@dyrected/core 2.24.2 → 2.25.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { F as Field, B as Block, C as CollectionConfig, D as DyrectedConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, G as GlobalConfig, a as DeclarativeHookExpression, W as WorkflowConfig, b as AuthenticatedUser, c as WorkflowTransition, L as LifecycleEventName, d as LifecycleEvent, e as DatabaseAdapter, f as BaseDocument, H as HookRequestContext, T as TaskRunResult, g as TaskConfig, h as DetailActionOptions, i as DetailAction, j as DetailComputedOptions, k as ComputedHandler, l as DetailComputed, m as DetailCustomOptions, n as DetailCustom, o as DetailDividerOptions, p as DetailDivider, q as DisplayFieldOptions, r as DetailField, s as DetailItem, t as DetailGridOptions, u as DetailGrid, v as DetailRepeatOptions, w as DetailRepeat, x as DetailSectionOptions, y as DetailSection, z as DetailTabOptions, E as DetailTab, I as DetailTabsOptions, J as DetailTabs, K as DetailTextOptions, M as DetailText, N as DetailSchema, O as DyrectedContext, Q as AIConfig, R as AIPIIConfig, S as IdStrategy, U as CompiledNavTree, V as CompiledNavItem, X as UserNavigationPreferences, Y as DefineWorkspaceOptions, Z as ViewConfig, _ as DateTimeField, $ as RelationshipField, a0 as SelectField, a1 as ArrayField, a2 as FieldType, a3 as BooleanField, a4 as AuthConfig, a5 as AccessPolicyResolver, a6 as DateField, a7 as TextField, a8 as EmailField, a9 as IconField, aa as ImageField, ab as JoinField, ac as JsonField, ad as MoneyField, ae as MultiSelectField, af as NumberField, ag as ObjectField, ah as RadioField, ai as RichTextField, aj as RowField, ak as TextareaField, al as TimeField, am as UrlField } from './app-Bg34iyUz.js';
-export { an as AIAction, ao as AIActionStatus, ap as AIActionType, aq as AIAuditActionType, ar as AIAuditRecord, as as AIChunk, at as AIMessage, au as AIPIIPattern, av as AIRateLimitResult, aw as AIRateLimitStore, ax as AIThread, ay as AIToolContext, az as AIToolDefinition, aA as AI_ACTIONS_COLLECTION, aB as AI_AUDIT_COLLECTION, aC as AI_CHUNKS_COLLECTION, aD as AI_MESSAGES_COLLECTION, aE as AI_THREADS_COLLECTION, aF as AccessConfig, aG as AccessFunction, aH as AccessFunctionArgs, aI as AccessResult, aJ as AccessRule, aK as ActionConfig, aL as ActionConfigBase, aM as ActionConfigWithHandler, aN as ActionConfigWithMutation, aO as ActionContext, aP as ActionType, aQ as AdminAuthAccessResolution, aR as AdminAuthClaimMapping, aS as AdminAuthMember, aT as AdminAuthProvider, aU as AdminAuthProviderMembersConfig, aV as AdminAuthProvisioningMode, aW as AdminAuthResolveAccessArgs, aX as AdminAuthResolvedIdentity, aY as AdminConfig, aZ as AdminDashboardComponentSlots, a_ as AdminIconName, a$ as AggregateArgs, b0 as AggregateCastType, b1 as AggregateCollectionResult, b2 as AggregateInput, b3 as AggregateOperation, b4 as AggregateResult, b5 as AppTrashConfig, b6 as BaseAdminAuthProvider, b7 as BaseFieldAdmin, b8 as BlockVariant, b9 as BlocksField, ba as BooleanFieldAdmin, bb as BooleanFormat, bc as CURRENT_NAV_PREFERENCES_VERSION, bd as CUSTOM_VIEW_FETCH_ALL_LIMIT, be as CalendarViewConfig, bf as CardsViewConfig, bg as CharacterLimitFieldAdmin, bh as CharacterLimitFieldConfig, bi as CollectionAfterChangeHook, bj as CollectionAfterDeleteHook, bk as CollectionAfterReadHook, bl as CollectionAfterReadHookEntry, bm as CollectionAfterRestoreHook, bn as CollectionAfterTransitionHook, bo as CollectionAfterTrashHook, bp as CollectionBeforeChangeHook, bq as CollectionBeforeChangeHookEntry, br as CollectionBeforeCommitHook, bs as CollectionBeforeDeleteHook, bt as CollectionBeforeReadHook, bu as CollectionBeforeReadHookEntry, bv as CollectionBeforeRestoreHook, bw as CollectionBeforeTransitionHook, bx as CollectionBeforeTrashHook, by as CollectionEmailConfig, bz as CollectionIndex, bA as CollectionListComponentSlots, bB as CollectionRAGConfig, bC as CollectionSchemaResult, bD as CollectionSummaryResult, bE as CollectionViewComponentSlots, bF as CompiledNavGroup, bG as CountOperation, bH as CustomAdminAuthProvider, bI as CustomViewConfig, bJ as CustomViewDataConfig, bK as DEFAULT_USER_NAV_PREFERENCES, bL as DateFieldAdmin, bM as DateFormat, bN as DefaultValueContext, bO as DefineActionOptions, bP as DefineCalendarViewOptions, bQ as DefineCardsViewOptions, bR as DefineCustomViewOptions, bS as DefineGanttViewOptions, bT as DefineKanbanViewOptions, bU as DefinePageInput, bV as DefineTableViewOptions, bW as DefineViewBaseOptions, bX as DefineViewOptions, bY as DetailSpan, bZ as DisplayTone, b_ as DisplayVariant, b$ as DistinctCountOperation, c0 as DistinctValuesOperation, c1 as DocumentFormComponentSlots, c2 as DynamicOptionItem, c3 as DynamicOptionsConfig, c4 as DynamicOptionsResolver, c5 as DynamicOptionsResolverArgs, c6 as DyrectedAIContext, c7 as DyrectedLoggerConfig, c8 as DyrectedObservabilityConfig, c9 as EmailFieldAdmin, ca as EmailTemplateArgs, cb as EmailTemplateResult, cc as FORM_SHELLS, cd as FieldAdminHooks, ce as FieldAdminOnChangeHook, cf as FieldAdminOnChangeHookArgs, cg as FieldAdminOptionsHook, ch as FieldAdminOptionsHookArgs, ci as FieldAdminOptionsHookResult, cj as FieldAfterReadHook, ck as FieldAfterReadHookArgs, cl as FieldBase, cm as FieldBeforeChangeHook, cn as FieldBeforeChangeHookArgs, co as FieldHook, cp as FieldHooks, cq as FileData, cr as FormShell, cs as GanttViewConfig, ct as GetDocumentResult, cu as GlobalAfterChangeHook, cv as GlobalAfterReadHook, cw as GlobalAfterReadHookEntry, cx as GlobalBeforeChangeHook, cy as GlobalBeforeChangeHookEntry, cz as GlobalBeforeReadHook, cA as GlobalBeforeReadHookEntry, cB as GlobalFormComponentSlots, cC as GlobalRAGConfig, cD as GlobalSchemaResult, cE as GlobalSummaryResult, cF as HeadingLevel, cG as HookFunction, cH as IconFieldAdmin, cI as ImageService, cJ as ImageTransformOptions, cK as InferAggregateResult, cL as JoinFieldAdmin, cM as JsonFieldAdmin, cN as JsonFormat, cO as KanbanViewConfig, cP as LIFECYCLE_EVENT_NAMES, cQ as LifecycleEventHandler, cR as LinkFormat, cS as MetricColor, cT as MoneyFieldAdmin, cU as MoneyFieldConfig, cV as MultiSelectFieldAdmin, cW as NamedAccessPolicy, cX as NavBadgeConfig, cY as NavGroup, cZ as NumberFieldAdmin, c_ as NumberFormat, c$ as NumberLimitFieldAdmin, d0 as NumberLimitFieldConfig, d1 as NumericOperation, d2 as NumericUpdateOperator, d3 as OIDCAdminAuthProvider, d4 as OptionFormat, d5 as OutboundEmail, d6 as PageAction, d7 as PageBreadcrumbItem, d8 as PageConfig, d9 as PaginatedResult, da as PinnedNavItemRef, db as PublicAdminAuthProvider, dc as QueryCollectionResult, dd as RAGSearchResult, de as RadioFieldAdmin, df as RateLimitConfig, dg as ReadonlyDatabaseAdapter, dh as RichTextFeature, di as RichTextFieldConfig, dj as SelectFieldAdmin, dk as SqlWhereResult, dl as StorageAdapter, dm as TableViewConfig, dn as TaskContext, dp as TaskLogger, dq as TaskRunStatus, dr as TextFieldAdmin, ds as TextFormat, dt as TextareaFieldAdmin, du as TrashConfig, dv as TrustProxyConfig, dw as TypedField, dx as UploadConfig, dy as UrlFieldAdmin, dz as UrlLinkValue, dA as ViewActionFeatures, dB as ViewComponentSlots, dC as ViewConfigBase, dD as ViewLayout, dE as ViewMetric, dF as ViewMetricGroupBy, dG as ViewMetricGroupByConfig, dH as ViewMetricTrendConfig, dI as ViewSubMetric, dJ as WhereClause, dK as WhereOperator, dL as WhereOperatorName, dM as WordLimitFieldAdmin, dN as WordLimitFieldConfig, dO as WorkflowMetadata, dP as WorkflowOnTransitionContext, dQ as WorkflowOnTransitionHook, dR as WorkflowRole, dS as WorkflowState, dT as WorkflowTransitionContext, dU as coerceBooleanWhere, dV as defineAction, dW as defineCalendarView, dX as defineCardsView, dY as defineCustomView, dZ as defineGanttView, d_ as defineKanbanView, d$ as definePage, e0 as defineTableView, e1 as defineView, e2 as defineWorkspace, e3 as isAICollection, e4 as parseMongoWhere, e5 as parseSqlWhere } from './app-Bg34iyUz.js';
+import { F as Field, B as Block, C as CollectionConfig, D as DyrectedConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, G as GlobalConfig, a as DeclarativeHookExpression, W as WorkflowConfig, b as AuthenticatedUser, c as WorkflowTransition, L as LifecycleEventName, d as LifecycleEvent, e as DatabaseAdapter, f as BaseDocument, H as HookRequestContext, T as TaskRunResult, g as TaskConfig, h as DetailActionOptions, i as DetailAction, j as DetailComputedOptions, k as ComputedHandler, l as DetailComputed, m as DetailCustomOptions, n as DetailCustom, o as DetailDividerOptions, p as DetailDivider, q as DisplayFieldOptions, r as DetailField, s as DetailItem, t as DetailGridOptions, u as DetailGrid, v as DetailRepeatOptions, w as DetailRepeat, x as DetailSectionOptions, y as DetailSection, z as DetailTabOptions, E as DetailTab, I as DetailTabsOptions, J as DetailTabs, K as DetailTextOptions, M as DetailText, N as DetailSchema, O as DyrectedContext, Q as AIConfig, R as AIPIIConfig, S as IdStrategy, U as CompiledNavTree, V as CompiledNavItem, X as UserNavigationPreferences, Y as NavigationRolePolicy, Z as DefineWorkspaceOptions, _ as ViewConfig, $ as AdminConfig, a0 as AdminStringKey, a1 as DateTimeField, a2 as RelationshipField, a3 as SelectField, a4 as ArrayField, a5 as FieldType, a6 as BooleanField, a7 as AuthConfig, a8 as AccessPolicyResolver, a9 as DateField, aa as TextField, ab as EmailField, ac as IconField, ad as ImageField, ae as JoinField, af as JsonField, ag as MoneyField, ah as MultiSelectField, ai as NumberField, aj as ObjectField, ak as RadioField, al as RichTextField, am as RowField, an as TextareaField, ao as TimeField, ap as UrlField } from './app-Ti5woUOq.js';
+export { aq as AIAction, ar as AIActionStatus, as as AIActionType, at as AIAuditActionType, au as AIAuditRecord, av as AIChunk, aw as AIMessage, ax as AIPIIPattern, ay as AIRateLimitResult, az as AIRateLimitStore, aA as AIThread, aB as AIToolContext, aC as AIToolDefinition, aD as AI_ACTIONS_COLLECTION, aE as AI_AUDIT_COLLECTION, aF as AI_CHUNKS_COLLECTION, aG as AI_MESSAGES_COLLECTION, aH as AI_THREADS_COLLECTION, aI as AccessConfig, aJ as AccessFunction, aK as AccessFunctionArgs, aL as AccessResult, aM as AccessRule, aN as ActionConfig, aO as ActionConfigBase, aP as ActionConfigWithHandler, aQ as ActionConfigWithMutation, aR as ActionContext, aS as ActionType, aT as AdminAuthAccessResolution, aU as AdminAuthClaimMapping, aV as AdminAuthMember, aW as AdminAuthProvider, aX as AdminAuthProviderMembersConfig, aY as AdminAuthProvisioningMode, aZ as AdminAuthResolveAccessArgs, a_ as AdminAuthResolvedIdentity, a$ as AdminDashboardComponentSlots, b0 as AdminIconName, b1 as AdminStrings, b2 as AggregateArgs, b3 as AggregateCastType, b4 as AggregateCollectionResult, b5 as AggregateInput, b6 as AggregateOperation, b7 as AggregateResult, b8 as AppTrashConfig, b9 as BaseAdminAuthProvider, ba as BaseFieldAdmin, bb as BlockVariant, bc as BlocksField, bd as BooleanFieldAdmin, be as BooleanFormat, bf as CURRENT_NAV_PREFERENCES_VERSION, bg as CUSTOM_VIEW_FETCH_ALL_LIMIT, bh as CalendarViewConfig, bi as CardsViewConfig, bj as CharacterLimitFieldAdmin, bk as CharacterLimitFieldConfig, bl as CollectionAfterChangeHook, bm as CollectionAfterDeleteHook, bn as CollectionAfterReadHook, bo as CollectionAfterReadHookEntry, bp as CollectionAfterRestoreHook, bq as CollectionAfterTransitionHook, br as CollectionAfterTrashHook, bs as CollectionBeforeChangeHook, bt as CollectionBeforeChangeHookEntry, bu as CollectionBeforeCommitHook, bv as CollectionBeforeDeleteHook, bw as CollectionBeforeReadHook, bx as CollectionBeforeReadHookEntry, by as CollectionBeforeRestoreHook, bz as CollectionBeforeTransitionHook, bA as CollectionBeforeTrashHook, bB as CollectionEmailConfig, bC as CollectionIndex, bD as CollectionListComponentSlots, bE as CollectionRAGConfig, bF as CollectionSchemaResult, bG as CollectionSummaryResult, bH as CollectionViewComponentSlots, bI as CompiledNavGroup, bJ as CountOperation, bK as CustomAdminAuthProvider, bL as CustomViewConfig, bM as CustomViewDataConfig, bN as DEFAULT_USER_NAV_PREFERENCES, bO as DateFieldAdmin, bP as DateFormat, bQ as DefaultValueContext, bR as DefineActionOptions, bS as DefineCalendarViewOptions, bT as DefineCardsViewOptions, bU as DefineCustomViewOptions, bV as DefineGanttViewOptions, bW as DefineKanbanViewOptions, bX as DefinePageInput, bY as DefineTableViewOptions, bZ as DefineViewBaseOptions, b_ as DefineViewOptions, b$ as DetailSpan, c0 as DisplayTone, c1 as DisplayVariant, c2 as DistinctCountOperation, c3 as DistinctValuesOperation, c4 as DocumentFormComponentSlots, c5 as DynamicOptionItem, c6 as DynamicOptionsConfig, c7 as DynamicOptionsResolver, c8 as DynamicOptionsResolverArgs, c9 as DyrectedAIContext, ca as DyrectedLoggerConfig, cb as DyrectedObservabilityConfig, cc as EmailFieldAdmin, cd as EmailTemplateArgs, ce as EmailTemplateResult, cf as FORM_SHELLS, cg as FieldAdminHooks, ch as FieldAdminOnChangeHook, ci as FieldAdminOnChangeHookArgs, cj as FieldAdminOptionsHook, ck as FieldAdminOptionsHookArgs, cl as FieldAdminOptionsHookResult, cm as FieldAfterReadHook, cn as FieldAfterReadHookArgs, co as FieldBase, cp as FieldBeforeChangeHook, cq as FieldBeforeChangeHookArgs, cr as FieldHook, cs as FieldHooks, ct as FileData, cu as FormShell, cv as GanttViewConfig, cw as GetDocumentResult, cx as GlobalAfterChangeHook, cy as GlobalAfterReadHook, cz as GlobalAfterReadHookEntry, cA as GlobalBeforeChangeHook, cB as GlobalBeforeChangeHookEntry, cC as GlobalBeforeReadHook, cD as GlobalBeforeReadHookEntry, cE as GlobalFormComponentSlots, cF as GlobalRAGConfig, cG as GlobalSchemaResult, cH as GlobalSummaryResult, cI as HeadingLevel, cJ as HookFunction, cK as IconFieldAdmin, cL as ImageService, cM as ImageTransformOptions, cN as InferAggregateResult, cO as JoinFieldAdmin, cP as JsonFieldAdmin, cQ as JsonFormat, cR as KanbanViewConfig, cS as LIFECYCLE_EVENT_NAMES, cT as LifecycleEventHandler, cU as LinkFormat, cV as MetricColor, cW as MoneyFieldAdmin, cX as MoneyFieldConfig, cY as MultiSelectFieldAdmin, cZ as NAVIGATION_POLICY_KEY, c_ as NamedAccessPolicy, c$ as NavBadgeConfig, d0 as NavGroup, d1 as NumberFieldAdmin, d2 as NumberFormat, d3 as NumberLimitFieldAdmin, d4 as NumberLimitFieldConfig, d5 as NumericOperation, d6 as NumericUpdateOperator, d7 as OIDCAdminAuthProvider, d8 as OptionFormat, d9 as OutboundEmail, da as PageAction, db as PageBreadcrumbItem, dc as PageConfig, dd as PaginatedResult, de as PinnedNavItemRef, df as PublicAdminAuthProvider, dg as QueryCollectionResult, dh as RAGSearchResult, di as RadioFieldAdmin, dj as RateLimitConfig, dk as ReadonlyDatabaseAdapter, dl as RichTextFeature, dm as RichTextFieldConfig, dn as SelectFieldAdmin, dp as SqlWhereResult, dq as StorageAdapter, dr as TableViewConfig, ds as TaskContext, dt as TaskLogger, du as TaskRunStatus, dv as TextFieldAdmin, dw as TextFormat, dx as TextareaFieldAdmin, dy as TrashConfig, dz as TrustProxyConfig, dA as TypedField, dB as UploadConfig, dC as UrlFieldAdmin, dD as UrlLinkValue, dE as ViewActionFeatures, dF as ViewComponentSlots, dG as ViewConfigBase, dH as ViewLayout, dI as ViewMetric, dJ as ViewMetricGroupBy, dK as ViewMetricGroupByConfig, dL as ViewMetricTrendConfig, dM as ViewSubMetric, dN as WhereClause, dO as WhereOperator, dP as WhereOperatorName, dQ as WordLimitFieldAdmin, dR as WordLimitFieldConfig, dS as WorkflowMetadata, dT as WorkflowOnTransitionContext, dU as WorkflowOnTransitionHook, dV as WorkflowRole, dW as WorkflowState, dX as WorkflowTransitionContext, dY as coerceBooleanWhere, dZ as defineAction, d_ as defineCalendarView, d$ as defineCardsView, e0 as defineCustomView, e1 as defineGanttView, e2 as defineKanbanView, e3 as definePage, e4 as defineTableView, e5 as defineView, e6 as defineWorkspace, e7 as isAICollection, e8 as parseMongoWhere, e9 as parseSqlWhere } from './app-Ti5woUOq.js';
 import jexl from 'jexl';
 import { Context } from 'hono';
 export { z } from 'zod';
@@ -1537,7 +1537,9 @@ interface ReconciledNavTree extends CompiledNavTree {
  * Reconciles developer-defined navigation tree from code (`baseTree`)
  * with operator personal/role preferences (`prefs`), ensuring:
  * 1. Sparse delta merging (newly deployed code resources are never dropped).
- * 2. User-created custom groups and operational workspaces are injected.
+ * 2. User-created custom groups and operational workspaces are injected. Items
+ *    already in the server tree keep the server's `access` and `badge`; a
+ *    preference can never replace them. Injected items are flagged `userDefined`.
  * 3. User visibility overrides (`hidden`) are respected.
  * 4. User ordering overrides (`groupOrder`, `itemOrder`) are applied.
  * 5. Pinned favorite shortcuts are extracted.
@@ -1550,12 +1552,46 @@ interface ReconcileNavigationOptions {
      * If false (default), hidden groups, items, and views are omitted.
      */
     includeHidden?: boolean;
+    /**
+     * If false, preferences can only reorder, rename, regroup or hide items that
+     * already exist in the base tree. Items and pins the base tree does not contain
+     * are ignored. Use this when the server has locked the user's menu to a role
+     * policy. Defaults to true.
+     */
+    allowUserItems?: boolean;
 }
 declare function reconcileNavigation(baseTree: CompiledNavTree | null | undefined, prefs: UserNavigationPreferences | null | undefined, schemas?: {
     collections?: Array<any>;
     globals?: Array<any>;
 }, options?: ReconcileNavigationOptions): ReconciledNavTree;
 
+/**
+ * Reduces a navigation preference to the parts that are safe to share as a
+ * role or global default: ordering, hiding, groups, and regrouped items that
+ * already exist in the server tree. Pinned shortcuts and any item the server
+ * tree does not contain (the publisher's own workspaces) are dropped, so
+ * publishing a layout can never smuggle the publisher's items to other users.
+ */
+declare function sanitizeNavigationLayout(prefs: UserNavigationPreferences | null | undefined, tree: CompiledNavTree): UserNavigationPreferences;
+/**
+ * Validates a stored or submitted role policy and returns a normalised copy,
+ * or `null` when the value is not a policy.
+ */
+declare function parseNavigationRolePolicy(value: unknown, tree: CompiledNavTree): NavigationRolePolicy | null;
+/**
+ * Applies the role menu policies that govern a user to their access-pruned tree.
+ *
+ * `policies` has one entry per role the user holds: the role's policy, or `null`
+ * when the role has none. The menu is locked only if every role has an enforced
+ * policy; a role without one leaves the user unrestricted, because policy narrows
+ * the menu and never grants access. A locked menu is the union of what the
+ * enforced roles allow, arranged by the first policy's layout.
+ *
+ * `access` is applied before this runs, so a policy can never reveal an item the
+ * user cannot access.
+ */
+declare function applyNavigationRolePolicies(tree: CompiledNavTree, policies: Array<NavigationRolePolicy | null | undefined>): CompiledNavTree;
+
 /**
  * System route prefixes reserved by Dyrected.
  * Cannot be used as operational workspace slugs.
@@ -1731,6 +1767,30 @@ declare function getDefaultEmailTemplate(purpose: "invite" | "resetPassword" | "
     rawHtml: string;
 };
 
+type BrandingSource = Pick<AdminConfig, "branding" | "meta" | "strings"> | null | undefined;
+/**
+ * The name of the product as editors should see it.
+ *
+ * Resolution order: `branding.appName`, `branding.logoText`, then the name inside
+ * `meta.titleSuffix` (without its leading `-` or `—`). Returns an empty string when
+ * none is set. It never returns "Dyrected", so white-labelled products do not show
+ * the underlying CMS name; callers decide what neutral wording to use instead.
+ *
+ * @example
+ * resolveAppName({ meta: { titleSuffix: '— Acme Admin' } }) // 'Acme Admin'
+ */
+declare function resolveAppName(admin: BrandingSource): string;
+/**
+ * The text appended to every admin page `<title>`: `meta.titleSuffix` when set,
+ * otherwise `- <app name>`, otherwise an empty string.
+ */
+declare function resolveTitleSuffix(admin: BrandingSource): string;
+/**
+ * Looks up an overridable admin string, replacing `{appName}` with the resolved app name.
+ * Returns `fallback` when the host did not override the key.
+ */
+declare function resolveAdminString(admin: BrandingSource, key: AdminStringKey, fallback: string): string;
+
 type TopLevelFieldName<TFields extends readonly Field[]> = Extract<TFields[number], {
     name: string;
 }>["name"];
@@ -2390,4 +2450,4 @@ declare function defineTab<const T extends readonly Field[]>(args: {
     fields: T;
 }): T;
 
-export { AIConfig, type AIErrorCode, AIPIIConfig, type AccessConditions, AccessPolicyResolver, AdminAuthConfig, type AdminComponentsValidationIssue, ArrayField, AuthConfig, type AuthDocFields, AuthenticatedUser, BASE62_ALPHABET, BUILTIN_JEXL_HELPERS, BaseDocument, Block, BooleanField, CROCKFORD_BASE32, CollectionConfig, CompiledNavItem, CompiledNavTree, ComputedHandler, type ConfigDiagnostic, ConfigValidationError, ConflictError, type CreatedAtFieldOptions, type CreatedByFieldOptions, DatabaseAdapter, DateField, DateTimeField, type DeclarativeAccessSurface, type DeclarativeAccessValidationIssue, type DeclarativeAdminSurface, type DeclarativeAdminValidationIssue, DeclarativeHookExpression, type DeclarativeHookSurface, type DeclarativeHookValidationIssue, type DeclarativePreviewSurface, type DeclarativePreviewValidationIssue, DefineWorkspaceOptions, DetailAction, DetailActionOptions, DetailComputed, DetailComputedOptions, DetailCustom, DetailCustomOptions, DetailDivider, DetailDividerOptions, DetailField, DetailGrid, DetailGridOptions, DetailItem, DetailRepeat, DetailRepeatOptions, DetailSchema, DetailSection, DetailSectionOptions, DetailTab, DetailTabOptions, DetailTabs, DetailTabsOptions, DetailText, DetailTextOptions, DisplayFieldOptions, DuplicateKeyError, DyrectedAIError, DyrectedConfig, DyrectedError, EMAIL_TEMPLATES_COLLECTION_CONFIG, EMAIL_TEMPLATES_COLLECTION_SLUG, EmailField, type ExprFunction, type ExtractCollectionSlugs, Field, FieldConditionBuilder, FieldType, ForbiddenError, type GenerateIdOptions, GlobalConfig, HookRequestContext, INTERNAL_SYSTEM_COLLECTIONS, IconField, IdStrategy, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, type LayoutOptions, LifecycleEvent, LifecycleEventName, MatchBuilder, MoneyField, MultiSelectField, NANOID_ALPHABET, NON_NEGOTIABLE_CREDENTIAL_FIELDS, NotFoundError, NumberField, ObjectField, PII_REGEX_PATTERNS, type Prettify, PublicAdminAuthConfig, type PublishingWorkflowOptions, RESERVED_NAVIGATION_SLUGS, RadioField, type ReconcileNavigationOptions, type ReconciledNavTree, type ReferencedComponentKeys, RelationshipField, type ResolvedTrashConfig, type RestoreDocumentOptions, RichTextField, type RoleOption, type RolesFieldOptions, RowField, type SanitizeDocForAIOptions, SelectField, type SoftDeleteOptions, type SortClause, type SortDirection, type SqlSortDialect, type SystemDocFields, TASK_LOCKS_COLLECTION, TASK_LOCKS_COLLECTION_CONFIG, TRASH_COLLECTION, TRASH_COLLECTION_CONFIG, TaskConfig, TaskRunResult, type TaskRunner, type TemplateBlock, TextField, TextareaField, TimeField, UNASSIGNED_GROUP_KEY, type UpdatedAtFieldOptions, type UpdatedByFieldOptions, type UploadDocFields, UrlField, UserNavigationPreferences, ValidationError, ViewConfig, WORKFLOW_HISTORY_COLLECTION, type WhenFunction, WorkflowConfig, WorkflowTransition, abs, addDays, alertBox, asCollection, assertValidAdminConditionsInConfig, assertValidDeclarativeAccessInConfig, assertValidDeclarativeHookExpression, assertValidDeclarativeHookResult, assertValidDeclarativeHooksInConfig, assertValidNavigationSlugs, assertValidPreviewUrlsInConfig, assertValidTrashInConfig, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, capitalize, ceil, clamp, coalesce, collectAdminComponentsValidationIssues, collectAdminConditionValidationIssues, collectConfigDiagnostics, collectDeclarativeAccessValidationIssues, collectDeclarativeHookValidationIssues, collectPreviewUrlValidationIssues, collectReferencedComponentKeys, compact, compileNavigation, count, createLifecycleEvent, createTaskRunner, createTrashPurgeTask, createWorkflowDocument, ctaButton, defaultValue, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineCreatedAtField, defineCreatedByField, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMoneyField, defineMultiSelectField, defineNumberField, defineObjectField, definePublishingWorkflow, defineRadioField, defineRelationshipField, defineRichTextField, defineRoles, defineRolesField, defineRowField, defineSelectField, defineTab, defineTask, defineTextField, defineTextareaField, defineTimeField, defineUpdatedAtField, defineUpdatedByField, defineUrlField, detailBox, diffDays, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, displayAction, displayComputed, displayCustom, displayCustomComponent, displayDivider, displayField, displayGrid, displayRepeat, displaySection, displayTab, displayTabs, displayText, divider, emailTokens, endsWith, escapeHtml, evaluateDetailComputed, evaluateJexl, evaluateJexlSync, eventList, executeFieldAfterRead, executeFieldBeforeChange, expr, first, floor, formatConfigDiagnostics, formatDate, formatJexlValue, generateDefaultDetailSchema, generateDocumentId, generateId, generateOpenApi, get, getAdminAuthCollection, getAdminRoleForCollection, getAllowedSitesForUser, getDefaultEmailTemplate, getPublicAdminAuthConfig, getTrashEntryId, heading, includes, initializeWorkflowDocument, isConfigValidationError, isDetailItemVisible, isEmpty, isFuture, isPast, isSiteAuthorized, isUserAdmin, join, last, layout, length, lower, maskEmail, maskPhone, maskTextPII, materializeWorkflowDocument, max, min, nanoid, nextCronRun, normalizeConfig, normalizeDetailItem, normalizeGroupKey, now, numericFieldNames, paragraph, parseCron, parseSort, pow, prefixedId, pruneNavigationByAccess, pruneNavigationForUser, publishedStateName, publishingWorkflow, readingTime, reconcileNavigation, registerJexlHelpers, replace, resolveAdminAuthCollection, resolveAllCollectionViews, resolveAuthorizedSiteId, resolveBlocks, resolveDocumentTitle, resolveIndexName, resolvePrefix, resolveTrashConfig, restoreDocument, round, row, runCollectionHooks, safeLinkDetailBox, sanitizeDocForAI, saveWorkflowDraft, sectionLabel, simplePublishingWorkflow, slugify, softDeleteDocument, spacer, sqrt, startsWith, sum, table, today, transitionWorkflow, trim, truncate, ulid, unique, upper, uuid, validateAdminConditionExpression, validateDeclarativeAccessExpression, validateDeclarativeHookExpression, validatePreviewUrlExpression, when, wordCount, workflowCapabilities };
+export { AIConfig, type AIErrorCode, AIPIIConfig, type AccessConditions, AccessPolicyResolver, AdminAuthConfig, type AdminComponentsValidationIssue, AdminConfig, AdminStringKey, ArrayField, AuthConfig, type AuthDocFields, AuthenticatedUser, BASE62_ALPHABET, BUILTIN_JEXL_HELPERS, BaseDocument, Block, BooleanField, CROCKFORD_BASE32, CollectionConfig, CompiledNavItem, CompiledNavTree, ComputedHandler, type ConfigDiagnostic, ConfigValidationError, ConflictError, type CreatedAtFieldOptions, type CreatedByFieldOptions, DatabaseAdapter, DateField, DateTimeField, type DeclarativeAccessSurface, type DeclarativeAccessValidationIssue, type DeclarativeAdminSurface, type DeclarativeAdminValidationIssue, DeclarativeHookExpression, type DeclarativeHookSurface, type DeclarativeHookValidationIssue, type DeclarativePreviewSurface, type DeclarativePreviewValidationIssue, DefineWorkspaceOptions, DetailAction, DetailActionOptions, DetailComputed, DetailComputedOptions, DetailCustom, DetailCustomOptions, DetailDivider, DetailDividerOptions, DetailField, DetailGrid, DetailGridOptions, DetailItem, DetailRepeat, DetailRepeatOptions, DetailSchema, DetailSection, DetailSectionOptions, DetailTab, DetailTabOptions, DetailTabs, DetailTabsOptions, DetailText, DetailTextOptions, DisplayFieldOptions, DuplicateKeyError, DyrectedAIError, DyrectedConfig, DyrectedError, EMAIL_TEMPLATES_COLLECTION_CONFIG, EMAIL_TEMPLATES_COLLECTION_SLUG, EmailField, type ExprFunction, type ExtractCollectionSlugs, Field, FieldConditionBuilder, FieldType, ForbiddenError, type GenerateIdOptions, GlobalConfig, HookRequestContext, INTERNAL_SYSTEM_COLLECTIONS, IconField, IdStrategy, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, type LayoutOptions, LifecycleEvent, LifecycleEventName, MatchBuilder, MoneyField, MultiSelectField, NANOID_ALPHABET, NON_NEGOTIABLE_CREDENTIAL_FIELDS, NavigationRolePolicy, NotFoundError, NumberField, ObjectField, PII_REGEX_PATTERNS, type Prettify, PublicAdminAuthConfig, type PublishingWorkflowOptions, RESERVED_NAVIGATION_SLUGS, RadioField, type ReconcileNavigationOptions, type ReconciledNavTree, type ReferencedComponentKeys, RelationshipField, type ResolvedTrashConfig, type RestoreDocumentOptions, RichTextField, type RoleOption, type RolesFieldOptions, RowField, type SanitizeDocForAIOptions, SelectField, type SoftDeleteOptions, type SortClause, type SortDirection, type SqlSortDialect, type SystemDocFields, TASK_LOCKS_COLLECTION, TASK_LOCKS_COLLECTION_CONFIG, TRASH_COLLECTION, TRASH_COLLECTION_CONFIG, TaskConfig, TaskRunResult, type TaskRunner, type TemplateBlock, TextField, TextareaField, TimeField, UNASSIGNED_GROUP_KEY, type UpdatedAtFieldOptions, type UpdatedByFieldOptions, type UploadDocFields, UrlField, UserNavigationPreferences, ValidationError, ViewConfig, WORKFLOW_HISTORY_COLLECTION, type WhenFunction, WorkflowConfig, WorkflowTransition, abs, addDays, alertBox, applyNavigationRolePolicies, asCollection, assertValidAdminConditionsInConfig, assertValidDeclarativeAccessInConfig, assertValidDeclarativeHookExpression, assertValidDeclarativeHookResult, assertValidDeclarativeHooksInConfig, assertValidNavigationSlugs, assertValidPreviewUrlsInConfig, assertValidTrashInConfig, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, capitalize, ceil, clamp, coalesce, collectAdminComponentsValidationIssues, collectAdminConditionValidationIssues, collectConfigDiagnostics, collectDeclarativeAccessValidationIssues, collectDeclarativeHookValidationIssues, collectPreviewUrlValidationIssues, collectReferencedComponentKeys, compact, compileNavigation, count, createLifecycleEvent, createTaskRunner, createTrashPurgeTask, createWorkflowDocument, ctaButton, defaultValue, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineCreatedAtField, defineCreatedByField, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMoneyField, defineMultiSelectField, defineNumberField, defineObjectField, definePublishingWorkflow, defineRadioField, defineRelationshipField, defineRichTextField, defineRoles, defineRolesField, defineRowField, defineSelectField, defineTab, defineTask, defineTextField, defineTextareaField, defineTimeField, defineUpdatedAtField, defineUpdatedByField, defineUrlField, detailBox, diffDays, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, displayAction, displayComputed, displayCustom, displayCustomComponent, displayDivider, displayField, displayGrid, displayRepeat, displaySection, displayTab, displayTabs, displayText, divider, emailTokens, endsWith, escapeHtml, evaluateDetailComputed, evaluateJexl, evaluateJexlSync, eventList, executeFieldAfterRead, executeFieldBeforeChange, expr, first, floor, formatConfigDiagnostics, formatDate, formatJexlValue, generateDefaultDetailSchema, generateDocumentId, generateId, generateOpenApi, get, getAdminAuthCollection, getAdminRoleForCollection, getAllowedSitesForUser, getDefaultEmailTemplate, getPublicAdminAuthConfig, getTrashEntryId, heading, includes, initializeWorkflowDocument, isConfigValidationError, isDetailItemVisible, isEmpty, isFuture, isPast, isSiteAuthorized, isUserAdmin, join, last, layout, length, lower, maskEmail, maskPhone, maskTextPII, materializeWorkflowDocument, max, min, nanoid, nextCronRun, normalizeConfig, normalizeDetailItem, normalizeGroupKey, now, numericFieldNames, paragraph, parseCron, parseNavigationRolePolicy, parseSort, pow, prefixedId, pruneNavigationByAccess, pruneNavigationForUser, publishedStateName, publishingWorkflow, readingTime, reconcileNavigation, registerJexlHelpers, replace, resolveAdminAuthCollection, resolveAdminString, resolveAllCollectionViews, resolveAppName, resolveAuthorizedSiteId, resolveBlocks, resolveDocumentTitle, resolveIndexName, resolvePrefix, resolveTitleSuffix, resolveTrashConfig, restoreDocument, round, row, runCollectionHooks, safeLinkDetailBox, sanitizeDocForAI, sanitizeNavigationLayout, saveWorkflowDraft, sectionLabel, simplePublishingWorkflow, slugify, softDeleteDocument, spacer, sqrt, startsWith, sum, table, today, transitionWorkflow, trim, truncate, ulid, unique, upper, uuid, validateAdminConditionExpression, validateDeclarativeAccessExpression, validateDeclarativeHookExpression, validatePreviewUrlExpression, when, wordCount, workflowCapabilities };

package/dist/index.js

@@ -1866,6 +1866,7 @@ var DyrectedAIError = class _DyrectedAIError extends Error {
 function defineWorkspace(options) {
   return options;
 }
+var NAVIGATION_POLICY_KEY = "admin:navigation-policy";
 var CURRENT_NAV_PREFERENCES_VERSION = 1;
 var DEFAULT_USER_NAV_PREFERENCES = {
   _version: CURRENT_NAV_PREFERENCES_VERSION,
@@ -4207,6 +4208,32 @@ function isUserAdmin(user, collection) {
   return false;
 }
 
+// src/utils/app-name.ts
+var SUFFIX_SEPARATOR = /^[\s\-\u2013\u2014|\u00b7:]+/;
+function resolveAppName(admin) {
+  const candidates = [
+    admin?.branding?.appName,
+    admin?.branding?.logoText,
+    admin?.meta?.titleSuffix?.replace(SUFFIX_SEPARATOR, "")
+  ];
+  for (const candidate of candidates) {
+    const value = typeof candidate === "string" ? candidate.trim() : "";
+    if (value) return value;
+  }
+  return "";
+}
+function resolveTitleSuffix(admin) {
+  const explicit = admin?.meta?.titleSuffix;
+  if (typeof explicit === "string") return explicit.trim();
+  const name = resolveAppName(admin);
+  return name ? `- ${name}` : "";
+}
+function resolveAdminString(admin, key, fallback) {
+  const override = admin?.strings?.[key];
+  const text = typeof override === "string" && override.trim() ? override : fallback;
+  return text.replace(/\{appName\}/g, resolveAppName(admin));
+}
+
 // src/utils/block-references.ts
 function mergeUniqueBlocks(blocks) {
   const seen = /* @__PURE__ */ new Map();
@@ -4576,7 +4603,7 @@ function layout({ preheader, title, content, footer, siteName }) {
       ${table(
     row(
       table(
-        row(" ", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${sectionLabel(siteName ?? "Dyrected")}${heading(title)}`, "padding:30px 32px 24px") + row(resolvedContent, "padding:0 32px 32px") + row(
+        row(" ", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${siteName?.trim() ? sectionLabel(siteName) : ""}${heading(title)}`, "padding:30px 32px 24px") + row(resolvedContent, "padding:0 32px 32px") + row(
           `${divider()}${paragraph(resolvedFooter, "20px 0 6px")}${paragraph("Privacy: this message contains account-related information; please avoid forwarding it.", "10px 0px 0px 0px", "12px")}`,
           "padding:0 32px 28px"
         ),
@@ -4591,14 +4618,15 @@ function layout({ preheader, title, content, footer, siteName }) {
 </html>`;
 }
 function getDefaultEmailTemplate(purpose, options) {
-  const siteName = options?.siteName ?? "Dyrected";
+  const siteName = options?.siteName?.trim() ?? "";
+  const account = siteName ? `${siteName} account` : "account";
   switch (purpose) {
     case "invite":
       return {
-        subject: `You've been invited to ${siteName}`,
+        subject: siteName ? `You've been invited to ${siteName}` : "You've been invited",
         rawHtml: layout({
           siteName,
-          preheader: `You've been invited to join ${siteName}.`,
+          preheader: siteName ? `You've been invited to join ${siteName}.` : "You've been invited to join.",
           title: "You've been invited",
           content: [
             paragraph("Use the invitation link below to create your account. The link expires in 7 days."),
@@ -4615,7 +4643,7 @@ function getDefaultEmailTemplate(purpose, options) {
         subject: "Reset your password",
         rawHtml: layout({
           siteName,
-          preheader: `Reset your ${siteName} password.`,
+          preheader: siteName ? `Reset your ${siteName} password.` : "Reset your password.",
           title: "Reset your password",
           content: [
             paragraph("We received a request to reset your password. The reset link expires in 1 hour."),
@@ -4629,10 +4657,10 @@ function getDefaultEmailTemplate(purpose, options) {
       };
     case "welcome":
       return {
-        subject: `Welcome to ${siteName} \u2014 your account is ready`,
+        subject: siteName ? `Welcome to ${siteName} \u2014 your account is ready` : "Welcome \u2014 your account is ready",
         rawHtml: layout({
           siteName,
-          preheader: `Your ${siteName} account is ready.`,
+          preheader: `Your ${account} is ready.`,
           title: "Welcome \u2014 your account is ready",
           content: [paragraph("Your account has been created. You can now log in with:"), detailBox("{{email}}")],
           footer: "If you didn't create this account, you can safely ignore this email."
@@ -4643,7 +4671,7 @@ function getDefaultEmailTemplate(purpose, options) {
         subject: "Your password has been changed",
         rawHtml: layout({
           siteName,
-          preheader: `Your ${siteName} password was changed.`,
+          preheader: siteName ? `Your ${siteName} password was changed.` : "Your password was changed.",
           title: "Password changed",
           content: [
             paragraph("The password for your account has been changed."),
@@ -4654,12 +4682,12 @@ function getDefaultEmailTemplate(purpose, options) {
       };
     default:
       return {
-        subject: `Notification from ${siteName}`,
+        subject: siteName ? `Notification from ${siteName}` : "Account notification",
         rawHtml: layout({
           siteName,
-          preheader: `Account notification from ${siteName}.`,
+          preheader: siteName ? `Account notification from ${siteName}.` : "Account notification.",
           title: "Account Notification",
-          content: [paragraph(`This is an account notification from ${siteName}.`)],
+          content: [paragraph(siteName ? `This is an account notification from ${siteName}.` : "This is an account notification.")],
           footer: "If you have any questions, please reach out to our team."
         })
       };
@@ -4895,7 +4923,7 @@ var EMAIL_TEMPLATES_COLLECTION_CONFIG = {
     beforeChange: [
       async ({ data, req }) => {
         if (data && data.format === "html") {
-          const siteName = req?.config?.admin?.branding?.logoText || "Dyrected";
+          const siteName = resolveAppName(req?.config?.admin);
           const defaults = getDefaultEmailTemplate(data.purpose || "invite", { siteName });
           if (!data.subject) {
             data.subject = defaults.subject;
@@ -5768,12 +5796,13 @@ function getGlobalTag(global) {
   return `Global: ${global.label || global.slug}`;
 }
 function generateOpenApi(config) {
+  const appName = resolveAppName(config.admin);
   const spec = {
     openapi: "3.0.0",
     info: {
-      title: "Dyrected API",
+      title: appName ? `${appName} API` : "API",
       version: "1.0.0",
-      description: "Automatically generated OpenAPI specification for the Dyrected project."
+      description: appName ? `Automatically generated OpenAPI specification for ${appName}.` : "Automatically generated OpenAPI specification for this project."
     },
     components: {
       schemas: {
@@ -5884,7 +5913,7 @@ function generateOpenApi(config) {
   spec.paths["/api/schemas"] = {
     get: {
       tags: ["System"],
-      summary: "Get the serialized Dyrected schema",
+      summary: "Get the serialized schema",
       security: [],
       responses: {
         200: { description: "Collection and global schema definitions" }
@@ -7982,6 +8011,7 @@ function reconcileNavigation(baseTree, prefs, schemas, options) {
     };
   }
   const includeHidden = options?.includeHidden ?? false;
+  const allowUserItems = options?.allowUserItems ?? true;
   const effectivePrefs = prefs || DEFAULT_USER_NAV_PREFERENCES;
   const hiddenSet = new Set(effectivePrefs.hidden || []);
   const knownCollectionSlugs = new Set((schemas?.collections || []).map((c) => c.slug));
@@ -8013,8 +8043,14 @@ function reconcileNavigation(baseTree, prefs, schemas, options) {
       });
     }
   }
+  const ungroupedKeys = /* @__PURE__ */ new Set();
+  for (const item of baseTree.ungrouped || []) {
+    ungroupedKeys.add(item.id);
+    if (item.slug) ungroupedKeys.add(item.slug);
+  }
   for (const itemOpt of effectivePrefs.items || []) {
     const itemId = itemOpt.slug ? `workspace_${itemOpt.slug}` : itemOpt.collection ? `collection_${itemOpt.collection}` : `custom_${Math.random()}`;
+    if (ungroupedKeys.has(itemId) || itemOpt.slug && ungroupedKeys.has(itemOpt.slug)) continue;
     let existingItem;
     let existingParentGroup;
     for (const g of groupsList) {
@@ -8025,6 +8061,7 @@ function reconcileNavigation(baseTree, prefs, schemas, options) {
         break;
       }
     }
+    if (!existingItem && !allowUserItems) continue;
     const targetGroup = typeof itemOpt.group === "object" ? itemOpt.group?.name : itemOpt.group || existingParentGroup?.name || "Custom";
     const groupKey = targetGroup;
     let group = findGroup(groupKey);
@@ -8054,7 +8091,7 @@ function reconcileNavigation(baseTree, prefs, schemas, options) {
     const baseViews = existingItem?.views || [];
     const userViews = (itemOpt.views || []).map((uv) => {
       const bv = baseViews.find((b) => b.slug === uv.slug);
-      if (!bv) return uv;
+      if (!bv) return { ...uv, access: void 0 };
       const metricsScope = uv.metricsScope ?? bv.metricsScope;
       let metrics = uv.metrics;
       if (Array.isArray(uv.metrics) && Array.isArray(bv.metrics)) {
@@ -8075,6 +8112,7 @@ function reconcileNavigation(baseTree, prefs, schemas, options) {
       return {
         ...bv,
         ...uv,
+        access: bv.access,
         metricsScope,
         metrics
       };
@@ -8111,10 +8149,12 @@ function reconcileNavigation(baseTree, prefs, schemas, options) {
       group: group.name,
       order: itemOpt.order ?? existingItem?.order ?? 100,
       views: mergedViews,
-      collection: itemOpt.collection || existingItem?.collection,
-      global: itemOpt.global || existingItem?.global,
-      badge: itemOpt.badge || existingItem?.badge,
-      access: itemOpt.access || existingItem?.access
+      collection: existingItem?.collection || itemOpt.collection,
+      global: existingItem?.global || itemOpt.global,
+      // Access and badges are policy/server-computed: only the server tree may set them.
+      badge: existingItem?.badge,
+      access: existingItem?.access,
+      ...existingItem ? existingItem.userDefined ? { userDefined: true } : {} : { userDefined: true }
     };
     if (existingIndex >= 0) {
       group.items[existingIndex] = compiledItem;
@@ -8213,7 +8253,7 @@ function reconcileNavigation(baseTree, prefs, schemas, options) {
         label: pin.label || match.label,
         icon: pin.icon || match.icon
       });
-    } else {
+    } else if (allowUserItems) {
       pinnedItems.push({
         id: `pin_${pin.slug}`,
         type: pin.type,
@@ -8232,6 +8272,61 @@ function reconcileNavigation(baseTree, prefs, schemas, options) {
   };
 }
 
+// src/utils/navigation-policy.ts
+var isStringArray = (value) => Array.isArray(value) && value.every((v) => typeof v === "string");
+var itemKeys = (item) => [item.id, ...item.slug ? [item.slug] : []];
+var allTreeItems = (tree) => [
+  ...tree.groups.flatMap((g) => g.items),
+  ...tree.ungrouped
+];
+function sanitizeNavigationLayout(prefs, tree) {
+  const known = new Set(allTreeItems(tree).flatMap(itemKeys));
+  return {
+    _version: CURRENT_NAV_PREFERENCES_VERSION,
+    hidden: isStringArray(prefs?.hidden) ? prefs.hidden : [],
+    groupOrder: isStringArray(prefs?.groupOrder) ? prefs.groupOrder : [],
+    itemOrder: Object.fromEntries(
+      Object.entries(prefs?.itemOrder ?? {}).filter(([, order]) => isStringArray(order))
+    ),
+    groups: Array.isArray(prefs?.groups) ? prefs.groups : [],
+    items: (Array.isArray(prefs?.items) ? prefs.items : []).filter((item) => {
+      if (item.slug) return known.has(item.slug) || known.has(`workspace_${item.slug}`);
+      if (item.collection) return known.has(`collection_${item.collection}`);
+      if (item.global) return known.has(`global_${item.global}`);
+      return false;
+    })
+  };
+}
+function parseNavigationRolePolicy(value, tree) {
+  if (!value || typeof value !== "object") return null;
+  const raw = value;
+  if (typeof raw.enforced !== "boolean" || !isStringArray(raw.allowed)) return null;
+  const layout2 = sanitizeNavigationLayout(raw.layout, tree);
+  return {
+    _version: CURRENT_NAV_PREFERENCES_VERSION,
+    enforced: raw.enforced,
+    allowed: raw.allowed,
+    layout: {
+      _version: layout2._version,
+      hidden: layout2.hidden,
+      groupOrder: layout2.groupOrder,
+      itemOrder: layout2.itemOrder,
+      groups: layout2.groups,
+      items: layout2.items
+    }
+  };
+}
+function applyNavigationRolePolicies(tree, policies) {
+  const enforced = policies.filter((p) => !!p?.enforced);
+  if (policies.length === 0 || enforced.length !== policies.length) return tree;
+  const allowed = new Set(enforced.flatMap((p) => p.allowed));
+  const isAllowed = (item) => itemKeys(item).some((key) => allowed.has(key));
+  const groups = tree.groups.map((g) => ({ ...g, items: g.items.filter(isAllowed) })).filter((g) => g.items.length > 0);
+  const filtered = { groups, ungrouped: tree.ungrouped.filter(isAllowed) };
+  const reconciled = reconcileNavigation(filtered, enforced[0].layout, void 0, { allowUserItems: false });
+  return { groups: reconciled.groups, ungrouped: reconciled.ungrouped, locked: true };
+}
+
 // src/utils/navigation.ts
 var RESERVED_NAVIGATION_SLUGS = /* @__PURE__ */ new Set([
   "collections",
@@ -8879,6 +8974,7 @@ export {
   LIFECYCLE_EVENT_NAMES,
   MatchBuilder,
   NANOID_ALPHABET,
+  NAVIGATION_POLICY_KEY,
   NON_NEGOTIABLE_CREDENTIAL_FIELDS,
   NotFoundError,
   PII_REGEX_PATTERNS,
@@ -8893,6 +8989,7 @@ export {
   abs,
   addDays,
   alertBox,
+  applyNavigationRolePolicies,
   asCollection,
   assertValidAdminConditionsInConfig,
   assertValidDeclarativeAccessInConfig,
@@ -9048,6 +9145,7 @@ export {
   paragraph,
   parseCron,
   parseMongoWhere,
+  parseNavigationRolePolicy,
   parseSort,
   parseSqlWhere,
   pow,
@@ -9061,12 +9159,15 @@ export {
   registerJexlHelpers,
   replace,
   resolveAdminAuthCollection,
+  resolveAdminString,
   resolveAllCollectionViews,
+  resolveAppName,
   resolveAuthorizedSiteId,
   resolveBlocks,
   resolveDocumentTitle,
   resolveIndexName,
   resolvePrefix,
+  resolveTitleSuffix,
   resolveTrashConfig,
   restoreDocument,
   round,
@@ -9074,6 +9175,7 @@ export {
   runCollectionHooks,
   safeLinkDetailBox,
   sanitizeDocForAI,
+  sanitizeNavigationLayout,
   saveWorkflowDraft,
   sectionLabel,
   simplePublishingWorkflow,