@dyrected/core 2.13.6 → 2.15.0

package/dist/server.cjs

@@ -2307,6 +2307,12 @@ var init_chunker = __esm({
 });
 
 // src/services/rag/embedding.service.ts
+function hasEmbeddingApiKey(config) {
+  const ai = config?.ai;
+  return Boolean(
+    ai?.apiKey || process.env.OPENROUTER_API_KEY || process.env.OPENAI_API_KEY || process.env.GEMINI_API_KEY || process.env.GOOGLE_GENERATIVE_AI_API_KEY
+  );
+}
 function getEmbeddingModel(config) {
   const ai = config?.ai;
   const provider = ai?.provider;
@@ -2649,6 +2655,9 @@ var init_rag_service = __esm({
         if (!col || !this.isCollectionRAGEnabled(config, col)) {
           return { indexed: 0, skipped: 0 };
         }
+        if (!hasEmbeddingApiKey(config)) {
+          return { indexed: 0, skipped: 0 };
+        }
         const docId = String(doc.id || doc._id || "");
         if (!docId) return { indexed: 0, skipped: 0 };
         const ragConfig = col.ai?.rag;
@@ -3948,8 +3957,12 @@ var server_exports = {};
 __export(server_exports, {
   AIAgent: () => AIAgent,
   AIController: () => AIController,
+  AUTH_SESSIONS_COLLECTION: () => AUTH_SESSIONS_COLLECTION,
   AuthController: () => AuthController,
   CollectionController: () => CollectionController,
+  DEFAULT_LOCK_TIME_MS: () => DEFAULT_LOCK_TIME_MS,
+  DEFAULT_MAX_LOGIN_ATTEMPTS: () => DEFAULT_MAX_LOGIN_ATTEMPTS,
+  DEFAULT_SESSION_EXPIRY: () => DEFAULT_SESSION_EXPIRY,
   EmbeddingService: () => EmbeddingService,
   GlobalController: () => GlobalController,
   InMemoryRateLimitStore: () => InMemoryRateLimitStore,
@@ -3960,7 +3973,11 @@ __export(server_exports, {
   attachRequestMetrics: () => attachRequestMetrics,
   bindObservabilityRuntime: () => bindObservabilityRuntime,
   buildDyrectedSystemPrompt: () => buildDyrectedSystemPrompt,
+  buildInviteEmail: () => buildInviteEmail,
+  buildPasswordChangedEmail: () => buildPasswordChangedEmail,
   buildRequestLogger: () => buildRequestLogger,
+  buildResetPasswordEmail: () => buildResetPasswordEmail,
+  buildWelcomeEmail: () => buildWelcomeEmail,
   captureRequestBody: () => captureRequestBody,
   chunkText: () => chunkText,
   cosineSimilarity: () => cosineSimilarity,
@@ -3968,26 +3985,42 @@ __export(server_exports, {
   createDyrectedApp: () => createDyrectedApp,
   createObservabilityRuntime: () => createObservabilityRuntime,
   createRequestSpan: () => createRequestSpan,
+  decodeCollectionToken: () => decodeCollectionToken,
   endRequestSpan: () => endRequestSpan,
   estimateTokens: () => estimateTokens,
   extractTextFromDoc: () => extractTextFromDoc,
   formatAIErrorMessage: () => formatAIErrorMessage,
   getAIModel: () => getAIModel,
+  getAuthSession: () => getAuthSession,
   getConfigLogger: () => getConfigLogger,
   getEmbeddingModel: () => getEmbeddingModel,
+  getLockedUntilMs: () => getLockedUntilMs,
   getObservabilityRuntime: () => getObservabilityRuntime,
   getRequestLogger: () => getRequestLogger,
+  hasEmbeddingApiKey: () => hasEmbeddingApiKey,
   hashContent: () => hashContent,
+  hashPassword: () => hashPassword,
+  isAuthSessionActive: () => isAuthSessionActive,
+  issueAuthSessionToken: () => issueAuthSessionToken,
   normalizeFieldValue: () => normalizeFieldValue,
   redactBody: () => redactBody,
   redactHeaders: () => redactHeaders,
   registerRoutes: () => registerRoutes,
   renderPrometheusMetrics: () => renderPrometheusMetrics,
+  resolveAuthLockoutConfig: () => resolveAuthLockoutConfig,
   resolveObservabilityConfig: () => resolveObservabilityConfig,
+  resolveSessionTokenExpiry: () => resolveSessionTokenExpiry,
+  revokeAllAuthSessions: () => revokeAllAuthSessions,
+  revokeAuthSession: () => revokeAuthSession,
+  sendEmail: () => sendEmail,
   serializeDetailForApi: () => serializeDetailForApi,
   serializeViewForApi: () => serializeViewForApi,
   shouldSampleRequest: () => shouldSampleRequest,
-  validatePayloadAgainstFields: () => validatePayloadAgainstFields
+  signCollectionToken: () => signCollectionToken,
+  touchAuthSession: () => touchAuthSession,
+  validatePayloadAgainstFields: () => validatePayloadAgainstFields,
+  verifyCollectionToken: () => verifyCollectionToken,
+  verifyPassword: () => verifyPassword
 });
 module.exports = __toCommonJS(server_exports);
 
@@ -4829,6 +4862,14 @@ function getSecret() {
   return new TextEncoder().encode(secret);
 }
 var DEFAULT_EXPIRY = "7d";
+var DEFAULT_SESSION_EXPIRY = DEFAULT_EXPIRY;
+function resolveSessionTokenExpiry(collection) {
+  const auth = collection.auth;
+  if (auth && typeof auth === "object" && typeof auth.tokenExpiration === "string" && auth.tokenExpiration.length > 0) {
+    return auth.tokenExpiration;
+  }
+  return DEFAULT_SESSION_EXPIRY;
+}
 async function signCollectionToken(payload, expiresIn = DEFAULT_EXPIRY) {
   return new import_jose.SignJWT({ ...payload }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(expiresIn).sign(getSecret());
 }
@@ -7783,13 +7824,13 @@ var CollectionController = class {
     const config = c.get("config");
     const db = config.db;
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!this.collection.views?.length) {
-      return c.json({ error: true, message: `Collection ${this.collection.slug} has no views` }, 404);
+    if (!this.collection.views?.length && !this.collection.actions?.length) {
+      return c.json({ error: true, message: `Collection ${this.collection.slug} has no views or actions` }, 404);
     }
     const actionName = c.req.param("action");
     const viewSlugParam = c.req.param("viewSlug");
     let action;
-    for (const view2 of this.collection.views) {
+    for (const view2 of this.collection.views ?? []) {
       if (viewSlugParam && view2.slug !== viewSlugParam) continue;
       const match = view2.actions?.find((candidate) => candidate.name === actionName);
       if (match) {
@@ -7797,6 +7838,9 @@ var CollectionController = class {
         break;
       }
     }
+    if (!action && !viewSlugParam) {
+      action = this.collection.actions?.find((candidate) => candidate.name === actionName);
+    }
     if (!action) {
       return c.json(
         { error: true, message: `Action "${actionName}" was not found${viewSlugParam ? ` in view "${viewSlugParam}"` : ""}` },
@@ -7814,7 +7858,7 @@ var CollectionController = class {
     const input = body?.input ?? {};
     const user = c.get("user");
     const accessArgs = { user, req: this.toHookRequestContext(c) };
-    const view = viewSlugParam ? this.collection.views.find((candidate) => candidate.slug === viewSlugParam) : void 0;
+    const view = viewSlugParam ? this.collection.views?.find((candidate) => candidate.slug === viewSlugParam) : void 0;
     if (view?.access) {
       const allowed = await resolveBooleanAccess(config, view.access.update ?? view.access.read ?? true, {
         ...accessArgs,
@@ -7852,7 +7896,8 @@ var CollectionController = class {
           });
           resolvedData = handlerResult ?? {};
         } catch (error) {
-          results.push({ id, ok: false, status: 500, error: error instanceof Error ? error.message : String(error) });
+          const status = typeof error.statusCode === "number" ? error.statusCode : 500;
+          results.push({ id, ok: false, status, error: error instanceof Error ? error.message : String(error) });
           continue;
         }
       } else {
@@ -7875,7 +7920,8 @@ var CollectionController = class {
     if (requestedIds.length === 1) {
       const single = results[0];
       if (!single.ok) {
-        return c.json(single.error ?? { error: true, message: "Action failed" }, single.status ?? 500);
+        const body2 = typeof single.error === "string" ? { error: true, message: single.error } : single.error ?? { error: true, message: "Action failed" };
+        return c.json(body2, single.status ?? 500);
       }
       return c.json(single.doc);
     }
@@ -9680,6 +9726,7 @@ var AuthController = class {
       userId: user.id,
       email: user.email,
       collection: this.collection.slug,
+      expiresIn: resolveSessionTokenExpiry(this.collection),
       ip: c.get("clientIp"),
       authSource: "local"
     });
@@ -9771,6 +9818,7 @@ var AuthController = class {
       userId: user.id,
       email: user.email,
       collection: this.collection.slug,
+      expiresIn: resolveSessionTokenExpiry(this.collection),
       ip: c.get("clientIp"),
       authSource: "local"
     });
@@ -9861,12 +9909,15 @@ var AuthController = class {
     }
     const tokenPayload = c.get("authTokenPayload");
     if (tokenPayload?.sid) {
-      const token2 = await signCollectionToken({
-        sub: requestUser.sub,
-        email: requestUser.email,
-        collection: this.collection.slug,
-        sid: tokenPayload.sid
-      });
+      const token2 = await signCollectionToken(
+        {
+          sub: requestUser.sub,
+          email: requestUser.email,
+          collection: this.collection.slug,
+          sid: tokenPayload.sid
+        },
+        resolveSessionTokenExpiry(this.collection)
+      );
       return c.json({ token: token2 });
     }
     const token = await issueAuthSessionToken({
@@ -10128,6 +10179,7 @@ var AuthController = class {
       userId: user.id,
       email: inviteeEmail,
       collection: this.collection.slug,
+      expiresIn: resolveSessionTokenExpiry(this.collection),
       ip: c.get("clientIp"),
       authSource: "local"
     });
@@ -10380,6 +10432,7 @@ var AdminAuthController = class {
       userId: user.id,
       email: user.email,
       collection: adminCollection.slug,
+      expiresIn: resolveSessionTokenExpiry(adminCollection),
       providerId: provider.id,
       authSource: "external",
       ip: c.get("clientIp")
@@ -14313,6 +14366,8 @@ function registerRoutes(app, config) {
     app.post(`${path}/aggregate`, (c) => controller.aggregate(c));
     if (collection.views?.length) {
       app.post(`${path}/views/:viewSlug/actions/:action`, optionalAuth(config), (c) => controller.runViewAction(c));
+    }
+    if (collection.views?.length || collection.actions?.length) {
       app.post(`${path}/actions/:action`, optionalAuth(config), (c) => controller.runViewAction(c));
     }
     if (collection.audit) {
@@ -15090,6 +15145,8 @@ async function createDyrectedApp(rawConfig) {
     if (err instanceof import_http_exception6.HTTPException) {
       return c.json({ error: true, message: err.message }, err.status);
     }
+    const statusCode = err.statusCode;
+    const status = typeof statusCode === "number" && Number.isInteger(statusCode) && statusCode >= 400 && statusCode <= 599 ? statusCode : 500;
     const logger = getRequestLogger(c, "core");
     logger.error({
       err,
@@ -15102,9 +15159,10 @@ async function createDyrectedApp(rawConfig) {
       method: c.req.method
     });
     return c.json({
+      error: true,
       message: err.message || "Internal Server Error",
       stack: process.env.NODE_ENV === "development" ? err.stack : void 0
-    }, 500);
+    }, status);
   });
   registerRoutes(app, config);
   return app;
@@ -15120,8 +15178,12 @@ init_embedding_service();
 0 && (module.exports = {
   AIAgent,
   AIController,
+  AUTH_SESSIONS_COLLECTION,
   AuthController,
   CollectionController,
+  DEFAULT_LOCK_TIME_MS,
+  DEFAULT_MAX_LOGIN_ATTEMPTS,
+  DEFAULT_SESSION_EXPIRY,
   EmbeddingService,
   GlobalController,
   InMemoryRateLimitStore,
@@ -15132,7 +15194,11 @@ init_embedding_service();
   attachRequestMetrics,
   bindObservabilityRuntime,
   buildDyrectedSystemPrompt,
+  buildInviteEmail,
+  buildPasswordChangedEmail,
   buildRequestLogger,
+  buildResetPasswordEmail,
+  buildWelcomeEmail,
   captureRequestBody,
   chunkText,
   cosineSimilarity,
@@ -15140,24 +15206,40 @@ init_embedding_service();
   createDyrectedApp,
   createObservabilityRuntime,
   createRequestSpan,
+  decodeCollectionToken,
   endRequestSpan,
   estimateTokens,
   extractTextFromDoc,
   formatAIErrorMessage,
   getAIModel,
+  getAuthSession,
   getConfigLogger,
   getEmbeddingModel,
+  getLockedUntilMs,
   getObservabilityRuntime,
   getRequestLogger,
+  hasEmbeddingApiKey,
   hashContent,
+  hashPassword,
+  isAuthSessionActive,
+  issueAuthSessionToken,
   normalizeFieldValue,
   redactBody,
   redactHeaders,
   registerRoutes,
   renderPrometheusMetrics,
+  resolveAuthLockoutConfig,
   resolveObservabilityConfig,
+  resolveSessionTokenExpiry,
+  revokeAllAuthSessions,
+  revokeAuthSession,
+  sendEmail,
   serializeDetailForApi,
   serializeViewForApi,
   shouldSampleRequest,
-  validatePayloadAgainstFields
+  signCollectionToken,
+  touchAuthSession,
+  validatePayloadAgainstFields,
+  verifyCollectionToken,
+  verifyPassword
 });

package/dist/server.d.cts

@@ -1,5 +1,5 @@
-import { J as DyrectedContext, D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig, bj as DatabaseAdapter, b as AuthenticatedUser, bE as DyrectedAIContext, al as AIThread, ah as AIMessage, cu as RAGSearchResult, ak as AIRateLimitStore, aj as AIRateLimitResult } from './app-phLVsEOM.cjs';
-export { d8 as DyrectedObservabilityRuntime, d9 as RequestBodyCapture, da as RequestTraceContext, db as ResolvedObservabilityConfig, dc as attachRequestMetrics, dd as bindObservabilityRuntime, de as buildRequestLogger, df as captureRequestBody, dg as createDyrectedApp, dh as createObservabilityRuntime, di as createRequestSpan, dj as endRequestSpan, dk as getConfigLogger, dl as getObservabilityRuntime, dm as getRequestLogger, dn as redactBody, dp as redactHeaders, dq as renderPrometheusMetrics, dr as resolveObservabilityConfig, ds as shouldSampleRequest } from './app-phLVsEOM.cjs';
+import { M as DyrectedContext, D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig, bl as DatabaseAdapter, b as AuthenticatedUser, bG as DyrectedAIContext, an as AIThread, aj as AIMessage, cw as RAGSearchResult, am as AIRateLimitStore, al as AIRateLimitResult } from './app-Cmp5lFLJ.cjs';
+export { da as CollectionTokenPayload, db as DEFAULT_SESSION_EXPIRY, dc as DyrectedObservabilityRuntime, dd as RequestBodyCapture, de as RequestTraceContext, df as ResolvedObservabilityConfig, dg as attachRequestMetrics, dh as bindObservabilityRuntime, di as buildRequestLogger, dj as captureRequestBody, dk as createDyrectedApp, dl as createObservabilityRuntime, dm as createRequestSpan, dn as decodeCollectionToken, dp as endRequestSpan, dq as getConfigLogger, dr as getObservabilityRuntime, ds as getRequestLogger, dt as redactBody, du as redactHeaders, dv as renderPrometheusMetrics, dw as resolveObservabilityConfig, dx as resolveSessionTokenExpiry, dy as shouldSampleRequest, dz as signCollectionToken, dA as verifyCollectionToken } from './app-Cmp5lFLJ.cjs';
 import * as hono from 'hono';
 import { Hono, Context, Next } from 'hono';
 import * as hono_utils_http_status from 'hono/utils/http-status';
@@ -434,6 +434,96 @@ declare class AIController {
     }, hono_utils_http_status.ContentfulStatusCode, "json">>;
 }
 
+declare const AUTH_SESSIONS_COLLECTION = "__auth_sessions";
+interface AuthSessionRecord {
+    id: string;
+    userId: string;
+    email: string;
+    collection: string;
+    authSource?: 'local' | 'external';
+    providerId?: string;
+    lastIp?: string;
+    createdAt?: string;
+    updatedAt?: string;
+    lastSeenAt?: string;
+    expiresAt?: string | null;
+    revokedAt?: string | null;
+}
+interface IssueAuthSessionArgs {
+    config: DyrectedConfig;
+    userId: string;
+    email: string;
+    collection: string;
+    expiresIn?: string;
+    authSource?: 'local' | 'external';
+    providerId?: string;
+    ip?: string;
+}
+declare function issueAuthSessionToken(args: IssueAuthSessionArgs): Promise<string>;
+declare function getAuthSession(config: DyrectedConfig, sessionId: string): Promise<AuthSessionRecord | null>;
+declare function isAuthSessionActive(session: AuthSessionRecord | null | undefined): session is AuthSessionRecord;
+declare function touchAuthSession(config: DyrectedConfig, sessionId: string, args: {
+    ip?: string;
+}): Promise<void>;
+declare function revokeAuthSession(config: DyrectedConfig, sessionId: string): Promise<void>;
+declare function revokeAllAuthSessions(config: DyrectedConfig, args: {
+    userId: string;
+    collection: string;
+}): Promise<number>;
+
+/**
+ * Hash a plain-text password using scrypt.
+ * Returns a `salt:hash` string safe to store in the database.
+ */
+declare function hashPassword(plain: string): Promise<string>;
+/**
+ * Verify a plain-text password against a stored `salt:hash` string.
+ */
+declare function verifyPassword(plain: string, stored: string): Promise<boolean>;
+
+declare const DEFAULT_MAX_LOGIN_ATTEMPTS = 5;
+declare const DEFAULT_LOCK_TIME_MS: number;
+type ResolvedAuthLockoutConfig = {
+    enabled: boolean;
+    maxLoginAttempts: number;
+    lockTime: number;
+};
+declare function resolveAuthLockoutConfig(collection: CollectionConfig): ResolvedAuthLockoutConfig;
+declare function getLockedUntilMs(value: unknown): number | null;
+
+declare function sendEmail(config: DyrectedConfig, payload: {
+    to: string;
+    subject: string;
+    html: string;
+}): Promise<void>;
+declare function buildWelcomeEmail(config: DyrectedConfig, args: {
+    email: string;
+}): {
+    subject: string;
+    html: string;
+};
+declare function buildInviteEmail(config: DyrectedConfig, args: {
+    token: string;
+    invitedByEmail?: string;
+    url?: string;
+}): {
+    subject: string;
+    html: string;
+};
+declare function buildResetPasswordEmail(config: DyrectedConfig, args: {
+    token: string;
+    url?: string;
+}): {
+    subject: string;
+    html: string;
+};
+declare function buildPasswordChangedEmail(config: DyrectedConfig, args: {
+    email: string;
+}): {
+    subject: string;
+    html: string;
+};
+
 declare function getAIModel(config?: DyrectedConfig): LanguageModel;
 declare function formatAIErrorMessage(error: any): string;
 declare function buildDyrectedSystemPrompt(context: DyrectedAIContext): string;
@@ -626,6 +716,13 @@ declare function estimateTokens(text: string): number;
  */
 declare function chunkText(text: string, options?: ChunkOptions): ChunkResult[];
 
+/**
+ * Whether any embedding API key is resolvable for this config. Mirrors the
+ * key sources consulted by `getEmbeddingModel` without constructing a
+ * provider. When this returns false, RAG indexing can never succeed, so
+ * callers should skip silently instead of throwing and logging noise.
+ */
+declare function hasEmbeddingApiKey(config?: DyrectedConfig): boolean;
 declare function getEmbeddingModel(config?: DyrectedConfig): EmbeddingModel;
 declare class EmbeddingService {
     private config?;
@@ -648,4 +745,4 @@ declare class InMemoryRateLimitStore implements AIRateLimitStore {
 }
 declare function aiRateLimit(config?: DyrectedConfig): (c: Context<DyrectedContext>, next: Next) => Promise<void>;
 
-export { AIAgent, type AIAgentOptions, AIController, AuthController, type ChunkOptions, type ChunkResult, CollectionController, type DeleteDocumentChunksOptions, DyrectedContext, EmbeddingService, GlobalController, InMemoryRateLimitStore, type IndexDocumentOptions, MediaController, PreviewController, type RAGSearchOptions, RAGService, type ReindexAllOptions, type ReindexCollectionOptions, aiRateLimit, buildDyrectedSystemPrompt, chunkText, cosineSimilarity, createDyrectedAITools, estimateTokens, extractTextFromDoc, formatAIErrorMessage, getAIModel, getEmbeddingModel, hashContent, normalizeFieldValue, registerRoutes, serializeDetailForApi, serializeViewForApi, validatePayloadAgainstFields };
+export { AIAgent, type AIAgentOptions, AIController, AUTH_SESSIONS_COLLECTION, AuthController, type AuthSessionRecord, type ChunkOptions, type ChunkResult, CollectionController, DEFAULT_LOCK_TIME_MS, DEFAULT_MAX_LOGIN_ATTEMPTS, type DeleteDocumentChunksOptions, DyrectedContext, EmbeddingService, GlobalController, InMemoryRateLimitStore, type IndexDocumentOptions, MediaController, PreviewController, type RAGSearchOptions, RAGService, type ReindexAllOptions, type ReindexCollectionOptions, type ResolvedAuthLockoutConfig, aiRateLimit, buildDyrectedSystemPrompt, buildInviteEmail, buildPasswordChangedEmail, buildResetPasswordEmail, buildWelcomeEmail, chunkText, cosineSimilarity, createDyrectedAITools, estimateTokens, extractTextFromDoc, formatAIErrorMessage, getAIModel, getAuthSession, getEmbeddingModel, getLockedUntilMs, hasEmbeddingApiKey, hashContent, hashPassword, isAuthSessionActive, issueAuthSessionToken, normalizeFieldValue, registerRoutes, resolveAuthLockoutConfig, revokeAllAuthSessions, revokeAuthSession, sendEmail, serializeDetailForApi, serializeViewForApi, touchAuthSession, validatePayloadAgainstFields, verifyPassword };

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { J as DyrectedContext, D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig, bj as DatabaseAdapter, b as AuthenticatedUser, bE as DyrectedAIContext, al as AIThread, ah as AIMessage, cu as RAGSearchResult, ak as AIRateLimitStore, aj as AIRateLimitResult } from './app-phLVsEOM.js';
-export { d8 as DyrectedObservabilityRuntime, d9 as RequestBodyCapture, da as RequestTraceContext, db as ResolvedObservabilityConfig, dc as attachRequestMetrics, dd as bindObservabilityRuntime, de as buildRequestLogger, df as captureRequestBody, dg as createDyrectedApp, dh as createObservabilityRuntime, di as createRequestSpan, dj as endRequestSpan, dk as getConfigLogger, dl as getObservabilityRuntime, dm as getRequestLogger, dn as redactBody, dp as redactHeaders, dq as renderPrometheusMetrics, dr as resolveObservabilityConfig, ds as shouldSampleRequest } from './app-phLVsEOM.js';
+import { M as DyrectedContext, D as DyrectedConfig, C as CollectionConfig, G as GlobalConfig, bl as DatabaseAdapter, b as AuthenticatedUser, bG as DyrectedAIContext, an as AIThread, aj as AIMessage, cw as RAGSearchResult, am as AIRateLimitStore, al as AIRateLimitResult } from './app-Cmp5lFLJ.js';
+export { da as CollectionTokenPayload, db as DEFAULT_SESSION_EXPIRY, dc as DyrectedObservabilityRuntime, dd as RequestBodyCapture, de as RequestTraceContext, df as ResolvedObservabilityConfig, dg as attachRequestMetrics, dh as bindObservabilityRuntime, di as buildRequestLogger, dj as captureRequestBody, dk as createDyrectedApp, dl as createObservabilityRuntime, dm as createRequestSpan, dn as decodeCollectionToken, dp as endRequestSpan, dq as getConfigLogger, dr as getObservabilityRuntime, ds as getRequestLogger, dt as redactBody, du as redactHeaders, dv as renderPrometheusMetrics, dw as resolveObservabilityConfig, dx as resolveSessionTokenExpiry, dy as shouldSampleRequest, dz as signCollectionToken, dA as verifyCollectionToken } from './app-Cmp5lFLJ.js';
 import * as hono from 'hono';
 import { Hono, Context, Next } from 'hono';
 import * as hono_utils_http_status from 'hono/utils/http-status';
@@ -434,6 +434,96 @@ declare class AIController {
     }, hono_utils_http_status.ContentfulStatusCode, "json">>;
 }
 
+declare const AUTH_SESSIONS_COLLECTION = "__auth_sessions";
+interface AuthSessionRecord {
+    id: string;
+    userId: string;
+    email: string;
+    collection: string;
+    authSource?: 'local' | 'external';
+    providerId?: string;
+    lastIp?: string;
+    createdAt?: string;
+    updatedAt?: string;
+    lastSeenAt?: string;
+    expiresAt?: string | null;
+    revokedAt?: string | null;
+}
+interface IssueAuthSessionArgs {
+    config: DyrectedConfig;
+    userId: string;
+    email: string;
+    collection: string;
+    expiresIn?: string;
+    authSource?: 'local' | 'external';
+    providerId?: string;
+    ip?: string;
+}
+declare function issueAuthSessionToken(args: IssueAuthSessionArgs): Promise<string>;
+declare function getAuthSession(config: DyrectedConfig, sessionId: string): Promise<AuthSessionRecord | null>;
+declare function isAuthSessionActive(session: AuthSessionRecord | null | undefined): session is AuthSessionRecord;
+declare function touchAuthSession(config: DyrectedConfig, sessionId: string, args: {
+    ip?: string;
+}): Promise<void>;
+declare function revokeAuthSession(config: DyrectedConfig, sessionId: string): Promise<void>;
+declare function revokeAllAuthSessions(config: DyrectedConfig, args: {
+    userId: string;
+    collection: string;
+}): Promise<number>;
+
+/**
+ * Hash a plain-text password using scrypt.
+ * Returns a `salt:hash` string safe to store in the database.
+ */
+declare function hashPassword(plain: string): Promise<string>;
+/**
+ * Verify a plain-text password against a stored `salt:hash` string.
+ */
+declare function verifyPassword(plain: string, stored: string): Promise<boolean>;
+
+declare const DEFAULT_MAX_LOGIN_ATTEMPTS = 5;
+declare const DEFAULT_LOCK_TIME_MS: number;
+type ResolvedAuthLockoutConfig = {
+    enabled: boolean;
+    maxLoginAttempts: number;
+    lockTime: number;
+};
+declare function resolveAuthLockoutConfig(collection: CollectionConfig): ResolvedAuthLockoutConfig;
+declare function getLockedUntilMs(value: unknown): number | null;
+
+declare function sendEmail(config: DyrectedConfig, payload: {
+    to: string;
+    subject: string;
+    html: string;
+}): Promise<void>;
+declare function buildWelcomeEmail(config: DyrectedConfig, args: {
+    email: string;
+}): {
+    subject: string;
+    html: string;
+};
+declare function buildInviteEmail(config: DyrectedConfig, args: {
+    token: string;
+    invitedByEmail?: string;
+    url?: string;
+}): {
+    subject: string;
+    html: string;
+};
+declare function buildResetPasswordEmail(config: DyrectedConfig, args: {
+    token: string;
+    url?: string;
+}): {
+    subject: string;
+    html: string;
+};
+declare function buildPasswordChangedEmail(config: DyrectedConfig, args: {
+    email: string;
+}): {
+    subject: string;
+    html: string;
+};
+
 declare function getAIModel(config?: DyrectedConfig): LanguageModel;
 declare function formatAIErrorMessage(error: any): string;
 declare function buildDyrectedSystemPrompt(context: DyrectedAIContext): string;
@@ -626,6 +716,13 @@ declare function estimateTokens(text: string): number;
  */
 declare function chunkText(text: string, options?: ChunkOptions): ChunkResult[];
 
+/**
+ * Whether any embedding API key is resolvable for this config. Mirrors the
+ * key sources consulted by `getEmbeddingModel` without constructing a
+ * provider. When this returns false, RAG indexing can never succeed, so
+ * callers should skip silently instead of throwing and logging noise.
+ */
+declare function hasEmbeddingApiKey(config?: DyrectedConfig): boolean;
 declare function getEmbeddingModel(config?: DyrectedConfig): EmbeddingModel;
 declare class EmbeddingService {
     private config?;
@@ -648,4 +745,4 @@ declare class InMemoryRateLimitStore implements AIRateLimitStore {
 }
 declare function aiRateLimit(config?: DyrectedConfig): (c: Context<DyrectedContext>, next: Next) => Promise<void>;
 
-export { AIAgent, type AIAgentOptions, AIController, AuthController, type ChunkOptions, type ChunkResult, CollectionController, type DeleteDocumentChunksOptions, DyrectedContext, EmbeddingService, GlobalController, InMemoryRateLimitStore, type IndexDocumentOptions, MediaController, PreviewController, type RAGSearchOptions, RAGService, type ReindexAllOptions, type ReindexCollectionOptions, aiRateLimit, buildDyrectedSystemPrompt, chunkText, cosineSimilarity, createDyrectedAITools, estimateTokens, extractTextFromDoc, formatAIErrorMessage, getAIModel, getEmbeddingModel, hashContent, normalizeFieldValue, registerRoutes, serializeDetailForApi, serializeViewForApi, validatePayloadAgainstFields };
+export { AIAgent, type AIAgentOptions, AIController, AUTH_SESSIONS_COLLECTION, AuthController, type AuthSessionRecord, type ChunkOptions, type ChunkResult, CollectionController, DEFAULT_LOCK_TIME_MS, DEFAULT_MAX_LOGIN_ATTEMPTS, type DeleteDocumentChunksOptions, DyrectedContext, EmbeddingService, GlobalController, InMemoryRateLimitStore, type IndexDocumentOptions, MediaController, PreviewController, type RAGSearchOptions, RAGService, type ReindexAllOptions, type ReindexCollectionOptions, type ResolvedAuthLockoutConfig, aiRateLimit, buildDyrectedSystemPrompt, buildInviteEmail, buildPasswordChangedEmail, buildResetPasswordEmail, buildWelcomeEmail, chunkText, cosineSimilarity, createDyrectedAITools, estimateTokens, extractTextFromDoc, formatAIErrorMessage, getAIModel, getAuthSession, getEmbeddingModel, getLockedUntilMs, hasEmbeddingApiKey, hashContent, hashPassword, isAuthSessionActive, issueAuthSessionToken, normalizeFieldValue, registerRoutes, resolveAuthLockoutConfig, revokeAllAuthSessions, revokeAuthSession, sendEmail, serializeDetailForApi, serializeViewForApi, touchAuthSession, validatePayloadAgainstFields, verifyPassword };