@dyrected/core 2.16.0 → 2.18.0

package/dist/server.js

@@ -6084,6 +6084,72 @@ function createReadonlyDb(db) {
   });
 }
 
+// src/utils/errors.ts
+var DyrectedError = class _DyrectedError extends Error {
+  statusCode;
+  constructor(message, statusCode = 500) {
+    super(message);
+    this.name = "DyrectedError";
+    this.statusCode = statusCode;
+    Object.setPrototypeOf(this, _DyrectedError.prototype);
+  }
+};
+var ValidationError = class _ValidationError extends DyrectedError {
+  constructor(message) {
+    super(message, 400);
+    this.name = "ValidationError";
+    Object.setPrototypeOf(this, _ValidationError.prototype);
+  }
+};
+
+// src/utils/field-integrity.ts
+function* storedFields(fields) {
+  for (const field of fields ?? []) {
+    if (field.type === "row") {
+      yield* storedFields(field.fields);
+    } else if (field.name) {
+      yield field;
+    }
+  }
+}
+function sameValue(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null || a === void 0 || b === void 0) return a == b;
+  if (typeof a === "object" || typeof b === "object") {
+    return JSON.stringify(a) === JSON.stringify(b);
+  }
+  return false;
+}
+function assertImmutableFieldsUnchanged(fields, data, original) {
+  for (const field of storedFields(fields)) {
+    if (!field.immutable || data[field.name] === void 0) continue;
+    if (!sameValue(data[field.name], original[field.name])) {
+      throw new ValidationError(
+        `Field "${field.label ?? field.name}" is immutable and cannot be modified.`
+      );
+    }
+  }
+}
+function normalizeMoneyFields(fields, data) {
+  let next = data;
+  for (const field of storedFields(fields)) {
+    if (field.type !== "money") continue;
+    const value = data[field.name];
+    if (value === void 0 || value === null || value === "") continue;
+    let minor;
+    if (typeof value === "number") minor = value;
+    else if (typeof value === "string" && /^-?\d+$/.test(value.trim())) minor = Number(value.trim());
+    if (minor === void 0 || !Number.isSafeInteger(minor)) {
+      throw new ValidationError(
+        `Field "${field.label ?? field.name}" must be a whole number of minor units (for example kobo or cents).`
+      );
+    }
+    if (next === data) next = { ...data };
+    next[field.name] = minor;
+  }
+  return next;
+}
+
 // src/utils/upload-validation.ts
 function isMimeAllowed(mimeType, allowed) {
   const type = (mimeType || "").toLowerCase().trim();
@@ -6679,7 +6745,7 @@ async function dispatchLifecycleEvent(config, event) {
   }
 }
 async function saveWorkflowDraft(args) {
-  const { config, collection, id, originalDoc, data, user } = args;
+  const { config, collection, id, originalDoc, data, user, beforeCommit } = args;
   const db = config.db;
   const workflow = collection.workflow;
   if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
@@ -6713,13 +6779,14 @@ async function saveWorkflowDraft(args) {
     }
     const updated = await tx.update({ collection: collection.slug, id, data: updateData });
     await persistEvent(tx, event);
+    await beforeCommit?.(tx, updated);
     return updated;
   });
   void dispatchLifecycleEvent(config, event);
   return { doc, event };
 }
 async function createWorkflowDocument(args) {
-  const { config, collection, data, user } = args;
+  const { config, collection, data, user, beforeCommit } = args;
   const db = config.db;
   if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
   let event;
@@ -6733,13 +6800,14 @@ async function createWorkflowDocument(args) {
       payload: { revision: 1, previousRevision: null }
     });
     await persistEvent(tx, event);
+    await beforeCommit?.(tx, created);
     return created;
   });
   void dispatchLifecycleEvent(config, event);
   return { doc, event };
 }
 async function transitionWorkflow(args) {
-  const { config, collection, id, transitionName, expectedRevision, comment, user, req } = args;
+  const { config, collection, id, transitionName, expectedRevision, comment, input, user, req } = args;
   const db = config.db;
   const workflow = collection.workflow;
   if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
@@ -6765,7 +6833,7 @@ async function transitionWorkflow(args) {
   if (transition.requireComment && !comment?.trim()) {
     throw Object.assign(new Error(`A comment is required for "${transition.label}".`), { statusCode: 400 });
   }
-  const hookContext = { transition, from: meta.state, to: transition.to, doc: original, user, comment, req, db };
+  const hookContext = { transition, from: meta.state, to: transition.to, doc: original, user, comment, input, req, db };
   for (const hook of workflow.hooks?.beforeTransition ?? []) await hook(hookContext);
   const events = [
     createLifecycleEvent({
@@ -6819,6 +6887,19 @@ async function transitionWorkflow(args) {
     if (targetState.published) data.__published = working;
     if (transition.unpublish) data.__published = null;
     const next = await tx.update({ collection: collection.slug, id, data });
+    if (transition.onTransition) {
+      await transition.onTransition({
+        transition,
+        from: lockedMeta.state,
+        to: transition.to,
+        doc: locked,
+        input,
+        comment,
+        user,
+        req,
+        tx
+      });
+    }
     await tx.create({
       collection: WORKFLOW_HISTORY_COLLECTION,
       data: {
@@ -7458,6 +7539,7 @@ var CollectionController = class {
       updatedBy: user?.sub ?? null
     };
     data = DefaultsService.apply(this.collection.fields, data);
+    data = normalizeMoneyFields(this.collection.fields, data);
     if (this.collection.workflow) {
       data = initializeWorkflowDocument(data, this.collection.workflow);
     }
@@ -7505,12 +7587,18 @@ var CollectionController = class {
     if (!data.id) {
       data = { ...data, id: generateDocumentId(this.collection) };
     }
+    const beforeCommit = this.buildBeforeCommit(c, "create", user);
     const doc = this.collection.workflow ? (await createWorkflowDocument({
       config,
       collection: this.collection,
       data,
-      user
-    })).doc : await db.create({ collection: this.collection.slug, data });
+      user,
+      beforeCommit
+    })).doc : await this.persistInTransaction(
+      db,
+      beforeCommit,
+      (writer) => writer.create({ collection: this.collection.slug, data })
+    );
     if (this.collection.audit && db) {
       AuditService.log(db, {
         operation: "create",
@@ -7744,6 +7832,36 @@ var CollectionController = class {
     const body = await c.req.json();
     return this.performUpdate(c, id, body);
   }
+  /**
+   * Builds the callback that runs the collection's `beforeCommit` hooks inside
+   * the write transaction, or `undefined` when the collection has none.
+   */
+  buildBeforeCommit(c, operation, user, previousDoc) {
+    const hooks = this.collection.hooks?.beforeCommit;
+    if (!hooks?.length) return void 0;
+    return async (tx, doc) => {
+      for (const hook of hooks) {
+        await hook({ doc, previousDoc, req: this.toHookRequestContext(c), user, operation, tx });
+      }
+    };
+  }
+  /**
+   * Runs a single write. When `beforeCommit` hooks exist the write and the
+   * hooks share one transaction, so a throwing hook rolls the write back.
+   */
+  async persistInTransaction(db, beforeCommit, write) {
+    if (!beforeCommit) return write(db);
+    if (!db.transaction) {
+      throw new Error(
+        `Collection "${this.collection.slug}" defines beforeCommit hooks but the configured database adapter does not support transactions.`
+      );
+    }
+    return db.transaction(async (tx) => {
+      const doc = await write(tx);
+      await beforeCommit(tx, doc);
+      return doc;
+    });
+  }
   /**
    * Core update pipeline shared by PATCH requests and operational actions:
    * auth-field stripping, timestamps, access enforcement, field write access,
@@ -7785,6 +7903,7 @@ var CollectionController = class {
         403
       );
     }
+    data = normalizeMoneyFields(this.collection.fields, data);
     let before = null;
     if (this.collection.audit) {
       before = originalDoc;
@@ -7818,14 +7937,21 @@ var CollectionController = class {
       surface: "collection.beforeChange",
       path: `collection:${this.collection.slug}.hooks.beforeChange`
     });
+    assertImmutableFieldsUnchanged(this.collection.fields, data, originalDoc);
+    const beforeCommit = this.buildBeforeCommit(c, "update", user, originalDoc);
     const doc = this.collection.workflow ? (await saveWorkflowDraft({
       config,
       collection: this.collection,
       id,
       originalDoc,
       data,
-      user
-    })).doc : await db.update({ collection: this.collection.slug, id, data });
+      user,
+      beforeCommit
+    })).doc : await this.persistInTransaction(
+      db,
+      beforeCommit,
+      (writer) => writer.update({ collection: this.collection.slug, id, data })
+    );
     if (this.collection.audit && db) {
       AuditService.log(db, {
         operation: "update",
@@ -8052,6 +8178,7 @@ var CollectionController = class {
         transitionName,
         expectedRevision: body.expectedRevision,
         comment: body.comment,
+        input: body.input,
         user: c.get("user"),
         req: { query: c.req.query(), headers: c.req.header(), raw: c.req.raw }
       });
@@ -9383,6 +9510,20 @@ var MediaFolderController = class {
   }
 };
 
+// src/utils/admin-url.ts
+var DEFAULT_ADMIN_PATH = "/admin";
+function resolveAdminUrl(c, config, clientUrl) {
+  const configured = config.admin?.adminUrl?.trim() || process.env.DYRECTED_ADMIN_URL?.trim() || (typeof clientUrl === "string" ? clientUrl.trim() : "") || DEFAULT_ADMIN_PATH;
+  try {
+    return new URL(configured, c.req.url).toString();
+  } catch {
+    return configured;
+  }
+}
+function appendQueryParam(url, key, value) {
+  return `${url}${url.includes("?") ? "&" : "?"}${key}=${encodeURIComponent(value)}`;
+}
+
 // src/controllers/auth.controller.ts
 import { randomBytes as randomBytes3 } from "crypto";
 
@@ -10058,8 +10199,7 @@ var AuthController = class {
         },
         "1h"
       );
-      const resetUrl = body?.resetUrl;
-      const url = resetUrl ? `${resetUrl}${resetUrl.includes("?") ? "&" : "?"}token=${encodeURIComponent(resetToken)}` : void 0;
+      const url = appendQueryParam(resolveAdminUrl(c, config, body?.resetUrl), "token", resetToken);
       try {
         const { subject, html } = buildResetPasswordEmail(config, {
           token: resetToken,
@@ -10191,8 +10331,7 @@ var AuthController = class {
       },
       "7d"
     );
-    const inviteUrl = body?.inviteUrl;
-    const url = inviteUrl ? `${inviteUrl}${inviteUrl.includes("?") ? "&" : "?"}inviteToken=${encodeURIComponent(inviteToken)}` : void 0;
+    const url = appendQueryParam(resolveAdminUrl(c, config, body?.inviteUrl), "inviteToken", inviteToken);
     try {
       const { subject, html } = buildInviteEmail(config, {
         token: inviteToken,
@@ -12471,7 +12610,12 @@ function generateOpenApi(config) {
           type: "object",
           properties: {
             expectedRevision: { type: "integer", minimum: 1 },
-            comment: { type: "string" }
+            comment: { type: "string" },
+            input: {
+              type: "object",
+              additionalProperties: true,
+              description: "Extra data passed to the transition's onTransition handler."
+            }
           }
         },
         WorkflowHistoryEntry: {
@@ -13634,6 +13778,9 @@ function fieldToSchema(field) {
     case "number":
       schema = { type: "number" };
       break;
+    case "money":
+      schema = { type: "integer", description: "Amount in minor units (for example kobo or cents)." };
+      break;
     case "boolean":
       schema = { type: "boolean" };
       break;
@@ -13774,6 +13921,537 @@ function getSwaggerHtml(specUrl) {
   `;
 }
 
+// src/types/navigation.ts
+var CURRENT_NAV_PREFERENCES_VERSION = 1;
+var DEFAULT_USER_NAV_PREFERENCES = {
+  _version: CURRENT_NAV_PREFERENCES_VERSION,
+  pinned: [],
+  hidden: [],
+  groupOrder: [],
+  itemOrder: {},
+  groups: [],
+  items: []
+};
+
+// src/utils/navigation-reconciler.ts
+var normalizeKey = (val) => (val || "").toLowerCase().replace(/[^a-z0-9]/g, "-");
+function reconcileNavigation(baseTree, prefs, schemas, options) {
+  if (!baseTree) {
+    return {
+      groups: [],
+      ungrouped: [],
+      pinnedItems: []
+    };
+  }
+  const includeHidden = options?.includeHidden ?? false;
+  const effectivePrefs = prefs || DEFAULT_USER_NAV_PREFERENCES;
+  const hiddenSet = new Set(effectivePrefs.hidden || []);
+  const knownCollectionSlugs = new Set((schemas?.collections || []).map((c) => c.slug));
+  const knownGlobalSlugs = new Set((schemas?.globals || []).map((g) => g.slug));
+  const groupsList = [];
+  const findGroup = (query) => {
+    const qNorm = normalizeKey(query);
+    return groupsList.find(
+      (g) => g.id === query || g.slug === query || g.name === query || normalizeKey(g.id) === qNorm || normalizeKey(g.slug) === qNorm || normalizeKey(g.name) === qNorm
+    );
+  };
+  for (const g of baseTree.groups || []) {
+    groupsList.push({
+      ...g,
+      items: (g.items || []).map((item) => ({ ...item }))
+    });
+  }
+  for (const ug of effectivePrefs.groups || []) {
+    const existing = findGroup(ug.slug || ug.name);
+    if (!existing) {
+      groupsList.push({
+        id: ug.slug ? `group_${ug.slug}` : `group_${normalizeKey(ug.name)}`,
+        name: ug.name,
+        slug: ug.slug || normalizeKey(ug.name),
+        icon: ug.icon || "Folder",
+        defaultExpanded: ug.defaultExpanded ?? true,
+        order: ug.order ?? 100,
+        items: []
+      });
+    }
+  }
+  for (const itemOpt of effectivePrefs.items || []) {
+    const targetGroup = typeof itemOpt.group === "object" ? itemOpt.group?.name : itemOpt.group;
+    const groupKey = targetGroup || "Custom";
+    let group = findGroup(groupKey);
+    if (!group) {
+      group = {
+        id: `group_${normalizeKey(groupKey)}`,
+        name: groupKey,
+        slug: normalizeKey(groupKey),
+        icon: "Folder",
+        defaultExpanded: true,
+        order: 99,
+        items: []
+      };
+      groupsList.push(group);
+    }
+    const itemId = itemOpt.slug ? `workspace_${itemOpt.slug}` : itemOpt.collection ? `collection_${itemOpt.collection}` : `custom_${Math.random()}`;
+    for (const otherGroup of groupsList) {
+      if (otherGroup !== group) {
+        otherGroup.items = otherGroup.items.filter((i) => i.slug !== itemOpt.slug && i.id !== itemId);
+      }
+    }
+    const existingIndex = group.items.findIndex((i) => i.id === itemId || i.slug === itemOpt.slug);
+    const existingItem = existingIndex >= 0 ? group.items[existingIndex] : void 0;
+    const col = schemas?.collections?.find((c) => c.slug === itemOpt.collection);
+    const colViews = col?.views || [];
+    const baseViews = existingItem?.views || [];
+    const userViews = itemOpt.views || [];
+    const userViewSlugs = new Set(userViews.map((v) => v.slug));
+    let mergedViews = [
+      ...baseViews.filter((v) => !userViewSlugs.has(v.slug)),
+      ...userViews
+    ];
+    if (mergedViews.length === 0 && itemOpt.collection) {
+      if (colViews.length > 0) {
+        mergedViews = [...colViews];
+      } else {
+        mergedViews = [
+          {
+            slug: "default",
+            label: col?.label || col?.labels?.plural || itemOpt.label || "All Records",
+            layout: "table",
+            collection: itemOpt.collection
+          }
+        ];
+      }
+    }
+    mergedViews = mergedViews.map((v) => ({
+      ...v,
+      collection: v.collection || itemOpt.collection || existingItem?.collection
+    }));
+    const compiledItem = {
+      id: itemId,
+      type: itemOpt.slug ? "workspace" : itemOpt.collection ? "collection" : itemOpt.global ? "global" : "workspace",
+      slug: itemOpt.slug || itemOpt.collection || itemOpt.global || "item",
+      label: itemOpt.label || itemOpt.slug || "Item",
+      icon: itemOpt.icon || existingItem?.icon || col?.admin?.icon || "Briefcase",
+      group: group.name,
+      order: itemOpt.order ?? existingItem?.order ?? 100,
+      views: mergedViews,
+      collection: itemOpt.collection || existingItem?.collection,
+      global: itemOpt.global || existingItem?.global,
+      badge: itemOpt.badge || existingItem?.badge,
+      access: itemOpt.access || existingItem?.access
+    };
+    if (existingIndex >= 0) {
+      group.items[existingIndex] = compiledItem;
+    } else {
+      group.items.push(compiledItem);
+    }
+  }
+  const allAvailableItems = [];
+  const reconciledGroups = [];
+  for (const group of groupsList) {
+    const isGroupHidden = hiddenSet.has(group.id) || !!group.slug && hiddenSet.has(group.slug) || hiddenSet.has(group.name);
+    if (!includeHidden && isGroupHidden) {
+      continue;
+    }
+    const visibleItems = [];
+    for (const item of group.items) {
+      const isItemHidden = hiddenSet.has(item.id) || !!item.slug && hiddenSet.has(item.slug);
+      if (!includeHidden && isItemHidden) {
+        continue;
+      }
+      const allViews = item.views || [];
+      const visibleViews = includeHidden ? allViews : allViews.filter((v) => {
+        const compoundKey = `${item.slug}_${v.slug}`;
+        return !hiddenSet.has(compoundKey) && !hiddenSet.has(v.slug);
+      });
+      let isTombstone = false;
+      if (schemas && schemas.collections && schemas.collections.length > 0) {
+        if (item.collection && !knownCollectionSlugs.has(item.collection)) {
+          isTombstone = true;
+        }
+      }
+      if (schemas && schemas.globals && schemas.globals.length > 0) {
+        if (item.global && !knownGlobalSlugs.has(item.global)) {
+          isTombstone = true;
+        }
+      }
+      const processedItem = {
+        ...item,
+        views: visibleViews,
+        ...isTombstone ? { isTombstone: true } : {}
+      };
+      visibleItems.push(processedItem);
+      allAvailableItems.push(processedItem);
+    }
+    const groupKey = group.slug || group.name;
+    const itemOrderList = effectivePrefs.itemOrder?.[group.id] || effectivePrefs.itemOrder?.[groupKey];
+    if (itemOrderList && itemOrderList.length > 0) {
+      visibleItems.sort((a, b) => {
+        const aIdx = itemOrderList.indexOf(a.id) >= 0 ? itemOrderList.indexOf(a.id) : a.slug ? itemOrderList.indexOf(a.slug) : -1;
+        const bIdx = itemOrderList.indexOf(b.id) >= 0 ? itemOrderList.indexOf(b.id) : b.slug ? itemOrderList.indexOf(b.slug) : -1;
+        if (aIdx >= 0 && bIdx >= 0) return aIdx - bIdx;
+        if (aIdx >= 0) return -1;
+        if (bIdx >= 0) return 1;
+        return (a.order ?? 100) - (b.order ?? 100);
+      });
+    } else {
+      visibleItems.sort((a, b) => (a.order ?? 100) - (b.order ?? 100));
+    }
+    reconciledGroups.push({
+      ...group,
+      items: visibleItems
+    });
+  }
+  if (effectivePrefs.groupOrder && effectivePrefs.groupOrder.length > 0) {
+    reconciledGroups.sort((a, b) => {
+      const aIdx = effectivePrefs.groupOrder.indexOf(a.id) >= 0 ? effectivePrefs.groupOrder.indexOf(a.id) : a.slug ? effectivePrefs.groupOrder.indexOf(a.slug) : effectivePrefs.groupOrder.indexOf(a.name);
+      const bIdx = effectivePrefs.groupOrder.indexOf(b.id) >= 0 ? effectivePrefs.groupOrder.indexOf(b.id) : b.slug ? effectivePrefs.groupOrder.indexOf(b.slug) : effectivePrefs.groupOrder.indexOf(b.name);
+      if (aIdx >= 0 && bIdx >= 0) return aIdx - bIdx;
+      if (aIdx >= 0) return -1;
+      if (bIdx >= 0) return 1;
+      return (a.order ?? 100) - (b.order ?? 100);
+    });
+  } else {
+    reconciledGroups.sort((a, b) => (a.order ?? 100) - (b.order ?? 100));
+  }
+  const reconciledUngrouped = (baseTree.ungrouped || []).filter((item) => {
+    const isItemHidden = hiddenSet.has(item.id) || !!item.slug && hiddenSet.has(item.slug);
+    return includeHidden || !isItemHidden;
+  }).map((item) => {
+    const allViews = item.views || [];
+    const visibleViews = includeHidden ? allViews : allViews.filter((v) => {
+      const compoundKey = `${item.slug}_${v.slug}`;
+      return !hiddenSet.has(compoundKey) && !hiddenSet.has(v.slug);
+    });
+    const processed = { ...item, views: visibleViews };
+    allAvailableItems.push(processed);
+    return processed;
+  });
+  const pinnedItems = [];
+  for (const pin of effectivePrefs.pinned || []) {
+    const match = allAvailableItems.find((i) => i.slug === pin.slug || i.id === pin.slug);
+    if (match) {
+      pinnedItems.push({
+        ...match,
+        id: `pin_${match.id}`,
+        label: pin.label || match.label,
+        icon: pin.icon || match.icon
+      });
+    } else {
+      pinnedItems.push({
+        id: `pin_${pin.slug}`,
+        type: pin.type,
+        slug: pin.slug,
+        label: pin.label || pin.slug,
+        icon: pin.icon || "Star",
+        order: 0,
+        views: []
+      });
+    }
+  }
+  return {
+    groups: reconciledGroups,
+    ungrouped: reconciledUngrouped,
+    pinnedItems
+  };
+}
+
+// src/utils/navigation.ts
+var RESERVED_NAVIGATION_SLUGS = /* @__PURE__ */ new Set([
+  "collections",
+  "globals",
+  "setup",
+  "api",
+  "login",
+  "logout",
+  "settings",
+  "admin",
+  "preferences",
+  "auth"
+]);
+function assertValidNavigationSlugs(navigation) {
+  for (const item of navigation) {
+    if (item.slug) {
+      const normalizedSlug = item.slug.toLowerCase().trim().replace(/^\//, "");
+      if (RESERVED_NAVIGATION_SLUGS.has(normalizedSlug)) {
+        throw new Error(
+          `[Dyrected Config] The slug '${item.slug}' in navigation item '${item.label || item.slug}' is a reserved system path and cannot be used as an operational workspace slug.`
+        );
+      }
+    }
+  }
+}
+function resolveGroupMeta(groupProp, defaultGroupName = "Collections") {
+  if (!groupProp) {
+    return { name: defaultGroupName };
+  }
+  if (typeof groupProp === "string") {
+    return { name: groupProp };
+  }
+  return { name: groupProp.name, meta: groupProp };
+}
+function compileNavigation(config) {
+  const collections = config.collections || [];
+  const globals = config.globals || [];
+  const explicitNav = config.admin?.navigation || [];
+  assertValidNavigationSlugs(explicitNav);
+  const collectionsBySlug = /* @__PURE__ */ new Map();
+  for (const col of collections) {
+    collectionsBySlug.set(col.slug, col);
+  }
+  const globalsBySlug = /* @__PURE__ */ new Map();
+  for (const gl of globals) {
+    globalsBySlug.set(gl.slug, gl);
+  }
+  const mentionedCollections = /* @__PURE__ */ new Set();
+  const mentionedGlobals = /* @__PURE__ */ new Set();
+  const injectedViewsByCollection = /* @__PURE__ */ new Map();
+  for (const item of explicitNav) {
+    if (item.addToCollection) {
+      const existing = injectedViewsByCollection.get(item.addToCollection) || [];
+      if (item.views && item.views.length > 0) {
+        injectedViewsByCollection.set(item.addToCollection, [...existing, ...item.views]);
+      }
+    }
+    if (item.collection) mentionedCollections.add(item.collection);
+    if (item.global) mentionedGlobals.add(item.global);
+  }
+  const groupMetadataMap = /* @__PURE__ */ new Map();
+  const itemsByGroup = /* @__PURE__ */ new Map();
+  const ungroupedItems = [];
+  const registerItem = (groupName, item) => {
+    if (!groupName) {
+      ungroupedItems.push(item);
+    } else {
+      const list = itemsByGroup.get(groupName) || [];
+      list.push(item);
+      itemsByGroup.set(groupName, list);
+    }
+  };
+  for (const item of explicitNav) {
+    if (item.addToCollection && !item.slug && !item.collection && !item.global && !item.dashboard && !item.href) {
+      continue;
+    }
+    const { name: groupName, meta: groupMeta } = resolveGroupMeta(item.group, void 0);
+    if (groupName && groupMeta) {
+      groupMetadataMap.set(groupName, { ...groupMetadataMap.get(groupName) || {}, ...groupMeta });
+    }
+    if (item.dashboard) {
+      registerItem(groupName, {
+        id: "dashboard",
+        type: "dashboard",
+        slug: "dashboard",
+        label: item.label || "Dashboard",
+        icon: item.icon || "LayoutDashboard",
+        group: groupName,
+        order: item.order ?? 0,
+        views: [],
+        access: item.access
+      });
+      continue;
+    }
+    if (item.collection) {
+      const col = collectionsBySlug.get(item.collection);
+      const combinedViews = [
+        ...col?.views || [],
+        ...injectedViewsByCollection.get(item.collection) || [],
+        ...item.views || []
+      ];
+      registerItem(groupName, {
+        id: item.slug || `collection_${item.collection}`,
+        type: item.slug ? "workspace" : "collection",
+        slug: item.slug || item.collection,
+        collection: item.collection,
+        label: item.label || col?.labels?.plural || item.collection,
+        icon: item.icon || col?.admin?.icon || "Folder",
+        group: groupName,
+        order: item.order ?? col?.admin?.order ?? 100,
+        views: combinedViews,
+        badge: item.badge,
+        access: item.access || col?.access?.read
+      });
+      continue;
+    }
+    if (item.global) {
+      const gl = globalsBySlug.get(item.global);
+      registerItem(groupName, {
+        id: item.slug || `global_${item.global}`,
+        type: "global",
+        slug: item.slug || item.global,
+        global: item.global,
+        label: item.label || gl?.label || item.global,
+        icon: item.icon || "Settings",
+        group: groupName,
+        order: item.order ?? 100,
+        views: [],
+        badge: item.badge,
+        access: item.access
+      });
+      continue;
+    }
+    if (item.href) {
+      registerItem(groupName, {
+        id: `link_${item.slug || item.href}`,
+        type: "link",
+        slug: item.slug || "link",
+        label: item.label || "Link",
+        href: item.href,
+        icon: item.icon || "ExternalLink",
+        group: groupName,
+        order: item.order ?? 100,
+        views: [],
+        badge: item.badge,
+        access: item.access
+      });
+      continue;
+    }
+    const workspaceSlug = item.slug || "workspace";
+    registerItem(groupName, {
+      id: `workspace_${workspaceSlug}`,
+      type: "workspace",
+      slug: workspaceSlug,
+      label: item.label || workspaceSlug,
+      icon: item.icon || "Briefcase",
+      group: groupName,
+      order: item.order ?? 100,
+      views: item.views || [],
+      badge: item.badge,
+      access: item.access
+    });
+  }
+  for (const col of collections) {
+    if (mentionedCollections.has(col.slug)) continue;
+    if (col.admin?.hidden) continue;
+    const groupProp = col.admin?.group;
+    const { name: groupName, meta: groupMeta } = resolveGroupMeta(groupProp, "Collections");
+    if (groupMeta) {
+      groupMetadataMap.set(groupName, { ...groupMetadataMap.get(groupName) || {}, ...groupMeta });
+    }
+    const combinedViews = [
+      ...col.views || [],
+      ...injectedViewsByCollection.get(col.slug) || []
+    ];
+    registerItem(groupName, {
+      id: `collection_${col.slug}`,
+      type: "collection",
+      slug: col.slug,
+      collection: col.slug,
+      label: col.labels?.plural || col.slug,
+      icon: col.admin?.icon || "Folder",
+      group: groupName,
+      order: col?.admin?.order ?? 100,
+      views: combinedViews,
+      access: col.access?.read
+    });
+  }
+  for (const gl of globals) {
+    if (mentionedGlobals.has(gl.slug)) continue;
+    const groupName = "Configuration";
+    registerItem(groupName, {
+      id: `global_${gl.slug}`,
+      type: "global",
+      slug: gl.slug,
+      global: gl.slug,
+      label: gl.label || gl.slug,
+      icon: "Settings",
+      group: groupName,
+      order: 100,
+      views: []
+    });
+  }
+  const sortAndSpliceItems = (items) => {
+    const sorted = [...items].sort((a, b) => a.order - b.order);
+    const explicitMap = /* @__PURE__ */ new Map();
+    for (const opt of explicitNav) {
+      if (opt.slug) explicitMap.set(opt.slug, opt);
+      if (opt.collection) explicitMap.set(opt.collection, opt);
+      if (opt.global) explicitMap.set(opt.global, opt);
+    }
+    for (const opt of explicitNav) {
+      const itemKey = opt.slug || opt.collection || opt.global;
+      if (!itemKey) continue;
+      if (opt.after) {
+        const itemIdx = sorted.findIndex((i) => i.slug === itemKey);
+        const targetIdx = sorted.findIndex((i) => i.slug === opt.after);
+        if (itemIdx !== -1 && targetIdx !== -1 && itemIdx !== targetIdx) {
+          const [moved] = sorted.splice(itemIdx, 1);
+          const newTargetIdx = sorted.findIndex((i) => i.slug === opt.after);
+          sorted.splice(newTargetIdx + 1, 0, moved);
+        }
+      } else if (opt.before) {
+        const itemIdx = sorted.findIndex((i) => i.slug === itemKey);
+        const targetIdx = sorted.findIndex((i) => i.slug === opt.before);
+        if (itemIdx !== -1 && targetIdx !== -1 && itemIdx !== targetIdx) {
+          const [moved] = sorted.splice(itemIdx, 1);
+          const newTargetIdx = sorted.findIndex((i) => i.slug === opt.before);
+          sorted.splice(newTargetIdx, 0, moved);
+        }
+      } else if (opt.position === "first") {
+        const itemIdx = sorted.findIndex((i) => i.slug === itemKey);
+        if (itemIdx > 0) {
+          const [moved] = sorted.splice(itemIdx, 1);
+          sorted.unshift(moved);
+        }
+      } else if (opt.position === "last") {
+        const itemIdx = sorted.findIndex((i) => i.slug === itemKey);
+        if (itemIdx !== -1 && itemIdx < sorted.length - 1) {
+          const [moved] = sorted.splice(itemIdx, 1);
+          sorted.push(moved);
+        }
+      }
+    }
+    return sorted;
+  };
+  const compiledGroups = [];
+  for (const [groupName, rawItems] of itemsByGroup.entries()) {
+    const meta = groupMetadataMap.get(groupName);
+    const sortedItems = sortAndSpliceItems(rawItems);
+    compiledGroups.push({
+      id: `group_${groupName.toLowerCase().replace(/\s+/g, "_")}`,
+      name: groupName,
+      slug: meta?.slug || groupName.toLowerCase().replace(/\s+/g, "-"),
+      icon: meta?.icon,
+      defaultExpanded: meta?.defaultExpanded ?? true,
+      order: meta?.order ?? 100,
+      items: sortedItems
+    });
+  }
+  compiledGroups.sort((a, b) => a.order - b.order);
+  return {
+    groups: compiledGroups,
+    ungrouped: sortAndSpliceItems(ungroupedItems)
+  };
+}
+function pruneNavigationForUser(tree, user) {
+  const userRoles = /* @__PURE__ */ new Set();
+  if (user?.role) userRoles.add(user.role);
+  if (Array.isArray(user?.roles)) {
+    for (const r of user.roles) userRoles.add(r);
+  }
+  const isAllowed = (item) => {
+    if (!item.access) return true;
+    if (Array.isArray(item.access)) {
+      if (item.access.length === 0) return true;
+      return item.access.some((role) => userRoles.has(role));
+    }
+    return true;
+  };
+  const prunedGroups = [];
+  for (const group of tree.groups) {
+    const visibleItems = group.items.filter(isAllowed);
+    if (visibleItems.length > 0) {
+      prunedGroups.push({
+        ...group,
+        items: visibleItems
+      });
+    }
+  }
+  return {
+    groups: prunedGroups,
+    ungrouped: tree.ungrouped.filter(isAllowed)
+  };
+}
+
 // src/router.ts
 init_access_control();
 import { HTTPException as HTTPException5 } from "hono/http-exception";
@@ -13922,6 +14600,30 @@ function serializeDetailForApi(detail) {
   if (!detail || !Array.isArray(detail)) return void 0;
   return detail.map(serializeDetailItemForApi);
 }
+async function serializeActionsForApi(actions, serializeAccess) {
+  const serializeAccessConfig = async (access) => {
+    if (!access) return void 0;
+    const serialized = {};
+    for (const key of ["read", "create", "update", "delete"]) {
+      if (access[key] !== void 0) serialized[key] = await serializeAccess(access[key]);
+    }
+    return serialized;
+  };
+  return Promise.all(
+    (actions || []).map(async (action) => ({
+      name: action.name,
+      label: action.label,
+      icon: action.icon,
+      type: action.type ?? "row",
+      confirm: action.confirm,
+      submitLabel: action.submitLabel,
+      fields: action.fields?.map(serializeFieldForApi),
+      mutation: action.mutation,
+      // Self-hosted handlers are intentionally omitted: they never leave the server.
+      access: action.access ? await serializeAccessConfig(action.access) : void 0
+    }))
+  );
+}
 async function serializeViewForApi(view, serializeAccess) {
   if (!view) return view;
   const serializeAccessConfig = async (access) => {
@@ -13948,20 +14650,7 @@ async function serializeViewForApi(view, serializeAccess) {
     features: view.features,
     actionOrder: view.actionOrder,
     components: view.components,
-    actions: await Promise.all(
-      (view.actions || []).map(async (action) => ({
-        name: action.name,
-        label: action.label,
-        icon: action.icon,
-        type: action.type ?? "row",
-        confirm: action.confirm,
-        submitLabel: action.submitLabel,
-        fields: action.fields?.map(serializeFieldForApi),
-        mutation: action.mutation,
-        // Self-hosted handlers are intentionally omitted: they never leave the server.
-        access: action.access ? await serializeAccessConfig(action.access) : void 0
-      }))
-    ),
+    actions: await serializeActionsForApi(view.actions, serializeAccess),
     access: view.access ? await serializeAccessConfig(view.access) : void 0
   };
 }
@@ -14043,6 +14732,7 @@ function registerRoutes(app, config) {
         drafts: !!col.drafts,
         defaultView: col.defaultView ?? col.admin?.defaultView,
         views: await Promise.all((col.views || []).map((view) => serializeViewForApi(view, serializeAccess))),
+        actions: await serializeActionsForApi(col.actions, serializeAccess),
         admin: col.admin,
         detail: serializeDetailForApi(col.detail),
         workflow: col.workflow ? {
@@ -14273,6 +14963,7 @@ function registerRoutes(app, config) {
     const user = c.get("user");
     const key = c.req.param("key");
     const scope = c.req.query("scope");
+    const roleParam = c.req.query("role");
     if (!db) return c.json({ message: "Database not configured" }, 500);
     if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
     const getGlobalPreference = async () => {
@@ -14282,27 +14973,61 @@ function registerRoutes(app, config) {
       });
       return globalDoc ? globalDoc.value : null;
     };
-    if (scope === "global" || !user?.collection || !user.sub) {
+    const getRolePreference = async (r) => {
+      const roleDoc = await db.findOne({
+        collection: "__role_preferences",
+        id: `${r}_${key}`
+      });
+      return roleDoc ? roleDoc.value : null;
+    };
+    const getUserPreferences = async () => {
+      if (!user?.collection || !user.sub) return null;
+      const doc = await db.findOne({ collection: user.collection, id: user.sub });
+      if (!doc) return null;
+      return typeof doc.__preferences === "object" && doc.__preferences !== null ? doc.__preferences : {};
+    };
+    if (scope === "global") {
       const globalValue2 = await getGlobalPreference();
       return c.json({ key, value: globalValue2 });
     }
-    const doc = await db.findOne({ collection: user.collection, id: user.sub });
-    if (!doc) {
-      const globalValue2 = await getGlobalPreference();
-      return c.json({ key, value: globalValue2 });
+    if (scope === "role") {
+      if (roleParam) {
+        const val = await getRolePreference(roleParam);
+        return c.json({ key, value: val, role: roleParam });
+      }
+      const userRoles2 = Array.isArray(user?.roles) ? user.roles : typeof user?.role === "string" ? [user.role] : [];
+      for (const r of userRoles2) {
+        const val = await getRolePreference(r);
+        if (val !== null && val !== void 0) {
+          return c.json({ key, value: val, role: r });
+        }
+      }
+      return c.json({ key, value: null });
     }
-    const preferences = typeof doc.__preferences === "object" && doc.__preferences !== null ? doc.__preferences : {};
-    if (key in preferences) {
-      return c.json({ key, value: preferences[key] ?? null });
+    if (scope === "personal") {
+      const prefs2 = await getUserPreferences();
+      return c.json({ key, value: prefs2 && key in prefs2 ? prefs2[key] ?? null : null });
+    }
+    const prefs = await getUserPreferences();
+    if (prefs && key in prefs && prefs[key] !== null && prefs[key] !== void 0) {
+      return c.json({ key, value: prefs[key] });
+    }
+    const userRoles = Array.isArray(user?.roles) ? user.roles : typeof user?.role === "string" ? [user.role] : [];
+    for (const r of userRoles) {
+      const val = await getRolePreference(r);
+      if (val !== null && val !== void 0) {
+        return c.json({ key, value: val });
+      }
     }
     const globalValue = await getGlobalPreference();
-    return c.json({ key, value: globalValue });
+    return c.json({ key, value: globalValue ?? null });
   });
   app.put("/api/preferences/:key", requireAuth(config), async (c) => {
     const db = config.db;
     const user = c.get("user");
     const key = c.req.param("key");
-    const scope = c.req.query("scope");
+    const scope = c.req.query("scope") || "personal";
+    const roleParam = c.req.query("role");
     if (!db) return c.json({ message: "Database not configured" }, 500);
     if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
     if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
@@ -14335,7 +15060,47 @@ function registerRoutes(app, config) {
           data: { id: key, value: body.value }
         });
       }
-      return c.json({ key, value: body.value });
+      return c.json({ key, value: body.value, scope: "global" });
+    }
+    if (scope === "role") {
+      const userCol = config.collections?.find((col) => col.slug === user?.collection);
+      const isAdminUser = isUserAdmin(user, userCol);
+      if (!isAdminUser) {
+        return c.json(
+          {
+            error: true,
+            message: "Only administrators can save role preferences."
+          },
+          403
+        );
+      }
+      if (!roleParam) {
+        return c.json(
+          {
+            error: true,
+            message: "Role query parameter is required for role-scoped preferences."
+          },
+          400
+        );
+      }
+      const roleDocId = `${roleParam}_${key}`;
+      const existing = await db.findOne({
+        collection: "__role_preferences",
+        id: roleDocId
+      });
+      if (existing) {
+        await db.update({
+          collection: "__role_preferences",
+          id: roleDocId,
+          data: { value: body.value, role: roleParam, key }
+        });
+      } else {
+        await db.create({
+          collection: "__role_preferences",
+          data: { id: roleDocId, role: roleParam, key, value: body.value }
+        });
+      }
+      return c.json({ key, value: body.value, role: roleParam, scope: "role" });
     }
     const doc = await db.findOne({ collection: user.collection, id: user.sub });
     if (!doc) return c.json({ error: true, message: "User not found." }, 404);
@@ -14346,13 +15111,14 @@ function registerRoutes(app, config) {
       id: user.sub,
       data: { __preferences: nextPreferences }
     });
-    return c.json({ key, value: body.value });
+    return c.json({ key, value: body.value, scope: "personal" });
   });
   app.delete("/api/preferences/:key", requireAuth(config), async (c) => {
     const db = config.db;
     const user = c.get("user");
     const key = c.req.param("key");
-    const scope = c.req.query("scope");
+    const scope = c.req.query("scope") || "personal";
+    const roleParam = c.req.query("role");
     if (!db) return c.json({ message: "Database not configured" }, 500);
     if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
     if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
@@ -14371,6 +15137,30 @@ function registerRoutes(app, config) {
       await db.delete({ collection: "__global_preferences", id: key });
       return c.json({ success: true });
     }
+    if (scope === "role") {
+      const userCol = config.collections?.find((col) => col.slug === user?.collection);
+      const isAdminUser = isUserAdmin(user, userCol);
+      if (!isAdminUser) {
+        return c.json(
+          {
+            error: true,
+            message: "Only administrators can delete role preferences."
+          },
+          403
+        );
+      }
+      if (!roleParam) {
+        return c.json(
+          {
+            error: true,
+            message: "Role query parameter is required for role-scoped preferences."
+          },
+          400
+        );
+      }
+      await db.delete({ collection: "__role_preferences", id: `${roleParam}_${key}` });
+      return c.json({ success: true });
+    }
     const doc = await db.findOne({ collection: user.collection, id: user.sub });
     if (!doc) return c.json({ error: true, message: "User not found." }, 404);
     const preferences = typeof doc.__preferences === "object" && doc.__preferences !== null ? { ...doc.__preferences } : {};
@@ -14382,6 +15172,198 @@ function registerRoutes(app, config) {
     });
     return c.json({ success: true });
   });
+  app.get("/api/admin/navigation", optionalAuth(config), async (c) => {
+    const user = c.get("user");
+    const compiled = compileNavigation(config);
+    const pruned = pruneNavigationForUser(compiled, user);
+    return c.json(pruned);
+  });
+  app.on(["GET", "POST"], "/api/admin/navigation/badges", optionalAuth(config), async (c) => {
+    const db = config.db;
+    if (!db) return c.json({ badges: {} });
+    const user = c.get("user");
+    const compiled = compileNavigation(config);
+    let userNavPrefs = null;
+    const prefsQuery = c.req.query("prefs");
+    if (prefsQuery) {
+      try {
+        userNavPrefs = JSON.parse(decodeURIComponent(prefsQuery));
+      } catch {
+      }
+    }
+    if (!userNavPrefs && c.req.method === "POST") {
+      try {
+        const body = await c.req.json();
+        if (body?.preferences) userNavPrefs = body.preferences;
+      } catch {
+      }
+    }
+    if (!userNavPrefs && user?.collection && user?.sub) {
+      try {
+        const userDoc = await db.findOne({ collection: user.collection, id: user.sub });
+        if (userDoc?.__preferences && typeof userDoc.__preferences === "object") {
+          userNavPrefs = userDoc.__preferences["admin:navigation"];
+        }
+      } catch {
+      }
+    }
+    if (!userNavPrefs) {
+      try {
+        const globalDoc = await db.findOne({
+          collection: "__global_preferences",
+          id: "admin:navigation"
+        });
+        if (globalDoc?.value) {
+          userNavPrefs = globalDoc.value;
+        }
+      } catch {
+      }
+    }
+    let allItems;
+    if (userNavPrefs) {
+      const reconciled = reconcileNavigation(compiled, userNavPrefs, {
+        collections: config.collections,
+        globals: config.globals
+      });
+      allItems = [
+        ...reconciled.ungrouped || [],
+        ...reconciled.pinnedItems || [],
+        ...(reconciled.groups || []).flatMap((g) => g.items || [])
+      ];
+    } else {
+      const pruned = pruneNavigationForUser(compiled, user);
+      allItems = [
+        ...pruned.ungrouped,
+        ...pruned.groups.flatMap((g) => g.items)
+      ];
+    }
+    const badges = {};
+    const requestsByCollection = /* @__PURE__ */ new Map();
+    let reqCounter = 0;
+    for (const item of allItems) {
+      if (item.badge) {
+        const itemBadge = item.badge;
+        const badgeKey = item.slug || item.collection || item.global || item.id;
+        if (typeof itemBadge === "string") {
+          badges[badgeKey] = { count: itemBadge, variant: "default" };
+        } else {
+          const badgeConfig = itemBadge;
+          const variant = badgeConfig.variant ?? "default";
+          if (badgeConfig.text) {
+            badges[badgeKey] = { count: badgeConfig.text, variant };
+          } else {
+            let targetCol;
+            let targetWhere;
+            if (badgeConfig.aggregate) {
+              targetCol = badgeConfig.aggregate.collection;
+              targetWhere = badgeConfig.aggregate.where;
+            } else if (badgeConfig.count) {
+              targetCol = item.collection || item.views?.[0]?.collection;
+              const primaryView = item.views?.[0];
+              if (primaryView?.filter) {
+                targetWhere = primaryView.filter;
+              }
+            }
+            if (targetCol) {
+              const reqId = `agg_${reqCounter++}`;
+              const list = requestsByCollection.get(targetCol) || [];
+              list.push({
+                id: reqId,
+                where: targetWhere,
+                onResult: (count2) => {
+                  badges[badgeKey] = { count: count2, variant };
+                }
+              });
+              requestsByCollection.set(targetCol, list);
+            }
+          }
+        }
+      }
+      if (item.views && item.views.length > 0) {
+        for (const view of item.views) {
+          if (!view.badge) continue;
+          const viewBadge = view.badge;
+          const viewKey = `${item.slug}:${view.slug}`;
+          const altKey = `${item.slug}_${view.slug}`;
+          const plainKey = view.slug;
+          const setBadgeResult = (res) => {
+            badges[viewKey] = res;
+            badges[altKey] = res;
+            if (!badges[plainKey]) {
+              badges[plainKey] = res;
+            }
+            if (view.collection) {
+              badges[`${view.collection}:${view.slug}`] = res;
+              badges[`${view.collection}_${view.slug}`] = res;
+            }
+          };
+          if (typeof viewBadge === "string") {
+            setBadgeResult({ count: viewBadge, variant: "default" });
+            continue;
+          }
+          const badgeConfig = viewBadge;
+          const variant = badgeConfig.variant ?? "default";
+          if (badgeConfig.text) {
+            setBadgeResult({ count: badgeConfig.text, variant });
+            continue;
+          }
+          const targetCol = badgeConfig.aggregate?.collection || view.collection || item.collection || (item.type === "collection" ? item.slug : void 0);
+          const targetWhere = badgeConfig.aggregate?.where || (typeof view.filter === "object" ? view.filter : void 0);
+          if (!targetCol) continue;
+          const reqId = `agg_${reqCounter++}`;
+          const list = requestsByCollection.get(targetCol) || [];
+          list.push({
+            id: reqId,
+            where: targetWhere,
+            onResult: (count2) => {
+              setBadgeResult({ count: count2, variant });
+            }
+          });
+          requestsByCollection.set(targetCol, list);
+        }
+      }
+    }
+    const collectionTasks = Array.from(requestsByCollection.entries()).map(async ([col, reqs]) => {
+      if (typeof db.aggregate === "function") {
+        try {
+          const aggregates = {};
+          for (const req of reqs) {
+            aggregates[req.id] = { count: "*", where: req.where };
+          }
+          const agg = await db.aggregate({
+            collection: col,
+            aggregates
+          });
+          for (const req of reqs) {
+            const val = agg?.[req.id];
+            req.onResult(typeof val === "number" ? val : 0);
+          }
+        } catch {
+          for (const req of reqs) {
+            req.onResult(0);
+          }
+        }
+      } else {
+        await Promise.allSettled(
+          reqs.map(async (req) => {
+            try {
+              const res = await db.find({
+                collection: col,
+                where: req.where,
+                limit: 1
+              });
+              const total = res?.totalDocs ?? res?.total ?? 0;
+              req.onResult(total);
+            } catch {
+              req.onResult(0);
+            }
+          })
+        );
+      }
+    });
+    await Promise.allSettled(collectionTasks);
+    return c.json({ badges });
+  });
   app.get("/api/media/folders", async (c) => {
     const folderController = new MediaFolderController("media");
     return folderController.list(c);
@@ -14631,6 +15613,31 @@ function registerRoutes(app, config) {
   });
 }
 
+// src/tasks.ts
+var TASK_LOCKS_COLLECTION = "__task_locks";
+var TASK_LOCKS_COLLECTION_CONFIG = {
+  slug: TASK_LOCKS_COLLECTION,
+  labels: { singular: "Task lock", plural: "Task locks" },
+  fields: [
+    { name: "name", type: "text", required: true },
+    // Numeric and promoted so the lock compare-and-set is a real column comparison.
+    { name: "lockedUntil", type: "number", required: true, promoted: true },
+    { name: "lockedBy", type: "text" },
+    { name: "lastScheduledFor", type: "date" },
+    { name: "lastStartedAt", type: "date" },
+    { name: "lastFinishedAt", type: "date" },
+    { name: "lastStatus", type: "text" },
+    { name: "lastError", type: "textarea" }
+  ],
+  access: {
+    read: ({ user }) => !!user?.roles?.includes("admin"),
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
+  admin: { hidden: true }
+};
+
 // src/utils/config.ts
 var AUDIT_COLLECTION_SLUG = "__audit";
 var SYSTEM_FIELDS = [
@@ -14782,6 +15789,7 @@ function normalizeConfig(config) {
   const globals = schemaAwareConfig?.globals || [];
   const needsAudit = collections.some((col) => col.audit);
   const needsWorkflow = collections.some((col) => col.workflow || col.drafts);
+  const needsTasks = (config.tasks?.length ?? 0) > 0;
   const needsAuthSessions = collections.some((col) => !!col.auth);
   const adminAuthCollectionSlug = getAdminAuthCollection({
     collections,
@@ -14861,7 +15869,33 @@ function normalizeConfig(config) {
           }
         ];
       }
+      if (!existingFieldNames.has("__preferences")) {
+        fields = [
+          ...fields,
+          {
+            name: "__preferences",
+            type: "json",
+            label: "Preferences",
+            promoted: true,
+            admin: {
+              hidden: true,
+              readOnly: true
+            }
+          }
+        ];
+      }
       fields = fields.map((field) => {
+        if (field.name === "__preferences") {
+          return {
+            ...field,
+            promoted: true,
+            admin: {
+              ...field.admin || {},
+              hidden: true,
+              readOnly: true
+            }
+          };
+        }
         if (field.name === "email") {
           return {
             ...field,
@@ -14988,6 +16022,9 @@ function normalizeConfig(config) {
   if (needsWorkflow && !normalizedCollections.some((col) => col.slug === LIFECYCLE_EVENTS_COLLECTION)) {
     systemCollections.push(LIFECYCLE_EVENTS_COLLECTION_CONFIG);
   }
+  if (needsTasks && !normalizedCollections.some((col) => col.slug === TASK_LOCKS_COLLECTION)) {
+    systemCollections.push(TASK_LOCKS_COLLECTION_CONFIG);
+  }
   if (needsAuthSessions && !normalizedCollections.some((col) => col.slug === AUTH_SESSIONS_COLLECTION)) {
     systemCollections.push(AUTH_SESSIONS_COLLECTION_CONFIG);
   }
@@ -15357,6 +16394,7 @@ export {
   revokeAllAuthSessions,
   revokeAuthSession,
   sendEmail,
+  serializeActionsForApi,
   serializeDetailForApi,
   serializeViewForApi,
   shouldSampleRequest,