@dyrected/core 2.19.0 → 2.20.0

package/dist/index.cjs

@@ -1799,8 +1799,11 @@ __export(index_exports, {
   DuplicateKeyError: () => DuplicateKeyError,
   DyrectedAIError: () => DyrectedAIError,
   DyrectedError: () => DyrectedError,
+  EMAIL_TEMPLATES_COLLECTION_CONFIG: () => EMAIL_TEMPLATES_COLLECTION_CONFIG,
+  EMAIL_TEMPLATES_COLLECTION_SLUG: () => EMAIL_TEMPLATES_COLLECTION_SLUG,
   FieldConditionBuilder: () => FieldConditionBuilder,
   ForbiddenError: () => ForbiddenError,
+  INTERNAL_SYSTEM_COLLECTIONS: () => INTERNAL_SYSTEM_COLLECTIONS,
   LIFECYCLE_EVENTS_COLLECTION: () => LIFECYCLE_EVENTS_COLLECTION,
   LIFECYCLE_EVENT_NAMES: () => LIFECYCLE_EVENT_NAMES,
   MatchBuilder: () => MatchBuilder,
@@ -1818,6 +1821,7 @@ __export(index_exports, {
   WORKFLOW_HISTORY_COLLECTION: () => WORKFLOW_HISTORY_COLLECTION,
   abs: () => abs,
   addDays: () => addDays,
+  alertBox: () => alertBox,
   asCollection: () => asCollection,
   assertValidAdminConditionsInConfig: () => assertValidAdminConditionsInConfig,
   assertValidDeclarativeAccessInConfig: () => assertValidDeclarativeAccessInConfig,
@@ -1847,6 +1851,7 @@ __export(index_exports, {
   createTaskRunner: () => createTaskRunner,
   createTrashPurgeTask: () => createTrashPurgeTask,
   createWorkflowDocument: () => createWorkflowDocument,
+  ctaButton: () => ctaButton,
   defaultValue: () => defaultValue,
   defineAction: () => defineAction,
   defineArrayField: () => defineArrayField,
@@ -1893,6 +1898,7 @@ __export(index_exports, {
   defineUrlField: () => defineUrlField,
   defineView: () => defineView,
   defineWorkspace: () => defineWorkspace,
+  detailBox: () => detailBox,
   diffDays: () => diffDays,
   dispatchLifecycleEvent: () => dispatchLifecycleEvent,
   dispatchPendingLifecycleEvents: () => dispatchPendingLifecycleEvents,
@@ -1908,10 +1914,14 @@ __export(index_exports, {
   displayTab: () => displayTab,
   displayTabs: () => displayTabs,
   displayText: () => displayText,
+  divider: () => divider,
+  emailTokens: () => emailTokens,
   endsWith: () => endsWith,
+  escapeHtml: () => escapeHtml,
   evaluateDetailComputed: () => evaluateDetailComputed,
   evaluateJexl: () => evaluateJexl,
   evaluateJexlSync: () => evaluateJexlSync,
+  eventList: () => eventList,
   executeFieldAfterRead: () => executeFieldAfterRead,
   executeFieldBeforeChange: () => executeFieldBeforeChange,
   expr: () => expr,
@@ -1928,8 +1938,10 @@ __export(index_exports, {
   getAdminAuthCollection: () => getAdminAuthCollection,
   getAdminRoleForCollection: () => getAdminRoleForCollection,
   getAllowedSitesForUser: () => getAllowedSitesForUser,
+  getDefaultEmailTemplate: () => getDefaultEmailTemplate,
   getPublicAdminAuthConfig: () => getPublicAdminAuthConfig,
   getTrashEntryId: () => getTrashEntryId,
+  heading: () => heading,
   includes: () => includes,
   initializeWorkflowDocument: () => initializeWorkflowDocument,
   isAICollection: () => isAICollection,
@@ -1942,6 +1954,7 @@ __export(index_exports, {
   isUserAdmin: () => isUserAdmin,
   join: () => join,
   last: () => last,
+  layout: () => layout,
   length: () => length,
   lower: () => lower,
   maskEmail: () => maskEmail,
@@ -1957,6 +1970,7 @@ __export(index_exports, {
   normalizeGroupKey: () => normalizeGroupKey,
   now: () => now,
   numericFieldNames: () => numericFieldNames,
+  paragraph: () => paragraph,
   parseCron: () => parseCron,
   parseMongoWhere: () => parseMongoWhere,
   parseSort: () => parseSort,
@@ -1973,21 +1987,27 @@ __export(index_exports, {
   resolveAdminAuthCollection: () => resolveAdminAuthCollection,
   resolveAllCollectionViews: () => resolveAllCollectionViews,
   resolveAuthorizedSiteId: () => resolveAuthorizedSiteId,
+  resolveBlocks: () => resolveBlocks,
   resolveDocumentTitle: () => resolveDocumentTitle,
   resolveIndexName: () => resolveIndexName,
   resolvePrefix: () => resolvePrefix,
   resolveTrashConfig: () => resolveTrashConfig,
   restoreDocument: () => restoreDocument,
   round: () => round,
+  row: () => row,
   runCollectionHooks: () => runCollectionHooks,
+  safeLinkDetailBox: () => safeLinkDetailBox,
   sanitizeDocForAI: () => sanitizeDocForAI,
   saveWorkflowDraft: () => saveWorkflowDraft,
+  sectionLabel: () => sectionLabel,
   simplePublishingWorkflow: () => simplePublishingWorkflow,
   slugify: () => slugify,
   softDeleteDocument: () => softDeleteDocument,
+  spacer: () => spacer,
   sqrt: () => sqrt,
   startsWith: () => startsWith,
   sum: () => sum,
+  table: () => table,
   today: () => today,
   transitionWorkflow: () => transitionWorkflow,
   trim: () => trim,
@@ -3243,6 +3263,14 @@ async function executeFieldAfterRead(fields, doc, user, db) {
 
 // src/trash.ts
 var TRASH_COLLECTION = "__trash";
+var INTERNAL_SYSTEM_COLLECTIONS = /* @__PURE__ */ new Set([
+  "__audit",
+  "__sessions",
+  "__task_locks",
+  "__trash",
+  "__workflow_history",
+  "__lifecycle_events"
+]);
 var TRASH_COLLECTION_CONFIG = {
   slug: TRASH_COLLECTION,
   labels: { singular: "Trash entry", plural: "Trash entries" },
@@ -3334,7 +3362,7 @@ function assertValidTrashInConfig(config, source = "config") {
     if (col.slug === "trash") {
       throw new Error(`Collection slug "trash" is reserved by Dyrected for the trash system.`);
     }
-    const isSystem = col.slug.startsWith("__");
+    const isSystem = INTERNAL_SYSTEM_COLLECTIONS.has(col.slug);
     if (isSystem && col.trash) {
       throw new Error(`System collection "${col.slug}" cannot enable trash.`);
     }
@@ -3713,7 +3741,7 @@ function createTaskRunner(config) {
       throw error;
     }
   }
-  async function execute(task, row, scheduledFor) {
+  async function execute(task, row2, scheduledFor) {
     const started = Date.now();
     const lockMs = (task.lockTimeout ?? DEFAULT_LOCK_TIMEOUT_SECONDS) * 1e3;
     const token = `${instanceId}:${started}`;
@@ -3721,7 +3749,7 @@ function createTaskRunner(config) {
       id: { equals: task.name },
       lockedUntil: { less_than: started }
     };
-    if (scheduledFor) where.lastScheduledFor = { equals: row.lastScheduledFor };
+    if (scheduledFor) where.lastScheduledFor = { equals: row2.lastScheduledFor };
     const claimed = await db.update({
       collection: TASK_LOCKS_COLLECTION,
       where,
@@ -3782,21 +3810,21 @@ function createTaskRunner(config) {
     async runTask(name) {
       const task = tasks.get(name);
       if (!task) throw new Error(`Unknown task "${name}".`);
-      const row = await ensureLockRow(name, /* @__PURE__ */ new Date());
-      return track(execute(task, row, void 0));
+      const row2 = await ensureLockRow(name, /* @__PURE__ */ new Date());
+      return track(execute(task, row2, void 0));
     },
     async runDue(now2 = /* @__PURE__ */ new Date()) {
       const results = [];
       for (const task of tasks.values()) {
         if (!task.schedule) continue;
-        const row = await ensureLockRow(task.name, now2);
-        const reference = new Date(String(row.lastScheduledFor));
+        const row2 = await ensureLockRow(task.name, now2);
+        const reference = new Date(String(row2.lastScheduledFor));
         const due = Number.isNaN(reference.getTime()) ? true : nextCronRun(task.schedule, reference).getTime() <= now2.getTime();
         if (!due) {
           results.push({ name: task.name, status: "skipped", reason: "not-due", durationMs: 0 });
           continue;
         }
-        results.push(await track(execute(task, row, floorToMinute(now2))));
+        results.push(await track(execute(task, row2, floorToMinute(now2))));
       }
       return results;
     },
@@ -4311,13 +4339,34 @@ function getAdminRoleForCollection(collection) {
   }
   return "admin";
 }
+var STANDARD_ADMIN_ROLES = /* @__PURE__ */ new Set([
+  "admin",
+  "super_admin",
+  "superadmin",
+  "super admin",
+  "super-admin",
+  "owner"
+]);
 function isUserAdmin(user, collection) {
   if (!user) return false;
-  const roles = Array.isArray(user.roles) ? user.roles : typeof user.role === "string" ? [user.role] : [];
-  if (roles.length === 0) return false;
+  const rawRoles = Array.isArray(user.roles) ? user.roles : typeof user.roles === "string" ? [user.roles] : Array.isArray(user.role) ? user.role : typeof user.role === "string" ? [user.role] : [];
+  if (rawRoles.length === 0) return false;
+  const roles = rawRoles.filter((r) => typeof r === "string");
   const configuredRole = getAdminRoleForCollection(collection);
-  if (roles.includes(configuredRole)) return true;
-  return roles.includes("admin") || roles.includes("super_admin");
+  for (const r of roles) {
+    if (r === configuredRole || r.toLowerCase() === configuredRole.toLowerCase()) {
+      return true;
+    }
+    const normalized = r.trim().toLowerCase();
+    if (STANDARD_ADMIN_ROLES.has(normalized)) {
+      return true;
+    }
+    const stripped = normalized.replace(/[\s_-]+/g, "");
+    if (stripped === "admin" || stripped === "superadmin" || stripped === "owner") {
+      return true;
+    }
+  }
+  return false;
 }
 
 // src/utils/block-references.ts
@@ -4540,6 +4589,245 @@ function generateDocumentId(collectionOrSlug) {
   return generateId({ prefix, type });
 }
 
+// src/services/email-template.ts
+var emailTokens = {
+  colors: {
+    canvas: "#f6f7f2",
+    surface: "#ffffff",
+    text: "#171717",
+    muted: "#62665b",
+    subtle: "#8a8f82",
+    border: "#dde0d7",
+    accent: "#b6ff2e",
+    code: "#f1f3ec",
+    codeBorder: "#e2e5dc",
+    dangerSurface: "#fff2f0",
+    dangerBorder: "#ffc9c2",
+    dangerText: "#9f251b"
+  },
+  font: "Arial, 'Helvetica Neue', Helvetica, sans-serif",
+  mono: "'Courier New', Courier, monospace",
+  radius: { card: "12px", control: "6px" },
+  width: "600px"
+};
+function escapeHtml(value) {
+  return value.replace(
+    /[&<>'"]/g,
+    (character) => ({
+      "&": "&amp;",
+      "<": "&lt;",
+      ">": "&gt;",
+      "'": "&#39;",
+      '"': "&quot;"
+    })[character]
+  );
+}
+function safeHttpUrl(value) {
+  if (value.startsWith("{{") && value.endsWith("}}")) {
+    return value;
+  }
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" || url.protocol === "http:" ? escapeHtml(url.toString()) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function heading(content) {
+  return `<h1 style="margin:0;font-family:${emailTokens.font};font-size:24px;line-height:1.25;font-weight:700;color:${emailTokens.colors.text}">${escapeHtml(content)}</h1>`;
+}
+function paragraph(content, margin = "0 0 16px", size = "15px") {
+  return `<p style="margin:${margin};font-family:${emailTokens.font};font-size:${size};line-height:1.6;color:${emailTokens.colors.muted}">${escapeHtml(content)}</p>`;
+}
+function sectionLabel(content) {
+  return `<p style="margin:0 0 8px;font-family:${emailTokens.font};font-size:11px;line-height:1.4;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:${emailTokens.colors.subtle}">${escapeHtml(content)}</p>`;
+}
+function divider() {
+  return `<table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%"><tr><td style="height:1px;background:${emailTokens.colors.border};font-size:0;line-height:0">&nbsp;</td></tr></table>`;
+}
+function spacer(height = 16) {
+  return table(row("&nbsp;", `height:${height}px;font-size:0;line-height:0`));
+}
+function row(content, cellStyle = "") {
+  return `<tr><td style="${cellStyle}">${content}</td></tr>`;
+}
+function table(content, style = "width:100%") {
+  return `<table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%" style="${style}">${content}</table>`;
+}
+function detailBox(content, monospace = false) {
+  const font = monospace ? emailTokens.mono : emailTokens.font;
+  return table(
+    row(
+      escapeHtml(content),
+      `padding:14px 16px;font-family:${font};font-size:13px;line-height:1.5;font-weight:${monospace ? "400" : "700"};color:${emailTokens.colors.text};word-break:break-all`
+    ),
+    `width:100%;background:${emailTokens.colors.code};border:1px solid ${emailTokens.colors.codeBorder};border-radius:${emailTokens.radius.control}`
+  );
+}
+function eventList(events) {
+  return table(
+    events.map(
+      ({ label, value }) => row(
+        `${sectionLabel(label)}${paragraph(value, "0")}`,
+        `padding:12px 0;border-bottom:1px solid ${emailTokens.colors.border}`
+      )
+    ).join("")
+  );
+}
+function ctaButton(label, href) {
+  const safeHref = safeHttpUrl(href);
+  if (!safeHref) return "";
+  return table(
+    row(
+      `<a href="${safeHref}" style="display:inline-block;padding:13px 22px;border-radius:${emailTokens.radius.control};background:${emailTokens.colors.accent};font-family:${emailTokens.font};font-size:14px;line-height:1.2;font-weight:700;color:${emailTokens.colors.text};text-decoration:none">${escapeHtml(label)}</a>`,
+      "padding:8px 0 24px"
+    ),
+    "width:auto"
+  );
+}
+function safeLinkDetailBox(href) {
+  const safeHref = safeHttpUrl(href);
+  if (!safeHref) return "";
+  return detailBox(safeHref, true);
+}
+function alertBox(content) {
+  return table(
+    row(
+      escapeHtml(content),
+      `padding:13px 16px;font-family:${emailTokens.font};font-size:13px;line-height:1.5;color:${emailTokens.colors.dangerText}`
+    ),
+    `width:100%;background:${emailTokens.colors.dangerSurface};border:1px solid ${emailTokens.colors.dangerBorder};border-radius:${emailTokens.radius.control}`
+  );
+}
+function resolveBlocks(input) {
+  if (Array.isArray(input)) {
+    const parts = [];
+    for (const item of input) {
+      if (Array.isArray(item)) {
+        for (const sub of item) {
+          if (typeof sub === "string" && sub.length > 0) parts.push(sub);
+        }
+      } else if (typeof item === "string" && item.length > 0) {
+        parts.push(item);
+      }
+    }
+    return parts.join("\n");
+  }
+  return typeof input === "string" ? input : "";
+}
+function layout({ preheader, title, content, footer, siteName }) {
+  const resolvedContent = resolveBlocks(content);
+  const resolvedFooter = resolveBlocks(footer);
+  return `<!doctype html>
+<html lang="en" dir="ltr" xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta http-equiv="X-UA-Compatible" content="IE=edge">
+    <meta name="x-apple-disable-message-reformatting">
+    <meta name="format-detection" content="telephone=no,address=no,email=no,date=no,url=no">
+    <meta name="color-scheme" content="light">
+    <meta name="supported-color-schemes" content="light">
+    <title>${escapeHtml(title)}</title>
+  </head>
+  <body style="margin:0;padding:0;background-color:${emailTokens.colors.canvas};word-spacing:normal;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%">
+    <div style="display:none;max-height:0;max-width:0;overflow:hidden;opacity:0;mso-hide:all;color:transparent;font-size:1px;line-height:1px">
+      ${escapeHtml(preheader)}&#8203;&#847;&zwnj;&nbsp;&#8199;&#8199;&#847;&zwnj;&nbsp;
+    </div>
+    <center lang="en" style="width:100%;background-color:${emailTokens.colors.canvas}">
+      ${table(
+    row(
+      table(
+        row("&nbsp;", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${sectionLabel(siteName ?? "Dyrected")}${heading(title)}`, "padding:30px 32px 24px") + row(resolvedContent, "padding:0 32px 32px") + row(
+          `${divider()}${paragraph(resolvedFooter, "20px 0 6px")}${paragraph("Privacy: this message contains account-related information; please avoid forwarding it.", "10px 0px 0px 0px", "12px")}`,
+          "padding:0 32px 28px"
+        ),
+        `width:100%;max-width:${emailTokens.width};background:${emailTokens.colors.surface};border:1px solid ${emailTokens.colors.border};border-radius:${emailTokens.radius.card};overflow:hidden`
+      ),
+      "padding:32px 12px"
+    ),
+    `width:100%;background:${emailTokens.colors.canvas}`
+  )}
+    </center>
+  </body>
+</html>`;
+}
+function getDefaultEmailTemplate(purpose, options) {
+  const siteName = options?.siteName ?? "Dyrected";
+  switch (purpose) {
+    case "invite":
+      return {
+        subject: `You've been invited to ${siteName}`,
+        rawHtml: layout({
+          siteName,
+          preheader: `You've been invited to join ${siteName}.`,
+          title: "You've been invited",
+          content: [
+            paragraph("Use the invitation link below to create your account. The link expires in 7 days."),
+            ctaButton("Accept invitation", "{{url}}"),
+            sectionLabel("Invitation link"),
+            safeLinkDetailBox("{{url}}"),
+            paragraph("If the button does not work, copy and paste the link above into your browser.", "12px 0 0")
+          ],
+          footer: "If you weren't expecting this invitation, you can safely ignore this email."
+        })
+      };
+    case "resetPassword":
+      return {
+        subject: "Reset your password",
+        rawHtml: layout({
+          siteName,
+          preheader: `Reset your ${siteName} password.`,
+          title: "Reset your password",
+          content: [
+            paragraph("We received a request to reset your password. The reset link expires in 1 hour."),
+            ctaButton("Reset password", "{{url}}"),
+            sectionLabel("Reset link"),
+            safeLinkDetailBox("{{url}}"),
+            paragraph("If the button does not work, copy and paste the link above into your browser.", "12px 0 0")
+          ],
+          footer: "If you didn't request a password reset, you can safely ignore this email."
+        })
+      };
+    case "welcome":
+      return {
+        subject: `Welcome to ${siteName} \u2014 your account is ready`,
+        rawHtml: layout({
+          siteName,
+          preheader: `Your ${siteName} account is ready.`,
+          title: "Welcome \u2014 your account is ready",
+          content: [paragraph("Your account has been created. You can now log in with:"), detailBox("{{email}}")],
+          footer: "If you didn't create this account, you can safely ignore this email."
+        })
+      };
+    case "passwordChanged":
+      return {
+        subject: "Your password has been changed",
+        rawHtml: layout({
+          siteName,
+          preheader: `Your ${siteName} password was changed.`,
+          title: "Password changed",
+          content: [
+            paragraph("The password for your account has been changed."),
+            alertBox("If you did not make this change, please contact support or reset your password immediately.")
+          ],
+          footer: "Security notice: this confirms a recent credential change."
+        })
+      };
+    default:
+      return {
+        subject: `Notification from ${siteName}`,
+        rawHtml: layout({
+          siteName,
+          preheader: `Account notification from ${siteName}.`,
+          title: "Account Notification",
+          content: [paragraph(`This is an account notification from ${siteName}.`)],
+          footer: "If you have any questions, please reach out to our team."
+        })
+      };
+  }
+}
+
 // src/utils/config.ts
 var AUDIT_COLLECTION_SLUG = "__audit";
 var SYSTEM_FIELDS = [
@@ -4681,6 +4969,114 @@ var AUTH_SESSIONS_COLLECTION_CONFIG = {
   },
   admin: { hidden: true }
 };
+var EMAIL_TEMPLATES_COLLECTION_SLUG = "__email_templates";
+var EMAIL_TEMPLATES_COLLECTION_CONFIG = {
+  slug: EMAIL_TEMPLATES_COLLECTION_SLUG,
+  labels: { singular: "Email Template", plural: "Email Templates" },
+  detail: false,
+  fields: [
+    {
+      name: "collectionSlug",
+      type: "select",
+      label: "Applies To",
+      required: true,
+      defaultValue: "*",
+      options: [
+        { label: "Global (All Users & Collections)", value: "*" }
+      ],
+      admin: {
+        description: "Choose which user collection this template applies to, or 'Global' for all users."
+      }
+    },
+    {
+      name: "purpose",
+      type: "select",
+      label: "Purpose",
+      required: true,
+      options: [
+        { label: "Invite", value: "invite" },
+        { label: "Password Reset", value: "resetPassword" },
+        { label: "Welcome", value: "welcome" },
+        { label: "Password Changed", value: "passwordChanged" }
+      ],
+      admin: { width: "50%" }
+    },
+    {
+      name: "format",
+      type: "select",
+      label: "Format",
+      required: true,
+      defaultValue: "html",
+      options: [
+        { label: "HTML", value: "html" },
+        { label: "External Template", value: "external_template" }
+      ],
+      admin: { width: "50%" }
+    },
+    {
+      name: "subject",
+      type: "text",
+      label: "Subject",
+      admin: {
+        description: "Subject line (optional when using external provider template)"
+      }
+    },
+    {
+      name: "rawHtml",
+      type: "textarea",
+      label: "HTML Content",
+      admin: {
+        description: "Raw HTML email content with {{variable}} tags"
+      }
+    },
+    {
+      name: "externalTemplateId",
+      type: "text",
+      label: "External Template ID",
+      admin: {
+        description: "Template ID or alias from Seamailer, Postmark, SendGrid, etc."
+      }
+    },
+    {
+      name: "active",
+      type: "boolean",
+      label: "Active",
+      defaultValue: true,
+      admin: {
+        description: "When active, this template overrides code config. When disabled, falls back to code."
+      }
+    }
+  ],
+  admin: {
+    group: "Settings",
+    icon: "Mail",
+    groupBy: "collectionSlug",
+    defaultColumns: ["purpose", "collectionSlug", "format", "active"]
+  },
+  hooks: {
+    beforeChange: [
+      async ({ data, req }) => {
+        if (data && data.format === "html") {
+          const siteName = req?.config?.admin?.branding?.logoText || "Dyrected";
+          const defaults = getDefaultEmailTemplate(data.purpose || "invite", { siteName });
+          if (!data.subject) {
+            data.subject = defaults.subject;
+          }
+          if (!data.rawHtml) {
+            data.rawHtml = defaults.rawHtml;
+          }
+        }
+        return data;
+      }
+    ]
+  },
+  access: {
+    read: ({ user }) => isUserAdmin(user),
+    create: ({ user }) => isUserAdmin(user),
+    update: ({ user }) => isUserAdmin(user),
+    delete: ({ user }) => isUserAdmin(user)
+  }
+};
 function normalizeConfig(config) {
   const schemaAwareConfig = normalizeSchemaFragment(config);
   assertValidDeclarativeHooksInConfig(schemaAwareConfig, "config");
@@ -4695,10 +5091,13 @@ function normalizeConfig(config) {
   const needsTasks = (config.tasks?.length ?? 0) > 0;
   const needsAuthSessions = collections.some((col) => !!col.auth);
   const needsTrash = schemaAwareConfig.trash?.enabled === true || collections.some((col) => resolveTrashConfig(col, schemaAwareConfig).enabled);
-  const adminAuthCollectionSlug = getAdminAuthCollection({
+  const adminAuthCollection = getAdminAuthCollection({
     collections,
     adminAuth: schemaAwareConfig.adminAuth
-  })?.slug;
+  });
+  const adminAuthCollectionSlug = adminAuthCollection?.slug;
+  const adminOnly = ({ user }) => isUserAdmin(user, adminAuthCollection);
+  const adminOtherThanSelf = ({ user, id }) => isUserAdmin(user, adminAuthCollection) && user?.id !== id;
   const normalizedCollections = collections.map((col) => {
     let fields = col.fields || [];
     const existingFieldNames = new Set(fields.map((f) => f.name));
@@ -4747,7 +5146,7 @@ function normalizeConfig(config) {
               { value: "viewer", label: "Viewer" }
             ],
             access: {
-              update: "user.role == 'admin' || (user.roles != null && 'admin' in user.roles)"
+              update: adminOnly
             }
           }
         ];
@@ -4765,7 +5164,7 @@ function normalizeConfig(config) {
               { value: "pending", label: "Pending" }
             ],
             access: {
-              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
+              update: adminOtherThanSelf
             },
             admin: {
               condition: `!(data.roles && "admin" in data.roles) && data.role != "admin"`
@@ -4834,7 +5233,7 @@ function normalizeConfig(config) {
             access: {
               ...field.access || {},
               // Must be an admin; cannot edit own roles (no self-elevation).
-              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
+              update: adminOtherThanSelf
             }
           };
         }
@@ -4843,7 +5242,7 @@ function normalizeConfig(config) {
             ...field,
             access: {
               ...field.access || {},
-              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
+              update: adminOtherThanSelf
             }
           };
         }
@@ -4935,6 +5334,52 @@ function normalizeConfig(config) {
   if (needsTrash && !normalizedCollections.some((col) => col.slug === TRASH_COLLECTION)) {
     systemCollections.push(TRASH_COLLECTION_CONFIG);
   }
+  const needsEmailTemplates = schemaAwareConfig.email?.adminEditable === true;
+  if (needsEmailTemplates && !normalizedCollections.some((col) => col.slug === EMAIL_TEMPLATES_COLLECTION_SLUG)) {
+    const adminCol = getAdminAuthCollection(schemaAwareConfig);
+    const customAccess = schemaAwareConfig.email?.access;
+    const resolveOpAccess = (op) => {
+      if (typeof customAccess === "function") return customAccess;
+      if (customAccess && typeof customAccess === "object" && customAccess[op]) return customAccess[op];
+      return ({ user }) => isUserAdmin(user, adminCol);
+    };
+    const customPurposes = schemaAwareConfig.email?.purposes ?? [];
+    const purposeOptions = [
+      { label: "Invite", value: "invite" },
+      { label: "Password Reset", value: "resetPassword" },
+      { label: "Welcome", value: "welcome" },
+      { label: "Password Changed", value: "passwordChanged" },
+      ...customPurposes
+    ];
+    const targetableCollections = normalizedCollections.filter(
+      (c) => !c.slug.startsWith("__")
+    );
+    const audienceOptions = [
+      { label: "Global (All Collections)", value: "*" },
+      ...targetableCollections.map((c) => ({
+        label: `${c.labels?.singular || c.labels?.plural || c.slug} (${c.slug})`,
+        value: c.slug
+      }))
+    ];
+    systemCollections.push({
+      ...EMAIL_TEMPLATES_COLLECTION_CONFIG,
+      fields: EMAIL_TEMPLATES_COLLECTION_CONFIG.fields.map((f) => {
+        if (f.name === "collectionSlug") {
+          return { ...f, options: audienceOptions };
+        }
+        if (f.name === "purpose") {
+          return { ...f, options: purposeOptions };
+        }
+        return f;
+      }),
+      access: {
+        read: resolveOpAccess("read"),
+        create: resolveOpAccess("create"),
+        update: resolveOpAccess("update"),
+        delete: resolveOpAccess("delete")
+      }
+    });
+  }
   return {
     ...schemaAwareConfig,
     collections: [...normalizedCollections, ...systemCollections],
@@ -6262,6 +6707,31 @@ function generateOpenApi(config) {
       spec.paths[`${path}/accept-invite`] = {
         post: publicAuthPost("Accept an invitation")
       };
+      spec.paths[`${path}/tokens/verify`] = {
+        get: {
+          tags: [collectionTag],
+          summary: `Verify an invite or password reset token`,
+          parameters: [
+            {
+              name: "token",
+              in: "query",
+              required: true,
+              schema: { type: "string" }
+            },
+            {
+              name: "purpose",
+              in: "query",
+              required: false,
+              schema: { type: "string", enum: ["invite", "reset"] }
+            }
+          ],
+          responses: {
+            200: {
+              description: "Token verification result"
+            }
+          }
+        }
+      };
       spec.paths[`${path}/{id}/change-password`] = {
         post: {
           tags: [collectionTag],
@@ -7459,8 +7929,8 @@ function sanitizeDocForAI(options) {
 // src/utils/index-name.ts
 var import_node_crypto2 = require("crypto");
 var MAX_INDEX_NAME_LENGTH = 60;
-function resolveIndexName(prefix, table, fields) {
-  const full = `${prefix}_${table}_${fields.join("_")}`;
+function resolveIndexName(prefix, table2, fields) {
+  const full = `${prefix}_${table2}_${fields.join("_")}`;
   if (full.length <= MAX_INDEX_NAME_LENGTH) return full;
   const hash = (0, import_node_crypto2.createHash)("sha1").update(full).digest("hex").slice(0, 10);
   const tail = (fields[fields.length - 1] ?? "").slice(0, 30);
@@ -7932,7 +8402,7 @@ function compileNavigation(config) {
   const mentionedTrash = explicitNav.some((i) => i.trash || i.slug === "trash");
   if (!mentionedTrash) {
     const hasTrash = collections.some(
-      (col) => !col.slug.startsWith("__") && resolveTrashConfig(col, config).enabled
+      (col) => !INTERNAL_SYSTEM_COLLECTIONS.has(col.slug) && resolveTrashConfig(col, config).enabled
     );
     if (hasTrash) {
       registerItem(void 0, {
@@ -8263,8 +8733,11 @@ function defineTab(args) {
   DuplicateKeyError,
   DyrectedAIError,
   DyrectedError,
+  EMAIL_TEMPLATES_COLLECTION_CONFIG,
+  EMAIL_TEMPLATES_COLLECTION_SLUG,
   FieldConditionBuilder,
   ForbiddenError,
+  INTERNAL_SYSTEM_COLLECTIONS,
   LIFECYCLE_EVENTS_COLLECTION,
   LIFECYCLE_EVENT_NAMES,
   MatchBuilder,
@@ -8282,6 +8755,7 @@ function defineTab(args) {
   WORKFLOW_HISTORY_COLLECTION,
   abs,
   addDays,
+  alertBox,
   asCollection,
   assertValidAdminConditionsInConfig,
   assertValidDeclarativeAccessInConfig,
@@ -8311,6 +8785,7 @@ function defineTab(args) {
   createTaskRunner,
   createTrashPurgeTask,
   createWorkflowDocument,
+  ctaButton,
   defaultValue,
   defineAction,
   defineArrayField,
@@ -8357,6 +8832,7 @@ function defineTab(args) {
   defineUrlField,
   defineView,
   defineWorkspace,
+  detailBox,
   diffDays,
   dispatchLifecycleEvent,
   dispatchPendingLifecycleEvents,
@@ -8372,10 +8848,14 @@ function defineTab(args) {
   displayTab,
   displayTabs,
   displayText,
+  divider,
+  emailTokens,
   endsWith,
+  escapeHtml,
   evaluateDetailComputed,
   evaluateJexl,
   evaluateJexlSync,
+  eventList,
   executeFieldAfterRead,
   executeFieldBeforeChange,
   expr,
@@ -8392,8 +8872,10 @@ function defineTab(args) {
   getAdminAuthCollection,
   getAdminRoleForCollection,
   getAllowedSitesForUser,
+  getDefaultEmailTemplate,
   getPublicAdminAuthConfig,
   getTrashEntryId,
+  heading,
   includes,
   initializeWorkflowDocument,
   isAICollection,
@@ -8406,6 +8888,7 @@ function defineTab(args) {
   isUserAdmin,
   join,
   last,
+  layout,
   length,
   lower,
   maskEmail,
@@ -8421,6 +8904,7 @@ function defineTab(args) {
   normalizeGroupKey,
   now,
   numericFieldNames,
+  paragraph,
   parseCron,
   parseMongoWhere,
   parseSort,
@@ -8437,21 +8921,27 @@ function defineTab(args) {
   resolveAdminAuthCollection,
   resolveAllCollectionViews,
   resolveAuthorizedSiteId,
+  resolveBlocks,
   resolveDocumentTitle,
   resolveIndexName,
   resolvePrefix,
   resolveTrashConfig,
   restoreDocument,
   round,
+  row,
   runCollectionHooks,
+  safeLinkDetailBox,
   sanitizeDocForAI,
   saveWorkflowDraft,
+  sectionLabel,
   simplePublishingWorkflow,
   slugify,
   softDeleteDocument,
+  spacer,
   sqrt,
   startsWith,
   sum,
+  table,
   today,
   transitionWorkflow,
   trim,