the names of top-level fields declared as numbers. SQL adapters use
+ * this to decide which JSON-extracted sort fields need a numeric cast.
+ */
+declare function numericFieldNames(fields?: Field[]): Set<string>;
+/**
+ * Dialect hooks for turning a parsed sort into a SQL `ORDER BY` body.
+ * Each SQL adapter supplies its own quoting, JSON extraction, and numeric cast.
+ */
+interface SqlSortDialect {
+    /** Quote a real column identifier (e.g. `"created_at"` or \`created_at\`). */
+    quoteIdent: (identifier: string) => string;
+    /** SQL expression that reads a top-level field out of the JSON `data` column. */
+    jsonExtract: (field: string) => string;
+    /**
+     * Wrap a JSON-extracted expression so it sorts numerically instead of
+     * lexicographically. Adapters whose JSON extraction already preserves number
+     * types (SQLite) can return the expression unchanged.
+     */
+    castNumeric: (expr: string) => string;
+}
+/**
+ * Builds the `ORDER BY` body shared by the SQL adapters.
+ *
+ * Real (promoted) columns and the `created_at`/`updated_at` timestamps are
+ * ordered by their typed column directly. Everything else is read out of the
+ * JSON `data` column — and when a field is declared as a `number`, its extracted
+ * value is cast so it orders by magnitude rather than as text ("9" < "10").
+ *
+ * @param sort            The raw sort string (e.g. `"-createdAt"`, `"priority,-views"`).
+ * @param existingColumns Real column names present on the table.
+ * @param numericFields   Names of top-level fields declared with `type: 'number'`.
+ * @param dialect         Adapter-specific quoting, extraction, and numeric cast.
+ */
+declare function buildSqlOrderBy(sort: string | undefined, existingColumns: string[], numericFields: Set<string>, dialect: SqlSortDialect): string;
 
 type AnyHookFn = (args: any) => any;
 /**
@@ -201,6 +242,7 @@ declare function generateOpenApi(config: DyrectedConfig): any;
 declare const WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
 declare const LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
 declare function publishingWorkflow(): WorkflowConfig;
+declare function simplePublishingWorkflow(): WorkflowConfig;
 declare function workflowCapabilities(workflow: WorkflowConfig, user?: AuthenticatedUser): Set<string>;
 declare function canViewWorkflowDraft(workflow: WorkflowConfig, user?: AuthenticatedUser): boolean;
 declare function availableWorkflowTransitions(workflow: WorkflowConfig, state: string, user?: AuthenticatedUser): WorkflowTransition[];
@@ -497,4 +539,4 @@ declare function defineTab<const T extends readonly Field[]>(args: {
     fields: T;
 }): T;
 
-export { AdminAuthConfig, ArrayField, type AuthDocFields, AuthenticatedUser, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, DateField, DateTimeField, DyrectedConfig, EmailField, Field, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MultiSelectField, NumberField, ObjectField, type Prettify, PublicAdminAuthConfig, RadioField, RelationshipField, RichTextField, RowField, SelectField, type SortClause, type SortDirection, type SqlWhereResult, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhereClause, type WhereOperator, type WhereOperatorName, WorkflowConfig, WorkflowTransition, availableWorkflowTransitions, canViewWorkflowDraft, createLifecycleEvent, createWorkflowDocument, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, executeFieldAfterRead, executeFieldBeforeChange, generateOpenApi, getAdminAuthCollection, getPublicAdminAuthConfig, initializeWorkflowDocument, materializeWorkflowDocument, normalizeConfig, parseMongoWhere, parseSort, parseSqlWhere, publishingWorkflow, resolveAdminAuthCollection, runCollectionHooks, saveWorkflowDraft, transitionWorkflow, workflowCapabilities };
+export { AdminAuthConfig, ArrayField, type AuthDocFields, AuthenticatedUser, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, DateField, DateTimeField, DyrectedConfig, EmailField, Field, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MultiSelectField, NumberField, ObjectField, type Prettify, PublicAdminAuthConfig, RadioField, RelationshipField, RichTextField, RowField, SelectField, type SortClause, type SortDirection, type SqlSortDialect, type SqlWhereResult, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhereClause, type WhereOperator, type WhereOperatorName, WorkflowConfig, WorkflowTransition, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, createLifecycleEvent, createWorkflowDocument, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, executeFieldAfterRead, executeFieldBeforeChange, generateOpenApi, getAdminAuthCollection, getPublicAdminAuthConfig, initializeWorkflowDocument, materializeWorkflowDocument, normalizeConfig, numericFieldNames, parseMongoWhere, parseSort, parseSqlWhere, publishingWorkflow, resolveAdminAuthCollection, runCollectionHooks, saveWorkflowDraft, simplePublishingWorkflow, transitionWorkflow, workflowCapabilities };

package/dist/index.js

@@ -19,9 +19,10 @@ import {
   resolveAdminAuthCollection,
   runCollectionHooks,
   saveWorkflowDraft,
+  simplePublishingWorkflow,
   transitionWorkflow,
   workflowCapabilities
-} from "./chunk-2WODKOUB.js";
+} from "./chunk-35NM2WPO.js";
 
 // src/types/workflows.ts
 var LIFECYCLE_EVENT_NAMES = [
@@ -35,7 +36,7 @@ var LIFECYCLE_EVENT_NAMES = [
 function assertNever(op, context) {
   throw new Error(`[dyrected/core] Unhandled where operator "${op}" in ${context}`);
 }
-function parseSqlWhere(where, getJsonField, placeholder = "?") {
+function parseSqlWhere(where, getJsonField, placeholder = "?", likeOperator = "LIKE") {
   const params = [];
   let pgIndex = 1;
   function next() {
@@ -97,10 +98,10 @@ function parseSqlWhere(where, getJsonField, placeholder = "?") {
         return `${c} <= ${next()}`;
       case "contains":
         params.push(`%${operand}%`);
-        return `${c} LIKE ${next()}`;
+        return `${c} ${likeOperator} ${next()}`;
       case "starts_with":
         params.push(`${operand}%`);
-        return `${c} LIKE ${next()}`;
+        return `${c} ${likeOperator} ${next()}`;
       case "exists":
         return operand ? `${c} IS NOT NULL` : `${c} IS NULL`;
       default:
@@ -205,6 +206,33 @@ function parseSort(sort, fallback = { field: "createdAt", direction: "DESC" }) {
   }).filter((clause) => Boolean(clause));
   return clauses.length > 0 ? clauses : [fallback];
 }
+function numericFieldNames(fields) {
+  const names = /* @__PURE__ */ new Set();
+  for (const field of fields ?? []) {
+    if (field.type === "number" && "name" in field && field.name) {
+      names.add(field.name);
+    }
+  }
+  return names;
+}
+var TIMESTAMP_COLUMNS = {
+  createdat: "created_at",
+  created_at: "created_at",
+  updatedat: "updated_at",
+  updated_at: "updated_at"
+};
+function buildSqlOrderBy(sort, existingColumns, numericFields, dialect) {
+  return parseSort(sort).map(({ field, direction }) => {
+    const timestamp = TIMESTAMP_COLUMNS[field.toLowerCase()];
+    if (timestamp) return `${dialect.quoteIdent(timestamp)} ${direction}`;
+    if (existingColumns.includes(field) && field !== "id" && field !== "data") {
+      return `${dialect.quoteIdent(field)} ${direction}`;
+    }
+    const extracted = dialect.jsonExtract(field);
+    const expr = numericFields.has(field) ? dialect.castNumeric(extracted) : extracted;
+    return `${expr} ${direction}`;
+  }).join(", ");
+}
 
 // src/index.ts
 function defineCollection(config) {
@@ -258,6 +286,7 @@ export {
   LIFECYCLE_EVENT_NAMES,
   WORKFLOW_HISTORY_COLLECTION,
   availableWorkflowTransitions,
+  buildSqlOrderBy,
   canViewWorkflowDraft,
   createLifecycleEvent,
   createWorkflowDocument,
@@ -299,6 +328,7 @@ export {
   initializeWorkflowDocument,
   materializeWorkflowDocument,
   normalizeConfig,
+  numericFieldNames,
   parseMongoWhere,
   parseSort,
   parseSqlWhere,
@@ -306,6 +336,7 @@ export {
   resolveAdminAuthCollection,
   runCollectionHooks,
   saveWorkflowDraft,
+  simplePublishingWorkflow,
   transitionWorkflow,
   workflowCapabilities
 };

package/dist/server.cjs

@@ -827,6 +827,20 @@ function mergeWhereConstraint(where, constraint) {
 // src/workflows.ts
 var WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
 var LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
+function simplePublishingWorkflow() {
+  return {
+    initialState: "draft",
+    draftState: "draft",
+    states: [
+      { name: "draft", label: "Draft", color: "neutral" },
+      { name: "published", label: "Published", color: "success", published: true }
+    ],
+    transitions: [
+      { name: "publish", label: "Publish", from: "draft", to: "published" },
+      { name: "unpublish", label: "Unpublish", from: "published", to: "draft", unpublish: true }
+    ]
+  };
+}
 function publicMetadata(meta) {
   const { availableTransitions: _availableTransitions, ...safe } = meta;
   return safe;
@@ -860,9 +874,23 @@ function initializeWorkflowDocument(data, workflow) {
     __workflow: { state: workflow.initialState, revision: 1 }
   };
 }
+function publishedStateName(workflow) {
+  return workflow.states.find((state) => state.published)?.name ?? workflow.states[workflow.states.length - 1]?.name ?? workflow.initialState;
+}
 function materializeWorkflowDocument(doc, workflow, user) {
   const meta = doc.__workflow;
-  if (!meta) return doc;
+  if (!meta) {
+    const { __published: _legacyPublished, __workflow: _legacyWorkflow, ...working2 } = doc;
+    const state = publishedStateName(workflow);
+    return {
+      ...working2,
+      _workflow: {
+        state,
+        revision: 1,
+        availableTransitions: availableWorkflowTransitions(workflow, state, user).map((item) => item.name)
+      }
+    };
+  }
   const { __published, __workflow, ...working } = doc;
   if (!canViewWorkflowDraft(workflow, user)) {
     if (!__published || typeof __published !== "object") return null;
@@ -1122,7 +1150,7 @@ var CollectionController = class {
       });
     }
     const readonlyDb = createReadonlyDb(db);
-    const limit = Number(c.req.query("limit")) || 10;
+    const limit = Math.min(Number(c.req.query("limit")) || 10, 100);
     const page = Number(c.req.query("page")) || 1;
     const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const sort = c.req.query("sort") || void 0;
@@ -1170,7 +1198,8 @@ var CollectionController = class {
       limit,
       page,
       sort,
-      where
+      where,
+      fields: this.collection.fields
     });
     if (result.total === 0 && this.collection.initialData && !where && page === 1) {
       console.log(`[dyrected/core] Auto-seeding collection "${this.collection.slug}" from config.initialData`);
@@ -1182,7 +1211,8 @@ var CollectionController = class {
         limit,
         page,
         sort,
-        where
+        where,
+        fields: this.collection.fields
       });
     }
     result.docs = result.docs.map((doc) => this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc).filter((doc) => doc !== null);
@@ -4352,6 +4382,8 @@ function registerRoutes(app, config) {
       }))),
       upload: !!col.upload,
       auth: !!col.auth,
+      audit: !!col.audit,
+      drafts: !!col.drafts,
       admin: col.admin,
       workflow: col.workflow ? {
         initialState: col.workflow.initialState,
@@ -4672,6 +4704,11 @@ function registerRoutes(app, config) {
     app.patch(path, (c) => controller.update(c));
     app.post(`${path}/seed`, (c) => controller.seed(c));
   }
+  if (!process.env.DYRECTED_JWT_SECRET) {
+    console.warn(
+      '[dyrected] DYRECTED_JWT_SECRET is not set \u2014 token-mode live preview is signing with an insecure default. Set DYRECTED_JWT_SECRET before relying on `previewMode: "token"` in production.'
+    );
+  }
   const previewController = new PreviewController();
   app.post("/api/preview-token", requireAuth(config), (c) => previewController.createToken(c));
   app.get("/api/preview-data", (c) => previewController.getData(c));
@@ -4884,7 +4921,7 @@ function normalizeConfig(config) {
   const collections = config?.collections || [];
   const globals = config?.globals || [];
   const needsAudit = collections.some((col) => col.audit);
-  const needsWorkflow = collections.some((col) => col.workflow);
+  const needsWorkflow = collections.some((col) => col.workflow || col.drafts);
   const adminAuthCollectionSlug = getAdminAuthCollection({
     collections,
     adminAuth: config.adminAuth
@@ -5019,8 +5056,10 @@ function normalizeConfig(config) {
     }
     const updatedFieldNames = new Set(fields.map((f) => f.name));
     const fieldsToInject = SYSTEM_FIELDS.filter((f) => !updatedFieldNames.has(f.name));
+    const workflow = col.workflow || (col.drafts ? simplePublishingWorkflow() : void 0);
     return {
       ...col,
+      workflow,
       fields: [...fields, ...fieldsToInject]
     };
   });

package/dist/server.d.cts

@@ -1,7 +1,7 @@
 import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-C0twGIaF.cjs';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-C0uxEU7Q.cjs';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
 import 'lucide-react';

package/dist/server.d.ts

@@ -1,7 +1,7 @@
 import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-C0twGIaF.js';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-C0uxEU7Q.js';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
 import 'lucide-react';

package/dist/server.js

@@ -13,7 +13,7 @@ import {
   runCollectionHooks,
   saveWorkflowDraft,
   transitionWorkflow
-} from "./chunk-2WODKOUB.js";
+} from "./chunk-35NM2WPO.js";
 
 // src/app.ts
 import { Hono } from "hono";
@@ -611,7 +611,7 @@ var CollectionController = class {
       });
     }
     const readonlyDb = createReadonlyDb(db);
-    const limit = Number(c.req.query("limit")) || 10;
+    const limit = Math.min(Number(c.req.query("limit")) || 10, 100);
     const page = Number(c.req.query("page")) || 1;
     const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const sort = c.req.query("sort") || void 0;
@@ -659,7 +659,8 @@ var CollectionController = class {
       limit,
       page,
       sort,
-      where
+      where,
+      fields: this.collection.fields
     });
     if (result.total === 0 && this.collection.initialData && !where && page === 1) {
       console.log(`[dyrected/core] Auto-seeding collection "${this.collection.slug}" from config.initialData`);
@@ -671,7 +672,8 @@ var CollectionController = class {
         limit,
         page,
         sort,
-        where
+        where,
+        fields: this.collection.fields
       });
     }
     result.docs = result.docs.map((doc) => this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc).filter((doc) => doc !== null);
@@ -2940,6 +2942,8 @@ function registerRoutes(app, config) {
       }))),
       upload: !!col.upload,
       auth: !!col.auth,
+      audit: !!col.audit,
+      drafts: !!col.drafts,
       admin: col.admin,
       workflow: col.workflow ? {
         initialState: col.workflow.initialState,
@@ -3260,6 +3264,11 @@ function registerRoutes(app, config) {
     app.patch(path, (c) => controller.update(c));
     app.post(`${path}/seed`, (c) => controller.seed(c));
   }
+  if (!process.env.DYRECTED_JWT_SECRET) {
+    console.warn(
+      '[dyrected] DYRECTED_JWT_SECRET is not set \u2014 token-mode live preview is signing with an insecure default. Set DYRECTED_JWT_SECRET before relying on `previewMode: "token"` in production.'
+    );
+  }
   const previewController = new PreviewController();
   app.post("/api/preview-token", requireAuth(config), (c) => previewController.createToken(c));
   app.get("/api/preview-data", (c) => previewController.getData(c));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dyrected/core",
-  "version": "2.5.60",
+  "version": "2.5.61",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",