domma-cms 0.33.1 → 0.34.0

package/admin/js/templates/views-list.html

@@ -5,13 +5,6 @@
     </button>
 </div>
 
-<div id="views-pro-notice" class="card mb-3" style="display:none;">
-    <div class="card-body" style="color:var(--dm-warning,#f59e0b);display:flex;align-items:center;gap:.6rem;">
-        <span data-icon="warning"></span>
-        <span>Views require a MongoDB connection (pro mode). Configure one under Collections → Options.</span>
-    </div>
-</div>
-
 <div class="card">
     <div class="card-body">
         <div id="views-table"></div>

package/admin/js/views/views-list.js

@@ -1 +1 @@
-import{api as l}from"../api.js";import{filterByProject as p,getProjectFromHash as m}from"../lib/project-context.js";function i(s){return String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}export const viewsListView={templateUrl:"/admin/js/templates/views-list.html",async onMount(s){await d(s),s.find("#create-view-btn").off("click").on("click",()=>{R.navigate("/views/new")}),Domma.icons.scan()}};async function d(s){let r=[];try{r=await l.views.list(),s.find("#views-pro-notice").hide()}catch(e){e.message?.includes("MongoDB")||e.message?.includes("pro mode")||e.message?.includes("connection")?s.find("#views-pro-notice").show():E.toast("Could not load views.",{type:"error"})}const c=m();c&&(r=p(r,c)),T.create("#views-table",{data:r,columns:[{key:"title",title:"Title",render:(e,t)=>{const n=document.createElement("a");return n.href=`#/views/${i(t.slug)}/preview`,n.textContent=e,n.style.fontWeight="600",n.outerHTML}},{key:"slug",title:"Slug",render:e=>`<code>${i(e)}</code>`},{key:"pipeline",title:"Source",render:e=>`<code>${i(e?.source||"\u2014")}</code>`},{key:"display",title:"Mode",render:e=>i(e?.mode||"table")},{key:"access",title:"Roles",render:e=>(e?.roles||[]).map(t=>`<span class="badge badge-secondary">${i(t)}</span>`).join(" ")},{key:"slug",title:"Actions",render:e=>{const t=document.createElement("div");t.style.cssText="display:flex;gap:.4rem;justify-content:flex-end;";const n=document.createElement("a");n.href=`#/views/${i(e)}/preview`,n.className="btn btn-sm btn-ghost",n.setAttribute("data-tooltip","Preview"),n.innerHTML='<span data-icon="eye"></span>';const o=document.createElement("a");o.href=`#/views/edit/${i(e)}`,o.className="btn btn-sm btn-ghost",o.setAttribute("data-tooltip","Edit"),o.innerHTML='<span data-icon="edit"></span>';const a=document.createElement("button");return a.className="btn btn-sm btn-danger js-delete-view",a.dataset.slug=e,a.setAttribute("data-tooltip","Delete"),a.innerHTML='<span data-icon="trash"></span>',t.appendChild(n),t.appendChild(o),t.appendChild(a),t.outerHTML}}],emptyMessage:'No views yet. Click "New View" to create your first view.'}),document.querySelectorAll(".js-delete-view").forEach(e=>{e.addEventListener("click",async()=>{const t=e.dataset.slug;if(await E.confirm(`Delete view "${t}"? This cannot be undone.`))try{await l.views.delete(t),E.toast("View deleted.",{type:"success"}),await d(s)}catch{E.toast("Failed to delete view.",{type:"error"})}})}),Domma.icons.scan(),document.querySelectorAll("#views-table [data-tooltip]").forEach(e=>{E.tooltip(e,{content:e.getAttribute("data-tooltip"),position:"top"})})}
+import{api as l}from"../api.js";import{filterByProject as p,getProjectFromHash as m}from"../lib/project-context.js";function a(i){return String(i).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}export const viewsListView={templateUrl:"/admin/js/templates/views-list.html",async onMount(i){await d(i),i.find("#create-view-btn").off("click").on("click",()=>{R.navigate("/views/new")}),Domma.icons.scan()}};async function d(i){let r=[];try{r=await l.views.list()}catch{E.toast("Could not load views.",{type:"error"})}const c=m();c&&(r=p(r,c)),T.create("#views-table",{data:r,columns:[{key:"title",title:"Title",render:(e,t)=>{const n=document.createElement("a");return n.href=`#/views/${a(t.slug)}/preview`,n.textContent=e,n.style.fontWeight="600",n.outerHTML}},{key:"slug",title:"Slug",render:e=>`<code>${a(e)}</code>`},{key:"pipeline",title:"Source",render:e=>`<code>${a(e?.source||"\u2014")}</code>`},{key:"display",title:"Mode",render:e=>a(e?.mode||"table")},{key:"access",title:"Roles",render:e=>(e?.roles||[]).map(t=>`<span class="badge badge-secondary">${a(t)}</span>`).join(" ")},{key:"slug",title:"Actions",render:e=>{const t=document.createElement("div");t.style.cssText="display:flex;gap:.4rem;justify-content:flex-end;";const n=document.createElement("a");n.href=`#/views/${a(e)}/preview`,n.className="btn btn-sm btn-ghost",n.setAttribute("data-tooltip","Preview"),n.innerHTML='<span data-icon="eye"></span>';const s=document.createElement("a");s.href=`#/views/edit/${a(e)}`,s.className="btn btn-sm btn-ghost",s.setAttribute("data-tooltip","Edit"),s.innerHTML='<span data-icon="edit"></span>';const o=document.createElement("button");return o.className="btn btn-sm btn-danger js-delete-view",o.dataset.slug=e,o.setAttribute("data-tooltip","Delete"),o.innerHTML='<span data-icon="trash"></span>',t.appendChild(n),t.appendChild(s),t.appendChild(o),t.outerHTML}}],emptyMessage:'No views yet. Click "New View" to create your first view.'}),document.querySelectorAll(".js-delete-view").forEach(e=>{e.addEventListener("click",async()=>{const t=e.dataset.slug;if(await E.confirm(`Delete view "${t}"? This cannot be undone.`))try{await l.views.delete(t),E.toast("View deleted.",{type:"success"}),await d(i)}catch{E.toast("Failed to delete view.",{type:"error"})}})}),Domma.icons.scan(),document.querySelectorAll("#views-table [data-tooltip]").forEach(e=>{E.tooltip(e,{content:e.getAttribute("data-tooltip"),position:"top"})})}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "0.33.1",
+  "version": "0.34.0",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/routes/api/views.js

@@ -1,5 +1,5 @@
 /**
- * Views API (Pro — requires MongoDB)
+ * Views API
  *
  * Admin endpoints (authenticated + views permission):
  * GET    /views                     - List all view configs

package/server/services/markdown.js

@@ -678,7 +678,7 @@ async function processViewBlocks(markdown, tagSet) {
                 replacement = renderCollectionTable(`view:${slug}`, entries, fields, attrs, ctaOpts);
             }
         } catch {
-            // View not found, MongoDB not configured, or pipeline error — show empty state
+            // View not found or pipeline error — show empty state
         }
 
         if (attrs.class || attrs.id) {
@@ -958,7 +958,7 @@ async function renderViewBrowserShell(attrs) {
             total   = r.total ?? entries.length;
         }
     } catch {
-        // executeView errored (no Pro / view missing) — emit empty shell.
+        // executeView errored (view missing or pipeline error) — emit empty shell.
     }
 
     // Derive a schema-like fields list from the first row so the browser can

package/server/services/viewPipeline.js

@@ -0,0 +1,609 @@
+/**
+ * View Pipeline Evaluator
+ *
+ * Executes the Views feature's allowed aggregation-stage subset in plain
+ * JavaScript so views work on file-backed collections (no MongoDB needed).
+ * MongoDB-backed sources keep using native aggregation in views.js — this
+ * module exists so the SAME view definition produces the same results on
+ * either storage adapter. Documents are the raw entry shape ({id, data,
+ * meta}) and field paths are dot-paths ('data.price', 'meta.createdAt').
+ *
+ * Deliberate divergences from MongoDB (documented, pragmatic):
+ *  - Equality is loose-numeric: the guided view editor emits string values
+ *    even for numeric fields, and strict typing would silently empty views
+ *    that visibly "should" match. (Same trade filterEngine makes.)
+ *  - $sort places missing/null values LAST regardless of direction (Mongo
+ *    treats missing as lowest).
+ *  - $addFields supports literals and '$path' references only — operator
+ *    expressions throw a clear error rather than mis-evaluating.
+ *
+ * Pure module: no imports from other services. $lookup resolves foreign
+ * collections through an injected `resolveCollection(slug)` callback.
+ */
+
+/** Error raised for constructs the evaluator does not support. */
+export class ViewPipelineError extends Error {
+    /**
+     * @param {string} message
+     * @param {string} [stage] - The stage type that raised the error
+     */
+    constructor(message, stage = '') {
+        super(message);
+        this.name = 'ViewPipelineError';
+        this.stage = stage;
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Value helpers
+// ---------------------------------------------------------------------------
+
+/**
+ * Path segments that must never be traversed or written: assigning through
+ * them on plain objects mutates shared prototypes in a long-running server
+ * process. Stage configs are admin-authored JSON, but a typo'd or malicious
+ * '__proto__.x' output path must be inert, not global.
+ */
+const UNSAFE_SEGMENTS = new Set(['__proto__', 'constructor', 'prototype']);
+
+function splitPath(path) {
+    return String(path).split('.');
+}
+
+/**
+ * Resolve a dot-path against a document. Returns undefined through nulls
+ * and refuses to read through prototype-chain segments.
+ *
+ * @param {object} doc
+ * @param {string} path
+ * @returns {*}
+ */
+function getPath(doc, path) {
+    let value = doc;
+    for (const part of splitPath(path)) {
+        if (UNSAFE_SEGMENTS.has(part)) return undefined;
+        if (value === null || value === undefined) return undefined;
+        value = value[part];
+    }
+    return value;
+}
+
+/**
+ * Set a dot-path on a plain object, creating intermediate objects.
+ * Prototype-chain segments throw rather than silently polluting.
+ *
+ * @param {object} target
+ * @param {string} path
+ * @param {*} value
+ */
+function setPath(target, path, value) {
+    const parts = splitPath(path);
+    if (parts.some((p) => UNSAFE_SEGMENTS.has(p))) {
+        throw new ViewPipelineError(`"${path}" is not a valid output field path`);
+    }
+    let node = target;
+    for (let i = 0; i < parts.length - 1; i++) {
+        if (typeof node[parts[i]] !== 'object' || node[parts[i]] === null || Array.isArray(node[parts[i]])) {
+            node[parts[i]] = {};
+        }
+        node = node[parts[i]];
+    }
+    node[parts[parts.length - 1]] = value;
+}
+
+/** Delete a dot-path from a plain object (used by $project exclusion). */
+function deletePath(target, path) {
+    const parts = splitPath(path);
+    if (parts.some((p) => UNSAFE_SEGMENTS.has(p))) return;
+    let node = target;
+    for (let i = 0; i < parts.length - 1; i++) {
+        node = node?.[parts[i]];
+        if (typeof node !== 'object' || node === null) return;
+    }
+    if (typeof node === 'object' && node !== null) delete node[parts[parts.length - 1]];
+}
+
+/** Number('') is 0 — treat empty strings as non-numeric like filterEngine. */
+function maybeNumber(value) {
+    if (typeof value === 'number') return value;
+    if (typeof value === 'string' && value.trim() !== '' && Number.isFinite(Number(value))) {
+        return Number(value);
+    }
+    return null;
+}
+
+/**
+ * Loose scalar equality: strict first, then numeric coercion. Objects
+ * compare by JSON shape (covers $in of object values and $addToSet).
+ */
+function scalarEq(a, b) {
+    if (a === b) return true;
+    const na = maybeNumber(a);
+    const nb = maybeNumber(b);
+    if (na !== null && nb !== null) return na === nb;
+    if (typeof a === 'object' && a !== null && typeof b === 'object' && b !== null) {
+        return JSON.stringify(a) === JSON.stringify(b);
+    }
+    return false;
+}
+
+/**
+ * Mongo-style equality: if the document value is an array, a scalar query
+ * value matches when any element matches (array membership).
+ */
+function looseEq(docValue, queryValue) {
+    if (Array.isArray(docValue) && !Array.isArray(queryValue)) {
+        return docValue.some((el) => scalarEq(el, queryValue));
+    }
+    return scalarEq(docValue, queryValue);
+}
+
+/** Ordering comparison with numeric coercion; undefined never matches. */
+function compare(docValue, queryValue) {
+    if (docValue === undefined || docValue === null) return null;
+    const nd = maybeNumber(docValue);
+    const nq = maybeNumber(queryValue);
+    if (nd !== null && nq !== null) return nd < nq ? -1 : nd > nq ? 1 : 0;
+    const sd = String(docValue);
+    const sq = String(queryValue);
+    return sd < sq ? -1 : sd > sq ? 1 : 0;
+}
+
+// ---------------------------------------------------------------------------
+// $match
+// ---------------------------------------------------------------------------
+
+/** True when a query fragment is an operator object ({$gt: 5, ...}). */
+function isOperatorObject(value) {
+    return value !== null
+        && typeof value === 'object'
+        && !Array.isArray(value)
+        && Object.keys(value).length > 0
+        && Object.keys(value).every((k) => k.startsWith('$'));
+}
+
+/**
+ * Evaluate one field's condition (plain value or operator object) against
+ * a resolved document value.
+ */
+function matchFieldCondition(docValue, condition) {
+    if (!isOperatorObject(condition)) {
+        return looseEq(docValue, condition);
+    }
+
+    for (const [op, arg] of Object.entries(condition)) {
+        switch (op) {
+            case '$eq':
+                if (!looseEq(docValue, arg)) return false;
+                break;
+            case '$ne':
+                if (looseEq(docValue, arg)) return false;
+                break;
+            case '$gt': {
+                const c = compare(docValue, arg);
+                if (c === null || c <= 0) return false;
+                break;
+            }
+            case '$gte': {
+                const c = compare(docValue, arg);
+                if (c === null || c < 0) return false;
+                break;
+            }
+            case '$lt': {
+                const c = compare(docValue, arg);
+                if (c === null || c >= 0) return false;
+                break;
+            }
+            case '$lte': {
+                const c = compare(docValue, arg);
+                if (c === null || c > 0) return false;
+                break;
+            }
+            case '$in':
+                if (!Array.isArray(arg)) throw new ViewPipelineError('$in requires an array', '$match');
+                if (!arg.some((v) => looseEq(docValue, v))) return false;
+                break;
+            case '$nin':
+                if (!Array.isArray(arg)) throw new ViewPipelineError('$nin requires an array', '$match');
+                if (arg.some((v) => looseEq(docValue, v))) return false;
+                break;
+            case '$exists':
+                if (arg ? docValue === undefined : docValue !== undefined) return false;
+                break;
+            case '$regex': {
+                let re;
+                try {
+                    re = arg instanceof RegExp ? arg : new RegExp(arg, condition.$options || '');
+                } catch {
+                    throw new ViewPipelineError(`Invalid $regex pattern: ${arg}`, '$match');
+                }
+                const tested = Array.isArray(docValue)
+                    ? docValue.some((el) => re.test(String(el)))
+                    : docValue !== undefined && docValue !== null && re.test(String(docValue));
+                if (!tested) return false;
+                break;
+            }
+            case '$options':
+                break; // consumed by $regex
+            case '$not':
+                if (matchFieldCondition(docValue, arg)) return false;
+                break;
+            case '$elemMatch': {
+                if (!Array.isArray(docValue)) return false;
+                const some = docValue.some((el) =>
+                    isOperatorObject(arg) || Object.keys(arg || {}).every((k) => k.startsWith('$'))
+                        ? matchFieldCondition(el, arg)
+                        : matchDocument(el, arg));
+                if (!some) return false;
+                break;
+            }
+            default:
+                throw new ViewPipelineError(`"${op}" is not supported for file-backed collections`, '$match');
+        }
+    }
+    return true;
+}
+
+/**
+ * Evaluate a MongoDB query-document subset against a document.
+ * Exported for reuse and direct testing.
+ *
+ * @param {object} doc
+ * @param {object} query
+ * @returns {boolean}
+ */
+export function matchDocument(doc, query) {
+    if (!query || typeof query !== 'object') return true;
+
+    for (const [key, condition] of Object.entries(query)) {
+        if (key === '$and') {
+            if (!Array.isArray(condition)) throw new ViewPipelineError('$and requires an array', '$match');
+            if (!condition.every((sub) => matchDocument(doc, sub))) return false;
+            continue;
+        }
+        if (key === '$or') {
+            if (!Array.isArray(condition)) throw new ViewPipelineError('$or requires an array', '$match');
+            if (!condition.some((sub) => matchDocument(doc, sub))) return false;
+            continue;
+        }
+        if (key === '$nor') {
+            if (!Array.isArray(condition)) throw new ViewPipelineError('$nor requires an array', '$match');
+            if (condition.some((sub) => matchDocument(doc, sub))) return false;
+            continue;
+        }
+        if (key.startsWith('$')) {
+            throw new ViewPipelineError(`"${key}" is not supported for file-backed collections`, '$match');
+        }
+        if (!matchFieldCondition(getPath(doc, key), condition)) return false;
+    }
+    return true;
+}
+
+// ---------------------------------------------------------------------------
+// Stage evaluators
+// ---------------------------------------------------------------------------
+
+function evalSort(docs, config) {
+    const keys = Object.entries(config || {});
+    // Stable in V8; missing values sort last regardless of direction.
+    return [...docs].sort((a, b) => {
+        for (const [path, dirRaw] of keys) {
+            const dir = Number(dirRaw) < 0 ? -1 : 1;
+            const av = getPath(a, path);
+            const bv = getPath(b, path);
+            const aMissing = av === undefined || av === null;
+            const bMissing = bv === undefined || bv === null;
+            if (aMissing && bMissing) continue;
+            if (aMissing) return 1;
+            if (bMissing) return -1;
+            const na = maybeNumber(av);
+            const nb = maybeNumber(bv);
+            let c;
+            if (na !== null && nb !== null) c = na - nb;
+            else c = String(av).localeCompare(String(bv));
+            if (c !== 0) return (c < 0 ? -1 : 1) * dir;
+        }
+        return 0;
+    });
+}
+
+/** Resolve an $addFields / $project value: '$path' ref or literal. */
+function resolveValueSpec(doc, spec, stage) {
+    if (typeof spec === 'string' && spec.startsWith('$')) {
+        return getPath(doc, spec.slice(1));
+    }
+    if (spec !== null && typeof spec === 'object' && !Array.isArray(spec)) {
+        if (Object.keys(spec).some((k) => k.startsWith('$'))) {
+            throw new ViewPipelineError(
+                `operator expressions are not supported for file-backed collections (${stage})`, stage);
+        }
+    }
+    return spec;
+}
+
+function evalProject(docs, config) {
+    const entries = Object.entries(config || {});
+    if (!entries.length) return docs;
+
+    const exclusions = entries.filter(([k, v]) => (v === 0 || v === false) && k !== '_id' && k !== 'id');
+    const inclusions = entries.filter(([k, v]) => !(v === 0 || v === false));
+
+    if (exclusions.length && inclusions.length) {
+        throw new ViewPipelineError('Cannot mix inclusion and exclusion in $project', '$project');
+    }
+
+    if (exclusions.length) {
+        return docs.map((doc) => {
+            const clone = structuredClone(doc);
+            for (const [path] of exclusions) deletePath(clone, path);
+            return clone;
+        });
+    }
+
+    return docs.map((doc) => {
+        const out = {};
+        // id carried unless explicitly excluded ({..., id: 0} — mongo's _id exception)
+        const idExcluded = entries.some(([k, v]) => (k === 'id' || k === '_id') && (v === 0 || v === false));
+        if (!idExcluded && doc.id !== undefined) out.id = doc.id;
+        for (const [path, spec] of inclusions) {
+            const value = (spec === 1 || spec === true)
+                ? getPath(doc, path)
+                : resolveValueSpec(doc, spec, '$project');
+            if (value !== undefined) setPath(out, path, value);
+        }
+        return out;
+    });
+}
+
+function evalAddFields(docs, config) {
+    const entries = Object.entries(config || {});
+    return docs.map((doc) => {
+        const clone = structuredClone(doc);
+        for (const [path, spec] of entries) {
+            setPath(clone, path, resolveValueSpec(doc, spec, '$addFields'));
+        }
+        return clone;
+    });
+}
+
+function evalUnwind(docs, config) {
+    let path;
+    let preserve = false;
+    if (typeof config === 'string') {
+        path = config;
+    } else if (config && typeof config === 'object') {
+        if (config.includeArrayIndex) {
+            throw new ViewPipelineError('includeArrayIndex is not supported for file-backed collections', '$unwind');
+        }
+        path = config.path;
+        preserve = !!config.preserveNullAndEmptyArrays;
+    }
+    if (typeof path !== 'string' || !path.startsWith('$')) {
+        throw new ViewPipelineError('$unwind requires a "$path" string', '$unwind');
+    }
+    const fieldPath = path.slice(1);
+
+    const out = [];
+    for (const doc of docs) {
+        const value = getPath(doc, fieldPath);
+        if (Array.isArray(value)) {
+            if (!value.length) {
+                if (preserve) {
+                    const clone = structuredClone(doc);
+                    deletePath(clone, fieldPath);
+                    out.push(clone);
+                }
+                continue;
+            }
+            for (const el of value) {
+                const clone = structuredClone(doc);
+                setPath(clone, fieldPath, el);
+                out.push(clone);
+            }
+        } else if (value === undefined || value === null) {
+            if (preserve) {
+                const clone = structuredClone(doc);
+                deletePath(clone, fieldPath);
+                out.push(clone);
+            }
+        } else {
+            out.push(doc); // non-array scalar passes through (mongo semantics)
+        }
+    }
+    return out;
+}
+
+function resolveGroupId(doc, idSpec) {
+    if (idSpec === null || idSpec === undefined) return null;
+    if (typeof idSpec === 'string' && idSpec.startsWith('$')) return getPath(doc, idSpec.slice(1));
+    if (typeof idSpec === 'object' && !Array.isArray(idSpec)) {
+        const out = {};
+        for (const [k, v] of Object.entries(idSpec)) {
+            out[k] = (typeof v === 'string' && v.startsWith('$')) ? getPath(doc, v.slice(1)) : v;
+        }
+        return out;
+    }
+    return idSpec; // literal
+}
+
+function evalGroup(docs, config) {
+    const { _id: idSpec = null, ...accums } = config || {};
+
+    // Validate accumulators up front
+    const ACCS = new Set(['$sum', '$avg', '$min', '$max', '$first', '$last', '$push', '$addToSet']);
+    for (const [field, spec] of Object.entries(accums)) {
+        if (!spec || typeof spec !== 'object' || Object.keys(spec).length !== 1) {
+            throw new ViewPipelineError(`$group field "${field}" must be a single accumulator object`, '$group');
+        }
+        const acc = Object.keys(spec)[0];
+        if (!ACCS.has(acc)) {
+            throw new ViewPipelineError(`"${acc}" is not supported for file-backed collections`, '$group');
+        }
+    }
+
+    const groups = new Map(); // key → { _id, docs: [] }
+    for (const doc of docs) {
+        const id = resolveGroupId(doc, idSpec);
+        const key = JSON.stringify(id ?? null);
+        if (!groups.has(key)) groups.set(key, { _id: id ?? null, docs: [] });
+        groups.get(key).docs.push(doc);
+    }
+
+    const resolveArg = (doc, arg) =>
+        (typeof arg === 'string' && arg.startsWith('$')) ? getPath(doc, arg.slice(1)) : arg;
+
+    const out = [];
+    for (const { _id, docs: members } of groups.values()) {
+        const row = { _id };
+        for (const [field, spec] of Object.entries(accums)) {
+            const [acc] = Object.keys(spec);
+            const arg = spec[acc];
+            switch (acc) {
+                case '$sum': {
+                    let sum = 0;
+                    for (const m of members) {
+                        const v = maybeNumber(resolveArg(m, arg));
+                        if (v !== null) sum += v;
+                    }
+                    row[field] = sum;
+                    break;
+                }
+                case '$avg': {
+                    const nums = members.map((m) => maybeNumber(resolveArg(m, arg))).filter((v) => v !== null);
+                    row[field] = nums.length ? nums.reduce((a, b) => a + b, 0) / nums.length : null;
+                    break;
+                }
+                case '$min':
+                case '$max': {
+                    let best;
+                    for (const m of members) {
+                        const v = resolveArg(m, arg);
+                        if (v === undefined || v === null) continue;
+                        if (best === undefined) { best = v; continue; }
+                        const c = compare(v, best);
+                        if (c !== null && ((acc === '$min' && c < 0) || (acc === '$max' && c > 0))) best = v;
+                    }
+                    row[field] = best ?? null;
+                    break;
+                }
+                case '$first':
+                    row[field] = resolveArg(members[0], arg);
+                    break;
+                case '$last':
+                    row[field] = resolveArg(members[members.length - 1], arg);
+                    break;
+                case '$push':
+                    row[field] = members.map((m) => resolveArg(m, arg));
+                    break;
+                case '$addToSet': {
+                    const set = [];
+                    for (const m of members) {
+                        const v = resolveArg(m, arg);
+                        if (!set.some((s) => scalarEq(s, v))) set.push(v);
+                    }
+                    row[field] = set;
+                    break;
+                }
+            }
+        }
+        out.push(row);
+    }
+    return out;
+}
+
+async function evalLookup(docs, config, resolveCollection, lookupCache) {
+    const { from, localField, foreignField, as } = config || {};
+    if (!from || !localField || !foreignField || !as) {
+        throw new ViewPipelineError(
+            'Only the equality form of $lookup ({from, localField, foreignField, as}) is supported for file-backed collections',
+            '$lookup');
+    }
+    if (typeof resolveCollection !== 'function') {
+        throw new ViewPipelineError('$lookup requires a collection resolver', '$lookup');
+    }
+
+    // Mongo-authored views reference `cms_<slug>` collection names — accept both.
+    const slug = String(from).replace(/^cms_/, '');
+    if (!lookupCache.has(slug)) {
+        lookupCache.set(slug, await resolveCollection(slug));
+    }
+    const foreign = lookupCache.get(slug) || [];
+
+    return docs.map((doc) => {
+        const localValue = getPath(doc, localField);
+        const matches = foreign.filter((f) => {
+            const fv = getPath(f, foreignField);
+            if (Array.isArray(localValue)) return localValue.some((lv) => looseEq(fv, lv));
+            return looseEq(fv, localValue) || looseEq(localValue, fv);
+        });
+        const clone = structuredClone(doc);
+        setPath(clone, as, structuredClone(matches));
+        return clone;
+    });
+}
+
+// ---------------------------------------------------------------------------
+// Pipeline driver
+// ---------------------------------------------------------------------------
+
+/**
+ * Execute a pipeline (mongo-form stage objects) over an array of documents.
+ * Returns the FULL result set — the caller paginates.
+ *
+ * @param {object[]} docs
+ * @param {object[]} stages - [{$match: {...}}, {$sort: {...}}, ...]
+ * @param {object}   [opts]
+ * @param {function} [opts.resolveCollection] - async (slug) => object[] (for $lookup)
+ * @returns {Promise<object[]>}
+ * @throws {ViewPipelineError} On unsupported constructs
+ */
+export async function executePipeline(docs, stages, { resolveCollection } = {}) {
+    let current = docs;
+    const lookupCache = new Map();
+
+    for (const stage of stages || []) {
+        const keys = Object.keys(stage || {});
+        if (keys.length !== 1) {
+            throw new ViewPipelineError('Each pipeline stage must have exactly one stage type');
+        }
+        const type = keys[0];
+        const config = stage[type];
+
+        switch (type) {
+            case '$match':
+                current = current.filter((doc) => matchDocument(doc, config));
+                break;
+            case '$sort':
+                current = evalSort(current, config);
+                break;
+            case '$project':
+                current = evalProject(current, config);
+                break;
+            case '$addFields':
+                current = evalAddFields(current, config);
+                break;
+            case '$unwind':
+                current = evalUnwind(current, config);
+                break;
+            case '$group':
+                current = evalGroup(current, config);
+                break;
+            case '$lookup':
+                current = await evalLookup(current, config, resolveCollection, lookupCache);
+                break;
+            case '$limit':
+                current = current.slice(0, Math.max(0, Number(config) || 0));
+                break;
+            case '$skip':
+                current = current.slice(Math.max(0, Number(config) || 0));
+                break;
+            case '$count':
+                current = [{ [String(config || 'count')]: current.length }];
+                break;
+            default:
+                throw new ViewPipelineError(`"${type}" is not supported for file-backed collections`, type);
+        }
+    }
+
+    return current;
+}

package/server/services/views.js

@@ -1,27 +1,51 @@
 /**
- * Views Service (Pro — requires MongoDB)
+ * Views Service
  *
- * View configs are stored in MongoDB `cms__views` on the 'default' connection.
- * The `connection` field in each view config specifies which connection to use
- * when executing the aggregation pipeline.
+ * View configs are stored as JSON files in content/views/ (always file-based,
+ * like collection schemas and forms). Execution dispatches on the SOURCE
+ * collection's storage adapter:
  *
- * Allowed aggregation stage types (Phase 1):
+ *  - mongodb-backed source with a live connection → native MongoDB
+ *    aggregation (unchanged from the original implementation)
+ *  - everything else → the built-in JS pipeline evaluator (viewPipeline.js)
+ *    over the collection adapter's documents
+ *
+ * The same view definition therefore works on both storage adapters —
+ * field paths are raw-document dot-paths ('data.price', 'meta.createdAt')
+ * in both cases.
+ *
+ * Older installs that stored view configs in the MongoDB `cms__views`
+ * collection are migrated to files automatically (one-time, read-only —
+ * the Mongo collection is never modified).
+ *
+ * Allowed aggregation stage types:
  *   $match, $lookup, $sort, $project, $unwind, $limit, $skip, $count,
  *   $addFields, $group
  *
  * Forbidden stage types:
  *   $out, $merge, $function, $accumulator, $graphLookup
  */
+import fs from 'fs/promises';
+import path from 'path';
+import {fileURLToPath} from 'url';
 import {v4 as uuidv4} from 'uuid';
 import {buildRowLevelMatch} from './rowAccess.js';
+import {executePipeline} from './viewPipeline.js';
 import * as cache from './cache/index.js';
 
-/** MongoDB collection where view configs are stored. */
-const VIEWS_COLLECTION = 'cms__views';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ROOT      = path.resolve(__dirname, '..', '..');
+export const VIEWS_DIR = path.join(ROOT, 'content', 'views');
+
+/** Legacy MongoDB collection where pre-0.34 view configs were stored. */
+const LEGACY_VIEWS_COLLECTION = 'cms__views';
 
 /** Prefix applied to CMS data collections — mirrors MongoAdapter.PREFIX. */
 const COLLECTION_PREFIX = 'cms_';
 
+/** Filename/lookup guard — view slugs are slugified, so keep this strict. */
+const SLUG_RE = /^[a-z0-9-]+$/;
+
 const ALLOWED_STAGES = new Set([
     '$match', '$lookup', '$sort', '$project',
     '$unwind', '$limit', '$skip', '$count',
@@ -36,21 +60,6 @@ const FORBIDDEN_STAGES = new Set([
 // Internal helpers
 // ---------------------------------------------------------------------------
 
-/**
- * Get the Db instance for storing/reading view configs ('default' connection).
- *
- * @returns {Promise<import('mongodb').Db>}
- * @throws {Error} If MongoDB is not configured
- */
-async function getMetaDb() {
-    try {
-        const { getDb } = await import('./connectionManager.js');
-        return getDb('default');
-    } catch {
-        throw new Error('Views require a MongoDB connection. Configure a "default" connection in pro mode.');
-    }
-}
-
 /**
  * Slugify a string to a URL-safe identifier.
  *
@@ -89,22 +98,135 @@ function buildPipelineStages(stages) {
     return stages.map(stage => ({ [stage.type]: stage.config }));
 }
 
+// ---------------------------------------------------------------------------
+// File storage
+// ---------------------------------------------------------------------------
+
+/**
+ * Ensure the views directory exists. Lazy — engine updates never touch
+ * content/, so the dir is created on first write.
+ *
+ * @returns {Promise<void>}
+ */
+export async function ensureViewsDir() {
+    await fs.mkdir(VIEWS_DIR, { recursive: true });
+}
+
+/**
+ * Read a single view config by slug (no migration hook — internal/raw).
+ *
+ * @param {string} slug
+ * @returns {Promise<object>}
+ * @throws {Error} If the view file does not exist or cannot be parsed.
+ */
+export async function readView(slug) {
+    const file = path.join(VIEWS_DIR, `${slug}.json`);
+    return JSON.parse(await fs.readFile(file, 'utf8'));
+}
+
+/**
+ * Write a view config to disk and invalidate its cache tag.
+ *
+ * @param {string} slug
+ * @param {object} view
+ * @returns {Promise<void>}
+ */
+export async function writeView(slug, view) {
+    await ensureViewsDir();
+    const file = path.join(VIEWS_DIR, `${slug}.json`);
+    await fs.writeFile(file, JSON.stringify(view, null, 4) + '\n', 'utf8');
+    await cache.invalidateTags([`view:${slug}`]);
+}
+
+// ---------------------------------------------------------------------------
+// One-time migration from the legacy MongoDB store
+// ---------------------------------------------------------------------------
+
+let migrationPromise = null;
+
+function ensureMigrated() {
+    if (!migrationPromise) migrationPromise = migrateFromMongo().catch(() => {});
+    return migrationPromise;
+}
+
+/**
+ * Migrate pre-0.34 view configs from the MongoDB `cms__views` collection to
+ * content/views/*.json. Best-effort and READ-ONLY on the Mongo side: any
+ * failure (no mongodb package, no connection, empty collection) is a silent
+ * no-op, and existing view files always win.
+ *
+ * @param {object} [opts]
+ * @param {function} [opts.getDbImpl] - Injectable getDb for tests
+ * @returns {Promise<void>}
+ */
+export async function migrateFromMongo({ getDbImpl } = {}) {
+    // Any view file present = already migrated / already in use.
+    try {
+        const entries = await fs.readdir(VIEWS_DIR);
+        if (entries.some(e => e.endsWith('.json'))) return;
+    } catch { /* dir absent — proceed */ }
+
+    let db;
+    try {
+        const getDb = getDbImpl ?? (await import('./connectionManager.js')).getDb;
+        db = getDb('default');
+    } catch {
+        return; // file-mode install — nothing to migrate
+    }
+
+    let docs;
+    try {
+        docs = await db.collection(LEGACY_VIEWS_COLLECTION)
+            .find({}, { projection: { _id: 0 } })
+            .toArray();
+    } catch {
+        return;
+    }
+    if (!docs.length) return;
+
+    let migrated = 0;
+    for (const doc of docs) {
+        const slug = slugify(String(doc.slug || ''));
+        if (!slug) continue;
+        try {
+            await writeView(slug, { ...doc, slug });
+            migrated++;
+        } catch { /* skip unwritable doc */ }
+    }
+    if (migrated) {
+        console.log(`[views] Migrated ${migrated} view config(s) from MongoDB to content/views/`);
+    }
+}
+
 // ---------------------------------------------------------------------------
 // CRUD
 // ---------------------------------------------------------------------------
 
 /**
- * List all view configs.
+ * List all view configs, newest first.
  *
  * @returns {Promise<object[]>}
- * @throws {Error} If MongoDB is not available
  */
 export async function listViews() {
-    const db = await getMetaDb();
-    return db.collection(VIEWS_COLLECTION)
-        .find({}, { projection: { _id: 0 } })
-        .sort({ 'meta.createdAt': -1 })
-        .toArray();
+    await ensureMigrated();
+
+    let entries;
+    try {
+        entries = await fs.readdir(VIEWS_DIR);
+    } catch {
+        return [];
+    }
+
+    const views = [];
+    for (const entry of entries.filter(e => e.endsWith('.json'))) {
+        try {
+            views.push(JSON.parse(await fs.readFile(path.join(VIEWS_DIR, entry), 'utf8')));
+        } catch {
+            // skip malformed
+        }
+    }
+    views.sort((a, b) => String(b.meta?.createdAt || '').localeCompare(String(a.meta?.createdAt || '')));
+    return views;
 }
 
 /**
@@ -112,12 +234,19 @@ export async function listViews() {
  *
  * @param {string} slug
  * @returns {Promise<object|null>}
- * @throws {Error} If MongoDB is not available
  */
 export async function getView(slug) {
-    const db = await getMetaDb();
-    const doc = await db.collection(VIEWS_COLLECTION).findOne({ slug }, { projection: { _id: 0 } });
-    return doc || null;
+    await ensureMigrated();
+
+    // Strict slug guard — this is hit with raw URL params (public route) and
+    // the slug becomes a filename.
+    if (typeof slug !== 'string' || !SLUG_RE.test(slug)) return null;
+
+    try {
+        return await readView(slug);
+    } catch {
+        return null;
+    }
 }
 
 /**
@@ -136,7 +265,6 @@ export async function getView(slug) {
  * @throws {Error} If slug already exists or validation fails
  */
 export async function createView(data, userId = null) {
-    const db = await getMetaDb();
     const { title, description = '', connection = 'default', pipeline, display, access, meta: inputMeta } = data;
 
     if (!title) throw new Error('title is required');
@@ -145,8 +273,7 @@ export async function createView(data, userId = null) {
     const slug = data.slug ? slugify(data.slug) : slugify(title);
     if (!slug) throw new Error('Could not derive a slug from the title');
 
-    const existing = await db.collection(VIEWS_COLLECTION).findOne({ slug });
-    if (existing) throw new Error(`A view with slug "${slug}" already exists`);
+    if (await getView(slug)) throw new Error(`A view with slug "${slug}" already exists`);
 
     const stages = pipeline.stages || [];
     validateStages(stages);
@@ -178,8 +305,7 @@ export async function createView(data, userId = null) {
         }
     };
 
-    await db.collection(VIEWS_COLLECTION).insertOne({ ...view });
-    await cache.invalidateTags([`view:${slug}`]);
+    await writeView(slug, view);
     return view;
 }
 
@@ -192,13 +318,14 @@ export async function createView(data, userId = null) {
  * @throws {Error} If view not found or validation fails
  */
 export async function updateView(slug, data) {
-    const db = await getMetaDb();
-    const existing = await db.collection(VIEWS_COLLECTION).findOne({ slug });
+    const existing = await getView(slug);
     if (!existing) throw new Error(`View "${slug}" not found`);
 
     const stages = data.pipeline?.stages ?? existing.pipeline?.stages ?? [];
     validateStages(stages);
 
+    // `_id` strip is load-bearing for configs migrated from the legacy
+    // MongoDB store; `id` is immutable.
     const { _id, id, meta: inputMeta, ...rest } = data;
     const updated = {
         ...existing,
@@ -218,9 +345,8 @@ export async function updateView(slug, data) {
         }
     };
 
-    await db.collection(VIEWS_COLLECTION).replaceOne({ slug }, { ...updated });
-    await cache.invalidateTags([`view:${slug}`]);
     const { _id: _stripped, ...result } = updated;
+    await writeView(slug, result);
     return result;
 }
 
@@ -232,9 +358,14 @@ export async function updateView(slug, data) {
  * @throws {Error} If view not found
  */
 export async function deleteView(slug) {
-    const db = await getMetaDb();
-    const result = await db.collection(VIEWS_COLLECTION).deleteOne({ slug });
-    if (result.deletedCount === 0) throw new Error(`View "${slug}" not found`);
+    if (typeof slug !== 'string' || !SLUG_RE.test(slug)) {
+        throw new Error(`View "${slug}" not found`);
+    }
+    try {
+        await fs.unlink(path.join(VIEWS_DIR, `${slug}.json`));
+    } catch {
+        throw new Error(`View "${slug}" not found`);
+    }
     await cache.invalidateTags([`view:${slug}`]);
 }
 
@@ -243,28 +374,15 @@ export async function deleteView(slug) {
 // ---------------------------------------------------------------------------
 
 /**
- * Execute a view's aggregation pipeline and return paginated results.
- *
- * @param {string} slug
- * @param {object} [opts]
- * @param {number}  [opts.page=1]
- * @param {number}  [opts.limit=25]
- * @param {object|null} [opts.user=null] - Authenticated user (for row-level filtering)
- * @returns {Promise<{ results: object[], total: number, page: number, limit: number }>}
- * @throws {Error} If view not found, connection unavailable, or stage validation fails
+ * Execute a view against a MongoDB-backed source collection using native
+ * aggregation (unchanged pre-0.34 behaviour).
  */
-export async function executeView(slug, {page = 1, limit = 25, user = null} = {}) {
-    const view = await getView(slug);
-    if (!view) throw new Error(`View "${slug}" not found`);
-
+async function executeMongoView(view, { page, limit, user }) {
     const { getDb } = await import('./connectionManager.js');
     const db = getDb(view.connection || 'default');
 
     const sourceCollection = `${COLLECTION_PREFIX}${view.pipeline.source}`;
-    const stages = view.pipeline?.stages || [];
-    validateStages(stages);
-
-    const pipeline = buildPipelineStages(stages);
+    const pipeline = buildPipelineStages(view.pipeline?.stages || []);
 
     // Prepend row-level $match if configured
     const rowFilter = buildRowLevelMatch(user, view.access?.rowLevel);
@@ -293,3 +411,67 @@ export async function executeView(slug, {page = 1, limit = 25, user = null} = {}
 
     return { results, total, page, limit };
 }
+
+/**
+ * Execute a view against any other source via the JS pipeline evaluator.
+ * The full collection and full pipeline output are materialised in memory —
+ * same trade the FileAdapter already makes for whole collections.
+ */
+async function executeFileView(view, { page, limit, user }) {
+    const { getAdapter } = await import('./adapterRegistry.js');
+    const adapter = await getAdapter(view.pipeline.source);
+    const docs = await adapter.all(view.pipeline.source);
+
+    const stages = buildPipelineStages(view.pipeline?.stages || []);
+
+    const rowFilter = buildRowLevelMatch(user, view.access?.rowLevel);
+    if (rowFilter) {
+        stages.unshift({$match: rowFilter});
+    }
+
+    const all = await executePipeline(docs, stages, {
+        resolveCollection: async (slug) => (await getAdapter(slug)).all(slug),
+    });
+
+    const total = all.length;
+    const offset = (page - 1) * limit;
+    return { results: all.slice(offset, offset + limit), total, page, limit };
+}
+
+/**
+ * Execute a view's pipeline and return paginated results.
+ *
+ * @param {string} slug
+ * @param {object} [opts]
+ * @param {number}  [opts.page=1]
+ * @param {number}  [opts.limit=25]
+ * @param {object|null} [opts.user=null] - Authenticated user (for row-level filtering)
+ * @returns {Promise<{ results: object[], total: number, page: number, limit: number }>}
+ * @throws {Error} If view not found or stage validation fails
+ */
+export async function executeView(slug, {page = 1, limit = 25, user = null} = {}) {
+    const view = await getView(slug);
+    if (!view) throw new Error(`View "${slug}" not found`);
+
+    validateStages(view.pipeline?.stages || []);
+
+    // Dispatch on the SOURCE collection's storage adapter. A mongodb-declared
+    // schema whose connection is unavailable falls back to the JS evaluator —
+    // matching adapterRegistry's own file fallback.
+    let useMongo = false;
+    try {
+        const { getCollection } = await import('./collections.js');
+        const schema = await getCollection(view.pipeline.source);
+        if (schema?.storage?.adapter === 'mongodb') {
+            const { getDb } = await import('./connectionManager.js');
+            getDb(view.connection || 'default'); // throws when unavailable
+            useMongo = true;
+        }
+    } catch {
+        useMongo = false;
+    }
+
+    return useMongo
+        ? executeMongoView(view, { page, limit, user })
+        : executeFileView(view, { page, limit, user });
+}