@dyrected/core 2.12.0 → 2.13.1

package/dist/index.cjs

@@ -5,9 +5,6 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
 var __commonJS = (cb, mod) => function __require() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
@@ -33,517 +30,6 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// src/observability.ts
-var observability_exports = {};
-__export(observability_exports, {
-  attachRequestMetrics: () => attachRequestMetrics,
-  bindObservabilityRuntime: () => bindObservabilityRuntime,
-  buildRequestLogger: () => buildRequestLogger,
-  captureRequestBody: () => captureRequestBody,
-  createObservabilityRuntime: () => createObservabilityRuntime,
-  createRequestSpan: () => createRequestSpan,
-  endRequestSpan: () => endRequestSpan,
-  getConfigLogger: () => getConfigLogger,
-  getObservabilityRuntime: () => getObservabilityRuntime,
-  getRequestLogger: () => getRequestLogger,
-  redactBody: () => redactBody,
-  redactHeaders: () => redactHeaders,
-  renderPrometheusMetrics: () => renderPrometheusMetrics,
-  resolveObservabilityConfig: () => resolveObservabilityConfig,
-  shouldSampleRequest: () => shouldSampleRequest
-});
-function resolveObservabilityConfig(config) {
-  const requestLogging = config?.requestLogging;
-  const sampling = config?.sampling;
-  const tracing = config?.tracing;
-  const metrics = config?.metrics;
-  return {
-    requestLogging: {
-      enabled: requestLogging?.enabled ?? true,
-      logBodies: requestLogging?.logBodies ?? false,
-      maxBodyBytes: requestLogging?.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES,
-      redactPaths: uniqueValues([
-        ...DEFAULT_REDACT_PATHS,
-        ...requestLogging?.redactPaths ?? []
-      ]),
-      includeHeaders: normalizeHeaderNames(requestLogging?.includeHeaders ?? []),
-      redactHeaders: uniqueValues(
-        normalizeHeaderNames([
-          ...DEFAULT_REDACT_HEADERS,
-          ...requestLogging?.redactHeaders ?? []
-        ])
-      )
-    },
-    sampling: {
-      successRate: clampRate(sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE),
-      traceSuccessRate: clampRate(
-        sampling?.traceSuccessRate ?? sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE
-      ),
-      bodySuccessRate: clampRate(
-        sampling?.bodySuccessRate ?? Math.min(DEFAULT_BODY_SAMPLE_RATE, sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE)
-      ),
-      alwaysKeep4xx: sampling?.alwaysKeep4xx ?? true,
-      alwaysKeep5xx: sampling?.alwaysKeep5xx ?? true
-    },
-    tracing: {
-      enabled: tracing?.enabled ?? false,
-      serviceName: tracing?.serviceName ?? "dyrected",
-      exporter: tracing?.exporter ?? "none",
-      headers: tracing?.headers ?? {},
-      endpoint: tracing?.endpoint
-    },
-    metrics: {
-      enabled: metrics?.enabled ?? false,
-      exporter: metrics?.exporter ?? "none",
-      endpoint: metrics?.endpoint,
-      path: metrics?.path ?? "/metrics"
-    },
-    transports: {
-      targets: config?.transports?.targets && config.transports.targets.length > 0 ? config.transports.targets : [{ type: "stdout" }]
-    }
-  };
-}
-function createObservabilityRuntime(config) {
-  const resolved = resolveObservabilityConfig(config.observability);
-  const logger = createRootLogger(config.logger, resolved);
-  const shutdownTasks = [];
-  const meterRuntime = resolved.metrics.enabled || resolved.metrics.exporter === "prometheus" ? createMeterProvider(resolved) : void 0;
-  const tracerProvider = resolved.tracing.enabled ? createTracerProvider(resolved) : void 0;
-  const tracer = tracerProvider?.getTracer("dyrected");
-  const meter = meterRuntime?.provider.getMeter("dyrected");
-  const metrics = meter ? {
-    requestCount: meter.createCounter("dyrected_http_requests_total", {
-      description: "Total HTTP requests served by Dyrected"
-    }),
-    authFailureCount: meter.createCounter("dyrected_auth_failures_total", {
-      description: "Authentication failures"
-    }),
-    uncaughtErrorCount: meter.createCounter("dyrected_uncaught_errors_total", {
-      description: "Uncaught application errors"
-    }),
-    auditWriteFailureCount: meter.createCounter("dyrected_audit_write_failures_total", {
-      description: "Audit log persistence failures"
-    }),
-    emailSendFailureCount: meter.createCounter("dyrected_email_send_failures_total", {
-      description: "Transactional email delivery failures"
-    }),
-    workflowHookFailureCount: meter.createCounter("dyrected_workflow_hook_failures_total", {
-      description: "Workflow hook failures isolated after successful writes"
-    }),
-    requestDuration: meter.createHistogram("dyrected_http_request_duration_ms", {
-      description: "HTTP request duration in milliseconds",
-      unit: "ms"
-    })
-  } : void 0;
-  if (meterRuntime) {
-    shutdownTasks.push(() => meterRuntime.provider.shutdown());
-  }
-  if (tracerProvider) {
-    shutdownTasks.push(() => tracerProvider.shutdown());
-  }
-  return {
-    logger,
-    config: resolved,
-    tracer,
-    metrics,
-    prometheusExporter: meterRuntime?.prometheusExporter,
-    shutdown: async () => {
-      for (const task of shutdownTasks) {
-        await task();
-      }
-    },
-    recordAuthFailure: (attributes) => metrics?.authFailureCount.add(1, attributes),
-    recordUncaughtError: (attributes) => metrics?.uncaughtErrorCount.add(1, attributes),
-    recordAuditWriteFailure: (attributes) => metrics?.auditWriteFailureCount.add(1, attributes),
-    recordEmailSendFailure: (attributes) => metrics?.emailSendFailureCount.add(1, attributes),
-    recordWorkflowHookFailure: (attributes) => metrics?.workflowHookFailureCount.add(1, attributes)
-  };
-}
-function bindObservabilityRuntime(config, runtime) {
-  runtimeByConfig.set(config, runtime);
-}
-function getObservabilityRuntime(config) {
-  if (!config || typeof config !== "object") return void 0;
-  return runtimeByConfig.get(config);
-}
-function createRootLogger(loggerConfig, observability) {
-  if (loggerConfig && !("options" in loggerConfig)) {
-    return loggerConfig;
-  }
-  const options = loggerConfig?.options ?? {};
-  const enabled = options.enabled ?? process.env.DISABLE_LOGGING !== "true";
-  const name = options.name ?? "dyrected";
-  if (loggerConfig?.destination) {
-    return (0, import_pino.default)(
-      {
-        ...options,
-        enabled,
-        name,
-        timestamp: options.timestamp ?? import_pino.stdTimeFunctions.isoTime
-      },
-      loggerConfig.destination
-    );
-  }
-  const streams = buildTransportStreams(observability);
-  const destination = streams.length === 1 ? streams[0] : (0, import_pino.multistream)(streams.map((stream) => ({ stream })));
-  return (0, import_pino.default)(
-    {
-      ...options,
-      enabled,
-      name,
-      timestamp: options.timestamp ?? import_pino.stdTimeFunctions.isoTime
-    },
-    destination
-  );
-}
-function buildTransportStreams(observability) {
-  const targets = observability.transports.targets;
-  if (targets.length === 0) {
-    return [defaultLoggerDestination()];
-  }
-  return targets.map((target) => {
-    switch (target.type) {
-      case "stdout":
-        return defaultLoggerDestination();
-      case "stderr":
-        return (0, import_pino.destination)(2);
-      case "file":
-        return (0, import_pino.destination)(target.path);
-      case "otlp":
-        return new OtlpLogWritable(target.endpoint, target.headers);
-    }
-  });
-}
-function defaultLoggerDestination() {
-  if (process.env.NODE_ENV !== "production" && typeof window === "undefined") {
-    try {
-      const req = globalThis.require;
-      if (req) {
-        const pinoPretty = req("pino-pretty");
-        return pinoPretty({
-          colorize: true,
-          ignore: "pid,hostname",
-          translateTime: "SYS:HH:MM:ss",
-          destination: 1,
-          sync: true
-        });
-      }
-    } catch {
-    }
-  }
-  return (0, import_pino.destination)(1);
-}
-function createTracerProvider(observability) {
-  const exporter = createTraceExporter(observability);
-  const provider = new import_sdk_trace_base.BasicTracerProvider({
-    resource: (0, import_resources.resourceFromAttributes)({
-      "service.name": observability.tracing.serviceName
-    }),
-    spanProcessors: exporter ? [new import_sdk_trace_base.BatchSpanProcessor(exporter)] : []
-  });
-  import_api.trace.setGlobalTracerProvider(provider);
-  return provider;
-}
-function createTraceExporter(observability) {
-  switch (observability.tracing.exporter) {
-    case "console":
-      return new import_sdk_trace_base.ConsoleSpanExporter();
-    case "otlp":
-      return new import_exporter_trace_otlp_http.OTLPTraceExporter({
-        url: observability.tracing.endpoint,
-        headers: observability.tracing.headers
-      });
-    default:
-      return void 0;
-  }
-}
-function createMeterProvider(observability) {
-  const readers = [];
-  let prometheusExporter;
-  switch (observability.metrics.exporter) {
-    case "otlp":
-      readers.push(
-        new import_sdk_metrics.PeriodicExportingMetricReader({
-          exporter: new import_exporter_metrics_otlp_http.OTLPMetricExporter({
-            url: observability.metrics.endpoint
-          })
-        })
-      );
-      break;
-    case "prometheus":
-      prometheusExporter = new import_exporter_prometheus.PrometheusExporter({
-        endpoint: observability.metrics.path,
-        preventServerStart: true
-      });
-      readers.push(prometheusExporter);
-      break;
-  }
-  const provider = new import_sdk_metrics.MeterProvider({
-    resource: (0, import_resources.resourceFromAttributes)({
-      "service.name": observability.tracing.serviceName
-    }),
-    readers
-  });
-  return { provider, prometheusExporter };
-}
-function getConfigLogger(config, component) {
-  const base = config?.logger && !("options" in config.logger) ? config.logger : fallbackLogger;
-  return base.child({ component });
-}
-function getRequestLogger(c, component) {
-  const base = c.get("logger") ?? fallbackLogger;
-  return component ? base.child({ component }) : base;
-}
-function buildRequestLogger(runtime, vars, requestId) {
-  const trace2 = vars.requestTrace;
-  return runtime.logger.child({
-    requestId,
-    siteId: vars.siteId,
-    workspaceId: vars.workspaceId,
-    traceId: trace2?.traceId,
-    spanId: trace2?.spanId
-  });
-}
-function shouldSampleRequest(requestId, statusCode, sampling, kind) {
-  if (statusCode >= 500 && sampling.alwaysKeep5xx) return true;
-  if (statusCode >= 400 && sampling.alwaysKeep4xx) return true;
-  const rate = kind === "trace" ? sampling.traceSuccessRate : kind === "body" ? sampling.bodySuccessRate : sampling.successRate;
-  return deterministicSample(requestId ?? "no-request-id", rate);
-}
-function redactHeaders(headers, observability) {
-  const includeHeaders = new Set(observability.requestLogging.includeHeaders);
-  const redactHeaders2 = new Set(observability.requestLogging.redactHeaders);
-  const output = {};
-  for (const [key, value] of Object.entries(headers)) {
-    const normalizedKey = key.toLowerCase();
-    if (includeHeaders.size > 0 && !includeHeaders.has(normalizedKey)) continue;
-    output[normalizedKey] = redactHeaders2.has(normalizedKey) ? REDACTED_VALUE : value;
-  }
-  return output;
-}
-async function captureRequestBody(request, observability) {
-  const contentType = request.headers.get("content-type") ?? void 0;
-  const contentLength = toNumber(request.headers.get("content-length"));
-  const jsonBody = contentType?.includes("application/json");
-  if (!jsonBody) {
-    return {
-      attempted: false,
-      contentType,
-      contentLength
-    };
-  }
-  try {
-    const text = await request.clone().text();
-    if (!text) {
-      return { attempted: true, contentType, contentLength };
-    }
-    const truncated = text.length > observability.requestLogging.maxBodyBytes;
-    const raw = truncated ? text.slice(0, observability.requestLogging.maxBodyBytes) : text;
-    try {
-      const parsed = JSON.parse(raw);
-      return {
-        attempted: true,
-        contentType,
-        contentLength: contentLength ?? text.length,
-        truncated,
-        body: redactBody(parsed, observability.requestLogging.redactPaths)
-      };
-    } catch {
-      return {
-        attempted: true,
-        contentType,
-        contentLength: contentLength ?? text.length,
-        truncated,
-        parseFailed: true
-      };
-    }
-  } catch {
-    return {
-      attempted: true,
-      contentType,
-      contentLength,
-      parseFailed: true
-    };
-  }
-}
-function redactBody(value, redactPaths) {
-  const cloned = deepClone(value);
-  for (const path of redactPaths) {
-    applyRedaction(cloned, path.split("."));
-  }
-  return cloned;
-}
-function applyRedaction(target, segments) {
-  if (!target || segments.length === 0) return;
-  const [segment, ...rest] = segments;
-  if (Array.isArray(target)) {
-    for (const item of target) {
-      if (segment === "*") {
-        applyRedaction(item, rest);
-      } else {
-        applyRedaction(item, segments);
-      }
-    }
-    return;
-  }
-  if (typeof target !== "object") return;
-  const record = target;
-  if (segment === "*") {
-    for (const value of Object.values(record)) {
-      applyRedaction(value, rest);
-    }
-    return;
-  }
-  if (!(segment in record)) return;
-  if (rest.length === 0) {
-    record[segment] = REDACTED_VALUE;
-    return;
-  }
-  applyRedaction(record[segment], rest);
-}
-function deepClone(value) {
-  if (typeof structuredClone === "function") {
-    return structuredClone(value);
-  }
-  return JSON.parse(JSON.stringify(value));
-}
-function createRequestSpan(runtime, name, attributes) {
-  if (!runtime.tracer) return void 0;
-  const span = runtime.tracer.startSpan(name, { attributes }, import_api.context.active());
-  const spanContext = span.spanContext();
-  return {
-    span,
-    traceId: spanContext.traceId,
-    spanId: spanContext.spanId,
-    sampled: spanContext.traceFlags === import_api.TraceFlags.SAMPLED
-  };
-}
-function endRequestSpan(requestTrace, statusCode, error) {
-  if (!requestTrace) return;
-  requestTrace.span.setAttribute("http.status_code", statusCode);
-  if (error) {
-    requestTrace.span.recordException(error instanceof Error ? error : new Error(String(error)));
-  }
-  requestTrace.span.end();
-}
-function attachRequestMetrics(runtime, args) {
-  runtime.metrics?.requestCount.add(1, {
-    method: args.method,
-    route: args.route,
-    status_class: `${Math.floor(args.statusCode / 100)}xx`
-  });
-  runtime.metrics?.requestDuration.record(args.durationMs, {
-    method: args.method,
-    route: args.route,
-    status_class: `${Math.floor(args.statusCode / 100)}xx`
-  });
-}
-async function renderPrometheusMetrics(exporter) {
-  let statusCode = 200;
-  const headers = {};
-  let body = "";
-  await new Promise((resolve) => {
-    const response = {
-      statusCode,
-      setHeader(name, value) {
-        headers[name.toLowerCase()] = value;
-      },
-      end(chunk) {
-        if (chunk) body += chunk;
-        statusCode = this.statusCode;
-        resolve();
-      }
-    };
-    exporter.getMetricsRequestHandler({}, response);
-  });
-  return { body, headers, statusCode };
-}
-function normalizeHeaderNames(headers) {
-  return headers.map((value) => value.toLowerCase());
-}
-function uniqueValues(values) {
-  return [...new Set(values)];
-}
-function clampRate(value) {
-  if (Number.isNaN(value)) return 0;
-  return Math.max(0, Math.min(1, value));
-}
-function deterministicSample(seed, rate) {
-  if (rate >= 1) return true;
-  if (rate <= 0) return false;
-  let hash = 0;
-  for (let index = 0; index < seed.length; index += 1) {
-    hash = hash * 31 + seed.charCodeAt(index) >>> 0;
-  }
-  return hash / 4294967295 <= rate;
-}
-function toNumber(value) {
-  if (!value) return void 0;
-  const parsed = Number(value);
-  return Number.isFinite(parsed) ? parsed : void 0;
-}
-var import_api, import_exporter_metrics_otlp_http, import_exporter_prometheus, import_exporter_trace_otlp_http, import_resources, import_sdk_metrics, import_sdk_trace_base, import_pino, import_node_stream, DEFAULT_REDACT_HEADERS, DEFAULT_REDACT_PATHS, DEFAULT_MAX_BODY_BYTES, DEFAULT_SUCCESS_SAMPLE_RATE, DEFAULT_BODY_SAMPLE_RATE, REDACTED_VALUE, runtimeByConfig, fallbackLogger, OtlpLogWritable;
-var init_observability = __esm({
-  "src/observability.ts"() {
-    "use strict";
-    import_api = require("@opentelemetry/api");
-    import_exporter_metrics_otlp_http = require("@opentelemetry/exporter-metrics-otlp-http");
-    import_exporter_prometheus = require("@opentelemetry/exporter-prometheus");
-    import_exporter_trace_otlp_http = require("@opentelemetry/exporter-trace-otlp-http");
-    import_resources = require("@opentelemetry/resources");
-    import_sdk_metrics = require("@opentelemetry/sdk-metrics");
-    import_sdk_trace_base = require("@opentelemetry/sdk-trace-base");
-    import_pino = __toESM(require("pino"), 1);
-    import_node_stream = require("stream");
-    DEFAULT_REDACT_HEADERS = ["authorization", "cookie", "set-cookie", "x-api-key"];
-    DEFAULT_REDACT_PATHS = [
-      "password",
-      "currentPassword",
-      "newPassword",
-      "confirmPassword",
-      "token",
-      "refreshToken",
-      "accessToken",
-      "secret",
-      "apiKey",
-      "inviteToken",
-      "resetToken"
-    ];
-    DEFAULT_MAX_BODY_BYTES = 8192;
-    DEFAULT_SUCCESS_SAMPLE_RATE = 0.1;
-    DEFAULT_BODY_SAMPLE_RATE = 0.02;
-    REDACTED_VALUE = "[REDACTED]";
-    runtimeByConfig = /* @__PURE__ */ new WeakMap();
-    fallbackLogger = (0, import_pino.default)({
-      name: "dyrected",
-      enabled: process.env.DISABLE_LOGGING !== "true",
-      timestamp: import_pino.stdTimeFunctions.isoTime
-    });
-    OtlpLogWritable = class extends import_node_stream.Writable {
-      constructor(endpoint, headers = {}) {
-        super();
-        this.endpoint = endpoint;
-        this.headers = headers;
-      }
-      endpoint;
-      headers;
-      _write(chunk, _encoding, callback) {
-        const payload = chunk.toString();
-        void fetch(this.endpoint, {
-          method: "POST",
-          headers: {
-            "content-type": "application/json",
-            ...this.headers
-          },
-          body: JSON.stringify({ logs: payload.trim().split("\n").filter(Boolean) })
-        }).then(() => callback()).catch(
-          (error) => callback(error instanceof Error ? error : new Error(String(error)))
-        );
-      }
-    };
-  }
-});
-
 // ../../node_modules/.pnpm/@babel+runtime@7.29.7/node_modules/@babel/runtime/helpers/interopRequireDefault.js
 var require_interopRequireDefault = __commonJS({
   "../../node_modules/.pnpm/@babel+runtime@7.29.7/node_modules/@babel/runtime/helpers/interopRequireDefault.js"(exports2, module2) {
@@ -2298,12 +1784,20 @@ var require_Jexl = __commonJS({
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  AI_ACTIONS_COLLECTION: () => AI_ACTIONS_COLLECTION,
+  AI_AUDIT_COLLECTION: () => AI_AUDIT_COLLECTION,
+  AI_CHUNKS_COLLECTION: () => AI_CHUNKS_COLLECTION,
+  AI_MESSAGES_COLLECTION: () => AI_MESSAGES_COLLECTION,
+  AI_THREADS_COLLECTION: () => AI_THREADS_COLLECTION,
   BUILTIN_JEXL_HELPERS: () => BUILTIN_JEXL_HELPERS,
   ConfigValidationError: () => ConfigValidationError,
+  DyrectedAIError: () => DyrectedAIError,
   FieldConditionBuilder: () => FieldConditionBuilder,
   LIFECYCLE_EVENTS_COLLECTION: () => LIFECYCLE_EVENTS_COLLECTION,
   LIFECYCLE_EVENT_NAMES: () => LIFECYCLE_EVENT_NAMES,
   MatchBuilder: () => MatchBuilder,
+  NON_NEGOTIABLE_CREDENTIAL_FIELDS: () => NON_NEGOTIABLE_CREDENTIAL_FIELDS,
+  PII_REGEX_PATTERNS: () => PII_REGEX_PATTERNS,
   WORKFLOW_HISTORY_COLLECTION: () => WORKFLOW_HISTORY_COLLECTION,
   abs: () => abs,
   addDays: () => addDays,
@@ -2391,18 +1885,26 @@ __export(index_exports, {
   generateOpenApi: () => generateOpenApi,
   get: () => get,
   getAdminAuthCollection: () => getAdminAuthCollection,
+  getAdminRoleForCollection: () => getAdminRoleForCollection,
+  getAllowedSitesForUser: () => getAllowedSitesForUser,
   getPublicAdminAuthConfig: () => getPublicAdminAuthConfig,
   includes: () => includes,
   initializeWorkflowDocument: () => initializeWorkflowDocument,
+  isAICollection: () => isAICollection,
   isConfigValidationError: () => isConfigValidationError,
   isDetailItemVisible: () => isDetailItemVisible,
   isEmpty: () => isEmpty,
   isFuture: () => isFuture,
   isPast: () => isPast,
+  isSiteAuthorized: () => isSiteAuthorized,
+  isUserAdmin: () => isUserAdmin,
   join: () => join,
   last: () => last,
   length: () => length,
   lower: () => lower,
+  maskEmail: () => maskEmail,
+  maskPhone: () => maskPhone,
+  maskTextPII: () => maskTextPII,
   materializeWorkflowDocument: () => materializeWorkflowDocument,
   max: () => max,
   min: () => min,
@@ -2420,8 +1922,10 @@ __export(index_exports, {
   registerJexlHelpers: () => registerJexlHelpers,
   replace: () => replace,
   resolveAdminAuthCollection: () => resolveAdminAuthCollection,
+  resolveAuthorizedSiteId: () => resolveAuthorizedSiteId,
   round: () => round,
   runCollectionHooks: () => runCollectionHooks,
+  sanitizeDocForAI: () => sanitizeDocForAI,
   saveWorkflowDraft: () => saveWorkflowDraft,
   simplePublishingWorkflow: () => simplePublishingWorkflow,
   slugify: () => slugify,
@@ -2440,7 +1944,8 @@ __export(index_exports, {
   validatePreviewUrlExpression: () => validatePreviewUrlExpression,
   when: () => when,
   wordCount: () => wordCount,
-  workflowCapabilities: () => workflowCapabilities
+  workflowCapabilities: () => workflowCapabilities,
+  z: () => import_zod.z
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -2460,6 +1965,40 @@ function defineAction(config) {
   return config;
 }
 
+// src/types/ai.ts
+var AI_THREADS_COLLECTION = "_dyrected_ai_threads";
+var AI_MESSAGES_COLLECTION = "_dyrected_ai_messages";
+var AI_CHUNKS_COLLECTION = "_dyrected_ai_chunks";
+var AI_ACTIONS_COLLECTION = "_dyrected_ai_actions";
+var AI_AUDIT_COLLECTION = "_dyrected_ai_audit";
+function isAICollection(slug) {
+  return slug === AI_THREADS_COLLECTION || slug === AI_MESSAGES_COLLECTION || slug === AI_CHUNKS_COLLECTION || slug === AI_ACTIONS_COLLECTION || slug === AI_AUDIT_COLLECTION;
+}
+
+// src/types/ai-errors.ts
+var DyrectedAIError = class _DyrectedAIError extends Error {
+  code;
+  status;
+  details;
+  constructor(code, message, status = 500, details) {
+    super(message);
+    this.name = "DyrectedAIError";
+    this.code = code;
+    this.status = status;
+    this.details = details;
+    Object.setPrototypeOf(this, _DyrectedAIError.prototype);
+  }
+  toJSON() {
+    return {
+      error: true,
+      code: this.code,
+      message: this.message,
+      status: this.status,
+      details: this.details
+    };
+  }
+};
+
 // src/auth/token.ts
 var import_jose = require("jose");
 
@@ -2862,18 +2401,31 @@ async function transitionWorkflow(args) {
       await hook({ ...hookContext, doc: updated, event: events[0] });
     } catch (error) {
       try {
-        const { getConfigLogger: getConfigLogger2, getObservabilityRuntime: getObservabilityRuntime2 } = await Promise.resolve().then(() => (init_observability(), observability_exports));
-        getObservabilityRuntime2(config)?.recordWorkflowHookFailure({
+        const obs = config?.__observability;
+        obs?.recordWorkflowHookFailure?.({
           collection: collection.slug,
           transition: transition.name
         });
-        getConfigLogger2(config, "workflow").error({
-          err: error,
-          msg: "afterTransition hook failed",
-          collection: collection.slug,
-          transition: transition.name,
-          documentId: id
-        });
+        const logger = config?.logger;
+        if (logger && typeof logger.child === "function") {
+          logger.child({ component: "workflow" }).error({
+            err: error,
+            msg: "afterTransition hook failed",
+            collection: collection.slug,
+            transition: transition.name,
+            documentId: id
+          });
+        } else if (logger && typeof logger.error === "function") {
+          logger.error({
+            err: error,
+            msg: "afterTransition hook failed",
+            collection: collection.slug,
+            transition: transition.name,
+            documentId: id
+          });
+        } else {
+          console.error("afterTransition hook failed:", error);
+        }
       } catch {
         console.error("afterTransition hook failed:", error);
       }
@@ -2916,6 +2468,19 @@ function humanizeProviderName(id, type) {
   if (!cleaned) return type.toUpperCase();
   return cleaned.replace(/\b\w/g, (char) => char.toUpperCase());
 }
+function getAdminRoleForCollection(collection) {
+  if (!collection?.auth) return "admin";
+  if (typeof collection.auth === "object" && collection.auth.adminRole) {
+    return collection.auth.adminRole;
+  }
+  return "admin";
+}
+function isUserAdmin(user, collection) {
+  if (!user || !Array.isArray(user.roles)) return false;
+  const configuredRole = getAdminRoleForCollection(collection);
+  if (user.roles.includes(configuredRole)) return true;
+  return user.roles.includes("admin") || user.roles.includes("super_admin");
+}
 
 // src/utils/block-references.ts
 function mergeUniqueBlocks(blocks) {
@@ -5023,6 +4588,182 @@ function generateOpenApi(config) {
       }
     }
   };
+  spec.paths["/api/ai/chat"] = {
+    post: {
+      tags: ["AI"],
+      summary: "Send prompt and stream AI assistant response",
+      requestBody: {
+        required: true,
+        content: {
+          "application/json": {
+            schema: {
+              type: "object",
+              properties: {
+                content: { type: "string", description: "User prompt message" },
+                prompt: { type: "string", description: "Alias for content" },
+                threadId: { type: "string", description: "Existing conversation thread ID" },
+                messages: { type: "array", items: { type: "object" }, description: "Conversation history" }
+              },
+              required: []
+            }
+          }
+        }
+      },
+      responses: {
+        200: {
+          description: "Server-Sent Events (SSE) AI message stream",
+          content: { "text/event-stream": { schema: { type: "string" } } }
+        }
+      }
+    }
+  };
+  spec.paths["/api/ai/threads"] = {
+    get: {
+      tags: ["AI"],
+      summary: "List conversation threads",
+      parameters: [
+        { name: "limit", in: "query", schema: { type: "integer", default: 20 } }
+      ],
+      responses: { 200: { description: "Array of conversation threads" } }
+    },
+    post: {
+      tags: ["AI"],
+      summary: "Create a new conversation thread",
+      requestBody: {
+        content: {
+          "application/json": {
+            schema: {
+              type: "object",
+              properties: { title: { type: "string" } }
+            }
+          }
+        }
+      },
+      responses: { 201: { description: "Created conversation thread" } }
+    },
+    delete: {
+      tags: ["AI"],
+      summary: "Clear all conversation threads",
+      responses: { 200: { description: "Count of deleted threads" } }
+    }
+  };
+  spec.paths["/api/ai/threads/{threadId}"] = {
+    get: {
+      tags: ["AI"],
+      summary: "Get conversation thread and historical messages",
+      parameters: [
+        { name: "threadId", in: "path", required: true, schema: { type: "string" } }
+      ],
+      responses: { 200: { description: "Thread details and messages" } }
+    },
+    delete: {
+      tags: ["AI"],
+      summary: "Delete a specific conversation thread",
+      parameters: [
+        { name: "threadId", in: "path", required: true, schema: { type: "string" } }
+      ],
+      responses: { 200: { description: "Deletion success status" } }
+    }
+  };
+  spec.paths["/api/ai/threads/{threadId}/messages"] = {
+    post: {
+      tags: ["AI"],
+      summary: "Post a message to an existing thread and stream reply",
+      parameters: [
+        { name: "threadId", in: "path", required: true, schema: { type: "string" } }
+      ],
+      requestBody: {
+        required: true,
+        content: {
+          "application/json": {
+            schema: {
+              type: "object",
+              properties: { content: { type: "string" } },
+              required: ["content"]
+            }
+          }
+        }
+      },
+      responses: {
+        200: {
+          description: "Server-Sent Events (SSE) AI message stream",
+          content: { "text/event-stream": { schema: { type: "string" } } }
+        }
+      }
+    }
+  };
+  spec.paths["/api/ai/actions/{actionId}"] = {
+    get: {
+      tags: ["AI"],
+      summary: "Get an AI mutation action proposal",
+      parameters: [
+        { name: "actionId", in: "path", required: true, schema: { type: "string" } }
+      ],
+      responses: { 200: { description: "AI Action details and diff payload" } }
+    }
+  };
+  spec.paths["/api/ai/actions/{actionId}/execute"] = {
+    post: {
+      tags: ["AI"],
+      summary: "Approve and execute an AI mutation proposal",
+      parameters: [
+        { name: "actionId", in: "path", required: true, schema: { type: "string" } }
+      ],
+      responses: { 200: { description: "Execution result" } }
+    }
+  };
+  spec.paths["/api/ai/actions/{actionId}/reject"] = {
+    post: {
+      tags: ["AI"],
+      summary: "Reject an AI mutation proposal",
+      parameters: [
+        { name: "actionId", in: "path", required: true, schema: { type: "string" } }
+      ],
+      responses: { 200: { description: "Rejection result" } }
+    }
+  };
+  spec.paths["/api/ai/rag/reindex"] = {
+    post: {
+      tags: ["AI"],
+      summary: "Trigger vector reindexing for semantic search",
+      requestBody: {
+        content: {
+          "application/json": {
+            schema: {
+              type: "object",
+              properties: {
+                collection: { type: "string" },
+                force: { type: "boolean" }
+              }
+            }
+          }
+        }
+      },
+      responses: { 200: { description: "Reindexing results and chunk counts" } }
+    }
+  };
+  spec.paths["/api/ai/rag/search"] = {
+    post: {
+      tags: ["AI"],
+      summary: "Perform semantic vector search against indexed content",
+      requestBody: {
+        required: true,
+        content: {
+          "application/json": {
+            schema: {
+              type: "object",
+              properties: {
+                query: { type: "string" },
+                limit: { type: "integer", default: 5 }
+              },
+              required: ["query"]
+            }
+          }
+        }
+      },
+      responses: { 200: { description: "Semantic search results" } }
+    }
+  };
   for (const collection of config.collections) {
     spec.components.schemas[collection.slug] = collectionToSchema(collection);
   }
@@ -6496,7 +6237,240 @@ function createExpr() {
 var expr = createExpr();
 var when = expr;
 
+// src/utils/tenant.ts
+var import_http_exception = require("hono/http-exception");
+function getAllowedSitesForUser(user, payload) {
+  const raw = user?.allowedSites ?? user?.siteIds ?? user?.siteAccess ?? (user?.siteId ? [user.siteId] : void 0) ?? payload?.allowedSites ?? payload?.siteIds ?? payload?.siteAccess ?? (payload?.siteId ? [payload.siteId] : void 0);
+  if (Array.isArray(raw)) {
+    return raw.filter((s) => typeof s === "string" && s.trim().length > 0);
+  }
+  return void 0;
+}
+function isSiteAuthorized(user, payload, requestedSiteId) {
+  const allowedSites = getAllowedSitesForUser(user, payload);
+  if (!allowedSites || allowedSites.length === 0) {
+    return true;
+  }
+  if (!requestedSiteId) {
+    return false;
+  }
+  return allowedSites.includes(requestedSiteId);
+}
+function resolveAuthorizedSiteId(c) {
+  const user = typeof c.get === "function" ? c.get("user") : void 0;
+  const tokenPayload = typeof c.get === "function" ? c.get("authTokenPayload") : void 0;
+  const requestedSiteId = (typeof c.req?.header === "function" ? c.req.header("X-Site-Id") : void 0) || (typeof c.get === "function" ? c.get("siteId") : void 0);
+  const allowedSites = getAllowedSitesForUser(user, tokenPayload);
+  if (Array.isArray(allowedSites) && allowedSites.length > 0) {
+    if (!requestedSiteId) {
+      return allowedSites[0];
+    }
+    if (!allowedSites.includes(requestedSiteId)) {
+      throw new import_http_exception.HTTPException(403, {
+        message: `Forbidden: User is not authorized to access site "${requestedSiteId}".`
+      });
+    }
+    return requestedSiteId;
+  }
+  return requestedSiteId || "default";
+}
+
+// src/utils/ai-pii.ts
+var NON_NEGOTIABLE_CREDENTIAL_FIELDS = /* @__PURE__ */ new Set([
+  "password",
+  "salt",
+  "hash",
+  "resetPasswordToken",
+  "apiKey",
+  "token",
+  "secret",
+  "accessToken",
+  "refreshToken",
+  "privateKey",
+  "private_key",
+  "webhookSecret",
+  "webhook_secret",
+  "authSecret",
+  "auth_secret",
+  "cvv",
+  "cvc",
+  "pin"
+]);
+function maskEmail(email, strategy = "mask") {
+  if (!email || typeof email !== "string") return email;
+  if (strategy === "token") return "[REDACTED_EMAIL]";
+  const atIdx = email.indexOf("@");
+  if (atIdx <= 1) {
+    return "***@" + (email.slice(atIdx + 1) || "example.com");
+  }
+  const prefix = email[0];
+  const domain = email.slice(atIdx);
+  return `${prefix}***${domain}`;
+}
+function maskPhone(phone, strategy = "mask") {
+  if (!phone || typeof phone !== "string") return phone;
+  if (strategy === "token") return "[REDACTED_PHONE]";
+  const digits = phone.replace(/\D/g, "");
+  if (digits.length < 4) return "***-***-****";
+  const lastFour = digits.slice(-4);
+  return `***-***-${lastFour}`;
+}
+var PII_REGEX_PATTERNS = {
+  email: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,
+  phone_number: /(?:\+?\d{1,3}[-\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-\s]?\d{4}\b/g,
+  phoneNumber: /(?:\+?\d{1,3}[-\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-\s]?\d{4}\b/g,
+  phone: /(?:\+?\d{1,3}[-\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-\s]?\d{4}\b/g,
+  credit_card: /\b(?:\d{4}[-\s]?){3}\d{4}\b/g,
+  ssn: /\b\d{3}-\d{2}-\d{4}\b/g,
+  ipv4: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g,
+  ipv6: /(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}/g,
+  iban: /\b[A-Z]{2}\d{2}[A-Z0-9]{4}\d{7}([A-Z0-9]?){0,16}\b/g,
+  api_key: /\b(?:sk_(?:live|test)_[0-9a-zA-Z_]{16,}|ghp_[0-9a-zA-Z_]{20,}|AKIA[0-9A-Z]{16})\b/g,
+  jwt: /\beyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g,
+  passport: /\b[A-Z]{1,2}[0-9]{6,9}\b/g
+};
+var PII_PATTERN_PRIORITY = {
+  api_key: 1,
+  jwt: 2,
+  iban: 3,
+  credit_card: 4,
+  ipv6: 5,
+  ipv4: 6,
+  email: 7,
+  passport: 8,
+  ssn: 9,
+  phone: 10,
+  phone_number: 10,
+  phoneNumber: 10
+};
+function maskTextPII(text, piiConfig) {
+  if (!text || typeof text !== "string") return text;
+  if (!piiConfig || piiConfig.enabled === false) return text;
+  let result = text;
+  const strategy = piiConfig.strategy || "mask";
+  const rawPatterns = piiConfig.patterns || [
+    "email",
+    "phone",
+    "phone_number",
+    "phoneNumber",
+    "ssn",
+    "credit_card",
+    "ipv4"
+  ];
+  const patterns = [...rawPatterns].sort(
+    (a, b) => (PII_PATTERN_PRIORITY[a] ?? 99) - (PII_PATTERN_PRIORITY[b] ?? 99)
+  );
+  for (const patternName of patterns) {
+    const regex = PII_REGEX_PATTERNS[patternName];
+    if (!regex) continue;
+    result = result.replace(regex, (match) => {
+      switch (patternName) {
+        case "email":
+          return maskEmail(match, strategy);
+        case "phone":
+        case "phone_number":
+        case "phoneNumber":
+          return maskPhone(match, strategy);
+        case "credit_card":
+          return strategy === "token" ? "[REDACTED_CREDIT_CARD]" : "****-****-****-" + match.replace(/\D/g, "").slice(-4);
+        case "ssn":
+          return strategy === "token" ? "[REDACTED_SSN]" : "***-**-" + match.replace(/\D/g, "").slice(-4);
+        case "ipv4":
+          return "[REDACTED_IP]";
+        case "ipv6":
+          return "[REDACTED_IPV6]";
+        case "iban":
+          return strategy === "token" ? "[REDACTED_IBAN]" : "****-****-" + match.replace(/\s/g, "").slice(-4);
+        case "api_key":
+          return "[REDACTED_API_KEY]";
+        case "jwt":
+          return "[REDACTED_JWT]";
+        case "passport":
+          return strategy === "token" ? "[REDACTED_PASSPORT]" : "***" + match.slice(-3);
+        default:
+          return "[REDACTED]";
+      }
+    });
+  }
+  if (typeof piiConfig.customScrubber === "function") {
+    result = piiConfig.customScrubber(result);
+  }
+  return result;
+}
+function sanitizeDocForAI(options) {
+  const { doc, collectionConfig, globalAIConfig } = options;
+  if (!doc || typeof doc !== "object") return doc;
+  const copy = { ...doc };
+  for (const cred of NON_NEGOTIABLE_CREDENTIAL_FIELDS) {
+    delete copy[cred];
+  }
+  if (collectionConfig?.ai?.excludeFields) {
+    for (const field of collectionConfig.ai.excludeFields) {
+      delete copy[field];
+    }
+  }
+  const fields = collectionConfig?.fields || [];
+  for (const field of fields) {
+    const fieldName = field.name;
+    if (!fieldName || copy[fieldName] === void 0) continue;
+    if (field.ai?.exclude === true) {
+      delete copy[fieldName];
+      continue;
+    }
+    const val = copy[fieldName];
+    const normalizedName = fieldName.toLowerCase().replace(/[_\s-]/g, "");
+    const isEmail = field.type === "email" || normalizedName.includes("email");
+    const isPhone = field.type === "phone" || normalizedName.includes("phone") || normalizedName === "tel" || normalizedName === "telephone" || normalizedName === "mobile" || normalizedName === "cell";
+    if (isEmail) {
+      if (globalAIConfig?.pii?.enabled !== false && field.ai?.allowRaw !== true && typeof val === "string") {
+        copy[fieldName] = maskEmail(val, globalAIConfig?.pii?.strategy);
+      }
+      continue;
+    }
+    if (isPhone) {
+      if (globalAIConfig?.pii?.enabled !== false && field.ai?.allowRaw !== true && typeof val === "string") {
+        copy[fieldName] = maskPhone(val, globalAIConfig?.pii?.strategy);
+      }
+      continue;
+    }
+    if (field.ai?.redact === true || field.ai?.redact === "mask") {
+      if (typeof val === "string") {
+        copy[fieldName] = "[REDACTED]";
+      }
+    }
+  }
+  if (collectionConfig?.ai?.redactFields) {
+    for (const field of collectionConfig.ai.redactFields) {
+      if (copy[field] !== void 0) {
+        const val = copy[field];
+        if (typeof val === "string") {
+          if (field.toLowerCase().includes("email")) {
+            copy[field] = maskEmail(val, globalAIConfig?.pii?.strategy);
+          } else if (field.toLowerCase().includes("phone")) {
+            copy[field] = maskPhone(val, globalAIConfig?.pii?.strategy);
+          } else {
+            copy[field] = "[REDACTED]";
+          }
+        }
+      }
+    }
+  }
+  let result = copy;
+  if (typeof collectionConfig?.ai?.sanitizeDoc === "function") {
+    result = collectionConfig.ai.sanitizeDoc(copy);
+  }
+  if (globalAIConfig?.pii?.enabled === true) {
+    for (const [k, v] of Object.entries(result)) {
+      if (typeof v === "string") {
+        result[k] = maskTextPII(v, globalAIConfig.pii);
+      }
+    }
+  }
+  return result;
+}
+
 // src/index.ts
+var import_zod = require("zod");
 function defineCollection(config) {
   return config;
 }
@@ -6545,12 +6519,20 @@ function defineTab(args) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AI_ACTIONS_COLLECTION,
+  AI_AUDIT_COLLECTION,
+  AI_CHUNKS_COLLECTION,
+  AI_MESSAGES_COLLECTION,
+  AI_THREADS_COLLECTION,
   BUILTIN_JEXL_HELPERS,
   ConfigValidationError,
+  DyrectedAIError,
   FieldConditionBuilder,
   LIFECYCLE_EVENTS_COLLECTION,
   LIFECYCLE_EVENT_NAMES,
   MatchBuilder,
+  NON_NEGOTIABLE_CREDENTIAL_FIELDS,
+  PII_REGEX_PATTERNS,
   WORKFLOW_HISTORY_COLLECTION,
   abs,
   addDays,
@@ -6638,18 +6620,26 @@ function defineTab(args) {
   generateOpenApi,
   get,
   getAdminAuthCollection,
+  getAdminRoleForCollection,
+  getAllowedSitesForUser,
   getPublicAdminAuthConfig,
   includes,
   initializeWorkflowDocument,
+  isAICollection,
   isConfigValidationError,
   isDetailItemVisible,
   isEmpty,
   isFuture,
   isPast,
+  isSiteAuthorized,
+  isUserAdmin,
   join,
   last,
   length,
   lower,
+  maskEmail,
+  maskPhone,
+  maskTextPII,
   materializeWorkflowDocument,
   max,
   min,
@@ -6667,8 +6657,10 @@ function defineTab(args) {
   registerJexlHelpers,
   replace,
   resolveAdminAuthCollection,
+  resolveAuthorizedSiteId,
   round,
   runCollectionHooks,
+  sanitizeDocForAI,
   saveWorkflowDraft,
   simplePublishingWorkflow,
   slugify,
@@ -6687,5 +6679,6 @@ function defineTab(args) {
   validatePreviewUrlExpression,
   when,
   wordCount,
-  workflowCapabilities
+  workflowCapabilities,
+  z
 });