@dyrected/core 2.7.1 → 2.8.0

package/dist/server.cjs

@@ -627,6 +627,7 @@ __export(server_exports, {
   registerRoutes: () => registerRoutes,
   renderPrometheusMetrics: () => renderPrometheusMetrics,
   resolveObservabilityConfig: () => resolveObservabilityConfig,
+  serializeDetailForApi: () => serializeDetailForApi,
   shouldSampleRequest: () => shouldSampleRequest
 });
 module.exports = __toCommonJS(server_exports);
@@ -1259,9 +1260,42 @@ function round(val, decimals = 0) {
 }
 function clamp(val, minVal, maxVal) {
   const num = Number(val) || 0;
-  const min = Number(minVal) || 0;
-  const max = Number(maxVal) || 0;
-  return Math.min(Math.max(num, min), max);
+  const min2 = Number(minVal) || 0;
+  const max2 = Number(maxVal) || 0;
+  return Math.min(Math.max(num, min2), max2);
+}
+function ceil(val) {
+  return Math.ceil(Number(val) || 0);
+}
+function floor(val) {
+  return Math.floor(Number(val) || 0);
+}
+function abs(val) {
+  return Math.abs(Number(val) || 0);
+}
+function min(...args) {
+  const nums = args.flat().map((n) => Number(n) || 0);
+  return nums.length ? Math.min(...nums) : 0;
+}
+function max(...args) {
+  const nums = args.flat().map((n) => Number(n) || 0);
+  return nums.length ? Math.max(...nums) : 0;
+}
+function pow(base, exp) {
+  return Math.pow(Number(base) || 0, Number(exp) || 0);
+}
+function sqrt(val) {
+  return Math.sqrt(Number(val) || 0);
+}
+function sum(arr) {
+  if (!Array.isArray(arr)) return Number(arr) || 0;
+  return arr.reduce((acc, val) => acc + (Number(val) || 0), 0);
+}
+function count(val) {
+  if (Array.isArray(val)) return val.length;
+  if (typeof val === "string") return val.length;
+  if (val !== void 0 && val !== null && val !== false) return 1;
+  return 0;
 }
 function defaultValue(val, fallback) {
   if (val === void 0 || val === null || val === "") return fallback;
@@ -1280,13 +1314,12 @@ function isEmpty(val) {
   return false;
 }
 function get(obj, path, fallback = null) {
-  if (!obj || typeof obj !== "object") return fallback;
-  const pathStr = String(path || "").trim();
-  if (!pathStr) return fallback;
-  const parts = pathStr.split(".");
+  if (obj === void 0 || obj === null || typeof obj !== "object") return fallback;
+  if (typeof path !== "string") return fallback;
+  const parts = path.split(".").filter(Boolean);
   let curr = obj;
   for (const part of parts) {
-    if (curr === void 0 || curr === null) return fallback;
+    if (curr === void 0 || curr === null || typeof curr !== "object") return fallback;
     curr = curr[part];
   }
   return curr === void 0 || curr === null ? fallback : curr;
@@ -1324,6 +1357,15 @@ function registerJexlHelpers(jexlInstance = import_jexl2.default) {
     // Math
     round,
     clamp,
+    ceil,
+    floor,
+    abs,
+    min,
+    max,
+    pow,
+    sqrt,
+    sum,
+    count,
     // Objects & Logical
     default: defaultValue,
     coalesce,
@@ -1335,9 +1377,33 @@ function registerJexlHelpers(jexlInstance = import_jexl2.default) {
       jexlInstance.addFunction(name, fn);
     } catch {
     }
+    try {
+      jexlInstance.addTransform(name, fn);
+    } catch {
+    }
+  }
+  try {
+    jexlInstance.addBinaryOp("and", 20, (left, right) => Boolean(left && right));
+    jexlInstance.addBinaryOp("or", 10, (left, right) => Boolean(left || right));
+  } catch {
   }
 }
 registerJexlHelpers(import_jexl2.default);
+async function evaluateJexl(expression, context = {}) {
+  if (!expression || typeof expression !== "string") return void 0;
+  try {
+    const evalContext = {
+      null: null,
+      undefined: void 0,
+      ...context,
+      math: Math,
+      Math
+    };
+    return await import_jexl2.default.eval(expression, evalContext);
+  } catch (_err) {
+    return void 0;
+  }
+}
 var BUILTIN_JEXL_HELPERS = [
   // Strings
   "slugify",
@@ -1919,7 +1985,7 @@ function collectConfigDiagnostics(config) {
 function formatConfigDiagnostics(source, diagnostics, options = {}) {
   const color = options.color ?? false;
   const header = `${colorize("Config validation failed", 31, color)} in ${colorize(source, 36, color)}`;
-  const docLink = `${colorize("   Learn how to write declarative rules:", 90, color)} ${colorize("https://docs.dyrected.com/docs/features/admin/form-and-field-hooks", 34, color)}`;
+  const docLink = `${colorize("   Learn how to write declarative rules:", 90, color)} ${colorize("https://docs.dyrected.com/docs/editor-experience/form-and-field-hooks", 34, color)}`;
   const lines = diagnostics.flatMap((issue, index) => [
     `${colorize(`${index + 1}.`, 31, color)} ${colorize(issue.path, 1, color)}`,
     `   ${issue.message}`,
@@ -3015,6 +3081,71 @@ async function transitionWorkflow(args) {
 
 // src/controllers/collection.controller.ts
 init_observability();
+
+// src/detail.ts
+function normalizeDetailItem(item) {
+  if (typeof item === "string") {
+    return {
+      type: "field",
+      field: item
+    };
+  }
+  return item;
+}
+async function evaluateDetailComputed(detail, doc, user, db) {
+  if (!doc || !detail || !Array.isArray(detail)) {
+    return doc;
+  }
+  const computedItems = [];
+  const extractComputed = (items) => {
+    for (const rawItem of items) {
+      if (!rawItem) continue;
+      const item = normalizeDetailItem(rawItem);
+      if (item.type === "computed") {
+        const id = item.id || item.label?.toLowerCase().replace(/[^a-z0-9]+/g, "_");
+        if (id) {
+          computedItems.push({
+            id,
+            label: item.label,
+            expression: item.expression,
+            handler: item.handler
+          });
+        }
+      } else if (item.type === "section" || item.type === "grid" || item.type === "repeat") {
+        if (item.items && Array.isArray(item.items)) {
+          extractComputed(item.items);
+        }
+      } else if (item.type === "tabs" && item.tabs && Array.isArray(item.tabs)) {
+        for (const tab of item.tabs) {
+          if (tab.items) extractComputed(tab.items);
+        }
+      }
+    }
+  };
+  extractComputed(detail);
+  if (computedItems.length === 0) return doc;
+  const evaluated = {};
+  for (const item of computedItems) {
+    try {
+      if (typeof item.handler === "function") {
+        evaluated[item.id] = await item.handler({ doc, user, db });
+      } else if (item.expression) {
+        evaluated[item.id] = await evaluateJexl(item.expression, { doc, user });
+      }
+    } catch (_err) {
+      evaluated[item.id] = null;
+    }
+  }
+  return {
+    ...doc,
+    _meta: {
+      ...doc._meta || {},
+      computed: evaluated
+    }
+  };
+}
+
+// src/controllers/collection.controller.ts
 var CollectionController = class {
   collection;
   constructor(collection) {
@@ -3031,6 +3162,22 @@ var CollectionController = class {
   toHookRequestContext(c) {
     return toHookRequestContext(c.req);
   }
+  sanitizeDoc(doc) {
+    if (!doc || typeof doc !== "object") return doc;
+    if (this.collection.auth) {
+      const {
+        password: _p,
+        salt: _s,
+        resetPasswordToken: _rpt,
+        resetPasswordExpires: _rpe,
+        loginAttempts: _la,
+        lockUntil: _lu,
+        ...safeDoc
+      } = doc;
+      return safeDoc;
+    }
+    return doc;
+  }
   async evaluateAccess(c, action, options = {}) {
     const config = c.get("config");
     return resolveCollectionAccess(
@@ -3263,6 +3410,9 @@ var CollectionController = class {
         depth
       );
     }
+    if (this.collection.auth && result.docs && Array.isArray(result.docs)) {
+      result.docs = result.docs.map((d) => this.sanitizeDoc(d));
+    }
     return c.json(result);
   }
   async findOne(c) {
@@ -3279,32 +3429,51 @@ var CollectionController = class {
         id: id2
       });
       const externalSubject = localDoc?.externalSubject || id2;
-      let member = null;
       if (provider.members.get) {
-        member = await provider.members.get({ externalSubject, req: hookReq });
+        const member = await provider.members.get({
+          externalSubject,
+          req: hookReq
+        });
+        if (member) {
+          return c.json({
+            ...member,
+            id: localDoc ? localDoc.id : member.id,
+            externalSubject: member.id
+          });
+        }
       } else if (provider.members.list) {
         const listResult = await provider.members.list({ req: hookReq });
-        member = listResult.docs.find((m) => m.id === externalSubject) || null;
+        const matched = listResult.docs.find((m) => m.id === externalSubject || m.id === id2);
+        if (matched) {
+          return c.json({
+            ...matched,
+            id: localDoc ? localDoc.id : matched.id,
+            externalSubject: matched.id
+          });
+        }
       }
-      if (!member) return c.json({ message: "Not Found" }, 404);
-      return c.json({
-        ...member,
-        id: localDoc ? localDoc.id : member.id,
-        externalSubject: member.id
-      });
     }
-    const readonlyDb = createReadonlyDb(db);
     const id = c.req.param("id");
-    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
-    const user = c.get("user");
     if (!id) return c.json({ message: "Missing ID" }, 400);
-    let doc = await db.findOne({ collection: this.collection.slug, id });
-    if (!doc) return c.json({ message: "Not Found" }, 404);
+    const depth = Number.parseInt(c.req.query("depth") || "0", 10);
+    const user = c.get("user");
+    const doc = await db.findOne({
+      collection: this.collection.slug,
+      id
+    });
+    if (!doc) {
+      return c.json({ message: "Document not found" }, 404);
+    }
+    let effectiveDoc = doc;
     if (this.collection.workflow) {
-      doc = materializeWorkflowDocument(doc, this.collection.workflow, user);
-      if (!doc) return c.json({ message: "Not Found" }, 404);
+      effectiveDoc = materializeWorkflowDocument(
+        doc,
+        this.collection.workflow,
+        user
+      );
+      if (!effectiveDoc) return c.json({ message: "Document not found" }, 404);
     }
-    const access = await this.evaluateAccess(c, "read", { id, doc });
+    const access = await this.evaluateAccess(c, "read", { id, doc: effectiveDoc });
     if (!access.allowed) {
       return c.json(
         {
@@ -3314,7 +3483,11 @@ var CollectionController = class {
         403
       );
     }
-    const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
+    const docWithDefaults = DefaultsService.apply(
+      this.collection.fields,
+      effectiveDoc
+    );
+    const readonlyDb = createReadonlyDb(db);
     const docWithCollectionHooks = await runCollectionHooks(
       this.collection.hooks?.afterRead,
       {
@@ -3340,17 +3513,20 @@ var CollectionController = class {
       },
       docWithFieldHooks
     );
+    let finalDoc = docWithFieldAccess;
     if (depth > 0 && docWithFieldAccess) {
       const populationService = new PopulationService(db, config.collections);
-      const populatedDoc = await populationService.populate({
+      finalDoc = await populationService.populate({
         data: docWithFieldAccess,
         fields: this.collection.fields,
         currentDepth: 0,
         maxDepth: depth
       });
-      return c.json(populatedDoc);
     }
-    return c.json(docWithFieldAccess);
+    if (finalDoc && this.collection.detail) {
+      finalDoc = await evaluateDetailComputed(this.collection.detail, finalDoc, user, readonlyDb);
+    }
+    return c.json(this.sanitizeDoc(finalDoc));
   }
   async create(c) {
     const config = c.get("config");
@@ -4122,6 +4298,63 @@ var CollectionController = class {
       201
     );
   }
+  async aggregate(c) {
+    const config = c.get("config");
+    const db = config.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const access = await this.evaluateAccess(c, "read");
+    if (!access.allowed) {
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: read on ${this.collection.slug}`
+        },
+        403
+      );
+    }
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json({ message: "Invalid JSON body" }, 400);
+    }
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      return c.json(
+        { message: "Aggregate request body must be a JSON object" },
+        400
+      );
+    }
+    const { sanitizeWhereClause: sanitizeWhereClause2 } = await Promise.resolve().then(() => (init_where_sanitizer(), where_sanitizer_exports));
+    const sanitizedAggregates = {};
+    for (const [key, op] of Object.entries(body)) {
+      if (!op || typeof op !== "object" || Array.isArray(op)) {
+        return c.json(
+          {
+            message: `Aggregate operation "${key}" must be an object`
+          },
+          400
+        );
+      }
+      const operation = op;
+      let opWhere = operation.where && typeof operation.where === "object" ? operation.where : void 0;
+      if (opWhere) {
+        opWhere = sanitizeWhereClause2(opWhere, this.collection.fields);
+        if (Object.keys(opWhere).length === 0) opWhere = void 0;
+      }
+      if (access.constraint) {
+        opWhere = opWhere ? mergeWhereConstraint(opWhere, access.constraint) : access.constraint;
+      }
+      sanitizedAggregates[key] = {
+        ...operation,
+        ...opWhere !== void 0 ? { where: opWhere } : { where: void 0 }
+      };
+    }
+    const result = await db.aggregate({
+      collection: this.collection.slug,
+      aggregates: sanitizedAggregates
+    });
+    return c.json(result);
+  }
 };
 
 // src/controllers/global.controller.ts
@@ -4205,17 +4438,25 @@ var GlobalController = class {
       },
       docWithFieldHooks
     );
+    let finalDoc = docWithFieldAccess;
     if (depth > 0 && docWithFieldAccess) {
       const populationService = new PopulationService(db, config.collections);
-      const populatedData = await populationService.populate({
+      finalDoc = await populationService.populate({
         data: docWithFieldAccess,
         fields: this.global.fields,
         currentDepth: 0,
         maxDepth: depth
       });
-      return c.json(populatedData);
     }
-    return c.json(docWithFieldAccess);
+    if (finalDoc && this.global.detail) {
+      finalDoc = await evaluateDetailComputed(
+        this.global.detail,
+        finalDoc,
+        user,
+        readonlyDb
+      );
+    }
+    return c.json(finalDoc);
   }
   async update(c) {
     const config = c.get("config");
@@ -5668,6 +5909,7 @@ var AdminAuthController = class {
     });
   }
   getProvider(config, id) {
+    if (!id) return void 0;
     if (config.adminAuth?.mode !== "external") return void 0;
     return config.adminAuth.providers.find((provider) => provider.id === id);
   }
@@ -5866,17 +6108,16 @@ var AdminAuthController = class {
         throw new Error("OIDC nonce verification failed.");
       }
       claims = payload;
-    } else if (tokenBody.access_token && (provider.userInfoEndpoint || discovery.userinfo_endpoint)) {
-      const userInfo = await fetch(
-        provider.userInfoEndpoint || discovery.userinfo_endpoint,
-        {
-          headers: { Authorization: `Bearer ${tokenBody.access_token}` }
-        }
-      );
+    } else {
+      const userInfoEndpoint = provider.userInfoEndpoint ?? discovery.userinfo_endpoint;
+      if (!tokenBody.access_token || !userInfoEndpoint) {
+        throw new Error("OIDC provider did not return usable identity claims.");
+      }
+      const userInfo = await fetch(userInfoEndpoint, {
+        headers: { Authorization: `Bearer ${tokenBody.access_token}` }
+      });
       if (!userInfo.ok) throw new Error("OIDC userinfo request failed.");
       claims = await userInfo.json();
-    } else {
-      throw new Error("OIDC provider did not return usable identity claims.");
     }
     return {
       identity: this.mapClaims(claims, provider.claimMapping),
@@ -6791,6 +7032,71 @@ function generateOpenApi(config) {
         responses: { 200: { description: "Deleted and failed document IDs" } }
       }
     };
+    spec.paths[`${path}/aggregate`] = {
+      post: {
+        tags: [collectionTag],
+        summary: `Aggregate ${labels.plural}`,
+        description: `Compute statistical aggregations (count, sum, avg, min, max) across ${labels.plural}.`,
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                additionalProperties: {
+                  type: "object",
+                  properties: {
+                    count: { type: "string", example: "*" },
+                    sum: { type: "string", description: "Field to sum" },
+                    avg: { type: "string", description: "Field to average" },
+                    min: { type: "string", description: "Field for minimum" },
+                    max: { type: "string", description: "Field for maximum" },
+                    cast: {
+                      type: "string",
+                      enum: [
+                        "number",
+                        "integer",
+                        "float",
+                        "boolean",
+                        "date",
+                        "string"
+                      ]
+                    },
+                    where: {
+                      type: "object",
+                      description: "Per-aggregate filter condition",
+                      additionalProperties: true
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        responses: {
+          200: {
+            description: "Success",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  additionalProperties: {
+                    type: "number",
+                    nullable: true
+                  }
+                }
+              }
+            }
+          },
+          400: {
+            description: "Bad Request - Invalid aggregate input"
+          },
+          403: {
+            description: "Forbidden - Access denied by read rule"
+          }
+        }
+      }
+    };
     if (collection.audit) {
       spec.paths[`${path}/__audit`] = {
         get: {
@@ -7387,10 +7693,7 @@ function accessGate(config, target, action) {
       req: toHookRequestContext(c.req)
     });
     if (!allowed) {
-      return c.json(
-        { error: true, message: `Access denied: ${action} on ${target.slug}` },
-        403
-      );
+      return c.json({ error: true, message: `Access denied: ${action} on ${target.slug}` }, 403);
     }
     await next();
   };
@@ -7430,6 +7733,80 @@ function serializeBlockForApi(block) {
     fields: block.fields?.map(serializeFieldForApi)
   };
 }
+function serializeDetailItemForApi(item) {
+  if (!item) return item;
+  if (typeof item === "string") {
+    return { type: "field", field: item };
+  }
+  if (item.type === "section") {
+    return {
+      type: "section",
+      title: item.title,
+      items: (item.items || []).map(serializeDetailItemForApi),
+      options: item.options
+    };
+  }
+  if (item.type === "tab") {
+    return {
+      type: "tab",
+      label: item.label,
+      items: (item.items || []).map(serializeDetailItemForApi),
+      options: item.options
+    };
+  }
+  if (item.type === "tabs") {
+    return {
+      type: "tabs",
+      tabs: (item.tabs || []).map(serializeDetailItemForApi),
+      options: item.options
+    };
+  }
+  if (item.type === "grid") {
+    return {
+      type: "grid",
+      columns: item.columns,
+      items: (item.items || []).map(serializeDetailItemForApi),
+      options: item.options
+    };
+  }
+  if (item.type === "repeat") {
+    return {
+      type: "repeat",
+      field: item.field,
+      items: (item.items || []).map(serializeDetailItemForApi),
+      options: item.options
+    };
+  }
+  if (item.type === "computed") {
+    return {
+      type: "computed",
+      id: item.id || item.label?.toLowerCase().replace(/[^a-z0-9]+/g, "_"),
+      label: item.label,
+      expression: item.expression,
+      options: {
+        id: item.id,
+        span: item.options?.span,
+        format: item.options?.format,
+        currency: item.options?.currency,
+        visible: item.options?.visible
+      }
+    };
+  }
+  if (item.type === "field") {
+    return {
+      type: "field",
+      field: item.field,
+      options: item.options
+    };
+  }
+  return item;
+}
+function serializeDetailForApi(detail) {
+  if (detail === false) return false;
+  if (detail === true) return true;
+  if (!detail || !Array.isArray(detail)) return void 0;
+  return detail.map(serializeDetailItemForApi);
+}
 function registerRoutes(app, config) {
   const optionsCache = /* @__PURE__ */ new Map();
   app.get("/api/schemas", optionalAuth(config), async (c) => {
@@ -7448,15 +7825,12 @@ function registerRoutes(app, config) {
       if (typeof access === "boolean") return access;
       if (access && typeof access === "object" && typeof access.policy === "string") {
         const policy = requestConfig.accessPolicies?.[access.policy];
-        if (typeof policy === "string" || typeof policy === "boolean")
-          return policy;
+        if (typeof policy === "string" || typeof policy === "boolean") return policy;
       }
       return resolveBooleanAccess(requestConfig, access, accessArgs);
     };
     const filteredCollections = await Promise.all(
-      collections.filter(
-        (col) => !siteId || col.shared || !col.siteId || col.siteId === siteId
-      ).map(async (col) => ({
+      collections.filter((col) => !siteId || col.shared || !col.siteId || col.siteId === siteId).map(async (col) => ({
         slug: col.slug,
         labels: col.labels,
         access: {
@@ -7494,6 +7868,7 @@ function registerRoutes(app, config) {
         audit: !!col.audit,
         drafts: !!col.drafts,
         admin: col.admin,
+        detail: serializeDetailForApi(col.detail),
         workflow: col.workflow ? {
           initialState: col.workflow.initialState,
           draftState: col.workflow.draftState,
@@ -7512,9 +7887,7 @@ function registerRoutes(app, config) {
       }))
     );
     const filteredGlobals = await Promise.all(
-      globals.filter(
-        (glb) => !siteId || glb.shared || !glb.siteId || glb.siteId === siteId
-      ).map(async (glb) => ({
+      globals.filter((glb) => !siteId || glb.shared || !glb.siteId || glb.siteId === siteId).map(async (glb) => ({
         slug: glb.slug,
         label: glb.label,
         access: {
@@ -7544,7 +7917,8 @@ function registerRoutes(app, config) {
             }
           }))
         ),
-        admin: glb.admin
+        admin: glb.admin,
+        detail: serializeDetailForApi(glb.detail)
       }))
     );
     return c.json({
@@ -7558,148 +7932,137 @@ function registerRoutes(app, config) {
       adminHealth: {
         emailConfigured: !!requestConfig.email,
         secureAuthSecretConfigured: !!process.env.DYRECTED_JWT_SECRET,
-        authCollectionConfigured: requestConfig.collections.some(
-          (collection) => !!collection.auth
-        ),
-        uploadCollectionConfigured: requestConfig.collections.some(
-          (collection) => !!collection.upload
-        )
+        authCollectionConfigured: requestConfig.collections.some((collection) => !!collection.auth),
+        uploadCollectionConfigured: requestConfig.collections.some((collection) => !!collection.upload)
       }
     });
   });
-  app.get(
-    "/api/dyrected/options/:collection/:field",
-    optionalAuth(config),
-    async (c) => {
-      const { collection: colSlug, field: fieldName } = c.req.param();
-      const siteId = c.req.header("X-Site-Id");
-      const requestConfig = siteId && config.onSchemaFetch ? mergeDynamicConfig(config, await config.onSchemaFetch(siteId)) : config;
-      let collections = [...requestConfig.collections];
-      const user = c.get("user");
-      let collection = collections.find((col) => col.slug === colSlug);
-      let field;
-      if (collection) {
-        const accessExpr = collection.access?.read;
-        if (accessExpr !== void 0 && accessExpr !== null) {
-          const allowed = await resolveBooleanAccess(config, accessExpr, {
-            user,
-            req: toHookRequestContext(c.req)
-          });
-          if (!allowed) {
-            return c.json(
-              { error: true, message: `Access denied: read on ${colSlug}` },
-              403
-            );
-          }
-        }
-        field = collection.fields.find((f) => f.name === fieldName);
-      } else {
-        const globals = [...requestConfig.globals];
-        const glb = globals.find((g) => g.slug === colSlug);
-        if (!glb) {
-          return c.json(
-            {
-              error: true,
-              message: `${colSlug} not found as collection or global`
-            },
-            404
-          );
-        }
-        const accessExpr = glb.access?.read;
-        if (accessExpr !== void 0 && accessExpr !== null) {
-          const allowed = await resolveBooleanAccess(config, accessExpr, {
-            user,
-            req: toHookRequestContext(c.req)
-          });
-          if (!allowed) {
-            return c.json(
-              {
-                error: true,
-                message: `Access denied: read on global ${colSlug}`
-              },
-              403
-            );
-          }
+  app.get("/api/dyrected/options/:collection/:field", optionalAuth(config), async (c) => {
+    const { collection: colSlug, field: fieldName } = c.req.param();
+    const siteId = c.req.header("X-Site-Id");
+    const requestConfig = siteId && config.onSchemaFetch ? mergeDynamicConfig(config, await config.onSchemaFetch(siteId)) : config;
+    let collections = [...requestConfig.collections];
+    const user = c.get("user");
+    let collection = collections.find((col) => col.slug === colSlug);
+    let field;
+    if (collection) {
+      const accessExpr = collection.access?.read;
+      if (accessExpr !== void 0 && accessExpr !== null) {
+        const allowed = await resolveBooleanAccess(config, accessExpr, {
+          user,
+          req: toHookRequestContext(c.req)
+        });
+        if (!allowed) {
+          return c.json({ error: true, message: `Access denied: read on ${colSlug}` }, 403);
         }
-        field = glb.fields.find((f) => f.name === fieldName);
       }
-      if (!field) {
+      field = collection.fields.find((f) => f.name === fieldName);
+    } else {
+      const globals = [...requestConfig.globals];
+      const glb = globals.find((g) => g.slug === colSlug);
+      if (!glb) {
         return c.json(
           {
             error: true,
-            message: `Field ${fieldName} not found in ${colSlug}`
+            message: `${colSlug} not found as collection or global`
           },
           404
         );
       }
-      let resolver;
-      let cacheTTL;
-      if (typeof field.options === "function") {
-        resolver = field.options;
-      } else if (field.options && typeof field.options === "object" && "resolve" in field.options) {
-        resolver = field.options.resolve;
-        cacheTTL = field.options.cacheTTL;
-      }
-      if (!resolver) {
-        return c.json(
-          {
-            error: true,
-            message: `Field ${fieldName} in ${colSlug} is not dynamic`
-          },
-          400
-        );
-      }
-      try {
-        const db = c.get("db") || config.db;
-        const queryParams = c.req.query();
-        const reqContext = {
-          query: queryParams,
-          headers: c.req.header(),
-          raw: c.req.raw
-        };
-        const shouldCache = typeof cacheTTL === "number" && cacheTTL > 0;
-        let cacheKey = "";
-        if (shouldCache) {
-          cacheKey = JSON.stringify([
-            siteId ?? "",
-            colSlug,
-            fieldName,
-            user?.id ?? null,
-            queryParams
-          ]);
-          const hit = optionsCache.get(cacheKey);
-          if (hit && hit.expires > Date.now()) {
-            return c.json(hit.value);
-          }
-        }
-        const result = await resolver({
-          db,
+      const accessExpr = glb.access?.read;
+      if (accessExpr !== void 0 && accessExpr !== null) {
+        const allowed = await resolveBooleanAccess(config, accessExpr, {
           user,
-          req: reqContext
+          req: toHookRequestContext(c.req)
         });
-        if (shouldCache) {
-          optionsCache.set(cacheKey, {
-            expires: Date.now() + cacheTTL * 1e3,
-            value: result
-          });
+        if (!allowed) {
+          return c.json(
+            {
+              error: true,
+              message: `Access denied: read on global ${colSlug}`
+            },
+            403
+          );
         }
-        return c.json(result);
-      } catch (err) {
-        getRequestLogger(c, "router").error({
-          err,
-          msg: "Failed to resolve dynamic field options",
-          fieldName
+      }
+      field = glb.fields.find((f) => f.name === fieldName);
+    }
+    if (!field) {
+      return c.json(
+        {
+          error: true,
+          message: `Field ${fieldName} not found in ${colSlug}`
+        },
+        404
+      );
+    }
+    let resolver;
+    let cacheTTL;
+    if (typeof field.options === "function") {
+      resolver = field.options;
+    } else if (field.options && typeof field.options === "object" && "resolve" in field.options) {
+      resolver = field.options.resolve;
+      cacheTTL = field.options.cacheTTL;
+    }
+    if (!resolver) {
+      return c.json(
+        {
+          error: true,
+          message: `Field ${fieldName} in ${colSlug} is not dynamic`
+        },
+        400
+      );
+    }
+    try {
+      const db = c.get("db") || config.db;
+      const queryParams = c.req.query();
+      const reqContext = {
+        query: queryParams,
+        headers: c.req.header(),
+        raw: c.req.raw
+      };
+      const shouldCache = typeof cacheTTL === "number" && cacheTTL > 0;
+      let cacheKey = "";
+      if (shouldCache) {
+        cacheKey = JSON.stringify([
+          siteId ?? "",
+          colSlug,
+          fieldName,
+          user?.id ?? null,
+          queryParams
+        ]);
+        const hit = optionsCache.get(cacheKey);
+        if (hit && hit.expires > Date.now()) {
+          return c.json(hit.value);
+        }
+      }
+      const result = await resolver({
+        db,
+        user,
+        req: reqContext
+      });
+      if (shouldCache) {
+        optionsCache.set(cacheKey, {
+          expires: Date.now() + cacheTTL * 1e3,
+          value: result
         });
-        return c.json(
-          {
-            error: true,
-            message: err.message || "Failed to resolve dynamic options"
-          },
-          500
-        );
       }
+      return c.json(result);
+    } catch (err) {
+      getRequestLogger(c, "router").error({
+        err,
+        msg: "Failed to resolve dynamic field options",
+        fieldName
+      });
+      return c.json(
+        {
+          error: true,
+          message: err.message || "Failed to resolve dynamic options"
+        },
+        500
+      );
     }
-  );
+  });
   app.get("/api/openapi.json", (c) => {
     return c.json(generateOpenApi(config));
   });
@@ -7712,13 +8075,8 @@ function registerRoutes(app, config) {
     const key = c.req.param("key");
     const scope = c.req.query("scope");
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub)
-      return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key)
-      return c.json(
-        { error: true, message: "Preference key is required." },
-        400
-      );
+    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
     const getGlobalPreference = async () => {
       const globalDoc = await db.findOne({
         collection: "__global_preferences",
@@ -7745,13 +8103,8 @@ function registerRoutes(app, config) {
     const key = c.req.param("key");
     const scope = c.req.query("scope");
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub)
-      return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key)
-      return c.json(
-        { error: true, message: "Preference key is required." },
-        400
-      );
+    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
     const body = await c.req.json().catch(() => ({}));
     if (scope === "global") {
       const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
@@ -7799,13 +8152,8 @@ function registerRoutes(app, config) {
     const key = c.req.param("key");
     const scope = c.req.query("scope");
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub)
-      return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key)
-      return c.json(
-        { error: true, message: "Preference key is required." },
-        400
-      );
+    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
     if (scope === "global") {
       const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
       if (!isAdminUser) {
@@ -7844,41 +8192,17 @@ function registerRoutes(app, config) {
     for (const col of uploadCollections) {
       const mediaController = new MediaController(col.slug);
       const prefix = `/api/collections/${col.slug}`;
-      app.get(
-        `${prefix}/media`,
-        accessGate(config, col, "read"),
-        (c) => mediaController.find(c)
-      );
-      app.get(
-        `${prefix}/media/:filename{.+$}`,
-        (c) => mediaController.serve(c)
-      );
-      app.post(
-        `${prefix}/media`,
-        accessGate(config, col, "create"),
-        (c) => mediaController.upload(c)
-      );
-      app.delete(
-        `${prefix}/media/:id`,
-        accessGate(config, col, "delete"),
-        (c) => mediaController.delete(c)
-      );
+      app.get(`${prefix}/media`, accessGate(config, col, "read"), (c) => mediaController.find(c));
+      app.get(`${prefix}/media/:filename{.+$}`, (c) => mediaController.serve(c));
+      app.post(`${prefix}/media`, accessGate(config, col, "create"), (c) => mediaController.upload(c));
+      app.delete(`${prefix}/media/:id`, accessGate(config, col, "delete"), (c) => mediaController.delete(c));
     }
   }
   const adminAuthController = new AdminAuthController(config);
   app.get("/api/admin/auth/providers", (c) => adminAuthController.providers(c));
-  app.get(
-    "/api/admin/auth/:provider/start",
-    (c) => adminAuthController.start(c)
-  );
-  app.get(
-    "/api/admin/auth/:provider/callback",
-    (c) => adminAuthController.callback(c)
-  );
-  app.post(
-    "/api/admin/auth/:provider/exchange",
-    (c) => adminAuthController.exchange(c)
-  );
+  app.get("/api/admin/auth/:provider/start", (c) => adminAuthController.start(c));
+  app.get("/api/admin/auth/:provider/callback", (c) => adminAuthController.callback(c));
+  app.post("/api/admin/auth/:provider/exchange", (c) => adminAuthController.exchange(c));
   app.post("/api/admin/logout", (c) => adminAuthController.logout(c));
   for (const collection of config.collections) {
     if (!collection.auth) continue;
@@ -7889,21 +8213,10 @@ function registerRoutes(app, config) {
     app.get(`${path}/init`, (c) => authController.init(c));
     app.post(`${path}/first-user`, (c) => authController.registerFirstUser(c));
     app.get(`${path}/me`, requireAuth(config), (c) => authController.me(c));
-    app.post(
-      `${path}/refresh-token`,
-      requireAuth(config),
-      (c) => authController.refreshToken(c)
-    );
-    app.post(
-      `${path}/forgot-password`,
-      (c) => authController.forgotPassword(c)
-    );
+    app.post(`${path}/refresh-token`, requireAuth(config), (c) => authController.refreshToken(c));
+    app.post(`${path}/forgot-password`, (c) => authController.forgotPassword(c));
     app.post(`${path}/reset-password`, (c) => authController.resetPassword(c));
-    app.post(
-      `${path}/invite`,
-      requireAuth(config),
-      (c) => authController.invite(c)
-    );
+    app.post(`${path}/invite`, requireAuth(config), (c) => authController.invite(c));
     app.post(`${path}/accept-invite`, (c) => authController.acceptInvite(c));
   }
   const auditController = new AuditController();
@@ -7914,33 +8227,19 @@ function registerRoutes(app, config) {
     app.post(path, (c) => controller.create(c));
     app.post(`${path}/media`, (c) => controller.create(c));
     app.delete(`${path}/delete-many`, (c) => controller.deleteMany(c));
+    app.post(`${path}/aggregate`, (c) => controller.aggregate(c));
     if (collection.audit) {
-      app.get(
-        `${path}/__audit`,
-        (c) => auditController.findForCollection(c, collection)
-      );
+      app.get(`${path}/__audit`, (c) => auditController.findForCollection(c, collection));
     }
     app.get(`${path}/:id`, (c) => controller.findOne(c));
     app.patch(`${path}/:id`, (c) => controller.update(c));
     app.delete(`${path}/:id`, (c) => controller.delete(c));
     if (collection.auth) {
-      app.post(
-        `${path}/:id/change-password`,
-        requireAuth(config),
-        (c) => controller.changePassword(c)
-      );
+      app.post(`${path}/:id/change-password`, requireAuth(config), (c) => controller.changePassword(c));
     }
     if (collection.workflow) {
-      app.post(
-        `${path}/:id/transitions/:transition`,
-        requireAuth(config),
-        (c) => controller.transition(c)
-      );
-      app.get(
-        `${path}/:id/workflow-history`,
-        requireAuth(config),
-        (c) => controller.workflowHistory(c)
-      );
+      app.post(`${path}/:id/transitions/:transition`, requireAuth(config), (c) => controller.transition(c));
+      app.get(`${path}/:id/workflow-history`, requireAuth(config), (c) => controller.workflowHistory(c));
     }
   }
   for (const global of config.globals) {
@@ -7955,11 +8254,7 @@ function registerRoutes(app, config) {
     });
   }
   const previewController = new PreviewController();
-  app.post(
-    "/api/preview-token",
-    requireAuth(config),
-    (c) => previewController.createToken(c)
-  );
+  app.post("/api/preview-token", requireAuth(config), (c) => previewController.createToken(c));
   app.get("/api/preview-data", (c) => previewController.getData(c));
   app.get("/api/audit", (c) => auditController.findAll(c));
   app.get("/api/collections/:slug/__audit", async (c) => {
@@ -7972,81 +8267,49 @@ function registerRoutes(app, config) {
     if (!config2.onSchemaFetch || !siteId) {
       return c.json({ message: `Collection "${slug}" not found` }, 404);
     }
-    const requestConfig = mergeDynamicConfig(
-      config2,
-      await config2.onSchemaFetch(siteId)
-    );
-    const collection = requestConfig.collections.find(
-      (col) => col.slug === slug
-    );
+    const requestConfig = mergeDynamicConfig(config2, await config2.onSchemaFetch(siteId));
+    const collection = requestConfig.collections.find((col) => col.slug === slug);
     if (!collection?.audit) {
-      return c.json(
-        { message: `Collection "${slug}" not found or has no audit log` },
-        404
-      );
+      return c.json({ message: `Collection "${slug}" not found or has no audit log` }, 404);
     }
     return auditController.findForCollection(c, collection);
   });
-  app.post(
-    "/api/collections/:slug/:id/transitions/:transition",
-    requireAuth(config),
-    async (c) => {
-      const slug = c.req.param("slug");
-      const siteId = c.req.header("X-Site-Id") || c.get("siteId");
-      const config2 = c.get("config");
-      if (config2.collections.some((col) => col.slug === slug)) {
-        return c.json({ message: "Not Found" }, 404);
-      }
-      if (!config2.onSchemaFetch || !siteId) {
-        return c.json({ message: `Collection "${slug}" not found` }, 404);
-      }
-      const requestConfig = mergeDynamicConfig(
-        config2,
-        await config2.onSchemaFetch(siteId)
-      );
-      const collection = requestConfig.collections.find(
-        (col) => col.slug === slug
-      );
-      if (!collection?.workflow) {
-        return c.json(
-          { message: `Collection "${slug}" not found or has no workflow` },
-          404
-        );
-      }
-      const controller = new CollectionController(collection);
-      return controller.transition(c);
+  app.post("/api/collections/:slug/:id/transitions/:transition", requireAuth(config), async (c) => {
+    const slug = c.req.param("slug");
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const config2 = c.get("config");
+    if (config2.collections.some((col) => col.slug === slug)) {
+      return c.json({ message: "Not Found" }, 404);
     }
-  );
-  app.get(
-    "/api/collections/:slug/:id/workflow-history",
-    requireAuth(config),
-    async (c) => {
-      const slug = c.req.param("slug");
-      const siteId = c.req.header("X-Site-Id") || c.get("siteId");
-      const config2 = c.get("config");
-      if (config2.collections.some((col) => col.slug === slug)) {
-        return c.json({ message: "Not Found" }, 404);
-      }
-      if (!config2.onSchemaFetch || !siteId) {
-        return c.json({ message: `Collection "${slug}" not found` }, 404);
-      }
-      const requestConfig = mergeDynamicConfig(
-        config2,
-        await config2.onSchemaFetch(siteId)
-      );
-      const collection = requestConfig.collections.find(
-        (col) => col.slug === slug
-      );
-      if (!collection?.workflow) {
-        return c.json(
-          { message: `Collection "${slug}" not found or has no workflow` },
-          404
-        );
-      }
-      const controller = new CollectionController(collection);
-      return controller.workflowHistory(c);
+    if (!config2.onSchemaFetch || !siteId) {
+      return c.json({ message: `Collection "${slug}" not found` }, 404);
     }
-  );
+    const requestConfig = mergeDynamicConfig(config2, await config2.onSchemaFetch(siteId));
+    const collection = requestConfig.collections.find((col) => col.slug === slug);
+    if (!collection?.workflow) {
+      return c.json({ message: `Collection "${slug}" not found or has no workflow` }, 404);
+    }
+    const controller = new CollectionController(collection);
+    return controller.transition(c);
+  });
+  app.get("/api/collections/:slug/:id/workflow-history", requireAuth(config), async (c) => {
+    const slug = c.req.param("slug");
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const config2 = c.get("config");
+    if (config2.collections.some((col) => col.slug === slug)) {
+      return c.json({ message: "Not Found" }, 404);
+    }
+    if (!config2.onSchemaFetch || !siteId) {
+      return c.json({ message: `Collection "${slug}" not found` }, 404);
+    }
+    const requestConfig = mergeDynamicConfig(config2, await config2.onSchemaFetch(siteId));
+    const collection = requestConfig.collections.find((col) => col.slug === slug);
+    if (!collection?.workflow) {
+      return c.json({ message: `Collection "${slug}" not found or has no workflow` }, 404);
+    }
+    const controller = new CollectionController(collection);
+    return controller.workflowHistory(c);
+  });
   app.all("/api/collections/:slug/:id?", async (c) => {
     const slug = c.req.param("slug");
     const id = c.req.param("id");
@@ -8056,13 +8319,8 @@ function registerRoutes(app, config) {
       return c.json({ message: "Method Not Allowed" }, 405);
     }
     if (config2.onSchemaFetch && siteId) {
-      const requestConfig = mergeDynamicConfig(
-        config2,
-        await config2.onSchemaFetch(siteId)
-      );
-      let collection = requestConfig.collections.find(
-        (col) => col.slug === slug
-      );
+      const requestConfig = mergeDynamicConfig(config2, await config2.onSchemaFetch(siteId));
+      let collection = requestConfig.collections.find((col) => col.slug === slug);
       if (!collection && slug === "media") {
         collection = {
           slug: "media",
@@ -8075,25 +8333,19 @@ function registerRoutes(app, config) {
         if (collection.auth && id) {
           const authController = new AuthController(collection);
           const method2 = c.req.method;
-          if (method2 === "POST" && id === "login")
-            return authController.login(c);
-          if (method2 === "POST" && id === "logout")
-            return authController.logout(c);
+          if (method2 === "POST" && id === "login") return authController.login(c);
+          if (method2 === "POST" && id === "logout") return authController.logout(c);
           if (method2 === "GET" && id === "me") return authController.me(c);
-          if (method2 === "POST" && id === "refresh-token")
-            return authController.refreshToken(c);
-          if (method2 === "POST" && id === "forgot-password")
-            return authController.forgotPassword(c);
-          if (method2 === "POST" && id === "reset-password")
-            return authController.resetPassword(c);
+          if (method2 === "POST" && id === "refresh-token") return authController.refreshToken(c);
+          if (method2 === "POST" && id === "forgot-password") return authController.forgotPassword(c);
+          if (method2 === "POST" && id === "reset-password") return authController.resetPassword(c);
         }
         const controller = new CollectionController(collection);
         const method = c.req.method;
         if (id) {
           if (method === "GET") return controller.findOne(c);
           if (method === "PATCH") return controller.update(c);
-          if (method === "DELETE" && id === "delete-many")
-            return controller.deleteMany(c);
+          if (method === "DELETE" && id === "delete-many") return controller.deleteMany(c);
           if (method === "DELETE") return controller.delete(c);
           if (method === "POST" && id === "media") return controller.create(c);
         } else {
@@ -8113,10 +8365,7 @@ function registerRoutes(app, config) {
       return c.json({ message: "Method Not Allowed" }, 405);
     }
     if (config2.onSchemaFetch && siteId) {
-      const requestConfig = mergeDynamicConfig(
-        config2,
-        await config2.onSchemaFetch(siteId)
-      );
+      const requestConfig = mergeDynamicConfig(config2, await config2.onSchemaFetch(siteId));
       const global = requestConfig.globals.find((glb) => glb.slug === slug);
       if (global) {
         const controller = new GlobalController(global);
@@ -8482,7 +8731,7 @@ function resolveClientIp(req, trustProxy = false) {
     const value = normalizeIp(req.headers[header]);
     if (value) return value;
   }
-  if (trustProxy) {
+  if (trustProxy === true || typeof trustProxy === "number") {
     const forwardedFor = pickForwardedFor(req.headers, trustProxy);
     if (forwardedFor) return forwardedFor;
   }
@@ -8494,6 +8743,7 @@ function pickForwardedFor(headers, trustProxy) {
     const chain2 = forwardedHeader.split(",").map((entry) => normalizeIp(entry)).filter((entry) => !!entry);
     if (chain2.length > 0) {
       if (trustProxy === true) return chain2[0];
+      if (trustProxy <= 0) return null;
       const trustedHops2 = Math.max(1, Math.floor(trustProxy));
       const candidateIndex2 = Math.max(0, chain2.length - trustedHops2);
       return chain2[candidateIndex2] ?? chain2[0];
@@ -8506,6 +8756,7 @@ function pickForwardedFor(headers, trustProxy) {
   const chain = matches.map((match) => normalizeIp(match[1])).filter((entry) => !!entry);
   if (chain.length === 0) return null;
   if (trustProxy === true) return chain[0];
+  if (trustProxy <= 0) return null;
   const trustedHops = Math.max(1, Math.floor(trustProxy));
   const candidateIndex = Math.max(0, chain.length - trustedHops);
   return chain[candidateIndex] ?? chain[0];
@@ -8710,7 +8961,7 @@ async function createDyrectedApp(rawConfig) {
   app.use("*", (0, import_cors.cors)(config.cors ? { origin: config.cors.origins } : {}));
   app.get("/health", (c) => c.json({ status: "ok", version: "0.0.1" }));
   if (observability.config.metrics.enabled && observability.config.metrics.exporter === "prometheus" && observability.prometheusExporter) {
-    app.get(observability.config.metrics.path, async (c) => {
+    app.get(observability.config.metrics.path, async (_c) => {
       const metrics = await renderPrometheusMetrics(
         observability.prometheusExporter
       );
@@ -8770,5 +9021,6 @@ init_observability();
   registerRoutes,
   renderPrometheusMetrics,
   resolveObservabilityConfig,
+  serializeDetailForApi,
   shouldSampleRequest
 });