@dyrected/core 2.13.5 → 2.14.0

package/dist/index.js

@@ -1775,6 +1775,11 @@ var require_Jexl = __commonJS({
   }
 });
 
+// src/types/readonly-fix.ts
+function asCollection(config) {
+  return config;
+}
+
 // src/types/workflows.ts
 var LIFECYCLE_EVENT_NAMES = [
   "revision.created",
@@ -1787,6 +1792,21 @@ var LIFECYCLE_EVENT_NAMES = [
 function defineView(config) {
   return config;
 }
+function defineTableView(config) {
+  return config;
+}
+function defineKanbanView(config) {
+  return config;
+}
+function defineCalendarView(config) {
+  return config;
+}
+function defineGanttView(config) {
+  return config;
+}
+function defineCardsView(config) {
+  return config;
+}
 function defineAction(config) {
   return config;
 }
@@ -3540,7 +3560,7 @@ function normalizeConfig(config) {
             name: "roles",
             type: "select",
             label: "Roles",
-            defaultValue: [],
+            defaultValue: "viewer",
             options: [
               { value: "admin", label: "Admin" },
               { value: "editor", label: "Editor" },
@@ -6300,7 +6320,7 @@ function sanitizeDocForAI(options) {
 // src/index.ts
 import { z } from "zod";
 function defineCollection(config) {
-  return config;
+  return asCollection(config);
 }
 function defineGlobal(config) {
   return config;
@@ -6328,17 +6348,26 @@ var defineTimeField = createFieldDefiner("time");
 var defineSelectField = createFieldDefiner("select");
 var defineMultiSelectField = createFieldDefiner("multiSelect");
 var defineRadioField = createFieldDefiner("radio");
-var defineRelationshipField = createFieldDefiner("relationship");
 var defineArrayField = createFieldDefiner("array");
 var defineObjectField = createFieldDefiner("object");
 var defineJsonField = createFieldDefiner("json");
 var defineBlocksField = createFieldDefiner("blocks");
-var defineImageField = createFieldDefiner("image");
 var defineEmailField = createFieldDefiner("email");
 var defineUrlField = createFieldDefiner("url");
 var defineIconField = createFieldDefiner("icon");
-var defineJoinField = createFieldDefiner("join");
 var defineRowField = createFieldDefiner("row");
+var _defineRelationshipFieldBase = createFieldDefiner("relationship");
+var _defineImageFieldBase = createFieldDefiner("image");
+var _defineJoinFieldBase = createFieldDefiner("join");
+function defineRelationshipField(config) {
+  return _defineRelationshipFieldBase(config);
+}
+function defineImageField(config) {
+  return _defineImageFieldBase(config);
+}
+function defineJoinField(config) {
+  return _defineJoinFieldBase(config);
+}
 function defineTab(args) {
   return args.fields.map((field) => ({
     ...field,
@@ -6363,6 +6392,7 @@ export {
   WORKFLOW_HISTORY_COLLECTION,
   abs,
   addDays,
+  asCollection,
   assertValidAdminConditionsInConfig,
   assertValidDeclarativeAccessInConfig,
   assertValidDeclarativeHookExpression,
@@ -6391,17 +6421,21 @@ export {
   defineBlock,
   defineBlocksField,
   defineBooleanField,
+  defineCalendarView,
+  defineCardsView,
   defineCollection,
   defineConfig,
   defineDateField,
   defineDateTimeField,
   defineEmailField,
   defineField,
+  defineGanttView,
   defineGlobal,
   defineIconField,
   defineImageField,
   defineJoinField,
   defineJsonField,
+  defineKanbanView,
   defineMultiSelectField,
   defineNumberField,
   defineObjectField,
@@ -6412,6 +6446,7 @@ export {
   defineRowField,
   defineSelectField,
   defineTab,
+  defineTableView,
   defineTextField,
   defineTextareaField,
   defineTimeField,

package/dist/server.cjs

@@ -3948,8 +3948,12 @@ var server_exports = {};
 __export(server_exports, {
   AIAgent: () => AIAgent,
   AIController: () => AIController,
+  AUTH_SESSIONS_COLLECTION: () => AUTH_SESSIONS_COLLECTION,
   AuthController: () => AuthController,
   CollectionController: () => CollectionController,
+  DEFAULT_LOCK_TIME_MS: () => DEFAULT_LOCK_TIME_MS,
+  DEFAULT_MAX_LOGIN_ATTEMPTS: () => DEFAULT_MAX_LOGIN_ATTEMPTS,
+  DEFAULT_SESSION_EXPIRY: () => DEFAULT_SESSION_EXPIRY,
   EmbeddingService: () => EmbeddingService,
   GlobalController: () => GlobalController,
   InMemoryRateLimitStore: () => InMemoryRateLimitStore,
@@ -3960,7 +3964,11 @@ __export(server_exports, {
   attachRequestMetrics: () => attachRequestMetrics,
   bindObservabilityRuntime: () => bindObservabilityRuntime,
   buildDyrectedSystemPrompt: () => buildDyrectedSystemPrompt,
+  buildInviteEmail: () => buildInviteEmail,
+  buildPasswordChangedEmail: () => buildPasswordChangedEmail,
   buildRequestLogger: () => buildRequestLogger,
+  buildResetPasswordEmail: () => buildResetPasswordEmail,
+  buildWelcomeEmail: () => buildWelcomeEmail,
   captureRequestBody: () => captureRequestBody,
   chunkText: () => chunkText,
   cosineSimilarity: () => cosineSimilarity,
@@ -3968,26 +3976,41 @@ __export(server_exports, {
   createDyrectedApp: () => createDyrectedApp,
   createObservabilityRuntime: () => createObservabilityRuntime,
   createRequestSpan: () => createRequestSpan,
+  decodeCollectionToken: () => decodeCollectionToken,
   endRequestSpan: () => endRequestSpan,
   estimateTokens: () => estimateTokens,
   extractTextFromDoc: () => extractTextFromDoc,
   formatAIErrorMessage: () => formatAIErrorMessage,
   getAIModel: () => getAIModel,
+  getAuthSession: () => getAuthSession,
   getConfigLogger: () => getConfigLogger,
   getEmbeddingModel: () => getEmbeddingModel,
+  getLockedUntilMs: () => getLockedUntilMs,
   getObservabilityRuntime: () => getObservabilityRuntime,
   getRequestLogger: () => getRequestLogger,
   hashContent: () => hashContent,
+  hashPassword: () => hashPassword,
+  isAuthSessionActive: () => isAuthSessionActive,
+  issueAuthSessionToken: () => issueAuthSessionToken,
   normalizeFieldValue: () => normalizeFieldValue,
   redactBody: () => redactBody,
   redactHeaders: () => redactHeaders,
   registerRoutes: () => registerRoutes,
   renderPrometheusMetrics: () => renderPrometheusMetrics,
+  resolveAuthLockoutConfig: () => resolveAuthLockoutConfig,
   resolveObservabilityConfig: () => resolveObservabilityConfig,
+  resolveSessionTokenExpiry: () => resolveSessionTokenExpiry,
+  revokeAllAuthSessions: () => revokeAllAuthSessions,
+  revokeAuthSession: () => revokeAuthSession,
+  sendEmail: () => sendEmail,
   serializeDetailForApi: () => serializeDetailForApi,
   serializeViewForApi: () => serializeViewForApi,
   shouldSampleRequest: () => shouldSampleRequest,
-  validatePayloadAgainstFields: () => validatePayloadAgainstFields
+  signCollectionToken: () => signCollectionToken,
+  touchAuthSession: () => touchAuthSession,
+  validatePayloadAgainstFields: () => validatePayloadAgainstFields,
+  verifyCollectionToken: () => verifyCollectionToken,
+  verifyPassword: () => verifyPassword
 });
 module.exports = __toCommonJS(server_exports);
 
@@ -4829,6 +4852,14 @@ function getSecret() {
   return new TextEncoder().encode(secret);
 }
 var DEFAULT_EXPIRY = "7d";
+var DEFAULT_SESSION_EXPIRY = DEFAULT_EXPIRY;
+function resolveSessionTokenExpiry(collection) {
+  const auth = collection.auth;
+  if (auth && typeof auth === "object" && typeof auth.tokenExpiration === "string" && auth.tokenExpiration.length > 0) {
+    return auth.tokenExpiration;
+  }
+  return DEFAULT_SESSION_EXPIRY;
+}
 async function signCollectionToken(payload, expiresIn = DEFAULT_EXPIRY) {
   return new import_jose.SignJWT({ ...payload }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(expiresIn).sign(getSecret());
 }
@@ -9680,6 +9711,7 @@ var AuthController = class {
       userId: user.id,
       email: user.email,
       collection: this.collection.slug,
+      expiresIn: resolveSessionTokenExpiry(this.collection),
       ip: c.get("clientIp"),
       authSource: "local"
     });
@@ -9771,6 +9803,7 @@ var AuthController = class {
       userId: user.id,
       email: user.email,
       collection: this.collection.slug,
+      expiresIn: resolveSessionTokenExpiry(this.collection),
       ip: c.get("clientIp"),
       authSource: "local"
     });
@@ -9861,12 +9894,15 @@ var AuthController = class {
     }
     const tokenPayload = c.get("authTokenPayload");
     if (tokenPayload?.sid) {
-      const token2 = await signCollectionToken({
-        sub: requestUser.sub,
-        email: requestUser.email,
-        collection: this.collection.slug,
-        sid: tokenPayload.sid
-      });
+      const token2 = await signCollectionToken(
+        {
+          sub: requestUser.sub,
+          email: requestUser.email,
+          collection: this.collection.slug,
+          sid: tokenPayload.sid
+        },
+        resolveSessionTokenExpiry(this.collection)
+      );
       return c.json({ token: token2 });
     }
     const token = await issueAuthSessionToken({
@@ -10128,6 +10164,7 @@ var AuthController = class {
       userId: user.id,
       email: inviteeEmail,
       collection: this.collection.slug,
+      expiresIn: resolveSessionTokenExpiry(this.collection),
       ip: c.get("clientIp"),
       authSource: "local"
     });
@@ -10380,6 +10417,7 @@ var AdminAuthController = class {
       userId: user.id,
       email: user.email,
       collection: adminCollection.slug,
+      expiresIn: resolveSessionTokenExpiry(adminCollection),
       providerId: provider.id,
       authSource: "external",
       ip: c.get("clientIp")
@@ -14669,7 +14707,7 @@ function normalizeConfig(config) {
             name: "roles",
             type: "select",
             label: "Roles",
-            defaultValue: [],
+            defaultValue: "viewer",
             options: [
               { value: "admin", label: "Admin" },
               { value: "editor", label: "Editor" },
@@ -15120,8 +15158,12 @@ init_embedding_service();
 0 && (module.exports = {
   AIAgent,
   AIController,
+  AUTH_SESSIONS_COLLECTION,
   AuthController,
   CollectionController,
+  DEFAULT_LOCK_TIME_MS,
+  DEFAULT_MAX_LOGIN_ATTEMPTS,
+  DEFAULT_SESSION_EXPIRY,
   EmbeddingService,
   GlobalController,
   InMemoryRateLimitStore,
@@ -15132,7 +15174,11 @@ init_embedding_service();
   attachRequestMetrics,
   bindObservabilityRuntime,
   buildDyrectedSystemPrompt,
+  buildInviteEmail,
+  buildPasswordChangedEmail,
   buildRequestLogger,
+  buildResetPasswordEmail,
+  buildWelcomeEmail,
   captureRequestBody,
   chunkText,
   cosineSimilarity,
@@ -15140,24 +15186,39 @@ init_embedding_service();
   createDyrectedApp,
   createObservabilityRuntime,
   createRequestSpan,
+  decodeCollectionToken,
   endRequestSpan,
   estimateTokens,
   extractTextFromDoc,
   formatAIErrorMessage,
   getAIModel,
+  getAuthSession,
   getConfigLogger,
   getEmbeddingModel,
+  getLockedUntilMs,
   getObservabilityRuntime,
   getRequestLogger,
   hashContent,
+  hashPassword,
+  isAuthSessionActive,
+  issueAuthSessionToken,
   normalizeFieldValue,
   redactBody,
   redactHeaders,
   registerRoutes,
   renderPrometheusMetrics,
+  resolveAuthLockoutConfig,
   resolveObservabilityConfig,
+  resolveSessionTokenExpiry,
+  revokeAllAuthSessions,
+  revokeAuthSession,
+  sendEmail,
   serializeDetailForApi,
   serializeViewForApi,
   shouldSampleRequest,
-  validatePayloadAgainstFields
+  signCollectionToken,
+  touchAuthSession,
+  validatePayloadAgainstFields,
+  verifyCollectionToken,
+  verifyPassword
 });

package/dist/server.d.cts

@@ -1,5 +1,5 @@
-import { J as DyrectedContext, D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig, bf as DatabaseAdapter, b as AuthenticatedUser, bt as DyrectedAIContext, al as AIThread, ah as AIMessage, ck as RAGSearchResult, ak as AIRateLimitStore, aj as AIRateLimitResult } from './app-De-3eNn1.cjs';
-export { cV as DyrectedObservabilityRuntime, cW as RequestBodyCapture, cX as RequestTraceContext, cY as ResolvedObservabilityConfig, cZ as attachRequestMetrics, c_ as bindObservabilityRuntime, c$ as buildRequestLogger, d0 as captureRequestBody, d1 as createDyrectedApp, d2 as createObservabilityRuntime, d3 as createRequestSpan, d4 as endRequestSpan, d5 as getConfigLogger, d6 as getObservabilityRuntime, d7 as getRequestLogger, d8 as redactBody, d9 as redactHeaders, da as renderPrometheusMetrics, db as resolveObservabilityConfig, dc as shouldSampleRequest } from './app-De-3eNn1.cjs';
+import { J as DyrectedContext, D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig, bj as DatabaseAdapter, b as AuthenticatedUser, bE as DyrectedAIContext, al as AIThread, ah as AIMessage, cu as RAGSearchResult, ak as AIRateLimitStore, aj as AIRateLimitResult } from './app-Cp8RudRI.cjs';
+export { d8 as CollectionTokenPayload, d9 as DEFAULT_SESSION_EXPIRY, da as DyrectedObservabilityRuntime, db as RequestBodyCapture, dc as RequestTraceContext, dd as ResolvedObservabilityConfig, de as attachRequestMetrics, df as bindObservabilityRuntime, dg as buildRequestLogger, dh as captureRequestBody, di as createDyrectedApp, dj as createObservabilityRuntime, dk as createRequestSpan, dl as decodeCollectionToken, dm as endRequestSpan, dn as getConfigLogger, dp as getObservabilityRuntime, dq as getRequestLogger, dr as redactBody, ds as redactHeaders, dt as renderPrometheusMetrics, du as resolveObservabilityConfig, dv as resolveSessionTokenExpiry, dw as shouldSampleRequest, dx as signCollectionToken, dy as verifyCollectionToken } from './app-Cp8RudRI.cjs';
 import * as hono from 'hono';
 import { Hono, Context, Next } from 'hono';
 import * as hono_utils_http_status from 'hono/utils/http-status';
@@ -434,6 +434,96 @@ declare class AIController {
     }, hono_utils_http_status.ContentfulStatusCode, "json">>;
 }
 
+declare const AUTH_SESSIONS_COLLECTION = "__auth_sessions";
+interface AuthSessionRecord {
+    id: string;
+    userId: string;
+    email: string;
+    collection: string;
+    authSource?: 'local' | 'external';
+    providerId?: string;
+    lastIp?: string;
+    createdAt?: string;
+    updatedAt?: string;
+    lastSeenAt?: string;
+    expiresAt?: string | null;
+    revokedAt?: string | null;
+}
+interface IssueAuthSessionArgs {
+    config: DyrectedConfig;
+    userId: string;
+    email: string;
+    collection: string;
+    expiresIn?: string;
+    authSource?: 'local' | 'external';
+    providerId?: string;
+    ip?: string;
+}
+declare function issueAuthSessionToken(args: IssueAuthSessionArgs): Promise<string>;
+declare function getAuthSession(config: DyrectedConfig, sessionId: string): Promise<AuthSessionRecord | null>;
+declare function isAuthSessionActive(session: AuthSessionRecord | null | undefined): session is AuthSessionRecord;
+declare function touchAuthSession(config: DyrectedConfig, sessionId: string, args: {
+    ip?: string;
+}): Promise<void>;
+declare function revokeAuthSession(config: DyrectedConfig, sessionId: string): Promise<void>;
+declare function revokeAllAuthSessions(config: DyrectedConfig, args: {
+    userId: string;
+    collection: string;
+}): Promise<number>;
+
+/**
+ * Hash a plain-text password using scrypt.
+ * Returns a `salt:hash` string safe to store in the database.
+ */
+declare function hashPassword(plain: string): Promise<string>;
+/**
+ * Verify a plain-text password against a stored `salt:hash` string.
+ */
+declare function verifyPassword(plain: string, stored: string): Promise<boolean>;
+
+declare const DEFAULT_MAX_LOGIN_ATTEMPTS = 5;
+declare const DEFAULT_LOCK_TIME_MS: number;
+type ResolvedAuthLockoutConfig = {
+    enabled: boolean;
+    maxLoginAttempts: number;
+    lockTime: number;
+};
+declare function resolveAuthLockoutConfig(collection: CollectionConfig): ResolvedAuthLockoutConfig;
+declare function getLockedUntilMs(value: unknown): number | null;
+
+declare function sendEmail(config: DyrectedConfig, payload: {
+    to: string;
+    subject: string;
+    html: string;
+}): Promise<void>;
+declare function buildWelcomeEmail(config: DyrectedConfig, args: {
+    email: string;
+}): {
+    subject: string;
+    html: string;
+};
+declare function buildInviteEmail(config: DyrectedConfig, args: {
+    token: string;
+    invitedByEmail?: string;
+    url?: string;
+}): {
+    subject: string;
+    html: string;
+};
+declare function buildResetPasswordEmail(config: DyrectedConfig, args: {
+    token: string;
+    url?: string;
+}): {
+    subject: string;
+    html: string;
+};
+declare function buildPasswordChangedEmail(config: DyrectedConfig, args: {
+    email: string;
+}): {
+    subject: string;
+    html: string;
+};
+
 declare function getAIModel(config?: DyrectedConfig): LanguageModel;
 declare function formatAIErrorMessage(error: any): string;
 declare function buildDyrectedSystemPrompt(context: DyrectedAIContext): string;
@@ -648,4 +738,4 @@ declare class InMemoryRateLimitStore implements AIRateLimitStore {
 }
 declare function aiRateLimit(config?: DyrectedConfig): (c: Context<DyrectedContext>, next: Next) => Promise<void>;
 
-export { AIAgent, type AIAgentOptions, AIController, AuthController, type ChunkOptions, type ChunkResult, CollectionController, type DeleteDocumentChunksOptions, DyrectedContext, EmbeddingService, GlobalController, InMemoryRateLimitStore, type IndexDocumentOptions, MediaController, PreviewController, type RAGSearchOptions, RAGService, type ReindexAllOptions, type ReindexCollectionOptions, aiRateLimit, buildDyrectedSystemPrompt, chunkText, cosineSimilarity, createDyrectedAITools, estimateTokens, extractTextFromDoc, formatAIErrorMessage, getAIModel, getEmbeddingModel, hashContent, normalizeFieldValue, registerRoutes, serializeDetailForApi, serializeViewForApi, validatePayloadAgainstFields };
+export { AIAgent, type AIAgentOptions, AIController, AUTH_SESSIONS_COLLECTION, AuthController, type AuthSessionRecord, type ChunkOptions, type ChunkResult, CollectionController, DEFAULT_LOCK_TIME_MS, DEFAULT_MAX_LOGIN_ATTEMPTS, type DeleteDocumentChunksOptions, DyrectedContext, EmbeddingService, GlobalController, InMemoryRateLimitStore, type IndexDocumentOptions, MediaController, PreviewController, type RAGSearchOptions, RAGService, type ReindexAllOptions, type ReindexCollectionOptions, type ResolvedAuthLockoutConfig, aiRateLimit, buildDyrectedSystemPrompt, buildInviteEmail, buildPasswordChangedEmail, buildResetPasswordEmail, buildWelcomeEmail, chunkText, cosineSimilarity, createDyrectedAITools, estimateTokens, extractTextFromDoc, formatAIErrorMessage, getAIModel, getAuthSession, getEmbeddingModel, getLockedUntilMs, hashContent, hashPassword, isAuthSessionActive, issueAuthSessionToken, normalizeFieldValue, registerRoutes, resolveAuthLockoutConfig, revokeAllAuthSessions, revokeAuthSession, sendEmail, serializeDetailForApi, serializeViewForApi, touchAuthSession, validatePayloadAgainstFields, verifyPassword };

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { J as DyrectedContext, D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig, bf as DatabaseAdapter, b as AuthenticatedUser, bt as DyrectedAIContext, al as AIThread, ah as AIMessage, ck as RAGSearchResult, ak as AIRateLimitStore, aj as AIRateLimitResult } from './app-De-3eNn1.js';
-export { cV as DyrectedObservabilityRuntime, cW as RequestBodyCapture, cX as RequestTraceContext, cY as ResolvedObservabilityConfig, cZ as attachRequestMetrics, c_ as bindObservabilityRuntime, c$ as buildRequestLogger, d0 as captureRequestBody, d1 as createDyrectedApp, d2 as createObservabilityRuntime, d3 as createRequestSpan, d4 as endRequestSpan, d5 as getConfigLogger, d6 as getObservabilityRuntime, d7 as getRequestLogger, d8 as redactBody, d9 as redactHeaders, da as renderPrometheusMetrics, db as resolveObservabilityConfig, dc as shouldSampleRequest } from './app-De-3eNn1.js';
+import { J as DyrectedContext, D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig, bj as DatabaseAdapter, b as AuthenticatedUser, bE as DyrectedAIContext, al as AIThread, ah as AIMessage, cu as RAGSearchResult, ak as AIRateLimitStore, aj as AIRateLimitResult } from './app-Cp8RudRI.js';
+export { d8 as CollectionTokenPayload, d9 as DEFAULT_SESSION_EXPIRY, da as DyrectedObservabilityRuntime, db as RequestBodyCapture, dc as RequestTraceContext, dd as ResolvedObservabilityConfig, de as attachRequestMetrics, df as bindObservabilityRuntime, dg as buildRequestLogger, dh as captureRequestBody, di as createDyrectedApp, dj as createObservabilityRuntime, dk as createRequestSpan, dl as decodeCollectionToken, dm as endRequestSpan, dn as getConfigLogger, dp as getObservabilityRuntime, dq as getRequestLogger, dr as redactBody, ds as redactHeaders, dt as renderPrometheusMetrics, du as resolveObservabilityConfig, dv as resolveSessionTokenExpiry, dw as shouldSampleRequest, dx as signCollectionToken, dy as verifyCollectionToken } from './app-Cp8RudRI.js';
 import * as hono from 'hono';
 import { Hono, Context, Next } from 'hono';
 import * as hono_utils_http_status from 'hono/utils/http-status';
@@ -434,6 +434,96 @@ declare class AIController {
     }, hono_utils_http_status.ContentfulStatusCode, "json">>;
 }
 
+declare const AUTH_SESSIONS_COLLECTION = "__auth_sessions";
+interface AuthSessionRecord {
+    id: string;
+    userId: string;
+    email: string;
+    collection: string;
+    authSource?: 'local' | 'external';
+    providerId?: string;
+    lastIp?: string;
+    createdAt?: string;
+    updatedAt?: string;
+    lastSeenAt?: string;
+    expiresAt?: string | null;
+    revokedAt?: string | null;
+}
+interface IssueAuthSessionArgs {
+    config: DyrectedConfig;
+    userId: string;
+    email: string;
+    collection: string;
+    expiresIn?: string;
+    authSource?: 'local' | 'external';
+    providerId?: string;
+    ip?: string;
+}
+declare function issueAuthSessionToken(args: IssueAuthSessionArgs): Promise<string>;
+declare function getAuthSession(config: DyrectedConfig, sessionId: string): Promise<AuthSessionRecord | null>;
+declare function isAuthSessionActive(session: AuthSessionRecord | null | undefined): session is AuthSessionRecord;
+declare function touchAuthSession(config: DyrectedConfig, sessionId: string, args: {
+    ip?: string;
+}): Promise<void>;
+declare function revokeAuthSession(config: DyrectedConfig, sessionId: string): Promise<void>;
+declare function revokeAllAuthSessions(config: DyrectedConfig, args: {
+    userId: string;
+    collection: string;
+}): Promise<number>;
+
+/**
+ * Hash a plain-text password using scrypt.
+ * Returns a `salt:hash` string safe to store in the database.
+ */
+declare function hashPassword(plain: string): Promise<string>;
+/**
+ * Verify a plain-text password against a stored `salt:hash` string.
+ */
+declare function verifyPassword(plain: string, stored: string): Promise<boolean>;
+
+declare const DEFAULT_MAX_LOGIN_ATTEMPTS = 5;
+declare const DEFAULT_LOCK_TIME_MS: number;
+type ResolvedAuthLockoutConfig = {
+    enabled: boolean;
+    maxLoginAttempts: number;
+    lockTime: number;
+};
+declare function resolveAuthLockoutConfig(collection: CollectionConfig): ResolvedAuthLockoutConfig;
+declare function getLockedUntilMs(value: unknown): number | null;
+
+declare function sendEmail(config: DyrectedConfig, payload: {
+    to: string;
+    subject: string;
+    html: string;
+}): Promise<void>;
+declare function buildWelcomeEmail(config: DyrectedConfig, args: {
+    email: string;
+}): {
+    subject: string;
+    html: string;
+};
+declare function buildInviteEmail(config: DyrectedConfig, args: {
+    token: string;
+    invitedByEmail?: string;
+    url?: string;
+}): {
+    subject: string;
+    html: string;
+};
+declare function buildResetPasswordEmail(config: DyrectedConfig, args: {
+    token: string;
+    url?: string;
+}): {
+    subject: string;
+    html: string;
+};
+declare function buildPasswordChangedEmail(config: DyrectedConfig, args: {
+    email: string;
+}): {
+    subject: string;
+    html: string;
+};
+
 declare function getAIModel(config?: DyrectedConfig): LanguageModel;
 declare function formatAIErrorMessage(error: any): string;
 declare function buildDyrectedSystemPrompt(context: DyrectedAIContext): string;
@@ -648,4 +738,4 @@ declare class InMemoryRateLimitStore implements AIRateLimitStore {
 }
 declare function aiRateLimit(config?: DyrectedConfig): (c: Context<DyrectedContext>, next: Next) => Promise<void>;
 
-export { AIAgent, type AIAgentOptions, AIController, AuthController, type ChunkOptions, type ChunkResult, CollectionController, type DeleteDocumentChunksOptions, DyrectedContext, EmbeddingService, GlobalController, InMemoryRateLimitStore, type IndexDocumentOptions, MediaController, PreviewController, type RAGSearchOptions, RAGService, type ReindexAllOptions, type ReindexCollectionOptions, aiRateLimit, buildDyrectedSystemPrompt, chunkText, cosineSimilarity, createDyrectedAITools, estimateTokens, extractTextFromDoc, formatAIErrorMessage, getAIModel, getEmbeddingModel, hashContent, normalizeFieldValue, registerRoutes, serializeDetailForApi, serializeViewForApi, validatePayloadAgainstFields };
+export { AIAgent, type AIAgentOptions, AIController, AUTH_SESSIONS_COLLECTION, AuthController, type AuthSessionRecord, type ChunkOptions, type ChunkResult, CollectionController, DEFAULT_LOCK_TIME_MS, DEFAULT_MAX_LOGIN_ATTEMPTS, type DeleteDocumentChunksOptions, DyrectedContext, EmbeddingService, GlobalController, InMemoryRateLimitStore, type IndexDocumentOptions, MediaController, PreviewController, type RAGSearchOptions, RAGService, type ReindexAllOptions, type ReindexCollectionOptions, type ResolvedAuthLockoutConfig, aiRateLimit, buildDyrectedSystemPrompt, buildInviteEmail, buildPasswordChangedEmail, buildResetPasswordEmail, buildWelcomeEmail, chunkText, cosineSimilarity, createDyrectedAITools, estimateTokens, extractTextFromDoc, formatAIErrorMessage, getAIModel, getAuthSession, getEmbeddingModel, getLockedUntilMs, hashContent, hashPassword, isAuthSessionActive, issueAuthSessionToken, normalizeFieldValue, registerRoutes, resolveAuthLockoutConfig, revokeAllAuthSessions, revokeAuthSession, sendEmail, serializeDetailForApi, serializeViewForApi, touchAuthSession, validatePayloadAgainstFields, verifyPassword };