@dyrected/core 2.12.0 → 2.13.1

package/dist/index.d.cts

@@ -1,8 +1,14 @@
-import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, G as GlobalConfig, a as DeclarativeHookExpression, W as WorkflowConfig, b as AuthenticatedUser, c as WorkflowTransition, L as LifecycleEventName, d as LifecycleEvent, e as BaseDocument, H as HookRequestContext, f as DetailComputedOptions, g as ComputedHandler, h as DetailComputed, i as DetailCustomOptions, j as DetailCustom, k as DetailDividerOptions, l as DetailDivider, m as DisplayFieldOptions, n as DetailField, o as DetailItem, p as DetailGridOptions, q as DetailGrid, r as DetailRepeatOptions, s as DetailRepeat, t as DetailSectionOptions, u as DetailSection, v as DetailTabOptions, w as DetailTab, x as DetailTabsOptions, y as DetailTabs, z as DetailTextOptions, E as DetailText, I as DetailSchema, J as ArrayField, K as BlocksField, M as BooleanField, N as AuthConfig, O as AccessPolicyResolver, Q as DateField, R as DateTimeField, S as EmailField, T as IconField, U as ImageField, V as JoinField, X as JsonField, Y as MultiSelectField, Z as NumberField, _ as ObjectField, $ as RadioField, a0 as RelationshipField, a1 as RichTextField, a2 as RowField, a3 as SelectField, a4 as TextField, a5 as TextareaField, a6 as TimeField, a7 as UrlField } from './app-config-C6hYM8WO.cjs';
-export { a8 as AccessConfig, a9 as AccessFunction, aa as AccessFunctionArgs, ab as AccessResult, ac as AccessRule, ad as ActionConfig, ae as ActionContext, af as ActionType, ag as AdminAuthAccessResolution, ah as AdminAuthClaimMapping, ai as AdminAuthMember, aj as AdminAuthProvider, ak as AdminAuthProviderMembersConfig, al as AdminAuthProvisioningMode, am as AdminAuthResolveAccessArgs, an as AdminAuthResolvedIdentity, ao as AdminConfig, ap as AdminDashboardComponentSlots, aq as AdminIconName, ar as AggregateArgs, as as AggregateCastType, at as AggregateInput, au as AggregateOperation, av as AggregateResult, aw as BaseAdminAuthProvider, ax as BaseFieldAdmin, ay as BlockVariant, az as BooleanFieldAdmin, aA as BooleanFormat, aB as CharacterLimitFieldAdmin, aC as CharacterLimitFieldConfig, aD as CollectionAfterChangeHook, aE as CollectionAfterDeleteHook, aF as CollectionAfterReadHook, aG as CollectionAfterReadHookEntry, aH as CollectionAfterTransitionHook, aI as CollectionBeforeChangeHook, aJ as CollectionBeforeChangeHookEntry, aK as CollectionBeforeDeleteHook, aL as CollectionBeforeReadHook, aM as CollectionBeforeReadHookEntry, aN as CollectionBeforeTransitionHook, aO as CollectionListComponentSlots, aP as CollectionViewComponentSlots, aQ as CountOperation, aR as CustomAdminAuthProvider, aS as DatabaseAdapter, aT as DateFieldAdmin, aU as DateFormat, aV as DefineActionOptions, aW as DefineViewOptions, aX as DetailSpan, aY as DisplayTone, aZ as DisplayVariant, a_ as DistinctCountOperation, a$ as DistinctValuesOperation, b0 as DynamicOptionItem, b1 as DynamicOptionsConfig, b2 as DynamicOptionsResolver, b3 as DynamicOptionsResolverArgs, b4 as DyrectedLoggerConfig, b5 as DyrectedObservabilityConfig, b6 as EmailFieldAdmin, b7 as FieldAdminHooks, b8 as FieldAdminOnChangeHook, b9 as FieldAdminOnChangeHookArgs, ba as FieldAdminOptionsHook, bb as FieldAdminOptionsHookArgs, bc as FieldAdminOptionsHookResult, bd as FieldAfterReadHook, be as FieldAfterReadHookArgs, bf as FieldBase, bg as FieldBeforeChangeHook, bh as FieldBeforeChangeHookArgs, bi as FieldHook, bj as FieldHooks, bk as FieldType, bl as FileData, bm as GlobalAfterChangeHook, bn as GlobalAfterReadHook, bo as GlobalAfterReadHookEntry, bp as GlobalBeforeChangeHook, bq as GlobalBeforeChangeHookEntry, br as GlobalBeforeReadHook, bs as GlobalBeforeReadHookEntry, bt as HeadingLevel, bu as HookFunction, bv as IconFieldAdmin, bw as ImageService, bx as ImageTransformOptions, by as InferAggregateResult, bz as JoinFieldAdmin, bA as JsonFieldAdmin, bB as JsonFormat, bC as LIFECYCLE_EVENT_NAMES, bD as LifecycleEventHandler, bE as LinkFormat, bF as MetricColor, bG as MultiSelectFieldAdmin, bH as NamedAccessPolicy, bI as NumberFieldAdmin, bJ as NumberFormat, bK as NumberLimitFieldAdmin, bL as NumberLimitFieldConfig, bM as NumericOperation, bN as OIDCAdminAuthProvider, bO as OptionFormat, bP as PaginatedResult, bQ as PublicAdminAuthProvider, bR as RadioFieldAdmin, bS as RateLimitConfig, bT as ReadonlyDatabaseAdapter, bU as RichTextFeature, bV as RichTextFieldConfig, bW as SelectFieldAdmin, bX as SqlWhereResult, bY as StorageAdapter, bZ as TextFieldAdmin, b_ as TextFormat, b$ as TextareaFieldAdmin, c0 as TrustProxyConfig, c1 as TypedField, c2 as UploadConfig, c3 as UrlFieldAdmin, c4 as UrlLinkValue, c5 as ViewActionFeatures, c6 as ViewComponentSlots, c7 as ViewConfig, c8 as ViewLayout, c9 as ViewMetric, ca as ViewSubMetric, cb as WhereClause, cc as WhereOperator, cd as WhereOperatorName, ce as WordLimitFieldAdmin, cf as WordLimitFieldConfig, cg as WorkflowMetadata, ch as WorkflowRole, ci as WorkflowState, cj as WorkflowTransitionContext, ck as defineAction, cl as defineView, cm as parseMongoWhere, cn as parseSqlWhere } from './app-config-C6hYM8WO.cjs';
+import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, G as GlobalConfig, a as DeclarativeHookExpression, W as WorkflowConfig, b as AuthenticatedUser, c as WorkflowTransition, L as LifecycleEventName, d as LifecycleEvent, e as BaseDocument, H as HookRequestContext, f as DetailComputedOptions, g as ComputedHandler, h as DetailComputed, i as DetailCustomOptions, j as DetailCustom, k as DetailDividerOptions, l as DetailDivider, m as DisplayFieldOptions, n as DetailField, o as DetailItem, p as DetailGridOptions, q as DetailGrid, r as DetailRepeatOptions, s as DetailRepeat, t as DetailSectionOptions, u as DetailSection, v as DetailTabOptions, w as DetailTab, x as DetailTabsOptions, y as DetailTabs, z as DetailTextOptions, E as DetailText, I as DetailSchema, J as DyrectedContext, K as AIConfig, M as AIPIIConfig, N as ArrayField, O as BlocksField, Q as BooleanField, R as AuthConfig, S as AccessPolicyResolver, T as DateField, U as DateTimeField, V as EmailField, X as IconField, Y as ImageField, Z as JoinField, _ as JsonField, $ as MultiSelectField, a0 as NumberField, a1 as ObjectField, a2 as RadioField, a3 as RelationshipField, a4 as RichTextField, a5 as RowField, a6 as SelectField, a7 as TextField, a8 as TextareaField, a9 as TimeField, aa as UrlField } from './app-De-3eNn1.cjs';
+export { ab as AIAction, ac as AIActionStatus, ad as AIActionType, ae as AIAuditActionType, af as AIAuditRecord, ag as AIChunk, ah as AIMessage, ai as AIPIIPattern, aj as AIRateLimitResult, ak as AIRateLimitStore, al as AIThread, am as AIToolContext, an as AIToolDefinition, ao as AI_ACTIONS_COLLECTION, ap as AI_AUDIT_COLLECTION, aq as AI_CHUNKS_COLLECTION, ar as AI_MESSAGES_COLLECTION, as as AI_THREADS_COLLECTION, at as AccessConfig, au as AccessFunction, av as AccessFunctionArgs, aw as AccessResult, ax as AccessRule, ay as ActionConfig, az as ActionContext, aA as ActionType, aB as AdminAuthAccessResolution, aC as AdminAuthClaimMapping, aD as AdminAuthMember, aE as AdminAuthProvider, aF as AdminAuthProviderMembersConfig, aG as AdminAuthProvisioningMode, aH as AdminAuthResolveAccessArgs, aI as AdminAuthResolvedIdentity, aJ as AdminConfig, aK as AdminDashboardComponentSlots, aL as AdminIconName, aM as AggregateArgs, aN as AggregateCastType, aO as AggregateCollectionResult, aP as AggregateInput, aQ as AggregateOperation, aR as AggregateResult, aS as BaseAdminAuthProvider, aT as BaseFieldAdmin, aU as BlockVariant, aV as BooleanFieldAdmin, aW as BooleanFormat, aX as CharacterLimitFieldAdmin, aY as CharacterLimitFieldConfig, aZ as CollectionAfterChangeHook, a_ as CollectionAfterDeleteHook, a$ as CollectionAfterReadHook, b0 as CollectionAfterReadHookEntry, b1 as CollectionAfterTransitionHook, b2 as CollectionBeforeChangeHook, b3 as CollectionBeforeChangeHookEntry, b4 as CollectionBeforeDeleteHook, b5 as CollectionBeforeReadHook, b6 as CollectionBeforeReadHookEntry, b7 as CollectionBeforeTransitionHook, b8 as CollectionListComponentSlots, b9 as CollectionRAGConfig, ba as CollectionSchemaResult, bb as CollectionSummaryResult, bc as CollectionViewComponentSlots, bd as CountOperation, be as CustomAdminAuthProvider, bf as DatabaseAdapter, bg as DateFieldAdmin, bh as DateFormat, bi as DefineActionOptions, bj as DefineViewOptions, bk as DetailSpan, bl as DisplayTone, bm as DisplayVariant, bn as DistinctCountOperation, bo as DistinctValuesOperation, bp as DynamicOptionItem, bq as DynamicOptionsConfig, br as DynamicOptionsResolver, bs as DynamicOptionsResolverArgs, bt as DyrectedAIContext, bu as DyrectedLoggerConfig, bv as DyrectedObservabilityConfig, bw as EmailFieldAdmin, bx as FieldAdminHooks, by as FieldAdminOnChangeHook, bz as FieldAdminOnChangeHookArgs, bA as FieldAdminOptionsHook, bB as FieldAdminOptionsHookArgs, bC as FieldAdminOptionsHookResult, bD as FieldAfterReadHook, bE as FieldAfterReadHookArgs, bF as FieldBase, bG as FieldBeforeChangeHook, bH as FieldBeforeChangeHookArgs, bI as FieldHook, bJ as FieldHooks, bK as FieldType, bL as FileData, bM as GetDocumentResult, bN as GlobalAfterChangeHook, bO as GlobalAfterReadHook, bP as GlobalAfterReadHookEntry, bQ as GlobalBeforeChangeHook, bR as GlobalBeforeChangeHookEntry, bS as GlobalBeforeReadHook, bT as GlobalBeforeReadHookEntry, bU as GlobalRAGConfig, bV as GlobalSchemaResult, bW as GlobalSummaryResult, bX as HeadingLevel, bY as HookFunction, bZ as IconFieldAdmin, b_ as ImageService, b$ as ImageTransformOptions, c0 as InferAggregateResult, c1 as JoinFieldAdmin, c2 as JsonFieldAdmin, c3 as JsonFormat, c4 as LIFECYCLE_EVENT_NAMES, c5 as LifecycleEventHandler, c6 as LinkFormat, c7 as MetricColor, c8 as MultiSelectFieldAdmin, c9 as NamedAccessPolicy, ca as NumberFieldAdmin, cb as NumberFormat, cc as NumberLimitFieldAdmin, cd as NumberLimitFieldConfig, ce as NumericOperation, cf as OIDCAdminAuthProvider, cg as OptionFormat, ch as PaginatedResult, ci as PublicAdminAuthProvider, cj as QueryCollectionResult, ck as RAGSearchResult, cl as RadioFieldAdmin, cm as RateLimitConfig, cn as ReadonlyDatabaseAdapter, co as RichTextFeature, cp as RichTextFieldConfig, cq as SelectFieldAdmin, cr as SqlWhereResult, cs as StorageAdapter, ct as TextFieldAdmin, cu as TextFormat, cv as TextareaFieldAdmin, cw as TrustProxyConfig, cx as TypedField, cy as UploadConfig, cz as UrlFieldAdmin, cA as UrlLinkValue, cB as ViewActionFeatures, cC as ViewComponentSlots, cD as ViewConfig, cE as ViewLayout, cF as ViewMetric, cG as ViewSubMetric, cH as WhereClause, cI as WhereOperator, cJ as WhereOperatorName, cK as WordLimitFieldAdmin, cL as WordLimitFieldConfig, cM as WorkflowMetadata, cN as WorkflowRole, cO as WorkflowState, cP as WorkflowTransitionContext, cQ as defineAction, cR as defineView, cS as isAICollection, cT as parseMongoWhere, cU as parseSqlWhere } from './app-De-3eNn1.cjs';
 import jexl from 'jexl';
-import 'lucide-react';
+import { Context } from 'hono';
+export { z } from 'zod';
+import 'hono/types';
 import 'pino';
+import 'lucide-react';
+import 'jose';
+import '@opentelemetry/api';
+import '@opentelemetry/exporter-prometheus';
 
 type Prettify<T> = {
     [K in keyof T]: T[K];
@@ -75,6 +81,21 @@ type UploadDocFields = {
     }>;
 };
 
+type AIErrorCode = 'AI_UNCONFIGURED' | 'AI_RATE_LIMITED' | 'AI_QUOTA_EXHAUSTED' | 'AI_TIMEOUT' | 'AI_TOOL_VALIDATION_ERROR' | 'AI_PERMISSION_DENIED' | 'AI_TENANT_VIOLATION' | 'AI_ACTION_EXPIRED' | 'AI_ACTION_ALREADY_EXECUTED' | 'AI_INTERNAL_ERROR';
+declare class DyrectedAIError extends Error {
+    readonly code: AIErrorCode;
+    readonly status: number;
+    readonly details?: Record<string, unknown>;
+    constructor(code: AIErrorCode, message: string, status?: number, details?: Record<string, unknown>);
+    toJSON(): {
+        error: boolean;
+        code: AIErrorCode;
+        message: string;
+        status: number;
+        details: Record<string, unknown> | undefined;
+    };
+}
+
 /**
  * Normalizes the Dyrected configuration by injecting system fields
  * (createdAt, updatedAt, createdBy, updatedBy) into every collection and
@@ -85,6 +106,17 @@ declare function normalizeConfig(config: DyrectedConfig): DyrectedConfig;
 declare function getAdminAuthCollection(config: Pick<DyrectedConfig, "collections" | "adminAuth">): CollectionConfig | null;
 declare function resolveAdminAuthCollection(collections: CollectionConfig[], collectionSlug?: string): CollectionConfig | undefined;
 declare function getPublicAdminAuthConfig(adminAuth?: AdminAuthConfig, collections?: CollectionConfig[]): PublicAdminAuthConfig;
+/**
+ * Resolves the configured admin role for a collection or returns "admin" as default.
+ */
+declare function getAdminRoleForCollection(collection?: CollectionConfig | null): string;
+/**
+ * Checks whether a user possesses an administrative role.
+ * Considers:
+ * 1. The collection's configured `adminRole` (e.g. 'super_admin')
+ * 2. Standard admin roles ('admin', 'super_admin')
+ */
+declare function isUserAdmin(user: any, collection?: CollectionConfig | null): boolean;
 
 type SortDirection = 'ASC' | 'DESC';
 interface SortClause {
@@ -1143,6 +1175,61 @@ declare const expr: ExprFunction;
  */
 declare const when: ExprFunction;
 
+/**
+ * Extracts the list of allowed site IDs for a given authenticated user or token payload.
+ * Checks common tenant membership properties: `allowedSites`, `siteIds`, `siteAccess`, and singular `siteId`.
+ */
+declare function getAllowedSitesForUser(user?: Record<string, unknown> | null, payload?: Record<string, unknown> | null): string[] | undefined;
+/**
+ * Checks whether an authenticated user is permitted to access a given site ID.
+ * If the user has no tenant restrictions configured, access is unrestricted (returns true).
+ */
+declare function isSiteAuthorized(user: Record<string, unknown> | null | undefined, payload: Record<string, unknown> | null | undefined, requestedSiteId: string | undefined): boolean;
+/**
+ * Resolves the authorized site ID for the current request.
+ * Prioritizes `c.get("siteId")` (set upstream) and `X-Site-Id` header.
+ * Enforces that restricted users cannot spoof or access unauthorized site IDs.
+ *
+ * @throws HTTPException(403) if the user is not authorized for the requested site.
+ */
+declare function resolveAuthorizedSiteId(c: Context<DyrectedContext>): string;
+
+declare const NON_NEGOTIABLE_CREDENTIAL_FIELDS: Set<string>;
+/**
+ * Masks an email address to protect privacy (e.g. "john.doe@example.com" -> "j***@example.com").
+ */
+declare function maskEmail(email: string, strategy?: "mask" | "token"): string;
+/**
+ * Masks a phone number (e.g. "+1 555-234-5678" -> "+1 ***-***-5678").
+ */
+declare function maskPhone(phone: string, strategy?: "mask" | "token"): string;
+/**
+ * High-performance regex patterns for common PII.
+ */
+declare const PII_REGEX_PATTERNS: Record<string, RegExp>;
+/**
+ * Scrubs unstructured free text using configured regex patterns and custom scrubbers.
+ */
+declare function maskTextPII(text: string, piiConfig?: AIPIIConfig): string;
+interface SanitizeDocForAIOptions {
+    doc: Record<string, unknown>;
+    collectionConfig?: CollectionConfig;
+    globalAIConfig?: AIConfig;
+}
+/**
+ * Deterministically sanitizes a CMS document before sending it to an AI assistant or RAG pipeline:
+ * 1. Non-negotiably strips passwords, secrets, hashes, and session tokens.
+ * 2. Strips collection-level `excludeFields`.
+ * 3. Applies field-level definitions:
+ *    - Automatically masks `email` and `phone` by default (opt-out privacy) unless `ai: { allowRaw: true }`.
+ *    - Strips fields configured with `ai: { exclude: true }`.
+ *    - Masks fields configured with `ai: { redact: true }`.
+ * 4. Applies collection-level `redactFields`.
+ * 5. Calls custom programmatic `collectionConfig.ai.sanitizeDoc` hook if provided.
+ * 6. Scrubs unstructured text across string fields if `config.ai.pii.enabled === true`.
+ */
+declare function sanitizeDocForAI(options: SanitizeDocForAIOptions): Record<string, unknown>;
+
 type TopLevelFieldName<TFields extends readonly Field[]> = Extract<TFields[number], {
     name: string;
 }>["name"];
@@ -1562,4 +1649,4 @@ declare function defineTab<const T extends readonly Field[]>(args: {
     fields: T;
 }): T;
 
-export { type AccessConditions, AccessPolicyResolver, AdminAuthConfig, ArrayField, AuthConfig, type AuthDocFields, AuthenticatedUser, BUILTIN_JEXL_HELPERS, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, ComputedHandler, type ConfigDiagnostic, ConfigValidationError, DateField, DateTimeField, type DeclarativeAccessSurface, type DeclarativeAccessValidationIssue, type DeclarativeAdminSurface, type DeclarativeAdminValidationIssue, DeclarativeHookExpression, type DeclarativeHookSurface, type DeclarativeHookValidationIssue, type DeclarativePreviewSurface, type DeclarativePreviewValidationIssue, DetailComputed, DetailComputedOptions, DetailCustom, DetailCustomOptions, DetailDivider, DetailDividerOptions, DetailField, DetailGrid, DetailGridOptions, DetailItem, DetailRepeat, DetailRepeatOptions, DetailSchema, DetailSection, DetailSectionOptions, DetailTab, DetailTabOptions, DetailTabs, DetailTabsOptions, DetailText, DetailTextOptions, DisplayFieldOptions, DyrectedConfig, EmailField, type ExprFunction, Field, FieldConditionBuilder, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MatchBuilder, MultiSelectField, NumberField, ObjectField, type Prettify, PublicAdminAuthConfig, type PublishingWorkflowOptions, RadioField, RelationshipField, RichTextField, RowField, SelectField, type SortClause, type SortDirection, type SqlSortDialect, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhenFunction, WorkflowConfig, WorkflowTransition, abs, addDays, assertValidAdminConditionsInConfig, assertValidDeclarativeAccessInConfig, assertValidDeclarativeHookExpression, assertValidDeclarativeHookResult, assertValidDeclarativeHooksInConfig, assertValidPreviewUrlsInConfig, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, capitalize, ceil, clamp, coalesce, collectAdminConditionValidationIssues, collectConfigDiagnostics, collectDeclarativeAccessValidationIssues, collectDeclarativeHookValidationIssues, collectPreviewUrlValidationIssues, compact, count, createLifecycleEvent, createWorkflowDocument, defaultValue, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, definePublishingWorkflow, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, diffDays, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, displayComputed, displayCustom, displayCustomComponent, displayDivider, displayField, displayGrid, displayRepeat, displaySection, displayTab, displayTabs, displayText, endsWith, evaluateDetailComputed, evaluateJexl, evaluateJexlSync, executeFieldAfterRead, executeFieldBeforeChange, expr, first, floor, formatConfigDiagnostics, formatDate, formatJexlValue, generateDefaultDetailSchema, generateOpenApi, get, getAdminAuthCollection, getPublicAdminAuthConfig, includes, initializeWorkflowDocument, isConfigValidationError, isDetailItemVisible, isEmpty, isFuture, isPast, join, last, length, lower, materializeWorkflowDocument, max, min, normalizeConfig, normalizeDetailItem, now, numericFieldNames, parseSort, pow, publishedStateName, publishingWorkflow, readingTime, registerJexlHelpers, replace, resolveAdminAuthCollection, round, runCollectionHooks, saveWorkflowDraft, simplePublishingWorkflow, slugify, sqrt, startsWith, sum, today, transitionWorkflow, trim, truncate, unique, upper, validateAdminConditionExpression, validateDeclarativeAccessExpression, validateDeclarativeHookExpression, validatePreviewUrlExpression, when, wordCount, workflowCapabilities };
+export { AIConfig, type AIErrorCode, AIPIIConfig, type AccessConditions, AccessPolicyResolver, AdminAuthConfig, ArrayField, AuthConfig, type AuthDocFields, AuthenticatedUser, BUILTIN_JEXL_HELPERS, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, ComputedHandler, type ConfigDiagnostic, ConfigValidationError, DateField, DateTimeField, type DeclarativeAccessSurface, type DeclarativeAccessValidationIssue, type DeclarativeAdminSurface, type DeclarativeAdminValidationIssue, DeclarativeHookExpression, type DeclarativeHookSurface, type DeclarativeHookValidationIssue, type DeclarativePreviewSurface, type DeclarativePreviewValidationIssue, DetailComputed, DetailComputedOptions, DetailCustom, DetailCustomOptions, DetailDivider, DetailDividerOptions, DetailField, DetailGrid, DetailGridOptions, DetailItem, DetailRepeat, DetailRepeatOptions, DetailSchema, DetailSection, DetailSectionOptions, DetailTab, DetailTabOptions, DetailTabs, DetailTabsOptions, DetailText, DetailTextOptions, DisplayFieldOptions, DyrectedAIError, DyrectedConfig, EmailField, type ExprFunction, Field, FieldConditionBuilder, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MatchBuilder, MultiSelectField, NON_NEGOTIABLE_CREDENTIAL_FIELDS, NumberField, ObjectField, PII_REGEX_PATTERNS, type Prettify, PublicAdminAuthConfig, type PublishingWorkflowOptions, RadioField, RelationshipField, RichTextField, RowField, type SanitizeDocForAIOptions, SelectField, type SortClause, type SortDirection, type SqlSortDialect, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhenFunction, WorkflowConfig, WorkflowTransition, abs, addDays, assertValidAdminConditionsInConfig, assertValidDeclarativeAccessInConfig, assertValidDeclarativeHookExpression, assertValidDeclarativeHookResult, assertValidDeclarativeHooksInConfig, assertValidPreviewUrlsInConfig, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, capitalize, ceil, clamp, coalesce, collectAdminConditionValidationIssues, collectConfigDiagnostics, collectDeclarativeAccessValidationIssues, collectDeclarativeHookValidationIssues, collectPreviewUrlValidationIssues, compact, count, createLifecycleEvent, createWorkflowDocument, defaultValue, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, definePublishingWorkflow, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, diffDays, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, displayComputed, displayCustom, displayCustomComponent, displayDivider, displayField, displayGrid, displayRepeat, displaySection, displayTab, displayTabs, displayText, endsWith, evaluateDetailComputed, evaluateJexl, evaluateJexlSync, executeFieldAfterRead, executeFieldBeforeChange, expr, first, floor, formatConfigDiagnostics, formatDate, formatJexlValue, generateDefaultDetailSchema, generateOpenApi, get, getAdminAuthCollection, getAdminRoleForCollection, getAllowedSitesForUser, getPublicAdminAuthConfig, includes, initializeWorkflowDocument, isConfigValidationError, isDetailItemVisible, isEmpty, isFuture, isPast, isSiteAuthorized, isUserAdmin, join, last, length, lower, maskEmail, maskPhone, maskTextPII, materializeWorkflowDocument, max, min, normalizeConfig, normalizeDetailItem, now, numericFieldNames, parseSort, pow, publishedStateName, publishingWorkflow, readingTime, registerJexlHelpers, replace, resolveAdminAuthCollection, resolveAuthorizedSiteId, round, runCollectionHooks, sanitizeDocForAI, saveWorkflowDraft, simplePublishingWorkflow, slugify, sqrt, startsWith, sum, today, transitionWorkflow, trim, truncate, unique, upper, validateAdminConditionExpression, validateDeclarativeAccessExpression, validateDeclarativeHookExpression, validatePreviewUrlExpression, when, wordCount, workflowCapabilities };

package/dist/index.d.ts

@@ -1,8 +1,14 @@
-import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, G as GlobalConfig, a as DeclarativeHookExpression, W as WorkflowConfig, b as AuthenticatedUser, c as WorkflowTransition, L as LifecycleEventName, d as LifecycleEvent, e as BaseDocument, H as HookRequestContext, f as DetailComputedOptions, g as ComputedHandler, h as DetailComputed, i as DetailCustomOptions, j as DetailCustom, k as DetailDividerOptions, l as DetailDivider, m as DisplayFieldOptions, n as DetailField, o as DetailItem, p as DetailGridOptions, q as DetailGrid, r as DetailRepeatOptions, s as DetailRepeat, t as DetailSectionOptions, u as DetailSection, v as DetailTabOptions, w as DetailTab, x as DetailTabsOptions, y as DetailTabs, z as DetailTextOptions, E as DetailText, I as DetailSchema, J as ArrayField, K as BlocksField, M as BooleanField, N as AuthConfig, O as AccessPolicyResolver, Q as DateField, R as DateTimeField, S as EmailField, T as IconField, U as ImageField, V as JoinField, X as JsonField, Y as MultiSelectField, Z as NumberField, _ as ObjectField, $ as RadioField, a0 as RelationshipField, a1 as RichTextField, a2 as RowField, a3 as SelectField, a4 as TextField, a5 as TextareaField, a6 as TimeField, a7 as UrlField } from './app-config-C6hYM8WO.js';
-export { a8 as AccessConfig, a9 as AccessFunction, aa as AccessFunctionArgs, ab as AccessResult, ac as AccessRule, ad as ActionConfig, ae as ActionContext, af as ActionType, ag as AdminAuthAccessResolution, ah as AdminAuthClaimMapping, ai as AdminAuthMember, aj as AdminAuthProvider, ak as AdminAuthProviderMembersConfig, al as AdminAuthProvisioningMode, am as AdminAuthResolveAccessArgs, an as AdminAuthResolvedIdentity, ao as AdminConfig, ap as AdminDashboardComponentSlots, aq as AdminIconName, ar as AggregateArgs, as as AggregateCastType, at as AggregateInput, au as AggregateOperation, av as AggregateResult, aw as BaseAdminAuthProvider, ax as BaseFieldAdmin, ay as BlockVariant, az as BooleanFieldAdmin, aA as BooleanFormat, aB as CharacterLimitFieldAdmin, aC as CharacterLimitFieldConfig, aD as CollectionAfterChangeHook, aE as CollectionAfterDeleteHook, aF as CollectionAfterReadHook, aG as CollectionAfterReadHookEntry, aH as CollectionAfterTransitionHook, aI as CollectionBeforeChangeHook, aJ as CollectionBeforeChangeHookEntry, aK as CollectionBeforeDeleteHook, aL as CollectionBeforeReadHook, aM as CollectionBeforeReadHookEntry, aN as CollectionBeforeTransitionHook, aO as CollectionListComponentSlots, aP as CollectionViewComponentSlots, aQ as CountOperation, aR as CustomAdminAuthProvider, aS as DatabaseAdapter, aT as DateFieldAdmin, aU as DateFormat, aV as DefineActionOptions, aW as DefineViewOptions, aX as DetailSpan, aY as DisplayTone, aZ as DisplayVariant, a_ as DistinctCountOperation, a$ as DistinctValuesOperation, b0 as DynamicOptionItem, b1 as DynamicOptionsConfig, b2 as DynamicOptionsResolver, b3 as DynamicOptionsResolverArgs, b4 as DyrectedLoggerConfig, b5 as DyrectedObservabilityConfig, b6 as EmailFieldAdmin, b7 as FieldAdminHooks, b8 as FieldAdminOnChangeHook, b9 as FieldAdminOnChangeHookArgs, ba as FieldAdminOptionsHook, bb as FieldAdminOptionsHookArgs, bc as FieldAdminOptionsHookResult, bd as FieldAfterReadHook, be as FieldAfterReadHookArgs, bf as FieldBase, bg as FieldBeforeChangeHook, bh as FieldBeforeChangeHookArgs, bi as FieldHook, bj as FieldHooks, bk as FieldType, bl as FileData, bm as GlobalAfterChangeHook, bn as GlobalAfterReadHook, bo as GlobalAfterReadHookEntry, bp as GlobalBeforeChangeHook, bq as GlobalBeforeChangeHookEntry, br as GlobalBeforeReadHook, bs as GlobalBeforeReadHookEntry, bt as HeadingLevel, bu as HookFunction, bv as IconFieldAdmin, bw as ImageService, bx as ImageTransformOptions, by as InferAggregateResult, bz as JoinFieldAdmin, bA as JsonFieldAdmin, bB as JsonFormat, bC as LIFECYCLE_EVENT_NAMES, bD as LifecycleEventHandler, bE as LinkFormat, bF as MetricColor, bG as MultiSelectFieldAdmin, bH as NamedAccessPolicy, bI as NumberFieldAdmin, bJ as NumberFormat, bK as NumberLimitFieldAdmin, bL as NumberLimitFieldConfig, bM as NumericOperation, bN as OIDCAdminAuthProvider, bO as OptionFormat, bP as PaginatedResult, bQ as PublicAdminAuthProvider, bR as RadioFieldAdmin, bS as RateLimitConfig, bT as ReadonlyDatabaseAdapter, bU as RichTextFeature, bV as RichTextFieldConfig, bW as SelectFieldAdmin, bX as SqlWhereResult, bY as StorageAdapter, bZ as TextFieldAdmin, b_ as TextFormat, b$ as TextareaFieldAdmin, c0 as TrustProxyConfig, c1 as TypedField, c2 as UploadConfig, c3 as UrlFieldAdmin, c4 as UrlLinkValue, c5 as ViewActionFeatures, c6 as ViewComponentSlots, c7 as ViewConfig, c8 as ViewLayout, c9 as ViewMetric, ca as ViewSubMetric, cb as WhereClause, cc as WhereOperator, cd as WhereOperatorName, ce as WordLimitFieldAdmin, cf as WordLimitFieldConfig, cg as WorkflowMetadata, ch as WorkflowRole, ci as WorkflowState, cj as WorkflowTransitionContext, ck as defineAction, cl as defineView, cm as parseMongoWhere, cn as parseSqlWhere } from './app-config-C6hYM8WO.js';
+import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, G as GlobalConfig, a as DeclarativeHookExpression, W as WorkflowConfig, b as AuthenticatedUser, c as WorkflowTransition, L as LifecycleEventName, d as LifecycleEvent, e as BaseDocument, H as HookRequestContext, f as DetailComputedOptions, g as ComputedHandler, h as DetailComputed, i as DetailCustomOptions, j as DetailCustom, k as DetailDividerOptions, l as DetailDivider, m as DisplayFieldOptions, n as DetailField, o as DetailItem, p as DetailGridOptions, q as DetailGrid, r as DetailRepeatOptions, s as DetailRepeat, t as DetailSectionOptions, u as DetailSection, v as DetailTabOptions, w as DetailTab, x as DetailTabsOptions, y as DetailTabs, z as DetailTextOptions, E as DetailText, I as DetailSchema, J as DyrectedContext, K as AIConfig, M as AIPIIConfig, N as ArrayField, O as BlocksField, Q as BooleanField, R as AuthConfig, S as AccessPolicyResolver, T as DateField, U as DateTimeField, V as EmailField, X as IconField, Y as ImageField, Z as JoinField, _ as JsonField, $ as MultiSelectField, a0 as NumberField, a1 as ObjectField, a2 as RadioField, a3 as RelationshipField, a4 as RichTextField, a5 as RowField, a6 as SelectField, a7 as TextField, a8 as TextareaField, a9 as TimeField, aa as UrlField } from './app-De-3eNn1.js';
+export { ab as AIAction, ac as AIActionStatus, ad as AIActionType, ae as AIAuditActionType, af as AIAuditRecord, ag as AIChunk, ah as AIMessage, ai as AIPIIPattern, aj as AIRateLimitResult, ak as AIRateLimitStore, al as AIThread, am as AIToolContext, an as AIToolDefinition, ao as AI_ACTIONS_COLLECTION, ap as AI_AUDIT_COLLECTION, aq as AI_CHUNKS_COLLECTION, ar as AI_MESSAGES_COLLECTION, as as AI_THREADS_COLLECTION, at as AccessConfig, au as AccessFunction, av as AccessFunctionArgs, aw as AccessResult, ax as AccessRule, ay as ActionConfig, az as ActionContext, aA as ActionType, aB as AdminAuthAccessResolution, aC as AdminAuthClaimMapping, aD as AdminAuthMember, aE as AdminAuthProvider, aF as AdminAuthProviderMembersConfig, aG as AdminAuthProvisioningMode, aH as AdminAuthResolveAccessArgs, aI as AdminAuthResolvedIdentity, aJ as AdminConfig, aK as AdminDashboardComponentSlots, aL as AdminIconName, aM as AggregateArgs, aN as AggregateCastType, aO as AggregateCollectionResult, aP as AggregateInput, aQ as AggregateOperation, aR as AggregateResult, aS as BaseAdminAuthProvider, aT as BaseFieldAdmin, aU as BlockVariant, aV as BooleanFieldAdmin, aW as BooleanFormat, aX as CharacterLimitFieldAdmin, aY as CharacterLimitFieldConfig, aZ as CollectionAfterChangeHook, a_ as CollectionAfterDeleteHook, a$ as CollectionAfterReadHook, b0 as CollectionAfterReadHookEntry, b1 as CollectionAfterTransitionHook, b2 as CollectionBeforeChangeHook, b3 as CollectionBeforeChangeHookEntry, b4 as CollectionBeforeDeleteHook, b5 as CollectionBeforeReadHook, b6 as CollectionBeforeReadHookEntry, b7 as CollectionBeforeTransitionHook, b8 as CollectionListComponentSlots, b9 as CollectionRAGConfig, ba as CollectionSchemaResult, bb as CollectionSummaryResult, bc as CollectionViewComponentSlots, bd as CountOperation, be as CustomAdminAuthProvider, bf as DatabaseAdapter, bg as DateFieldAdmin, bh as DateFormat, bi as DefineActionOptions, bj as DefineViewOptions, bk as DetailSpan, bl as DisplayTone, bm as DisplayVariant, bn as DistinctCountOperation, bo as DistinctValuesOperation, bp as DynamicOptionItem, bq as DynamicOptionsConfig, br as DynamicOptionsResolver, bs as DynamicOptionsResolverArgs, bt as DyrectedAIContext, bu as DyrectedLoggerConfig, bv as DyrectedObservabilityConfig, bw as EmailFieldAdmin, bx as FieldAdminHooks, by as FieldAdminOnChangeHook, bz as FieldAdminOnChangeHookArgs, bA as FieldAdminOptionsHook, bB as FieldAdminOptionsHookArgs, bC as FieldAdminOptionsHookResult, bD as FieldAfterReadHook, bE as FieldAfterReadHookArgs, bF as FieldBase, bG as FieldBeforeChangeHook, bH as FieldBeforeChangeHookArgs, bI as FieldHook, bJ as FieldHooks, bK as FieldType, bL as FileData, bM as GetDocumentResult, bN as GlobalAfterChangeHook, bO as GlobalAfterReadHook, bP as GlobalAfterReadHookEntry, bQ as GlobalBeforeChangeHook, bR as GlobalBeforeChangeHookEntry, bS as GlobalBeforeReadHook, bT as GlobalBeforeReadHookEntry, bU as GlobalRAGConfig, bV as GlobalSchemaResult, bW as GlobalSummaryResult, bX as HeadingLevel, bY as HookFunction, bZ as IconFieldAdmin, b_ as ImageService, b$ as ImageTransformOptions, c0 as InferAggregateResult, c1 as JoinFieldAdmin, c2 as JsonFieldAdmin, c3 as JsonFormat, c4 as LIFECYCLE_EVENT_NAMES, c5 as LifecycleEventHandler, c6 as LinkFormat, c7 as MetricColor, c8 as MultiSelectFieldAdmin, c9 as NamedAccessPolicy, ca as NumberFieldAdmin, cb as NumberFormat, cc as NumberLimitFieldAdmin, cd as NumberLimitFieldConfig, ce as NumericOperation, cf as OIDCAdminAuthProvider, cg as OptionFormat, ch as PaginatedResult, ci as PublicAdminAuthProvider, cj as QueryCollectionResult, ck as RAGSearchResult, cl as RadioFieldAdmin, cm as RateLimitConfig, cn as ReadonlyDatabaseAdapter, co as RichTextFeature, cp as RichTextFieldConfig, cq as SelectFieldAdmin, cr as SqlWhereResult, cs as StorageAdapter, ct as TextFieldAdmin, cu as TextFormat, cv as TextareaFieldAdmin, cw as TrustProxyConfig, cx as TypedField, cy as UploadConfig, cz as UrlFieldAdmin, cA as UrlLinkValue, cB as ViewActionFeatures, cC as ViewComponentSlots, cD as ViewConfig, cE as ViewLayout, cF as ViewMetric, cG as ViewSubMetric, cH as WhereClause, cI as WhereOperator, cJ as WhereOperatorName, cK as WordLimitFieldAdmin, cL as WordLimitFieldConfig, cM as WorkflowMetadata, cN as WorkflowRole, cO as WorkflowState, cP as WorkflowTransitionContext, cQ as defineAction, cR as defineView, cS as isAICollection, cT as parseMongoWhere, cU as parseSqlWhere } from './app-De-3eNn1.js';
 import jexl from 'jexl';
-import 'lucide-react';
+import { Context } from 'hono';
+export { z } from 'zod';
+import 'hono/types';
 import 'pino';
+import 'lucide-react';
+import 'jose';
+import '@opentelemetry/api';
+import '@opentelemetry/exporter-prometheus';
 
 type Prettify<T> = {
     [K in keyof T]: T[K];
@@ -75,6 +81,21 @@ type UploadDocFields = {
     }>;
 };
 
+type AIErrorCode = 'AI_UNCONFIGURED' | 'AI_RATE_LIMITED' | 'AI_QUOTA_EXHAUSTED' | 'AI_TIMEOUT' | 'AI_TOOL_VALIDATION_ERROR' | 'AI_PERMISSION_DENIED' | 'AI_TENANT_VIOLATION' | 'AI_ACTION_EXPIRED' | 'AI_ACTION_ALREADY_EXECUTED' | 'AI_INTERNAL_ERROR';
+declare class DyrectedAIError extends Error {
+    readonly code: AIErrorCode;
+    readonly status: number;
+    readonly details?: Record<string, unknown>;
+    constructor(code: AIErrorCode, message: string, status?: number, details?: Record<string, unknown>);
+    toJSON(): {
+        error: boolean;
+        code: AIErrorCode;
+        message: string;
+        status: number;
+        details: Record<string, unknown> | undefined;
+    };
+}
+
 /**
  * Normalizes the Dyrected configuration by injecting system fields
  * (createdAt, updatedAt, createdBy, updatedBy) into every collection and
@@ -85,6 +106,17 @@ declare function normalizeConfig(config: DyrectedConfig): DyrectedConfig;
 declare function getAdminAuthCollection(config: Pick<DyrectedConfig, "collections" | "adminAuth">): CollectionConfig | null;
 declare function resolveAdminAuthCollection(collections: CollectionConfig[], collectionSlug?: string): CollectionConfig | undefined;
 declare function getPublicAdminAuthConfig(adminAuth?: AdminAuthConfig, collections?: CollectionConfig[]): PublicAdminAuthConfig;
+/**
+ * Resolves the configured admin role for a collection or returns "admin" as default.
+ */
+declare function getAdminRoleForCollection(collection?: CollectionConfig | null): string;
+/**
+ * Checks whether a user possesses an administrative role.
+ * Considers:
+ * 1. The collection's configured `adminRole` (e.g. 'super_admin')
+ * 2. Standard admin roles ('admin', 'super_admin')
+ */
+declare function isUserAdmin(user: any, collection?: CollectionConfig | null): boolean;
 
 type SortDirection = 'ASC' | 'DESC';
 interface SortClause {
@@ -1143,6 +1175,61 @@ declare const expr: ExprFunction;
  */
 declare const when: ExprFunction;
 
+/**
+ * Extracts the list of allowed site IDs for a given authenticated user or token payload.
+ * Checks common tenant membership properties: `allowedSites`, `siteIds`, `siteAccess`, and singular `siteId`.
+ */
+declare function getAllowedSitesForUser(user?: Record<string, unknown> | null, payload?: Record<string, unknown> | null): string[] | undefined;
+/**
+ * Checks whether an authenticated user is permitted to access a given site ID.
+ * If the user has no tenant restrictions configured, access is unrestricted (returns true).
+ */
+declare function isSiteAuthorized(user: Record<string, unknown> | null | undefined, payload: Record<string, unknown> | null | undefined, requestedSiteId: string | undefined): boolean;
+/**
+ * Resolves the authorized site ID for the current request.
+ * Prioritizes `c.get("siteId")` (set upstream) and `X-Site-Id` header.
+ * Enforces that restricted users cannot spoof or access unauthorized site IDs.
+ *
+ * @throws HTTPException(403) if the user is not authorized for the requested site.
+ */
+declare function resolveAuthorizedSiteId(c: Context<DyrectedContext>): string;
+
+declare const NON_NEGOTIABLE_CREDENTIAL_FIELDS: Set<string>;
+/**
+ * Masks an email address to protect privacy (e.g. "john.doe@example.com" -> "j***@example.com").
+ */
+declare function maskEmail(email: string, strategy?: "mask" | "token"): string;
+/**
+ * Masks a phone number (e.g. "+1 555-234-5678" -> "+1 ***-***-5678").
+ */
+declare function maskPhone(phone: string, strategy?: "mask" | "token"): string;
+/**
+ * High-performance regex patterns for common PII.
+ */
+declare const PII_REGEX_PATTERNS: Record<string, RegExp>;
+/**
+ * Scrubs unstructured free text using configured regex patterns and custom scrubbers.
+ */
+declare function maskTextPII(text: string, piiConfig?: AIPIIConfig): string;
+interface SanitizeDocForAIOptions {
+    doc: Record<string, unknown>;
+    collectionConfig?: CollectionConfig;
+    globalAIConfig?: AIConfig;
+}
+/**
+ * Deterministically sanitizes a CMS document before sending it to an AI assistant or RAG pipeline:
+ * 1. Non-negotiably strips passwords, secrets, hashes, and session tokens.
+ * 2. Strips collection-level `excludeFields`.
+ * 3. Applies field-level definitions:
+ *    - Automatically masks `email` and `phone` by default (opt-out privacy) unless `ai: { allowRaw: true }`.
+ *    - Strips fields configured with `ai: { exclude: true }`.
+ *    - Masks fields configured with `ai: { redact: true }`.
+ * 4. Applies collection-level `redactFields`.
+ * 5. Calls custom programmatic `collectionConfig.ai.sanitizeDoc` hook if provided.
+ * 6. Scrubs unstructured text across string fields if `config.ai.pii.enabled === true`.
+ */
+declare function sanitizeDocForAI(options: SanitizeDocForAIOptions): Record<string, unknown>;
+
 type TopLevelFieldName<TFields extends readonly Field[]> = Extract<TFields[number], {
     name: string;
 }>["name"];
@@ -1562,4 +1649,4 @@ declare function defineTab<const T extends readonly Field[]>(args: {
     fields: T;
 }): T;
 
-export { type AccessConditions, AccessPolicyResolver, AdminAuthConfig, ArrayField, AuthConfig, type AuthDocFields, AuthenticatedUser, BUILTIN_JEXL_HELPERS, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, ComputedHandler, type ConfigDiagnostic, ConfigValidationError, DateField, DateTimeField, type DeclarativeAccessSurface, type DeclarativeAccessValidationIssue, type DeclarativeAdminSurface, type DeclarativeAdminValidationIssue, DeclarativeHookExpression, type DeclarativeHookSurface, type DeclarativeHookValidationIssue, type DeclarativePreviewSurface, type DeclarativePreviewValidationIssue, DetailComputed, DetailComputedOptions, DetailCustom, DetailCustomOptions, DetailDivider, DetailDividerOptions, DetailField, DetailGrid, DetailGridOptions, DetailItem, DetailRepeat, DetailRepeatOptions, DetailSchema, DetailSection, DetailSectionOptions, DetailTab, DetailTabOptions, DetailTabs, DetailTabsOptions, DetailText, DetailTextOptions, DisplayFieldOptions, DyrectedConfig, EmailField, type ExprFunction, Field, FieldConditionBuilder, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MatchBuilder, MultiSelectField, NumberField, ObjectField, type Prettify, PublicAdminAuthConfig, type PublishingWorkflowOptions, RadioField, RelationshipField, RichTextField, RowField, SelectField, type SortClause, type SortDirection, type SqlSortDialect, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhenFunction, WorkflowConfig, WorkflowTransition, abs, addDays, assertValidAdminConditionsInConfig, assertValidDeclarativeAccessInConfig, assertValidDeclarativeHookExpression, assertValidDeclarativeHookResult, assertValidDeclarativeHooksInConfig, assertValidPreviewUrlsInConfig, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, capitalize, ceil, clamp, coalesce, collectAdminConditionValidationIssues, collectConfigDiagnostics, collectDeclarativeAccessValidationIssues, collectDeclarativeHookValidationIssues, collectPreviewUrlValidationIssues, compact, count, createLifecycleEvent, createWorkflowDocument, defaultValue, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, definePublishingWorkflow, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, diffDays, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, displayComputed, displayCustom, displayCustomComponent, displayDivider, displayField, displayGrid, displayRepeat, displaySection, displayTab, displayTabs, displayText, endsWith, evaluateDetailComputed, evaluateJexl, evaluateJexlSync, executeFieldAfterRead, executeFieldBeforeChange, expr, first, floor, formatConfigDiagnostics, formatDate, formatJexlValue, generateDefaultDetailSchema, generateOpenApi, get, getAdminAuthCollection, getPublicAdminAuthConfig, includes, initializeWorkflowDocument, isConfigValidationError, isDetailItemVisible, isEmpty, isFuture, isPast, join, last, length, lower, materializeWorkflowDocument, max, min, normalizeConfig, normalizeDetailItem, now, numericFieldNames, parseSort, pow, publishedStateName, publishingWorkflow, readingTime, registerJexlHelpers, replace, resolveAdminAuthCollection, round, runCollectionHooks, saveWorkflowDraft, simplePublishingWorkflow, slugify, sqrt, startsWith, sum, today, transitionWorkflow, trim, truncate, unique, upper, validateAdminConditionExpression, validateDeclarativeAccessExpression, validateDeclarativeHookExpression, validatePreviewUrlExpression, when, wordCount, workflowCapabilities };
+export { AIConfig, type AIErrorCode, AIPIIConfig, type AccessConditions, AccessPolicyResolver, AdminAuthConfig, ArrayField, AuthConfig, type AuthDocFields, AuthenticatedUser, BUILTIN_JEXL_HELPERS, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, ComputedHandler, type ConfigDiagnostic, ConfigValidationError, DateField, DateTimeField, type DeclarativeAccessSurface, type DeclarativeAccessValidationIssue, type DeclarativeAdminSurface, type DeclarativeAdminValidationIssue, DeclarativeHookExpression, type DeclarativeHookSurface, type DeclarativeHookValidationIssue, type DeclarativePreviewSurface, type DeclarativePreviewValidationIssue, DetailComputed, DetailComputedOptions, DetailCustom, DetailCustomOptions, DetailDivider, DetailDividerOptions, DetailField, DetailGrid, DetailGridOptions, DetailItem, DetailRepeat, DetailRepeatOptions, DetailSchema, DetailSection, DetailSectionOptions, DetailTab, DetailTabOptions, DetailTabs, DetailTabsOptions, DetailText, DetailTextOptions, DisplayFieldOptions, DyrectedAIError, DyrectedConfig, EmailField, type ExprFunction, Field, FieldConditionBuilder, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MatchBuilder, MultiSelectField, NON_NEGOTIABLE_CREDENTIAL_FIELDS, NumberField, ObjectField, PII_REGEX_PATTERNS, type Prettify, PublicAdminAuthConfig, type PublishingWorkflowOptions, RadioField, RelationshipField, RichTextField, RowField, type SanitizeDocForAIOptions, SelectField, type SortClause, type SortDirection, type SqlSortDialect, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhenFunction, WorkflowConfig, WorkflowTransition, abs, addDays, assertValidAdminConditionsInConfig, assertValidDeclarativeAccessInConfig, assertValidDeclarativeHookExpression, assertValidDeclarativeHookResult, assertValidDeclarativeHooksInConfig, assertValidPreviewUrlsInConfig, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, capitalize, ceil, clamp, coalesce, collectAdminConditionValidationIssues, collectConfigDiagnostics, collectDeclarativeAccessValidationIssues, collectDeclarativeHookValidationIssues, collectPreviewUrlValidationIssues, compact, count, createLifecycleEvent, createWorkflowDocument, defaultValue, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, definePublishingWorkflow, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, diffDays, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, displayComputed, displayCustom, displayCustomComponent, displayDivider, displayField, displayGrid, displayRepeat, displaySection, displayTab, displayTabs, displayText, endsWith, evaluateDetailComputed, evaluateJexl, evaluateJexlSync, executeFieldAfterRead, executeFieldBeforeChange, expr, first, floor, formatConfigDiagnostics, formatDate, formatJexlValue, generateDefaultDetailSchema, generateOpenApi, get, getAdminAuthCollection, getAdminRoleForCollection, getAllowedSitesForUser, getPublicAdminAuthConfig, includes, initializeWorkflowDocument, isConfigValidationError, isDetailItemVisible, isEmpty, isFuture, isPast, isSiteAuthorized, isUserAdmin, join, last, length, lower, maskEmail, maskPhone, maskTextPII, materializeWorkflowDocument, max, min, normalizeConfig, normalizeDetailItem, now, numericFieldNames, parseSort, pow, publishedStateName, publishingWorkflow, readingTime, registerJexlHelpers, replace, resolveAdminAuthCollection, resolveAuthorizedSiteId, round, runCollectionHooks, sanitizeDocForAI, saveWorkflowDraft, simplePublishingWorkflow, slugify, sqrt, startsWith, sum, today, transitionWorkflow, trim, truncate, unique, upper, validateAdminConditionExpression, validateDeclarativeAccessExpression, validateDeclarativeHookExpression, validatePreviewUrlExpression, when, wordCount, workflowCapabilities };

package/dist/index.js

@@ -1,6 +1,7 @@
 import {
   BUILTIN_JEXL_HELPERS,
   ConfigValidationError,
+  DyrectedAIError,
   LIFECYCLE_EVENTS_COLLECTION,
   WORKFLOW_HISTORY_COLLECTION,
   abs,
@@ -56,6 +57,8 @@ import {
   generateOpenApi,
   get,
   getAdminAuthCollection,
+  getAdminRoleForCollection,
+  getAllowedSitesForUser,
   getPublicAdminAuthConfig,
   includes,
   initializeWorkflowDocument,
@@ -64,6 +67,8 @@ import {
   isEmpty,
   isFuture,
   isPast,
+  isSiteAuthorized,
+  isUserAdmin,
   join,
   last,
   length,
@@ -81,6 +86,7 @@ import {
   registerJexlHelpers,
   replace,
   resolveAdminAuthCollection,
+  resolveAuthorizedSiteId,
   round,
   runCollectionHooks,
   saveWorkflowDraft,
@@ -101,7 +107,24 @@ import {
   validatePreviewUrlExpression,
   wordCount,
   workflowCapabilities
-} from "./chunk-VOE2LOLF.js";
+} from "./chunk-LYENW2EN.js";
+import {
+  NON_NEGOTIABLE_CREDENTIAL_FIELDS,
+  PII_REGEX_PATTERNS,
+  maskEmail,
+  maskPhone,
+  maskTextPII,
+  sanitizeDocForAI
+} from "./chunk-254THFDS.js";
+import {
+  AI_ACTIONS_COLLECTION,
+  AI_AUDIT_COLLECTION,
+  AI_CHUNKS_COLLECTION,
+  AI_MESSAGES_COLLECTION,
+  AI_THREADS_COLLECTION,
+  isAICollection
+} from "./chunk-4RAQJVJM.js";
+import "./chunk-27YRIGK5.js";
 import "./chunk-JSBRDJBE.js";
 
 // src/types/workflows.ts
@@ -778,6 +801,7 @@ var expr = createExpr();
 var when = expr;
 
 // src/index.ts
+import { z } from "zod";
 function defineCollection(config) {
   return config;
 }
@@ -825,12 +849,20 @@ function defineTab(args) {
   }));
 }
 export {
+  AI_ACTIONS_COLLECTION,
+  AI_AUDIT_COLLECTION,
+  AI_CHUNKS_COLLECTION,
+  AI_MESSAGES_COLLECTION,
+  AI_THREADS_COLLECTION,
   BUILTIN_JEXL_HELPERS,
   ConfigValidationError,
+  DyrectedAIError,
   FieldConditionBuilder,
   LIFECYCLE_EVENTS_COLLECTION,
   LIFECYCLE_EVENT_NAMES,
   MatchBuilder,
+  NON_NEGOTIABLE_CREDENTIAL_FIELDS,
+  PII_REGEX_PATTERNS,
   WORKFLOW_HISTORY_COLLECTION,
   abs,
   addDays,
@@ -918,18 +950,26 @@ export {
   generateOpenApi,
   get,
   getAdminAuthCollection,
+  getAdminRoleForCollection,
+  getAllowedSitesForUser,
   getPublicAdminAuthConfig,
   includes,
   initializeWorkflowDocument,
+  isAICollection,
   isConfigValidationError,
   isDetailItemVisible,
   isEmpty,
   isFuture,
   isPast,
+  isSiteAuthorized,
+  isUserAdmin,
   join,
   last,
   length,
   lower,
+  maskEmail,
+  maskPhone,
+  maskTextPII,
   materializeWorkflowDocument,
   max,
   min,
@@ -947,8 +987,10 @@ export {
   registerJexlHelpers,
   replace,
   resolveAdminAuthCollection,
+  resolveAuthorizedSiteId,
   round,
   runCollectionHooks,
+  sanitizeDocForAI,
   saveWorkflowDraft,
   simplePublishingWorkflow,
   slugify,
@@ -967,5 +1009,6 @@ export {
   validatePreviewUrlExpression,
   when,
   wordCount,
-  workflowCapabilities
+  workflowCapabilities,
+  z
 };

package/dist/rag.service-YDGEYTXS.js

@@ -0,0 +1,11 @@
+import {
+  RAGService
+} from "./chunk-ZYYDTHF3.js";
+import "./chunk-254THFDS.js";
+import "./chunk-4RAQJVJM.js";
+import "./chunk-HRRJ3RYT.js";
+import "./chunk-27YRIGK5.js";
+import "./chunk-JSBRDJBE.js";
+export {
+  RAGService
+};