@dyrected/core 2.13.0 → 2.13.3

package/dist/chunk-W7GKJM2X.js

@@ -1,1136 +0,0 @@
-import {
-  RAGService
-} from "./chunk-ZYYDTHF3.js";
-import {
-  sanitizeDocForAI
-} from "./chunk-254THFDS.js";
-import {
-  AI_ACTIONS_COLLECTION,
-  isAICollection
-} from "./chunk-4RAQJVJM.js";
-import {
-  isAccessAllowed,
-  resolveAccess
-} from "./chunk-HRRJ3RYT.js";
-
-// src/services/ai-tools.ts
-import { tool } from "ai";
-import { z } from "zod";
-
-// src/utils/access-control.ts
-function toHookRequestContext(req) {
-  return {
-    query: req.query(),
-    headers: req.header(),
-    raw: req.raw
-  };
-}
-async function resolveBooleanAccess(config, access, args) {
-  const result = await resolveAccess(config, access, args);
-  if (result === void 0) return true;
-  return typeof result === "boolean" ? result : false;
-}
-async function matchesAccessConstraint(config, collection, id, constraint) {
-  if (!config.db) return false;
-  const match = await config.db.find({
-    collection,
-    where: { AND: [{ id: { equals: id } }, constraint] },
-    limit: 1
-  });
-  return match.total > 0;
-}
-async function resolveCollectionAccess(config, collection, action, access, args) {
-  const result = await resolveAccess(config, access, args);
-  if (result === void 0) return { allowed: true };
-  if (typeof result === "boolean") return { allowed: result };
-  if (action === "read" && !args.id) {
-    return { allowed: true, constraint: result };
-  }
-  if (!args.id) {
-    return { allowed: false };
-  }
-  return {
-    allowed: await matchesAccessConstraint(config, collection, args.id, result)
-  };
-}
-function resolveFieldAccessId(context) {
-  const candidate = context.id ?? context.doc?.id ?? context.data?.id;
-  return typeof candidate === "string" && candidate.length > 0 ? candidate : void 0;
-}
-async function applyFieldReadAccess(context, doc) {
-  if (!doc || typeof doc !== "object") return doc;
-  const result = { ...doc };
-  for (const field of context.fields) {
-    if (field.type === "row" && field.fields) {
-      Object.assign(
-        result,
-        await applyFieldReadAccess(
-          { ...context, fields: field.fields },
-          result
-        )
-      );
-      continue;
-    }
-    if (!field.name) continue;
-    const value = result[field.name];
-    const canRead = await resolveBooleanAccess(
-      context.config,
-      field.access?.read,
-      {
-        user: context.user,
-        req: context.req,
-        doc: context.doc,
-        data: context.data,
-        id: resolveFieldAccessId(context)
-      }
-    );
-    if (!canRead) {
-      delete result[field.name];
-      continue;
-    }
-    if (value === void 0 || value === null) continue;
-    if (field.type === "object" && field.fields && typeof value === "object" && !Array.isArray(value)) {
-      result[field.name] = await applyFieldReadAccess(
-        { ...context, fields: field.fields },
-        value
-      );
-      continue;
-    }
-    if (field.type === "array" && field.fields && Array.isArray(value)) {
-      const childFields = field.fields;
-      result[field.name] = await Promise.all(
-        value.map(
-          (item) => typeof item === "object" && item !== null ? applyFieldReadAccess(
-            { ...context, fields: childFields },
-            item
-          ) : item
-        )
-      );
-      continue;
-    }
-    if (field.type === "blocks" && field.blocks && Array.isArray(value)) {
-      result[field.name] = await Promise.all(
-        value.map(async (item) => {
-          if (typeof item !== "object" || item === null) return item;
-          const typedItem = item;
-          const block = field.blocks?.find(
-            (candidate) => candidate.slug === typedItem.blockType
-          );
-          if (!block || !block.fields) return item;
-          return applyFieldReadAccess(
-            { ...context, fields: block.fields },
-            typedItem
-          );
-        })
-      );
-    }
-  }
-  return result;
-}
-async function applyFieldWriteAccess(context, data) {
-  if (!data || typeof data !== "object") return data;
-  const result = { ...data };
-  for (const field of context.fields) {
-    if (field.type === "row" && field.fields) {
-      Object.assign(
-        result,
-        await applyFieldWriteAccess(
-          { ...context, fields: field.fields },
-          result
-        )
-      );
-      continue;
-    }
-    if (!field.name || !(field.name in result)) continue;
-    const writeRule = context.operation === "create" ? field.access?.create ?? field.access?.update : field.access?.update;
-    const canWrite = await resolveBooleanAccess(context.config, writeRule, {
-      user: context.user,
-      req: context.req,
-      doc: context.doc,
-      data: context.data,
-      id: resolveFieldAccessId(context)
-    });
-    if (!canWrite) {
-      delete result[field.name];
-      continue;
-    }
-    const value = result[field.name];
-    if (value === void 0 || value === null) continue;
-    if (field.type === "object" && field.fields && typeof value === "object" && !Array.isArray(value)) {
-      result[field.name] = await applyFieldWriteAccess(
-        { ...context, fields: field.fields },
-        value
-      );
-      continue;
-    }
-    if (field.type === "array" && field.fields && Array.isArray(value)) {
-      const childFields = field.fields;
-      result[field.name] = await Promise.all(
-        value.map(
-          (item) => typeof item === "object" && item !== null ? applyFieldWriteAccess(
-            { ...context, fields: childFields },
-            item
-          ) : item
-        )
-      );
-      continue;
-    }
-    if (field.type === "blocks" && field.blocks && Array.isArray(value)) {
-      result[field.name] = await Promise.all(
-        value.map(async (item) => {
-          if (typeof item !== "object" || item === null) return item;
-          const typedItem = item;
-          const block = field.blocks?.find(
-            (candidate) => candidate.slug === typedItem.blockType
-          );
-          if (!block || !block.fields) return item;
-          return applyFieldWriteAccess(
-            { ...context, fields: block.fields },
-            typedItem
-          );
-        })
-      );
-    }
-  }
-  return result;
-}
-function mergeWhereConstraint(where, constraint) {
-  return where ? { AND: [where, constraint] } : constraint;
-}
-
-// src/services/ai-tools.ts
-function generateActionId() {
-  return `act_${Date.now().toString(36)}_${Math.random().toString(36).substring(2, 9)}`;
-}
-function isCollectionVisibleToProject(col, projectId) {
-  if (!col.siteId || col.shared || projectId === "default") return true;
-  return col.siteId === projectId;
-}
-function getAvailableCollectionSlugs(config, projectId) {
-  return (config.collections || []).filter((c) => !isAICollection(c.slug) && !c.slug.startsWith("_")).filter((c) => !projectId || isCollectionVisibleToProject(c, projectId)).map((c) => c.slug).join(", ");
-}
-function isGlobalVisibleToProject(glb, projectId) {
-  if (!glb.siteId || glb.shared || projectId === "default") return true;
-  return glb.siteId === projectId;
-}
-function getAvailableGlobalSlugs(config, projectId) {
-  return (config.globals || []).filter((g) => !projectId || isGlobalVisibleToProject(g, projectId)).map((g) => g.slug).join(", ");
-}
-function validatePayloadAgainstFields(fields, data, isPartial = false) {
-  if (!data || typeof data !== "object") {
-    return { valid: false, error: "Payload must be a non-null object." };
-  }
-  for (const field of fields) {
-    const val = data[field.name];
-    if (!isPartial && field.required && (val === void 0 || val === null || val === "")) {
-      return { valid: false, error: `Required field "${field.name}" is missing or empty.` };
-    }
-    if (val !== void 0 && val !== null) {
-      if (field.type === "number" && typeof val !== "number") {
-        const num = Number(val);
-        if (isNaN(num)) {
-          return { valid: false, error: `Field "${field.name}" expects a numeric value, received "${val}".` };
-        }
-      } else if (field.type === "checkbox" && typeof val !== "boolean") {
-        if (val !== "true" && val !== "false") {
-          return { valid: false, error: `Field "${field.name}" expects a boolean value.` };
-        }
-      }
-    }
-  }
-  return { valid: true };
-}
-function withTimeout(promise, timeoutMs = 1e4, toolName = "tool") {
-  let timer;
-  const timeoutPromise = new Promise((_, reject) => {
-    timer = setTimeout(() => {
-      reject(new Error(`Tool "${toolName}" timed out after ${timeoutMs}ms`));
-    }, timeoutMs);
-  });
-  return Promise.race([promise, timeoutPromise]).finally(() => {
-    if (timer) clearTimeout(timer);
-  });
-}
-function createDyrectedAITools({
-  db,
-  config,
-  user,
-  projectId
-}) {
-  const context = { db, user, projectId, config };
-  const builtInTools = {
-    listCollections: tool({
-      description: "List all content collections available in this Dyrected CMS project",
-      inputSchema: z.object({}),
-      execute: async () => {
-        return withTimeout(
-          (async () => {
-            const collections = (config.collections || []).filter((col) => !isAICollection(col.slug) && !col.slug.startsWith("_")).filter((col) => isCollectionVisibleToProject(col, projectId)).map((col) => ({
-              slug: col.slug,
-              label: col.labels?.singular || col.labels?.plural || col.slug,
-              auth: !!col.auth,
-              timestamps: col.timestamps !== false
-            }));
-            return { collections };
-          })(),
-          1e4,
-          "listCollections"
-        );
-      }
-    }),
-    getCollectionSchema: tool({
-      description: "Get detailed field definitions, relations, and validation rules for a specific collection",
-      inputSchema: z.object({
-        collection: z.string().describe("Slug of the collection to inspect")
-      }),
-      execute: async ({
-        collection
-      }) => {
-        return withTimeout(
-          (async () => {
-            if (isAICollection(collection) || collection.startsWith("_")) {
-              return {
-                error: `Collection "${collection}" is private or internal.`,
-                suggestion: `Choose from available public collections: [${getAvailableCollectionSlugs(config, projectId)}]`,
-                recoverable: true
-              };
-            }
-            const col = config.collections?.find((c) => c.slug === collection);
-            if (!col || !isCollectionVisibleToProject(col, projectId)) {
-              return {
-                error: `Collection "${collection}" not found in project.`,
-                suggestion: `Available collections are: [${getAvailableCollectionSlugs(config, projectId)}]. Please re-try with a valid collection.`,
-                recoverable: true
-              };
-            }
-            const fields = col.fields?.map((f) => ({
-              name: f.name,
-              type: f.type,
-              label: f.label,
-              required: !!f.required,
-              unique: !!f.unique,
-              relationTo: f.relationTo,
-              options: f.options
-            })) || [];
-            return {
-              slug: col.slug,
-              label: col.labels?.singular || col.labels?.plural || col.slug,
-              auth: !!col.auth,
-              fields
-            };
-          })(),
-          1e4,
-          "getCollectionSchema"
-        );
-      }
-    }),
-    listGlobals: tool({
-      description: "List all singleton global configurations (e.g. site-settings, navigation, homepage) in this project",
-      inputSchema: z.object({}),
-      execute: async () => {
-        return withTimeout(
-          (async () => {
-            const globals = (config.globals || []).filter((g) => isGlobalVisibleToProject(g, projectId)).map((g) => ({
-              slug: g.slug,
-              label: g.label || g.slug
-            }));
-            return { globals };
-          })(),
-          1e4,
-          "listGlobals"
-        );
-      }
-    }),
-    getGlobalSchema: tool({
-      description: "Get schema and current saved values for a singleton global configuration",
-      inputSchema: z.object({
-        global: z.string().describe('Slug of the global configuration (e.g. "homepage", "site-settings")')
-      }),
-      execute: async ({
-        global: globalSlug
-      }) => {
-        return withTimeout(
-          (async () => {
-            const g = config.globals?.find((item) => item.slug === globalSlug);
-            if (!g || !isGlobalVisibleToProject(g, projectId)) {
-              return {
-                error: `Global "${globalSlug}" not found.`,
-                suggestion: `Available globals in this project are: [${getAvailableGlobalSlugs(config, projectId)}].`,
-                recoverable: true
-              };
-            }
-            let data = null;
-            try {
-              data = await db.getGlobal({ slug: globalSlug });
-            } catch {
-            }
-            const fields = g.fields?.map((f) => ({
-              name: f.name,
-              type: f.type,
-              label: f.label,
-              required: !!f.required
-            })) || [];
-            return {
-              slug: g.slug,
-              label: g.label || g.slug,
-              fields,
-              data
-            };
-          })(),
-          1e4,
-          "getGlobalSchema"
-        );
-      }
-    }),
-    queryCollection: tool({
-      description: 'Query structured records from a collection using exact field filters, sorting, and pagination. Use this tool for finding documents with specific statuses, categories, date ranges, or numeric thresholds (e.g. price > 50000, status == "published"). Do NOT use this tool for open-ended conceptual or semantic questions.',
-      inputSchema: z.object({
-        collection: z.string().describe('Slug of the collection to query (e.g. "articles", "products", "services")'),
-        where: z.record(z.string(), z.any()).optional().describe('Filter criteria object (e.g. { "status": "published", "price": { "greater_than": 50000 } })'),
-        sort: z.string().optional().describe('Field to sort by (prefix with "-" for descending, e.g. "-createdAt")'),
-        limit: z.number().min(1).max(50).optional().default(10).describe("Maximum documents to return (1-50)"),
-        page: z.number().min(1).optional().default(1).describe("Page number for pagination")
-      }),
-      execute: async ({
-        collection,
-        where,
-        sort,
-        limit = 10,
-        page = 1
-      }) => {
-        return withTimeout(
-          (async () => {
-            if (isAICollection(collection) || collection.startsWith("_")) {
-              return {
-                error: `Collection "${collection}" is private or internal.`,
-                suggestion: `Query public collections: [${getAvailableCollectionSlugs(config, projectId)}]`,
-                recoverable: true
-              };
-            }
-            const col = config.collections?.find((c) => c.slug === collection);
-            if (!col || !isCollectionVisibleToProject(col, projectId)) {
-              return {
-                error: `Collection "${collection}" does not exist in this project.`,
-                suggestion: `Available collections are: [${getAvailableCollectionSlugs(config, projectId)}]. Use getCollectionSchema() to inspect valid fields.`,
-                recoverable: true
-              };
-            }
-            const accessResult = await resolveAccess(config, col.access?.read, {
-              req: { user, siteId: projectId },
-              user
-            });
-            if (accessResult === false) {
-              return {
-                error: `Access denied: user lacks read permission for collection "${collection}".`,
-                recoverable: false
-              };
-            }
-            let queryWhere = where || {};
-            if (accessResult && typeof accessResult === "object") {
-              queryWhere = mergeWhereConstraint(queryWhere, accessResult);
-            }
-            try {
-              const result = await db.find({
-                collection,
-                where: queryWhere,
-                sort,
-                limit,
-                page
-              });
-              const sanitizedDocs = (result.docs || []).map(
-                (doc) => sanitizeDocForAI({
-                  doc,
-                  collectionConfig: col,
-                  globalAIConfig: config.ai
-                })
-              );
-              return {
-                collection,
-                docs: sanitizedDocs,
-                total: result.total ?? sanitizedDocs.length,
-                totalPages: result.totalPages ?? 1,
-                page: result.page ?? page,
-                limit: result.limit ?? limit
-              };
-            } catch (err) {
-              return {
-                error: `Failed to query collection "${collection}": ${err.message}`,
-                suggestion: "Verify field names match the collection schema using getCollectionSchema().",
-                recoverable: true
-              };
-            }
-          })(),
-          1e4,
-          "queryCollection"
-        );
-      }
-    }),
-    getDocument: tool({
-      description: "Retrieve a single full document by its ID from a collection",
-      inputSchema: z.object({
-        collection: z.string().describe("Slug of the collection"),
-        id: z.string().describe("Primary key ID of the document")
-      }),
-      execute: async ({
-        collection,
-        id
-      }) => {
-        return withTimeout(
-          (async () => {
-            if (isAICollection(collection) || collection.startsWith("_")) {
-              return {
-                error: `Collection "${collection}" is private or internal.`,
-                suggestion: `Retrieve documents from public collections: [${getAvailableCollectionSlugs(config, projectId)}]`,
-                recoverable: true
-              };
-            }
-            const col = config.collections?.find((c) => c.slug === collection);
-            if (!col || !isCollectionVisibleToProject(col, projectId)) {
-              return {
-                error: `Collection "${collection}" not found in project.`,
-                suggestion: `Available collections are: [${getAvailableCollectionSlugs(config, projectId)}].`,
-                recoverable: true
-              };
-            }
-            const accessResult = await resolveAccess(config, col.access?.read, {
-              req: { user, siteId: projectId },
-              user
-            });
-            if (accessResult === false) {
-              return {
-                error: `Access denied: you do not have permission to read document "${id}" in "${collection}".`,
-                recoverable: false
-              };
-            }
-            try {
-              const doc = await db.findOne({
-                collection,
-                id
-              });
-              if (!doc) {
-                return {
-                  error: `Document "${id}" not found in collection "${collection}".`,
-                  suggestion: `Check available IDs using queryCollection("${collection}").`,
-                  recoverable: true
-                };
-              }
-              if (accessResult && typeof accessResult === "object") {
-                const checkMatch = await db.find({
-                  collection,
-                  where: mergeWhereConstraint({ id: { equals: id } }, accessResult),
-                  limit: 1
-                });
-                if (checkMatch.total === 0) {
-                  return {
-                    error: `Document "${id}" not found in collection "${collection}".`,
-                    suggestion: "Verify document ID using queryCollection().",
-                    recoverable: true
-                  };
-                }
-              }
-              const docAccess = await resolveAccess(config, col.access?.read, {
-                req: { user, siteId: projectId },
-                user,
-                doc
-              });
-              if (docAccess === false) {
-                return {
-                  error: `Access denied: you do not have permission to read document "${id}" in "${collection}".`,
-                  recoverable: false
-                };
-              }
-              const sanitizedDoc = sanitizeDocForAI({
-                doc,
-                collectionConfig: col,
-                globalAIConfig: config.ai
-              });
-              return { collection, doc: sanitizedDoc };
-            } catch (err) {
-              return {
-                error: `Failed to fetch document "${id}": ${err.message}`,
-                recoverable: true
-              };
-            }
-          })(),
-          1e4,
-          "getDocument"
-        );
-      }
-    }),
-    aggregateCollection: tool({
-      description: 'Compute mathematical aggregates and summary statistics over a collection (e.g. count, sum, average, min, max, groupBy). Use this tool whenever the user asks "how many...", "what is the total...", "average price of...", or asks for counts grouped by status/category. Do NOT use semantic search for counting.',
-      inputSchema: z.object({
-        collection: z.string().describe("Slug of the collection to aggregate"),
-        aggregates: z.record(
-          z.string(),
-          z.object({
-            count: z.literal("*").optional(),
-            countDistinct: z.string().optional(),
-            distinct: z.string().optional(),
-            sum: z.string().optional(),
-            avg: z.string().optional(),
-            min: z.string().optional(),
-            max: z.string().optional(),
-            cast: z.enum(["number", "integer", "float", "string", "boolean", "date"]).optional(),
-            where: z.record(z.string(), z.any()).optional()
-          })
-        ).describe('Named aggregate operations to calculate (e.g. { "totalCount": { "count": "*" } })'),
-        groupBy: z.string().optional().describe('Optional field name to group results by (e.g. "status", "category")')
-      }),
-      execute: async ({
-        collection,
-        aggregates,
-        groupBy
-      }) => {
-        return withTimeout(
-          (async () => {
-            if (isAICollection(collection) || collection.startsWith("_")) {
-              return {
-                error: `Collection "${collection}" is private or internal.`,
-                suggestion: `Aggregate public collections: [${getAvailableCollectionSlugs(config, projectId)}]`,
-                recoverable: true
-              };
-            }
-            const col = config.collections?.find((c) => c.slug === collection);
-            if (!col || !isCollectionVisibleToProject(col, projectId)) {
-              return {
-                error: `Collection "${collection}" not found in project.`,
-                suggestion: `Available collections are: [${getAvailableCollectionSlugs(config, projectId)}].`,
-                recoverable: true
-              };
-            }
-            const accessResult = await resolveAccess(config, col.access?.read, {
-              req: { user, siteId: projectId },
-              user
-            });
-            if (accessResult === false) {
-              return {
-                error: `Access denied: you do not have permission to aggregate collection "${collection}".`,
-                recoverable: false
-              };
-            }
-            let effectiveAggregates = aggregates;
-            if (accessResult && typeof accessResult === "object") {
-              effectiveAggregates = {};
-              for (const [key, op] of Object.entries(aggregates)) {
-                effectiveAggregates[key] = {
-                  ...op,
-                  where: mergeWhereConstraint(op.where, accessResult)
-                };
-              }
-            }
-            try {
-              const result = await db.aggregate({
-                collection,
-                aggregates: effectiveAggregates,
-                groupBy
-              });
-              return { collection, result };
-            } catch (err) {
-              return {
-                error: `Failed to compute aggregates on "${collection}": ${err.message}`,
-                suggestion: "Verify field names match schema with getCollectionSchema().",
-                recoverable: true
-              };
-            }
-          })(),
-          1e4,
-          "aggregateCollection"
-        );
-      }
-    }),
-    searchContent: tool({
-      description: 'Perform semantic vector search across unstructured text, articles, documentation, FAQs, guides, policies, and rich-text fields. Use this tool for open-ended questions, concepts, thematic topics, explanations, and qualitative inquiries (e.g. "what is our policy on refunds?", "how do we handle chargebacks?"). Do NOT use this tool for exact counts or strict numeric filtering.',
-      inputSchema: z.object({
-        query: z.string().describe("The natural language semantic search query or topic to look up"),
-        collections: z.array(z.string()).optional().describe('Optional collection slugs to restrict search scope to (e.g. ["articles", "faqs"])'),
-        limit: z.number().min(1).max(10).optional().default(4).describe("Number of top relevant snippets to return (1-10)"),
-        minScore: z.number().min(0).max(1).optional().default(0.45).describe("Minimum cosine similarity cutoff threshold (0.0 to 1.0)")
-      }),
-      execute: async ({
-        query,
-        collections,
-        limit = 4,
-        minScore = 0.45
-      }) => {
-        return withTimeout(
-          (async () => {
-            try {
-              const result = await RAGService.search({
-                db,
-                config,
-                query,
-                projectId,
-                collections,
-                limit,
-                minScore,
-                user
-              });
-              return result;
-            } catch (err) {
-              return {
-                query,
-                resultsCount: 0,
-                sources: [],
-                error: `Semantic search failed: ${err.message}`,
-                recoverable: true
-              };
-            }
-          })(),
-          1e4,
-          "searchContent"
-        );
-      }
-    }),
-    // Day 5: Human-in-the-Loop Mutation Proposal Tools
-    proposeCreateDocument: tool({
-      description: "Propose creating a new document in a collection. Does NOT write to the database immediately; creates a proposal requiring human approval in the chat UI.",
-      inputSchema: z.object({
-        collection: z.string().describe("Slug of the target collection"),
-        data: z.record(z.string(), z.any()).describe("Key-value object containing the document fields to create"),
-        summary: z.string().describe("Clear 1-sentence summary of the new document being created")
-      }),
-      execute: async ({
-        collection,
-        data,
-        summary
-      }) => {
-        return withTimeout(
-          (async () => {
-            if (isAICollection(collection) || collection.startsWith("_")) {
-              return {
-                error: `Collection "${collection}" is internal and cannot be modified.`,
-                suggestion: `Target public collections: [${getAvailableCollectionSlugs(config, projectId)}]`,
-                recoverable: true
-              };
-            }
-            const col = config.collections?.find((c) => c.slug === collection);
-            if (!col || !isCollectionVisibleToProject(col, projectId)) {
-              return {
-                error: `Collection "${collection}" not found in project.`,
-                suggestion: `Available collections are: [${getAvailableCollectionSlugs(config, projectId)}].`,
-                recoverable: true
-              };
-            }
-            const canCreate = await isAccessAllowed(config, col.access?.create, {
-              req: { user, siteId: projectId },
-              user,
-              data
-            });
-            if (!canCreate) {
-              return {
-                error: `Access denied: you do not have permission to create records in "${collection}".`,
-                recoverable: false
-              };
-            }
-            const fields = col.fields?.map((f) => ({ name: f.name, type: f.type, required: !!f.required })) || [];
-            const validation = validatePayloadAgainstFields(fields, data, false);
-            if (!validation.valid) {
-              return {
-                error: `Schema validation failed: ${validation.error}`,
-                suggestion: `Check collection schema with getCollectionSchema("${collection}").`,
-                recoverable: true
-              };
-            }
-            const actionId = generateActionId();
-            const actionRecord = {
-              id: actionId,
-              projectId,
-              userId: user?.id ? String(user.id) : void 0,
-              type: "createDocument",
-              targetCollection: collection,
-              summary,
-              beforeSnapshot: null,
-              proposedData: data,
-              status: "pending",
-              expiresAt: new Date(Date.now() + 30 * 60 * 1e3),
-              // 30 mins
-              createdAt: /* @__PURE__ */ new Date()
-            };
-            try {
-              await db.create({
-                collection: AI_ACTIONS_COLLECTION,
-                data: actionRecord
-              });
-            } catch (err) {
-              return {
-                error: `Failed to persist action proposal: ${err.message}`,
-                recoverable: true
-              };
-            }
-            return {
-              actionId,
-              type: "createDocument",
-              collection,
-              summary,
-              proposedData: data,
-              status: "pending",
-              requiresApproval: true
-            };
-          })(),
-          1e4,
-          "proposeCreateDocument"
-        );
-      }
-    }),
-    proposeUpdateDocument: tool({
-      description: "Propose updating specific fields on an existing document in a collection. Does NOT modify the database immediately; creates a proposal requiring human approval in the chat UI.",
-      inputSchema: z.object({
-        collection: z.string().describe("Slug of the target collection"),
-        id: z.string().describe("Primary key ID of the document to update"),
-        data: z.record(z.string(), z.any()).describe("Key-value object containing the fields to update"),
-        summary: z.string().describe("Clear 1-sentence summary of the changes being proposed")
-      }),
-      execute: async ({
-        collection,
-        id,
-        data,
-        summary
-      }) => {
-        return withTimeout(
-          (async () => {
-            if (isAICollection(collection) || collection.startsWith("_")) {
-              return {
-                error: `Collection "${collection}" is internal and cannot be modified.`,
-                suggestion: `Target public collections: [${getAvailableCollectionSlugs(config, projectId)}]`,
-                recoverable: true
-              };
-            }
-            const col = config.collections?.find((c) => c.slug === collection);
-            if (!col || !isCollectionVisibleToProject(col, projectId)) {
-              return {
-                error: `Collection "${collection}" not found in project.`,
-                suggestion: `Available collections are: [${getAvailableCollectionSlugs(config, projectId)}].`,
-                recoverable: true
-              };
-            }
-            const readAccessResult = await resolveAccess(config, col.access?.read, {
-              req: { user, siteId: projectId },
-              user
-            });
-            if (readAccessResult === false) {
-              return {
-                error: `Access denied: you do not have permission to read document "${id}" in "${collection}".`,
-                recoverable: false
-              };
-            }
-            const existingDoc = readAccessResult && typeof readAccessResult === "object" ? (await db.find({
-              collection,
-              where: mergeWhereConstraint({ id: { equals: id } }, readAccessResult),
-              limit: 1
-            }))?.docs?.[0] || null : await db.findOne({ collection, id });
-            if (!existingDoc) {
-              return {
-                error: `Document "${id}" not found in collection "${collection}".`,
-                suggestion: `Search existing records first with queryCollection("${collection}").`,
-                recoverable: true
-              };
-            }
-            const updateAccessResult = await resolveAccess(config, col.access?.update, {
-              req: { user, siteId: projectId },
-              user,
-              data,
-              doc: existingDoc
-            });
-            if (updateAccessResult === false) {
-              return {
-                error: `Access denied: you do not have permission to update document "${id}" in "${collection}".`,
-                recoverable: false
-              };
-            }
-            if (updateAccessResult && typeof updateAccessResult === "object") {
-              const matches = await db.find({
-                collection,
-                where: mergeWhereConstraint({ id: { equals: id } }, updateAccessResult),
-                limit: 1
-              });
-              if (!matches || !matches.docs || matches.docs.length === 0) {
-                return {
-                  error: `Access denied: you do not have permission to update document "${id}" under current constraints.`,
-                  recoverable: false
-                };
-              }
-            }
-            const fields = col.fields?.map((f) => ({ name: f.name, type: f.type, required: !!f.required })) || [];
-            const validation = validatePayloadAgainstFields(fields, data, true);
-            if (!validation.valid) {
-              return {
-                error: `Schema validation failed: ${validation.error}`,
-                suggestion: `Check collection schema with getCollectionSchema("${collection}").`,
-                recoverable: true
-              };
-            }
-            const actionId = generateActionId();
-            const actionRecord = {
-              id: actionId,
-              projectId,
-              userId: user?.id ? String(user.id) : void 0,
-              type: "updateDocument",
-              targetCollection: collection,
-              documentId: id,
-              summary,
-              beforeSnapshot: existingDoc,
-              proposedData: data,
-              status: "pending",
-              expiresAt: new Date(Date.now() + 30 * 60 * 1e3),
-              createdAt: /* @__PURE__ */ new Date()
-            };
-            try {
-              await db.create({
-                collection: AI_ACTIONS_COLLECTION,
-                data: actionRecord
-              });
-            } catch (err) {
-              return {
-                error: `Failed to persist action proposal: ${err.message}`,
-                recoverable: true
-              };
-            }
-            return {
-              actionId,
-              type: "updateDocument",
-              collection,
-              documentId: id,
-              summary,
-              beforeSnapshot: existingDoc,
-              proposedData: data,
-              status: "pending",
-              requiresApproval: true
-            };
-          })(),
-          1e4,
-          "proposeUpdateDocument"
-        );
-      }
-    }),
-    proposeDeleteDocument: tool({
-      description: "Propose deleting an existing document from a collection. Does NOT delete from the database immediately; creates a proposal requiring human approval in the chat UI.",
-      inputSchema: z.object({
-        collection: z.string().describe("Slug of the target collection"),
-        id: z.string().describe("Primary key ID of the document to delete"),
-        summary: z.string().describe("Clear explanation of why this document should be deleted"),
-        permanent: z.boolean().optional().default(false).describe("Whether this is a permanent deletion")
-      }),
-      execute: async ({
-        collection,
-        id,
-        summary,
-        permanent = false
-      }) => {
-        return withTimeout(
-          (async () => {
-            if (isAICollection(collection) || collection.startsWith("_")) {
-              return {
-                error: `Collection "${collection}" is internal and cannot be deleted.`,
-                suggestion: `Target public collections: [${getAvailableCollectionSlugs(config, projectId)}]`,
-                recoverable: true
-              };
-            }
-            const col = config.collections?.find((c) => c.slug === collection);
-            if (!col || !isCollectionVisibleToProject(col, projectId)) {
-              return {
-                error: `Collection "${collection}" not found in project.`,
-                suggestion: `Available collections are: [${getAvailableCollectionSlugs(config, projectId)}].`,
-                recoverable: true
-              };
-            }
-            const readAccessResult = await resolveAccess(config, col.access?.read, {
-              req: { user, siteId: projectId },
-              user
-            });
-            if (readAccessResult === false) {
-              return {
-                error: `Access denied: you do not have permission to read document "${id}" in "${collection}".`,
-                recoverable: false
-              };
-            }
-            const existingDoc = readAccessResult && typeof readAccessResult === "object" ? (await db.find({
-              collection,
-              where: mergeWhereConstraint({ id: { equals: id } }, readAccessResult),
-              limit: 1
-            }))?.docs?.[0] || null : await db.findOne({ collection, id });
-            if (!existingDoc) {
-              return {
-                error: `Document "${id}" not found in collection "${collection}".`,
-                suggestion: `Search existing records with queryCollection("${collection}").`,
-                recoverable: true
-              };
-            }
-            const deleteAccessResult = await resolveAccess(config, col.access?.delete, {
-              req: { user, siteId: projectId },
-              user,
-              doc: existingDoc
-            });
-            if (deleteAccessResult === false) {
-              return {
-                error: `Access denied: you do not have permission to delete document "${id}" in "${collection}".`,
-                recoverable: false
-              };
-            }
-            if (deleteAccessResult && typeof deleteAccessResult === "object") {
-              const matches = await db.find({
-                collection,
-                where: mergeWhereConstraint({ id: { equals: id } }, deleteAccessResult),
-                limit: 1
-              });
-              if (!matches || !matches.docs || matches.docs.length === 0) {
-                return {
-                  error: `Access denied: you do not have permission to delete document "${id}" under current constraints.`,
-                  recoverable: false
-                };
-              }
-            }
-            const actionId = generateActionId();
-            const actionRecord = {
-              id: actionId,
-              projectId,
-              userId: user?.id ? String(user.id) : void 0,
-              type: "deleteDocument",
-              targetCollection: collection,
-              documentId: id,
-              summary,
-              beforeSnapshot: existingDoc,
-              proposedData: { permanent },
-              status: "pending",
-              expiresAt: new Date(Date.now() + 30 * 60 * 1e3),
-              createdAt: /* @__PURE__ */ new Date()
-            };
-            try {
-              await db.create({
-                collection: AI_ACTIONS_COLLECTION,
-                data: actionRecord
-              });
-            } catch (err) {
-              return {
-                error: `Failed to persist action proposal: ${err.message}`,
-                recoverable: true
-              };
-            }
-            return {
-              actionId,
-              type: "deleteDocument",
-              collection,
-              documentId: id,
-              summary,
-              beforeSnapshot: existingDoc,
-              proposedData: { permanent },
-              status: "pending",
-              requiresApproval: true
-            };
-          })(),
-          1e4,
-          "proposeDeleteDocument"
-        );
-      }
-    }),
-    proposeUpdateGlobal: tool({
-      description: "Propose modifying singleton global settings (e.g. site-settings, navigation, homepage). Does NOT modify the database immediately; creates a proposal requiring human approval in the chat UI.",
-      inputSchema: z.object({
-        global: z.string().describe('Slug of the global configuration (e.g. "homepage", "site-settings")'),
-        data: z.record(z.string(), z.any()).describe("Key-value object containing the fields to update"),
-        summary: z.string().describe("Clear 1-sentence summary of why these global settings are being updated")
-      }),
-      execute: async ({
-        global: globalSlug,
-        data,
-        summary
-      }) => {
-        return withTimeout(
-          (async () => {
-            const g = config.globals?.find((item) => item.slug === globalSlug);
-            if (!g || !isGlobalVisibleToProject(g, projectId)) {
-              return {
-                error: `Global "${globalSlug}" not found in project.`,
-                suggestion: `Available globals in this project are: [${getAvailableGlobalSlugs(config, projectId)}].`,
-                recoverable: true
-              };
-            }
-            let existingGlobal = null;
-            try {
-              existingGlobal = await db.getGlobal({ slug: globalSlug });
-            } catch {
-            }
-            const fields = g.fields?.map((f) => ({ name: f.name, type: f.type, required: !!f.required })) || [];
-            const validation = validatePayloadAgainstFields(fields, data, true);
-            if (!validation.valid) {
-              return {
-                error: `Schema validation failed: ${validation.error}`,
-                suggestion: `Inspect global fields with getGlobalSchema("${globalSlug}").`,
-                recoverable: true
-              };
-            }
-            const actionId = generateActionId();
-            const actionRecord = {
-              id: actionId,
-              projectId,
-              userId: user?.id ? String(user.id) : void 0,
-              type: "updateGlobal",
-              targetGlobal: globalSlug,
-              summary,
-              beforeSnapshot: existingGlobal,
-              proposedData: data,
-              status: "pending",
-              expiresAt: new Date(Date.now() + 30 * 60 * 1e3),
-              createdAt: /* @__PURE__ */ new Date()
-            };
-            try {
-              await db.create({
-                collection: AI_ACTIONS_COLLECTION,
-                data: actionRecord
-              });
-            } catch (err) {
-              return {
-                error: `Failed to persist action proposal: ${err.message}`,
-                recoverable: true
-              };
-            }
-            return {
-              actionId,
-              type: "updateGlobal",
-              global: globalSlug,
-              summary,
-              beforeSnapshot: existingGlobal,
-              proposedData: data,
-              status: "pending",
-              requiresApproval: true
-            };
-          })(),
-          1e4,
-          "proposeUpdateGlobal"
-        );
-      }
-    })
-  };
-  const customTools = {};
-  if (config.ai?.tools) {
-    for (const [toolName, toolDef] of Object.entries(config.ai.tools)) {
-      const schema = toolDef.inputSchema || toolDef.parameters || z.object({});
-      customTools[toolName] = tool({
-        description: toolDef.description,
-        inputSchema: schema,
-        execute: async (args) => {
-          return withTimeout(
-            Promise.resolve(toolDef.execute(args, context)),
-            1e4,
-            toolName
-          );
-        }
-      });
-    }
-  }
-  return {
-    ...builtInTools,
-    ...customTools
-  };
-}
-
-export {
-  toHookRequestContext,
-  resolveBooleanAccess,
-  resolveCollectionAccess,
-  applyFieldReadAccess,
-  applyFieldWriteAccess,
-  mergeWhereConstraint,
-  validatePayloadAgainstFields,
-  createDyrectedAITools
-};