@dyrected/core 2.13.0 → 2.13.1

package/LICENSE.md

@@ -0,0 +1,50 @@
+Business Source License 1.1
+
+Parameters
+
+Licensor: Dyrected
+Licensed Work: Dyrected
+Additional Use Grant: Production use and commercial use of the Licensed Work are permitted for your own internal business operations, your own websites and applications, and client websites or applications that you build or deploy on behalf of a client, provided that you do not, without a separate commercial license from the Licensor, (a) provide the Licensed Work as a hosted or managed service to third parties, (b) embed, white-label, sublicense, or otherwise redistribute the Licensed Work as part of a multi-tenant or customer-facing SaaS, platform, or developer service, or (c) enable third parties to create, manage, or operate independent projects, sites, workspaces, or environments using the Licensed Work as a material part of the service you provide.
+Change Date: 2030-05-18
+Change License: Apache License 2.0
+
+---
+
+Business Source License 1.1
+
+License text copyright © 2024 MariaDB plc, All Rights Reserved.
+“Business Source License” is a trademark of MariaDB plc.
+
+### Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative works, redistribute, and make non-production use of the Licensed Work. The Licensor may make an Additional Use Grant, above, permitting limited production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly available distribution of a specific version of the Licensed Work under this License, whichever comes first, the Licensor hereby grants you rights under the terms of the Change License, and the rights granted in the paragraph above terminate.
+
+If your use of the Licensed Work does not comply with the requirements currently in effect as described in this License, you must purchase a commercial license from the Licensor, its affiliated entities, or authorized resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works of the Licensed Work, are subject to this License. This License applies separately for each version of the Licensed Work and the Change Date may vary for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy of the Licensed Work. If you receive the Licensed Work in original or modified form from a third party, the terms and conditions set forth in this License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically terminate your rights under this License for the current and all other versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of Licensor or its affiliates (provided that you may use a trademark or logo of Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS, EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND TITLE.
+
+MariaDB hereby grants you permission to use this License’s text to license your works, and to refer to it using the trademark “Business Source License”, as long as you comply with the Covenants of Licensor below.
+
+### Covenants of Licensor
+
+In consideration of the right to use this License’s text and the “Business Source License” name and trademark, Licensor covenants to MariaDB, and to all other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version, or a license that is compatible with GPL Version 2.0 or a later version, where “compatible” means that software provided under the Change License can be included in a program with software provided under GPL Version 2.0 or a later version. Licensor may specify additional Change Licenses without limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not impose any additional restriction on the right granted in this License, as the Additional Use Grant; or (b) insert the text “None”.
+
+3. Not to modify this License in any other way.
+
+---
+
+The Business Source License (this document, or the “License”) is not an Open Source license. However, the Licensed Work will eventually be made available under an Open Source License, as stated in this License.

package/dist/{app-D_ODsBWA.d.cts → app-De-3eNn1.d.cts}

@@ -1693,6 +1693,12 @@ interface AuthConfig {
      * Defaults to `10 * 60 * 1000` (10 minutes).
      */
     lockTime?: number;
+    /**
+     * The role name designated as the superuser/admin role for this collection.
+     *
+     * Defaults to `'admin'`.
+     */
+    adminRole?: string;
 }
 /**
  * Use this contract when you want the exact shape of a collection config.

package/dist/{app-D_ODsBWA.d.ts → app-De-3eNn1.d.ts}

@@ -1693,6 +1693,12 @@ interface AuthConfig {
      * Defaults to `10 * 60 * 1000` (10 minutes).
      */
     lockTime?: number;
+    /**
+     * The role name designated as the superuser/admin role for this collection.
+     *
+     * Defaults to `'admin'`.
+     */
+    adminRole?: string;
 }
 /**
  * Use this contract when you want the exact shape of a collection config.

package/dist/{chunk-DZMBVIMN.js → chunk-LYENW2EN.js}

@@ -492,6 +492,19 @@ function humanizeProviderName(id, type) {
   if (!cleaned) return type.toUpperCase();
   return cleaned.replace(/\b\w/g, (char) => char.toUpperCase());
 }
+function getAdminRoleForCollection(collection) {
+  if (!collection?.auth) return "admin";
+  if (typeof collection.auth === "object" && collection.auth.adminRole) {
+    return collection.auth.adminRole;
+  }
+  return "admin";
+}
+function isUserAdmin(user, collection) {
+  if (!user || !Array.isArray(user.roles)) return false;
+  const configuredRole = getAdminRoleForCollection(collection);
+  if (user.roles.includes(configuredRole)) return true;
+  return user.roles.includes("admin") || user.roles.includes("super_admin");
+}
 
 // src/utils/jexl-helpers.ts
 var import_jexl = __toESM(require_Jexl(), 1);
@@ -3821,6 +3834,8 @@ export {
   getAdminAuthCollection,
   resolveAdminAuthCollection,
   getPublicAdminAuthConfig,
+  getAdminRoleForCollection,
+  isUserAdmin,
   mergeDynamicConfig,
   slugify,
   lower,

package/dist/index.cjs

@@ -1885,6 +1885,7 @@ __export(index_exports, {
   generateOpenApi: () => generateOpenApi,
   get: () => get,
   getAdminAuthCollection: () => getAdminAuthCollection,
+  getAdminRoleForCollection: () => getAdminRoleForCollection,
   getAllowedSitesForUser: () => getAllowedSitesForUser,
   getPublicAdminAuthConfig: () => getPublicAdminAuthConfig,
   includes: () => includes,
@@ -1896,6 +1897,7 @@ __export(index_exports, {
   isFuture: () => isFuture,
   isPast: () => isPast,
   isSiteAuthorized: () => isSiteAuthorized,
+  isUserAdmin: () => isUserAdmin,
   join: () => join,
   last: () => last,
   length: () => length,
@@ -2466,6 +2468,19 @@ function humanizeProviderName(id, type) {
   if (!cleaned) return type.toUpperCase();
   return cleaned.replace(/\b\w/g, (char) => char.toUpperCase());
 }
+function getAdminRoleForCollection(collection) {
+  if (!collection?.auth) return "admin";
+  if (typeof collection.auth === "object" && collection.auth.adminRole) {
+    return collection.auth.adminRole;
+  }
+  return "admin";
+}
+function isUserAdmin(user, collection) {
+  if (!user || !Array.isArray(user.roles)) return false;
+  const configuredRole = getAdminRoleForCollection(collection);
+  if (user.roles.includes(configuredRole)) return true;
+  return user.roles.includes("admin") || user.roles.includes("super_admin");
+}
 
 // src/utils/block-references.ts
 function mergeUniqueBlocks(blocks) {
@@ -6605,6 +6620,7 @@ function defineTab(args) {
   generateOpenApi,
   get,
   getAdminAuthCollection,
+  getAdminRoleForCollection,
   getAllowedSitesForUser,
   getPublicAdminAuthConfig,
   includes,
@@ -6616,6 +6632,7 @@ function defineTab(args) {
   isFuture,
   isPast,
   isSiteAuthorized,
+  isUserAdmin,
   join,
   last,
   length,

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, G as GlobalConfig, a as DeclarativeHookExpression, W as WorkflowConfig, b as AuthenticatedUser, c as WorkflowTransition, L as LifecycleEventName, d as LifecycleEvent, e as BaseDocument, H as HookRequestContext, f as DetailComputedOptions, g as ComputedHandler, h as DetailComputed, i as DetailCustomOptions, j as DetailCustom, k as DetailDividerOptions, l as DetailDivider, m as DisplayFieldOptions, n as DetailField, o as DetailItem, p as DetailGridOptions, q as DetailGrid, r as DetailRepeatOptions, s as DetailRepeat, t as DetailSectionOptions, u as DetailSection, v as DetailTabOptions, w as DetailTab, x as DetailTabsOptions, y as DetailTabs, z as DetailTextOptions, E as DetailText, I as DetailSchema, J as DyrectedContext, K as AIConfig, M as AIPIIConfig, N as ArrayField, O as BlocksField, Q as BooleanField, R as AuthConfig, S as AccessPolicyResolver, T as DateField, U as DateTimeField, V as EmailField, X as IconField, Y as ImageField, Z as JoinField, _ as JsonField, $ as MultiSelectField, a0 as NumberField, a1 as ObjectField, a2 as RadioField, a3 as RelationshipField, a4 as RichTextField, a5 as RowField, a6 as SelectField, a7 as TextField, a8 as TextareaField, a9 as TimeField, aa as UrlField } from './app-D_ODsBWA.cjs';
-export { ab as AIAction, ac as AIActionStatus, ad as AIActionType, ae as AIAuditActionType, af as AIAuditRecord, ag as AIChunk, ah as AIMessage, ai as AIPIIPattern, aj as AIRateLimitResult, ak as AIRateLimitStore, al as AIThread, am as AIToolContext, an as AIToolDefinition, ao as AI_ACTIONS_COLLECTION, ap as AI_AUDIT_COLLECTION, aq as AI_CHUNKS_COLLECTION, ar as AI_MESSAGES_COLLECTION, as as AI_THREADS_COLLECTION, at as AccessConfig, au as AccessFunction, av as AccessFunctionArgs, aw as AccessResult, ax as AccessRule, ay as ActionConfig, az as ActionContext, aA as ActionType, aB as AdminAuthAccessResolution, aC as AdminAuthClaimMapping, aD as AdminAuthMember, aE as AdminAuthProvider, aF as AdminAuthProviderMembersConfig, aG as AdminAuthProvisioningMode, aH as AdminAuthResolveAccessArgs, aI as AdminAuthResolvedIdentity, aJ as AdminConfig, aK as AdminDashboardComponentSlots, aL as AdminIconName, aM as AggregateArgs, aN as AggregateCastType, aO as AggregateCollectionResult, aP as AggregateInput, aQ as AggregateOperation, aR as AggregateResult, aS as BaseAdminAuthProvider, aT as BaseFieldAdmin, aU as BlockVariant, aV as BooleanFieldAdmin, aW as BooleanFormat, aX as CharacterLimitFieldAdmin, aY as CharacterLimitFieldConfig, aZ as CollectionAfterChangeHook, a_ as CollectionAfterDeleteHook, a$ as CollectionAfterReadHook, b0 as CollectionAfterReadHookEntry, b1 as CollectionAfterTransitionHook, b2 as CollectionBeforeChangeHook, b3 as CollectionBeforeChangeHookEntry, b4 as CollectionBeforeDeleteHook, b5 as CollectionBeforeReadHook, b6 as CollectionBeforeReadHookEntry, b7 as CollectionBeforeTransitionHook, b8 as CollectionListComponentSlots, b9 as CollectionRAGConfig, ba as CollectionSchemaResult, bb as CollectionSummaryResult, bc as CollectionViewComponentSlots, bd as CountOperation, be as CustomAdminAuthProvider, bf as DatabaseAdapter, bg as DateFieldAdmin, bh as DateFormat, bi as DefineActionOptions, bj as DefineViewOptions, bk as DetailSpan, bl as DisplayTone, bm as DisplayVariant, bn as DistinctCountOperation, bo as DistinctValuesOperation, bp as DynamicOptionItem, bq as DynamicOptionsConfig, br as DynamicOptionsResolver, bs as DynamicOptionsResolverArgs, bt as DyrectedAIContext, bu as DyrectedLoggerConfig, bv as DyrectedObservabilityConfig, bw as EmailFieldAdmin, bx as FieldAdminHooks, by as FieldAdminOnChangeHook, bz as FieldAdminOnChangeHookArgs, bA as FieldAdminOptionsHook, bB as FieldAdminOptionsHookArgs, bC as FieldAdminOptionsHookResult, bD as FieldAfterReadHook, bE as FieldAfterReadHookArgs, bF as FieldBase, bG as FieldBeforeChangeHook, bH as FieldBeforeChangeHookArgs, bI as FieldHook, bJ as FieldHooks, bK as FieldType, bL as FileData, bM as GetDocumentResult, bN as GlobalAfterChangeHook, bO as GlobalAfterReadHook, bP as GlobalAfterReadHookEntry, bQ as GlobalBeforeChangeHook, bR as GlobalBeforeChangeHookEntry, bS as GlobalBeforeReadHook, bT as GlobalBeforeReadHookEntry, bU as GlobalRAGConfig, bV as GlobalSchemaResult, bW as GlobalSummaryResult, bX as HeadingLevel, bY as HookFunction, bZ as IconFieldAdmin, b_ as ImageService, b$ as ImageTransformOptions, c0 as InferAggregateResult, c1 as JoinFieldAdmin, c2 as JsonFieldAdmin, c3 as JsonFormat, c4 as LIFECYCLE_EVENT_NAMES, c5 as LifecycleEventHandler, c6 as LinkFormat, c7 as MetricColor, c8 as MultiSelectFieldAdmin, c9 as NamedAccessPolicy, ca as NumberFieldAdmin, cb as NumberFormat, cc as NumberLimitFieldAdmin, cd as NumberLimitFieldConfig, ce as NumericOperation, cf as OIDCAdminAuthProvider, cg as OptionFormat, ch as PaginatedResult, ci as PublicAdminAuthProvider, cj as QueryCollectionResult, ck as RAGSearchResult, cl as RadioFieldAdmin, cm as RateLimitConfig, cn as ReadonlyDatabaseAdapter, co as RichTextFeature, cp as RichTextFieldConfig, cq as SelectFieldAdmin, cr as SqlWhereResult, cs as StorageAdapter, ct as TextFieldAdmin, cu as TextFormat, cv as TextareaFieldAdmin, cw as TrustProxyConfig, cx as TypedField, cy as UploadConfig, cz as UrlFieldAdmin, cA as UrlLinkValue, cB as ViewActionFeatures, cC as ViewComponentSlots, cD as ViewConfig, cE as ViewLayout, cF as ViewMetric, cG as ViewSubMetric, cH as WhereClause, cI as WhereOperator, cJ as WhereOperatorName, cK as WordLimitFieldAdmin, cL as WordLimitFieldConfig, cM as WorkflowMetadata, cN as WorkflowRole, cO as WorkflowState, cP as WorkflowTransitionContext, cQ as defineAction, cR as defineView, cS as isAICollection, cT as parseMongoWhere, cU as parseSqlWhere } from './app-D_ODsBWA.cjs';
+import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, G as GlobalConfig, a as DeclarativeHookExpression, W as WorkflowConfig, b as AuthenticatedUser, c as WorkflowTransition, L as LifecycleEventName, d as LifecycleEvent, e as BaseDocument, H as HookRequestContext, f as DetailComputedOptions, g as ComputedHandler, h as DetailComputed, i as DetailCustomOptions, j as DetailCustom, k as DetailDividerOptions, l as DetailDivider, m as DisplayFieldOptions, n as DetailField, o as DetailItem, p as DetailGridOptions, q as DetailGrid, r as DetailRepeatOptions, s as DetailRepeat, t as DetailSectionOptions, u as DetailSection, v as DetailTabOptions, w as DetailTab, x as DetailTabsOptions, y as DetailTabs, z as DetailTextOptions, E as DetailText, I as DetailSchema, J as DyrectedContext, K as AIConfig, M as AIPIIConfig, N as ArrayField, O as BlocksField, Q as BooleanField, R as AuthConfig, S as AccessPolicyResolver, T as DateField, U as DateTimeField, V as EmailField, X as IconField, Y as ImageField, Z as JoinField, _ as JsonField, $ as MultiSelectField, a0 as NumberField, a1 as ObjectField, a2 as RadioField, a3 as RelationshipField, a4 as RichTextField, a5 as RowField, a6 as SelectField, a7 as TextField, a8 as TextareaField, a9 as TimeField, aa as UrlField } from './app-De-3eNn1.cjs';
+export { ab as AIAction, ac as AIActionStatus, ad as AIActionType, ae as AIAuditActionType, af as AIAuditRecord, ag as AIChunk, ah as AIMessage, ai as AIPIIPattern, aj as AIRateLimitResult, ak as AIRateLimitStore, al as AIThread, am as AIToolContext, an as AIToolDefinition, ao as AI_ACTIONS_COLLECTION, ap as AI_AUDIT_COLLECTION, aq as AI_CHUNKS_COLLECTION, ar as AI_MESSAGES_COLLECTION, as as AI_THREADS_COLLECTION, at as AccessConfig, au as AccessFunction, av as AccessFunctionArgs, aw as AccessResult, ax as AccessRule, ay as ActionConfig, az as ActionContext, aA as ActionType, aB as AdminAuthAccessResolution, aC as AdminAuthClaimMapping, aD as AdminAuthMember, aE as AdminAuthProvider, aF as AdminAuthProviderMembersConfig, aG as AdminAuthProvisioningMode, aH as AdminAuthResolveAccessArgs, aI as AdminAuthResolvedIdentity, aJ as AdminConfig, aK as AdminDashboardComponentSlots, aL as AdminIconName, aM as AggregateArgs, aN as AggregateCastType, aO as AggregateCollectionResult, aP as AggregateInput, aQ as AggregateOperation, aR as AggregateResult, aS as BaseAdminAuthProvider, aT as BaseFieldAdmin, aU as BlockVariant, aV as BooleanFieldAdmin, aW as BooleanFormat, aX as CharacterLimitFieldAdmin, aY as CharacterLimitFieldConfig, aZ as CollectionAfterChangeHook, a_ as CollectionAfterDeleteHook, a$ as CollectionAfterReadHook, b0 as CollectionAfterReadHookEntry, b1 as CollectionAfterTransitionHook, b2 as CollectionBeforeChangeHook, b3 as CollectionBeforeChangeHookEntry, b4 as CollectionBeforeDeleteHook, b5 as CollectionBeforeReadHook, b6 as CollectionBeforeReadHookEntry, b7 as CollectionBeforeTransitionHook, b8 as CollectionListComponentSlots, b9 as CollectionRAGConfig, ba as CollectionSchemaResult, bb as CollectionSummaryResult, bc as CollectionViewComponentSlots, bd as CountOperation, be as CustomAdminAuthProvider, bf as DatabaseAdapter, bg as DateFieldAdmin, bh as DateFormat, bi as DefineActionOptions, bj as DefineViewOptions, bk as DetailSpan, bl as DisplayTone, bm as DisplayVariant, bn as DistinctCountOperation, bo as DistinctValuesOperation, bp as DynamicOptionItem, bq as DynamicOptionsConfig, br as DynamicOptionsResolver, bs as DynamicOptionsResolverArgs, bt as DyrectedAIContext, bu as DyrectedLoggerConfig, bv as DyrectedObservabilityConfig, bw as EmailFieldAdmin, bx as FieldAdminHooks, by as FieldAdminOnChangeHook, bz as FieldAdminOnChangeHookArgs, bA as FieldAdminOptionsHook, bB as FieldAdminOptionsHookArgs, bC as FieldAdminOptionsHookResult, bD as FieldAfterReadHook, bE as FieldAfterReadHookArgs, bF as FieldBase, bG as FieldBeforeChangeHook, bH as FieldBeforeChangeHookArgs, bI as FieldHook, bJ as FieldHooks, bK as FieldType, bL as FileData, bM as GetDocumentResult, bN as GlobalAfterChangeHook, bO as GlobalAfterReadHook, bP as GlobalAfterReadHookEntry, bQ as GlobalBeforeChangeHook, bR as GlobalBeforeChangeHookEntry, bS as GlobalBeforeReadHook, bT as GlobalBeforeReadHookEntry, bU as GlobalRAGConfig, bV as GlobalSchemaResult, bW as GlobalSummaryResult, bX as HeadingLevel, bY as HookFunction, bZ as IconFieldAdmin, b_ as ImageService, b$ as ImageTransformOptions, c0 as InferAggregateResult, c1 as JoinFieldAdmin, c2 as JsonFieldAdmin, c3 as JsonFormat, c4 as LIFECYCLE_EVENT_NAMES, c5 as LifecycleEventHandler, c6 as LinkFormat, c7 as MetricColor, c8 as MultiSelectFieldAdmin, c9 as NamedAccessPolicy, ca as NumberFieldAdmin, cb as NumberFormat, cc as NumberLimitFieldAdmin, cd as NumberLimitFieldConfig, ce as NumericOperation, cf as OIDCAdminAuthProvider, cg as OptionFormat, ch as PaginatedResult, ci as PublicAdminAuthProvider, cj as QueryCollectionResult, ck as RAGSearchResult, cl as RadioFieldAdmin, cm as RateLimitConfig, cn as ReadonlyDatabaseAdapter, co as RichTextFeature, cp as RichTextFieldConfig, cq as SelectFieldAdmin, cr as SqlWhereResult, cs as StorageAdapter, ct as TextFieldAdmin, cu as TextFormat, cv as TextareaFieldAdmin, cw as TrustProxyConfig, cx as TypedField, cy as UploadConfig, cz as UrlFieldAdmin, cA as UrlLinkValue, cB as ViewActionFeatures, cC as ViewComponentSlots, cD as ViewConfig, cE as ViewLayout, cF as ViewMetric, cG as ViewSubMetric, cH as WhereClause, cI as WhereOperator, cJ as WhereOperatorName, cK as WordLimitFieldAdmin, cL as WordLimitFieldConfig, cM as WorkflowMetadata, cN as WorkflowRole, cO as WorkflowState, cP as WorkflowTransitionContext, cQ as defineAction, cR as defineView, cS as isAICollection, cT as parseMongoWhere, cU as parseSqlWhere } from './app-De-3eNn1.cjs';
 import jexl from 'jexl';
 import { Context } from 'hono';
 export { z } from 'zod';
@@ -106,6 +106,17 @@ declare function normalizeConfig(config: DyrectedConfig): DyrectedConfig;
 declare function getAdminAuthCollection(config: Pick<DyrectedConfig, "collections" | "adminAuth">): CollectionConfig | null;
 declare function resolveAdminAuthCollection(collections: CollectionConfig[], collectionSlug?: string): CollectionConfig | undefined;
 declare function getPublicAdminAuthConfig(adminAuth?: AdminAuthConfig, collections?: CollectionConfig[]): PublicAdminAuthConfig;
+/**
+ * Resolves the configured admin role for a collection or returns "admin" as default.
+ */
+declare function getAdminRoleForCollection(collection?: CollectionConfig | null): string;
+/**
+ * Checks whether a user possesses an administrative role.
+ * Considers:
+ * 1. The collection's configured `adminRole` (e.g. 'super_admin')
+ * 2. Standard admin roles ('admin', 'super_admin')
+ */
+declare function isUserAdmin(user: any, collection?: CollectionConfig | null): boolean;
 
 type SortDirection = 'ASC' | 'DESC';
 interface SortClause {
@@ -1638,4 +1649,4 @@ declare function defineTab<const T extends readonly Field[]>(args: {
     fields: T;
 }): T;
 
-export { AIConfig, type AIErrorCode, AIPIIConfig, type AccessConditions, AccessPolicyResolver, AdminAuthConfig, ArrayField, AuthConfig, type AuthDocFields, AuthenticatedUser, BUILTIN_JEXL_HELPERS, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, ComputedHandler, type ConfigDiagnostic, ConfigValidationError, DateField, DateTimeField, type DeclarativeAccessSurface, type DeclarativeAccessValidationIssue, type DeclarativeAdminSurface, type DeclarativeAdminValidationIssue, DeclarativeHookExpression, type DeclarativeHookSurface, type DeclarativeHookValidationIssue, type DeclarativePreviewSurface, type DeclarativePreviewValidationIssue, DetailComputed, DetailComputedOptions, DetailCustom, DetailCustomOptions, DetailDivider, DetailDividerOptions, DetailField, DetailGrid, DetailGridOptions, DetailItem, DetailRepeat, DetailRepeatOptions, DetailSchema, DetailSection, DetailSectionOptions, DetailTab, DetailTabOptions, DetailTabs, DetailTabsOptions, DetailText, DetailTextOptions, DisplayFieldOptions, DyrectedAIError, DyrectedConfig, EmailField, type ExprFunction, Field, FieldConditionBuilder, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MatchBuilder, MultiSelectField, NON_NEGOTIABLE_CREDENTIAL_FIELDS, NumberField, ObjectField, PII_REGEX_PATTERNS, type Prettify, PublicAdminAuthConfig, type PublishingWorkflowOptions, RadioField, RelationshipField, RichTextField, RowField, type SanitizeDocForAIOptions, SelectField, type SortClause, type SortDirection, type SqlSortDialect, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhenFunction, WorkflowConfig, WorkflowTransition, abs, addDays, assertValidAdminConditionsInConfig, assertValidDeclarativeAccessInConfig, assertValidDeclarativeHookExpression, assertValidDeclarativeHookResult, assertValidDeclarativeHooksInConfig, assertValidPreviewUrlsInConfig, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, capitalize, ceil, clamp, coalesce, collectAdminConditionValidationIssues, collectConfigDiagnostics, collectDeclarativeAccessValidationIssues, collectDeclarativeHookValidationIssues, collectPreviewUrlValidationIssues, compact, count, createLifecycleEvent, createWorkflowDocument, defaultValue, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, definePublishingWorkflow, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, diffDays, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, displayComputed, displayCustom, displayCustomComponent, displayDivider, displayField, displayGrid, displayRepeat, displaySection, displayTab, displayTabs, displayText, endsWith, evaluateDetailComputed, evaluateJexl, evaluateJexlSync, executeFieldAfterRead, executeFieldBeforeChange, expr, first, floor, formatConfigDiagnostics, formatDate, formatJexlValue, generateDefaultDetailSchema, generateOpenApi, get, getAdminAuthCollection, getAllowedSitesForUser, getPublicAdminAuthConfig, includes, initializeWorkflowDocument, isConfigValidationError, isDetailItemVisible, isEmpty, isFuture, isPast, isSiteAuthorized, join, last, length, lower, maskEmail, maskPhone, maskTextPII, materializeWorkflowDocument, max, min, normalizeConfig, normalizeDetailItem, now, numericFieldNames, parseSort, pow, publishedStateName, publishingWorkflow, readingTime, registerJexlHelpers, replace, resolveAdminAuthCollection, resolveAuthorizedSiteId, round, runCollectionHooks, sanitizeDocForAI, saveWorkflowDraft, simplePublishingWorkflow, slugify, sqrt, startsWith, sum, today, transitionWorkflow, trim, truncate, unique, upper, validateAdminConditionExpression, validateDeclarativeAccessExpression, validateDeclarativeHookExpression, validatePreviewUrlExpression, when, wordCount, workflowCapabilities };
+export { AIConfig, type AIErrorCode, AIPIIConfig, type AccessConditions, AccessPolicyResolver, AdminAuthConfig, ArrayField, AuthConfig, type AuthDocFields, AuthenticatedUser, BUILTIN_JEXL_HELPERS, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, ComputedHandler, type ConfigDiagnostic, ConfigValidationError, DateField, DateTimeField, type DeclarativeAccessSurface, type DeclarativeAccessValidationIssue, type DeclarativeAdminSurface, type DeclarativeAdminValidationIssue, DeclarativeHookExpression, type DeclarativeHookSurface, type DeclarativeHookValidationIssue, type DeclarativePreviewSurface, type DeclarativePreviewValidationIssue, DetailComputed, DetailComputedOptions, DetailCustom, DetailCustomOptions, DetailDivider, DetailDividerOptions, DetailField, DetailGrid, DetailGridOptions, DetailItem, DetailRepeat, DetailRepeatOptions, DetailSchema, DetailSection, DetailSectionOptions, DetailTab, DetailTabOptions, DetailTabs, DetailTabsOptions, DetailText, DetailTextOptions, DisplayFieldOptions, DyrectedAIError, DyrectedConfig, EmailField, type ExprFunction, Field, FieldConditionBuilder, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MatchBuilder, MultiSelectField, NON_NEGOTIABLE_CREDENTIAL_FIELDS, NumberField, ObjectField, PII_REGEX_PATTERNS, type Prettify, PublicAdminAuthConfig, type PublishingWorkflowOptions, RadioField, RelationshipField, RichTextField, RowField, type SanitizeDocForAIOptions, SelectField, type SortClause, type SortDirection, type SqlSortDialect, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhenFunction, WorkflowConfig, WorkflowTransition, abs, addDays, assertValidAdminConditionsInConfig, assertValidDeclarativeAccessInConfig, assertValidDeclarativeHookExpression, assertValidDeclarativeHookResult, assertValidDeclarativeHooksInConfig, assertValidPreviewUrlsInConfig, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, capitalize, ceil, clamp, coalesce, collectAdminConditionValidationIssues, collectConfigDiagnostics, collectDeclarativeAccessValidationIssues, collectDeclarativeHookValidationIssues, collectPreviewUrlValidationIssues, compact, count, createLifecycleEvent, createWorkflowDocument, defaultValue, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, definePublishingWorkflow, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, diffDays, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, displayComputed, displayCustom, displayCustomComponent, displayDivider, displayField, displayGrid, displayRepeat, displaySection, displayTab, displayTabs, displayText, endsWith, evaluateDetailComputed, evaluateJexl, evaluateJexlSync, executeFieldAfterRead, executeFieldBeforeChange, expr, first, floor, formatConfigDiagnostics, formatDate, formatJexlValue, generateDefaultDetailSchema, generateOpenApi, get, getAdminAuthCollection, getAdminRoleForCollection, getAllowedSitesForUser, getPublicAdminAuthConfig, includes, initializeWorkflowDocument, isConfigValidationError, isDetailItemVisible, isEmpty, isFuture, isPast, isSiteAuthorized, isUserAdmin, join, last, length, lower, maskEmail, maskPhone, maskTextPII, materializeWorkflowDocument, max, min, normalizeConfig, normalizeDetailItem, now, numericFieldNames, parseSort, pow, publishedStateName, publishingWorkflow, readingTime, registerJexlHelpers, replace, resolveAdminAuthCollection, resolveAuthorizedSiteId, round, runCollectionHooks, sanitizeDocForAI, saveWorkflowDraft, simplePublishingWorkflow, slugify, sqrt, startsWith, sum, today, transitionWorkflow, trim, truncate, unique, upper, validateAdminConditionExpression, validateDeclarativeAccessExpression, validateDeclarativeHookExpression, validatePreviewUrlExpression, when, wordCount, workflowCapabilities };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, G as GlobalConfig, a as DeclarativeHookExpression, W as WorkflowConfig, b as AuthenticatedUser, c as WorkflowTransition, L as LifecycleEventName, d as LifecycleEvent, e as BaseDocument, H as HookRequestContext, f as DetailComputedOptions, g as ComputedHandler, h as DetailComputed, i as DetailCustomOptions, j as DetailCustom, k as DetailDividerOptions, l as DetailDivider, m as DisplayFieldOptions, n as DetailField, o as DetailItem, p as DetailGridOptions, q as DetailGrid, r as DetailRepeatOptions, s as DetailRepeat, t as DetailSectionOptions, u as DetailSection, v as DetailTabOptions, w as DetailTab, x as DetailTabsOptions, y as DetailTabs, z as DetailTextOptions, E as DetailText, I as DetailSchema, J as DyrectedContext, K as AIConfig, M as AIPIIConfig, N as ArrayField, O as BlocksField, Q as BooleanField, R as AuthConfig, S as AccessPolicyResolver, T as DateField, U as DateTimeField, V as EmailField, X as IconField, Y as ImageField, Z as JoinField, _ as JsonField, $ as MultiSelectField, a0 as NumberField, a1 as ObjectField, a2 as RadioField, a3 as RelationshipField, a4 as RichTextField, a5 as RowField, a6 as SelectField, a7 as TextField, a8 as TextareaField, a9 as TimeField, aa as UrlField } from './app-D_ODsBWA.js';
-export { ab as AIAction, ac as AIActionStatus, ad as AIActionType, ae as AIAuditActionType, af as AIAuditRecord, ag as AIChunk, ah as AIMessage, ai as AIPIIPattern, aj as AIRateLimitResult, ak as AIRateLimitStore, al as AIThread, am as AIToolContext, an as AIToolDefinition, ao as AI_ACTIONS_COLLECTION, ap as AI_AUDIT_COLLECTION, aq as AI_CHUNKS_COLLECTION, ar as AI_MESSAGES_COLLECTION, as as AI_THREADS_COLLECTION, at as AccessConfig, au as AccessFunction, av as AccessFunctionArgs, aw as AccessResult, ax as AccessRule, ay as ActionConfig, az as ActionContext, aA as ActionType, aB as AdminAuthAccessResolution, aC as AdminAuthClaimMapping, aD as AdminAuthMember, aE as AdminAuthProvider, aF as AdminAuthProviderMembersConfig, aG as AdminAuthProvisioningMode, aH as AdminAuthResolveAccessArgs, aI as AdminAuthResolvedIdentity, aJ as AdminConfig, aK as AdminDashboardComponentSlots, aL as AdminIconName, aM as AggregateArgs, aN as AggregateCastType, aO as AggregateCollectionResult, aP as AggregateInput, aQ as AggregateOperation, aR as AggregateResult, aS as BaseAdminAuthProvider, aT as BaseFieldAdmin, aU as BlockVariant, aV as BooleanFieldAdmin, aW as BooleanFormat, aX as CharacterLimitFieldAdmin, aY as CharacterLimitFieldConfig, aZ as CollectionAfterChangeHook, a_ as CollectionAfterDeleteHook, a$ as CollectionAfterReadHook, b0 as CollectionAfterReadHookEntry, b1 as CollectionAfterTransitionHook, b2 as CollectionBeforeChangeHook, b3 as CollectionBeforeChangeHookEntry, b4 as CollectionBeforeDeleteHook, b5 as CollectionBeforeReadHook, b6 as CollectionBeforeReadHookEntry, b7 as CollectionBeforeTransitionHook, b8 as CollectionListComponentSlots, b9 as CollectionRAGConfig, ba as CollectionSchemaResult, bb as CollectionSummaryResult, bc as CollectionViewComponentSlots, bd as CountOperation, be as CustomAdminAuthProvider, bf as DatabaseAdapter, bg as DateFieldAdmin, bh as DateFormat, bi as DefineActionOptions, bj as DefineViewOptions, bk as DetailSpan, bl as DisplayTone, bm as DisplayVariant, bn as DistinctCountOperation, bo as DistinctValuesOperation, bp as DynamicOptionItem, bq as DynamicOptionsConfig, br as DynamicOptionsResolver, bs as DynamicOptionsResolverArgs, bt as DyrectedAIContext, bu as DyrectedLoggerConfig, bv as DyrectedObservabilityConfig, bw as EmailFieldAdmin, bx as FieldAdminHooks, by as FieldAdminOnChangeHook, bz as FieldAdminOnChangeHookArgs, bA as FieldAdminOptionsHook, bB as FieldAdminOptionsHookArgs, bC as FieldAdminOptionsHookResult, bD as FieldAfterReadHook, bE as FieldAfterReadHookArgs, bF as FieldBase, bG as FieldBeforeChangeHook, bH as FieldBeforeChangeHookArgs, bI as FieldHook, bJ as FieldHooks, bK as FieldType, bL as FileData, bM as GetDocumentResult, bN as GlobalAfterChangeHook, bO as GlobalAfterReadHook, bP as GlobalAfterReadHookEntry, bQ as GlobalBeforeChangeHook, bR as GlobalBeforeChangeHookEntry, bS as GlobalBeforeReadHook, bT as GlobalBeforeReadHookEntry, bU as GlobalRAGConfig, bV as GlobalSchemaResult, bW as GlobalSummaryResult, bX as HeadingLevel, bY as HookFunction, bZ as IconFieldAdmin, b_ as ImageService, b$ as ImageTransformOptions, c0 as InferAggregateResult, c1 as JoinFieldAdmin, c2 as JsonFieldAdmin, c3 as JsonFormat, c4 as LIFECYCLE_EVENT_NAMES, c5 as LifecycleEventHandler, c6 as LinkFormat, c7 as MetricColor, c8 as MultiSelectFieldAdmin, c9 as NamedAccessPolicy, ca as NumberFieldAdmin, cb as NumberFormat, cc as NumberLimitFieldAdmin, cd as NumberLimitFieldConfig, ce as NumericOperation, cf as OIDCAdminAuthProvider, cg as OptionFormat, ch as PaginatedResult, ci as PublicAdminAuthProvider, cj as QueryCollectionResult, ck as RAGSearchResult, cl as RadioFieldAdmin, cm as RateLimitConfig, cn as ReadonlyDatabaseAdapter, co as RichTextFeature, cp as RichTextFieldConfig, cq as SelectFieldAdmin, cr as SqlWhereResult, cs as StorageAdapter, ct as TextFieldAdmin, cu as TextFormat, cv as TextareaFieldAdmin, cw as TrustProxyConfig, cx as TypedField, cy as UploadConfig, cz as UrlFieldAdmin, cA as UrlLinkValue, cB as ViewActionFeatures, cC as ViewComponentSlots, cD as ViewConfig, cE as ViewLayout, cF as ViewMetric, cG as ViewSubMetric, cH as WhereClause, cI as WhereOperator, cJ as WhereOperatorName, cK as WordLimitFieldAdmin, cL as WordLimitFieldConfig, cM as WorkflowMetadata, cN as WorkflowRole, cO as WorkflowState, cP as WorkflowTransitionContext, cQ as defineAction, cR as defineView, cS as isAICollection, cT as parseMongoWhere, cU as parseSqlWhere } from './app-D_ODsBWA.js';
+import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, G as GlobalConfig, a as DeclarativeHookExpression, W as WorkflowConfig, b as AuthenticatedUser, c as WorkflowTransition, L as LifecycleEventName, d as LifecycleEvent, e as BaseDocument, H as HookRequestContext, f as DetailComputedOptions, g as ComputedHandler, h as DetailComputed, i as DetailCustomOptions, j as DetailCustom, k as DetailDividerOptions, l as DetailDivider, m as DisplayFieldOptions, n as DetailField, o as DetailItem, p as DetailGridOptions, q as DetailGrid, r as DetailRepeatOptions, s as DetailRepeat, t as DetailSectionOptions, u as DetailSection, v as DetailTabOptions, w as DetailTab, x as DetailTabsOptions, y as DetailTabs, z as DetailTextOptions, E as DetailText, I as DetailSchema, J as DyrectedContext, K as AIConfig, M as AIPIIConfig, N as ArrayField, O as BlocksField, Q as BooleanField, R as AuthConfig, S as AccessPolicyResolver, T as DateField, U as DateTimeField, V as EmailField, X as IconField, Y as ImageField, Z as JoinField, _ as JsonField, $ as MultiSelectField, a0 as NumberField, a1 as ObjectField, a2 as RadioField, a3 as RelationshipField, a4 as RichTextField, a5 as RowField, a6 as SelectField, a7 as TextField, a8 as TextareaField, a9 as TimeField, aa as UrlField } from './app-De-3eNn1.js';
+export { ab as AIAction, ac as AIActionStatus, ad as AIActionType, ae as AIAuditActionType, af as AIAuditRecord, ag as AIChunk, ah as AIMessage, ai as AIPIIPattern, aj as AIRateLimitResult, ak as AIRateLimitStore, al as AIThread, am as AIToolContext, an as AIToolDefinition, ao as AI_ACTIONS_COLLECTION, ap as AI_AUDIT_COLLECTION, aq as AI_CHUNKS_COLLECTION, ar as AI_MESSAGES_COLLECTION, as as AI_THREADS_COLLECTION, at as AccessConfig, au as AccessFunction, av as AccessFunctionArgs, aw as AccessResult, ax as AccessRule, ay as ActionConfig, az as ActionContext, aA as ActionType, aB as AdminAuthAccessResolution, aC as AdminAuthClaimMapping, aD as AdminAuthMember, aE as AdminAuthProvider, aF as AdminAuthProviderMembersConfig, aG as AdminAuthProvisioningMode, aH as AdminAuthResolveAccessArgs, aI as AdminAuthResolvedIdentity, aJ as AdminConfig, aK as AdminDashboardComponentSlots, aL as AdminIconName, aM as AggregateArgs, aN as AggregateCastType, aO as AggregateCollectionResult, aP as AggregateInput, aQ as AggregateOperation, aR as AggregateResult, aS as BaseAdminAuthProvider, aT as BaseFieldAdmin, aU as BlockVariant, aV as BooleanFieldAdmin, aW as BooleanFormat, aX as CharacterLimitFieldAdmin, aY as CharacterLimitFieldConfig, aZ as CollectionAfterChangeHook, a_ as CollectionAfterDeleteHook, a$ as CollectionAfterReadHook, b0 as CollectionAfterReadHookEntry, b1 as CollectionAfterTransitionHook, b2 as CollectionBeforeChangeHook, b3 as CollectionBeforeChangeHookEntry, b4 as CollectionBeforeDeleteHook, b5 as CollectionBeforeReadHook, b6 as CollectionBeforeReadHookEntry, b7 as CollectionBeforeTransitionHook, b8 as CollectionListComponentSlots, b9 as CollectionRAGConfig, ba as CollectionSchemaResult, bb as CollectionSummaryResult, bc as CollectionViewComponentSlots, bd as CountOperation, be as CustomAdminAuthProvider, bf as DatabaseAdapter, bg as DateFieldAdmin, bh as DateFormat, bi as DefineActionOptions, bj as DefineViewOptions, bk as DetailSpan, bl as DisplayTone, bm as DisplayVariant, bn as DistinctCountOperation, bo as DistinctValuesOperation, bp as DynamicOptionItem, bq as DynamicOptionsConfig, br as DynamicOptionsResolver, bs as DynamicOptionsResolverArgs, bt as DyrectedAIContext, bu as DyrectedLoggerConfig, bv as DyrectedObservabilityConfig, bw as EmailFieldAdmin, bx as FieldAdminHooks, by as FieldAdminOnChangeHook, bz as FieldAdminOnChangeHookArgs, bA as FieldAdminOptionsHook, bB as FieldAdminOptionsHookArgs, bC as FieldAdminOptionsHookResult, bD as FieldAfterReadHook, bE as FieldAfterReadHookArgs, bF as FieldBase, bG as FieldBeforeChangeHook, bH as FieldBeforeChangeHookArgs, bI as FieldHook, bJ as FieldHooks, bK as FieldType, bL as FileData, bM as GetDocumentResult, bN as GlobalAfterChangeHook, bO as GlobalAfterReadHook, bP as GlobalAfterReadHookEntry, bQ as GlobalBeforeChangeHook, bR as GlobalBeforeChangeHookEntry, bS as GlobalBeforeReadHook, bT as GlobalBeforeReadHookEntry, bU as GlobalRAGConfig, bV as GlobalSchemaResult, bW as GlobalSummaryResult, bX as HeadingLevel, bY as HookFunction, bZ as IconFieldAdmin, b_ as ImageService, b$ as ImageTransformOptions, c0 as InferAggregateResult, c1 as JoinFieldAdmin, c2 as JsonFieldAdmin, c3 as JsonFormat, c4 as LIFECYCLE_EVENT_NAMES, c5 as LifecycleEventHandler, c6 as LinkFormat, c7 as MetricColor, c8 as MultiSelectFieldAdmin, c9 as NamedAccessPolicy, ca as NumberFieldAdmin, cb as NumberFormat, cc as NumberLimitFieldAdmin, cd as NumberLimitFieldConfig, ce as NumericOperation, cf as OIDCAdminAuthProvider, cg as OptionFormat, ch as PaginatedResult, ci as PublicAdminAuthProvider, cj as QueryCollectionResult, ck as RAGSearchResult, cl as RadioFieldAdmin, cm as RateLimitConfig, cn as ReadonlyDatabaseAdapter, co as RichTextFeature, cp as RichTextFieldConfig, cq as SelectFieldAdmin, cr as SqlWhereResult, cs as StorageAdapter, ct as TextFieldAdmin, cu as TextFormat, cv as TextareaFieldAdmin, cw as TrustProxyConfig, cx as TypedField, cy as UploadConfig, cz as UrlFieldAdmin, cA as UrlLinkValue, cB as ViewActionFeatures, cC as ViewComponentSlots, cD as ViewConfig, cE as ViewLayout, cF as ViewMetric, cG as ViewSubMetric, cH as WhereClause, cI as WhereOperator, cJ as WhereOperatorName, cK as WordLimitFieldAdmin, cL as WordLimitFieldConfig, cM as WorkflowMetadata, cN as WorkflowRole, cO as WorkflowState, cP as WorkflowTransitionContext, cQ as defineAction, cR as defineView, cS as isAICollection, cT as parseMongoWhere, cU as parseSqlWhere } from './app-De-3eNn1.js';
 import jexl from 'jexl';
 import { Context } from 'hono';
 export { z } from 'zod';
@@ -106,6 +106,17 @@ declare function normalizeConfig(config: DyrectedConfig): DyrectedConfig;
 declare function getAdminAuthCollection(config: Pick<DyrectedConfig, "collections" | "adminAuth">): CollectionConfig | null;
 declare function resolveAdminAuthCollection(collections: CollectionConfig[], collectionSlug?: string): CollectionConfig | undefined;
 declare function getPublicAdminAuthConfig(adminAuth?: AdminAuthConfig, collections?: CollectionConfig[]): PublicAdminAuthConfig;
+/**
+ * Resolves the configured admin role for a collection or returns "admin" as default.
+ */
+declare function getAdminRoleForCollection(collection?: CollectionConfig | null): string;
+/**
+ * Checks whether a user possesses an administrative role.
+ * Considers:
+ * 1. The collection's configured `adminRole` (e.g. 'super_admin')
+ * 2. Standard admin roles ('admin', 'super_admin')
+ */
+declare function isUserAdmin(user: any, collection?: CollectionConfig | null): boolean;
 
 type SortDirection = 'ASC' | 'DESC';
 interface SortClause {
@@ -1638,4 +1649,4 @@ declare function defineTab<const T extends readonly Field[]>(args: {
     fields: T;
 }): T;
 
-export { AIConfig, type AIErrorCode, AIPIIConfig, type AccessConditions, AccessPolicyResolver, AdminAuthConfig, ArrayField, AuthConfig, type AuthDocFields, AuthenticatedUser, BUILTIN_JEXL_HELPERS, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, ComputedHandler, type ConfigDiagnostic, ConfigValidationError, DateField, DateTimeField, type DeclarativeAccessSurface, type DeclarativeAccessValidationIssue, type DeclarativeAdminSurface, type DeclarativeAdminValidationIssue, DeclarativeHookExpression, type DeclarativeHookSurface, type DeclarativeHookValidationIssue, type DeclarativePreviewSurface, type DeclarativePreviewValidationIssue, DetailComputed, DetailComputedOptions, DetailCustom, DetailCustomOptions, DetailDivider, DetailDividerOptions, DetailField, DetailGrid, DetailGridOptions, DetailItem, DetailRepeat, DetailRepeatOptions, DetailSchema, DetailSection, DetailSectionOptions, DetailTab, DetailTabOptions, DetailTabs, DetailTabsOptions, DetailText, DetailTextOptions, DisplayFieldOptions, DyrectedAIError, DyrectedConfig, EmailField, type ExprFunction, Field, FieldConditionBuilder, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MatchBuilder, MultiSelectField, NON_NEGOTIABLE_CREDENTIAL_FIELDS, NumberField, ObjectField, PII_REGEX_PATTERNS, type Prettify, PublicAdminAuthConfig, type PublishingWorkflowOptions, RadioField, RelationshipField, RichTextField, RowField, type SanitizeDocForAIOptions, SelectField, type SortClause, type SortDirection, type SqlSortDialect, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhenFunction, WorkflowConfig, WorkflowTransition, abs, addDays, assertValidAdminConditionsInConfig, assertValidDeclarativeAccessInConfig, assertValidDeclarativeHookExpression, assertValidDeclarativeHookResult, assertValidDeclarativeHooksInConfig, assertValidPreviewUrlsInConfig, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, capitalize, ceil, clamp, coalesce, collectAdminConditionValidationIssues, collectConfigDiagnostics, collectDeclarativeAccessValidationIssues, collectDeclarativeHookValidationIssues, collectPreviewUrlValidationIssues, compact, count, createLifecycleEvent, createWorkflowDocument, defaultValue, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, definePublishingWorkflow, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, diffDays, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, displayComputed, displayCustom, displayCustomComponent, displayDivider, displayField, displayGrid, displayRepeat, displaySection, displayTab, displayTabs, displayText, endsWith, evaluateDetailComputed, evaluateJexl, evaluateJexlSync, executeFieldAfterRead, executeFieldBeforeChange, expr, first, floor, formatConfigDiagnostics, formatDate, formatJexlValue, generateDefaultDetailSchema, generateOpenApi, get, getAdminAuthCollection, getAllowedSitesForUser, getPublicAdminAuthConfig, includes, initializeWorkflowDocument, isConfigValidationError, isDetailItemVisible, isEmpty, isFuture, isPast, isSiteAuthorized, join, last, length, lower, maskEmail, maskPhone, maskTextPII, materializeWorkflowDocument, max, min, normalizeConfig, normalizeDetailItem, now, numericFieldNames, parseSort, pow, publishedStateName, publishingWorkflow, readingTime, registerJexlHelpers, replace, resolveAdminAuthCollection, resolveAuthorizedSiteId, round, runCollectionHooks, sanitizeDocForAI, saveWorkflowDraft, simplePublishingWorkflow, slugify, sqrt, startsWith, sum, today, transitionWorkflow, trim, truncate, unique, upper, validateAdminConditionExpression, validateDeclarativeAccessExpression, validateDeclarativeHookExpression, validatePreviewUrlExpression, when, wordCount, workflowCapabilities };
+export { AIConfig, type AIErrorCode, AIPIIConfig, type AccessConditions, AccessPolicyResolver, AdminAuthConfig, ArrayField, AuthConfig, type AuthDocFields, AuthenticatedUser, BUILTIN_JEXL_HELPERS, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, ComputedHandler, type ConfigDiagnostic, ConfigValidationError, DateField, DateTimeField, type DeclarativeAccessSurface, type DeclarativeAccessValidationIssue, type DeclarativeAdminSurface, type DeclarativeAdminValidationIssue, DeclarativeHookExpression, type DeclarativeHookSurface, type DeclarativeHookValidationIssue, type DeclarativePreviewSurface, type DeclarativePreviewValidationIssue, DetailComputed, DetailComputedOptions, DetailCustom, DetailCustomOptions, DetailDivider, DetailDividerOptions, DetailField, DetailGrid, DetailGridOptions, DetailItem, DetailRepeat, DetailRepeatOptions, DetailSchema, DetailSection, DetailSectionOptions, DetailTab, DetailTabOptions, DetailTabs, DetailTabsOptions, DetailText, DetailTextOptions, DisplayFieldOptions, DyrectedAIError, DyrectedConfig, EmailField, type ExprFunction, Field, FieldConditionBuilder, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MatchBuilder, MultiSelectField, NON_NEGOTIABLE_CREDENTIAL_FIELDS, NumberField, ObjectField, PII_REGEX_PATTERNS, type Prettify, PublicAdminAuthConfig, type PublishingWorkflowOptions, RadioField, RelationshipField, RichTextField, RowField, type SanitizeDocForAIOptions, SelectField, type SortClause, type SortDirection, type SqlSortDialect, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhenFunction, WorkflowConfig, WorkflowTransition, abs, addDays, assertValidAdminConditionsInConfig, assertValidDeclarativeAccessInConfig, assertValidDeclarativeHookExpression, assertValidDeclarativeHookResult, assertValidDeclarativeHooksInConfig, assertValidPreviewUrlsInConfig, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, capitalize, ceil, clamp, coalesce, collectAdminConditionValidationIssues, collectConfigDiagnostics, collectDeclarativeAccessValidationIssues, collectDeclarativeHookValidationIssues, collectPreviewUrlValidationIssues, compact, count, createLifecycleEvent, createWorkflowDocument, defaultValue, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, definePublishingWorkflow, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, diffDays, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, displayComputed, displayCustom, displayCustomComponent, displayDivider, displayField, displayGrid, displayRepeat, displaySection, displayTab, displayTabs, displayText, endsWith, evaluateDetailComputed, evaluateJexl, evaluateJexlSync, executeFieldAfterRead, executeFieldBeforeChange, expr, first, floor, formatConfigDiagnostics, formatDate, formatJexlValue, generateDefaultDetailSchema, generateOpenApi, get, getAdminAuthCollection, getAdminRoleForCollection, getAllowedSitesForUser, getPublicAdminAuthConfig, includes, initializeWorkflowDocument, isConfigValidationError, isDetailItemVisible, isEmpty, isFuture, isPast, isSiteAuthorized, isUserAdmin, join, last, length, lower, maskEmail, maskPhone, maskTextPII, materializeWorkflowDocument, max, min, normalizeConfig, normalizeDetailItem, now, numericFieldNames, parseSort, pow, publishedStateName, publishingWorkflow, readingTime, registerJexlHelpers, replace, resolveAdminAuthCollection, resolveAuthorizedSiteId, round, runCollectionHooks, sanitizeDocForAI, saveWorkflowDraft, simplePublishingWorkflow, slugify, sqrt, startsWith, sum, today, transitionWorkflow, trim, truncate, unique, upper, validateAdminConditionExpression, validateDeclarativeAccessExpression, validateDeclarativeHookExpression, validatePreviewUrlExpression, when, wordCount, workflowCapabilities };

package/dist/index.js

@@ -57,6 +57,7 @@ import {
   generateOpenApi,
   get,
   getAdminAuthCollection,
+  getAdminRoleForCollection,
   getAllowedSitesForUser,
   getPublicAdminAuthConfig,
   includes,
@@ -67,6 +68,7 @@ import {
   isFuture,
   isPast,
   isSiteAuthorized,
+  isUserAdmin,
   join,
   last,
   length,
@@ -105,7 +107,7 @@ import {
   validatePreviewUrlExpression,
   wordCount,
   workflowCapabilities
-} from "./chunk-DZMBVIMN.js";
+} from "./chunk-LYENW2EN.js";
 import {
   NON_NEGOTIABLE_CREDENTIAL_FIELDS,
   PII_REGEX_PATTERNS,
@@ -948,6 +950,7 @@ export {
   generateOpenApi,
   get,
   getAdminAuthCollection,
+  getAdminRoleForCollection,
   getAllowedSitesForUser,
   getPublicAdminAuthConfig,
   includes,
@@ -959,6 +962,7 @@ export {
   isFuture,
   isPast,
   isSiteAuthorized,
+  isUserAdmin,
   join,
   last,
   length,

package/dist/server.cjs

@@ -6182,6 +6182,19 @@ function humanizeProviderName(id, type) {
   if (!cleaned) return type.toUpperCase();
   return cleaned.replace(/\b\w/g, (char) => char.toUpperCase());
 }
+function getAdminRoleForCollection(collection) {
+  if (!collection?.auth) return "admin";
+  if (typeof collection.auth === "object" && collection.auth.adminRole) {
+    return collection.auth.adminRole;
+  }
+  return "admin";
+}
+function isUserAdmin(user, collection) {
+  if (!user || !Array.isArray(user.roles)) return false;
+  const configuredRole = getAdminRoleForCollection(collection);
+  if (user.roles.includes(configuredRole)) return true;
+  return user.roles.includes("admin") || user.roles.includes("super_admin");
+}
 
 // src/utils/collection-search.ts
 var DEFAULT_SEARCHABLE_NAMES = /* @__PURE__ */ new Set([
@@ -8001,7 +8014,7 @@ var CollectionController = class {
     if (newPassword.length < 8) {
       return c.json({ message: "Password must be at least 8 characters" }, 400);
     }
-    const isAdmin = Array.isArray(user.roles) && user.roles.includes("admin");
+    const isAdmin = isUserAdmin(user, this.collection);
     const isSelf = user.sub === id;
     if (!isAdmin && !isSelf) {
       return c.json(
@@ -9625,14 +9638,29 @@ var AuthController = class {
         400
       );
     }
+    let initialRole = getAdminRoleForCollection(this.collection);
+    const rolesField = this.collection.fields?.find((f) => f.name === "roles");
+    if (rolesField && Array.isArray(rolesField.options) && rolesField.options.length > 0) {
+      const optionValues = rolesField.options.map(
+        (opt) => typeof opt === "string" ? opt : opt?.value
+      );
+      if (!optionValues.includes(initialRole)) {
+        if (optionValues.includes("super_admin")) {
+          initialRole = "super_admin";
+        } else if (optionValues.includes("admin")) {
+          initialRole = "admin";
+        } else {
+          initialRole = optionValues[0];
+        }
+      }
+    }
     const hashedPassword = await hashPassword(body.password);
     const user = await db.create({
       collection: this.collection.slug,
       data: {
         ...body,
         password: hashedPassword,
-        roles: ["admin"]
-        // Default first user to admin
+        roles: [initialRole]
       }
     });
     const token = await issueAuthSessionToken({
@@ -14099,7 +14127,8 @@ function registerRoutes(app, config) {
     if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
     const body = await c.req.json().catch(() => ({}));
     if (scope === "global") {
-      const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
+      const userCol = config.collections?.find((col) => col.slug === user?.collection);
+      const isAdminUser = isUserAdmin(user, userCol);
       if (!isAdminUser) {
         return c.json(
           {
@@ -14147,7 +14176,8 @@ function registerRoutes(app, config) {
     if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
     if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
     if (scope === "global") {
-      const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
+      const userCol = config.collections?.find((col) => col.slug === user?.collection);
+      const isAdminUser = isUserAdmin(user, userCol);
       if (!isAdminUser) {
         return c.json(
           {

package/dist/server.d.cts

@@ -1,5 +1,5 @@
-import { J as DyrectedContext, D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig, bf as DatabaseAdapter, b as AuthenticatedUser, bt as DyrectedAIContext, al as AIThread, ah as AIMessage, ck as RAGSearchResult, ak as AIRateLimitStore, aj as AIRateLimitResult } from './app-D_ODsBWA.cjs';
-export { cV as DyrectedObservabilityRuntime, cW as RequestBodyCapture, cX as RequestTraceContext, cY as ResolvedObservabilityConfig, cZ as attachRequestMetrics, c_ as bindObservabilityRuntime, c$ as buildRequestLogger, d0 as captureRequestBody, d1 as createDyrectedApp, d2 as createObservabilityRuntime, d3 as createRequestSpan, d4 as endRequestSpan, d5 as getConfigLogger, d6 as getObservabilityRuntime, d7 as getRequestLogger, d8 as redactBody, d9 as redactHeaders, da as renderPrometheusMetrics, db as resolveObservabilityConfig, dc as shouldSampleRequest } from './app-D_ODsBWA.cjs';
+import { J as DyrectedContext, D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig, bf as DatabaseAdapter, b as AuthenticatedUser, bt as DyrectedAIContext, al as AIThread, ah as AIMessage, ck as RAGSearchResult, ak as AIRateLimitStore, aj as AIRateLimitResult } from './app-De-3eNn1.cjs';
+export { cV as DyrectedObservabilityRuntime, cW as RequestBodyCapture, cX as RequestTraceContext, cY as ResolvedObservabilityConfig, cZ as attachRequestMetrics, c_ as bindObservabilityRuntime, c$ as buildRequestLogger, d0 as captureRequestBody, d1 as createDyrectedApp, d2 as createObservabilityRuntime, d3 as createRequestSpan, d4 as endRequestSpan, d5 as getConfigLogger, d6 as getObservabilityRuntime, d7 as getRequestLogger, d8 as redactBody, d9 as redactHeaders, da as renderPrometheusMetrics, db as resolveObservabilityConfig, dc as shouldSampleRequest } from './app-De-3eNn1.cjs';
 import * as hono from 'hono';
 import { Hono, Context, Next } from 'hono';
 import * as hono_utils_types from 'hono/utils/types';

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { J as DyrectedContext, D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig, bf as DatabaseAdapter, b as AuthenticatedUser, bt as DyrectedAIContext, al as AIThread, ah as AIMessage, ck as RAGSearchResult, ak as AIRateLimitStore, aj as AIRateLimitResult } from './app-D_ODsBWA.js';
-export { cV as DyrectedObservabilityRuntime, cW as RequestBodyCapture, cX as RequestTraceContext, cY as ResolvedObservabilityConfig, cZ as attachRequestMetrics, c_ as bindObservabilityRuntime, c$ as buildRequestLogger, d0 as captureRequestBody, d1 as createDyrectedApp, d2 as createObservabilityRuntime, d3 as createRequestSpan, d4 as endRequestSpan, d5 as getConfigLogger, d6 as getObservabilityRuntime, d7 as getRequestLogger, d8 as redactBody, d9 as redactHeaders, da as renderPrometheusMetrics, db as resolveObservabilityConfig, dc as shouldSampleRequest } from './app-D_ODsBWA.js';
+import { J as DyrectedContext, D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig, bf as DatabaseAdapter, b as AuthenticatedUser, bt as DyrectedAIContext, al as AIThread, ah as AIMessage, ck as RAGSearchResult, ak as AIRateLimitStore, aj as AIRateLimitResult } from './app-De-3eNn1.js';
+export { cV as DyrectedObservabilityRuntime, cW as RequestBodyCapture, cX as RequestTraceContext, cY as ResolvedObservabilityConfig, cZ as attachRequestMetrics, c_ as bindObservabilityRuntime, c$ as buildRequestLogger, d0 as captureRequestBody, d1 as createDyrectedApp, d2 as createObservabilityRuntime, d3 as createRequestSpan, d4 as endRequestSpan, d5 as getConfigLogger, d6 as getObservabilityRuntime, d7 as getRequestLogger, d8 as redactBody, d9 as redactHeaders, da as renderPrometheusMetrics, db as resolveObservabilityConfig, dc as shouldSampleRequest } from './app-De-3eNn1.js';
 import * as hono from 'hono';
 import { Hono, Context, Next } from 'hono';
 import * as hono_utils_types from 'hono/utils/types';

package/dist/server.js

@@ -13,12 +13,14 @@ import {
   executeFieldBeforeChange,
   generateOpenApi,
   getAdminAuthCollection,
+  getAdminRoleForCollection,
   getAllowedSitesForUser,
   getAuthSession,
   getPublicAdminAuthConfig,
   initializeWorkflowDocument,
   isAuthSessionActive,
   isSiteAuthorized,
+  isUserAdmin,
   issueAuthSessionToken,
   materializeWorkflowDocument,
   mergeDynamicConfig,
@@ -33,7 +35,7 @@ import {
   touchAuthSession,
   transitionWorkflow,
   verifyCollectionToken
-} from "./chunk-DZMBVIMN.js";
+} from "./chunk-LYENW2EN.js";
 import {
   applyFieldReadAccess,
   applyFieldWriteAccess,
@@ -2321,7 +2323,7 @@ var CollectionController = class {
     if (newPassword.length < 8) {
       return c.json({ message: "Password must be at least 8 characters" }, 400);
     }
-    const isAdmin = Array.isArray(user.roles) && user.roles.includes("admin");
+    const isAdmin = isUserAdmin(user, this.collection);
     const isSelf = user.sub === id;
     if (!isAdmin && !isSelf) {
       return c.json(
@@ -3832,14 +3834,29 @@ var AuthController = class {
         400
       );
     }
+    let initialRole = getAdminRoleForCollection(this.collection);
+    const rolesField = this.collection.fields?.find((f) => f.name === "roles");
+    if (rolesField && Array.isArray(rolesField.options) && rolesField.options.length > 0) {
+      const optionValues = rolesField.options.map(
+        (opt) => typeof opt === "string" ? opt : opt?.value
+      );
+      if (!optionValues.includes(initialRole)) {
+        if (optionValues.includes("super_admin")) {
+          initialRole = "super_admin";
+        } else if (optionValues.includes("admin")) {
+          initialRole = "admin";
+        } else {
+          initialRole = optionValues[0];
+        }
+      }
+    }
     const hashedPassword = await hashPassword(body.password);
     const user = await db.create({
       collection: this.collection.slug,
       data: {
         ...body,
         password: hashedPassword,
-        roles: ["admin"]
-        // Default first user to admin
+        roles: [initialRole]
       }
     });
     const token = await issueAuthSessionToken({
@@ -6998,7 +7015,8 @@ function registerRoutes(app, config) {
     if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
     const body = await c.req.json().catch(() => ({}));
     if (scope === "global") {
-      const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
+      const userCol = config.collections?.find((col) => col.slug === user?.collection);
+      const isAdminUser = isUserAdmin(user, userCol);
       if (!isAdminUser) {
         return c.json(
           {
@@ -7046,7 +7064,8 @@ function registerRoutes(app, config) {
     if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
     if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
     if (scope === "global") {
-      const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
+      const userCol = config.collections?.find((col) => col.slug === user?.collection);
+      const isAdminUser = isUserAdmin(user, userCol);
       if (!isAdminUser) {
         return c.json(
           {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dyrected/core",
-  "version": "2.13.0",
+  "version": "2.13.1",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -20,12 +20,6 @@
   "files": [
     "dist"
   ],
-  "scripts": {
-    "build": "NODE_OPTIONS=--max-old-space-size=4096 tsup src/index.ts src/server.ts --format cjs,esm --dts",
-    "dev": "NODE_OPTIONS=--max-old-space-size=4096 tsup src/index.ts src/server.ts --format cjs,esm --watch --dts",
-    "lint": "eslint src/**/*.ts",
-    "test": "vitest"
-  },
   "dependencies": {
     "@ai-sdk/google": "^4.0.49",
     "@ai-sdk/openai": "^4.0.50",
@@ -65,5 +59,11 @@
   "publishConfig": {
     "access": "public"
   },
-  "description": "Core engine and schema handling for Dyrected CMS"
-}
+  "description": "Core engine and schema handling for Dyrected CMS",
+  "scripts": {
+    "build": "NODE_OPTIONS=--max-old-space-size=4096 tsup src/index.ts src/server.ts --format cjs,esm --dts",
+    "dev": "NODE_OPTIONS=--max-old-space-size=4096 tsup src/index.ts src/server.ts --format cjs,esm --watch --dts",
+    "lint": "eslint src/**/*.ts",
+    "test": "vitest"
+  }
+}