@dyrected/core 2.18.1 → 2.19.0

package/dist/index.js

@@ -1866,1821 +1866,2318 @@ import { SignJWT, jwtVerify, decodeJwt } from "jose";
 // src/auth/sessions.ts
 var AUTH_SESSIONS_COLLECTION = "__auth_sessions";
 
-// src/tasks.ts
-var TASK_LOCKS_COLLECTION = "__task_locks";
-var TASK_LOCKS_COLLECTION_CONFIG = {
-  slug: TASK_LOCKS_COLLECTION,
-  labels: { singular: "Task lock", plural: "Task locks" },
-  fields: [
-    { name: "name", type: "text", required: true },
-    // Numeric and promoted so the lock compare-and-set is a real column comparison.
-    { name: "lockedUntil", type: "number", required: true, promoted: true },
-    { name: "lockedBy", type: "text" },
-    { name: "lastScheduledFor", type: "date" },
-    { name: "lastStartedAt", type: "date" },
-    { name: "lastFinishedAt", type: "date" },
-    { name: "lastStatus", type: "text" },
-    { name: "lastError", type: "textarea" }
-  ],
-  access: {
-    read: ({ user }) => !!user?.roles?.includes("admin"),
-    create: () => false,
-    update: () => false,
-    delete: () => false
-  },
-  admin: { hidden: true }
-};
-var DEFAULT_LOCK_TIMEOUT_SECONDS = 300;
-var DEFAULT_TICK_MS = 3e4;
-var MONTH_NAMES = ["jan", "feb", "mar", "apr", "may", "jun", "jul", "aug", "sep", "oct", "nov", "dec"];
-var DAY_NAMES = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
-function parseCronField(raw, min2, max2, names, nameOffset, label) {
-  const values = /* @__PURE__ */ new Set();
-  const toNumber = (token) => {
-    const named = names?.indexOf(token.toLowerCase());
-    if (named !== void 0 && named >= 0) return named + nameOffset;
-    if (!/^\d+$/.test(token)) throw new Error(`Invalid cron ${label} "${token}".`);
-    return Number(token);
-  };
-  for (const part of raw.split(",")) {
-    const [rangePart, stepPart] = part.split("/");
-    const step = stepPart === void 0 ? 1 : Number(stepPart);
-    if (!Number.isInteger(step) || step < 1) throw new Error(`Invalid cron ${label} step "${part}".`);
-    let start;
-    let end;
-    if (rangePart === "*") {
-      start = min2;
-      end = max2;
-    } else if (rangePart.includes("-")) {
-      const [a, b] = rangePart.split("-");
-      start = toNumber(a);
-      end = toNumber(b);
-    } else {
-      start = toNumber(rangePart);
-      end = stepPart === void 0 ? start : max2;
-    }
-    if (start < min2 || end > max2 || start > end) {
-      throw new Error(`Cron ${label} "${part}" is out of range (${min2}-${max2}).`);
-    }
-    for (let v = start; v <= end; v += step) values.add(v);
-  }
-  return values;
+// src/utils/hooks.ts
+var import_jexl3 = __toESM(require_Jexl(), 1);
+
+// src/utils/declarative-hooks.ts
+var import_jexl2 = __toESM(require_Jexl(), 1);
+
+// src/utils/jexl-helpers.ts
+var import_jexl = __toESM(require_Jexl(), 1);
+function slugify(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase().trim().replace(/[^a-z0-9\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
 }
-function parseCron(expression) {
-  const fields = expression.trim().split(/\s+/);
-  if (fields.length !== 5) {
-    throw new Error(`Cron expression "${expression}" must have 5 fields (minute hour day-of-month month day-of-week).`);
-  }
-  const [min2, hour, dom, mon, dow] = fields;
-  const daysOfWeek = parseCronField(dow, 0, 7, DAY_NAMES, 0, "day-of-week");
-  if (daysOfWeek.has(7)) daysOfWeek.add(0);
-  daysOfWeek.delete(7);
-  return {
-    minutes: parseCronField(min2, 0, 59, void 0, 0, "minute"),
-    hours: parseCronField(hour, 0, 23, void 0, 0, "hour"),
-    daysOfMonth: parseCronField(dom, 1, 31, void 0, 0, "day-of-month"),
-    months: parseCronField(mon, 1, 12, MONTH_NAMES, 1, "month"),
-    daysOfWeek,
-    dayFieldsBothRestricted: dom !== "*" && dow !== "*"
-  };
+function lower(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).toLowerCase();
 }
-function dayMatches(schedule, date) {
-  const domOk = schedule.daysOfMonth.has(date.getUTCDate());
-  const dowOk = schedule.daysOfWeek.has(date.getUTCDay());
-  return schedule.dayFieldsBothRestricted ? domOk || dowOk : domOk && dowOk;
+function upper(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).toUpperCase();
 }
-function nextCronRun(expression, after) {
-  const schedule = typeof expression === "string" ? parseCron(expression) : expression;
-  const cursor = new Date(after.getTime());
-  cursor.setUTCSeconds(0, 0);
-  cursor.setUTCMinutes(cursor.getUTCMinutes() + 1);
-  const limit = after.getTime() + 5 * 366 * 24 * 60 * 60 * 1e3;
-  while (cursor.getTime() <= limit) {
-    if (!schedule.months.has(cursor.getUTCMonth() + 1)) {
-      cursor.setUTCMonth(cursor.getUTCMonth() + 1, 1);
-      cursor.setUTCHours(0, 0, 0, 0);
-      continue;
-    }
-    if (!dayMatches(schedule, cursor)) {
-      cursor.setUTCDate(cursor.getUTCDate() + 1);
-      cursor.setUTCHours(0, 0, 0, 0);
-      continue;
-    }
-    if (!schedule.hours.has(cursor.getUTCHours())) {
-      cursor.setUTCHours(cursor.getUTCHours() + 1, 0, 0, 0);
-      continue;
-    }
-    if (!schedule.minutes.has(cursor.getUTCMinutes())) {
-      cursor.setUTCMinutes(cursor.getUTCMinutes() + 1, 0, 0);
-      continue;
-    }
-    return cursor;
-  }
-  throw new Error(`Cron expression "${typeof expression === "string" ? expression : "schedule"}" never matches.`);
+function trim(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).trim();
 }
-function defineTask(task) {
-  if (!task.name || !task.name.trim()) throw new Error("A task needs a non-empty name.");
-  if (task.cron !== void 0) parseCron(task.cron);
-  if (task.lockTimeout !== void 0 && !(task.lockTimeout > 0)) {
-    throw new Error(`Task "${task.name}" lockTimeout must be a positive number of seconds.`);
-  }
-  return task;
+function capitalize(val) {
+  if (val === void 0 || val === null) return "";
+  const str = String(val).trim();
+  if (!str) return "";
+  return str.charAt(0).toUpperCase() + str.slice(1).toLowerCase();
 }
-function resolveLogger(config, taskName) {
-  const base = config.logger;
-  if (base && typeof base.child === "function") return base.child({ component: "tasks", task: taskName });
-  const prefix = `[dyrected/tasks] ${taskName}`;
-  return {
-    info: (obj, msg) => console.info(prefix, msg ?? "", obj),
-    warn: (obj, msg) => console.warn(prefix, msg ?? "", obj),
-    error: (obj, msg) => console.error(prefix, msg ?? "", obj)
-  };
+function truncate(val, length2, ellipsis = "...") {
+  if (val === void 0 || val === null) return "";
+  const str = String(val);
+  const maxLen = typeof length2 === "number" && length2 > 0 ? length2 : 100;
+  if (str.length <= maxLen) return str;
+  return str.slice(0, maxLen).trim() + String(ellipsis ?? "...");
 }
-function floorToMinute(date) {
-  const d = new Date(date.getTime());
-  d.setUTCSeconds(0, 0);
-  return d;
+function readingTime(val, wpm = 200) {
+  if (val === void 0 || val === null) return 1;
+  const str = String(val).trim();
+  if (!str) return 1;
+  const words = str.split(/\s+/).filter(Boolean).length;
+  return Math.max(1, Math.ceil(words / (typeof wpm === "number" && wpm > 0 ? wpm : 200)));
 }
-function createTaskRunner(config) {
-  const db = config.db;
-  if (!db) throw new Error("createTaskRunner requires config.db.");
-  const tasks = /* @__PURE__ */ new Map();
-  for (const task of config.tasks ?? []) {
-    if (tasks.has(task.name)) throw new Error(`Duplicate task name "${task.name}".`);
-    tasks.set(task.name, { ...task, schedule: task.cron ? parseCron(task.cron) : void 0 });
+function wordCount(val) {
+  if (val === void 0 || val === null) return 0;
+  const str = String(val).trim();
+  if (!str) return 0;
+  return str.split(/\s+/).filter(Boolean).length;
+}
+function replace(val, search, replacement) {
+  if (val === void 0 || val === null) return "";
+  return String(val).replace(new RegExp(String(search || ""), "g"), String(replacement ?? ""));
+}
+function startsWith(str, prefix) {
+  if (str === void 0 || str === null) return false;
+  return String(str).startsWith(String(prefix ?? ""));
+}
+function endsWith(str, suffix) {
+  if (str === void 0 || str === null) return false;
+  return String(str).endsWith(String(suffix ?? ""));
+}
+function now() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function today() {
+  return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+}
+function formatDate(val, style = "short") {
+  if (!val) return "";
+  const d = new Date(val);
+  if (Number.isNaN(d.getTime())) return "";
+  const styleStr = String(style).toLowerCase();
+  if (styleStr === "iso" || styleStr === "date") return d.toISOString().slice(0, 10);
+  if (styleStr === "datetime" || styleStr === "full") return d.toISOString();
+  return d.toLocaleDateString("en-US", {
+    year: "numeric",
+    month: "short",
+    day: "numeric"
+  });
+}
+function addDays(val, days) {
+  const d = val ? new Date(val) : /* @__PURE__ */ new Date();
+  if (Number.isNaN(d.getTime())) return "";
+  const daysNum = typeof days === "number" ? days : Number(days) || 0;
+  d.setDate(d.getDate() + daysNum);
+  return d.toISOString();
+}
+function diffDays(dateA, dateB) {
+  const dA = dateA ? new Date(dateA) : /* @__PURE__ */ new Date();
+  const dB = dateB ? new Date(dateB) : /* @__PURE__ */ new Date();
+  if (Number.isNaN(dA.getTime()) || Number.isNaN(dB.getTime())) return 0;
+  const diffMs = Math.abs(dA.getTime() - dB.getTime());
+  return Math.floor(diffMs / (1e3 * 60 * 60 * 24));
+}
+function isPast(val) {
+  if (!val) return false;
+  const d = new Date(val);
+  if (Number.isNaN(d.getTime())) return false;
+  return d.getTime() < Date.now();
+}
+function isFuture(val) {
+  if (!val) return false;
+  const d = new Date(val);
+  if (Number.isNaN(d.getTime())) return false;
+  return d.getTime() > Date.now();
+}
+function includes(arrOrStr, item) {
+  if (Array.isArray(arrOrStr)) {
+    return arrOrStr.includes(item);
   }
-  const instanceId = globalThis.crypto?.randomUUID?.() ?? `inst_${Date.now()}_${Math.random().toString(36).slice(2)}`;
-  let timer;
-  let inFlight = Promise.resolve();
-  let ticking = false;
-  let ready;
-  function ensureReady() {
-    ready ??= Promise.resolve(db.sync?.([TASK_LOCKS_COLLECTION_CONFIG], [])).then(() => void 0);
-    ready.catch(() => {
-      ready = void 0;
-    });
-    return ready;
+  if (typeof arrOrStr === "string") {
+    return arrOrStr.includes(String(item ?? ""));
   }
-  async function ensureLockRow(name, now2) {
-    await ensureReady();
-    const existing = await db.findOne({ collection: TASK_LOCKS_COLLECTION, id: name });
-    if (existing) return existing;
-    try {
-      return await db.create({
-        collection: TASK_LOCKS_COLLECTION,
-        data: {
-          id: name,
-          name,
-          lockedUntil: 0,
-          lockedBy: null,
-          lastScheduledFor: floorToMinute(now2).toISOString(),
-          lastStartedAt: null,
-          lastFinishedAt: null,
-          lastStatus: null,
-          lastError: null
-        }
-      });
-    } catch (error) {
-      const created = await db.findOne({ collection: TASK_LOCKS_COLLECTION, id: name });
-      if (created) return created;
-      throw error;
-    }
-  }
-  async function execute(task, row, scheduledFor) {
-    const started = Date.now();
-    const lockMs = (task.lockTimeout ?? DEFAULT_LOCK_TIMEOUT_SECONDS) * 1e3;
-    const token = `${instanceId}:${started}`;
-    const where = {
-      id: { equals: task.name },
-      lockedUntil: { less_than: started }
-    };
-    if (scheduledFor) where.lastScheduledFor = { equals: row.lastScheduledFor };
-    const claimed = await db.update({
-      collection: TASK_LOCKS_COLLECTION,
-      where,
-      data: {
-        lockedUntil: started + lockMs,
-        lockedBy: token,
-        lastStartedAt: new Date(started).toISOString(),
-        ...scheduledFor ? { lastScheduledFor: scheduledFor.toISOString() } : {}
-      }
-    });
-    if (claimed.affectedRows !== 1) {
-      return { name: task.name, status: "skipped", reason: "locked", durationMs: Date.now() - started };
-    }
-    const logger = resolveLogger(config, task.name);
-    const controller = new AbortController();
-    let timeout;
-    let status = "completed";
-    let errorMessage;
-    try {
-      await Promise.race([
-        Promise.resolve(task.run({ db, logger, signal: controller.signal, scheduledFor })),
-        new Promise((_, reject) => {
-          timeout = setTimeout(() => {
-            reject(new Error(`Task exceeded its lockTimeout of ${lockMs / 1e3}s.`));
-            controller.abort();
-          }, lockMs);
-        })
-      ]);
-    } catch (error) {
-      status = "failed";
-      errorMessage = error instanceof Error ? error.message : String(error);
-      logger.error({ err: error }, "Task failed");
-    } finally {
-      if (timeout) clearTimeout(timeout);
-    }
-    try {
-      await db.update({
-        collection: TASK_LOCKS_COLLECTION,
-        where: { id: { equals: task.name }, lockedBy: { equals: token } },
-        data: {
-          lockedUntil: 0,
-          lockedBy: null,
-          lastFinishedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          lastStatus: status,
-          lastError: errorMessage ?? null
-        }
-      });
-    } catch (error) {
-      logger.warn({ err: error }, "Could not release task lock; it will expire on its own");
-    }
-    return { name: task.name, status, error: errorMessage, durationMs: Date.now() - started };
-  }
-  function track(work) {
-    inFlight = inFlight.then(() => work).catch(() => void 0);
-    return work;
-  }
-  const runner = {
-    async runTask(name) {
-      const task = tasks.get(name);
-      if (!task) throw new Error(`Unknown task "${name}".`);
-      const row = await ensureLockRow(name, /* @__PURE__ */ new Date());
-      return track(execute(task, row, void 0));
-    },
-    async runDue(now2 = /* @__PURE__ */ new Date()) {
-      const results = [];
-      for (const task of tasks.values()) {
-        if (!task.schedule) continue;
-        const row = await ensureLockRow(task.name, now2);
-        const reference = new Date(String(row.lastScheduledFor));
-        const due = Number.isNaN(reference.getTime()) ? true : nextCronRun(task.schedule, reference).getTime() <= now2.getTime();
-        if (!due) {
-          results.push({ name: task.name, status: "skipped", reason: "not-due", durationMs: 0 });
-          continue;
-        }
-        results.push(await track(execute(task, row, floorToMinute(now2))));
-      }
-      return results;
-    },
-    start(options) {
-      if (timer) return;
-      const intervalMs = options?.intervalMs ?? DEFAULT_TICK_MS;
-      const tick = () => {
-        if (ticking) return;
-        ticking = true;
-        runner.runDue().catch((error) => resolveLogger(config, "runner").error({ err: error }, "Task tick failed")).finally(() => {
-          ticking = false;
-        });
-      };
-      timer = setInterval(tick, intervalMs);
-      timer.unref?.();
-      setTimeout(tick, 0);
-    },
-    async stop() {
-      if (timer) clearInterval(timer);
-      timer = void 0;
-      await inFlight;
-    }
-  };
-  return runner;
+  return false;
 }
-
-// src/workflows.ts
-var WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
-var LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
-var EDITOR_CAPABILITIES = ["entry.edit", "entry.submit"];
-var PUBLISHER_CAPABILITIES = ["entry.edit", "entry.submit", "entry.publish", "entry.unpublish"];
-function definePublishingWorkflow(options = {}) {
-  const editors = options.editors ?? ["editor"];
-  const publishers = options.publishers ?? ["publisher", "admin"];
-  return {
-    initialState: "draft",
-    draftState: "draft",
-    states: [
-      { name: "draft", label: "Draft", color: "neutral" },
-      { name: "in_review", label: "In review", color: "warning" },
-      { name: "published", label: "Published", color: "success", published: true }
-    ],
-    transitions: [
-      {
-        name: "submit",
-        label: "Submit for review",
-        from: "draft",
-        to: "in_review",
-        requiredCapabilities: ["entry.submit"]
-      },
-      {
-        name: "publish",
-        label: "Publish",
-        from: "in_review",
-        to: "published",
-        requiredCapabilities: ["entry.publish"]
-      },
-      {
-        name: "reject",
-        label: "Request changes",
-        from: "in_review",
-        to: "draft",
-        requiredCapabilities: ["entry.publish"],
-        requireComment: true
-      },
-      {
-        name: "unpublish",
-        label: "Unpublish",
-        from: "published",
-        to: "draft",
-        requiredCapabilities: ["entry.unpublish"],
-        unpublish: true
-      }
-    ],
-    roles: [
-      ...editors.map((role) => ({ role, capabilities: [...EDITOR_CAPABILITIES] })),
-      ...publishers.map((role) => ({ role, capabilities: [...PUBLISHER_CAPABILITIES] }))
-    ]
-  };
+function join(arr, separator = ", ") {
+  if (!Array.isArray(arr)) return "";
+  return arr.filter((item) => item !== void 0 && item !== null).join(String(separator));
 }
-function publishingWorkflow() {
-  return definePublishingWorkflow();
+function first(arr) {
+  if (Array.isArray(arr)) return arr[0] ?? null;
+  return null;
 }
-function simplePublishingWorkflow() {
-  return {
-    initialState: "draft",
-    draftState: "draft",
-    states: [
-      { name: "draft", label: "Draft", color: "neutral" },
-      { name: "published", label: "Published", color: "success", published: true }
-    ],
-    transitions: [
-      { name: "publish", label: "Publish", from: ["draft", "published"], to: "published" },
-      { name: "unpublish", label: "Unpublish", from: "published", to: "draft", unpublish: true }
-    ]
-    // Intentionally no `roles`: this lightweight workflow (synthesized from
-    // `drafts: true`) does no capability-based gating. Draft visibility for a
-    // no-roles workflow is handled in `canViewWorkflowDraft`.
-  };
+function last(arr) {
+  if (Array.isArray(arr)) return arr[arr.length - 1] ?? null;
+  return null;
 }
-function publicMetadata(meta) {
-  const { availableTransitions: _availableTransitions, ...safe } = meta;
-  return safe;
+function compact(arr) {
+  if (!Array.isArray(arr)) return [];
+  return arr.filter((item) => item !== void 0 && item !== null && item !== "");
 }
-function workflowCapabilities(workflow, user) {
-  const capabilities = new Set(Array.isArray(user?.capabilities) ? user.capabilities : []);
-  const roles = Array.isArray(user?.roles) ? user.roles : typeof user?.role === "string" ? [user.role] : [];
-  for (const mapping of workflow.roles ?? []) {
-    if (roles.includes(mapping.role)) mapping.capabilities.forEach((capability) => capabilities.add(capability));
-  }
-  return capabilities;
+function unique(arr) {
+  if (!Array.isArray(arr)) return [];
+  return Array.from(new Set(arr));
 }
-function canViewWorkflowDraft(workflow, user) {
-  if (!user) return false;
-  const capabilities = workflowCapabilities(workflow, user);
-  if (capabilities.has("entry.edit")) return true;
-  if (workflow.transitions.some(
-    (transition) => (transition.requiredCapabilities ?? []).some((capability) => capabilities.has(capability))
-  )) {
-    return true;
-  }
-  if (!workflow.roles || workflow.roles.length === 0) return true;
-  return false;
+function length(val) {
+  if (Array.isArray(val) || typeof val === "string") return val.length;
+  if (val && typeof val === "object") return Object.keys(val).length;
+  return 0;
 }
-function availableWorkflowTransitions(workflow, state, user) {
-  const capabilities = workflowCapabilities(workflow, user);
-  return workflow.transitions.filter((transition) => {
-    const from = Array.isArray(transition.from) ? transition.from : [transition.from];
-    return from.includes(state) && (transition.requiredCapabilities ?? []).every((item) => capabilities.has(item));
-  });
+function round(val, decimals = 0) {
+  const num = Number(val);
+  if (Number.isNaN(num)) return 0;
+  const dec = typeof decimals === "number" ? decimals : Number(decimals) || 0;
+  const factor = Math.pow(10, dec);
+  return Math.round(num * factor) / factor;
 }
-function initializeWorkflowDocument(data, workflow) {
-  return {
-    ...data,
-    __workflow: { state: workflow.initialState, revision: 1 }
-  };
+function clamp(val, minVal, maxVal) {
+  const num = Number(val) || 0;
+  const min2 = Number(minVal) || 0;
+  const max2 = Number(maxVal) || 0;
+  return Math.min(Math.max(num, min2), max2);
 }
-function publishedStateName(workflow) {
-  return workflow.states.find((state) => state.published)?.name ?? workflow.states[workflow.states.length - 1]?.name ?? workflow.initialState;
+function ceil(val) {
+  return Math.ceil(Number(val) || 0);
 }
-function materializeWorkflowDocument(doc, workflow, user) {
-  const meta = doc.__workflow;
-  const publishedState = publishedStateName(workflow);
-  if (!meta) {
-    const { __published: _legacyPublished, __workflow: _legacyWorkflow, ...working2 } = doc;
-    const state = publishedStateName(workflow);
-    return {
-      ...working2,
-      _workflow: {
-        state,
-        revision: 1,
-        availableTransitions: availableWorkflowTransitions(workflow, state, user).map((item) => item.name)
-      }
-    };
-  }
-  const { __published, __workflow, ...working } = doc;
-  if (!canViewWorkflowDraft(workflow, user)) {
-    if (!__published || typeof __published !== "object") {
-      if (meta.state === publishedState) {
-        return { ...working, _workflow: publicMetadata(meta) };
-      }
-      return null;
-    }
-    return { id: doc.id, ...__published, _workflow: publicMetadata(meta) };
-  }
-  return {
-    ...working,
-    _workflow: {
-      ...meta,
-      availableTransitions: availableWorkflowTransitions(workflow, meta.state, user).map((item) => item.name)
-    }
-  };
+function floor(val) {
+  return Math.floor(Number(val) || 0);
 }
-function eventId() {
-  return globalThis.crypto?.randomUUID?.() ?? `evt_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+function abs(val) {
+  return Math.abs(Number(val) || 0);
 }
-function createLifecycleEvent(args) {
-  return {
-    id: eventId(),
-    name: args.name,
-    collection: args.collection,
-    documentId: args.documentId,
-    occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
-    actorId: args.actorId,
-    payload: args.payload,
-    attempts: 0,
-    status: "pending"
-  };
+function min(...args) {
+  const nums = args.flat().map((n) => Number(n) || 0);
+  return nums.length ? Math.min(...nums) : 0;
 }
-async function persistEvent(db, event) {
-  await db.create({ collection: LIFECYCLE_EVENTS_COLLECTION, data: event });
+function max(...args) {
+  const nums = args.flat().map((n) => Number(n) || 0);
+  return nums.length ? Math.max(...nums) : 0;
 }
-async function dispatchLifecycleEvent(config, event) {
-  const db = config.db;
-  if (!db || !config.events?.handlers.length) return;
-  const maxAttempts = config.events.maxAttempts ?? 8;
-  const retryDelayMs = config.events.retryDelayMs ?? 1e3;
-  const attempts = event.attempts + 1;
-  try {
-    await db.update({
-      collection: LIFECYCLE_EVENTS_COLLECTION,
-      id: event.id,
-      data: { status: "processing", attempts }
-    });
-    for (const handler of config.events.handlers) await handler({ ...event, status: "processing", attempts });
-    await db.update({
-      collection: LIFECYCLE_EVENTS_COLLECTION,
-      id: event.id,
-      data: { status: "delivered", attempts, deliveredAt: (/* @__PURE__ */ new Date()).toISOString(), lastError: null }
-    });
-  } catch (error) {
-    const exhausted = attempts >= maxAttempts;
-    await db.update({
-      collection: LIFECYCLE_EVENTS_COLLECTION,
-      id: event.id,
-      data: {
-        status: "failed",
-        attempts,
-        lastError: error instanceof Error ? error.message : String(error),
-        nextAttemptAt: exhausted ? null : new Date(Date.now() + retryDelayMs * 2 ** (attempts - 1)).toISOString()
-      }
-    });
-  }
+function pow(base, exp) {
+  return Math.pow(Number(base) || 0, Number(exp) || 0);
 }
-async function dispatchPendingLifecycleEvents(config, limit = 50) {
-  if (!config.db || !config.events?.handlers.length) return 0;
-  const maxAttempts = config.events.maxAttempts ?? 8;
-  const result = await config.db.find({
-    collection: LIFECYCLE_EVENTS_COLLECTION,
-    where: { status: { in: ["pending", "failed"] } },
-    sort: "occurredAt",
-    limit
-  });
-  const now2 = Date.now();
-  const due = result.docs.filter(
-    (doc) => Number(doc.attempts ?? 0) < maxAttempts && (!doc.nextAttemptAt || new Date(doc.nextAttemptAt).getTime() <= now2)
-  );
-  for (const event of due) await dispatchLifecycleEvent(config, event);
-  return due.length;
+function sqrt(val) {
+  return Math.sqrt(Number(val) || 0);
 }
-async function saveWorkflowDraft(args) {
-  const { config, collection, id, originalDoc, data, user, beforeCommit } = args;
-  const db = config.db;
-  const workflow = collection.workflow;
-  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
-  const previous = originalDoc.__workflow;
-  const isLegacyPublishedDoc = !previous;
-  const baselineRevision = previous?.revision ?? 1;
-  const event = createLifecycleEvent({
-    name: "revision.created",
-    collection: collection.slug,
-    documentId: id,
-    actorId: user?.sub,
-    payload: {
-      revision: baselineRevision + 1,
-      previousRevision: isLegacyPublishedDoc ? baselineRevision : previous?.revision ?? null
-    }
-  });
-  const doc = await db.transaction(async (tx) => {
-    const nextMeta = {
-      ...previous ?? {},
-      state: isLegacyPublishedDoc ? workflow.draftState ?? workflow.initialState : originalDoc.__published ? workflow.draftState ?? workflow.initialState : previous.state,
-      revision: baselineRevision + 1,
-      ...isLegacyPublishedDoc ? { publishedRevision: baselineRevision } : {}
-    };
-    const updateData = {
-      ...data,
-      __workflow: nextMeta
-    };
-    if (isLegacyPublishedDoc) {
-      const { __workflow: _legacyWorkflow, __published: _legacyPublished, ...publishedSnapshot } = originalDoc;
-      updateData.__published = publishedSnapshot;
-    }
-    const updated = await tx.update({ collection: collection.slug, id, data: updateData });
-    await persistEvent(tx, event);
-    await beforeCommit?.(tx, updated);
-    return updated;
-  });
-  void dispatchLifecycleEvent(config, event);
-  return { doc, event };
+function sum(arr) {
+  if (!Array.isArray(arr)) return Number(arr) || 0;
+  return arr.reduce((acc, val) => acc + (Number(val) || 0), 0);
 }
-async function createWorkflowDocument(args) {
-  const { config, collection, data, user, beforeCommit } = args;
-  const db = config.db;
-  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
-  let event;
-  const doc = await db.transaction(async (tx) => {
-    const created = await tx.create({ collection: collection.slug, data });
-    event = createLifecycleEvent({
-      name: "revision.created",
-      collection: collection.slug,
-      documentId: created.id,
-      actorId: user?.sub,
-      payload: { revision: 1, previousRevision: null }
-    });
-    await persistEvent(tx, event);
-    await beforeCommit?.(tx, created);
-    return created;
-  });
-  void dispatchLifecycleEvent(config, event);
-  return { doc, event };
+function count(val) {
+  if (Array.isArray(val)) return val.length;
+  if (typeof val === "string") return val.length;
+  if (val !== void 0 && val !== null && val !== false) return 1;
+  return 0;
 }
-async function transitionWorkflow(args) {
-  const { config, collection, id, transitionName, expectedRevision, comment, input, user, req } = args;
-  const db = config.db;
-  const workflow = collection.workflow;
-  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
-  const original = await db.findOne({ collection: collection.slug, id });
-  if (!original) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
-  const meta = original.__workflow;
-  if (!meta) throw Object.assign(new Error("Entry has no workflow metadata"), { statusCode: 409 });
-  if (expectedRevision !== void 0 && expectedRevision !== meta.revision) {
-    throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), {
-      statusCode: 409
-    });
-  }
-  const transition = workflow.transitions.find((item) => item.name === transitionName);
-  const fromStates = transition ? Array.isArray(transition.from) ? transition.from : [transition.from] : [];
-  if (!transition || !fromStates.includes(meta.state)) {
-    throw Object.assign(new Error(`Transition "${transitionName}" is not valid from "${meta.state}".`), {
-      statusCode: 409
-    });
-  }
-  if (!availableWorkflowTransitions(workflow, meta.state, user).some((item) => item.name === transition.name)) {
-    throw Object.assign(new Error(`You do not have permission to perform "${transition.label}".`), { statusCode: 403 });
+function defaultValue(val, fallback) {
+  if (val === void 0 || val === null || val === "") return fallback;
+  return val;
+}
+function coalesce(...args) {
+  for (const arg of args) {
+    if (arg !== void 0 && arg !== null && arg !== "") return arg;
   }
-  if (transition.requireComment && !comment?.trim()) {
-    throw Object.assign(new Error(`A comment is required for "${transition.label}".`), { statusCode: 400 });
+  return null;
+}
+function isEmpty(val) {
+  if (val === void 0 || val === null || val === "") return true;
+  if (Array.isArray(val)) return val.length === 0;
+  if (typeof val === "object") return Object.keys(val).length === 0;
+  return false;
+}
+function get(obj, path, fallback = null) {
+  if (obj === void 0 || obj === null || typeof obj !== "object") return fallback;
+  if (typeof path !== "string") return fallback;
+  const parts = path.split(".").filter(Boolean);
+  let curr = obj;
+  for (const part of parts) {
+    if (curr === void 0 || curr === null || typeof curr !== "object") return fallback;
+    curr = curr[part];
   }
-  const hookContext = { transition, from: meta.state, to: transition.to, doc: original, user, comment, input, req, db };
-  for (const hook of workflow.hooks?.beforeTransition ?? []) await hook(hookContext);
-  const events = [
-    createLifecycleEvent({
-      name: "workflow.transitioned",
-      collection: collection.slug,
-      documentId: id,
-      actorId: user?.sub,
-      payload: { transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision, comment }
-    })
-  ];
-  const targetState = workflow.states.find((state) => state.name === transition.to);
-  if (targetState.published) {
-    events.push(
-      createLifecycleEvent({
-        name: "entry.published",
-        collection: collection.slug,
-        documentId: id,
-        actorId: user?.sub,
-        payload: { revision: meta.revision }
-      })
-    );
-  } else if (transition.unpublish) {
-    events.push(
-      createLifecycleEvent({
-        name: "entry.unpublished",
-        collection: collection.slug,
-        documentId: id,
-        actorId: user?.sub,
-        payload: { revision: meta.publishedRevision }
-      })
-    );
-  }
-  const updated = await db.transaction(async (tx) => {
-    const locked = await tx.findOne({ collection: collection.slug, id });
-    if (!locked) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
-    const lockedMeta = locked.__workflow;
-    if (lockedMeta.revision !== meta.revision || lockedMeta.state !== meta.state || expectedRevision !== void 0 && lockedMeta.revision !== expectedRevision) {
-      throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), {
-        statusCode: 409
-      });
-    }
-    const now2 = (/* @__PURE__ */ new Date()).toISOString();
-    const { __published: _published, __workflow: _workflow, id: _id, ...working } = locked;
-    const nextMeta = {
-      ...lockedMeta,
-      state: transition.to,
-      ...targetState.published ? { publishedRevision: lockedMeta.revision, publishedAt: now2, publishedBy: user?.sub } : {},
-      ...transition.unpublish ? { publishedRevision: void 0, publishedAt: void 0, publishedBy: void 0 } : {}
-    };
-    const data = { __workflow: nextMeta };
-    if (targetState.published) data.__published = working;
-    if (transition.unpublish) data.__published = null;
-    const next = await tx.update({ collection: collection.slug, id, data });
-    if (transition.onTransition) {
-      await transition.onTransition({
-        transition,
-        from: lockedMeta.state,
-        to: transition.to,
-        doc: locked,
-        input,
-        comment,
-        user,
-        req,
-        tx
-      });
-    }
-    await tx.create({
-      collection: WORKFLOW_HISTORY_COLLECTION,
-      data: {
-        collection: collection.slug,
-        documentId: id,
-        transition: transition.name,
-        from: lockedMeta.state,
-        to: transition.to,
-        revision: lockedMeta.revision,
-        comment: comment ?? null,
-        actorId: user?.sub ?? null,
-        createdAt: now2
-      }
-    });
-    for (const event of events) await persistEvent(tx, event);
-    if (collection.audit) {
-      await tx.create({
-        collection: "__audit",
-        data: {
-          collection: collection.slug,
-          documentId: id,
-          operation: "workflow.transition",
-          user: user?.sub ?? null,
-          timestamp: now2,
-          changes: JSON.stringify({
-            transition: transition.name,
-            from: lockedMeta.state,
-            to: transition.to,
-            revision: lockedMeta.revision
-          })
-        }
-      });
+  return curr === void 0 || curr === null ? fallback : curr;
+}
+function registerJexlHelpers(jexlInstance = import_jexl.default) {
+  const helpers = {
+    // Strings
+    slugify,
+    lower,
+    upper,
+    trim,
+    capitalize,
+    truncate,
+    readingTime,
+    wordCount,
+    replace,
+    startsWith,
+    endsWith,
+    // Dates
+    now,
+    today,
+    formatDate,
+    addDays,
+    diffDays,
+    isPast,
+    isFuture,
+    // Arrays
+    includes,
+    join,
+    first,
+    last,
+    compact,
+    unique,
+    length,
+    // Math
+    round,
+    clamp,
+    ceil,
+    floor,
+    abs,
+    min,
+    max,
+    pow,
+    sqrt,
+    sum,
+    count,
+    // Objects & Logical
+    default: defaultValue,
+    coalesce,
+    isEmpty,
+    get
+  };
+  for (const [name, fn] of Object.entries(helpers)) {
+    try {
+      jexlInstance.addFunction(name, fn);
+    } catch {
     }
-    return next;
-  });
-  for (const event of events) void dispatchLifecycleEvent(config, event);
-  for (const hook of workflow.hooks?.afterTransition ?? []) {
     try {
-      await hook({ ...hookContext, doc: updated, event: events[0] });
-    } catch (error) {
-      try {
-        const obs = config?.__observability;
-        obs?.recordWorkflowHookFailure?.({
-          collection: collection.slug,
-          transition: transition.name
-        });
-        const logger = config?.logger;
-        if (logger && typeof logger.child === "function") {
-          logger.child({ component: "workflow" }).error({
-            err: error,
-            msg: "afterTransition hook failed",
-            collection: collection.slug,
-            transition: transition.name,
-            documentId: id
-          });
-        } else if (logger && typeof logger.error === "function") {
-          logger.error({
-            err: error,
-            msg: "afterTransition hook failed",
-            collection: collection.slug,
-            transition: transition.name,
-            documentId: id
-          });
-        } else {
-          console.error("afterTransition hook failed:", error);
-        }
-      } catch {
-        console.error("afterTransition hook failed:", error);
-      }
+      jexlInstance.addTransform(name, fn);
+    } catch {
     }
   }
-  return updated;
-}
-
-// src/utils/admin-auth.ts
-function getAdminAuthCollection(config) {
-  const adminCollection = resolveAdminAuthCollection(config.collections, config.adminAuth?.collectionSlug);
-  return adminCollection ?? null;
-}
-function resolveAdminAuthCollection(collections, collectionSlug) {
-  const adminsCollection = collections.find((collection) => collection.slug === "__admins");
-  if (adminsCollection) return adminsCollection;
-  if (collectionSlug) {
-    const requestedCollection = collections.find((collection) => collection.slug === collectionSlug);
-    if (requestedCollection) return requestedCollection;
+  try {
+    jexlInstance.addBinaryOp("and", 20, (left, right) => Boolean(left && right));
+    jexlInstance.addBinaryOp("or", 10, (left, right) => Boolean(left || right));
+    jexlInstance.addBinaryOp("in", 30, (left, right) => {
+      if (Array.isArray(right)) return right.includes(left);
+      if (typeof right === "string") return right.includes(String(left ?? ""));
+      return false;
+    });
+  } catch {
   }
-  return collections.find((collection) => collection.auth);
-}
-function getPublicAdminAuthConfig(adminAuth, collections) {
-  const providers = (adminAuth?.providers ?? []).map((provider) => ({
-    id: provider.id,
-    type: provider.type,
-    displayName: provider.displayName || humanizeProviderName(provider.id, provider.type),
-    autoRedirect: provider.autoRedirect
-  }));
-  const resolvedCollectionSlug = collections ? resolveAdminAuthCollection(collections, adminAuth?.collectionSlug)?.slug : adminAuth?.collectionSlug;
-  return {
-    mode: adminAuth?.mode ?? "local",
-    collectionSlug: resolvedCollectionSlug,
-    provisioningMode: adminAuth?.provisioningMode,
-    providers
-  };
 }
-function humanizeProviderName(id, type) {
-  const cleaned = id.replace(/[-_]+/g, " ").trim();
-  if (!cleaned) return type.toUpperCase();
-  return cleaned.replace(/\b\w/g, (char) => char.toUpperCase());
-}
-function getAdminRoleForCollection(collection) {
-  if (!collection?.auth) return "admin";
-  if (typeof collection.auth === "object" && collection.auth.adminRole) {
-    return collection.auth.adminRole;
+registerJexlHelpers(import_jexl.default);
+async function evaluateJexl(expression, context = {}) {
+  if (!expression || typeof expression !== "string") return void 0;
+  try {
+    const evalContext = {
+      null: null,
+      undefined: void 0,
+      ...context,
+      math: Math,
+      Math
+    };
+    return await import_jexl.default.eval(expression, evalContext);
+  } catch (_err) {
+    return void 0;
   }
-  return "admin";
 }
-function isUserAdmin(user, collection) {
-  if (!user) return false;
-  const roles = Array.isArray(user.roles) ? user.roles : typeof user.role === "string" ? [user.role] : [];
-  if (roles.length === 0) return false;
-  const configuredRole = getAdminRoleForCollection(collection);
-  if (roles.includes(configuredRole)) return true;
-  return roles.includes("admin") || roles.includes("super_admin");
-}
-
-// src/utils/block-references.ts
-function mergeUniqueBlocks(blocks) {
-  const seen = /* @__PURE__ */ new Map();
-  for (const block of blocks) {
-    const existing = seen.get(block.slug);
-    if (existing && existing !== block) {
-      throw new Error(
-        `Duplicate block slug "${block.slug}" found in the reusable block registry. Block slugs must be unique.`
-      );
-    }
-    if (!existing) seen.set(block.slug, block);
-  }
-  return Array.from(seen.values());
-}
-function buildRegistry(blocks) {
-  return new Map(blocks.map((block) => [block.slug, block]));
-}
-function resolveField(field, registry, blockCache) {
-  const next = { ...field };
-  if (next.fields) {
-    next.fields = next.fields.map(
-      (child) => resolveField(child, registry, blockCache)
-    );
-  }
-  if (next.type !== "blocks") return next;
-  const hasInlineBlocks = Array.isArray(next.blocks) && next.blocks.length > 0;
-  const hasReferences = Array.isArray(next.blockReferences) && next.blockReferences.length > 0;
-  if (hasInlineBlocks && hasReferences) {
-    throw new Error(
-      `Blocks field "${next.name ?? "(unnamed)"}" cannot define both "blocks" and "blockReferences". Use one or the other.`
-    );
-  }
-  if (hasReferences) {
-    next.blocks = next.blockReferences.map((slug) => {
-      const block = registry.get(slug);
-      if (!block) {
-        throw new Error(
-          `Unknown block reference "${slug}" on blocks field "${next.name ?? "(unnamed)"}". Add it to defineConfig({ blocks: [...] }).`
-        );
-      }
-      return resolveBlock(block, registry, blockCache);
-    });
-    return next;
-  }
-  if (hasInlineBlocks) {
-    next.blocks = next.blocks.map(
-      (block) => resolveBlock(block, registry, blockCache)
-    );
-  }
-  return next;
-}
-function resolveBlock(block, registry, blockCache) {
-  const cached = blockCache.get(block);
-  if (cached) return cached;
-  const resolved = {
-    ...block,
-    fields: []
-  };
-  blockCache.set(block, resolved);
-  resolved.fields = block.fields.map(
-    (field) => resolveField(field, registry, blockCache)
-  );
-  return resolved;
-}
-function resolveFields(fields, registry, blockCache) {
-  return fields.map((field) => resolveField(field, registry, blockCache));
-}
-function normalizeSchemaFragment(fragment) {
-  const reusableBlocks = mergeUniqueBlocks(fragment.blocks ?? []);
-  const registry = buildRegistry(reusableBlocks);
-  const blockCache = /* @__PURE__ */ new WeakMap();
-  const resolvedBlocks = reusableBlocks.map(
-    (block) => resolveBlock(block, registry, blockCache)
-  );
-  const resolvedCollections = (fragment.collections ?? []).map(
-    (collection) => ({
-      ...collection,
-      fields: resolveFields(collection.fields ?? [], registry, blockCache)
-    })
-  );
-  const resolvedGlobals = (fragment.globals ?? []).map((global) => ({
-    ...global,
-    fields: resolveFields(global.fields ?? [], registry, blockCache)
-  }));
-  return {
-    ...fragment,
-    ...fragment.blocks ? { blocks: resolvedBlocks } : {},
-    ...fragment.collections ? { collections: resolvedCollections } : {},
-    ...fragment.globals ? { globals: resolvedGlobals } : {}
-  };
+function evaluateJexlSync(expression, context = {}) {
+  if (!expression || typeof expression !== "string") return void 0;
+  try {
+    const evalContext = {
+      null: null,
+      undefined: void 0,
+      ...context,
+      math: Math,
+      Math
+    };
+    return import_jexl.default.evalSync(expression, evalContext);
+  } catch (_err) {
+    return void 0;
+  }
 }
+var BUILTIN_JEXL_HELPERS = [
+  // Strings
+  "slugify",
+  "lower",
+  "upper",
+  "trim",
+  "capitalize",
+  "truncate",
+  "readingTime",
+  "wordCount",
+  "replace",
+  "startsWith",
+  "endsWith",
+  // Dates
+  "now",
+  "today",
+  "formatDate",
+  "addDays",
+  "diffDays",
+  "isPast",
+  "isFuture",
+  // Arrays
+  "includes",
+  "join",
+  "first",
+  "last",
+  "compact",
+  "unique",
+  "length",
+  // Math
+  "round",
+  "clamp",
+  // Objects & Logical
+  "default",
+  "coalesce",
+  "isEmpty",
+  "get"
+];
 
 // src/utils/declarative-hooks.ts
-var import_jexl2 = __toESM(require_Jexl(), 1);
-
-// src/utils/jexl-helpers.ts
-var import_jexl = __toESM(require_Jexl(), 1);
-function slugify(val) {
-  if (val === void 0 || val === null) return "";
-  return String(val).normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase().trim().replace(/[^a-z0-9\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
-}
-function lower(val) {
-  if (val === void 0 || val === null) return "";
-  return String(val).toLowerCase();
-}
-function upper(val) {
-  if (val === void 0 || val === null) return "";
-  return String(val).toUpperCase();
-}
-function trim(val) {
-  if (val === void 0 || val === null) return "";
-  return String(val).trim();
+registerJexlHelpers(import_jexl2.default);
+var SURFACE_ROOTS = {
+  "collection.beforeRead": ["req", "user", "query", ...BUILTIN_JEXL_HELPERS],
+  "collection.afterRead": ["req", "user", "doc", ...BUILTIN_JEXL_HELPERS],
+  "collection.beforeChange": ["req", "user", "data", "doc", "operation", ...BUILTIN_JEXL_HELPERS],
+  "global.beforeRead": ["req", "user", "query", ...BUILTIN_JEXL_HELPERS],
+  "global.afterRead": ["req", "user", "doc", ...BUILTIN_JEXL_HELPERS],
+  "global.beforeChange": ["req", "user", "data", "doc", "operation", ...BUILTIN_JEXL_HELPERS],
+  "field.beforeChange": ["value", "data", "originalDoc", "user", ...BUILTIN_JEXL_HELPERS],
+  "field.admin.onChange": ["value", "siblingData", "data", ...BUILTIN_JEXL_HELPERS]
+};
+var ACCESS_ROOTS = ["user", "req", "doc", "data", "id", "config", ...BUILTIN_JEXL_HELPERS];
+var ADMIN_CONDITION_RESERVED_ROOTS = ["data", "siblingData", "user", "id", ...BUILTIN_JEXL_HELPERS];
+var PREVIEW_URL_RESERVED_ROOTS = ["siteUrl", "id", ...BUILTIN_JEXL_HELPERS];
+var COMPILE_CACHE = /* @__PURE__ */ new Map();
+function compileExpression(expression) {
+  const cached = COMPILE_CACHE.get(expression);
+  if (cached) return cached;
+  const compiled = import_jexl2.default.compile(expression);
+  const next = { ast: compiled._ast };
+  COMPILE_CACHE.set(expression, next);
+  return next;
 }
-function capitalize(val) {
-  if (val === void 0 || val === null) return "";
-  const str = String(val).trim();
-  if (!str) return "";
-  return str.charAt(0).toUpperCase() + str.slice(1).toLowerCase();
+function isPlainObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
 }
-function truncate(val, length2, ellipsis = "...") {
-  if (val === void 0 || val === null) return "";
-  const str = String(val);
-  const maxLen = typeof length2 === "number" && length2 > 0 ? length2 : 100;
-  if (str.length <= maxLen) return str;
-  return str.slice(0, maxLen).trim() + String(ellipsis ?? "...");
+function quoteSegment(value) {
+  return `["${value.replace(/"/g, '\\"')}"]`;
 }
-function readingTime(val, wpm = 200) {
-  if (val === void 0 || val === null) return 1;
-  const str = String(val).trim();
-  if (!str) return 1;
-  const words = str.split(/\s+/).filter(Boolean).length;
-  return Math.max(1, Math.ceil(words / (typeof wpm === "number" && wpm > 0 ? wpm : 200)));
+function fieldSegment(field, index) {
+  return typeof field.name === "string" && field.name.length > 0 ? `fields${quoteSegment(field.name)}` : `fields[${index}]`;
 }
-function wordCount(val) {
-  if (val === void 0 || val === null) return 0;
-  const str = String(val).trim();
-  if (!str) return 0;
-  return str.split(/\s+/).filter(Boolean).length;
+function blockSegment(block, index) {
+  return typeof block.slug === "string" && block.slug.length > 0 ? `blocks${quoteSegment(block.slug)}` : `blocks[${index}]`;
 }
-function replace(val, search, replacement) {
-  if (val === void 0 || val === null) return "";
-  return String(val).replace(new RegExp(String(search || ""), "g"), String(replacement ?? ""));
+function collectionSegment(collection, index) {
+  return typeof collection.slug === "string" && collection.slug.length > 0 ? `collections${quoteSegment(collection.slug)}` : `collections[${index}]`;
 }
-function startsWith(str, prefix) {
-  if (str === void 0 || str === null) return false;
-  return String(str).startsWith(String(prefix ?? ""));
+function globalSegment(global, index) {
+  return typeof global.slug === "string" && global.slug.length > 0 ? `globals${quoteSegment(global.slug)}` : `globals[${index}]`;
 }
-function endsWith(str, suffix) {
-  if (str === void 0 || str === null) return false;
-  return String(str).endsWith(String(suffix ?? ""));
+function colorize(value, code, enabled) {
+  return enabled ? `\x1B[${code}m${value}\x1B[0m` : value;
 }
-function now() {
-  return (/* @__PURE__ */ new Date()).toISOString();
+function collectRootIdentifiers(node, roots, seen) {
+  if (!node || typeof node !== "object" || seen.has(node)) return;
+  seen.add(node);
+  const candidate = node;
+  if (candidate.type === "Identifier") {
+    if (candidate.from) {
+      collectRootIdentifiers(candidate.from, roots, seen);
+      return;
+    }
+    if (typeof candidate.value === "string" && candidate.value !== "null") {
+      roots.add(candidate.value);
+    }
+    return;
+  }
+  if (Array.isArray(node)) {
+    for (const entry of node) collectRootIdentifiers(entry, roots, seen);
+    return;
+  }
+  for (const value of Object.values(node)) {
+    if (Array.isArray(value)) {
+      for (const entry of value) collectRootIdentifiers(entry, roots, seen);
+      continue;
+    }
+    if (value && typeof value === "object") {
+      collectRootIdentifiers(value, roots, seen);
+    }
+  }
 }
-function today() {
-  return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+function getInvalidRoots(expression, allowedRoots) {
+  const { ast } = compileExpression(expression);
+  const roots = /* @__PURE__ */ new Set();
+  collectRootIdentifiers(ast, roots, /* @__PURE__ */ new Set());
+  const allowed = new Set(allowedRoots);
+  return [...roots].filter((root) => !allowed.has(root));
 }
-function formatDate(val, style = "short") {
-  if (!val) return "";
-  const d = new Date(val);
-  if (Number.isNaN(d.getTime())) return "";
-  const styleStr = String(style).toLowerCase();
-  if (styleStr === "iso" || styleStr === "date") return d.toISOString().slice(0, 10);
-  if (styleStr === "datetime" || styleStr === "full") return d.toISOString();
-  return d.toLocaleDateString("en-US", {
-    year: "numeric",
-    month: "short",
-    day: "numeric"
-  });
-}
-function addDays(val, days) {
-  const d = val ? new Date(val) : /* @__PURE__ */ new Date();
-  if (Number.isNaN(d.getTime())) return "";
-  const daysNum = typeof days === "number" ? days : Number(days) || 0;
-  d.setDate(d.getDate() + daysNum);
-  return d.toISOString();
-}
-function diffDays(dateA, dateB) {
-  const dA = dateA ? new Date(dateA) : /* @__PURE__ */ new Date();
-  const dB = dateB ? new Date(dateB) : /* @__PURE__ */ new Date();
-  if (Number.isNaN(dA.getTime()) || Number.isNaN(dB.getTime())) return 0;
-  const diffMs = Math.abs(dA.getTime() - dB.getTime());
-  return Math.floor(diffMs / (1e3 * 60 * 60 * 24));
-}
-function isPast(val) {
-  if (!val) return false;
-  const d = new Date(val);
-  if (Number.isNaN(d.getTime())) return false;
-  return d.getTime() < Date.now();
-}
-function isFuture(val) {
-  if (!val) return false;
-  const d = new Date(val);
-  if (Number.isNaN(d.getTime())) return false;
-  return d.getTime() > Date.now();
-}
-function includes(arrOrStr, item) {
-  if (Array.isArray(arrOrStr)) {
-    return arrOrStr.includes(item);
-  }
-  if (typeof arrOrStr === "string") {
-    return arrOrStr.includes(String(item ?? ""));
+function validateDeclarativeHookExpression(expression, surface, path) {
+  try {
+    const invalidRoots = getInvalidRoots(expression, SURFACE_ROOTS[surface]);
+    if (invalidRoots.length === 0) return [];
+    return [
+      {
+        path,
+        surface,
+        expression,
+        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${SURFACE_ROOTS[surface].map((root) => `"${root}"`).join(", ")}`
+      }
+    ];
+  } catch (error) {
+    return [
+      {
+        path,
+        surface,
+        expression,
+        message: `has invalid syntax: ${error.message}`
+      }
+    ];
   }
-  return false;
-}
-function join(arr, separator = ", ") {
-  if (!Array.isArray(arr)) return "";
-  return arr.filter((item) => item !== void 0 && item !== null).join(String(separator));
-}
-function first(arr) {
-  if (Array.isArray(arr)) return arr[0] ?? null;
-  return null;
-}
-function last(arr) {
-  if (Array.isArray(arr)) return arr[arr.length - 1] ?? null;
-  return null;
 }
-function compact(arr) {
-  if (!Array.isArray(arr)) return [];
-  return arr.filter((item) => item !== void 0 && item !== null && item !== "");
+function validateDeclarativeAccessExpression(expression, surface, path) {
+  try {
+    const invalidRoots = getInvalidRoots(expression, ACCESS_ROOTS);
+    if (invalidRoots.length === 0) return [];
+    return [
+      {
+        path,
+        surface,
+        expression,
+        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${ACCESS_ROOTS.map((root) => `"${root}"`).join(", ")}`
+      }
+    ];
+  } catch (error) {
+    return [
+      {
+        path,
+        surface,
+        expression,
+        message: `has invalid syntax: ${error.message}`
+      }
+    ];
+  }
 }
-function unique(arr) {
-  if (!Array.isArray(arr)) return [];
-  return Array.from(new Set(arr));
+function validateAdminConditionExpression(expression, path, allowedRoots) {
+  try {
+    const invalidRoots = getInvalidRoots(expression, allowedRoots);
+    if (invalidRoots.length === 0) return [];
+    return [
+      {
+        path,
+        surface: "field.admin.condition",
+        expression,
+        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${allowedRoots.map((root) => `"${root}"`).join(", ")}`
+      }
+    ];
+  } catch (error) {
+    return [
+      {
+        path,
+        surface: "field.admin.condition",
+        expression,
+        message: `has invalid syntax: ${error.message}`
+      }
+    ];
+  }
 }
-function length(val) {
-  if (Array.isArray(val) || typeof val === "string") return val.length;
-  if (val && typeof val === "object") return Object.keys(val).length;
-  return 0;
+function validatePreviewUrlExpression(expression, path, allowedRoots) {
+  try {
+    const invalidRoots = getInvalidRoots(expression, allowedRoots);
+    if (invalidRoots.length === 0) return [];
+    return [
+      {
+        path,
+        surface: "collection.admin.previewUrl",
+        expression,
+        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${allowedRoots.map((root) => `"${root}"`).join(", ")}`
+      }
+    ];
+  } catch (error) {
+    return [
+      {
+        path,
+        surface: "collection.admin.previewUrl",
+        expression,
+        message: `has invalid syntax: ${error.message}`
+      }
+    ];
+  }
 }
-function round(val, decimals = 0) {
-  const num = Number(val);
-  if (Number.isNaN(num)) return 0;
-  const dec = typeof decimals === "number" ? decimals : Number(decimals) || 0;
-  const factor = Math.pow(10, dec);
-  return Math.round(num * factor) / factor;
+function assertValidDeclarativeHookExpression(expression, surface, path) {
+  const issues = validateDeclarativeHookExpression(expression, surface, path);
+  if (issues.length === 0) return;
+  throw new Error(`Invalid declarative hook at ${path}: ${issues[0].message}`);
 }
-function clamp(val, minVal, maxVal) {
-  const num = Number(val) || 0;
-  const min2 = Number(minVal) || 0;
-  const max2 = Number(maxVal) || 0;
-  return Math.min(Math.max(num, min2), max2);
+function assertValidDeclarativeHookResult(result, surface, path) {
+  if (isPlainObject(result)) return;
+  throw new Error(`Invalid declarative hook result at ${path}: ${surface} expressions must return an object`);
 }
-function ceil(val) {
-  return Math.ceil(Number(val) || 0);
+function collectFieldIssues(fields, path, issues) {
+  fields.forEach((field, index) => {
+    const fieldPath = `${path}.${fieldSegment(field, index)}`;
+    field.hooks?.beforeChange?.forEach((hook, hookIndex) => {
+      if (typeof hook !== "string") return;
+      issues.push(
+        ...validateDeclarativeHookExpression(
+          hook,
+          "field.beforeChange",
+          `${fieldPath}.hooks.beforeChange[${hookIndex}]`
+        )
+      );
+    });
+    field.hooks?.afterRead?.forEach((hook, hookIndex) => {
+      if (typeof hook !== "string") return;
+      issues.push({
+        path: `${fieldPath}.hooks.afterRead[${hookIndex}]`,
+        surface: "unsupported",
+        expression: hook,
+        message: "declarative strings are not supported on field hooks.afterRead"
+      });
+    });
+    if (typeof field.admin?.hooks?.onChange === "string") {
+      issues.push(
+        ...validateDeclarativeHookExpression(
+          field.admin.hooks.onChange,
+          "field.admin.onChange",
+          `${fieldPath}.admin.hooks.onChange`
+        )
+      );
+    }
+    if (typeof field.admin?.hooks?.options === "string") {
+      issues.push({
+        path: `${fieldPath}.admin.hooks.options`,
+        surface: "unsupported",
+        expression: field.admin.hooks.options,
+        message: "declarative strings are not supported on field admin.hooks.options"
+      });
+    }
+    if (Array.isArray(field.fields)) {
+      collectFieldIssues(field.fields, fieldPath, issues);
+    }
+    if (Array.isArray(field.blocks)) {
+      field.blocks.forEach((block, blockIndex) => {
+        if (!Array.isArray(block.fields)) return;
+        collectFieldIssues(block.fields, `${fieldPath}.${blockSegment(block, blockIndex)}`, issues);
+      });
+    }
+  });
 }
-function floor(val) {
-  return Math.floor(Number(val) || 0);
+function collectFieldNames(fields) {
+  return fields.flatMap(
+    (field) => typeof field.name === "string" && field.name.length > 0 ? [field.name] : []
+  );
 }
-function abs(val) {
-  return Math.abs(Number(val) || 0);
+function collectAdminConditionIssues(fields, path, rootFieldNames, issues) {
+  const scopeFieldNames = collectFieldNames(fields);
+  const allowedRoots = [.../* @__PURE__ */ new Set([...ADMIN_CONDITION_RESERVED_ROOTS, ...rootFieldNames, ...scopeFieldNames])];
+  fields.forEach((field, index) => {
+    const fieldPath = `${path}.${fieldSegment(field, index)}`;
+    if (typeof field.admin?.condition === "string") {
+      issues.push(
+        ...validateAdminConditionExpression(
+          field.admin.condition,
+          `${fieldPath}.admin.condition`,
+          allowedRoots
+        )
+      );
+    }
+    if (Array.isArray(field.fields)) {
+      collectAdminConditionIssues(field.fields, fieldPath, rootFieldNames, issues);
+    }
+    if (Array.isArray(field.blocks)) {
+      field.blocks.forEach((block, blockIndex) => {
+        if (!Array.isArray(block.fields)) return;
+        collectAdminConditionIssues(
+          block.fields,
+          `${fieldPath}.${blockSegment(block, blockIndex)}`,
+          rootFieldNames,
+          issues
+        );
+      });
+    }
+  });
 }
-function min(...args) {
-  const nums = args.flat().map((n) => Number(n) || 0);
-  return nums.length ? Math.min(...nums) : 0;
+function collectFieldAccessIssues(fields, path, issues) {
+  fields.forEach((field, index) => {
+    const fieldPath = `${path}.${fieldSegment(field, index)}`;
+    if (typeof field.access?.read === "string") {
+      issues.push(...validateDeclarativeAccessExpression(field.access.read, "field.access", `${fieldPath}.access.read`));
+    }
+    if (typeof field.access?.create === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(field.access.create, "field.access", `${fieldPath}.access.create`)
+      );
+    }
+    if (typeof field.access?.update === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(field.access.update, "field.access", `${fieldPath}.access.update`)
+      );
+    }
+    if (Array.isArray(field.fields)) {
+      collectFieldAccessIssues(field.fields, fieldPath, issues);
+    }
+    if (Array.isArray(field.blocks)) {
+      field.blocks.forEach((block, blockIndex) => {
+        if (!Array.isArray(block.fields)) return;
+        collectFieldAccessIssues(
+          block.fields,
+          `${fieldPath}.${blockSegment(block, blockIndex)}`,
+          issues
+        );
+      });
+    }
+  });
 }
-function max(...args) {
-  const nums = args.flat().map((n) => Number(n) || 0);
-  return nums.length ? Math.max(...nums) : 0;
+function collectHookIssues(hooks, scope, path, issues) {
+  if (!hooks) return;
+  const supported = {
+    beforeRead: `${scope}.beforeRead`,
+    afterRead: `${scope}.afterRead`,
+    beforeChange: `${scope}.beforeChange`
+  };
+  for (const [key, value] of Object.entries(hooks)) {
+    if (!Array.isArray(value)) continue;
+    value.forEach((hook, index) => {
+      if (typeof hook !== "string") return;
+      const surface = supported[key];
+      if (!surface) {
+        issues.push({
+          path: `${path}.${key}[${index}]`,
+          surface: "unsupported",
+          expression: hook,
+          message: `declarative strings are not supported on ${scope} hooks.${key}`
+        });
+        return;
+      }
+      issues.push(...validateDeclarativeHookExpression(hook, surface, `${path}.${key}[${index}]`));
+    });
+  }
 }
-function pow(base, exp) {
-  return Math.pow(Number(base) || 0, Number(exp) || 0);
+function collectDeclarativeHookValidationIssues(config) {
+  const issues = [];
+  config.blocks?.forEach((block, blockIndex) => {
+    if (!Array.isArray(block.fields)) return;
+    collectFieldIssues(
+      block.fields,
+      blockSegment(block, blockIndex),
+      issues
+    );
+  });
+  config.collections.forEach((collection, collectionIndex) => {
+    const collectionPath = collectionSegment(collection, collectionIndex);
+    collectHookIssues(
+      collection.hooks,
+      "collection",
+      `${collectionPath}.hooks`,
+      issues
+    );
+    collectFieldIssues(collection.fields, collectionPath, issues);
+  });
+  config.globals?.forEach((global, globalIndex) => {
+    const globalPath = globalSegment(global, globalIndex);
+    collectHookIssues(
+      global.hooks,
+      "global",
+      `${globalPath}.hooks`,
+      issues
+    );
+    collectFieldIssues(global.fields, globalPath, issues);
+  });
+  return issues;
 }
-function sqrt(val) {
-  return Math.sqrt(Number(val) || 0);
+function collectDeclarativeAccessValidationIssues(config) {
+  const issues = [];
+  Object.entries(config.accessPolicies ?? {}).forEach(([name, value]) => {
+    if (typeof value !== "string") return;
+    issues.push(
+      ...validateDeclarativeAccessExpression(value, "config.accessPolicy", `accessPolicies.${name}`)
+    );
+  });
+  config.blocks?.forEach((block, blockIndex) => {
+    if (!Array.isArray(block.fields)) return;
+    collectFieldAccessIssues(
+      block.fields,
+      blockSegment(block, blockIndex),
+      issues
+    );
+  });
+  config.collections.forEach((collection, collectionIndex) => {
+    const collectionPath = collectionSegment(collection, collectionIndex);
+    if (typeof collection.access?.read === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.read,
+          "collection.access",
+          `${collectionPath}.access.read`
+        )
+      );
+    }
+    if (typeof collection.access?.create === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.create,
+          "collection.access",
+          `${collectionPath}.access.create`
+        )
+      );
+    }
+    if (typeof collection.access?.update === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.update,
+          "collection.access",
+          `${collectionPath}.access.update`
+        )
+      );
+    }
+    if (typeof collection.access?.delete === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.delete,
+          "collection.access",
+          `${collectionPath}.access.delete`
+        )
+      );
+    }
+    if (typeof collection.access?.readAudit === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.readAudit,
+          "collection.access",
+          `${collectionPath}.access.readAudit`
+        )
+      );
+    }
+    collectFieldAccessIssues(collection.fields, collectionPath, issues);
+  });
+  config.globals?.forEach((global, globalIndex) => {
+    const globalPath = globalSegment(global, globalIndex);
+    if (typeof global.access?.read === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(global.access.read, "global.access", `${globalPath}.access.read`)
+      );
+    }
+    if (typeof global.access?.update === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          global.access.update,
+          "global.access",
+          `${globalPath}.access.update`
+        )
+      );
+    }
+    collectFieldAccessIssues(global.fields, globalPath, issues);
+  });
+  return issues;
 }
-function sum(arr) {
-  if (!Array.isArray(arr)) return Number(arr) || 0;
-  return arr.reduce((acc, val) => acc + (Number(val) || 0), 0);
+function collectAdminConditionValidationIssues(config) {
+  const issues = [];
+  config.blocks?.forEach((block, blockIndex) => {
+    if (!Array.isArray(block.fields)) return;
+    collectAdminConditionIssues(
+      block.fields,
+      blockSegment(block, blockIndex),
+      collectFieldNames(block.fields),
+      issues
+    );
+  });
+  config.collections.forEach((collection, collectionIndex) => {
+    const collectionPath = collectionSegment(collection, collectionIndex);
+    const rootFieldNames = collectFieldNames(collection.fields);
+    collectAdminConditionIssues(collection.fields, collectionPath, rootFieldNames, issues);
+  });
+  config.globals?.forEach((global, globalIndex) => {
+    const globalPath = globalSegment(global, globalIndex);
+    const rootFieldNames = collectFieldNames(global.fields);
+    collectAdminConditionIssues(global.fields, globalPath, rootFieldNames, issues);
+  });
+  return issues;
 }
-function count(val) {
-  if (Array.isArray(val)) return val.length;
-  if (typeof val === "string") return val.length;
-  if (val !== void 0 && val !== null && val !== false) return 1;
-  return 0;
+function collectPreviewUrlValidationIssues(config) {
+  const issues = [];
+  config.collections.forEach((collection, collectionIndex) => {
+    if (typeof collection.admin?.previewUrl !== "string") return;
+    const collectionPath = collectionSegment(collection, collectionIndex);
+    const allowedRoots = [
+      .../* @__PURE__ */ new Set([...PREVIEW_URL_RESERVED_ROOTS, ...collectFieldNames(collection.fields)])
+    ];
+    issues.push(
+      ...validatePreviewUrlExpression(
+        collection.admin.previewUrl,
+        `${collectionPath}.admin.previewUrl`,
+        allowedRoots
+      )
+    );
+  });
+  return issues;
 }
-function defaultValue(val, fallback) {
-  if (val === void 0 || val === null || val === "") return fallback;
-  return val;
+function assertValidAdminConditionsInConfig(config, source = "config") {
+  const diagnostics = collectAdminConditionValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "adminCondition",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  if (diagnostics.length === 0) return;
+  throw new ConfigValidationError(source, diagnostics);
 }
-function coalesce(...args) {
-  for (const arg of args) {
-    if (arg !== void 0 && arg !== null && arg !== "") return arg;
-  }
-  return null;
+function assertValidPreviewUrlsInConfig(config, source = "config") {
+  const diagnostics = collectPreviewUrlValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "previewUrl",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  if (diagnostics.length === 0) return;
+  throw new ConfigValidationError(source, diagnostics);
 }
-function isEmpty(val) {
-  if (val === void 0 || val === null || val === "") return true;
-  if (Array.isArray(val)) return val.length === 0;
-  if (typeof val === "object") return Object.keys(val).length === 0;
-  return false;
+function collectConfigDiagnostics(config) {
+  const hookIssues = collectDeclarativeHookValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "declarativeHook",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  const accessIssues = collectDeclarativeAccessValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "declarativeAccess",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  const adminConditionIssues = collectAdminConditionValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "adminCondition",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  const previewUrlIssues = collectPreviewUrlValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "previewUrl",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  return [...hookIssues, ...accessIssues, ...adminConditionIssues, ...previewUrlIssues];
+}
+function formatConfigDiagnostics(source, diagnostics, options = {}) {
+  const color = options.color ?? false;
+  const header = `${colorize("Config validation failed", 31, color)} in ${colorize(source, 36, color)}`;
+  const docLink = `${colorize("   Learn how to write declarative rules:", 90, color)} ${colorize("https://docs.dyrected.com/docs/editor-experience/form-and-field-hooks", 34, color)}`;
+  const lines = diagnostics.flatMap((issue, index) => [
+    `${colorize(`${index + 1}.`, 31, color)} ${colorize(issue.path, 1, color)}`,
+    `   ${issue.message}`,
+    `   ${colorize("surface:", 90, color)} ${issue.surface}`
+  ]);
+  return `${header}
+${lines.join("\n")}
+
+${docLink}`;
+}
+var ConfigValidationError = class extends Error {
+  diagnostics;
+  source;
+  constructor(source, diagnostics) {
+    super(formatConfigDiagnostics(source, diagnostics));
+    this.name = "ConfigValidationError";
+    this.source = source;
+    this.diagnostics = diagnostics;
+  }
+};
+function isConfigValidationError(error) {
+  return error instanceof ConfigValidationError;
+}
+function assertValidDeclarativeHooksInConfig(config, source = "config") {
+  const diagnostics = collectDeclarativeHookValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "declarativeHook",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  if (diagnostics.length === 0) return;
+  throw new ConfigValidationError(source, diagnostics);
+}
+function assertValidDeclarativeAccessInConfig(config, source = "config") {
+  const diagnostics = collectDeclarativeAccessValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "declarativeAccess",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  if (diagnostics.length === 0) return;
+  throw new ConfigValidationError(source, diagnostics);
+}
+
+// src/utils/hooks.ts
+async function runCollectionHooks(hooks, args, options = {}) {
+  if (!hooks || hooks.length === 0) {
+    return args.data ?? args.doc ?? args.query ?? void 0;
+  }
+  const payloadKey = args.data !== void 0 ? "data" : args.doc !== void 0 ? "doc" : "query" in args ? "query" : void 0;
+  let currentPayload = payloadKey === void 0 ? void 0 : args[payloadKey];
+  for (const hook of hooks) {
+    try {
+      const hookArgs = {
+        ...args,
+        ...payloadKey !== void 0 ? { [payloadKey]: currentPayload } : {}
+      };
+      const result = typeof hook === "string" ? await (() => {
+        if (options.surface) {
+          assertValidDeclarativeHookExpression(
+            hook,
+            options.surface,
+            options.path ?? options.surface
+          );
+        }
+        return import_jexl3.default.eval(hook, hookArgs);
+      })() : await hook(hookArgs);
+      if (result !== void 0) {
+        if (typeof hook === "string" && options.surface) {
+          assertValidDeclarativeHookResult(
+            result,
+            options.surface,
+            options.path ?? options.surface
+          );
+        }
+        currentPayload = typeof hook === "string" && currentPayload && typeof currentPayload === "object" && !Array.isArray(currentPayload) && result && typeof result === "object" && !Array.isArray(result) ? {
+          ...currentPayload,
+          ...result
+        } : result;
+      }
+    } catch (err) {
+      if (options.isolated) {
+        console.error("Side-effect hook failed after a successful write", err);
+      } else {
+        throw err;
+      }
+    }
+  }
+  return currentPayload;
+}
+async function executeFieldBeforeChange(fields, data, originalDoc, user, db, pathPrefix = "") {
+  if (!data || typeof data !== "object") return data;
+  const result = { ...data };
+  for (const field of fields) {
+    if (!field.name) continue;
+    const fieldPath = pathPrefix ? `${pathPrefix}.${field.name}` : field.name;
+    const value = result[field.name];
+    const origValue = originalDoc?.[field.name];
+    let updatedValue = value;
+    if (field.hooks?.beforeChange) {
+      for (const hook of field.hooks.beforeChange) {
+        const hookArgs = {
+          value: updatedValue,
+          originalDoc: originalDoc ?? void 0,
+          data: result,
+          user,
+          db
+        };
+        updatedValue = typeof hook === "string" ? await (() => {
+          assertValidDeclarativeHookExpression(
+            hook,
+            "field.beforeChange",
+            fieldPath
+          );
+          return import_jexl3.default.eval(hook, hookArgs);
+        })() : await hook(hookArgs);
+      }
+      result[field.name] = updatedValue;
+    }
+    if (updatedValue !== void 0 && updatedValue !== null) {
+      if (field.type === "object" && field.fields) {
+        result[field.name] = await executeFieldBeforeChange(
+          field.fields,
+          updatedValue,
+          origValue,
+          user,
+          db,
+          fieldPath
+        );
+      } else if (field.type === "array" && field.fields && Array.isArray(updatedValue)) {
+        const arrayResult = [];
+        for (let i = 0; i < updatedValue.length; i++) {
+          const item = updatedValue[i];
+          const origItem = Array.isArray(origValue) ? origValue[i] : null;
+          arrayResult.push(
+            await executeFieldBeforeChange(
+              field.fields,
+              item,
+              origItem,
+              user,
+              db,
+              fieldPath
+            )
+          );
+        }
+        result[field.name] = arrayResult;
+      } else if (field.type === "blocks" && field.blocks && Array.isArray(updatedValue)) {
+        const blocksResult = [];
+        for (let i = 0; i < updatedValue.length; i++) {
+          const blockData = updatedValue[i];
+          const origBlock = Array.isArray(origValue) ? origValue[i] : null;
+          const blockConfig = field.blocks.find(
+            (b) => b.slug === blockData.blockType
+          );
+          if (blockConfig) {
+            blocksResult.push(
+              await executeFieldBeforeChange(
+                blockConfig.fields,
+                blockData,
+                origBlock,
+                user,
+                db,
+                fieldPath
+              )
+            );
+          } else {
+            blocksResult.push(blockData);
+          }
+        }
+        result[field.name] = blocksResult;
+      }
+    }
+  }
+  return result;
+}
+async function executeFieldAfterRead(fields, doc, user, db) {
+  if (!doc || typeof doc !== "object") return doc;
+  const result = { ...doc };
+  for (const field of fields) {
+    if (!field.name) continue;
+    const value = result[field.name];
+    let updatedValue = value;
+    if (field.hooks?.afterRead) {
+      for (const hook of field.hooks.afterRead) {
+        const typedHook = hook;
+        const hookArgs = {
+          value: updatedValue,
+          doc: result,
+          user,
+          db
+        };
+        updatedValue = await typedHook(hookArgs);
+      }
+      result[field.name] = updatedValue;
+    }
+    if (updatedValue !== void 0 && updatedValue !== null) {
+      if (field.type === "object" && field.fields) {
+        result[field.name] = await executeFieldAfterRead(
+          field.fields,
+          updatedValue,
+          user,
+          db
+        );
+      } else if (field.type === "array" && field.fields && Array.isArray(updatedValue)) {
+        const arrayResult = [];
+        for (const item of updatedValue) {
+          arrayResult.push(
+            await executeFieldAfterRead(
+              field.fields,
+              item,
+              user,
+              db
+            )
+          );
+        }
+        result[field.name] = arrayResult;
+      } else if (field.type === "blocks" && field.blocks && Array.isArray(updatedValue)) {
+        const blocksResult = [];
+        for (const blockData of updatedValue) {
+          const typedBlock = blockData;
+          const blockConfig = field.blocks.find(
+            (b) => b.slug === typedBlock.blockType
+          );
+          if (blockConfig) {
+            blocksResult.push(
+              await executeFieldAfterRead(
+                blockConfig.fields,
+                typedBlock,
+                user,
+                db
+              )
+            );
+          } else {
+            blocksResult.push(blockData);
+          }
+        }
+        result[field.name] = blocksResult;
+      }
+    }
+  }
+  return result;
+}
+
+// src/trash.ts
+var TRASH_COLLECTION = "__trash";
+var TRASH_COLLECTION_CONFIG = {
+  slug: TRASH_COLLECTION,
+  labels: { singular: "Trash entry", plural: "Trash entries" },
+  fields: [
+    { name: "collection", type: "text", required: true, promoted: true },
+    { name: "docId", type: "text", required: true, promoted: true },
+    { name: "deletedAt", type: "number", required: true, promoted: true },
+    // epoch ms
+    { name: "purgeAt", type: "number", promoted: true },
+    // epoch ms, null = never
+    { name: "deletedBy", type: "text", promoted: true },
+    { name: "title", type: "text" },
+    // resolved useAsTitle, for listing
+    { name: "snapshot", type: "json", required: true },
+    // the raw stored document
+    { name: "createdAt", type: "date" }
+    // original doc timestamps live in snapshot
+  ],
+  indexes: [
+    { fields: ["purgeAt"] },
+    { fields: ["collection", "docId"] }
+  ],
+  access: {
+    read: () => false,
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
+  admin: { hidden: true }
+};
+function getTrashEntryId(collection, docId) {
+  return `${collection}:${docId}`;
+}
+function resolveTrashConfig(collection, appConfig) {
+  const colTrash = collection.trash;
+  const appTrash = appConfig?.trash;
+  let enabled = true;
+  if (colTrash === false) {
+    enabled = false;
+  } else if (colTrash === true || typeof colTrash === "object" && colTrash !== null) {
+    enabled = true;
+  } else if (appTrash?.enabled === false) {
+    enabled = false;
+  }
+  if (!enabled) {
+    return {
+      enabled: false,
+      retentionDays: null,
+      allowPermanentDelete: true
+    };
+  }
+  let retentionDays = 30;
+  if (typeof colTrash === "object" && colTrash !== null && "retentionDays" in colTrash) {
+    retentionDays = colTrash.retentionDays ?? null;
+  } else if (appTrash?.retentionDays !== void 0) {
+    retentionDays = appTrash.retentionDays ?? null;
+  }
+  const allowPermanentDelete = typeof colTrash === "object" && colTrash !== null && colTrash.allowPermanentDelete !== void 0 ? colTrash.allowPermanentDelete : appTrash?.allowPermanentDelete !== void 0 ? appTrash.allowPermanentDelete : true;
+  return {
+    enabled: true,
+    retentionDays,
+    allowPermanentDelete
+  };
 }
-function get(obj, path, fallback = null) {
-  if (obj === void 0 || obj === null || typeof obj !== "object") return fallback;
-  if (typeof path !== "string") return fallback;
-  const parts = path.split(".").filter(Boolean);
-  let curr = obj;
-  for (const part of parts) {
-    if (curr === void 0 || curr === null || typeof curr !== "object") return fallback;
-    curr = curr[part];
+function logTrashWarning(config, payload) {
+  if (config?.logger && typeof config.logger.warn === "function") {
+    config.logger.warn(payload);
+  } else if (typeof console !== "undefined" && console.warn) {
+    console.warn(`[dyrected] ${payload.msg}`);
   }
-  return curr === void 0 || curr === null ? fallback : curr;
 }
-function registerJexlHelpers(jexlInstance = import_jexl.default) {
-  const helpers = {
-    // Strings
-    slugify,
-    lower,
-    upper,
-    trim,
-    capitalize,
-    truncate,
-    readingTime,
-    wordCount,
-    replace,
-    startsWith,
-    endsWith,
-    // Dates
-    now,
-    today,
-    formatDate,
-    addDays,
-    diffDays,
-    isPast,
-    isFuture,
-    // Arrays
-    includes,
-    join,
-    first,
-    last,
-    compact,
-    unique,
-    length,
-    // Math
-    round,
-    clamp,
-    ceil,
-    floor,
-    abs,
-    min,
-    max,
-    pow,
-    sqrt,
-    sum,
-    count,
-    // Objects & Logical
-    default: defaultValue,
-    coalesce,
-    isEmpty,
-    get
-  };
-  for (const [name, fn] of Object.entries(helpers)) {
-    try {
-      jexlInstance.addFunction(name, fn);
-    } catch {
+function assertValidTrashInConfig(config, source = "config") {
+  if (config.trash) {
+    const { retentionDays } = config.trash;
+    if (retentionDays !== void 0 && retentionDays !== null) {
+      if (!Number.isInteger(retentionDays) || retentionDays < 1) {
+        throw new Error(
+          `Invalid trash retentionDays in ${source}: must be an integer >= 1. Received ${retentionDays}.`
+        );
+      }
+      if (retentionDays > 3650) {
+        logTrashWarning(config, {
+          msg: `Trash retentionDays in ${source} is unusually large (${retentionDays} days > 10 years). Check if value was provided in hours or seconds.`
+        });
+      }
     }
-    try {
-      jexlInstance.addTransform(name, fn);
-    } catch {
+  }
+  for (const col of config.collections || []) {
+    if (col.slug === "trash") {
+      throw new Error(`Collection slug "trash" is reserved by Dyrected for the trash system.`);
+    }
+    const isSystem = col.slug.startsWith("__");
+    if (isSystem && col.trash) {
+      throw new Error(`System collection "${col.slug}" cannot enable trash.`);
+    }
+    if (col.trash === false) {
+      continue;
+    }
+    if (typeof col.trash === "object" && col.trash !== null) {
+      const { retentionDays } = col.trash;
+      if (retentionDays !== void 0 && retentionDays !== null) {
+        if (!Number.isInteger(retentionDays) || retentionDays < 1) {
+          throw new Error(
+            `Invalid trash retentionDays for collection "${col.slug}" in ${source}: must be an integer >= 1. Received ${retentionDays}. Use trash: false for immediate hard delete.`
+          );
+        }
+        if (retentionDays > 3650) {
+          logTrashWarning(config, {
+            msg: `Trash retentionDays for collection "${col.slug}" is unusually large (${retentionDays} days > 10 years). Check if value was provided in hours or seconds.`,
+            collection: col.slug
+          });
+        }
+      }
     }
   }
-  try {
-    jexlInstance.addBinaryOp("and", 20, (left, right) => Boolean(left && right));
-    jexlInstance.addBinaryOp("or", 10, (left, right) => Boolean(left || right));
-    jexlInstance.addBinaryOp("in", 30, (left, right) => {
-      if (Array.isArray(right)) return right.includes(left);
-      if (typeof right === "string") return right.includes(String(left ?? ""));
-      return false;
-    });
-  } catch {
+  for (const glob of config.globals || []) {
+    if (glob.slug === "trash") {
+      throw new Error(`Global slug "trash" is reserved by Dyrected for the trash system.`);
+    }
   }
 }
-registerJexlHelpers(import_jexl.default);
-async function evaluateJexl(expression, context = {}) {
-  if (!expression || typeof expression !== "string") return void 0;
-  try {
-    const evalContext = {
-      null: null,
-      undefined: void 0,
-      ...context,
-      math: Math,
-      Math
-    };
-    return await import_jexl.default.eval(expression, evalContext);
-  } catch (_err) {
-    return void 0;
+function resolveDocumentTitle(collection, doc) {
+  if (!doc || typeof doc !== "object") return "";
+  const titleField = collection.admin?.useAsTitle || "title";
+  const val = doc[titleField];
+  if (val !== void 0 && val !== null && String(val).trim().length > 0) {
+    return String(val);
+  }
+  if (doc.name !== void 0 && doc.name !== null && String(doc.name).trim().length > 0) {
+    return String(doc.name);
+  }
+  if (doc.id !== void 0 && doc.id !== null) {
+    return String(doc.id);
   }
+  return "";
 }
-function evaluateJexlSync(expression, context = {}) {
-  if (!expression || typeof expression !== "string") return void 0;
-  try {
-    const evalContext = {
-      null: null,
-      undefined: void 0,
-      ...context,
-      math: Math,
-      Math
-    };
-    return import_jexl.default.evalSync(expression, evalContext);
-  } catch (_err) {
-    return void 0;
+function createTrashPurgeTask(config) {
+  return {
+    name: "dyrected:trash-purge",
+    cron: config.trash?.purge?.cron ?? "0 3 * * *",
+    run: async ({ db, logger, signal }) => {
+      const batchSize = Math.max(1, config.trash?.purge?.batchSize ?? 200);
+      while (true) {
+        if (signal?.aborted) return;
+        const now2 = Date.now();
+        const due = await db.find({
+          collection: TRASH_COLLECTION,
+          where: {
+            purgeAt: { lte: now2, not_equals: null }
+          },
+          limit: batchSize,
+          sort: "purgeAt"
+        });
+        if (!due.docs.length) break;
+        for (const entry of due.docs) {
+          if (signal?.aborted) return;
+          if (entry.purgeAt == null || typeof entry.purgeAt !== "number") continue;
+          try {
+            const colSlug = entry.collection;
+            const colConfig = config.collections.find((c) => c.slug === colSlug);
+            const snapshot = typeof entry.snapshot === "string" ? JSON.parse(entry.snapshot) : entry.snapshot;
+            if (colConfig?.upload && config.storage && snapshot?.filename) {
+              try {
+                await config.storage.delete({ filename: snapshot.filename });
+                if (snapshot.sizes && typeof snapshot.sizes === "object") {
+                  for (const size of Object.values(snapshot.sizes)) {
+                    if (size?.filename) {
+                      await config.storage.delete({ filename: size.filename });
+                    }
+                  }
+                }
+              } catch (storageErr) {
+                logger.warn({ err: storageErr?.message || storageErr, docId: entry.docId, collection: colSlug }, "Failed to delete storage file on purge");
+              }
+            }
+            if (colConfig?.hooks?.afterDelete) {
+              await runCollectionHooks(
+                colConfig.hooks.afterDelete,
+                {
+                  id: entry.docId,
+                  doc: snapshot,
+                  user: void 0,
+                  req: {},
+                  db,
+                  mode: "permanent"
+                },
+                { isolated: true }
+              );
+            }
+            if (colConfig?.audit) {
+              try {
+                await db.create({
+                  collection: "__audit",
+                  data: {
+                    collection: colSlug,
+                    documentId: entry.docId,
+                    operation: "purge",
+                    user: null,
+                    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+                    changes: JSON.stringify({
+                      before: snapshot,
+                      after: null
+                    })
+                  }
+                });
+              } catch (auditErr) {
+                logger.warn({ err: auditErr?.message || auditErr, docId: entry.docId, collection: colSlug }, "Failed to write audit log on purge");
+              }
+            }
+            await db.delete({ collection: TRASH_COLLECTION, id: entry.id });
+          } catch (entryErr) {
+            logger.error({ err: entryErr?.message || entryErr, entryId: entry.id }, "Error purging trash entry");
+          }
+        }
+        if (due.docs.length < batchSize) break;
+      }
+    }
+  };
+}
+async function softDeleteDocument(options) {
+  const { db, config, collection: collectionSlug, id, deletedBy } = options;
+  const colConfig = config.collections.find((c) => c.slug === collectionSlug);
+  if (!colConfig) throw new Error(`Collection ${collectionSlug} not found`);
+  const doc = await db.findOne({ collection: collectionSlug, id });
+  if (!doc) throw new Error(`Document ${id} in ${collectionSlug} not found`);
+  const resolvedTrash = resolveTrashConfig(colConfig, config);
+  const deletedAt = Date.now();
+  const purgeAt = resolvedTrash.retentionDays !== null && resolvedTrash.retentionDays !== void 0 ? deletedAt + resolvedTrash.retentionDays * 864e5 : null;
+  const title = resolveDocumentTitle(colConfig, doc);
+  const trashId = getTrashEntryId(collectionSlug, id);
+  const trashData = {
+    id: trashId,
+    collection: collectionSlug,
+    docId: id,
+    deletedAt,
+    purgeAt,
+    deletedBy: deletedBy ?? null,
+    title,
+    snapshot: doc,
+    createdAt: doc.createdAt ?? new Date(deletedAt).toISOString()
+  };
+  if (db.transaction) {
+    await db.transaction(async (tx) => {
+      await tx.create({ collection: TRASH_COLLECTION, data: trashData });
+      await tx.delete({ collection: collectionSlug, id });
+    });
+  } else {
+    await db.create({ collection: TRASH_COLLECTION, data: trashData });
+    await db.delete({ collection: collectionSlug, id });
+  }
+  return { id: trashId, purgeAt };
+}
+async function restoreDocument(options) {
+  const { db, config, collection: collectionSlug, trashId: param, overrides } = options;
+  const colConfig = config.collections.find((c) => c.slug === collectionSlug);
+  if (!colConfig) throw new Error(`Collection ${collectionSlug} not found`);
+  const trashId = param.includes(":") ? param : getTrashEntryId(collectionSlug, param);
+  const entry = await db.findOne({ collection: TRASH_COLLECTION, id: trashId }) || await db.findOne({ collection: TRASH_COLLECTION, id: param });
+  if (!entry || entry.collection !== collectionSlug) {
+    throw new Error(`Trash entry ${param} not found for collection ${collectionSlug}`);
+  }
+  const snapshot = typeof entry.snapshot === "string" ? JSON.parse(entry.snapshot) : entry.snapshot;
+  const now2 = (/* @__PURE__ */ new Date()).toISOString();
+  const docToRestore = {
+    ...snapshot,
+    ...overrides || {},
+    id: entry.docId,
+    createdAt: snapshot.createdAt ?? entry.createdAt ?? now2,
+    updatedAt: now2
+  };
+  if (db.transaction) {
+    await db.transaction(async (tx) => {
+      await tx.create({ collection: collectionSlug, data: docToRestore });
+      await tx.delete({ collection: TRASH_COLLECTION, id: entry.id });
+    });
+  } else {
+    await db.create({ collection: collectionSlug, data: docToRestore });
+    await db.delete({ collection: TRASH_COLLECTION, id: entry.id });
   }
+  return { restoredDoc: docToRestore };
 }
-var BUILTIN_JEXL_HELPERS = [
-  // Strings
-  "slugify",
-  "lower",
-  "upper",
-  "trim",
-  "capitalize",
-  "truncate",
-  "readingTime",
-  "wordCount",
-  "replace",
-  "startsWith",
-  "endsWith",
-  // Dates
-  "now",
-  "today",
-  "formatDate",
-  "addDays",
-  "diffDays",
-  "isPast",
-  "isFuture",
-  // Arrays
-  "includes",
-  "join",
-  "first",
-  "last",
-  "compact",
-  "unique",
-  "length",
-  // Math
-  "round",
-  "clamp",
-  // Objects & Logical
-  "default",
-  "coalesce",
-  "isEmpty",
-  "get"
-];
 
-// src/utils/declarative-hooks.ts
-registerJexlHelpers(import_jexl2.default);
-var SURFACE_ROOTS = {
-  "collection.beforeRead": ["req", "user", "query", ...BUILTIN_JEXL_HELPERS],
-  "collection.afterRead": ["req", "user", "doc", ...BUILTIN_JEXL_HELPERS],
-  "collection.beforeChange": ["req", "user", "data", "doc", "operation", ...BUILTIN_JEXL_HELPERS],
-  "global.beforeRead": ["req", "user", "query", ...BUILTIN_JEXL_HELPERS],
-  "global.afterRead": ["req", "user", "doc", ...BUILTIN_JEXL_HELPERS],
-  "global.beforeChange": ["req", "user", "data", "doc", "operation", ...BUILTIN_JEXL_HELPERS],
-  "field.beforeChange": ["value", "data", "originalDoc", "user", ...BUILTIN_JEXL_HELPERS],
-  "field.admin.onChange": ["value", "siblingData", "data", ...BUILTIN_JEXL_HELPERS]
+// src/tasks.ts
+var TASK_LOCKS_COLLECTION = "__task_locks";
+var TASK_LOCKS_COLLECTION_CONFIG = {
+  slug: TASK_LOCKS_COLLECTION,
+  labels: { singular: "Task lock", plural: "Task locks" },
+  fields: [
+    { name: "name", type: "text", required: true },
+    // Numeric and promoted so the lock compare-and-set is a real column comparison.
+    { name: "lockedUntil", type: "number", required: true, promoted: true },
+    { name: "lockedBy", type: "text" },
+    { name: "lastScheduledFor", type: "date" },
+    { name: "lastStartedAt", type: "date" },
+    { name: "lastFinishedAt", type: "date" },
+    { name: "lastStatus", type: "text" },
+    { name: "lastError", type: "textarea" }
+  ],
+  access: {
+    read: ({ user }) => !!user?.roles?.includes("admin"),
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
+  admin: { hidden: true }
 };
-var ACCESS_ROOTS = ["user", "req", "doc", "data", "id", "config", ...BUILTIN_JEXL_HELPERS];
-var ADMIN_CONDITION_RESERVED_ROOTS = ["data", "siblingData", "user", "id", ...BUILTIN_JEXL_HELPERS];
-var PREVIEW_URL_RESERVED_ROOTS = ["siteUrl", "id", ...BUILTIN_JEXL_HELPERS];
-var COMPILE_CACHE = /* @__PURE__ */ new Map();
-function compileExpression(expression) {
-  const cached = COMPILE_CACHE.get(expression);
-  if (cached) return cached;
-  const compiled = import_jexl2.default.compile(expression);
-  const next = { ast: compiled._ast };
-  COMPILE_CACHE.set(expression, next);
-  return next;
-}
-function isPlainObject(value) {
-  return !!value && typeof value === "object" && !Array.isArray(value);
+var DEFAULT_LOCK_TIMEOUT_SECONDS = 300;
+var DEFAULT_TICK_MS = 3e4;
+var MONTH_NAMES = ["jan", "feb", "mar", "apr", "may", "jun", "jul", "aug", "sep", "oct", "nov", "dec"];
+var DAY_NAMES = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
+function parseCronField(raw, min2, max2, names, nameOffset, label) {
+  const values = /* @__PURE__ */ new Set();
+  const toNumber = (token) => {
+    const named = names?.indexOf(token.toLowerCase());
+    if (named !== void 0 && named >= 0) return named + nameOffset;
+    if (!/^\d+$/.test(token)) throw new Error(`Invalid cron ${label} "${token}".`);
+    return Number(token);
+  };
+  for (const part of raw.split(",")) {
+    const [rangePart, stepPart] = part.split("/");
+    const step = stepPart === void 0 ? 1 : Number(stepPart);
+    if (!Number.isInteger(step) || step < 1) throw new Error(`Invalid cron ${label} step "${part}".`);
+    let start;
+    let end;
+    if (rangePart === "*") {
+      start = min2;
+      end = max2;
+    } else if (rangePart.includes("-")) {
+      const [a, b] = rangePart.split("-");
+      start = toNumber(a);
+      end = toNumber(b);
+    } else {
+      start = toNumber(rangePart);
+      end = stepPart === void 0 ? start : max2;
+    }
+    if (start < min2 || end > max2 || start > end) {
+      throw new Error(`Cron ${label} "${part}" is out of range (${min2}-${max2}).`);
+    }
+    for (let v = start; v <= end; v += step) values.add(v);
+  }
+  return values;
 }
-function quoteSegment(value) {
-  return `["${value.replace(/"/g, '\\"')}"]`;
+function parseCron(expression) {
+  const fields = expression.trim().split(/\s+/);
+  if (fields.length !== 5) {
+    throw new Error(`Cron expression "${expression}" must have 5 fields (minute hour day-of-month month day-of-week).`);
+  }
+  const [min2, hour, dom, mon, dow] = fields;
+  const daysOfWeek = parseCronField(dow, 0, 7, DAY_NAMES, 0, "day-of-week");
+  if (daysOfWeek.has(7)) daysOfWeek.add(0);
+  daysOfWeek.delete(7);
+  return {
+    minutes: parseCronField(min2, 0, 59, void 0, 0, "minute"),
+    hours: parseCronField(hour, 0, 23, void 0, 0, "hour"),
+    daysOfMonth: parseCronField(dom, 1, 31, void 0, 0, "day-of-month"),
+    months: parseCronField(mon, 1, 12, MONTH_NAMES, 1, "month"),
+    daysOfWeek,
+    dayFieldsBothRestricted: dom !== "*" && dow !== "*"
+  };
 }
-function fieldSegment(field, index) {
-  return typeof field.name === "string" && field.name.length > 0 ? `fields${quoteSegment(field.name)}` : `fields[${index}]`;
+function dayMatches(schedule, date) {
+  const domOk = schedule.daysOfMonth.has(date.getUTCDate());
+  const dowOk = schedule.daysOfWeek.has(date.getUTCDay());
+  return schedule.dayFieldsBothRestricted ? domOk || dowOk : domOk && dowOk;
 }
-function blockSegment(block, index) {
-  return typeof block.slug === "string" && block.slug.length > 0 ? `blocks${quoteSegment(block.slug)}` : `blocks[${index}]`;
+function nextCronRun(expression, after) {
+  const schedule = typeof expression === "string" ? parseCron(expression) : expression;
+  const cursor = new Date(after.getTime());
+  cursor.setUTCSeconds(0, 0);
+  cursor.setUTCMinutes(cursor.getUTCMinutes() + 1);
+  const limit = after.getTime() + 5 * 366 * 24 * 60 * 60 * 1e3;
+  while (cursor.getTime() <= limit) {
+    if (!schedule.months.has(cursor.getUTCMonth() + 1)) {
+      cursor.setUTCMonth(cursor.getUTCMonth() + 1, 1);
+      cursor.setUTCHours(0, 0, 0, 0);
+      continue;
+    }
+    if (!dayMatches(schedule, cursor)) {
+      cursor.setUTCDate(cursor.getUTCDate() + 1);
+      cursor.setUTCHours(0, 0, 0, 0);
+      continue;
+    }
+    if (!schedule.hours.has(cursor.getUTCHours())) {
+      cursor.setUTCHours(cursor.getUTCHours() + 1, 0, 0, 0);
+      continue;
+    }
+    if (!schedule.minutes.has(cursor.getUTCMinutes())) {
+      cursor.setUTCMinutes(cursor.getUTCMinutes() + 1, 0, 0);
+      continue;
+    }
+    return cursor;
+  }
+  throw new Error(`Cron expression "${typeof expression === "string" ? expression : "schedule"}" never matches.`);
 }
-function collectionSegment(collection, index) {
-  return typeof collection.slug === "string" && collection.slug.length > 0 ? `collections${quoteSegment(collection.slug)}` : `collections[${index}]`;
+function defineTask(task) {
+  if (!task.name || !task.name.trim()) throw new Error("A task needs a non-empty name.");
+  if (task.cron !== void 0) parseCron(task.cron);
+  if (task.lockTimeout !== void 0 && !(task.lockTimeout > 0)) {
+    throw new Error(`Task "${task.name}" lockTimeout must be a positive number of seconds.`);
+  }
+  return task;
 }
-function globalSegment(global, index) {
-  return typeof global.slug === "string" && global.slug.length > 0 ? `globals${quoteSegment(global.slug)}` : `globals[${index}]`;
+function resolveLogger(config, taskName) {
+  const base = config.logger;
+  if (base && typeof base.child === "function") return base.child({ component: "tasks", task: taskName });
+  const prefix = `[dyrected/tasks] ${taskName}`;
+  return {
+    info: (obj, msg) => console.info(prefix, msg ?? "", obj),
+    warn: (obj, msg) => console.warn(prefix, msg ?? "", obj),
+    error: (obj, msg) => console.error(prefix, msg ?? "", obj)
+  };
 }
-function colorize(value, code, enabled) {
-  return enabled ? `\x1B[${code}m${value}\x1B[0m` : value;
+function floorToMinute(date) {
+  const d = new Date(date.getTime());
+  d.setUTCSeconds(0, 0);
+  return d;
 }
-function collectRootIdentifiers(node, roots, seen) {
-  if (!node || typeof node !== "object" || seen.has(node)) return;
-  seen.add(node);
-  const candidate = node;
-  if (candidate.type === "Identifier") {
-    if (candidate.from) {
-      collectRootIdentifiers(candidate.from, roots, seen);
-      return;
+function createTaskRunner(config) {
+  const db = config.db;
+  if (!db) throw new Error("createTaskRunner requires config.db.");
+  const tasks = /* @__PURE__ */ new Map();
+  for (const task of config.tasks ?? []) {
+    if (tasks.has(task.name)) throw new Error(`Duplicate task name "${task.name}".`);
+    tasks.set(task.name, { ...task, schedule: task.cron ? parseCron(task.cron) : void 0 });
+  }
+  const hasRetention = (config.collections ?? []).some((col) => {
+    const resolved = resolveTrashConfig(col, config);
+    return resolved.enabled && resolved.retentionDays !== null && resolved.retentionDays > 0;
+  });
+  if (hasRetention && !tasks.has("dyrected:trash-purge")) {
+    const purgeTask = createTrashPurgeTask(config);
+    tasks.set(purgeTask.name, { ...purgeTask, schedule: purgeTask.cron ? parseCron(purgeTask.cron) : void 0 });
+  }
+  const instanceId = globalThis.crypto?.randomUUID?.() ?? `inst_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+  let timer;
+  let inFlight = Promise.resolve();
+  let ticking = false;
+  let ready;
+  function ensureReady() {
+    ready ??= Promise.resolve(db.sync?.([TASK_LOCKS_COLLECTION_CONFIG], [])).then(() => void 0);
+    ready.catch(() => {
+      ready = void 0;
+    });
+    return ready;
+  }
+  async function ensureLockRow(name, now2) {
+    await ensureReady();
+    const existing = await db.findOne({ collection: TASK_LOCKS_COLLECTION, id: name });
+    if (existing) return existing;
+    try {
+      return await db.create({
+        collection: TASK_LOCKS_COLLECTION,
+        data: {
+          id: name,
+          name,
+          lockedUntil: 0,
+          lockedBy: null,
+          lastScheduledFor: floorToMinute(now2).toISOString(),
+          lastStartedAt: null,
+          lastFinishedAt: null,
+          lastStatus: null,
+          lastError: null
+        }
+      });
+    } catch (error) {
+      const created = await db.findOne({ collection: TASK_LOCKS_COLLECTION, id: name });
+      if (created) return created;
+      throw error;
     }
-    if (typeof candidate.value === "string" && candidate.value !== "null") {
-      roots.add(candidate.value);
+  }
+  async function execute(task, row, scheduledFor) {
+    const started = Date.now();
+    const lockMs = (task.lockTimeout ?? DEFAULT_LOCK_TIMEOUT_SECONDS) * 1e3;
+    const token = `${instanceId}:${started}`;
+    const where = {
+      id: { equals: task.name },
+      lockedUntil: { less_than: started }
+    };
+    if (scheduledFor) where.lastScheduledFor = { equals: row.lastScheduledFor };
+    const claimed = await db.update({
+      collection: TASK_LOCKS_COLLECTION,
+      where,
+      data: {
+        lockedUntil: started + lockMs,
+        lockedBy: token,
+        lastStartedAt: new Date(started).toISOString(),
+        ...scheduledFor ? { lastScheduledFor: scheduledFor.toISOString() } : {}
+      }
+    });
+    if (claimed.affectedRows !== 1) {
+      return { name: task.name, status: "skipped", reason: "locked", durationMs: Date.now() - started };
     }
-    return;
+    const logger = resolveLogger(config, task.name);
+    const controller = new AbortController();
+    let timeout;
+    let status = "completed";
+    let errorMessage;
+    try {
+      await Promise.race([
+        Promise.resolve(task.run({ db, logger, signal: controller.signal, scheduledFor })),
+        new Promise((_, reject) => {
+          timeout = setTimeout(() => {
+            reject(new Error(`Task exceeded its lockTimeout of ${lockMs / 1e3}s.`));
+            controller.abort();
+          }, lockMs);
+        })
+      ]);
+    } catch (error) {
+      status = "failed";
+      errorMessage = error instanceof Error ? error.message : String(error);
+      logger.error({ err: error }, "Task failed");
+    } finally {
+      if (timeout) clearTimeout(timeout);
+    }
+    try {
+      await db.update({
+        collection: TASK_LOCKS_COLLECTION,
+        where: { id: { equals: task.name }, lockedBy: { equals: token } },
+        data: {
+          lockedUntil: 0,
+          lockedBy: null,
+          lastFinishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          lastStatus: status,
+          lastError: errorMessage ?? null
+        }
+      });
+    } catch (error) {
+      logger.warn({ err: error }, "Could not release task lock; it will expire on its own");
+    }
+    return { name: task.name, status, error: errorMessage, durationMs: Date.now() - started };
   }
-  if (Array.isArray(node)) {
-    for (const entry of node) collectRootIdentifiers(entry, roots, seen);
-    return;
+  function track(work) {
+    inFlight = inFlight.then(() => work).catch(() => void 0);
+    return work;
   }
-  for (const value of Object.values(node)) {
-    if (Array.isArray(value)) {
-      for (const entry of value) collectRootIdentifiers(entry, roots, seen);
-      continue;
-    }
-    if (value && typeof value === "object") {
-      collectRootIdentifiers(value, roots, seen);
+  const runner = {
+    async runTask(name) {
+      const task = tasks.get(name);
+      if (!task) throw new Error(`Unknown task "${name}".`);
+      const row = await ensureLockRow(name, /* @__PURE__ */ new Date());
+      return track(execute(task, row, void 0));
+    },
+    async runDue(now2 = /* @__PURE__ */ new Date()) {
+      const results = [];
+      for (const task of tasks.values()) {
+        if (!task.schedule) continue;
+        const row = await ensureLockRow(task.name, now2);
+        const reference = new Date(String(row.lastScheduledFor));
+        const due = Number.isNaN(reference.getTime()) ? true : nextCronRun(task.schedule, reference).getTime() <= now2.getTime();
+        if (!due) {
+          results.push({ name: task.name, status: "skipped", reason: "not-due", durationMs: 0 });
+          continue;
+        }
+        results.push(await track(execute(task, row, floorToMinute(now2))));
+      }
+      return results;
+    },
+    start(options) {
+      if (timer) return;
+      const intervalMs = options?.intervalMs ?? DEFAULT_TICK_MS;
+      const tick = () => {
+        if (ticking) return;
+        ticking = true;
+        runner.runDue().catch((error) => resolveLogger(config, "runner").error({ err: error }, "Task tick failed")).finally(() => {
+          ticking = false;
+        });
+      };
+      timer = setInterval(tick, intervalMs);
+      timer.unref?.();
+      setTimeout(tick, 0);
+    },
+    async stop() {
+      if (timer) clearInterval(timer);
+      timer = void 0;
+      await inFlight;
+    },
+    getTasks() {
+      return Array.from(tasks.values()).map((t) => ({ name: t.name, cron: t.cron }));
     }
-  }
-}
-function getInvalidRoots(expression, allowedRoots) {
-  const { ast } = compileExpression(expression);
-  const roots = /* @__PURE__ */ new Set();
-  collectRootIdentifiers(ast, roots, /* @__PURE__ */ new Set());
-  const allowed = new Set(allowedRoots);
-  return [...roots].filter((root) => !allowed.has(root));
+  };
+  return runner;
 }
-function validateDeclarativeHookExpression(expression, surface, path) {
-  try {
-    const invalidRoots = getInvalidRoots(expression, SURFACE_ROOTS[surface]);
-    if (invalidRoots.length === 0) return [];
-    return [
+
+// src/workflows.ts
+var WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
+var LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
+var EDITOR_CAPABILITIES = ["entry.edit", "entry.submit"];
+var PUBLISHER_CAPABILITIES = ["entry.edit", "entry.submit", "entry.publish", "entry.unpublish"];
+function definePublishingWorkflow(options = {}) {
+  const editors = options.editors ?? ["editor"];
+  const publishers = options.publishers ?? ["publisher", "admin"];
+  return {
+    initialState: "draft",
+    draftState: "draft",
+    states: [
+      { name: "draft", label: "Draft", color: "neutral" },
+      { name: "in_review", label: "In review", color: "warning" },
+      { name: "published", label: "Published", color: "success", published: true }
+    ],
+    transitions: [
       {
-        path,
-        surface,
-        expression,
-        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${SURFACE_ROOTS[surface].map((root) => `"${root}"`).join(", ")}`
-      }
-    ];
-  } catch (error) {
-    return [
+        name: "submit",
+        label: "Submit for review",
+        from: "draft",
+        to: "in_review",
+        requiredCapabilities: ["entry.submit"]
+      },
       {
-        path,
-        surface,
-        expression,
-        message: `has invalid syntax: ${error.message}`
-      }
-    ];
-  }
-}
-function validateDeclarativeAccessExpression(expression, surface, path) {
-  try {
-    const invalidRoots = getInvalidRoots(expression, ACCESS_ROOTS);
-    if (invalidRoots.length === 0) return [];
-    return [
+        name: "publish",
+        label: "Publish",
+        from: "in_review",
+        to: "published",
+        requiredCapabilities: ["entry.publish"]
+      },
       {
-        path,
-        surface,
-        expression,
-        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${ACCESS_ROOTS.map((root) => `"${root}"`).join(", ")}`
-      }
-    ];
-  } catch (error) {
-    return [
+        name: "reject",
+        label: "Request changes",
+        from: "in_review",
+        to: "draft",
+        requiredCapabilities: ["entry.publish"],
+        requireComment: true
+      },
       {
-        path,
-        surface,
-        expression,
-        message: `has invalid syntax: ${error.message}`
+        name: "unpublish",
+        label: "Unpublish",
+        from: "published",
+        to: "draft",
+        requiredCapabilities: ["entry.unpublish"],
+        unpublish: true
       }
-    ];
-  }
+    ],
+    roles: [
+      ...editors.map((role) => ({ role, capabilities: [...EDITOR_CAPABILITIES] })),
+      ...publishers.map((role) => ({ role, capabilities: [...PUBLISHER_CAPABILITIES] }))
+    ]
+  };
 }
-function validateAdminConditionExpression(expression, path, allowedRoots) {
-  try {
-    const invalidRoots = getInvalidRoots(expression, allowedRoots);
-    if (invalidRoots.length === 0) return [];
-    return [
-      {
-        path,
-        surface: "field.admin.condition",
-        expression,
-        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${allowedRoots.map((root) => `"${root}"`).join(", ")}`
-      }
-    ];
-  } catch (error) {
-    return [
-      {
-        path,
-        surface: "field.admin.condition",
-        expression,
-        message: `has invalid syntax: ${error.message}`
-      }
-    ];
-  }
+function publishingWorkflow() {
+  return definePublishingWorkflow();
 }
-function validatePreviewUrlExpression(expression, path, allowedRoots) {
-  try {
-    const invalidRoots = getInvalidRoots(expression, allowedRoots);
-    if (invalidRoots.length === 0) return [];
-    return [
-      {
-        path,
-        surface: "collection.admin.previewUrl",
-        expression,
-        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${allowedRoots.map((root) => `"${root}"`).join(", ")}`
-      }
-    ];
-  } catch (error) {
-    return [
-      {
-        path,
-        surface: "collection.admin.previewUrl",
-        expression,
-        message: `has invalid syntax: ${error.message}`
-      }
-    ];
-  }
+function simplePublishingWorkflow() {
+  return {
+    initialState: "draft",
+    draftState: "draft",
+    states: [
+      { name: "draft", label: "Draft", color: "neutral" },
+      { name: "published", label: "Published", color: "success", published: true }
+    ],
+    transitions: [
+      { name: "publish", label: "Publish", from: ["draft", "published"], to: "published" },
+      { name: "unpublish", label: "Unpublish", from: "published", to: "draft", unpublish: true }
+    ]
+    // Intentionally no `roles`: this lightweight workflow (synthesized from
+    // `drafts: true`) does no capability-based gating. Draft visibility for a
+    // no-roles workflow is handled in `canViewWorkflowDraft`.
+  };
 }
-function assertValidDeclarativeHookExpression(expression, surface, path) {
-  const issues = validateDeclarativeHookExpression(expression, surface, path);
-  if (issues.length === 0) return;
-  throw new Error(`Invalid declarative hook at ${path}: ${issues[0].message}`);
+function publicMetadata(meta) {
+  const { availableTransitions: _availableTransitions, ...safe } = meta;
+  return safe;
 }
-function assertValidDeclarativeHookResult(result, surface, path) {
-  if (isPlainObject(result)) return;
-  throw new Error(`Invalid declarative hook result at ${path}: ${surface} expressions must return an object`);
+function workflowCapabilities(workflow, user) {
+  const capabilities = new Set(Array.isArray(user?.capabilities) ? user.capabilities : []);
+  const roles = Array.isArray(user?.roles) ? user.roles : typeof user?.role === "string" ? [user.role] : [];
+  for (const mapping of workflow.roles ?? []) {
+    if (roles.includes(mapping.role)) mapping.capabilities.forEach((capability) => capabilities.add(capability));
+  }
+  return capabilities;
 }
-function collectFieldIssues(fields, path, issues) {
-  fields.forEach((field, index) => {
-    const fieldPath = `${path}.${fieldSegment(field, index)}`;
-    field.hooks?.beforeChange?.forEach((hook, hookIndex) => {
-      if (typeof hook !== "string") return;
-      issues.push(
-        ...validateDeclarativeHookExpression(
-          hook,
-          "field.beforeChange",
-          `${fieldPath}.hooks.beforeChange[${hookIndex}]`
-        )
-      );
-    });
-    field.hooks?.afterRead?.forEach((hook, hookIndex) => {
-      if (typeof hook !== "string") return;
-      issues.push({
-        path: `${fieldPath}.hooks.afterRead[${hookIndex}]`,
-        surface: "unsupported",
-        expression: hook,
-        message: "declarative strings are not supported on field hooks.afterRead"
-      });
-    });
-    if (typeof field.admin?.hooks?.onChange === "string") {
-      issues.push(
-        ...validateDeclarativeHookExpression(
-          field.admin.hooks.onChange,
-          "field.admin.onChange",
-          `${fieldPath}.admin.hooks.onChange`
-        )
-      );
-    }
-    if (typeof field.admin?.hooks?.options === "string") {
-      issues.push({
-        path: `${fieldPath}.admin.hooks.options`,
-        surface: "unsupported",
-        expression: field.admin.hooks.options,
-        message: "declarative strings are not supported on field admin.hooks.options"
-      });
-    }
-    if (Array.isArray(field.fields)) {
-      collectFieldIssues(field.fields, fieldPath, issues);
-    }
-    if (Array.isArray(field.blocks)) {
-      field.blocks.forEach((block, blockIndex) => {
-        if (!Array.isArray(block.fields)) return;
-        collectFieldIssues(block.fields, `${fieldPath}.${blockSegment(block, blockIndex)}`, issues);
-      });
-    }
+function canViewWorkflowDraft(workflow, user) {
+  if (!user) return false;
+  const capabilities = workflowCapabilities(workflow, user);
+  if (capabilities.has("entry.edit")) return true;
+  if (workflow.transitions.some(
+    (transition) => (transition.requiredCapabilities ?? []).some((capability) => capabilities.has(capability))
+  )) {
+    return true;
+  }
+  if (!workflow.roles || workflow.roles.length === 0) return true;
+  return false;
+}
+function availableWorkflowTransitions(workflow, state, user) {
+  const capabilities = workflowCapabilities(workflow, user);
+  return workflow.transitions.filter((transition) => {
+    const from = Array.isArray(transition.from) ? transition.from : [transition.from];
+    return from.includes(state) && (transition.requiredCapabilities ?? []).every((item) => capabilities.has(item));
   });
 }
-function collectFieldNames(fields) {
-  return fields.flatMap(
-    (field) => typeof field.name === "string" && field.name.length > 0 ? [field.name] : []
-  );
+function initializeWorkflowDocument(data, workflow) {
+  return {
+    ...data,
+    __workflow: { state: workflow.initialState, revision: 1 }
+  };
+}
+function publishedStateName(workflow) {
+  return workflow.states.find((state) => state.published)?.name ?? workflow.states[workflow.states.length - 1]?.name ?? workflow.initialState;
 }
-function collectAdminConditionIssues(fields, path, rootFieldNames, issues) {
-  const scopeFieldNames = collectFieldNames(fields);
-  const allowedRoots = [.../* @__PURE__ */ new Set([...ADMIN_CONDITION_RESERVED_ROOTS, ...rootFieldNames, ...scopeFieldNames])];
-  fields.forEach((field, index) => {
-    const fieldPath = `${path}.${fieldSegment(field, index)}`;
-    if (typeof field.admin?.condition === "string") {
-      issues.push(
-        ...validateAdminConditionExpression(
-          field.admin.condition,
-          `${fieldPath}.admin.condition`,
-          allowedRoots
-        )
-      );
-    }
-    if (Array.isArray(field.fields)) {
-      collectAdminConditionIssues(field.fields, fieldPath, rootFieldNames, issues);
+function materializeWorkflowDocument(doc, workflow, user) {
+  const meta = doc.__workflow;
+  const publishedState = publishedStateName(workflow);
+  if (!meta) {
+    const { __published: _legacyPublished, __workflow: _legacyWorkflow, ...working2 } = doc;
+    const state = publishedStateName(workflow);
+    return {
+      ...working2,
+      _workflow: {
+        state,
+        revision: 1,
+        availableTransitions: availableWorkflowTransitions(workflow, state, user).map((item) => item.name)
+      }
+    };
+  }
+  const { __published, __workflow, ...working } = doc;
+  if (!canViewWorkflowDraft(workflow, user)) {
+    if (!__published || typeof __published !== "object") {
+      if (meta.state === publishedState) {
+        return { ...working, _workflow: publicMetadata(meta) };
+      }
+      return null;
     }
-    if (Array.isArray(field.blocks)) {
-      field.blocks.forEach((block, blockIndex) => {
-        if (!Array.isArray(block.fields)) return;
-        collectAdminConditionIssues(
-          block.fields,
-          `${fieldPath}.${blockSegment(block, blockIndex)}`,
-          rootFieldNames,
-          issues
-        );
-      });
+    return { id: doc.id, ...__published, _workflow: publicMetadata(meta) };
+  }
+  return {
+    ...working,
+    _workflow: {
+      ...meta,
+      availableTransitions: availableWorkflowTransitions(workflow, meta.state, user).map((item) => item.name)
     }
-  });
+  };
 }
-function collectFieldAccessIssues(fields, path, issues) {
-  fields.forEach((field, index) => {
-    const fieldPath = `${path}.${fieldSegment(field, index)}`;
-    if (typeof field.access?.read === "string") {
-      issues.push(...validateDeclarativeAccessExpression(field.access.read, "field.access", `${fieldPath}.access.read`));
-    }
-    if (typeof field.access?.create === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(field.access.create, "field.access", `${fieldPath}.access.create`)
-      );
-    }
-    if (typeof field.access?.update === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(field.access.update, "field.access", `${fieldPath}.access.update`)
-      );
-    }
-    if (Array.isArray(field.fields)) {
-      collectFieldAccessIssues(field.fields, fieldPath, issues);
-    }
-    if (Array.isArray(field.blocks)) {
-      field.blocks.forEach((block, blockIndex) => {
-        if (!Array.isArray(block.fields)) return;
-        collectFieldAccessIssues(
-          block.fields,
-          `${fieldPath}.${blockSegment(block, blockIndex)}`,
-          issues
-        );
-      });
-    }
-  });
+function eventId() {
+  return globalThis.crypto?.randomUUID?.() ?? `evt_${Date.now()}_${Math.random().toString(36).slice(2)}`;
 }
-function collectHookIssues(hooks, scope, path, issues) {
-  if (!hooks) return;
-  const supported = {
-    beforeRead: `${scope}.beforeRead`,
-    afterRead: `${scope}.afterRead`,
-    beforeChange: `${scope}.beforeChange`
+function createLifecycleEvent(args) {
+  return {
+    id: eventId(),
+    name: args.name,
+    collection: args.collection,
+    documentId: args.documentId,
+    occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+    actorId: args.actorId,
+    payload: args.payload,
+    attempts: 0,
+    status: "pending"
   };
-  for (const [key, value] of Object.entries(hooks)) {
-    if (!Array.isArray(value)) continue;
-    value.forEach((hook, index) => {
-      if (typeof hook !== "string") return;
-      const surface = supported[key];
-      if (!surface) {
-        issues.push({
-          path: `${path}.${key}[${index}]`,
-          surface: "unsupported",
-          expression: hook,
-          message: `declarative strings are not supported on ${scope} hooks.${key}`
-        });
-        return;
+}
+async function persistEvent(db, event) {
+  await db.create({ collection: LIFECYCLE_EVENTS_COLLECTION, data: event });
+}
+async function dispatchLifecycleEvent(config, event) {
+  const db = config.db;
+  if (!db || !config.events?.handlers.length) return;
+  const maxAttempts = config.events.maxAttempts ?? 8;
+  const retryDelayMs = config.events.retryDelayMs ?? 1e3;
+  const attempts = event.attempts + 1;
+  try {
+    await db.update({
+      collection: LIFECYCLE_EVENTS_COLLECTION,
+      id: event.id,
+      data: { status: "processing", attempts }
+    });
+    for (const handler of config.events.handlers) await handler({ ...event, status: "processing", attempts });
+    await db.update({
+      collection: LIFECYCLE_EVENTS_COLLECTION,
+      id: event.id,
+      data: { status: "delivered", attempts, deliveredAt: (/* @__PURE__ */ new Date()).toISOString(), lastError: null }
+    });
+  } catch (error) {
+    const exhausted = attempts >= maxAttempts;
+    await db.update({
+      collection: LIFECYCLE_EVENTS_COLLECTION,
+      id: event.id,
+      data: {
+        status: "failed",
+        attempts,
+        lastError: error instanceof Error ? error.message : String(error),
+        nextAttemptAt: exhausted ? null : new Date(Date.now() + retryDelayMs * 2 ** (attempts - 1)).toISOString()
       }
-      issues.push(...validateDeclarativeHookExpression(hook, surface, `${path}.${key}[${index}]`));
     });
   }
 }
-function collectDeclarativeHookValidationIssues(config) {
-  const issues = [];
-  config.blocks?.forEach((block, blockIndex) => {
-    if (!Array.isArray(block.fields)) return;
-    collectFieldIssues(
-      block.fields,
-      blockSegment(block, blockIndex),
-      issues
-    );
+async function dispatchPendingLifecycleEvents(config, limit = 50) {
+  if (!config.db || !config.events?.handlers.length) return 0;
+  const maxAttempts = config.events.maxAttempts ?? 8;
+  const result = await config.db.find({
+    collection: LIFECYCLE_EVENTS_COLLECTION,
+    where: { status: { in: ["pending", "failed"] } },
+    sort: "occurredAt",
+    limit
   });
-  config.collections.forEach((collection, collectionIndex) => {
-    const collectionPath = collectionSegment(collection, collectionIndex);
-    collectHookIssues(
-      collection.hooks,
-      "collection",
-      `${collectionPath}.hooks`,
-      issues
-    );
-    collectFieldIssues(collection.fields, collectionPath, issues);
+  const now2 = Date.now();
+  const due = result.docs.filter(
+    (doc) => Number(doc.attempts ?? 0) < maxAttempts && (!doc.nextAttemptAt || new Date(doc.nextAttemptAt).getTime() <= now2)
+  );
+  for (const event of due) await dispatchLifecycleEvent(config, event);
+  return due.length;
+}
+async function saveWorkflowDraft(args) {
+  const { config, collection, id, originalDoc, data, user, beforeCommit } = args;
+  const db = config.db;
+  const workflow = collection.workflow;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  const previous = originalDoc.__workflow;
+  const isLegacyPublishedDoc = !previous;
+  const baselineRevision = previous?.revision ?? 1;
+  const event = createLifecycleEvent({
+    name: "revision.created",
+    collection: collection.slug,
+    documentId: id,
+    actorId: user?.sub,
+    payload: {
+      revision: baselineRevision + 1,
+      previousRevision: isLegacyPublishedDoc ? baselineRevision : previous?.revision ?? null
+    }
   });
-  config.globals?.forEach((global, globalIndex) => {
-    const globalPath = globalSegment(global, globalIndex);
-    collectHookIssues(
-      global.hooks,
-      "global",
-      `${globalPath}.hooks`,
-      issues
-    );
-    collectFieldIssues(global.fields, globalPath, issues);
+  const doc = await db.transaction(async (tx) => {
+    const nextMeta = {
+      ...previous ?? {},
+      state: isLegacyPublishedDoc ? workflow.draftState ?? workflow.initialState : originalDoc.__published ? workflow.draftState ?? workflow.initialState : previous.state,
+      revision: baselineRevision + 1,
+      ...isLegacyPublishedDoc ? { publishedRevision: baselineRevision } : {}
+    };
+    const updateData = {
+      ...data,
+      __workflow: nextMeta
+    };
+    if (isLegacyPublishedDoc) {
+      const { __workflow: _legacyWorkflow, __published: _legacyPublished, ...publishedSnapshot } = originalDoc;
+      updateData.__published = publishedSnapshot;
+    }
+    const updated = await tx.update({ collection: collection.slug, id, data: updateData });
+    await persistEvent(tx, event);
+    await beforeCommit?.(tx, updated);
+    return updated;
+  });
+  void dispatchLifecycleEvent(config, event);
+  return { doc, event };
+}
+async function createWorkflowDocument(args) {
+  const { config, collection, data, user, beforeCommit } = args;
+  const db = config.db;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  let event;
+  const doc = await db.transaction(async (tx) => {
+    const created = await tx.create({ collection: collection.slug, data });
+    event = createLifecycleEvent({
+      name: "revision.created",
+      collection: collection.slug,
+      documentId: created.id,
+      actorId: user?.sub,
+      payload: { revision: 1, previousRevision: null }
+    });
+    await persistEvent(tx, event);
+    await beforeCommit?.(tx, created);
+    return created;
   });
-  return issues;
+  void dispatchLifecycleEvent(config, event);
+  return { doc, event };
 }
-function collectDeclarativeAccessValidationIssues(config) {
-  const issues = [];
-  Object.entries(config.accessPolicies ?? {}).forEach(([name, value]) => {
-    if (typeof value !== "string") return;
-    issues.push(
-      ...validateDeclarativeAccessExpression(value, "config.accessPolicy", `accessPolicies.${name}`)
+async function transitionWorkflow(args) {
+  const { config, collection, id, transitionName, expectedRevision, comment, input, user, req } = args;
+  const db = config.db;
+  const workflow = collection.workflow;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  const original = await db.findOne({ collection: collection.slug, id });
+  if (!original) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
+  const meta = original.__workflow;
+  if (!meta) throw Object.assign(new Error("Entry has no workflow metadata"), { statusCode: 409 });
+  if (expectedRevision !== void 0 && expectedRevision !== meta.revision) {
+    throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), {
+      statusCode: 409
+    });
+  }
+  const transition = workflow.transitions.find((item) => item.name === transitionName);
+  const fromStates = transition ? Array.isArray(transition.from) ? transition.from : [transition.from] : [];
+  if (!transition || !fromStates.includes(meta.state)) {
+    throw Object.assign(new Error(`Transition "${transitionName}" is not valid from "${meta.state}".`), {
+      statusCode: 409
+    });
+  }
+  if (!availableWorkflowTransitions(workflow, meta.state, user).some((item) => item.name === transition.name)) {
+    throw Object.assign(new Error(`You do not have permission to perform "${transition.label}".`), { statusCode: 403 });
+  }
+  if (transition.requireComment && !comment?.trim()) {
+    throw Object.assign(new Error(`A comment is required for "${transition.label}".`), { statusCode: 400 });
+  }
+  const hookContext = { transition, from: meta.state, to: transition.to, doc: original, user, comment, input, req, db };
+  for (const hook of workflow.hooks?.beforeTransition ?? []) await hook(hookContext);
+  const events = [
+    createLifecycleEvent({
+      name: "workflow.transitioned",
+      collection: collection.slug,
+      documentId: id,
+      actorId: user?.sub,
+      payload: { transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision, comment }
+    })
+  ];
+  const targetState = workflow.states.find((state) => state.name === transition.to);
+  if (targetState.published) {
+    events.push(
+      createLifecycleEvent({
+        name: "entry.published",
+        collection: collection.slug,
+        documentId: id,
+        actorId: user?.sub,
+        payload: { revision: meta.revision }
+      })
     );
-  });
-  config.blocks?.forEach((block, blockIndex) => {
-    if (!Array.isArray(block.fields)) return;
-    collectFieldAccessIssues(
-      block.fields,
-      blockSegment(block, blockIndex),
-      issues
+  } else if (transition.unpublish) {
+    events.push(
+      createLifecycleEvent({
+        name: "entry.unpublished",
+        collection: collection.slug,
+        documentId: id,
+        actorId: user?.sub,
+        payload: { revision: meta.publishedRevision }
+      })
     );
-  });
-  config.collections.forEach((collection, collectionIndex) => {
-    const collectionPath = collectionSegment(collection, collectionIndex);
-    if (typeof collection.access?.read === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(
-          collection.access.read,
-          "collection.access",
-          `${collectionPath}.access.read`
-        )
-      );
-    }
-    if (typeof collection.access?.create === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(
-          collection.access.create,
-          "collection.access",
-          `${collectionPath}.access.create`
-        )
-      );
-    }
-    if (typeof collection.access?.update === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(
-          collection.access.update,
-          "collection.access",
-          `${collectionPath}.access.update`
-        )
-      );
-    }
-    if (typeof collection.access?.delete === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(
-          collection.access.delete,
-          "collection.access",
-          `${collectionPath}.access.delete`
-        )
-      );
-    }
-    if (typeof collection.access?.readAudit === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(
-          collection.access.readAudit,
-          "collection.access",
-          `${collectionPath}.access.readAudit`
-        )
-      );
+  }
+  const updated = await db.transaction(async (tx) => {
+    const locked = await tx.findOne({ collection: collection.slug, id });
+    if (!locked) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
+    const lockedMeta = locked.__workflow;
+    if (lockedMeta.revision !== meta.revision || lockedMeta.state !== meta.state || expectedRevision !== void 0 && lockedMeta.revision !== expectedRevision) {
+      throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), {
+        statusCode: 409
+      });
     }
-    collectFieldAccessIssues(collection.fields, collectionPath, issues);
-  });
-  config.globals?.forEach((global, globalIndex) => {
-    const globalPath = globalSegment(global, globalIndex);
-    if (typeof global.access?.read === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(global.access.read, "global.access", `${globalPath}.access.read`)
-      );
+    const now2 = (/* @__PURE__ */ new Date()).toISOString();
+    const { __published: _published, __workflow: _workflow, id: _id, ...working } = locked;
+    const nextMeta = {
+      ...lockedMeta,
+      state: transition.to,
+      ...targetState.published ? { publishedRevision: lockedMeta.revision, publishedAt: now2, publishedBy: user?.sub } : {},
+      ...transition.unpublish ? { publishedRevision: void 0, publishedAt: void 0, publishedBy: void 0 } : {}
+    };
+    const data = { __workflow: nextMeta };
+    if (targetState.published) data.__published = working;
+    if (transition.unpublish) data.__published = null;
+    const next = await tx.update({ collection: collection.slug, id, data });
+    if (transition.onTransition) {
+      await transition.onTransition({
+        transition,
+        from: lockedMeta.state,
+        to: transition.to,
+        doc: locked,
+        input,
+        comment,
+        user,
+        req,
+        tx
+      });
     }
-    if (typeof global.access?.update === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(
-          global.access.update,
-          "global.access",
-          `${globalPath}.access.update`
-        )
-      );
+    await tx.create({
+      collection: WORKFLOW_HISTORY_COLLECTION,
+      data: {
+        collection: collection.slug,
+        documentId: id,
+        transition: transition.name,
+        from: lockedMeta.state,
+        to: transition.to,
+        revision: lockedMeta.revision,
+        comment: comment ?? null,
+        actorId: user?.sub ?? null,
+        createdAt: now2
+      }
+    });
+    for (const event of events) await persistEvent(tx, event);
+    if (collection.audit) {
+      await tx.create({
+        collection: "__audit",
+        data: {
+          collection: collection.slug,
+          documentId: id,
+          operation: "workflow.transition",
+          user: user?.sub ?? null,
+          timestamp: now2,
+          changes: JSON.stringify({
+            transition: transition.name,
+            from: lockedMeta.state,
+            to: transition.to,
+            revision: lockedMeta.revision
+          })
+        }
+      });
     }
-    collectFieldAccessIssues(global.fields, globalPath, issues);
-  });
-  return issues;
-}
-function collectAdminConditionValidationIssues(config) {
-  const issues = [];
-  config.blocks?.forEach((block, blockIndex) => {
-    if (!Array.isArray(block.fields)) return;
-    collectAdminConditionIssues(
-      block.fields,
-      blockSegment(block, blockIndex),
-      collectFieldNames(block.fields),
-      issues
-    );
-  });
-  config.collections.forEach((collection, collectionIndex) => {
-    const collectionPath = collectionSegment(collection, collectionIndex);
-    const rootFieldNames = collectFieldNames(collection.fields);
-    collectAdminConditionIssues(collection.fields, collectionPath, rootFieldNames, issues);
-  });
-  config.globals?.forEach((global, globalIndex) => {
-    const globalPath = globalSegment(global, globalIndex);
-    const rootFieldNames = collectFieldNames(global.fields);
-    collectAdminConditionIssues(global.fields, globalPath, rootFieldNames, issues);
+    return next;
   });
-  return issues;
+  for (const event of events) void dispatchLifecycleEvent(config, event);
+  for (const hook of workflow.hooks?.afterTransition ?? []) {
+    try {
+      await hook({ ...hookContext, doc: updated, event: events[0] });
+    } catch (error) {
+      try {
+        const obs = config?.__observability;
+        obs?.recordWorkflowHookFailure?.({
+          collection: collection.slug,
+          transition: transition.name
+        });
+        const logger = config?.logger;
+        if (logger && typeof logger.child === "function") {
+          logger.child({ component: "workflow" }).error({
+            err: error,
+            msg: "afterTransition hook failed",
+            collection: collection.slug,
+            transition: transition.name,
+            documentId: id
+          });
+        } else if (logger && typeof logger.error === "function") {
+          logger.error({
+            err: error,
+            msg: "afterTransition hook failed",
+            collection: collection.slug,
+            transition: transition.name,
+            documentId: id
+          });
+        } else {
+          console.error("afterTransition hook failed:", error);
+        }
+      } catch {
+        console.error("afterTransition hook failed:", error);
+      }
+    }
+  }
+  return updated;
 }
-function collectPreviewUrlValidationIssues(config) {
-  const issues = [];
-  config.collections.forEach((collection, collectionIndex) => {
-    if (typeof collection.admin?.previewUrl !== "string") return;
-    const collectionPath = collectionSegment(collection, collectionIndex);
-    const allowedRoots = [
-      .../* @__PURE__ */ new Set([...PREVIEW_URL_RESERVED_ROOTS, ...collectFieldNames(collection.fields)])
-    ];
-    issues.push(
-      ...validatePreviewUrlExpression(
-        collection.admin.previewUrl,
-        `${collectionPath}.admin.previewUrl`,
-        allowedRoots
-      )
-    );
-  });
-  return issues;
+
+// src/utils/admin-auth.ts
+function getAdminAuthCollection(config) {
+  const adminCollection = resolveAdminAuthCollection(config.collections, config.adminAuth?.collectionSlug);
+  return adminCollection ?? null;
 }
-function assertValidAdminConditionsInConfig(config, source = "config") {
-  const diagnostics = collectAdminConditionValidationIssues(config).map((issue) => ({
-    severity: "error",
-    source: "adminCondition",
-    path: issue.path,
-    surface: issue.surface,
-    message: issue.message,
-    expression: issue.expression
-  }));
-  if (diagnostics.length === 0) return;
-  throw new ConfigValidationError(source, diagnostics);
+function resolveAdminAuthCollection(collections, collectionSlug) {
+  const adminsCollection = collections.find((collection) => collection.slug === "__admins");
+  if (adminsCollection) return adminsCollection;
+  if (collectionSlug) {
+    const requestedCollection = collections.find((collection) => collection.slug === collectionSlug);
+    if (requestedCollection) return requestedCollection;
+  }
+  return collections.find((collection) => collection.auth);
 }
-function assertValidPreviewUrlsInConfig(config, source = "config") {
-  const diagnostics = collectPreviewUrlValidationIssues(config).map((issue) => ({
-    severity: "error",
-    source: "previewUrl",
-    path: issue.path,
-    surface: issue.surface,
-    message: issue.message,
-    expression: issue.expression
+function getPublicAdminAuthConfig(adminAuth, collections) {
+  const providers = (adminAuth?.providers ?? []).map((provider) => ({
+    id: provider.id,
+    type: provider.type,
+    displayName: provider.displayName || humanizeProviderName(provider.id, provider.type),
+    autoRedirect: provider.autoRedirect
   }));
-  if (diagnostics.length === 0) return;
-  throw new ConfigValidationError(source, diagnostics);
+  const resolvedCollectionSlug = collections ? resolveAdminAuthCollection(collections, adminAuth?.collectionSlug)?.slug : adminAuth?.collectionSlug;
+  return {
+    mode: adminAuth?.mode ?? "local",
+    collectionSlug: resolvedCollectionSlug,
+    provisioningMode: adminAuth?.provisioningMode,
+    providers
+  };
 }
-function collectConfigDiagnostics(config) {
-  const hookIssues = collectDeclarativeHookValidationIssues(config).map((issue) => ({
-    severity: "error",
-    source: "declarativeHook",
-    path: issue.path,
-    surface: issue.surface,
-    message: issue.message,
-    expression: issue.expression
-  }));
-  const accessIssues = collectDeclarativeAccessValidationIssues(config).map((issue) => ({
-    severity: "error",
-    source: "declarativeAccess",
-    path: issue.path,
-    surface: issue.surface,
-    message: issue.message,
-    expression: issue.expression
-  }));
-  const adminConditionIssues = collectAdminConditionValidationIssues(config).map((issue) => ({
-    severity: "error",
-    source: "adminCondition",
-    path: issue.path,
-    surface: issue.surface,
-    message: issue.message,
-    expression: issue.expression
-  }));
-  const previewUrlIssues = collectPreviewUrlValidationIssues(config).map((issue) => ({
-    severity: "error",
-    source: "previewUrl",
-    path: issue.path,
-    surface: issue.surface,
-    message: issue.message,
-    expression: issue.expression
-  }));
-  return [...hookIssues, ...accessIssues, ...adminConditionIssues, ...previewUrlIssues];
+function humanizeProviderName(id, type) {
+  const cleaned = id.replace(/[-_]+/g, " ").trim();
+  if (!cleaned) return type.toUpperCase();
+  return cleaned.replace(/\b\w/g, (char) => char.toUpperCase());
+}
+function getAdminRoleForCollection(collection) {
+  if (!collection?.auth) return "admin";
+  if (typeof collection.auth === "object" && collection.auth.adminRole) {
+    return collection.auth.adminRole;
+  }
+  return "admin";
+}
+function isUserAdmin(user, collection) {
+  if (!user) return false;
+  const roles = Array.isArray(user.roles) ? user.roles : typeof user.role === "string" ? [user.role] : [];
+  if (roles.length === 0) return false;
+  const configuredRole = getAdminRoleForCollection(collection);
+  if (roles.includes(configuredRole)) return true;
+  return roles.includes("admin") || roles.includes("super_admin");
 }
-function formatConfigDiagnostics(source, diagnostics, options = {}) {
-  const color = options.color ?? false;
-  const header = `${colorize("Config validation failed", 31, color)} in ${colorize(source, 36, color)}`;
-  const docLink = `${colorize("   Learn how to write declarative rules:", 90, color)} ${colorize("https://docs.dyrected.com/docs/editor-experience/form-and-field-hooks", 34, color)}`;
-  const lines = diagnostics.flatMap((issue, index) => [
-    `${colorize(`${index + 1}.`, 31, color)} ${colorize(issue.path, 1, color)}`,
-    `   ${issue.message}`,
-    `   ${colorize("surface:", 90, color)} ${issue.surface}`
-  ]);
-  return `${header}
-${lines.join("\n")}
 
-${docLink}`;
+// src/utils/block-references.ts
+function mergeUniqueBlocks(blocks) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const block of blocks) {
+    const existing = seen.get(block.slug);
+    if (existing && existing !== block) {
+      throw new Error(
+        `Duplicate block slug "${block.slug}" found in the reusable block registry. Block slugs must be unique.`
+      );
+    }
+    if (!existing) seen.set(block.slug, block);
+  }
+  return Array.from(seen.values());
 }
-var ConfigValidationError = class extends Error {
-  diagnostics;
-  source;
-  constructor(source, diagnostics) {
-    super(formatConfigDiagnostics(source, diagnostics));
-    this.name = "ConfigValidationError";
-    this.source = source;
-    this.diagnostics = diagnostics;
+function buildRegistry(blocks) {
+  return new Map(blocks.map((block) => [block.slug, block]));
+}
+function resolveField(field, registry, blockCache) {
+  const next = { ...field };
+  if (next.fields) {
+    next.fields = next.fields.map(
+      (child) => resolveField(child, registry, blockCache)
+    );
   }
-};
-function isConfigValidationError(error) {
-  return error instanceof ConfigValidationError;
+  if (next.type !== "blocks") return next;
+  const hasInlineBlocks = Array.isArray(next.blocks) && next.blocks.length > 0;
+  const hasReferences = Array.isArray(next.blockReferences) && next.blockReferences.length > 0;
+  if (hasInlineBlocks && hasReferences) {
+    throw new Error(
+      `Blocks field "${next.name ?? "(unnamed)"}" cannot define both "blocks" and "blockReferences". Use one or the other.`
+    );
+  }
+  if (hasReferences) {
+    next.blocks = next.blockReferences.map((slug) => {
+      const block = registry.get(slug);
+      if (!block) {
+        throw new Error(
+          `Unknown block reference "${slug}" on blocks field "${next.name ?? "(unnamed)"}". Add it to defineConfig({ blocks: [...] }).`
+        );
+      }
+      return resolveBlock(block, registry, blockCache);
+    });
+    return next;
+  }
+  if (hasInlineBlocks) {
+    next.blocks = next.blocks.map(
+      (block) => resolveBlock(block, registry, blockCache)
+    );
+  }
+  return next;
 }
-function assertValidDeclarativeHooksInConfig(config, source = "config") {
-  const diagnostics = collectDeclarativeHookValidationIssues(config).map((issue) => ({
-    severity: "error",
-    source: "declarativeHook",
-    path: issue.path,
-    surface: issue.surface,
-    message: issue.message,
-    expression: issue.expression
-  }));
-  if (diagnostics.length === 0) return;
-  throw new ConfigValidationError(source, diagnostics);
+function resolveBlock(block, registry, blockCache) {
+  const cached = blockCache.get(block);
+  if (cached) return cached;
+  const resolved = {
+    ...block,
+    fields: []
+  };
+  blockCache.set(block, resolved);
+  resolved.fields = block.fields.map(
+    (field) => resolveField(field, registry, blockCache)
+  );
+  return resolved;
 }
-function assertValidDeclarativeAccessInConfig(config, source = "config") {
-  const diagnostics = collectDeclarativeAccessValidationIssues(config).map((issue) => ({
-    severity: "error",
-    source: "declarativeAccess",
-    path: issue.path,
-    surface: issue.surface,
-    message: issue.message,
-    expression: issue.expression
+function resolveFields(fields, registry, blockCache) {
+  return fields.map((field) => resolveField(field, registry, blockCache));
+}
+function normalizeSchemaFragment(fragment) {
+  const reusableBlocks = mergeUniqueBlocks(fragment.blocks ?? []);
+  const registry = buildRegistry(reusableBlocks);
+  const blockCache = /* @__PURE__ */ new WeakMap();
+  const resolvedBlocks = reusableBlocks.map(
+    (block) => resolveBlock(block, registry, blockCache)
+  );
+  const resolvedCollections = (fragment.collections ?? []).map(
+    (collection) => ({
+      ...collection,
+      fields: resolveFields(collection.fields ?? [], registry, blockCache)
+    })
+  );
+  const resolvedGlobals = (fragment.globals ?? []).map((global) => ({
+    ...global,
+    fields: resolveFields(global.fields ?? [], registry, blockCache)
   }));
-  if (diagnostics.length === 0) return;
-  throw new ConfigValidationError(source, diagnostics);
+  return {
+    ...fragment,
+    ...fragment.blocks ? { blocks: resolvedBlocks } : {},
+    ...fragment.collections ? { collections: resolvedCollections } : {},
+    ...fragment.globals ? { globals: resolvedGlobals } : {}
+  };
 }
 
 // src/utils/id.ts
@@ -3864,7 +4361,7 @@ var AUDIT_COLLECTION = {
       name: "operation",
       type: "select",
       label: "Operation",
-      options: ["create", "update", "delete"],
+      options: ["create", "update", "delete", "trash", "restore", "purge", "trash-empty"],
       required: true
     },
     { name: "user", type: "text", label: "User ID" },
@@ -3958,12 +4455,14 @@ function normalizeConfig(config) {
   assertValidDeclarativeAccessInConfig(schemaAwareConfig, "config");
   assertValidAdminConditionsInConfig(schemaAwareConfig, "config");
   assertValidPreviewUrlsInConfig(schemaAwareConfig, "config");
+  assertValidTrashInConfig(schemaAwareConfig, "config");
   const collections = schemaAwareConfig?.collections || [];
   const globals = schemaAwareConfig?.globals || [];
   const needsAudit = collections.some((col) => col.audit);
   const needsWorkflow = collections.some((col) => col.workflow || col.drafts);
   const needsTasks = (config.tasks?.length ?? 0) > 0;
   const needsAuthSessions = collections.some((col) => !!col.auth);
+  const needsTrash = schemaAwareConfig.trash?.enabled === true || collections.some((col) => resolveTrashConfig(col, schemaAwareConfig).enabled);
   const adminAuthCollectionSlug = getAdminAuthCollection({
     collections,
     adminAuth: schemaAwareConfig.adminAuth
@@ -4201,6 +4700,9 @@ function normalizeConfig(config) {
   if (needsAuthSessions && !normalizedCollections.some((col) => col.slug === AUTH_SESSIONS_COLLECTION)) {
     systemCollections.push(AUTH_SESSIONS_COLLECTION_CONFIG);
   }
+  if (needsTrash && !normalizedCollections.some((col) => col.slug === TRASH_COLLECTION)) {
+    systemCollections.push(TRASH_COLLECTION_CONFIG);
+  }
   return {
     ...schemaAwareConfig,
     collections: [...normalizedCollections, ...systemCollections],
@@ -4563,206 +5065,6 @@ function buildSqlOrderBy(sort, existingColumns, numericFields, dialect) {
   }).join(", ");
 }
 
-// src/utils/hooks.ts
-var import_jexl3 = __toESM(require_Jexl(), 1);
-async function runCollectionHooks(hooks, args, options = {}) {
-  if (!hooks || hooks.length === 0) {
-    return args.data ?? args.doc ?? args.query ?? void 0;
-  }
-  const payloadKey = args.data !== void 0 ? "data" : args.doc !== void 0 ? "doc" : "query" in args ? "query" : void 0;
-  let currentPayload = payloadKey === void 0 ? void 0 : args[payloadKey];
-  for (const hook of hooks) {
-    try {
-      const hookArgs = {
-        ...args,
-        ...payloadKey !== void 0 ? { [payloadKey]: currentPayload } : {}
-      };
-      const result = typeof hook === "string" ? await (() => {
-        if (options.surface) {
-          assertValidDeclarativeHookExpression(
-            hook,
-            options.surface,
-            options.path ?? options.surface
-          );
-        }
-        return import_jexl3.default.eval(hook, hookArgs);
-      })() : await hook(hookArgs);
-      if (result !== void 0) {
-        if (typeof hook === "string" && options.surface) {
-          assertValidDeclarativeHookResult(
-            result,
-            options.surface,
-            options.path ?? options.surface
-          );
-        }
-        currentPayload = typeof hook === "string" && currentPayload && typeof currentPayload === "object" && !Array.isArray(currentPayload) && result && typeof result === "object" && !Array.isArray(result) ? {
-          ...currentPayload,
-          ...result
-        } : result;
-      }
-    } catch (err) {
-      if (options.isolated) {
-        console.error("Side-effect hook failed after a successful write", err);
-      } else {
-        throw err;
-      }
-    }
-  }
-  return currentPayload;
-}
-async function executeFieldBeforeChange(fields, data, originalDoc, user, db, pathPrefix = "") {
-  if (!data || typeof data !== "object") return data;
-  const result = { ...data };
-  for (const field of fields) {
-    if (!field.name) continue;
-    const fieldPath = pathPrefix ? `${pathPrefix}.${field.name}` : field.name;
-    const value = result[field.name];
-    const origValue = originalDoc?.[field.name];
-    let updatedValue = value;
-    if (field.hooks?.beforeChange) {
-      for (const hook of field.hooks.beforeChange) {
-        const hookArgs = {
-          value: updatedValue,
-          originalDoc: originalDoc ?? void 0,
-          data: result,
-          user,
-          db
-        };
-        updatedValue = typeof hook === "string" ? await (() => {
-          assertValidDeclarativeHookExpression(
-            hook,
-            "field.beforeChange",
-            fieldPath
-          );
-          return import_jexl3.default.eval(hook, hookArgs);
-        })() : await hook(hookArgs);
-      }
-      result[field.name] = updatedValue;
-    }
-    if (updatedValue !== void 0 && updatedValue !== null) {
-      if (field.type === "object" && field.fields) {
-        result[field.name] = await executeFieldBeforeChange(
-          field.fields,
-          updatedValue,
-          origValue,
-          user,
-          db,
-          fieldPath
-        );
-      } else if (field.type === "array" && field.fields && Array.isArray(updatedValue)) {
-        const arrayResult = [];
-        for (let i = 0; i < updatedValue.length; i++) {
-          const item = updatedValue[i];
-          const origItem = Array.isArray(origValue) ? origValue[i] : null;
-          arrayResult.push(
-            await executeFieldBeforeChange(
-              field.fields,
-              item,
-              origItem,
-              user,
-              db,
-              fieldPath
-            )
-          );
-        }
-        result[field.name] = arrayResult;
-      } else if (field.type === "blocks" && field.blocks && Array.isArray(updatedValue)) {
-        const blocksResult = [];
-        for (let i = 0; i < updatedValue.length; i++) {
-          const blockData = updatedValue[i];
-          const origBlock = Array.isArray(origValue) ? origValue[i] : null;
-          const blockConfig = field.blocks.find(
-            (b) => b.slug === blockData.blockType
-          );
-          if (blockConfig) {
-            blocksResult.push(
-              await executeFieldBeforeChange(
-                blockConfig.fields,
-                blockData,
-                origBlock,
-                user,
-                db,
-                fieldPath
-              )
-            );
-          } else {
-            blocksResult.push(blockData);
-          }
-        }
-        result[field.name] = blocksResult;
-      }
-    }
-  }
-  return result;
-}
-async function executeFieldAfterRead(fields, doc, user, db) {
-  if (!doc || typeof doc !== "object") return doc;
-  const result = { ...doc };
-  for (const field of fields) {
-    if (!field.name) continue;
-    const value = result[field.name];
-    let updatedValue = value;
-    if (field.hooks?.afterRead) {
-      for (const hook of field.hooks.afterRead) {
-        const typedHook = hook;
-        const hookArgs = {
-          value: updatedValue,
-          doc: result,
-          user,
-          db
-        };
-        updatedValue = await typedHook(hookArgs);
-      }
-      result[field.name] = updatedValue;
-    }
-    if (updatedValue !== void 0 && updatedValue !== null) {
-      if (field.type === "object" && field.fields) {
-        result[field.name] = await executeFieldAfterRead(
-          field.fields,
-          updatedValue,
-          user,
-          db
-        );
-      } else if (field.type === "array" && field.fields && Array.isArray(updatedValue)) {
-        const arrayResult = [];
-        for (const item of updatedValue) {
-          arrayResult.push(
-            await executeFieldAfterRead(
-              field.fields,
-              item,
-              user,
-              db
-            )
-          );
-        }
-        result[field.name] = arrayResult;
-      } else if (field.type === "blocks" && field.blocks && Array.isArray(updatedValue)) {
-        const blocksResult = [];
-        for (const blockData of updatedValue) {
-          const typedBlock = blockData;
-          const blockConfig = field.blocks.find(
-            (b) => b.slug === typedBlock.blockType
-          );
-          if (blockConfig) {
-            blocksResult.push(
-              await executeFieldAfterRead(
-                blockConfig.fields,
-                typedBlock,
-                user,
-                db
-              )
-            );
-          } else {
-            blocksResult.push(blockData);
-          }
-        }
-        result[field.name] = blocksResult;
-      }
-    }
-  }
-  return result;
-}
-
 // src/utils/openapi.ts
 function getCollectionLabels(collection) {
   return collection.labels || { singular: collection.slug, plural: collection.slug };
@@ -7186,10 +7488,12 @@ var RESERVED_NAVIGATION_SLUGS = /* @__PURE__ */ new Set([
   "settings",
   "admin",
   "preferences",
-  "auth"
+  "auth",
+  "trash"
 ]);
 function assertValidNavigationSlugs(navigation) {
   for (const item of navigation) {
+    if (item.dashboard || item.trash) continue;
     if (item.slug) {
       const normalizedSlug = item.slug.toLowerCase().trim().replace(/^\//, "");
       if (RESERVED_NAVIGATION_SLUGS.has(normalizedSlug)) {
@@ -7269,6 +7573,21 @@ function compileNavigation(config) {
       });
       continue;
     }
+    if (item.trash) {
+      registerItem(groupName, {
+        id: "trash",
+        type: "trash",
+        slug: "trash",
+        label: item.label || "Trash",
+        icon: item.icon || "Trash2",
+        group: groupName,
+        order: item.order ?? 950,
+        views: [],
+        badge: item.badge,
+        access: item.access
+      });
+      continue;
+    }
     if (item.collection) {
       const col = collectionsBySlug.get(item.collection);
       const combinedViews = [
@@ -7378,6 +7697,23 @@ function compileNavigation(config) {
       views: []
     });
   }
+  const mentionedTrash = explicitNav.some((i) => i.trash || i.slug === "trash");
+  if (!mentionedTrash) {
+    const hasTrash = collections.some(
+      (col) => !col.slug.startsWith("__") && resolveTrashConfig(col, config).enabled
+    );
+    if (hasTrash) {
+      registerItem(void 0, {
+        id: "trash",
+        type: "trash",
+        slug: "trash",
+        label: "Trash",
+        icon: "Trash2",
+        order: 950,
+        views: []
+      });
+    }
+  }
   const sortAndSpliceItems = (items) => {
     const sorted = [...items].sort((a, b) => a.order - b.order);
     const explicitMap = /* @__PURE__ */ new Map();
@@ -7545,6 +7881,133 @@ function defineImageField(config) {
 function defineJoinField(config) {
   return _defineJoinFieldBase(config);
 }
+function defineCreatedAtField(config) {
+  const type = config?.type ?? "datetime";
+  const name = config?.name ?? "createdAt";
+  return {
+    name,
+    label: "Created At",
+    ...config,
+    type,
+    admin: {
+      readOnly: true,
+      ...config?.admin
+    }
+  };
+}
+function defineUpdatedAtField(config) {
+  const type = config?.type ?? "datetime";
+  const name = config?.name ?? "updatedAt";
+  return {
+    name,
+    label: "Updated At",
+    ...config,
+    type,
+    admin: {
+      readOnly: true,
+      ...config?.admin
+    }
+  };
+}
+function defineCreatedByField(config) {
+  const name = config?.name ?? "createdBy";
+  if (config?.type === "text") {
+    const { type: _2, ...rest2 } = config;
+    return {
+      name,
+      label: "Created By",
+      ...rest2,
+      type: "text",
+      admin: {
+        readOnly: true,
+        ...rest2?.admin
+      }
+    };
+  }
+  const { type: _, relationTo = "users", ...rest } = config || {};
+  return {
+    name,
+    label: "Created By",
+    ...rest,
+    type: "relationship",
+    relationTo,
+    admin: {
+      readOnly: true,
+      ...rest?.admin
+    },
+    access: {
+      update: () => false,
+      ...rest?.access
+    }
+  };
+}
+function defineUpdatedByField(config) {
+  const name = config?.name ?? "updatedBy";
+  if (config?.type === "text") {
+    const { type: _2, ...rest2 } = config;
+    return {
+      name,
+      label: "Updated By",
+      ...rest2,
+      type: "text",
+      admin: {
+        readOnly: true,
+        ...rest2?.admin
+      }
+    };
+  }
+  const { type: _, relationTo = "users", ...rest } = config || {};
+  return {
+    name,
+    label: "Updated By",
+    ...rest,
+    type: "relationship",
+    relationTo,
+    admin: {
+      readOnly: true,
+      ...rest?.admin
+    },
+    access: {
+      update: () => false,
+      ...rest?.access
+    }
+  };
+}
+var DEFAULT_ROLES = [
+  { value: "admin", label: "Admin" },
+  { value: "editor", label: "Editor" },
+  { value: "viewer", label: "Viewer" }
+];
+function defineRolesField(config) {
+  const isMultiple = Boolean(config?.multiple || config?.hasMany || config?.type === "multiSelect");
+  const type = isMultiple ? "multiSelect" : "select";
+  const name = config?.name ?? "roles";
+  const label = config?.label ?? (name === "role" ? "Role" : "Roles");
+  const rawRoles = config?.roles ?? config?.options ?? DEFAULT_ROLES;
+  const resolvedOptions = Array.isArray(rawRoles) ? rawRoles.map(
+    (r) => typeof r === "string" ? { value: r, label: r.charAt(0).toUpperCase() + r.slice(1).replace(/[-_]/g, " ") } : r
+  ) : rawRoles;
+  const lastOption = Array.isArray(resolvedOptions) && resolvedOptions.length > 0 ? resolvedOptions[resolvedOptions.length - 1] : void 0;
+  const defaultRoleValue = lastOption ? typeof lastOption === "string" ? lastOption : lastOption.value : "viewer";
+  const defaultValue2 = config?.defaultValue !== void 0 ? config.defaultValue : isMultiple ? [defaultRoleValue] : defaultRoleValue;
+  const adminRoles = Array.isArray(config?.adminRole) ? config.adminRole : typeof config?.adminRole === "string" ? [config.adminRole] : ["admin"];
+  const defaultUpdateAccess = adminRoles.map((r) => `user.role == '${r}' || (user.roles != null && '${r}' in user.roles)`).join(" || ");
+  const { multiple: _, roles: __, adminRole: ___, ...rest } = config || {};
+  return {
+    name,
+    label,
+    defaultValue: defaultValue2,
+    options: resolvedOptions,
+    access: {
+      update: defaultUpdateAccess,
+      ...rest.access
+    },
+    ...rest,
+    type,
+    ...isMultiple ? { hasMany: true } : {}
+  };
+}
+var defineRoles = defineRolesField;
 function defineTab(args) {
   return args.fields.map((field) => ({
     ...field,
@@ -7579,6 +8042,8 @@ export {
   RESERVED_NAVIGATION_SLUGS,
   TASK_LOCKS_COLLECTION,
   TASK_LOCKS_COLLECTION_CONFIG,
+  TRASH_COLLECTION,
+  TRASH_COLLECTION_CONFIG,
   UNASSIGNED_GROUP_KEY,
   ValidationError,
   WORKFLOW_HISTORY_COLLECTION,
@@ -7592,6 +8057,7 @@ export {
   assertValidDeclarativeHooksInConfig,
   assertValidNavigationSlugs,
   assertValidPreviewUrlsInConfig,
+  assertValidTrashInConfig,
   availableWorkflowTransitions,
   buildSqlOrderBy,
   canViewWorkflowDraft,
@@ -7610,6 +8076,7 @@ export {
   count,
   createLifecycleEvent,
   createTaskRunner,
+  createTrashPurgeTask,
   createWorkflowDocument,
   defaultValue,
   defineAction,
@@ -7621,6 +8088,8 @@ export {
   defineCardsView,
   defineCollection,
   defineConfig,
+  defineCreatedAtField,
+  defineCreatedByField,
   defineDateField,
   defineDateTimeField,
   defineEmailField,
@@ -7640,6 +8109,8 @@ export {
   defineRadioField,
   defineRelationshipField,
   defineRichTextField,
+  defineRoles,
+  defineRolesField,
   defineRowField,
   defineSelectField,
   defineTab,
@@ -7648,6 +8119,8 @@ export {
   defineTextField,
   defineTextareaField,
   defineTimeField,
+  defineUpdatedAtField,
+  defineUpdatedByField,
   defineUrlField,
   defineView,
   defineWorkspace,
@@ -7687,6 +8160,7 @@ export {
   getAdminRoleForCollection,
   getAllowedSitesForUser,
   getPublicAdminAuthConfig,
+  getTrashEntryId,
   includes,
   initializeWorkflowDocument,
   isAICollection,
@@ -7730,14 +8204,18 @@ export {
   resolveAdminAuthCollection,
   resolveAllCollectionViews,
   resolveAuthorizedSiteId,
+  resolveDocumentTitle,
   resolveIndexName,
   resolvePrefix,
+  resolveTrashConfig,
+  restoreDocument,
   round,
   runCollectionHooks,
   sanitizeDocForAI,
   saveWorkflowDraft,
   simplePublishingWorkflow,
   slugify,
+  softDeleteDocument,
   sqrt,
   startsWith,
   sum,