@dyrected/core 2.8.3 → 2.10.0

package/dist/server.d.cts

@@ -2,7 +2,7 @@ import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Context, Hono } from 'hono';
 import { Logger } from 'pino';
-import { D as DyrectedConfig, aY as DyrectedObservabilityConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-BccpBUqJ.cjs';
+import { D as DyrectedConfig, b4 as DyrectedObservabilityConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-DQhcrGDE.cjs';
 import { JWTPayload } from 'jose';
 import { Tracer, Counter, Attributes, Histogram, Span } from '@opentelemetry/api';
 import { PrometheusExporter } from '@opentelemetry/exporter-prometheus';
@@ -157,6 +157,12 @@ interface DyrectedContext {
 declare function createDyrectedApp(rawConfig: DyrectedConfig | any): Promise<Hono<DyrectedContext, hono_types.BlankSchema, "/">>;
 
 declare function serializeDetailForApi(detail?: any): any;
+/**
+ * Serializes an operational view config for the Admin API.
+ * Function properties (action handlers) are stripped so the payload stays
+ * JSON-safe; access rules are resolved to static values the admin can evaluate.
+ */
+declare function serializeViewForApi(view: any, serializeAccess: (access: any) => Promise<any>): Promise<any>;
 /**
  * Register dynamic routes based on the provided configuration.
  */
@@ -374,25 +380,41 @@ declare class CollectionController {
     }, 403, "json">) | (Response & hono.TypedResponse<{
         [x: string]: hono_utils_types.JSONValue;
     }, 201, "json">)>;
-    update(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
+    update(c: Context<DyrectedContext>): Promise<Response>;
+    /**
+     * Core update pipeline shared by PATCH requests and operational actions:
+     * auth-field stripping, timestamps, access enforcement, field write access,
+     * beforeChange hooks, persistence (or workflow draft), audit logging,
+     * afterChange/afterRead hooks, and field read access on the response.
+     */
+    private performUpdate;
+    /**
+     * Runs an operational view action (`defineAction`) against one or more documents.
+     * Declarative mutations are resolved server-side (`now()`, `input.*`, `doc.*`)
+     * and every write flows through the standard update pipeline so the
+     * collection's lifecycle hooks and audit trail still apply.
+     */
+    runViewAction(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
         message: string;
     }, 500, "json">) | (Response & hono.TypedResponse<{
-        message: string;
-    }, 400, "json">) | (Response & hono.TypedResponse<{
-        id: string;
-        externalSubject: string;
-        email: string;
-        name?: string | undefined;
-        roles: string[];
-        siteAccess?: string[] | undefined;
-        status?: "active" | "pending" | undefined;
-    }, hono_utils_http_status.ContentfulStatusCode, "json">) | (Response & hono.TypedResponse<{
+        error: true;
         message: string;
     }, 404, "json">) | (Response & hono.TypedResponse<{
         error: true;
         message: string;
-    }, 403, "json">) | (Response & hono.TypedResponse<{
-        [x: string]: hono_utils_types.JSONValue;
+    }, 400, "json">) | (Response & hono.TypedResponse<{
+        error: true;
+        message: string;
+    }, 403, "json">) | (Response & hono.TypedResponse<never, any, "json">) | (Response & hono.TypedResponse<hono_utils_types.JSONValue, hono_utils_http_status.ContentfulStatusCode, "json">) | (Response & hono.TypedResponse<{
+        updated: number;
+        failed: number;
+        results: {
+            id: string;
+            ok: boolean;
+            status?: number | undefined;
+            doc?: hono_utils_types.JSONValue | undefined;
+            error?: hono_utils_types.JSONValue | undefined;
+        }[];
     }, hono_utils_http_status.ContentfulStatusCode, "json">)>;
     transition(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
         message: string;
@@ -476,7 +498,7 @@ declare class CollectionController {
     }, 403, "json">) | (Response & hono.TypedResponse<{
         message: string;
     }, 400, "json">) | (Response & hono.TypedResponse<{
-        [x: string]: number | null;
+        [x: string]: any;
     }, hono_utils_http_status.ContentfulStatusCode, "json">)>;
 }
 
@@ -576,4 +598,4 @@ declare class PreviewController {
     }, 401, "json">)>;
 }
 
-export { AuthController, CollectionController, type DyrectedContext, type DyrectedObservabilityRuntime, GlobalController, MediaController, PreviewController, type RequestBodyCapture, type RequestTraceContext, type ResolvedObservabilityConfig, attachRequestMetrics, bindObservabilityRuntime, buildRequestLogger, captureRequestBody, createDyrectedApp, createObservabilityRuntime, createRequestSpan, endRequestSpan, getConfigLogger, getObservabilityRuntime, getRequestLogger, redactBody, redactHeaders, registerRoutes, renderPrometheusMetrics, resolveObservabilityConfig, serializeDetailForApi, shouldSampleRequest };
+export { AuthController, CollectionController, type DyrectedContext, type DyrectedObservabilityRuntime, GlobalController, MediaController, PreviewController, type RequestBodyCapture, type RequestTraceContext, type ResolvedObservabilityConfig, attachRequestMetrics, bindObservabilityRuntime, buildRequestLogger, captureRequestBody, createDyrectedApp, createObservabilityRuntime, createRequestSpan, endRequestSpan, getConfigLogger, getObservabilityRuntime, getRequestLogger, redactBody, redactHeaders, registerRoutes, renderPrometheusMetrics, resolveObservabilityConfig, serializeDetailForApi, serializeViewForApi, shouldSampleRequest };

package/dist/server.d.ts

@@ -2,7 +2,7 @@ import * as hono_types from 'hono/types';
 import * as hono from 'hono';
 import { Context, Hono } from 'hono';
 import { Logger } from 'pino';
-import { D as DyrectedConfig, aY as DyrectedObservabilityConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-BccpBUqJ.js';
+import { D as DyrectedConfig, b4 as DyrectedObservabilityConfig, C as CollectionConfig, G as GlobalConfig } from './app-config-DQhcrGDE.js';
 import { JWTPayload } from 'jose';
 import { Tracer, Counter, Attributes, Histogram, Span } from '@opentelemetry/api';
 import { PrometheusExporter } from '@opentelemetry/exporter-prometheus';
@@ -157,6 +157,12 @@ interface DyrectedContext {
 declare function createDyrectedApp(rawConfig: DyrectedConfig | any): Promise<Hono<DyrectedContext, hono_types.BlankSchema, "/">>;
 
 declare function serializeDetailForApi(detail?: any): any;
+/**
+ * Serializes an operational view config for the Admin API.
+ * Function properties (action handlers) are stripped so the payload stays
+ * JSON-safe; access rules are resolved to static values the admin can evaluate.
+ */
+declare function serializeViewForApi(view: any, serializeAccess: (access: any) => Promise<any>): Promise<any>;
 /**
  * Register dynamic routes based on the provided configuration.
  */
@@ -374,25 +380,41 @@ declare class CollectionController {
     }, 403, "json">) | (Response & hono.TypedResponse<{
         [x: string]: hono_utils_types.JSONValue;
     }, 201, "json">)>;
-    update(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
+    update(c: Context<DyrectedContext>): Promise<Response>;
+    /**
+     * Core update pipeline shared by PATCH requests and operational actions:
+     * auth-field stripping, timestamps, access enforcement, field write access,
+     * beforeChange hooks, persistence (or workflow draft), audit logging,
+     * afterChange/afterRead hooks, and field read access on the response.
+     */
+    private performUpdate;
+    /**
+     * Runs an operational view action (`defineAction`) against one or more documents.
+     * Declarative mutations are resolved server-side (`now()`, `input.*`, `doc.*`)
+     * and every write flows through the standard update pipeline so the
+     * collection's lifecycle hooks and audit trail still apply.
+     */
+    runViewAction(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
         message: string;
     }, 500, "json">) | (Response & hono.TypedResponse<{
-        message: string;
-    }, 400, "json">) | (Response & hono.TypedResponse<{
-        id: string;
-        externalSubject: string;
-        email: string;
-        name?: string | undefined;
-        roles: string[];
-        siteAccess?: string[] | undefined;
-        status?: "active" | "pending" | undefined;
-    }, hono_utils_http_status.ContentfulStatusCode, "json">) | (Response & hono.TypedResponse<{
+        error: true;
         message: string;
     }, 404, "json">) | (Response & hono.TypedResponse<{
         error: true;
         message: string;
-    }, 403, "json">) | (Response & hono.TypedResponse<{
-        [x: string]: hono_utils_types.JSONValue;
+    }, 400, "json">) | (Response & hono.TypedResponse<{
+        error: true;
+        message: string;
+    }, 403, "json">) | (Response & hono.TypedResponse<never, any, "json">) | (Response & hono.TypedResponse<hono_utils_types.JSONValue, hono_utils_http_status.ContentfulStatusCode, "json">) | (Response & hono.TypedResponse<{
+        updated: number;
+        failed: number;
+        results: {
+            id: string;
+            ok: boolean;
+            status?: number | undefined;
+            doc?: hono_utils_types.JSONValue | undefined;
+            error?: hono_utils_types.JSONValue | undefined;
+        }[];
     }, hono_utils_http_status.ContentfulStatusCode, "json">)>;
     transition(c: Context<DyrectedContext>): Promise<(Response & hono.TypedResponse<{
         message: string;
@@ -476,7 +498,7 @@ declare class CollectionController {
     }, 403, "json">) | (Response & hono.TypedResponse<{
         message: string;
     }, 400, "json">) | (Response & hono.TypedResponse<{
-        [x: string]: number | null;
+        [x: string]: any;
     }, hono_utils_http_status.ContentfulStatusCode, "json">)>;
 }
 
@@ -576,4 +598,4 @@ declare class PreviewController {
     }, 401, "json">)>;
 }
 
-export { AuthController, CollectionController, type DyrectedContext, type DyrectedObservabilityRuntime, GlobalController, MediaController, PreviewController, type RequestBodyCapture, type RequestTraceContext, type ResolvedObservabilityConfig, attachRequestMetrics, bindObservabilityRuntime, buildRequestLogger, captureRequestBody, createDyrectedApp, createObservabilityRuntime, createRequestSpan, endRequestSpan, getConfigLogger, getObservabilityRuntime, getRequestLogger, redactBody, redactHeaders, registerRoutes, renderPrometheusMetrics, resolveObservabilityConfig, serializeDetailForApi, shouldSampleRequest };
+export { AuthController, CollectionController, type DyrectedContext, type DyrectedObservabilityRuntime, GlobalController, MediaController, PreviewController, type RequestBodyCapture, type RequestTraceContext, type ResolvedObservabilityConfig, attachRequestMetrics, bindObservabilityRuntime, buildRequestLogger, captureRequestBody, createDyrectedApp, createObservabilityRuntime, createRequestSpan, endRequestSpan, getConfigLogger, getObservabilityRuntime, getRequestLogger, redactBody, redactHeaders, registerRoutes, renderPrometheusMetrics, resolveObservabilityConfig, serializeDetailForApi, serializeViewForApi, shouldSampleRequest };

package/dist/server.js

@@ -21,6 +21,7 @@ import {
   mergeDynamicConfig,
   normalizeConfig,
   publishedStateName,
+  require_Jexl,
   revokeAllAuthSessions,
   revokeAuthSession,
   runCollectionHooks,
@@ -29,7 +30,7 @@ import {
   touchAuthSession,
   transitionWorkflow,
   verifyCollectionToken
-} from "./chunk-GFFGDHST.js";
+} from "./chunk-TYPDQTE2.js";
 import {
   attachRequestMetrics,
   bindObservabilityRuntime,
@@ -47,6 +48,9 @@ import {
   resolveObservabilityConfig,
   shouldSampleRequest
 } from "./chunk-FRSJJO27.js";
+import {
+  __toESM
+} from "./chunk-JSBRDJBE.js";
 
 // src/app.ts
 import { Hono } from "hono";
@@ -97,7 +101,7 @@ var DefaultsService = class {
 };
 
 // src/services/population.service.ts
-import jexl from "jexl";
+var import_jexl = __toESM(require_Jexl(), 1);
 var PopulationService = class {
   db;
   collections;
@@ -255,7 +259,7 @@ var PopulationService = class {
                   );
                 } else if (previewUrlPattern.includes("+") || previewUrlPattern.includes("?") || previewUrlPattern.includes("==") || previewUrlPattern.includes("siteUrl")) {
                   try {
-                    resolvedUrl = jexl.evalSync(
+                    resolvedUrl = import_jexl.default.evalSync(
                       previewUrlPattern,
                       docWithDefaults
                     );
@@ -434,12 +438,12 @@ function validateUpload(file, config) {
 }
 
 // src/auth/jexl.ts
-import jexl2 from "jexl";
+var import_jexl2 = __toESM(require_Jexl(), 1);
 async function evaluateAccess(expression, context) {
   if (expression === void 0 || expression === null) return false;
   if (typeof expression === "boolean") return expression;
   try {
-    const result = await jexl2.eval(expression, context);
+    const result = await import_jexl2.default.eval(expression, context);
     if (result && typeof result === "object" && !Array.isArray(result)) {
       return result;
     }
@@ -853,6 +857,45 @@ function mergeWhereConstraint(where, constraint) {
   return where ? { AND: [where, constraint] } : constraint;
 }
 
+// src/utils/action-mutation.ts
+function resolveActionMutation(mutation, ctx) {
+  if (!mutation) return {};
+  return resolveValue(mutation, ctx);
+}
+function resolveValue(value, ctx) {
+  if (typeof value === "string") return resolveExpression(value, ctx);
+  if (Array.isArray(value)) return value.map((item) => resolveValue(item, ctx));
+  if (isPlainObject(value)) {
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+      out[key] = resolveValue(entry, ctx);
+    }
+    return out;
+  }
+  return value;
+}
+function resolveExpression(expression, ctx) {
+  if (expression === "now()") return (/* @__PURE__ */ new Date()).toISOString();
+  const inputPath = expression.match(/^input\.([A-Za-z0-9_.-]+)$/)?.[1];
+  if (inputPath !== void 0) return getPath(ctx.input, inputPath);
+  const docPath = expression.match(/^doc\.([A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*)$/)?.[1];
+  if (docPath !== void 0) return getPath(ctx.doc, docPath);
+  const userPath = expression.match(/^user\.([A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*)$/)?.[1];
+  if (userPath !== void 0 && ctx.user) return getPath(ctx.user, userPath);
+  return expression;
+}
+function getPath(source, path) {
+  let cursor = source;
+  for (const segment of path.split(".")) {
+    if (!cursor || typeof cursor !== "object") return void 0;
+    cursor = cursor[segment];
+  }
+  return cursor;
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/controllers/collection.controller.ts
 var CollectionController = class {
   collection;
@@ -978,7 +1021,7 @@ var CollectionController = class {
       if (this.collection.admin?.filterable === false) {
         where = void 0;
       } else {
-        const { sanitizeWhereClause } = await import("./where-sanitizer-WJ2W2QCE.js");
+        const { sanitizeWhereClause } = await import("./where-sanitizer-3MNFMYA2.js");
         where = sanitizeWhereClause(where, this.collection.fields);
         if (Object.keys(where).length === 0) {
           where = void 0;
@@ -1526,12 +1569,24 @@ var CollectionController = class {
         externalSubject: member.id
       });
     }
-    const readonlyDb = createReadonlyDb(db);
     const id = c.req.param("id");
     if (!id) return c.json({ message: "Missing ID" }, 400);
     const body = await c.req.json();
+    return this.performUpdate(c, id, body);
+  }
+  /**
+   * Core update pipeline shared by PATCH requests and operational actions:
+   * auth-field stripping, timestamps, access enforcement, field write access,
+   * beforeChange hooks, persistence (or workflow draft), audit logging,
+   * afterChange/afterRead hooks, and field read access on the response.
+   */
+  async performUpdate(c, id, rawData) {
+    const config = c.get("config");
+    const db = config.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const readonlyDb = createReadonlyDb(db);
     const user = c.get("user");
-    let data = { ...body };
+    let data = { ...rawData };
     if (this.collection.auth) {
       delete data.password;
       delete data.oldPassword;
@@ -1651,6 +1706,119 @@ var CollectionController = class {
     );
     return c.json(accessibleDoc);
   }
+  /**
+   * Runs an operational view action (`defineAction`) against one or more documents.
+   * Declarative mutations are resolved server-side (`now()`, `input.*`, `doc.*`)
+   * and every write flows through the standard update pipeline so the
+   * collection's lifecycle hooks and audit trail still apply.
+   */
+  async runViewAction(c) {
+    const config = c.get("config");
+    const db = config.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    if (!this.collection.views?.length) {
+      return c.json({ error: true, message: `Collection ${this.collection.slug} has no views` }, 404);
+    }
+    const actionName = c.req.param("action");
+    const viewSlugParam = c.req.param("viewSlug");
+    let action;
+    for (const view2 of this.collection.views) {
+      if (viewSlugParam && view2.slug !== viewSlugParam) continue;
+      const match = view2.actions?.find((candidate) => candidate.name === actionName);
+      if (match) {
+        action = match;
+        break;
+      }
+    }
+    if (!action) {
+      return c.json(
+        { error: true, message: `Action "${actionName}" was not found${viewSlugParam ? ` in view "${viewSlugParam}"` : ""}` },
+        404
+      );
+    }
+    const body = await c.req.json().catch(() => ({}));
+    const requestedIds = Array.isArray(body?.ids) ? body.ids.filter((value) => typeof value === "string") : typeof body?.id === "string" ? [body.id] : [];
+    if (!requestedIds.length) {
+      return c.json(
+        { error: true, message: "Provide an `id` or an `ids` array of documents to act on." },
+        400
+      );
+    }
+    const input = body?.input ?? {};
+    const user = c.get("user");
+    const accessArgs = { user, req: this.toHookRequestContext(c) };
+    const view = viewSlugParam ? this.collection.views.find((candidate) => candidate.slug === viewSlugParam) : void 0;
+    if (view?.access) {
+      const allowed = await resolveBooleanAccess(config, view.access.update ?? view.access.read ?? true, {
+        ...accessArgs,
+        data: input
+      });
+      if (!allowed) {
+        return c.json({ error: true, message: `Access denied: view "${view.slug}"` }, 403);
+      }
+    }
+    if (action.access) {
+      const actionAccess = await resolveBooleanAccess(config, action.access.update ?? true, {
+        ...accessArgs,
+        data: input
+      });
+      if (!actionAccess) {
+        return c.json({ error: true, message: `Access denied: action "${action.name}"` }, 403);
+      }
+    }
+    const results = [];
+    for (const id of requestedIds) {
+      const targetDoc = await db.findOne({ collection: this.collection.slug, id });
+      if (!targetDoc) {
+        results.push({ id, ok: false, status: 404, error: "Not Found" });
+        continue;
+      }
+      let resolvedData;
+      if (typeof action.handler === "function") {
+        try {
+          const handlerResult = await action.handler({
+            doc: targetDoc,
+            docs: [targetDoc],
+            user: user ?? null,
+            input,
+            collection: { slug: this.collection.slug, label: this.collection.labels?.singular ?? this.collection.slug }
+          });
+          resolvedData = handlerResult ?? {};
+        } catch (error) {
+          results.push({ id, ok: false, status: 500, error: error instanceof Error ? error.message : String(error) });
+          continue;
+        }
+      } else {
+        resolvedData = resolveActionMutation(action.mutation, {
+          doc: targetDoc,
+          input,
+          user: user ?? null
+        });
+      }
+      const response = await this.performUpdate(c, id, resolvedData);
+      const ok = response.ok;
+      let payload;
+      try {
+        payload = await response.clone().json();
+      } catch {
+        payload = void 0;
+      }
+      results.push({ id, ok, status: response.status, ...ok ? { doc: payload } : { error: payload } });
+    }
+    if (requestedIds.length === 1) {
+      const single = results[0];
+      if (!single.ok) {
+        return c.json(single.error ?? { error: true, message: "Action failed" }, single.status ?? 500);
+      }
+      return c.json(single.doc);
+    }
+    const failed = results.filter((result) => !result.ok).length;
+    return c.json({
+      updated: results.length - failed,
+      failed,
+      results
+    });
+  }
   async transition(c) {
     const config = c.get("config");
     if (!config.db) return c.json({ message: "Database not configured" }, 500);
@@ -2032,9 +2200,23 @@ var CollectionController = class {
         400
       );
     }
-    const { sanitizeWhereClause } = await import("./where-sanitizer-WJ2W2QCE.js");
+    let rawAggregates;
+    let groupBy;
+    if ("aggregates" in body && typeof body.aggregates === "object" && body.aggregates !== null && !Array.isArray(body.aggregates)) {
+      rawAggregates = body.aggregates;
+      if (typeof body.groupBy === "string" && body.groupBy.trim()) {
+        groupBy = body.groupBy.trim();
+      }
+    } else {
+      rawAggregates = body;
+      const queryGroupBy = c.req.query("groupBy");
+      if (typeof queryGroupBy === "string" && queryGroupBy.trim()) {
+        groupBy = queryGroupBy.trim();
+      }
+    }
+    const { sanitizeWhereClause } = await import("./where-sanitizer-3MNFMYA2.js");
     const sanitizedAggregates = {};
-    for (const [key, op] of Object.entries(body)) {
+    for (const [key, op] of Object.entries(rawAggregates)) {
       if (!op || typeof op !== "object" || Array.isArray(op)) {
         return c.json(
           {
@@ -2059,7 +2241,8 @@ var CollectionController = class {
     }
     const result = await db.aggregate({
       collection: this.collection.slug,
-      aggregates: sanitizedAggregates
+      aggregates: sanitizedAggregates,
+      ...groupBy ? { groupBy } : {}
     });
     return c.json(result);
   }
@@ -4373,6 +4556,47 @@ function serializeDetailForApi(detail) {
   if (!detail || !Array.isArray(detail)) return void 0;
   return detail.map(serializeDetailItemForApi);
 }
+async function serializeViewForApi(view, serializeAccess) {
+  if (!view) return view;
+  const serializeAccessConfig = async (access) => {
+    if (!access) return void 0;
+    const serialized = {};
+    for (const key of ["read", "create", "update", "delete"]) {
+      if (access[key] !== void 0) serialized[key] = await serializeAccess(access[key]);
+    }
+    return serialized;
+  };
+  return {
+    slug: view.slug,
+    label: view.label,
+    icon: view.icon,
+    layout: view.layout ?? "table",
+    filter: view.filter,
+    groupBy: view.groupBy,
+    dateField: view.dateField,
+    startDateField: view.startDateField,
+    endDateField: view.endDateField,
+    columns: view.columns,
+    sort: view.sort,
+    metrics: view.metrics,
+    features: view.features,
+    actionOrder: view.actionOrder,
+    actions: await Promise.all(
+      (view.actions || []).map(async (action) => ({
+        name: action.name,
+        label: action.label,
+        icon: action.icon,
+        type: action.type ?? "row",
+        confirm: action.confirm,
+        fields: action.fields?.map(serializeFieldForApi),
+        mutation: action.mutation,
+        // Self-hosted handlers are intentionally omitted: they never leave the server.
+        access: action.access ? await serializeAccessConfig(action.access) : void 0
+      }))
+    ),
+    access: view.access ? await serializeAccessConfig(view.access) : void 0
+  };
+}
 function registerRoutes(app, config) {
   const optionsCache = /* @__PURE__ */ new Map();
   app.get("/api/schemas", optionalAuth(config), async (c) => {
@@ -4433,6 +4657,8 @@ function registerRoutes(app, config) {
         auth: !!col.auth,
         audit: !!col.audit,
         drafts: !!col.drafts,
+        defaultView: col.defaultView ?? col.admin?.defaultView,
+        views: await Promise.all((col.views || []).map((view) => serializeViewForApi(view, serializeAccess))),
         admin: col.admin,
         detail: serializeDetailForApi(col.detail),
         workflow: col.workflow ? {
@@ -4507,9 +4733,9 @@ function registerRoutes(app, config) {
     const { collection: colSlug, field: fieldName } = c.req.param();
     const siteId = c.req.header("X-Site-Id");
     const requestConfig = siteId && config.onSchemaFetch ? mergeDynamicConfig(config, await config.onSchemaFetch(siteId)) : config;
-    let collections = [...requestConfig.collections];
+    const collections = [...requestConfig.collections];
     const user = c.get("user");
-    let collection = collections.find((col) => col.slug === colSlug);
+    const collection = collections.find((col) => col.slug === colSlug);
     let field;
     if (collection) {
       const accessExpr = collection.access?.read;
@@ -4635,13 +4861,12 @@ function registerRoutes(app, config) {
   app.get("/api/docs", (c) => {
     return c.html(getSwaggerHtml());
   });
-  app.get("/api/preferences/:key", requireAuth(config), async (c) => {
+  app.get("/api/preferences/:key", optionalAuth(config), async (c) => {
     const db = config.db;
     const user = c.get("user");
     const key = c.req.param("key");
     const scope = c.req.query("scope");
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
     if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
     const getGlobalPreference = async () => {
       const globalDoc = await db.findOne({
@@ -4650,12 +4875,15 @@ function registerRoutes(app, config) {
       });
       return globalDoc ? globalDoc.value : null;
     };
-    if (scope === "global") {
+    if (scope === "global" || !user?.collection || !user.sub) {
       const globalValue2 = await getGlobalPreference();
       return c.json({ key, value: globalValue2 });
     }
     const doc = await db.findOne({ collection: user.collection, id: user.sub });
-    if (!doc) return c.json({ error: true, message: "User not found." }, 404);
+    if (!doc) {
+      const globalValue2 = await getGlobalPreference();
+      return c.json({ key, value: globalValue2 });
+    }
     const preferences = typeof doc.__preferences === "object" && doc.__preferences !== null ? doc.__preferences : {};
     if (key in preferences) {
       return c.json({ key, value: preferences[key] ?? null });
@@ -4794,6 +5022,10 @@ function registerRoutes(app, config) {
     app.post(`${path}/media`, (c) => controller.create(c));
     app.delete(`${path}/delete-many`, (c) => controller.deleteMany(c));
     app.post(`${path}/aggregate`, (c) => controller.aggregate(c));
+    if (collection.views?.length) {
+      app.post(`${path}/views/:viewSlug/actions/:action`, optionalAuth(config), (c) => controller.runViewAction(c));
+      app.post(`${path}/actions/:action`, optionalAuth(config), (c) => controller.runViewAction(c));
+    }
     if (collection.audit) {
       app.get(`${path}/__audit`, (c) => auditController.findForCollection(c, collection));
     }
@@ -5256,5 +5488,6 @@ export {
   renderPrometheusMetrics,
   resolveObservabilityConfig,
   serializeDetailForApi,
+  serializeViewForApi,
   shouldSampleRequest
 };

package/dist/{where-sanitizer-WJ2W2QCE.js → where-sanitizer-3MNFMYA2.js}

@@ -1,3 +1,5 @@
+import "./chunk-JSBRDJBE.js";
+
 // src/utils/where-sanitizer.ts
 var NEVER_FILTERABLE_TYPES = [
   "password",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dyrected/core",
-  "version": "2.8.3",
+  "version": "2.10.0",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -58,8 +58,8 @@
   },
   "description": "Core engine and schema handling for Dyrected CMS",
   "scripts": {
-    "build": "tsup src/index.ts src/server.ts --format cjs,esm --dts",
-    "dev": "tsup src/index.ts src/server.ts --format cjs,esm --watch --dts",
+    "build": "NODE_OPTIONS=--max-old-space-size=4096 tsup src/index.ts src/server.ts --format cjs,esm --dts",
+    "dev": "NODE_OPTIONS=--max-old-space-size=4096 tsup src/index.ts src/server.ts --format cjs,esm --watch --dts",
     "lint": "eslint src/**/*.ts",
     "test": "vitest"
   }

package/dist/__tests__/access-features.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=access-features.test.d.ts.map

package/dist/__tests__/access-features.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"access-features.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/access-features.test.ts"],"names":[],"mappings":""}