@dyrected/core 2.19.0 → 2.20.1

package/dist/server.cjs

@@ -3063,7 +3063,7 @@ function assertValidTrashInConfig(config, source = "config") {
     if (col.slug === "trash") {
       throw new Error(`Collection slug "trash" is reserved by Dyrected for the trash system.`);
     }
-    const isSystem = col.slug.startsWith("__");
+    const isSystem = INTERNAL_SYSTEM_COLLECTIONS.has(col.slug);
     if (isSystem && col.trash) {
       throw new Error(`System collection "${col.slug}" cannot enable trash.`);
     }
@@ -3170,12 +3170,20 @@ async function restoreDocument(options) {
   }
   return { restoredDoc: docToRestore };
 }
-var TRASH_COLLECTION, TRASH_COLLECTION_CONFIG;
+var TRASH_COLLECTION, INTERNAL_SYSTEM_COLLECTIONS, TRASH_COLLECTION_CONFIG;
 var init_trash = __esm({
   "src/trash.ts"() {
     "use strict";
     init_hooks();
     TRASH_COLLECTION = "__trash";
+    INTERNAL_SYSTEM_COLLECTIONS = /* @__PURE__ */ new Set([
+      "__audit",
+      "__sessions",
+      "__task_locks",
+      "__trash",
+      "__workflow_history",
+      "__lifecycle_events"
+    ]);
     TRASH_COLLECTION_CONFIG = {
       slug: TRASH_COLLECTION,
       labels: { singular: "Trash entry", plural: "Trash entries" },
@@ -4299,12 +4307,17 @@ function sanitizeWhereClause(where, fields) {
     const result = {};
     for (const [key, value] of Object.entries(node)) {
       const upperKey = key.toUpperCase();
-      if (upperKey === "AND" || upperKey === "OR") {
+      if (upperKey === "AND" || upperKey === "OR" || upperKey === "NOT") {
         if (Array.isArray(value)) {
           const processed = value.map((v) => walk(v)).filter((v) => Object.keys(v).length > 0);
           if (processed.length > 0) {
             result[upperKey] = processed;
           }
+        } else if (typeof value === "object" && value !== null) {
+          const processed = walk(value);
+          if (Object.keys(processed).length > 0) {
+            result[upperKey] = processed;
+          }
         }
         continue;
       }
@@ -5415,8 +5428,10 @@ __export(server_exports, {
   AUTH_SESSIONS_COLLECTION: () => AUTH_SESSIONS_COLLECTION,
   AuthController: () => AuthController,
   CollectionController: () => CollectionController,
+  DEFAULT_INVITE_EXPIRY: () => DEFAULT_INVITE_EXPIRY,
   DEFAULT_LOCK_TIME_MS: () => DEFAULT_LOCK_TIME_MS,
   DEFAULT_MAX_LOGIN_ATTEMPTS: () => DEFAULT_MAX_LOGIN_ATTEMPTS,
+  DEFAULT_RESET_PASSWORD_EXPIRY: () => DEFAULT_RESET_PASSWORD_EXPIRY,
   DEFAULT_SESSION_EXPIRY: () => DEFAULT_SESSION_EXPIRY,
   EmbeddingService: () => EmbeddingService,
   GlobalController: () => GlobalController,
@@ -5448,13 +5463,16 @@ __export(server_exports, {
   getAIModel: () => getAIModel,
   getAuthSession: () => getAuthSession,
   getConfigLogger: () => getConfigLogger,
+  getDbEmailTemplateOverride: () => getDbEmailTemplateOverride,
   getEmbeddingModel: () => getEmbeddingModel,
   getLockedUntilMs: () => getLockedUntilMs,
   getObservabilityRuntime: () => getObservabilityRuntime,
   getRequestLogger: () => getRequestLogger,
   hasEmbeddingApiKey: () => hasEmbeddingApiKey,
+  hasUsablePassword: () => hasUsablePassword,
   hashContent: () => hashContent,
   hashPassword: () => hashPassword,
+  interpolateVariables: () => interpolateVariables,
   isAuthSessionActive: () => isAuthSessionActive,
   issueAuthSessionToken: () => issueAuthSessionToken,
   normalizeFieldValue: () => normalizeFieldValue,
@@ -5463,7 +5481,10 @@ __export(server_exports, {
   registerRoutes: () => registerRoutes,
   renderPrometheusMetrics: () => renderPrometheusMetrics,
   resolveAuthLockoutConfig: () => resolveAuthLockoutConfig,
+  resolveEmailTemplate: () => resolveEmailTemplate,
+  resolveInviteTokenExpiry: () => resolveInviteTokenExpiry,
   resolveObservabilityConfig: () => resolveObservabilityConfig,
+  resolveResetPasswordTokenExpiry: () => resolveResetPasswordTokenExpiry,
   resolveSessionTokenExpiry: () => resolveSessionTokenExpiry,
   revokeAllAuthSessions: () => revokeAllAuthSessions,
   revokeAuthSession: () => revokeAuthSession,
@@ -5473,6 +5494,7 @@ __export(server_exports, {
   serializeViewForApi: () => serializeViewForApi,
   shouldSampleRequest: () => shouldSampleRequest,
   signCollectionToken: () => signCollectionToken,
+  toOutboundEmail: () => toOutboundEmail,
   touchAuthSession: () => touchAuthSession,
   validatePayloadAgainstFields: () => validatePayloadAgainstFields,
   verifyCollectionToken: () => verifyCollectionToken,
@@ -6297,13 +6319,27 @@ async function hashPassword(plain) {
   const derivedKey = await scryptAsync(plain, salt, KEY_LEN);
   return `${salt}:${derivedKey.toString("hex")}`;
 }
+function hasUsablePassword(stored) {
+  if (typeof stored !== "string" || !stored) return false;
+  const parts = stored.split(":");
+  return parts.length === 2 && Boolean(parts[0]) && Boolean(parts[1]);
+}
 async function verifyPassword(plain, stored) {
-  const [salt, storedHash] = stored.split(":");
+  if (typeof plain !== "string" || !plain || typeof stored !== "string" || !stored) {
+    return false;
+  }
+  const parts = stored.split(":");
+  if (parts.length !== 2) return false;
+  const [salt, storedHash] = parts;
   if (!salt || !storedHash) return false;
-  const derivedKey = await scryptAsync(plain, salt, KEY_LEN);
-  const storedBuffer = Buffer.from(storedHash, "hex");
-  if (derivedKey.length !== storedBuffer.length) return false;
-  return (0, import_node_crypto.timingSafeEqual)(derivedKey, storedBuffer);
+  try {
+    const derivedKey = await scryptAsync(plain, salt, KEY_LEN);
+    const storedBuffer = Buffer.from(storedHash, "hex");
+    if (derivedKey.length !== storedBuffer.length) return false;
+    return (0, import_node_crypto.timingSafeEqual)(derivedKey, storedBuffer);
+  } catch {
+    return false;
+  }
 }
 
 // src/auth/token.ts
@@ -6319,6 +6355,8 @@ function getSecret() {
 }
 var DEFAULT_EXPIRY = "7d";
 var DEFAULT_SESSION_EXPIRY = DEFAULT_EXPIRY;
+var DEFAULT_INVITE_EXPIRY = "48h";
+var DEFAULT_RESET_PASSWORD_EXPIRY = "2h";
 function resolveSessionTokenExpiry(collection) {
   const auth = collection.auth;
   if (auth && typeof auth === "object" && typeof auth.tokenExpiration === "string" && auth.tokenExpiration.length > 0) {
@@ -6326,6 +6364,20 @@ function resolveSessionTokenExpiry(collection) {
   }
   return DEFAULT_SESSION_EXPIRY;
 }
+function resolveInviteTokenExpiry(collection) {
+  const auth = collection.auth;
+  if (auth && typeof auth === "object" && typeof auth.inviteExpiration === "string" && auth.inviteExpiration.length > 0) {
+    return auth.inviteExpiration;
+  }
+  return DEFAULT_INVITE_EXPIRY;
+}
+function resolveResetPasswordTokenExpiry(collection) {
+  const auth = collection.auth;
+  if (auth && typeof auth === "object" && typeof auth.resetPasswordExpiration === "string" && auth.resetPasswordExpiration.length > 0) {
+    return auth.resetPasswordExpiration;
+  }
+  return DEFAULT_RESET_PASSWORD_EXPIRY;
+}
 async function signCollectionToken(payload, expiresIn = DEFAULT_EXPIRY) {
   return new import_jose.SignJWT({ ...payload }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(expiresIn).sign(getSecret());
 }
@@ -6630,13 +6682,34 @@ function getAdminRoleForCollection(collection) {
   }
   return "admin";
 }
+var STANDARD_ADMIN_ROLES = /* @__PURE__ */ new Set([
+  "admin",
+  "super_admin",
+  "superadmin",
+  "super admin",
+  "super-admin",
+  "owner"
+]);
 function isUserAdmin(user, collection) {
   if (!user) return false;
-  const roles = Array.isArray(user.roles) ? user.roles : typeof user.role === "string" ? [user.role] : [];
-  if (roles.length === 0) return false;
+  const rawRoles = Array.isArray(user.roles) ? user.roles : typeof user.roles === "string" ? [user.roles] : Array.isArray(user.role) ? user.role : typeof user.role === "string" ? [user.role] : [];
+  if (rawRoles.length === 0) return false;
+  const roles = rawRoles.filter((r) => typeof r === "string");
   const configuredRole = getAdminRoleForCollection(collection);
-  if (roles.includes(configuredRole)) return true;
-  return roles.includes("admin") || roles.includes("super_admin");
+  for (const r of roles) {
+    if (r === configuredRole || r.toLowerCase() === configuredRole.toLowerCase()) {
+      return true;
+    }
+    const normalized = r.trim().toLowerCase();
+    if (STANDARD_ADMIN_ROLES.has(normalized)) {
+      return true;
+    }
+    const stripped = normalized.replace(/[\s_-]+/g, "");
+    if (stripped === "admin" || stripped === "superadmin" || stripped === "owner") {
+      return true;
+    }
+  }
+  return false;
 }
 
 // src/utils/collection-search.ts
@@ -7285,7 +7358,7 @@ function compileNavigation(config) {
   const mentionedTrash = explicitNav.some((i) => i.trash || i.slug === "trash");
   if (!mentionedTrash) {
     const hasTrash = collections.some(
-      (col) => !col.slug.startsWith("__") && resolveTrashConfig(col, config).enabled
+      (col) => !INTERNAL_SYSTEM_COLLECTIONS.has(col.slug) && resolveTrashConfig(col, config).enabled
     );
     if (hasTrash) {
       registerItem(void 0, {
@@ -11444,9 +11517,16 @@ function resolveAdminUrl(c, config, clientUrl) {
 function appendQueryParam(url, key, value) {
   return `${url}${url.includes("?") ? "&" : "?"}${key}=${encodeURIComponent(value)}`;
 }
-
-// src/controllers/auth.controller.ts
-var import_node_crypto3 = require("crypto");
+function resolveActionUrl(c, config, customUrl) {
+  if (customUrl && typeof customUrl === "string" && customUrl.trim().length > 0) {
+    try {
+      return new URL(customUrl.trim(), c.req.url).toString();
+    } catch {
+      return customUrl.trim();
+    }
+  }
+  return resolveAdminUrl(c, config);
+}
 
 // src/auth/lockout.ts
 var DEFAULT_MAX_LOGIN_ATTEMPTS = 5;
@@ -11503,15 +11583,21 @@ var emailTokens = {
   width: "600px"
 };
 function escapeHtml(value) {
-  return value.replace(/[&<>'"]/g, (character) => ({
-    "&": "&amp;",
-    "<": "&lt;",
-    ">": "&gt;",
-    "'": "&#39;",
-    '"': "&quot;"
-  })[character]);
+  return value.replace(
+    /[&<>'"]/g,
+    (character) => ({
+      "&": "&amp;",
+      "<": "&lt;",
+      ">": "&gt;",
+      "'": "&#39;",
+      '"': "&quot;"
+    })[character]
+  );
 }
 function safeHttpUrl(value) {
+  if (value.startsWith("{{") && value.endsWith("}}")) {
+    return value;
+  }
   try {
     const url = new URL(value);
     return url.protocol === "https:" || url.protocol === "http:" ? escapeHtml(url.toString()) : void 0;
@@ -11522,8 +11608,8 @@ function safeHttpUrl(value) {
 function heading(content) {
   return `<h1 style="margin:0;font-family:${emailTokens.font};font-size:24px;line-height:1.25;font-weight:700;color:${emailTokens.colors.text}">${escapeHtml(content)}</h1>`;
 }
-function paragraph(content, margin = "0 0 16px") {
-  return `<p style="margin:${margin};font-family:${emailTokens.font};font-size:15px;line-height:1.6;color:${emailTokens.colors.muted}">${escapeHtml(content)}</p>`;
+function paragraph(content, margin = "0 0 16px", size = "15px") {
+  return `<p style="margin:${margin};font-family:${emailTokens.font};font-size:${size};line-height:1.6;color:${emailTokens.colors.muted}">${escapeHtml(content)}</p>`;
 }
 function sectionLabel(content) {
   return `<p style="margin:0 0 8px;font-family:${emailTokens.font};font-size:11px;line-height:1.4;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:${emailTokens.colors.subtle}">${escapeHtml(content)}</p>`;
@@ -11553,10 +11639,13 @@ function detailBox(content, monospace = false) {
 function ctaButton(label, href) {
   const safeHref = safeHttpUrl(href);
   if (!safeHref) return "";
-  return table(row(
-    `<a href="${safeHref}" style="display:inline-block;padding:13px 22px;border-radius:${emailTokens.radius.control};background:${emailTokens.colors.accent};font-family:${emailTokens.font};font-size:14px;line-height:1.2;font-weight:700;color:${emailTokens.colors.text};text-decoration:none">${escapeHtml(label)}</a>`,
-    "padding:8px 0 24px"
-  ), "width:auto");
+  return table(
+    row(
+      `<a href="${safeHref}" style="display:inline-block;padding:13px 22px;border-radius:${emailTokens.radius.control};background:${emailTokens.colors.accent};font-family:${emailTokens.font};font-size:14px;line-height:1.2;font-weight:700;color:${emailTokens.colors.text};text-decoration:none">${escapeHtml(label)}</a>`,
+      "padding:8px 0 24px"
+    ),
+    "width:auto"
+  );
 }
 function safeLinkDetailBox(href) {
   const safeHref = safeHttpUrl(href);
@@ -11564,9 +11653,33 @@ function safeLinkDetailBox(href) {
   return detailBox(safeHref, true);
 }
 function alertBox(content) {
-  return table(row(escapeHtml(content), `padding:13px 16px;font-family:${emailTokens.font};font-size:13px;line-height:1.5;color:${emailTokens.colors.dangerText}`), `width:100%;background:${emailTokens.colors.dangerSurface};border:1px solid ${emailTokens.colors.dangerBorder};border-radius:${emailTokens.radius.control}`);
+  return table(
+    row(
+      escapeHtml(content),
+      `padding:13px 16px;font-family:${emailTokens.font};font-size:13px;line-height:1.5;color:${emailTokens.colors.dangerText}`
+    ),
+    `width:100%;background:${emailTokens.colors.dangerSurface};border:1px solid ${emailTokens.colors.dangerBorder};border-radius:${emailTokens.radius.control}`
+  );
 }
-function layout({ preheader, title, content, footer }) {
+function resolveBlocks(input) {
+  if (Array.isArray(input)) {
+    const parts = [];
+    for (const item of input) {
+      if (Array.isArray(item)) {
+        for (const sub of item) {
+          if (typeof sub === "string" && sub.length > 0) parts.push(sub);
+        }
+      } else if (typeof item === "string" && item.length > 0) {
+        parts.push(item);
+      }
+    }
+    return parts.join("\n");
+  }
+  return typeof input === "string" ? input : "";
+}
+function layout({ preheader, title, content, footer, siteName }) {
+  const resolvedContent = resolveBlocks(content);
+  const resolvedFooter = resolveBlocks(footer);
   return `<!doctype html>
 <html lang="en" dir="ltr" xmlns="http://www.w3.org/1999/xhtml">
   <head>
@@ -11587,8 +11700,8 @@ function layout({ preheader, title, content, footer }) {
       ${table(
     row(
       table(
-        row("&nbsp;", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${sectionLabel("Dyrected")}${heading(title)}`, "padding:30px 32px 24px") + row(content, "padding:0 32px 32px") + row(
-          `${divider()}${paragraph(footer, "20px 0 6px")}${paragraph("Privacy: this message contains account-related information; please avoid forwarding it.", "0")}`,
+        row("&nbsp;", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${sectionLabel(siteName ?? "Dyrected")}${heading(title)}`, "padding:30px 32px 24px") + row(resolvedContent, "padding:0 32px 32px") + row(
+          `${divider()}${paragraph(resolvedFooter, "20px 0 6px")}${paragraph("Privacy: this message contains account-related information; please avoid forwarding it.", "10px 0px 0px 0px", "12px")}`,
           "padding:0 32px 28px"
         ),
         `width:100%;max-width:${emailTokens.width};background:${emailTokens.colors.surface};border:1px solid ${emailTokens.colors.border};border-radius:${emailTokens.radius.card};overflow:hidden`
@@ -11601,6 +11714,81 @@ function layout({ preheader, title, content, footer }) {
   </body>
 </html>`;
 }
+function getDefaultEmailTemplate(purpose, options) {
+  const siteName = options?.siteName ?? "Dyrected";
+  switch (purpose) {
+    case "invite":
+      return {
+        subject: `You've been invited to ${siteName}`,
+        rawHtml: layout({
+          siteName,
+          preheader: `You've been invited to join ${siteName}.`,
+          title: "You've been invited",
+          content: [
+            paragraph("Use the invitation link below to create your account. The link expires in 7 days."),
+            ctaButton("Accept invitation", "{{url}}"),
+            sectionLabel("Invitation link"),
+            safeLinkDetailBox("{{url}}"),
+            paragraph("If the button does not work, copy and paste the link above into your browser.", "12px 0 0")
+          ],
+          footer: "If you weren't expecting this invitation, you can safely ignore this email."
+        })
+      };
+    case "resetPassword":
+      return {
+        subject: "Reset your password",
+        rawHtml: layout({
+          siteName,
+          preheader: `Reset your ${siteName} password.`,
+          title: "Reset your password",
+          content: [
+            paragraph("We received a request to reset your password. The reset link expires in 1 hour."),
+            ctaButton("Reset password", "{{url}}"),
+            sectionLabel("Reset link"),
+            safeLinkDetailBox("{{url}}"),
+            paragraph("If the button does not work, copy and paste the link above into your browser.", "12px 0 0")
+          ],
+          footer: "If you didn't request a password reset, you can safely ignore this email."
+        })
+      };
+    case "welcome":
+      return {
+        subject: `Welcome to ${siteName} \u2014 your account is ready`,
+        rawHtml: layout({
+          siteName,
+          preheader: `Your ${siteName} account is ready.`,
+          title: "Welcome \u2014 your account is ready",
+          content: [paragraph("Your account has been created. You can now log in with:"), detailBox("{{email}}")],
+          footer: "If you didn't create this account, you can safely ignore this email."
+        })
+      };
+    case "passwordChanged":
+      return {
+        subject: "Your password has been changed",
+        rawHtml: layout({
+          siteName,
+          preheader: `Your ${siteName} password was changed.`,
+          title: "Password changed",
+          content: [
+            paragraph("The password for your account has been changed."),
+            alertBox("If you did not make this change, please contact support or reset your password immediately.")
+          ],
+          footer: "Security notice: this confirms a recent credential change."
+        })
+      };
+    default:
+      return {
+        subject: `Notification from ${siteName}`,
+        rawHtml: layout({
+          siteName,
+          preheader: `Account notification from ${siteName}.`,
+          title: "Account Notification",
+          content: [paragraph(`This is an account notification from ${siteName}.`)],
+          footer: "If you have any questions, please reach out to our team."
+        })
+      };
+  }
+}
 
 // src/services/email.service.ts
 var _devSend = null;
@@ -11628,11 +11816,18 @@ async function getDevSend() {
         password: account.pass
       });
       _devSend = async ({ to, subject, html }) => {
-        const info = await transport.sendMail({ from: '"Dyrected Dev" <dev@dyrected.local>', to, subject, html });
+        const info = await transport.sendMail({
+          from: '"Dyrected Dev" <dev@dyrected.local>',
+          to,
+          subject,
+          html
+        });
+        const previewUrl = nodemailer.default.getTestMessageUrl(info) || void 0;
         logger.info({
           msg: "Email preview URL",
-          previewUrl: nodemailer.default.getTestMessageUrl(info)
+          previewUrl
         });
+        return { previewUrl };
       };
       return _devSend;
     } catch {
@@ -11658,69 +11853,286 @@ async function sendEmail(config, payload) {
         err,
         msg: "Email provider send failed",
         to: payload.to,
-        subject: payload.subject
+        subject: "subject" in payload ? payload.subject : void 0,
+        template: "template" in payload ? payload.template : void 0
       });
       throw err;
     }
-    return;
+    return { success: true };
   }
   if (process.env.NODE_ENV !== "production") {
     const devSend = await getDevSend();
-    await devSend?.(payload);
+    if (devSend) {
+      if ("template" in payload && payload.template) {
+        const devHtml = `
+          <div style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; padding: 20px; border: 1px solid #e2e8f0; border-radius: 8px;">
+            <h3 style="margin-top:0; color: #1e293b;">External Template Email (Dev Preview)</h3>
+            <p><strong>To:</strong> ${payload.to}</p>
+            <p><strong>Template ID:</strong> <code>${payload.template}</code></p>
+            ${payload.subject ? `<p><strong>Subject:</strong> ${payload.subject}</p>` : ""}
+            <p><strong>Variables:</strong></p>
+            <pre style="background: #f8fafc; padding: 12px; border-radius: 6px; overflow-x: auto;">${JSON.stringify(payload.variables, null, 2)}</pre>
+          </div>
+        `;
+        const res = await devSend({
+          to: payload.to,
+          subject: payload.subject ?? `[Template: ${payload.template}] External Email`,
+          html: devHtml
+        });
+        return { success: true, previewUrl: res?.previewUrl };
+      } else if ("html" in payload) {
+        const res = await devSend({
+          to: payload.to,
+          subject: payload.subject,
+          html: payload.html
+        });
+        return { success: true, previewUrl: res?.previewUrl };
+      }
+    }
+  }
+  return { success: true };
+}
+function interpolateVariables(str, args, escapeMode = "html") {
+  if (!str || typeof str !== "string") return str;
+  return str.replace(/\{\{\s*([\w.]+)\s*\}\}/g, (_, path) => {
+    const parts = path.split(".");
+    let val = args;
+    for (const part of parts) {
+      if (val == null) break;
+      val = val[part];
+    }
+    if (val === void 0 || val === null) return "";
+    const raw = String(val);
+    return escapeMode === "html" ? escapeHtml(raw) : raw;
+  });
+}
+function formatDbTemplateDoc(doc, args) {
+  if (doc.format === "external_template" || doc.externalTemplateId) {
+    const rawVars = doc.variables && typeof doc.variables === "object" ? doc.variables : {};
+    const interpolatedVars = { ...args };
+    for (const [key, val] of Object.entries(rawVars)) {
+      if (typeof val === "string") {
+        interpolatedVars[key] = interpolateVariables(val, args);
+      } else {
+        interpolatedVars[key] = val;
+      }
+    }
+    return {
+      template: doc.externalTemplateId ?? "",
+      variables: interpolatedVars,
+      ...doc.subject ? { subject: interpolateVariables(doc.subject, args) } : {}
+    };
+  }
+  return {
+    subject: interpolateVariables(doc.subject || "", args),
+    html: interpolateVariables(doc.rawHtml || "", args)
+  };
+}
+async function getDbEmailTemplateOverride(db, collectionSlug, purpose, args) {
+  if (!db || typeof db.find !== "function") return null;
+  try {
+    if (collectionSlug) {
+      const specific = await db.find({
+        collection: "__email_templates",
+        where: {
+          collectionSlug,
+          purpose,
+          active: true
+        },
+        limit: 1
+      });
+      const doc2 = specific?.docs?.[0];
+      if (doc2) {
+        return formatDbTemplateDoc(doc2, args);
+      }
+    }
+    const global = await db.find({
+      collection: "__email_templates",
+      where: {
+        collectionSlug: "*",
+        purpose,
+        active: true
+      },
+      limit: 1
+    });
+    const doc = global?.docs?.[0];
+    if (doc) {
+      return formatDbTemplateDoc(doc, args);
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+function enrichArgs(config, collection, args) {
+  const slug = collection?.slug;
+  const readableSlug = slug?.replace(/^__/, "");
+  const fallbackLabel = readableSlug ? readableSlug.charAt(0).toUpperCase() + readableSlug.slice(1) : "Account";
+  return {
+    ...args,
+    collection: slug,
+    collectionLabel: collection?.labels?.singular || collection?.labels?.plural || fallbackLabel,
+    collectionLabels: collection?.labels,
+    siteName: config.admin?.branding?.logoText ?? "Dyrected"
+  };
+}
+function toOutboundEmail(to, result, metadata) {
+  if ("template" in result) {
+    return {
+      to,
+      type: "template",
+      template: result.template,
+      variables: result.variables,
+      ...result.subject ? { subject: result.subject } : {},
+      ...metadata
+    };
   }
+  return {
+    to,
+    type: "html",
+    subject: result.subject ?? "Notification",
+    html: result.html,
+    ...result.text ? { text: result.text } : {},
+    ...metadata
+  };
 }
-function buildWelcomeEmail(config, args) {
-  const custom = config.email?.templates?.welcome?.(args);
+function buildWelcomeEmail(config, args, collection, dbOverride) {
+  if (dbOverride) return dbOverride;
+  const enriched = enrichArgs(config, collection, args);
+  const collectionAuth = collection?.auth;
+  if (collectionAuth && typeof collectionAuth === "object" && collectionAuth.email?.templates?.welcome) {
+    return collectionAuth.email.templates.welcome(enriched);
+  }
+  const custom = config.email?.templates?.welcome?.(enriched);
+  if (custom) return custom;
   return {
-    subject: custom?.subject ?? "Welcome \u2014 your account is ready",
-    html: custom?.html ?? layout({
-      preheader: "Your Dyrected account is ready.",
+    subject: "Welcome \u2014 your account is ready",
+    html: layout({
+      siteName: enriched.siteName,
+      preheader: `Your ${enriched.siteName} account is ready.`,
       title: "Welcome \u2014 your account is ready",
-      content: `${paragraph("Your account has been created. You can now log in with:")}${detailBox(args.email)}`,
+      content: [
+        paragraph("Your account has been created. You can now log in with:"),
+        detailBox(args.email)
+      ],
       footer: "If you didn't create this account, you can safely ignore this email."
     })
   };
 }
-function buildInviteEmail(config, args) {
-  const custom = config.email?.templates?.invite?.(args);
+function buildInviteEmail(config, args, collection, dbOverride) {
+  if (dbOverride) return dbOverride;
+  const enriched = enrichArgs(config, collection, args);
+  const collectionAuth = collection?.auth;
+  if (collectionAuth && typeof collectionAuth === "object" && collectionAuth.email?.templates?.invite) {
+    return collectionAuth.email.templates.invite(enriched);
+  }
+  const custom = config.email?.templates?.invite?.(enriched);
+  if (custom) return custom;
   const inviteLink = args.url;
   const inviteLinkBlock = inviteLink ? safeLinkDetailBox(inviteLink) : "";
   return {
-    subject: custom?.subject ?? "You've been invited",
-    html: custom?.html ?? layout({
-      preheader: "You've been invited to join a Dyrected admin area.",
+    subject: "You've been invited",
+    html: layout({
+      siteName: enriched.siteName,
+      preheader: `You've been invited to join ${enriched.siteName}.`,
       title: "You've been invited",
-      content: inviteLink ? `${args.invitedByEmail ? paragraph(`You were invited by ${args.invitedByEmail}.`) : ""}${paragraph("Use the invitation link below to create your account. The link expires in 7 days.")}${ctaButton("Accept invitation", inviteLink)}${sectionLabel("Invitation link")}${inviteLinkBlock}${paragraph("If the button does not work, copy and paste the link above into your browser.", "12px 0 0")}` : `${args.invitedByEmail ? paragraph(`You were invited by ${args.invitedByEmail}.`) : ""}${paragraph("Use the invitation token below to accept your invitation. It expires in 7 days.")}${sectionLabel("Invitation token")}${detailBox(args.token, true)}`,
+      content: [
+        args.invitedByEmail && paragraph(`You were invited by ${args.invitedByEmail}.`),
+        inviteLink ? [
+          paragraph("Use the invitation link below to create your account. The link expires in 7 days."),
+          ctaButton("Accept invitation", inviteLink),
+          sectionLabel("Invitation link"),
+          inviteLinkBlock,
+          paragraph("If the button does not work, copy and paste the link above into your browser.", "12px 0 0")
+        ] : [
+          paragraph("Use the invitation token below to accept your invitation. It expires in 7 days."),
+          sectionLabel("Invitation token"),
+          detailBox(args.token, true)
+        ]
+      ],
       footer: "If you weren't expecting this invitation, you can safely ignore this email."
     })
   };
 }
-function buildResetPasswordEmail(config, args) {
-  const custom = config.email?.templates?.resetPassword?.(args);
+function buildResetPasswordEmail(config, args, collection, dbOverride) {
+  if (dbOverride) return dbOverride;
+  const enriched = enrichArgs(config, collection, args);
+  const collectionAuth = collection?.auth;
+  if (collectionAuth && typeof collectionAuth === "object" && collectionAuth.email?.templates?.resetPassword) {
+    return collectionAuth.email.templates.resetPassword(enriched);
+  }
+  const custom = config.email?.templates?.resetPassword?.(enriched);
+  if (custom) return custom;
   const resetLink = args.url;
   const resetLinkBlock = resetLink ? safeLinkDetailBox(resetLink) : "";
   return {
-    subject: custom?.subject ?? "Reset your password",
-    html: custom?.html ?? layout({
-      preheader: "Reset your Dyrected password.",
+    subject: "Reset your password",
+    html: layout({
+      siteName: enriched.siteName,
+      preheader: `Reset your ${enriched.siteName} password.`,
       title: "Reset your password",
-      content: resetLink ? `${paragraph("We received a request to reset your password. The reset link expires in 1 hour.")}${ctaButton("Reset password", resetLink)}${sectionLabel("Reset link")}${resetLinkBlock}${paragraph("If the button does not work, copy and paste the link above into your browser.", "12px 0 0")}` : `${paragraph("We received a request to reset your password. The reset token expires in 1 hour.")}${sectionLabel("Reset token")}${detailBox(args.token, true)}`,
+      content: [
+        resetLink ? [
+          paragraph("We received a request to reset your password. The reset link expires in 1 hour."),
+          ctaButton("Reset password", resetLink),
+          sectionLabel("Reset link"),
+          resetLinkBlock,
+          paragraph("If the button does not work, copy and paste the link above into your browser.", "12px 0 0")
+        ] : [
+          paragraph("We received a request to reset your password. The reset token expires in 1 hour."),
+          sectionLabel("Reset token"),
+          detailBox(args.token, true)
+        ]
+      ],
       footer: "If you didn't request a password reset, you can safely ignore this email."
     })
   };
 }
-function buildPasswordChangedEmail(config, args) {
-  const custom = config.email?.templates?.passwordChanged?.(args);
+function buildPasswordChangedEmail(config, args, collection, dbOverride) {
+  if (dbOverride) return dbOverride;
+  const enriched = enrichArgs(config, collection, args);
+  const collectionAuth = collection?.auth;
+  if (collectionAuth && typeof collectionAuth === "object" && collectionAuth.email?.templates?.passwordChanged) {
+    return collectionAuth.email.templates.passwordChanged(enriched);
+  }
+  const custom = config.email?.templates?.passwordChanged?.(enriched);
+  if (custom) return custom;
   return {
-    subject: custom?.subject ?? "Your password has been changed",
-    html: custom?.html ?? layout({
-      preheader: "Your Dyrected password was changed.",
+    subject: "Your password has been changed",
+    html: layout({
+      siteName: enriched.siteName,
+      preheader: `Your ${enriched.siteName} password was changed.`,
       title: "Password changed",
-      content: `${paragraph("The password for this account was just changed:")}${detailBox(args.email)}${spacer()}${alertBox("If you did not make this change, please contact support immediately.")}`,
+      content: [
+        paragraph("The password for this account was just changed:"),
+        detailBox(args.email),
+        spacer(),
+        alertBox("If you did not make this change, please contact support immediately.")
+      ],
       footer: "This is an automated security notification."
     })
   };
 }
+async function resolveEmailTemplate(params) {
+  const { config, collection, purpose, args, db } = params;
+  const enriched = enrichArgs(config, collection, args);
+  let dbOverride = null;
+  if (config.email?.adminEditable !== false && db) {
+    dbOverride = await getDbEmailTemplateOverride(db, collection?.slug, purpose, enriched);
+  }
+  switch (purpose) {
+    case "welcome":
+      return buildWelcomeEmail(config, enriched, collection, dbOverride);
+    case "invite":
+      return buildInviteEmail(config, enriched, collection, dbOverride);
+    case "resetPassword":
+      return buildResetPasswordEmail(config, enriched, collection, dbOverride);
+    case "passwordChanged":
+      return buildPasswordChangedEmail(config, enriched, collection, dbOverride);
+    default:
+      throw new Error(`Unknown email template purpose: ${purpose}`);
+  }
+}
 
 // src/controllers/auth.controller.ts
 var AuthController = class {
@@ -11757,9 +12169,10 @@ var AuthController = class {
     const data = {
       ...safeExtraFields,
       email,
-      password: await hashPassword((0, import_node_crypto3.randomBytes)(32).toString("hex"))
+      password: null,
+      invitedAt: Date.now()
     };
-    if (this.hasField("status")) {
+    if (this.hasField("status") && !data.status) {
       data.status = "pending";
     }
     return data;
@@ -11882,6 +12295,7 @@ var AuthController = class {
         ...rolePayload
       }
     });
+    const safeUser = this.sanitizeUser(user);
     const token = await issueAuthSessionToken({
       config,
       userId: user.id,
@@ -11891,15 +12305,28 @@ var AuthController = class {
       ip: c.get("clientIp"),
       authSource: "local"
     });
-    const { subject, html } = buildWelcomeEmail(config, { email: body.email });
-    sendEmail(config, { to: body.email, subject, html }).catch(
+    resolveEmailTemplate({
+      config,
+      collection: this.collection,
+      purpose: "welcome",
+      args: { email: body.email, user: safeUser },
+      db
+    }).then(
+      (emailResult) => sendEmail(
+        config,
+        toOutboundEmail(body.email, emailResult, {
+          collection: this.collection.slug,
+          purpose: "welcome",
+          user: safeUser
+        })
+      )
+    ).catch(
       (err) => getRequestLogger(c, "auth").error({
         err,
         msg: "Failed to send welcome email",
         email: body.email
       })
     );
-    const safeUser = this.sanitizeUser(user);
     return c.json({ token, user: safeUser });
   }
   // ---------------------------------------------------------------------------
@@ -11933,6 +12360,16 @@ var AuthController = class {
         403
       );
     }
+    if (!hasUsablePassword(user.password)) {
+      return c.json(
+        {
+          error: true,
+          code: "PASSWORD_NOT_SET",
+          message: "This account does not have a password set. Please use the invite link or reset password."
+        },
+        401
+      );
+    }
     const lockedUntilMs = getLockedUntilMs(user.lockedUntil);
     if (lockedUntilMs !== null && lockedUntilMs > Date.now()) {
       const retryAfterSeconds = Math.max(
@@ -12110,34 +12547,67 @@ var AuthController = class {
       limit: 1
     });
     const user = result.docs[0];
+    let resetToken;
+    let url;
+    let emailSent = false;
+    let emailError;
     if (user) {
-      const resetToken = await signCollectionToken(
+      const siteId = c.get("siteId");
+      resetToken = await signCollectionToken(
         {
-          sub: user.id,
+          sub: String(user.id),
           email: user.email,
           collection: this.collection.slug,
-          purpose: "reset"
+          purpose: "reset",
+          ...siteId ? { siteId } : {}
         },
-        "1h"
+        resolveResetPasswordTokenExpiry(this.collection)
       );
-      const url = appendQueryParam(resolveAdminUrl(c, config, body?.resetUrl), "token", resetToken);
-      try {
-        const { subject, html } = buildResetPasswordEmail(config, {
-          token: resetToken,
-          url
-        });
-        await sendEmail(config, { to: user.email, subject, html });
-      } catch (err) {
-        getRequestLogger(c, "auth").error({
-          err,
-          msg: "Failed to send password reset email",
-          email: user.email
-        });
+      const customResetUrl = body?.resetUrl ?? (typeof this.collection.auth === "object" ? this.collection.auth.urls?.resetPassword : void 0);
+      url = appendQueryParam(
+        resolveActionUrl(c, config, customResetUrl),
+        "token",
+        resetToken
+      );
+      if (body?.sendEmail !== false) {
+        try {
+          const emailResult = await resolveEmailTemplate({
+            config,
+            collection: this.collection,
+            purpose: "resetPassword",
+            args: {
+              token: resetToken,
+              url,
+              user
+            },
+            db
+          });
+          await sendEmail(
+            config,
+            toOutboundEmail(user.email, emailResult, {
+              collection: this.collection.slug,
+              purpose: "resetPassword",
+              user
+            })
+          );
+          emailSent = true;
+        } catch (err) {
+          emailSent = false;
+          emailError = err?.message ?? "Email delivery failed";
+          getRequestLogger(c, "auth").error({
+            err,
+            msg: "Failed to send password reset email",
+            email: user.email
+          });
+        }
       }
     }
     return c.json({
       success: true,
-      message: "If an account with that email exists, a reset link has been sent."
+      message: "If an account with that email exists, a reset link has been sent.",
+      ...body?.sendEmail === false && resetToken ? { token: resetToken, resetUrl: url } : {},
+      emailSent,
+      ...emailError ? { emailError } : {}
     });
   }
   // ---------------------------------------------------------------------------
@@ -12171,6 +12641,13 @@ var AuthController = class {
         400
       );
     }
+    const currentSiteId = c.get("siteId");
+    if (payload.siteId && currentSiteId && payload.siteId !== currentSiteId) {
+      return c.json(
+        { error: true, code: "SITE_MISMATCH", message: "Token is not valid for this site." },
+        403
+      );
+    }
     const hashedPassword = await hashPassword(body.password);
     await db.update({
       collection: this.collection.slug,
@@ -12185,10 +12662,24 @@ var AuthController = class {
       userId: payload.sub,
       collection: this.collection.slug
     });
-    const { subject, html } = buildPasswordChangedEmail(config, {
-      email: payload.email
-    });
-    sendEmail(config, { to: payload.email, subject, html }).catch(
+    resolveEmailTemplate({
+      config,
+      collection: this.collection,
+      purpose: "passwordChanged",
+      args: {
+        email: payload.email,
+        user: { id: payload.sub, email: payload.email }
+      },
+      db
+    }).then(
+      (emailResult) => sendEmail(
+        config,
+        toOutboundEmail(payload.email, emailResult, {
+          collection: this.collection.slug,
+          purpose: "passwordChanged"
+        })
+      )
+    ).catch(
       (err) => getRequestLogger(c, "auth").error({
         err,
         msg: "Failed to send password-changed email",
@@ -12217,61 +12708,117 @@ var AuthController = class {
     if (!body?.email) {
       return c.json({ error: true, message: "email is required." }, 400);
     }
-    const inviteData = body?.data && typeof body.data === "object" && !Array.isArray(body.data) ? body.data : {};
+    const {
+      email,
+      inviteUrl,
+      sendEmail: shouldSendEmail,
+      data: nestedData,
+      ...topLevelFields
+    } = body;
+    const inviteData = {
+      ...topLevelFields,
+      ...nestedData && typeof nestedData === "object" && !Array.isArray(nestedData) ? nestedData : {}
+    };
     const existing = await db.find({
       collection: this.collection.slug,
-      where: { email: body.email },
+      where: { email },
       limit: 1
     });
     const existingUser = existing.docs[0];
     const existingIsPending = existingUser?.status === "pending";
-    if (existingUser && !existingIsPending) {
+    if (existingUser && !existingIsPending && hasUsablePassword(existingUser.password)) {
       return c.json(
-        { error: true, message: "An account with that email already exists." },
+        {
+          error: true,
+          code: "USER_ALREADY_EXISTS",
+          message: "An account with that email already exists and has a password set. Use forgot password if needed."
+        },
         409
       );
     }
+    const now2 = Date.now();
+    let targetUser;
     if (!existingUser) {
-      await db.create({
+      const pendingData = await this.buildPendingInviteData(email, inviteData);
+      pendingData.invitedAt = now2;
+      targetUser = await db.create({
         collection: this.collection.slug,
-        data: await this.buildPendingInviteData(body.email, inviteData)
+        data: pendingData
       });
-    } else if (Object.keys(inviteData).length > 0) {
-      await db.update({
+    } else {
+      const updateData = {
+        ...inviteData,
+        invitedAt: now2
+      };
+      if (this.hasField("status") && !existingUser.status) {
+        updateData.status = "pending";
+      }
+      targetUser = await db.update({
         collection: this.collection.slug,
         id: String(existingUser.id),
-        data: await this.buildPendingInviteData(body.email, inviteData)
+        data: updateData
       });
     }
+    const siteId = c.get("siteId");
     const inviteToken = await signCollectionToken(
       {
-        sub: body.email,
-        email: body.email,
+        sub: email,
+        email,
         collection: this.collection.slug,
-        purpose: "invite"
+        purpose: "invite",
+        ...siteId ? { siteId } : {}
       },
-      "7d"
+      resolveInviteTokenExpiry(this.collection)
     );
-    const url = appendQueryParam(resolveAdminUrl(c, config, body?.inviteUrl), "inviteToken", inviteToken);
-    try {
-      const { subject, html } = buildInviteEmail(config, {
-        token: inviteToken,
-        invitedByEmail: requestUser.email,
-        url
-      });
-      await sendEmail(config, { to: body.email, subject, html });
-    } catch (err) {
-      getRequestLogger(c, "auth").error({
-        err,
-        msg: "Failed to send invite email",
-        email: body.email
-      });
+    const customInviteUrl = inviteUrl ?? (typeof this.collection.auth === "object" ? this.collection.auth.urls?.invite : void 0);
+    const url = appendQueryParam(
+      resolveActionUrl(c, config, customInviteUrl),
+      "inviteToken",
+      inviteToken
+    );
+    let emailSent = false;
+    let emailError;
+    if (shouldSendEmail !== false) {
+      try {
+        const emailResult = await resolveEmailTemplate({
+          config,
+          collection: this.collection,
+          purpose: "invite",
+          args: {
+            token: inviteToken,
+            invitedByEmail: requestUser.email,
+            url,
+            data: inviteData,
+            user: targetUser
+          },
+          db
+        });
+        await sendEmail(
+          config,
+          toOutboundEmail(email, emailResult, {
+            collection: this.collection.slug,
+            purpose: "invite",
+            user: targetUser
+          })
+        );
+        emailSent = true;
+      } catch (err) {
+        emailSent = false;
+        emailError = err?.message ?? "Email delivery failed";
+        getRequestLogger(c, "auth").error({
+          err,
+          msg: "Failed to send invite email",
+          email
+        });
+      }
     }
     return c.json({
       success: true,
-      message: `Invite sent to ${body.email}.`,
+      message: emailSent ? `Invite sent to ${email}.` : shouldSendEmail === false ? `Invite created for ${email}.` : `Invite created for ${email}, but email delivery failed.`,
       token: inviteToken,
-      inviteUrl: url
+      inviteUrl: url,
+      emailSent,
+      ...emailError ? { emailError } : {}
     });
   }
   // ---------------------------------------------------------------------------
@@ -12305,6 +12852,13 @@ var AuthController = class {
         400
       );
     }
+    const currentSiteId = c.get("siteId");
+    if (payload.siteId && currentSiteId && payload.siteId !== currentSiteId) {
+      return c.json(
+        { error: true, code: "SITE_MISMATCH", message: "Token is not valid for this site." },
+        403
+      );
+    }
     const inviteeEmail = payload.sub;
     const existing = await db.find({
       collection: this.collection.slug,
@@ -12313,12 +12867,26 @@ var AuthController = class {
     });
     const existingUser = existing.docs[0];
     const existingIsPending = existingUser?.status === "pending";
-    if (existingUser && !existingIsPending) {
+    if (existingUser && !existingIsPending && hasUsablePassword(existingUser.password)) {
       return c.json(
-        { error: true, message: "An account with that email already exists." },
+        {
+          error: true,
+          code: "INVITE_ALREADY_ACCEPTED",
+          message: "This invitation has already been accepted. Please log in or use forgot password."
+        },
         409
       );
     }
+    if (existingUser && payload.iat && typeof existingUser.invitedAt === "number" && payload.iat * 1e3 < existingUser.invitedAt - 2e3) {
+      return c.json(
+        {
+          error: true,
+          code: "INVITE_SUPERSEDED",
+          message: "This invitation link has been superseded by a newer invitation. Please use the latest link."
+        },
+        400
+      );
+    }
     const { token: _t, password: _p, ...extraFields } = body;
     const hashedPassword = await hashPassword(body.password);
     const user = existingUser ? await db.update({
@@ -12342,23 +12910,179 @@ var AuthController = class {
       ip: c.get("clientIp"),
       authSource: "local"
     });
-    const { subject, html } = buildWelcomeEmail(config, {
-      email: inviteeEmail
-    });
-    sendEmail(config, { to: inviteeEmail, subject, html }).catch(
+    const safeUser = this.sanitizeUser(user);
+    resolveEmailTemplate({
+      config,
+      collection: this.collection,
+      purpose: "welcome",
+      args: {
+        email: inviteeEmail,
+        user: safeUser
+      },
+      db
+    }).then(
+      (emailResult) => sendEmail(
+        config,
+        toOutboundEmail(inviteeEmail, emailResult, {
+          collection: this.collection.slug,
+          purpose: "welcome",
+          user: safeUser
+        })
+      )
+    ).catch(
       (err) => getRequestLogger(c, "auth").error({
         err,
         msg: "Failed to send welcome email",
         email: inviteeEmail
       })
     );
-    const safeUser = this.sanitizeUser(user);
     return c.json({ token: sessionToken, user: safeUser }, 201);
   }
+  // ---------------------------------------------------------------------------
+  // GET /tokens/verify?token=...&purpose=invite|reset
+  // Public. Validates token signature, expiration, database existence, and state.
+  // ---------------------------------------------------------------------------
+  async verifyToken(c) {
+    const db = c.get("config").db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const token = c.req.query("token");
+    const purpose = c.req.query("purpose");
+    if (!token) {
+      return c.json(
+        { valid: false, code: "TOKEN_REQUIRED", message: "Token is required." },
+        400
+      );
+    }
+    let payload;
+    try {
+      payload = await verifyCollectionToken(token);
+    } catch {
+      return c.json(
+        {
+          valid: false,
+          code: "TOKEN_EXPIRED_OR_INVALID",
+          message: "Token is invalid or has expired."
+        },
+        200
+      );
+    }
+    if (payload.collection !== this.collection.slug) {
+      return c.json(
+        {
+          valid: false,
+          code: "COLLECTION_MISMATCH",
+          message: "Token does not belong to this collection."
+        },
+        200
+      );
+    }
+    if (purpose && payload.purpose !== purpose) {
+      return c.json(
+        {
+          valid: false,
+          code: "PURPOSE_MISMATCH",
+          message: `Token was issued for '${payload.purpose}', not '${purpose}'.`
+        },
+        200
+      );
+    }
+    const currentSiteId = c.get("siteId");
+    if (payload.siteId && currentSiteId && payload.siteId !== currentSiteId) {
+      return c.json(
+        {
+          valid: false,
+          code: "SITE_MISMATCH",
+          message: "Token is not valid for this site."
+        },
+        200
+      );
+    }
+    if (payload.purpose === "invite") {
+      const result = await db.find({
+        collection: this.collection.slug,
+        where: { email: payload.email ?? payload.sub },
+        limit: 1
+      });
+      const user = result.docs[0];
+      if (!user) {
+        return c.json(
+          {
+            valid: false,
+            code: "USER_NOT_FOUND",
+            message: "Invited account was not found."
+          },
+          200
+        );
+      }
+      if (user._deleted || user.deletedAt) {
+        return c.json(
+          {
+            valid: false,
+            code: "USER_DELETED",
+            message: "Account has been deleted."
+          },
+          200
+        );
+      }
+      if (user.status !== "pending" && hasUsablePassword(user.password)) {
+        return c.json(
+          {
+            valid: false,
+            code: "INVITE_ALREADY_ACCEPTED",
+            message: "This invitation has already been accepted."
+          },
+          200
+        );
+      }
+      if (payload.iat && typeof user.invitedAt === "number" && payload.iat * 1e3 < user.invitedAt - 2e3) {
+        return c.json(
+          {
+            valid: false,
+            code: "INVITE_SUPERSEDED",
+            message: "This invitation link has been superseded by a newer one."
+          },
+          200
+        );
+      }
+      return c.json({
+        valid: true,
+        email: user.email,
+        collection: this.collection.slug
+      });
+    }
+    if (payload.purpose === "reset") {
+      const result = await db.find({
+        collection: this.collection.slug,
+        where: { id: payload.sub },
+        limit: 1
+      });
+      const user = result.docs[0];
+      if (!user || user._deleted || user.deletedAt) {
+        return c.json(
+          {
+            valid: false,
+            code: "USER_NOT_FOUND",
+            message: "Account was not found."
+          },
+          200
+        );
+      }
+      return c.json({
+        valid: true,
+        email: user.email,
+        collection: this.collection.slug
+      });
+    }
+    return c.json({
+      valid: true,
+      email: payload.email,
+      collection: this.collection.slug
+    });
+  }
 };
 
 // src/controllers/admin-auth.controller.ts
-var import_node_crypto4 = require("crypto");
+var import_node_crypto3 = require("crypto");
 var import_node_util2 = require("util");
 var import_jose2 = require("jose");
 var AdminAuthController = class {
@@ -12568,7 +13292,7 @@ var AdminAuthController = class {
             access.roles,
             access.data
           ),
-          password: await hashPassword((0, import_node_crypto4.randomBytes)(32).toString("hex"))
+          password: await hashPassword((0, import_node_crypto3.randomBytes)(32).toString("hex"))
         }
       });
     } else if (user) {
@@ -12655,7 +13379,7 @@ var AdminAuthController = class {
   }
   async buildOidcStartUrl(provider, returnTo, siteId, origin) {
     const discovery = await this.getOidcDiscovery(provider);
-    const nonce = (0, import_node_crypto4.randomBytes)(16).toString("hex");
+    const nonce = (0, import_node_crypto3.randomBytes)(16).toString("hex");
     const state = await this.signState({
       providerId: provider.id,
       returnTo,
@@ -15478,6 +16202,31 @@ function generateOpenApi(config) {
       spec.paths[`${path}/accept-invite`] = {
         post: publicAuthPost("Accept an invitation")
       };
+      spec.paths[`${path}/tokens/verify`] = {
+        get: {
+          tags: [collectionTag],
+          summary: `Verify an invite or password reset token`,
+          parameters: [
+            {
+              name: "token",
+              in: "query",
+              required: true,
+              schema: { type: "string" }
+            },
+            {
+              name: "purpose",
+              in: "query",
+              required: false,
+              schema: { type: "string", enum: ["invite", "reset"] }
+            }
+          ],
+          responses: {
+            200: {
+              description: "Token verification result"
+            }
+          }
+        }
+      };
       spec.paths[`${path}/{id}/change-password`] = {
         post: {
           tags: [collectionTag],
@@ -16088,7 +16837,7 @@ function registerRoutes(app, config) {
       return resolveBooleanAccess(requestConfig, access, accessArgs);
     };
     const filteredCollections = await Promise.all(
-      collections.filter((col) => !col.slug.startsWith("__") && (!siteId || col.shared || !col.siteId || col.siteId === siteId)).map(async (col) => ({
+      collections.filter((col) => !INTERNAL_SYSTEM_COLLECTIONS.has(col.slug) && (!siteId || col.shared || !col.siteId || col.siteId === siteId)).map(async (col) => ({
         slug: col.slug,
         labels: col.labels,
         shared: !!col.shared,
@@ -16230,7 +16979,7 @@ function registerRoutes(app, config) {
         model: effectiveAi?.model
       },
       trash: {
-        enabled: collections.some((col) => !col.slug.startsWith("__") && resolveTrashConfig(col, requestConfig).enabled),
+        enabled: collections.some((col) => !INTERNAL_SYSTEM_COLLECTIONS.has(col.slug) && resolveTrashConfig(col, requestConfig).enabled),
         retentionDays: requestConfig.trash?.retentionDays !== void 0 ? requestConfig.trash.retentionDays : 30,
         allowPermanentDelete: requestConfig.trash?.allowPermanentDelete !== false
       },
@@ -16241,7 +16990,7 @@ function registerRoutes(app, config) {
         uploadCollectionConfigured: requestConfig.collections.some((collection) => !!collection.upload),
         trashPurgeOverdue: await (async () => {
           const hasRetention = collections.some(
-            (col) => !col.slug.startsWith("__") && resolveTrashConfig(col, requestConfig).retentionDays !== null
+            (col) => !INTERNAL_SYSTEM_COLLECTIONS.has(col.slug) && resolveTrashConfig(col, requestConfig).retentionDays !== null
           );
           if (!hasRetention || !requestConfig.db) return false;
           try {
@@ -16879,6 +17628,7 @@ function registerRoutes(app, config) {
     app.post(`${path}/reset-password`, (c) => authController.resetPassword(c));
     app.post(`${path}/invite`, requireAuth(config), (c) => authController.invite(c));
     app.post(`${path}/accept-invite`, (c) => authController.acceptInvite(c));
+    app.get(`${path}/tokens/verify`, (c) => authController.verifyToken(c));
   }
   const auditController = new AuditController();
   for (const collection of config.collections) {
@@ -16923,6 +17673,126 @@ function registerRoutes(app, config) {
     app.get(path, (c) => controller.get(c));
     app.patch(path, (c) => controller.update(c));
   }
+  const testEmailRateLimitMap = /* @__PURE__ */ new Map();
+  const TEST_EMAIL_MAX = 5;
+  const TEST_EMAIL_WINDOW_MS = 6e4;
+  const handleTestEmailDispatch = async (c) => {
+    const user = c.get("user");
+    const adminCol = config.collections.find((col) => col.slug === "__admins") || config.collections.find((col) => col.auth);
+    if (!isUserAdmin(user, adminCol)) {
+      return c.json({ error: true, message: "Forbidden: Admin access required to dispatch test emails" }, 403);
+    }
+    const userId = String(user?.id ?? user?.sub ?? "unknown");
+    const now2 = Date.now();
+    const window2 = (testEmailRateLimitMap.get(userId) ?? []).filter(
+      (ts) => now2 - ts < TEST_EMAIL_WINDOW_MS
+    );
+    if (window2.length >= TEST_EMAIL_MAX) {
+      return c.json(
+        { error: true, message: `Rate limit exceeded: maximum ${TEST_EMAIL_MAX} test emails per minute.` },
+        429
+      );
+    }
+    window2.push(now2);
+    testEmailRateLimitMap.set(userId, window2);
+    const body = await c.req.json().catch(() => ({}));
+    const {
+      to,
+      subject,
+      html,
+      format = "html",
+      externalTemplateId,
+      purpose = "invite",
+      collectionSlug = "users"
+    } = body;
+    if (!to || typeof to !== "string" || !to.includes("@")) {
+      return c.json({ error: true, message: "A valid recipient email address is required" }, 400);
+    }
+    const siteName = config.admin?.branding?.logoText || "Dyrected";
+    let appUrl = config.admin?.siteUrl;
+    if (!appUrl) {
+      try {
+        appUrl = new URL(c.req.url).origin;
+      } catch {
+        appUrl = "http://localhost:3000";
+      }
+    }
+    const targetCol = config.collections.find((x) => x.slug === collectionSlug);
+    const resolvedCollectionLabel = collectionSlug === "*" ? "Account" : targetCol?.labels?.singular || targetCol?.labels?.plural || (collectionSlug.startsWith("__") ? collectionSlug.slice(2).charAt(0).toUpperCase() + collectionSlug.slice(3) : collectionSlug.charAt(0).toUpperCase() + collectionSlug.slice(1));
+    const mockData = {
+      "{{url}}": `${appUrl}/auth/setup-password?token=mock_test_token_${Date.now()}`,
+      "{{token}}": `mock_test_token_${Date.now()}`,
+      "{{email}}": to,
+      "{{collectionLabel}}": resolvedCollectionLabel,
+      "{{siteName}}": siteName,
+      "{{user.name}}": typeof user?.name === "string" ? user.name : "Test Recipient",
+      "{{user.first_name}}": typeof user?.first_name === "string" ? user.first_name : "Test",
+      "{{user.email}}": to
+    };
+    try {
+      let result;
+      if (format === "external_template") {
+        if (!externalTemplateId) {
+          return c.json({ error: true, message: "External template ID is required when format is external_template" }, 400);
+        }
+        const variables = {
+          email: to,
+          url: `${appUrl}/auth/setup-password?token=mock_test_token_${Date.now()}`,
+          token: `mock_test_token_${Date.now()}`,
+          collection: collectionSlug,
+          collectionLabel: resolvedCollectionLabel,
+          siteName,
+          user: {
+            name: typeof user?.name === "string" ? user.name : "Test Recipient",
+            first_name: typeof user?.first_name === "string" ? user.first_name : "Test",
+            email: to
+          }
+        };
+        let testSubject = subject || `[TEST] ${purpose} email`;
+        for (const [tag, sample] of Object.entries(mockData)) {
+          testSubject = testSubject.split(tag).join(sample);
+        }
+        result = await sendEmail(config, {
+          to,
+          type: "template",
+          template: externalTemplateId,
+          variables,
+          subject: testSubject,
+          purpose,
+          collection: collectionSlug
+        });
+      } else {
+        let finalSubject = subject || `[TEST] ${purpose} email`;
+        let finalHtml = html || "";
+        for (const [tag, sample] of Object.entries(mockData)) {
+          finalSubject = finalSubject.split(tag).join(sample);
+          finalHtml = finalHtml.split(tag).join(sample);
+        }
+        result = await sendEmail(config, {
+          to,
+          type: "html",
+          subject: finalSubject,
+          html: finalHtml,
+          purpose,
+          collection: collectionSlug
+        });
+      }
+      return c.json({
+        success: true,
+        message: `Test email sent to ${to}`,
+        previewUrl: result?.previewUrl
+      });
+    } catch (err) {
+      getConfigLogger(config, "email").error({
+        err,
+        msg: "Failed to dispatch test email",
+        to
+      });
+      return c.json({ error: true, message: err.message || "Failed to send test email" }, 500);
+    }
+  };
+  app.post("/api/__email_templates/test", requireAuth(config), handleTestEmailDispatch);
+  app.post("/api/email-templates/test", requireAuth(config), handleTestEmailDispatch);
   if (!process.env.DYRECTED_JWT_SECRET) {
     getConfigLogger(config, "router").warn({
       msg: "DYRECTED_JWT_SECRET is not set; token-mode live preview is signing with an insecure default"
@@ -17377,6 +18247,114 @@ var AUTH_SESSIONS_COLLECTION_CONFIG = {
   },
   admin: { hidden: true }
 };
+var EMAIL_TEMPLATES_COLLECTION_SLUG = "__email_templates";
+var EMAIL_TEMPLATES_COLLECTION_CONFIG = {
+  slug: EMAIL_TEMPLATES_COLLECTION_SLUG,
+  labels: { singular: "Email Template", plural: "Email Templates" },
+  detail: false,
+  fields: [
+    {
+      name: "collectionSlug",
+      type: "select",
+      label: "Applies To",
+      required: true,
+      defaultValue: "*",
+      options: [
+        { label: "Global (All Users & Collections)", value: "*" }
+      ],
+      admin: {
+        description: "Choose which user collection this template applies to, or 'Global' for all users."
+      }
+    },
+    {
+      name: "purpose",
+      type: "select",
+      label: "Purpose",
+      required: true,
+      options: [
+        { label: "Invite", value: "invite" },
+        { label: "Password Reset", value: "resetPassword" },
+        { label: "Welcome", value: "welcome" },
+        { label: "Password Changed", value: "passwordChanged" }
+      ],
+      admin: { width: "50%" }
+    },
+    {
+      name: "format",
+      type: "select",
+      label: "Format",
+      required: true,
+      defaultValue: "html",
+      options: [
+        { label: "HTML", value: "html" },
+        { label: "External Template", value: "external_template" }
+      ],
+      admin: { width: "50%" }
+    },
+    {
+      name: "subject",
+      type: "text",
+      label: "Subject",
+      admin: {
+        description: "Subject line (optional when using external provider template)"
+      }
+    },
+    {
+      name: "rawHtml",
+      type: "textarea",
+      label: "HTML Content",
+      admin: {
+        description: "Raw HTML email content with {{variable}} tags"
+      }
+    },
+    {
+      name: "externalTemplateId",
+      type: "text",
+      label: "External Template ID",
+      admin: {
+        description: "Template ID or alias from Seamailer, Postmark, SendGrid, etc."
+      }
+    },
+    {
+      name: "active",
+      type: "boolean",
+      label: "Active",
+      defaultValue: true,
+      admin: {
+        description: "When active, this template overrides code config. When disabled, falls back to code."
+      }
+    }
+  ],
+  admin: {
+    group: "Settings",
+    icon: "Mail",
+    groupBy: "collectionSlug",
+    defaultColumns: ["purpose", "collectionSlug", "format", "active"]
+  },
+  hooks: {
+    beforeChange: [
+      async ({ data, req }) => {
+        if (data && data.format === "html") {
+          const siteName = req?.config?.admin?.branding?.logoText || "Dyrected";
+          const defaults = getDefaultEmailTemplate(data.purpose || "invite", { siteName });
+          if (!data.subject) {
+            data.subject = defaults.subject;
+          }
+          if (!data.rawHtml) {
+            data.rawHtml = defaults.rawHtml;
+          }
+        }
+        return data;
+      }
+    ]
+  },
+  access: {
+    read: ({ user }) => isUserAdmin(user),
+    create: ({ user }) => isUserAdmin(user),
+    update: ({ user }) => isUserAdmin(user),
+    delete: ({ user }) => isUserAdmin(user)
+  }
+};
 function normalizeConfig(config) {
   const schemaAwareConfig = normalizeSchemaFragment(config);
   assertValidDeclarativeHooksInConfig(schemaAwareConfig, "config");
@@ -17391,10 +18369,13 @@ function normalizeConfig(config) {
   const needsTasks = (config.tasks?.length ?? 0) > 0;
   const needsAuthSessions = collections.some((col) => !!col.auth);
   const needsTrash = schemaAwareConfig.trash?.enabled === true || collections.some((col) => resolveTrashConfig(col, schemaAwareConfig).enabled);
-  const adminAuthCollectionSlug = getAdminAuthCollection({
+  const adminAuthCollection = getAdminAuthCollection({
     collections,
     adminAuth: schemaAwareConfig.adminAuth
-  })?.slug;
+  });
+  const adminAuthCollectionSlug = adminAuthCollection?.slug;
+  const adminOnly = ({ user }) => isUserAdmin(user, adminAuthCollection);
+  const adminOtherThanSelf = ({ user, id }) => isUserAdmin(user, adminAuthCollection) && user?.id !== id;
   const normalizedCollections = collections.map((col) => {
     let fields = col.fields || [];
     const existingFieldNames = new Set(fields.map((f) => f.name));
@@ -17443,7 +18424,7 @@ function normalizeConfig(config) {
               { value: "viewer", label: "Viewer" }
             ],
             access: {
-              update: "user.role == 'admin' || (user.roles != null && 'admin' in user.roles)"
+              update: adminOnly
             }
           }
         ];
@@ -17461,7 +18442,7 @@ function normalizeConfig(config) {
               { value: "pending", label: "Pending" }
             ],
             access: {
-              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
+              update: adminOtherThanSelf
             },
             admin: {
               condition: `!(data.roles && "admin" in data.roles) && data.role != "admin"`
@@ -17530,7 +18511,7 @@ function normalizeConfig(config) {
             access: {
               ...field.access || {},
               // Must be an admin; cannot edit own roles (no self-elevation).
-              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
+              update: adminOtherThanSelf
             }
           };
         }
@@ -17539,7 +18520,7 @@ function normalizeConfig(config) {
             ...field,
             access: {
               ...field.access || {},
-              update: "(user.role == 'admin' || (user.roles != null && 'admin' in user.roles)) && user.id != id"
+              update: adminOtherThanSelf
             }
           };
         }
@@ -17631,6 +18612,52 @@ function normalizeConfig(config) {
   if (needsTrash && !normalizedCollections.some((col) => col.slug === TRASH_COLLECTION)) {
     systemCollections.push(TRASH_COLLECTION_CONFIG);
   }
+  const needsEmailTemplates = schemaAwareConfig.email?.adminEditable === true;
+  if (needsEmailTemplates && !normalizedCollections.some((col) => col.slug === EMAIL_TEMPLATES_COLLECTION_SLUG)) {
+    const adminCol = getAdminAuthCollection(schemaAwareConfig);
+    const customAccess = schemaAwareConfig.email?.access;
+    const resolveOpAccess = (op) => {
+      if (typeof customAccess === "function") return customAccess;
+      if (customAccess && typeof customAccess === "object" && customAccess[op]) return customAccess[op];
+      return ({ user }) => isUserAdmin(user, adminCol);
+    };
+    const customPurposes = schemaAwareConfig.email?.purposes ?? [];
+    const purposeOptions = [
+      { label: "Invite", value: "invite" },
+      { label: "Password Reset", value: "resetPassword" },
+      { label: "Welcome", value: "welcome" },
+      { label: "Password Changed", value: "passwordChanged" },
+      ...customPurposes
+    ];
+    const targetableCollections = normalizedCollections.filter(
+      (c) => !c.slug.startsWith("__")
+    );
+    const audienceOptions = [
+      { label: "Global (All Collections)", value: "*" },
+      ...targetableCollections.map((c) => ({
+        label: `${c.labels?.singular || c.labels?.plural || c.slug} (${c.slug})`,
+        value: c.slug
+      }))
+    ];
+    systemCollections.push({
+      ...EMAIL_TEMPLATES_COLLECTION_CONFIG,
+      fields: EMAIL_TEMPLATES_COLLECTION_CONFIG.fields.map((f) => {
+        if (f.name === "collectionSlug") {
+          return { ...f, options: audienceOptions };
+        }
+        if (f.name === "purpose") {
+          return { ...f, options: purposeOptions };
+        }
+        return f;
+      }),
+      access: {
+        read: resolveOpAccess("read"),
+        create: resolveOpAccess("create"),
+        update: resolveOpAccess("update"),
+        delete: resolveOpAccess("delete")
+      }
+    });
+  }
   return {
     ...schemaAwareConfig,
     collections: [...normalizedCollections, ...systemCollections],
@@ -17945,8 +18972,10 @@ init_embedding_service();
   AUTH_SESSIONS_COLLECTION,
   AuthController,
   CollectionController,
+  DEFAULT_INVITE_EXPIRY,
   DEFAULT_LOCK_TIME_MS,
   DEFAULT_MAX_LOGIN_ATTEMPTS,
+  DEFAULT_RESET_PASSWORD_EXPIRY,
   DEFAULT_SESSION_EXPIRY,
   EmbeddingService,
   GlobalController,
@@ -17978,13 +19007,16 @@ init_embedding_service();
   getAIModel,
   getAuthSession,
   getConfigLogger,
+  getDbEmailTemplateOverride,
   getEmbeddingModel,
   getLockedUntilMs,
   getObservabilityRuntime,
   getRequestLogger,
   hasEmbeddingApiKey,
+  hasUsablePassword,
   hashContent,
   hashPassword,
+  interpolateVariables,
   isAuthSessionActive,
   issueAuthSessionToken,
   normalizeFieldValue,
@@ -17993,7 +19025,10 @@ init_embedding_service();
   registerRoutes,
   renderPrometheusMetrics,
   resolveAuthLockoutConfig,
+  resolveEmailTemplate,
+  resolveInviteTokenExpiry,
   resolveObservabilityConfig,
+  resolveResetPasswordTokenExpiry,
   resolveSessionTokenExpiry,
   revokeAllAuthSessions,
   revokeAuthSession,
@@ -18003,6 +19038,7 @@ init_embedding_service();
   serializeViewForApi,
   shouldSampleRequest,
   signCollectionToken,
+  toOutboundEmail,
   touchAuthSession,
   validatePayloadAgainstFields,
   verifyCollectionToken,