@dyrected/core 2.6.2 → 2.6.4

package/dist/server.d.cts

@@ -2,7 +2,7 @@ import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
 import { Logger } from 'pino';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-DCWinlNK.cjs';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-CYV70eoF.cjs';
 import { JWTPayload } from 'jose';
 import { Tracer, Counter, Attributes, Histogram, Span } from '@opentelemetry/api';
 import { PrometheusExporter } from '@opentelemetry/exporter-prometheus';
@@ -153,6 +153,9 @@ declare class AuthController {
     private collection;
     constructor(collection: CollectionConfig);
     private sanitizeUser;
+    private hasField;
+    private buildPendingInviteData;
+    private buildAcceptedInviteData;
     private clearLockoutState;
     private recordFailedLogin;
     init(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
@@ -185,6 +188,9 @@ declare class AuthController {
     }, 401, "json">) | (Response & hono.TypedResponse<{
         error: true;
         message: string;
+    }, 403, "json">) | (Response & hono.TypedResponse<{
+        error: true;
+        message: string;
         retryAfterSeconds: number;
     }, 429, "json">) | (Response & hono.TypedResponse<{
         token: string;
@@ -251,6 +257,8 @@ declare class AuthController {
     }, 409, "json">) | (Response & hono.TypedResponse<{
         success: true;
         message: string;
+        token: string;
+        inviteUrl: string | undefined;
     }, hono_utils_http_status.ContentfulStatusCode, "json">)>;
     acceptInvite(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
         message: string;

package/dist/server.d.ts

@@ -2,7 +2,7 @@ import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Hono, Context } from 'hono';
 import { Logger } from 'pino';
-import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-DCWinlNK.js';
+import { D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-CYV70eoF.js';
 import { JWTPayload } from 'jose';
 import { Tracer, Counter, Attributes, Histogram, Span } from '@opentelemetry/api';
 import { PrometheusExporter } from '@opentelemetry/exporter-prometheus';
@@ -153,6 +153,9 @@ declare class AuthController {
     private collection;
     constructor(collection: CollectionConfig);
     private sanitizeUser;
+    private hasField;
+    private buildPendingInviteData;
+    private buildAcceptedInviteData;
     private clearLockoutState;
     private recordFailedLogin;
     init(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
@@ -185,6 +188,9 @@ declare class AuthController {
     }, 401, "json">) | (Response & hono.TypedResponse<{
         error: true;
         message: string;
+    }, 403, "json">) | (Response & hono.TypedResponse<{
+        error: true;
+        message: string;
         retryAfterSeconds: number;
     }, 429, "json">) | (Response & hono.TypedResponse<{
         token: string;
@@ -251,6 +257,8 @@ declare class AuthController {
     }, 409, "json">) | (Response & hono.TypedResponse<{
         success: true;
         message: string;
+        token: string;
+        inviteUrl: string | undefined;
     }, hono_utils_http_status.ContentfulStatusCode, "json">)>;
     acceptInvite(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
         message: string;

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,kCAAkC,CAAC;AACjD,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAClD,cAAc,qCAAqC,CAAC"}

package/dist/server.js

@@ -1,10 +1,15 @@
 import {
   WORKFLOW_HISTORY_COLLECTION,
+  assertValidAdminConditionsInConfig,
+  assertValidDeclarativeAccessInConfig,
+  assertValidDeclarativeHooksInConfig,
+  assertValidPreviewUrlsInConfig,
   attachRequestMetrics,
   bindObservabilityRuntime,
   buildRequestLogger,
   canViewWorkflowDraft,
   captureRequestBody,
+  collectConfigDiagnostics,
   createObservabilityRuntime,
   createRequestSpan,
   createWorkflowDocument,
@@ -36,7 +41,7 @@ import {
   touchAuthSession,
   transitionWorkflow,
   verifyCollectionToken
-} from "./chunk-K3ASMUKV.js";
+} from "./chunk-YEBCT77K.js";
 
 // src/app.ts
 import { Hono } from "hono";
@@ -985,6 +990,10 @@ var CollectionController = class {
         query: where,
         user,
         db: readonlyDb
+      },
+      {
+        surface: "collection.beforeRead",
+        path: `collection:${this.collection.slug}.hooks.beforeRead`
       }
     );
     if (beforeReadResult !== void 0) {
@@ -1267,6 +1276,9 @@ var CollectionController = class {
       user,
       operation: "create",
       db: readonlyDb
+    }, {
+      surface: "collection.beforeChange",
+      path: `collection:${this.collection.slug}.hooks.beforeChange`
     });
     const doc = this.collection.workflow ? (await createWorkflowDocument({
       config,
@@ -1301,6 +1313,9 @@ var CollectionController = class {
       req: c.req,
       user,
       db: readonlyDb
+    }, {
+      surface: "collection.afterRead",
+      path: `collection:${this.collection.slug}.hooks.afterRead`
     });
     const finalDoc = await executeFieldAfterRead(
       this.collection.fields,
@@ -1398,6 +1413,9 @@ var CollectionController = class {
       user,
       operation: "create",
       db: readonlyDb
+    }, {
+      surface: "collection.beforeChange",
+      path: `collection:${this.collection.slug}.hooks.beforeChange`
     });
     const doc = await db.create({
       collection: this.collection.slug,
@@ -1420,6 +1438,9 @@ var CollectionController = class {
       req: c.req,
       user,
       db: readonlyDb
+    }, {
+      surface: "collection.afterRead",
+      path: `collection:${this.collection.slug}.hooks.afterRead`
     });
     const finalDoc = await executeFieldAfterRead(
       this.collection.fields,
@@ -1528,6 +1549,9 @@ var CollectionController = class {
       user,
       operation: "update",
       db: readonlyDb
+    }, {
+      surface: "collection.beforeChange",
+      path: `collection:${this.collection.slug}.hooks.beforeChange`
     });
     const doc = this.collection.workflow ? (await saveWorkflowDraft({
       config,
@@ -1565,6 +1589,9 @@ var CollectionController = class {
       req: c.req,
       user,
       db: readonlyDb
+    }, {
+      surface: "collection.afterRead",
+      path: `collection:${this.collection.slug}.hooks.afterRead`
     });
     const finalDoc = await executeFieldAfterRead(
       this.collection.fields,
@@ -1959,6 +1986,9 @@ var GlobalController = class {
       query: void 0,
       user,
       db: readonlyDb
+    }, {
+      surface: "global.beforeRead",
+      path: `global:${this.global.slug}.hooks.beforeRead`
     });
     let data = await db.getGlobal({ slug: this.global.slug });
     const isEmpty = !data || isFunctionallyEmpty(data);
@@ -1996,6 +2026,10 @@ var GlobalController = class {
         req: c.req,
         user,
         db: readonlyDb
+      },
+      {
+        surface: "global.afterRead",
+        path: `global:${this.global.slug}.hooks.afterRead`
       }
     );
     const docWithFieldHooks = await executeFieldAfterRead(
@@ -2078,6 +2112,9 @@ var GlobalController = class {
       user,
       operation: "update",
       db: readonlyDb
+    }, {
+      surface: "global.beforeChange",
+      path: `global:${this.global.slug}.hooks.beforeChange`
     });
     const updated = await db.updateGlobal({ slug: this.global.slug, data });
     await runCollectionHooks(
@@ -2097,6 +2134,9 @@ var GlobalController = class {
       req: c.req,
       user,
       db: readonlyDb
+    }, {
+      surface: "global.afterRead",
+      path: `global:${this.global.slug}.hooks.afterRead`
     });
     const finalDoc = await executeFieldAfterRead(
       this.global.fields,
@@ -2317,6 +2357,9 @@ var MediaController = class {
   }
 };
 
+// src/controllers/auth.controller.ts
+import { randomBytes as randomBytes2 } from "crypto";
+
 // src/auth/lockout.ts
 var DEFAULT_MAX_LOGIN_ATTEMPTS = 5;
 var DEFAULT_LOCK_TIME_MS = 10 * 60 * 1e3;
@@ -2361,6 +2404,7 @@ var emailTokens = {
     border: "#dde0d7",
     accent: "#b6ff2e",
     code: "#f1f3ec",
+    codeBorder: "#e2e5dc",
     dangerSurface: "#fff2f0",
     dangerBorder: "#ffc9c2",
     dangerText: "#9f251b"
@@ -2410,7 +2454,13 @@ function table(content, style = "width:100%") {
 }
 function detailBox(content, monospace = false) {
   const font = monospace ? emailTokens.mono : emailTokens.font;
-  return table(row(escapeHtml(content), `padding:14px 16px;font-family:${font};font-size:13px;line-height:1.5;font-weight:${monospace ? "400" : "700"};color:${emailTokens.colors.text};word-break:break-all`), `width:100%;background:${emailTokens.colors.code};border-radius:${emailTokens.radius.control}`);
+  return table(
+    row(
+      escapeHtml(content),
+      `padding:14px 16px;font-family:${font};font-size:13px;line-height:1.5;font-weight:${monospace ? "400" : "700"};color:${emailTokens.colors.text};word-break:break-all`
+    ),
+    `width:100%;background:${emailTokens.colors.code};border:1px solid ${emailTokens.colors.codeBorder};border-radius:${emailTokens.radius.control}`
+  );
 }
 function ctaButton(label, href) {
   const safeHref = safeHttpUrl(href);
@@ -2420,22 +2470,46 @@ function ctaButton(label, href) {
     "padding:8px 0 24px"
   ), "width:auto");
 }
+function safeLinkDetailBox(href) {
+  const safeHref = safeHttpUrl(href);
+  if (!safeHref) return "";
+  return detailBox(safeHref, true);
+}
 function alertBox(content) {
   return table(row(escapeHtml(content), `padding:13px 16px;font-family:${emailTokens.font};font-size:13px;line-height:1.5;color:${emailTokens.colors.dangerText}`), `width:100%;background:${emailTokens.colors.dangerSurface};border:1px solid ${emailTokens.colors.dangerBorder};border-radius:${emailTokens.radius.control}`);
 }
 function layout({ preheader, title, content, footer }) {
   return `<!doctype html>
-<html lang="en">
-  <head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"></head>
-  <body style="margin:0;padding:0;background:${emailTokens.colors.canvas}">
-    <div style="display:none;max-height:0;overflow:hidden;opacity:0;color:transparent">${escapeHtml(preheader)}</div>
-    ${table(row(
-    table(
-      row("&nbsp;", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${sectionLabel("Dyrected")}${heading(title)}`, "padding:30px 32px 24px") + row(content, "padding:0 32px 32px") + row(`${divider()}${paragraph(footer, "20px 0 6px")}${paragraph("Privacy: this message contains account-related information; please avoid forwarding it.", "0")}`, "padding:0 32px 28px"),
-      `width:100%;max-width:${emailTokens.width};background:${emailTokens.colors.surface};border:1px solid ${emailTokens.colors.border};border-radius:${emailTokens.radius.card};overflow:hidden`
+<html lang="en" dir="ltr" xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta http-equiv="X-UA-Compatible" content="IE=edge">
+    <meta name="x-apple-disable-message-reformatting">
+    <meta name="format-detection" content="telephone=no,address=no,email=no,date=no,url=no">
+    <meta name="color-scheme" content="light">
+    <meta name="supported-color-schemes" content="light">
+    <title>${escapeHtml(title)}</title>
+  </head>
+  <body style="margin:0;padding:0;background-color:${emailTokens.colors.canvas};word-spacing:normal;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%">
+    <div style="display:none;max-height:0;max-width:0;overflow:hidden;opacity:0;mso-hide:all;color:transparent;font-size:1px;line-height:1px">
+      ${escapeHtml(preheader)}&#8203;&#847;&zwnj;&nbsp;&#8199;&#8199;&#847;&zwnj;&nbsp;
+    </div>
+    <center lang="en" style="width:100%;background-color:${emailTokens.colors.canvas}">
+      ${table(
+    row(
+      table(
+        row("&nbsp;", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${sectionLabel("Dyrected")}${heading(title)}`, "padding:30px 32px 24px") + row(content, "padding:0 32px 32px") + row(
+          `${divider()}${paragraph(footer, "20px 0 6px")}${paragraph("Privacy: this message contains account-related information; please avoid forwarding it.", "0")}`,
+          "padding:0 32px 28px"
+        ),
+        `width:100%;max-width:${emailTokens.width};background:${emailTokens.colors.surface};border:1px solid ${emailTokens.colors.border};border-radius:${emailTokens.radius.card};overflow:hidden`
+      ),
+      "padding:32px 12px"
     ),
-    "padding:32px 12px"
-  ), `width:100%;background:${emailTokens.colors.canvas}`)}
+    `width:100%;background:${emailTokens.colors.canvas}`
+  )}
+    </center>
   </body>
 </html>`;
 }
@@ -2521,12 +2595,14 @@ function buildWelcomeEmail(config, args) {
 }
 function buildInviteEmail(config, args) {
   const custom = config.email?.templates?.invite?.(args);
+  const inviteLink = args.url;
+  const inviteLinkBlock = inviteLink ? safeLinkDetailBox(inviteLink) : "";
   return {
     subject: custom?.subject ?? "You've been invited",
     html: custom?.html ?? layout({
-      preheader: "You've been invited to join a Dyrected account.",
+      preheader: "You've been invited to join a Dyrected admin area.",
       title: "You've been invited",
-      content: `${args.invitedByEmail ? paragraph(`You were invited by ${args.invitedByEmail}.`) : ""}${paragraph("Use the token below to accept your invitation. It expires in 7 days.")}${sectionLabel("Invitation token")}${detailBox(args.token, true)}`,
+      content: inviteLink ? `${args.invitedByEmail ? paragraph(`You were invited by ${args.invitedByEmail}.`) : ""}${paragraph("Use the invitation link below to create your account. The link expires in 7 days.")}${ctaButton("Accept invitation", inviteLink)}${sectionLabel("Invitation link")}${inviteLinkBlock}${paragraph("If the button does not work, copy and paste the link above into your browser.", "12px 0 0")}` : `${args.invitedByEmail ? paragraph(`You were invited by ${args.invitedByEmail}.`) : ""}${paragraph("Use the invitation token below to accept your invitation. It expires in 7 days.")}${sectionLabel("Invitation token")}${detailBox(args.token, true)}`,
       footer: "If you weren't expecting this invitation, you can safely ignore this email."
     })
   };
@@ -2534,12 +2610,13 @@ function buildInviteEmail(config, args) {
 function buildResetPasswordEmail(config, args) {
   const custom = config.email?.templates?.resetPassword?.(args);
   const resetLink = args.url;
+  const resetLinkBlock = resetLink ? safeLinkDetailBox(resetLink) : "";
   return {
     subject: custom?.subject ?? "Reset your password",
     html: custom?.html ?? layout({
       preheader: "Reset your Dyrected password.",
       title: "Reset your password",
-      content: `${paragraph("We received a request to reset your password. The reset link and token expire in 1 hour.")}${resetLink ? ctaButton("Reset password", resetLink) : ""}${sectionLabel(resetLink ? "Or use this token" : "Reset token")}${detailBox(args.token, true)}`,
+      content: resetLink ? `${paragraph("We received a request to reset your password. The reset link expires in 1 hour.")}${ctaButton("Reset password", resetLink)}${sectionLabel("Reset link")}${resetLinkBlock}${paragraph("If the button does not work, copy and paste the link above into your browser.", "12px 0 0")}` : `${paragraph("We received a request to reset your password. The reset token expires in 1 hour.")}${sectionLabel("Reset token")}${detailBox(args.token, true)}`,
       footer: "If you didn't request a password reset, you can safely ignore this email."
     })
   };
@@ -2572,6 +2649,36 @@ var AuthController = class {
     } = user;
     return safeUser;
   }
+  hasField(name) {
+    return (this.collection.fields || []).some((field) => field.name === name);
+  }
+  async buildPendingInviteData(email, extraFields = {}) {
+    const {
+      id: _id,
+      password: _password,
+      email: _email,
+      ...safeExtraFields
+    } = extraFields;
+    const data = {
+      ...safeExtraFields,
+      email,
+      password: await hashPassword(randomBytes2(32).toString("hex"))
+    };
+    if (this.hasField("status")) {
+      data.status = "pending";
+    }
+    return data;
+  }
+  buildAcceptedInviteData(hashedPassword, extraFields) {
+    const data = {
+      ...extraFields,
+      password: hashedPassword
+    };
+    if (this.hasField("status")) {
+      data.status = "active";
+    }
+    return data;
+  }
   clearLockoutState(c, userId) {
     const db = c.get("config").db;
     if (!db) return Promise.resolve(null);
@@ -2706,6 +2813,12 @@ var AuthController = class {
         401
       );
     }
+    if (user.status === "pending") {
+      return c.json(
+        { error: true, message: "This invitation has not been accepted yet." },
+        403
+      );
+    }
     const lockedUntilMs = getLockedUntilMs(user.lockedUntil);
     if (lockedUntilMs !== null && lockedUntilMs > Date.now()) {
       const retryAfterSeconds = Math.max(
@@ -2970,6 +3083,7 @@ var AuthController = class {
   // ---------------------------------------------------------------------------
   // POST /invite
   // Requires auth. Issues a signed invite token and emails it to the invitee.
+  // If inviteUrl is provided, the email uses a clickable acceptance URL.
   // ---------------------------------------------------------------------------
   async invite(c) {
     const config = c.get("config");
@@ -2983,17 +3097,32 @@ var AuthController = class {
     if (!body?.email) {
       return c.json({ error: true, message: "email is required." }, 400);
     }
+    const inviteData = body?.data && typeof body.data === "object" && !Array.isArray(body.data) ? body.data : {};
     const existing = await db.find({
       collection: this.collection.slug,
       where: { email: body.email },
       limit: 1
     });
-    if (existing.total > 0) {
+    const existingUser = existing.docs[0];
+    const existingIsPending = existingUser?.status === "pending";
+    if (existingUser && !existingIsPending) {
       return c.json(
         { error: true, message: "An account with that email already exists." },
         409
       );
     }
+    if (!existingUser) {
+      await db.create({
+        collection: this.collection.slug,
+        data: await this.buildPendingInviteData(body.email, inviteData)
+      });
+    } else if (Object.keys(inviteData).length > 0) {
+      await db.update({
+        collection: this.collection.slug,
+        id: String(existingUser.id),
+        data: await this.buildPendingInviteData(body.email, inviteData)
+      });
+    }
     const inviteToken = await signCollectionToken(
       {
         sub: body.email,
@@ -3003,10 +3132,13 @@ var AuthController = class {
       },
       "7d"
     );
+    const inviteUrl = body?.inviteUrl;
+    const url = inviteUrl ? `${inviteUrl}${inviteUrl.includes("?") ? "&" : "?"}inviteToken=${encodeURIComponent(inviteToken)}` : void 0;
     try {
       const { subject, html } = buildInviteEmail(config, {
         token: inviteToken,
-        invitedByEmail: requestUser.email
+        invitedByEmail: requestUser.email,
+        url
       });
       await sendEmail(config, { to: body.email, subject, html });
     } catch (err) {
@@ -3016,7 +3148,12 @@ var AuthController = class {
         email: body.email
       });
     }
-    return c.json({ success: true, message: `Invite sent to ${body.email}.` });
+    return c.json({
+      success: true,
+      message: `Invite sent to ${body.email}.`,
+      token: inviteToken,
+      inviteUrl: url
+    });
   }
   // ---------------------------------------------------------------------------
   // POST /accept-invite
@@ -3055,7 +3192,9 @@ var AuthController = class {
       where: { email: inviteeEmail },
       limit: 1
     });
-    if (existing.total > 0) {
+    const existingUser = existing.docs[0];
+    const existingIsPending = existingUser?.status === "pending";
+    if (existingUser && !existingIsPending) {
       return c.json(
         { error: true, message: "An account with that email already exists." },
         409
@@ -3063,9 +3202,17 @@ var AuthController = class {
     }
     const { token: _t, password: _p, ...extraFields } = body;
     const hashedPassword = await hashPassword(body.password);
-    const user = await db.create({
+    const user = existingUser ? await db.update({
+      collection: this.collection.slug,
+      id: String(existingUser.id),
+      data: this.buildAcceptedInviteData(hashedPassword, extraFields)
+    }) : await db.create({
       collection: this.collection.slug,
-      data: { ...extraFields, email: inviteeEmail, password: hashedPassword }
+      data: {
+        ...extraFields,
+        email: inviteeEmail,
+        ...this.buildAcceptedInviteData(hashedPassword, {})
+      }
     });
     const sessionToken = await issueAuthSessionToken({
       config,
@@ -3091,7 +3238,7 @@ var AuthController = class {
 };
 
 // src/controllers/admin-auth.controller.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 import { TextEncoder } from "util";
 import {
   SignJWT,
@@ -3305,7 +3452,7 @@ var AdminAuthController = class {
             access.roles,
             access.data
           ),
-          password: await hashPassword(randomBytes2(32).toString("hex"))
+          password: await hashPassword(randomBytes3(32).toString("hex"))
         }
       });
     } else if (user) {
@@ -3391,7 +3538,7 @@ var AdminAuthController = class {
   }
   async buildOidcStartUrl(provider, returnTo, siteId, origin) {
     const discovery = await this.getOidcDiscovery(provider);
-    const nonce = randomBytes2(16).toString("hex");
+    const nonce = randomBytes3(16).toString("hex");
     const state = await this.signState({
       providerId: provider.id,
       returnTo,
@@ -3994,6 +4141,7 @@ function getSwaggerHtml(specUrl) {
 }
 
 // src/router.ts
+var SERIALIZED_ADMIN_HOOK_PREFIX = "__dyrected_fn__:";
 function accessGate(config, target, action) {
   return async (c, next) => {
     const user = c.get("user");
@@ -4020,7 +4168,7 @@ function serializeFieldForApi(f) {
   if (serialized.admin?.hooks) {
     const hooks = { ...serialized.admin.hooks };
     if (typeof hooks.onChange === "function") {
-      hooks.onChange = hooks.onChange.toString();
+      hooks.onChange = `${SERIALIZED_ADMIN_HOOK_PREFIX}${hooks.onChange.toString()}`;
     }
     if (typeof hooks.options === "function") {
       hooks.options = hooks.options.toString();
@@ -4054,6 +4202,10 @@ function registerRoutes(app, config) {
   app.get("/api/schemas", optionalAuth(config), async (c) => {
     const siteId = c.req.header("X-Site-Id");
     const requestConfig = siteId && config.onSchemaFetch ? mergeDynamicConfig(config, await config.onSchemaFetch(siteId)) : config;
+    assertValidDeclarativeHooksInConfig(requestConfig, "/api/schemas");
+    assertValidDeclarativeAccessInConfig(requestConfig, "/api/schemas");
+    assertValidAdminConditionsInConfig(requestConfig, "/api/schemas");
+    assertValidPreviewUrlsInConfig(requestConfig, "/api/schemas");
     const collections = [...requestConfig.collections];
     const globals = [...requestConfig.globals];
     const user = c.get("user");
@@ -4168,7 +4320,18 @@ function registerRoutes(app, config) {
       globals: filteredGlobals,
       admin: requestConfig.admin || {},
       adminAuth: getPublicAdminAuthConfig(requestConfig.adminAuth, collections),
-      hasStorage: !!requestConfig.storage
+      hasStorage: !!requestConfig.storage,
+      configDiagnostics: collectConfigDiagnostics(requestConfig),
+      adminHealth: {
+        emailConfigured: !!requestConfig.email,
+        secureAuthSecretConfigured: !!process.env.DYRECTED_JWT_SECRET,
+        authCollectionConfigured: requestConfig.collections.some(
+          (collection) => !!collection.auth
+        ),
+        uploadCollectionConfigured: requestConfig.collections.some(
+          (collection) => !!collection.upload
+        )
+      }
     });
   });
   app.get(

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,kCAAkC,CAAC;AACjD,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAClD,cAAc,qCAAqC,CAAC"}

package/dist/services/audit.service.d.ts

@@ -0,0 +1,23 @@
+import type { DatabaseAdapter, DyrectedConfig } from '../types/index.js';
+export interface AuditLogArgs {
+    operation: 'create' | 'update' | 'delete';
+    collection: string;
+    documentId?: string;
+    user?: {
+        id: string;
+        collection: string;
+        email?: string;
+    };
+    /** Full state before the operation (null for create). */
+    before?: any;
+    /** Full state after the operation (null for delete). */
+    after?: any;
+}
+export declare class AuditService {
+    /**
+     * Writes a single entry to the __audit collection.
+     * Called without await — runs asynchronously and never blocks the primary operation.
+     */
+    static log(db: DatabaseAdapter, args: AuditLogArgs, config?: DyrectedConfig): Promise<void>;
+}
+//# sourceMappingURL=audit.service.d.ts.map

package/dist/services/audit.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.service.d.ts","sourceRoot":"","sources":["../../src/services/audit.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGzE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,yDAAyD;IACzD,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,wDAAwD;IACxD,KAAK,CAAC,EAAE,GAAG,CAAC;CACb;AAED,qBAAa,YAAY;IACvB;;;OAGG;WACU,GAAG,CACd,EAAE,EAAE,eAAe,EACnB,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,cAAc,GACtB,OAAO,CAAC,IAAI,CAAC;CA8BjB"}

package/dist/services/audit.service.js

@@ -0,0 +1,39 @@
+import { getConfigLogger, getObservabilityRuntime } from '../observability.js';
+export class AuditService {
+    /**
+     * Writes a single entry to the __audit collection.
+     * Called without await — runs asynchronously and never blocks the primary operation.
+     */
+    static async log(db, args, config) {
+        try {
+            await db.create({
+                collection: '__audit',
+                data: {
+                    collection: args.collection,
+                    documentId: args.documentId ?? null,
+                    operation: args.operation,
+                    user: args.user?.id ?? null,
+                    timestamp: new Date().toISOString(),
+                    changes: JSON.stringify({
+                        before: args.before ?? null,
+                        after: args.after ?? null,
+                    }),
+                },
+            });
+        }
+        catch (err) {
+            getObservabilityRuntime(config)?.recordAuditWriteFailure({
+                collection: args.collection,
+                operation: args.operation,
+            });
+            getConfigLogger(config, 'audit').error({
+                err,
+                msg: 'Failed to write audit log',
+                collection: args.collection,
+                operation: args.operation,
+                documentId: args.documentId,
+            });
+        }
+    }
+}
+//# sourceMappingURL=audit.service.js.map

package/dist/services/audit.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.service.js","sourceRoot":"","sources":["../../src/services/audit.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAa/E,MAAM,OAAO,YAAY;IACvB;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,GAAG,CACd,EAAmB,EACnB,IAAkB,EAClB,MAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC;gBACd,UAAU,EAAE,SAAS;gBACrB,IAAI,EAAE;oBACJ,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;oBACnC,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI;oBAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;wBACtB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;wBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;qBAC1B,CAAC;iBACH;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uBAAuB,CAAC,MAAM,CAAC,EAAE,uBAAuB,CAAC;gBACvD,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;YACH,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBACrC,GAAG;gBACH,GAAG,EAAE,2BAA2B;gBAChC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/services/defaults.service.d.ts

@@ -0,0 +1,8 @@
+import type { Field } from '../types/index.js';
+export declare class DefaultsService {
+    /**
+     * Recursively apply default values to a data object based on field definitions.
+     */
+    static apply(fields: Field[], data?: any): any;
+}
+//# sourceMappingURL=defaults.service.d.ts.map

package/dist/services/defaults.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.service.d.ts","sourceRoot":"","sources":["../../src/services/defaults.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE/C,qBAAa,eAAe;IAC1B;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,GAAE,GAAQ,GAAG,GAAG;CA6CnD"}