@dyrected/core 2.5.58 → 2.5.60

package/dist/app-config-Dkndq5ni.d.cts

@@ -0,0 +1,1580 @@
+import { icons } from 'lucide-react';
+
+/**
+ * Minimum HTTP request context passed to every server-side hook and resolver.
+ *
+ * The full Web Standard `Request` is available as `raw` when you need it, but
+ * most hooks only need `query` (URL search parameters).
+ */
+interface HookRequestContext {
+    /** Parsed URL query-string parameters, e.g. `{ page: '2', search: 'hello' }`. */
+    query: Record<string, string>;
+    /** Incoming HTTP headers, lowercased. */
+    headers: Record<string, string>;
+    /** The raw Web Standard `Request` object. Useful for streaming or advanced header inspection. */
+    raw?: Request;
+}
+/**
+ * Base shape of an authenticated user as decoded from the JWT.
+ *
+ * The actual shape will include every field on your auth collection — this
+ * interface only guarantees the properties that Dyrected always stamps on the
+ * token. Extend it in your own codebase for stronger typing:
+ *
+ * @example
+ * declare module '@dyrected/core' {
+ *   interface AuthenticatedUser {
+ *     role: 'admin' | 'editor'
+ *     organizationId: string
+ *   }
+ * }
+ */
+interface AuthenticatedUser {
+    /** The user's document ID in the database. */
+    sub: string;
+    /** The user's email address. */
+    email?: string;
+    /** Slug of the collection this user was authenticated against. */
+    collection: string;
+    /** Array of role strings, if your auth collection has a `roles` field. */
+    roles?: string[];
+    /** Any additional fields from the auth collection document. */
+    [key: string]: unknown;
+}
+
+interface AccessFunctionArgs<TDoc extends object = Record<string, unknown>, TUser extends AuthenticatedUser = AuthenticatedUser> {
+    user: TUser | undefined;
+    doc?: TDoc;
+    data?: Partial<TDoc>;
+    req: HookRequestContext;
+}
+interface NamedAccessPolicy<TDoc extends object = Record<string, unknown>> {
+    policy: string;
+    params?: Record<string, unknown>;
+}
+type AccessResult = boolean | Record<string, unknown>;
+/**
+ * A function that determines whether the current user can perform an operation.
+ *
+ * Return `true` to allow, `false` to deny.
+ * Return a `where`-style object to allow access only to matching documents
+ * (useful for multi-tenant setups where users can only see their own data).
+ *
+ * Can also be expressed as a Jexl expression **string** for simple role checks
+ * that need to be serialised (e.g. stored in the database or sent to the Admin UI).
+ *
+ * @template TDoc  The shape of the collection's document.
+ *
+ * @example
+ * // Simple role check
+ * access: {
+ *   delete: ({ user }) => user?.roles?.includes('admin') ?? false,
+ * }
+ *
+ * @example
+ * // Row-level: users can only read their own documents
+ * access: {
+ *   read: ({ user }) => ({ owner: { equals: user?.sub } }),
+ * }
+ *
+ * @example
+ * // Jexl string — evaluated server-side
+ * access: {
+ *   update: "user.roles contains 'editor'",
+ * }
+ */
+type AccessFunction<TDoc extends object = Record<string, unknown>, TUser extends AuthenticatedUser = AuthenticatedUser> = (args: AccessFunctionArgs<TDoc, TUser>) => AccessResult | Promise<AccessResult>;
+type AccessRule<TDoc extends object = Record<string, unknown>, TUser extends AuthenticatedUser = AuthenticatedUser> = boolean | string | AccessFunction<TDoc, TUser> | NamedAccessPolicy<TDoc>;
+type AccessPolicyResolver<TDoc extends object = Record<string, unknown>, TUser extends AuthenticatedUser = AuthenticatedUser> = (args: AccessFunctionArgs<TDoc, TUser> & {
+    params?: Record<string, unknown>;
+}) => AccessResult | Promise<AccessResult>;
+
+/**
+ * The minimum shape of every document returned by the database layer.
+ *
+ * All documents have an `id` field assigned by the adapter. Additional fields
+ * are stored as `unknown` until you narrow them with your own interface.
+ *
+ * Use this as the base when declaring your collection document types:
+ * ```ts
+ * interface Post extends BaseDocument {
+ *   title: string
+ *   slug: string
+ * }
+ * ```
+ */
+interface BaseDocument {
+    /** The document's unique identifier, assigned by the database adapter. */
+    id: string;
+    [key: string]: any;
+}
+/**
+ * The envelope returned by collection list endpoints (`GET /api/collections/:slug`).
+ *
+ * @template T  The document type.
+ */
+interface PaginatedResult<T = Record<string, any>> {
+    /** The documents on the current page. */
+    docs: T[];
+    /** Total number of documents matching the query (across all pages). */
+    total: number;
+    /** Maximum number of documents per page as requested. */
+    limit: number;
+    /** The current page number (1-indexed). */
+    page: number;
+    /** Total number of pages given the current `limit`. */
+    totalPages: number;
+    /** Whether a next page exists. */
+    hasNextPage: boolean;
+    /** Whether a previous page exists. */
+    hasPrevPage: boolean;
+}
+/**
+ * Metadata returned after a file is uploaded and stored.
+ * Stored on the document in upload collections.
+ */
+interface FileData {
+    filename: string;
+    filesize?: number;
+    mimeType: string;
+    /** Public URL of the stored file. */
+    url: string;
+    width?: number;
+    height?: number;
+    focalPoint?: {
+        x: number;
+        y: number;
+    };
+    /** Base64-encoded BlurHash string for progressive image loading. */
+    blurhash?: string;
+    /** `'upload'` for server-stored files; `'external'` for provider-managed files. */
+    type?: "upload" | "external";
+    provider?: string;
+    provider_metadata?: unknown;
+    [key: string]: unknown;
+}
+
+/** A valid icon component name from the Lucide icon set bundled with Dyrected Admin. */
+type AdminIconName = keyof typeof icons;
+/** Ordered custom component keys rendered around the built-in Admin dashboard. */
+interface AdminDashboardComponentSlots {
+    beforeDashboard?: string[];
+    afterDashboard?: string[];
+}
+/** Ordered custom component keys rendered around a collection's list content. */
+interface CollectionListComponentSlots {
+    beforeList?: string[];
+    beforeListTable?: string[];
+    afterListTable?: string[];
+    afterList?: string[];
+}
+/**
+ * Branding and metadata options for the Dyrected Admin UI.
+ *
+ * @example
+ * admin: {
+ *   branding: {
+ *     logo: '/logo.svg',
+ *     primaryColor: '#6366f1',
+ *   },
+ *   meta: {
+ *     titleSuffix: '- My App',
+ *   },
+ * }
+ */
+interface AdminConfig {
+    /** Custom component slots around the built-in dashboard. */
+    components?: AdminDashboardComponentSlots;
+    branding?: {
+        /** Full logo image shown in the expanded sidebar. URL or imported image asset. */
+        logo?: string;
+        /** Compact logo mark used in the collapsed sidebar state. */
+        logoMark?: string;
+        /** Text alternative or addition to the logo image. */
+        logoText?: string;
+        /**
+         * Primary accent colour as any CSS colour value.
+         * @example '#6366f1'
+         * @example 'hsl(240 50% 60%)'
+         */
+        primaryColor?: string;
+        /** Browser tab favicon URL. */
+        favicon?: string;
+        /** Font family for body and UI text. Must be loaded separately. */
+        fontSans?: string;
+        /** Font family for headings. Must be loaded separately. */
+        fontSerif?: string;
+    };
+    meta?: {
+        /**
+         * String appended to every Admin page's `<title>`.
+         * @default '- Dyrected'
+         */
+        titleSuffix?: string;
+    };
+    /**
+     * The canonical/base URL of the frontend website for links and iframe live previews.
+     */
+    siteUrl?: string;
+}
+
+/**
+ * @deprecated Use {@link FieldBeforeChangeHook} or `FieldAfterReadHook` instead.
+ * This alias remains for backwards compatibility.
+ */
+type FieldHook<TDoc extends object = Record<string, unknown>, TValue = unknown> = FieldBeforeChangeHook<TValue, TDoc>;
+/**
+ * Runs before Dyrected queries the database for a list or single-document fetch.
+ *
+ * Return a new `where` query object to override or extend the current filter.
+ * Return `undefined` (or nothing) to leave the query unchanged.
+ */
+type CollectionBeforeReadHook = (args: {
+    req: HookRequestContext;
+    query?: Record<string, unknown>;
+    user?: AuthenticatedUser;
+    db: ReadonlyDatabaseAdapter;
+}) => Record<string, unknown> | void | Promise<Record<string, unknown> | void>;
+/**
+ * Runs after a document (or list of documents) is fetched from the database,
+ * before the response is sent to the client.
+ */
+type CollectionAfterReadHook<TDoc extends object = Record<string, unknown>> = (args: {
+    doc: TDoc;
+    req: HookRequestContext;
+    user?: AuthenticatedUser;
+    db: ReadonlyDatabaseAdapter;
+}) => TDoc | Promise<TDoc>;
+/**
+ * Runs **before** a document is created or updated in the database.
+ */
+type CollectionBeforeChangeHook<TDoc extends object = Record<string, unknown>> = (args: {
+    data: Partial<TDoc>;
+    doc?: TDoc;
+    req: HookRequestContext;
+    user?: AuthenticatedUser;
+    operation: "create" | "update";
+    db: ReadonlyDatabaseAdapter;
+}) => Partial<TDoc> | void | Promise<Partial<TDoc> | void>;
+/**
+ * Runs **after** a document is created or updated in the database.
+ */
+type CollectionAfterChangeHook<TDoc extends object = Record<string, unknown>> = (args: {
+    doc: TDoc;
+    previousDoc?: TDoc;
+    req: HookRequestContext;
+    user?: AuthenticatedUser;
+    operation: "create" | "update";
+    db: DatabaseAdapter;
+}) => void | Promise<void>;
+/**
+ * Runs **before** a document is deleted from the database.
+ */
+type CollectionBeforeDeleteHook<TDoc extends object = Record<string, unknown>> = (args: {
+    id: string;
+    doc: TDoc;
+    req: HookRequestContext;
+    user?: AuthenticatedUser;
+    db: ReadonlyDatabaseAdapter;
+}) => void | Promise<void>;
+/**
+ * Runs **after** a document has been deleted from the database.
+ */
+type CollectionAfterDeleteHook<TDoc extends object = Record<string, unknown>> = (args: {
+    id: string;
+    doc: TDoc;
+    req: HookRequestContext;
+    user?: AuthenticatedUser;
+    db: DatabaseAdapter;
+}) => void | Promise<void>;
+/** @see {@link CollectionBeforeReadHook} */
+type GlobalBeforeReadHook = CollectionBeforeReadHook;
+/**
+ * Runs after the global document is fetched, before the response is sent.
+ */
+type GlobalAfterReadHook<TDoc extends object = Record<string, unknown>> = (args: {
+    doc: TDoc;
+    req: HookRequestContext;
+    user?: AuthenticatedUser;
+    db: ReadonlyDatabaseAdapter;
+}) => TDoc | Promise<TDoc>;
+/**
+ * Runs before the global document is updated.
+ * Operation is always `'update'` (globals cannot be created or deleted).
+ */
+type GlobalBeforeChangeHook<TDoc extends object = Record<string, unknown>> = (args: {
+    data: Partial<TDoc>;
+    doc?: TDoc;
+    req: HookRequestContext;
+    user?: AuthenticatedUser;
+    operation: "update";
+    db: ReadonlyDatabaseAdapter;
+}) => Partial<TDoc> | void | Promise<Partial<TDoc> | void>;
+/**
+ * Runs after the global document is updated. Side-effects only.
+ */
+type GlobalAfterChangeHook<TDoc extends object = Record<string, unknown>> = (args: {
+    doc: TDoc;
+    previousDoc?: TDoc;
+    req: HookRequestContext;
+    user?: AuthenticatedUser;
+    operation: "update";
+    db: DatabaseAdapter;
+}) => void | Promise<void>;
+/**
+ * @deprecated Use the specific hook types instead:
+ * `CollectionBeforeChangeHook`, `CollectionAfterReadHook`, etc.
+ *
+ * This broad type remains for backwards compatibility with the internal hook runner.
+ */
+type HookFunction<TDoc extends object = Record<string, unknown>> = (args: {
+    data?: Partial<TDoc>;
+    doc?: TDoc;
+    user?: AuthenticatedUser;
+    req?: HookRequestContext;
+    operation?: "create" | "update" | "delete";
+    db?: DatabaseAdapter;
+    [key: string]: unknown;
+}) => unknown | Promise<unknown>;
+
+declare const LIFECYCLE_EVENT_NAMES: readonly ["revision.created", "workflow.transitioned", "entry.published", "entry.unpublished"];
+type LifecycleEventName = (typeof LIFECYCLE_EVENT_NAMES)[number];
+interface WorkflowState {
+    /** Stable machine-readable state key. */
+    name: string;
+    /** Label rendered in the Admin UI. */
+    label: string;
+    /** Marks the state whose revision is visible to public readers. */
+    published?: boolean;
+    /** Optional visual tone used by the Admin UI. */
+    color?: "neutral" | "warning" | "success" | "danger" | "info";
+}
+interface WorkflowTransition {
+    /** Stable transition key used by the REST and SDK APIs. */
+    name: string;
+    label: string;
+    from: string | string[];
+    to: string;
+    /** Every listed capability is required. */
+    requiredCapabilities?: string[];
+    /** Require a non-empty comment when performing the transition. */
+    requireComment?: boolean;
+    /** Remove the public snapshot after this transition commits. */
+    unpublish?: boolean;
+}
+interface WorkflowRole {
+    /** Existing user role value, for example `editor` or `publisher`. */
+    role: string;
+    capabilities: string[];
+}
+interface WorkflowConfig<TDoc extends object = Record<string, unknown>> {
+    initialState: string;
+    /** State used for a new working revision created from published content. */
+    draftState?: string;
+    states: WorkflowState[];
+    transitions: WorkflowTransition[];
+    /** Maps values in `user.roles` to workflow capabilities. */
+    roles?: WorkflowRole[];
+    hooks?: {
+        beforeTransition?: CollectionBeforeTransitionHook<TDoc>[];
+        afterTransition?: CollectionAfterTransitionHook<TDoc>[];
+    };
+}
+interface WorkflowMetadata {
+    state: string;
+    revision: number;
+    publishedRevision?: number;
+    publishedAt?: string;
+    publishedBy?: string;
+    /** Transitions currently allowed for the requesting user. Response-only. */
+    availableTransitions?: string[];
+}
+interface WorkflowTransitionContext<TDoc extends object = Record<string, unknown>> {
+    transition: WorkflowTransition;
+    from: string;
+    to: string;
+    doc: TDoc;
+    user?: AuthenticatedUser;
+    comment?: string;
+    req: HookRequestContext;
+    db: DatabaseAdapter;
+}
+type CollectionBeforeTransitionHook<TDoc extends object = Record<string, unknown>> = (args: WorkflowTransitionContext<TDoc>) => void | Promise<void>;
+type CollectionAfterTransitionHook<TDoc extends object = Record<string, unknown>> = (args: WorkflowTransitionContext<TDoc> & {
+    event: LifecycleEvent;
+}) => void | Promise<void>;
+interface LifecycleEvent<TPayload = Record<string, unknown>> {
+    id: string;
+    name: LifecycleEventName;
+    collection: string;
+    documentId: string;
+    occurredAt: string;
+    actorId?: string;
+    payload: TPayload;
+    attempts: number;
+    status: "pending" | "processing" | "delivered" | "failed";
+    nextAttemptAt?: string;
+    deliveredAt?: string;
+    lastError?: string;
+}
+type LifecycleEventHandler = (event: LifecycleEvent) => void | Promise<void>;
+
+/**
+ * Use this contract when you want the exact shape of a collection config.
+ *
+ * Most collection work comes down to a small set of top-level options: giving
+ * the collection a stable slug, defining its fields, deciding how it should
+ * appear in the Admin UI, and choosing whether it also handles access, hooks,
+ * auth, uploads, workflows, or other optional behavior.
+ *
+ * Pass your document's TypeScript type as the generic parameter `TDoc` to get
+ * fully typed hooks and access functions.
+ *
+ * @example
+ * ```ts
+ * interface Post {
+ *   id: string
+ *   title: string
+ *   slug: string
+ *   status: 'draft' | 'published'
+ *   publishedAt?: string
+ * }
+ *
+ * export const Posts = defineCollection<Post>({
+ *   slug: 'posts',
+ *   hooks: {
+ *     beforeChange: [({ data, operation }) => {
+ *       // `data` is typed as Partial<Post>
+ *       if (operation === 'create') return { ...data, status: 'draft' }
+ *       return data
+ *     }],
+ *     afterChange: [({ doc, previousDoc }) => {
+ *       // `doc` and `previousDoc` are typed as Post
+ *       if (doc.status !== previousDoc?.status) notifySubscribers(doc)
+ *     }],
+ *   },
+ *   fields: [...],
+ * })
+ * ```
+ *
+ * @see {@link https://dyrected.com/new-docs/basics/configuration/collections Collections documentation}
+ * @template TDoc The TypeScript shape of a document in this collection.
+ * Defaults to `Record<string, unknown>` for untyped usage.
+ */
+interface CollectionConfig<TDoc extends object = Record<string, unknown>> {
+    /**
+     * Unique identifier for this collection.
+     *
+     * Dyrected uses the slug for API routes, SDK calls, Admin URLs, and as the
+     * underlying database table or collection name. Treat it as part of the
+     * long-term data contract rather than a cosmetic label.
+     *
+     * Use kebab-case, for example `'blog-posts'`, `'team-members'`, or
+     * `'contact-submissions'`.
+     */
+    slug: string;
+    /**
+     * Restricts this collection to one specific site in a multi-tenant setup.
+     *
+     * Use this when the collection should belong to a single site rather than
+     * the whole installation. When set, only requests bearing a matching
+     * `X-Site-Id` header can access it.
+     */
+    siteId?: string;
+    /**
+     * If `true`, this collection is shared across all sites in a multi-tenant
+     * setup and accessible regardless of the `X-Site-Id` header.
+     *
+     * Use this for content that should stay common across sites, such as shared
+     * taxonomies, reusable assets, or centrally managed reference data.
+     */
+    shared?: boolean;
+    /**
+     * Human-readable names for documents in this collection, shown in the Admin UI.
+     *
+     * Use this when the slug is technical or when you want the dashboard to read
+     * more naturally. For example, `slug: 'people'` might use
+     * `labels: { singular: 'Person', plural: 'People' }`.
+     *
+     * @see {@link https://dyrected.com/new-docs/basics/configuration/collections#labels Collections labels}
+     */
+    labels?: {
+        singular: string;
+        plural: string;
+    };
+    /**
+     * If `true`, this collection is an auth collection. It gains
+     * `POST /api/collections/:slug/login` and `POST /api/collections/:slug/logout`
+     * endpoints, and documents are expected to have a `password` field.
+     *
+     * Turn this on when each document should behave like an account that can log
+     * in, hold credentials, and participate in user flows. Typical examples are
+     * `users`, `admins`, `members`, or `customers`.
+     *
+     * @see {@link https://dyrected.com/new-docs/features/authentication/overview Authentication overview}
+     */
+    auth?: boolean;
+    /**
+     * If `true` or a config object, this collection supports file uploads.
+     * Documents gain file-related fields (`url`, `filename`, `mimeType`, etc.)
+     * and the create endpoint accepts `multipart/form-data`.
+     *
+     * Turn this on when each document in the collection should represent a
+     * stored file, such as an image, PDF, video, or downloadable asset.
+     *
+     * @see {@link https://dyrected.com/new-docs/features/upload/overview Upload overview}
+     */
+    upload?: boolean | UploadConfig;
+    /**
+     * Field definitions that make up the document schema for this collection.
+     *
+     * This is the main schema contract for every document in the collection. It
+     * decides what editors can fill in, how data is validated, how records are
+     * stored, and what the API and SDK return.
+     *
+     * In practice, fields are where you model the actual content structure of the
+     * collection: simple values such as text and dates, relationships to other
+     * collections, nested objects and arrays, and flexible `blocks` fields for
+     * reusable page sections or long-form layouts.
+     *
+     * @see {@link https://dyrected.com/new-docs/basics/fields/overview Fields overview}
+     * @see {@link https://dyrected.com/new-docs/basics/fields/blocks Blocks and page sections}
+     */
+    fields: Field[];
+    /**
+     * If `true`, Dyrected automatically adds the built-in system fields
+     * `createdAt`, `updatedAt`, `createdBy`, and `updatedBy` to every document.
+     * Defaults to `true`.
+     */
+    timestamps?: boolean;
+    /**
+     * Initial documents to seed into this collection the first time it is
+     * fetched and found to be empty.
+     *
+     * Use this for starter records, demo content, or sensible defaults that
+     * should appear automatically before editors create anything themselves.
+     */
+    initialData?: Partial<TDoc>[];
+    /**
+     * If `true`, every create, update, and delete operation on this collection
+     * is logged to the `__audit` collection with before/after snapshots and the
+     * acting user's identity.
+     *
+     * Turn this on when you need accountability around changes, such as knowing
+     * who changed what, inspecting before-and-after state, or supporting
+     * compliance and operational review.
+     */
+    audit?: boolean;
+    /**
+     * Optional state-machine workflow for this collection. Workflow-enabled
+     * entries keep an editable working revision and an independent public
+     * snapshot, so editing published content never changes the live response.
+     *
+     * Use this when content moves through stages such as draft, review, and
+     * published, or when teams need an approval process before changes go live.
+     */
+    workflow?: WorkflowConfig<TDoc>;
+    /**
+     * Collection-level access control.
+     *
+     * Each key is an operation; the value can be a function, a Jexl string, a
+     * boolean, or a named policy reference. Returning `true` allows access and
+     * `false` denies it. Returning a `where`-style object grants access only to
+     * matching documents.
+     *
+     * @example
+     * access: {
+     *   read: () => true,
+     *   create: ({ user }) => !!user,
+     *   update: ({ user }) => user?.roles?.includes('editor') ?? false,
+     *   delete: ({ user }) => user?.roles?.includes('admin') ?? false,
+     * }
+     *
+     * @see {@link https://dyrected.com/new-docs/basics/access-control/overview Access control overview}
+     */
+    access?: {
+        read?: AccessRule<TDoc>;
+        create?: AccessRule<TDoc>;
+        update?: AccessRule<TDoc>;
+        delete?: AccessRule<TDoc>;
+        /**
+         * Controls who can read this collection's audit log (`GET /:slug/__audit`),
+         * for collections with `audit` enabled. Falls back to the `read` rule when
+         * omitted, so the audit trail is visible to whoever can read the documents.
+         * Set it explicitly to gate the audit log separately — for example, admins
+         * only, even on a collection anyone can read.
+         */
+        readAudit?: AccessRule<TDoc>;
+    };
+    /**
+     * Collection-level lifecycle hooks.
+     *
+     * Hooks run in the order they appear in the array. The return value of each
+     * hook is passed as the input to the next. Throwing inside any hook aborts
+     * the operation and returns a `500` error.
+     *
+     * See the Hooks reference for the full lifecycle diagram.
+     *
+     * @see {@link https://dyrected.com/new-docs/basics/hooks/overview Hooks overview}
+     * @see {@link https://dyrected.com/new-docs/basics/hooks/collections Collection hooks}
+     */
+    hooks?: {
+        /**
+         * Runs before the database is queried. Return a modified `where` object
+         * to override the query filter.
+         */
+        beforeRead?: CollectionBeforeReadHook[];
+        /**
+         * Runs after documents are fetched. Return a modified doc to change what
+         * the client receives. Runs on every document in a list response.
+         */
+        afterRead?: CollectionAfterReadHook<TDoc>[];
+        /**
+         * Runs before create or update. Return modified data to change what is
+         * written to the database. Throw to abort the write entirely.
+         */
+        beforeChange?: CollectionBeforeChangeHook<TDoc>[];
+        /**
+         * Runs after create or update is committed. For side-effects only:
+         * webhooks, cache busting, and notifications. Return value is ignored.
+         *
+         * Errors are isolated: caught, logged, and discarded so a failing
+         * side-effect never turns a successful write into an HTTP 500.
+         * See `CollectionAfterChangeHook` for await-vs-fire-and-forget guidance.
+         */
+        afterChange?: CollectionAfterChangeHook<TDoc>[];
+        /** Runs before a document is deleted. Throw to cancel the deletion. */
+        beforeDelete?: CollectionBeforeDeleteHook<TDoc>[];
+        /**
+         * Runs after a document has been deleted. For cleanup side-effects only.
+         *
+         * Errors are isolated: caught, logged, and discarded. The deletion is
+         * already committed and will not be undone.
+         */
+        afterDelete?: CollectionAfterDeleteHook<TDoc>[];
+    };
+    /**
+     * Admin UI configuration for this collection.
+     *
+     * @see {@link https://dyrected.com/new-docs/basics/configuration/collections#admin-options Admin options}
+     */
+    admin?: {
+        /**
+         * Lucide icon displayed beside this collection in the Admin sidebar.
+         * Uses Lucide component names, e.g. `'Newspaper'` or `'ShoppingBag'`.
+         */
+        icon?: AdminIconName;
+        /** Custom component slots for this collection's list view. */
+        components?: CollectionListComponentSlots;
+        /**
+         * The field name used as the document's display title in the Admin list
+         * view and breadcrumbs. Defaults to `'title'` if the field exists.
+         */
+        useAsTitle?: string;
+        /**
+         * Field names to show as columns in the Admin list view.
+         * Defaults to a sensible set of the first few non-structural fields.
+         */
+        defaultColumns?: string[];
+        /**
+         * Groups this collection under a named section in the Admin sidebar.
+         * Collections with the same `group` are visually grouped together.
+         */
+        group?: string;
+        /** If `true`, this collection is not shown in the Admin UI sidebar. */
+        hidden?: boolean;
+        /** If `false`, disables the filter UI entirely for this collection. Defaults to `true`. */
+        filterable?: boolean;
+        /**
+         * URL to open in the Live Preview pane when editing a document.
+         *
+         * Pass a Jexl string to keep the config serializable, for example
+         * `'slug == "home" ? "/" : "/blog/" + slug'`. This is usually the best
+         * default, especially when the schema needs to stay portable across
+         * environments such as Dyrected Cloud.
+         *
+         * Pass a function when you need custom runtime logic in a self-hosted
+         * project.
+         *
+         * @example
+         * previewUrl: 'slug == "home" ? "/" : "/blog/" + slug'
+         *
+         * @example
+         * previewUrl: (doc) => `https://mysite.com/blog/${doc.slug}`
+         */
+        previewUrl?: string | ((doc: TDoc, opts: {
+            locale?: string;
+        }) => string | null);
+        /**
+         * How the Live Preview pane communicates with the frontend.
+         * - `postMessage` sends a `postMessage` with the current doc data.
+         * - `token` passes a short-lived preview token as a query parameter.
+         */
+        previewMode?: "postMessage" | "token";
+        /**
+         * Frontend URL pattern for this collection, used by `url` fields to
+         * resolve internal links. Use `{fieldName}` placeholders.
+         *
+         * This is a plain route pattern string, not a Jexl expression.
+         *
+         * @example
+         * urlPattern: '/blog/{slug}' // /blog/my-post
+         * urlPattern: '/{slug}' // /about
+         */
+        urlPattern?: string;
+    };
+}
+/**
+ * Defines a Dyrected global — a singleton document without pagination or IDs.
+ *
+ * Globals are ideal for site-wide settings, feature flags, or any data where
+ * there is always exactly one record, such as `site-settings`, `navigation`,
+ * or `theme`.
+ *
+ * Pass your document's TypeScript type as the generic parameter `TDoc` to get
+ * fully typed hooks.
+ *
+ * @example
+ * ```ts
+ * interface SiteSettings {
+ *   siteName: string
+ *   tagline: string
+ *   maintenanceMode: boolean
+ * }
+ *
+ * export const Settings = defineGlobal<SiteSettings>({
+ *   slug: 'site-settings',
+ *   hooks: {
+ *     afterChange: [({ doc }) => {
+ *       // `doc` is typed as SiteSettings
+ *       if (doc.maintenanceMode) alertOnCall()
+ *     }],
+ *   },
+ *   fields: [...],
+ * })
+ * ```
+ *
+ * @template TDoc The TypeScript shape of this global's document.
+ */
+interface GlobalConfig<TDoc extends object = Record<string, unknown>> {
+    /**
+     * Unique identifier for this global.
+     * Used as the URL segment (`/api/globals/:slug`) and the storage key.
+     */
+    slug: string;
+    /** Restricts this global to a specific site in a multi-tenant deployment. */
+    siteId?: string;
+    /**
+     * If `true`, this global is shared across all sites in a multi-tenant
+     * deployment.
+     */
+    shared?: boolean;
+    /** Human-readable label shown in the Admin UI sidebar. */
+    label?: string;
+    /** Field definitions for this global's document schema. */
+    fields: Field[];
+    /** Access control for reading and updating this global. */
+    access?: {
+        read?: AccessRule<TDoc>;
+        update?: AccessRule<TDoc>;
+    };
+    /**
+     * Global-level lifecycle hooks.
+     * Globals support `beforeRead`, `afterRead`, `beforeChange`, and `afterChange`.
+     * There are no delete hooks since globals cannot be deleted.
+     */
+    hooks?: {
+        beforeRead?: GlobalBeforeReadHook[];
+        afterRead?: GlobalAfterReadHook<TDoc>[];
+        beforeChange?: GlobalBeforeChangeHook<TDoc>[];
+        afterChange?: GlobalAfterChangeHook<TDoc>[];
+    };
+    /** Admin UI configuration for this global. */
+    admin?: {
+        /**
+         * Lucide icon displayed beside this global in the Admin sidebar.
+         * Uses Lucide component names, e.g. `'Settings2'` or `'Palette'`.
+         */
+        icon?: AdminIconName;
+        /** Groups this global under a named section in the Admin sidebar. */
+        group?: string;
+        /** If `true`, this global is not shown in the Admin UI sidebar. */
+        hidden?: boolean;
+    };
+    /**
+     * Initial data to seed this global with the first time it is fetched and
+     * found to be empty.
+     */
+    initialData?: Partial<TDoc>;
+}
+
+/**
+ * The interface every database adapter must implement.
+ *
+ * Dyrected ships adapters for PostgreSQL, MySQL, SQLite, and MongoDB.
+ * Implement this interface to connect any other database.
+ */
+interface DatabaseAdapter {
+    /** Find a paginated list of documents in a collection. */
+    find(args: {
+        collection: string;
+        where?: Record<string, unknown>;
+        limit?: number;
+        page?: number;
+        sort?: string;
+    }): Promise<PaginatedResult>;
+    /** Find a single document by its ID. Returns `null` if not found. */
+    findOne(args: {
+        collection: string;
+        id: string;
+    }): Promise<BaseDocument | null>;
+    /** Insert a new document and return it with its generated `id`. */
+    create(args: {
+        collection: string;
+        data: Record<string, unknown>;
+    }): Promise<BaseDocument>;
+    /** Update a document by ID and return the updated document. */
+    update(args: {
+        collection: string;
+        id: string;
+        data: Record<string, unknown>;
+    }): Promise<BaseDocument>;
+    /** Delete a document by ID. Return value is intentionally untyped — callers do not use it. */
+    delete(args: {
+        collection: string;
+        id: string;
+    }): Promise<unknown>;
+    /** Fetch the singleton document for a global. Returns an empty object if not yet initialised. */
+    getGlobal(args: {
+        slug: string;
+    }): Promise<Record<string, unknown>>;
+    /** Create or replace the singleton document for a global. */
+    updateGlobal(args: {
+        slug: string;
+        data: Record<string, unknown>;
+    }): Promise<Record<string, unknown>>;
+    /**
+     * Sync the database schema with the current collection and global configs.
+     * Called on startup to create tables/collections that don't exist yet.
+     * Not all adapters implement this (e.g. MongoDB is schema-less).
+     */
+    sync?(collections: CollectionConfig[], globals: GlobalConfig[]): Promise<void>;
+    /**
+     * Execute a raw SQL query or database command.
+     * Optional — not all adapters support raw access.
+     */
+    execute?(query: string, params?: unknown[]): Promise<unknown>;
+    /**
+     * Run all adapter operations in `callback` as one atomic transaction.
+     * Shipped adapters implement this; workflow transitions require it.
+     */
+    transaction?<T>(callback: (db: DatabaseAdapter) => Promise<T>): Promise<T>;
+}
+/**
+ * Read-only view of the database adapter. Exposes only `find`, `findOne`,
+ * and `getGlobal` — no write operations.
+ *
+ * Passed to `beforeChange`, `beforeDelete`, `beforeRead`, `afterRead`,
+ * and field-level hooks. Write operations are available in `afterChange`
+ * and `afterDelete` hooks where the full {@link DatabaseAdapter} is provided.
+ */
+type ReadonlyDatabaseAdapter = Pick<DatabaseAdapter, "find" | "findOne" | "getGlobal">;
+/**
+ * The interface every storage adapter must implement.
+ *
+ * Dyrected ships adapters for local disk, S3, Cloudflare R2, Cloudinary, and
+ * Backblaze B2. Implement this interface to use any other storage provider.
+ */
+interface StorageAdapter {
+    /**
+     * Upload a file and return its metadata (URL, dimensions, etc.).
+     * The `prefix` is a path prefix used for multi-tenant setups.
+     */
+    upload(args: {
+        filename: string;
+        buffer: Uint8Array;
+        mimeType: string;
+        prefix?: string;
+    }): Promise<FileData>;
+    /** Delete a file by its stored filename. */
+    delete(args: {
+        filename: string;
+    }): Promise<void>;
+    /** Return the public URL for a stored file. */
+    getURL(args: {
+        filename: string;
+    }): string;
+    /**
+     * Retrieve the file's raw bytes and MIME type for serving via the API.
+     * Only needed by adapters that serve files through the Dyrected API
+     * (e.g. `LocalStorage`). Cloud adapters return `null` here and rely on
+     * direct CDN URLs instead.
+     */
+    resolve?(args: {
+        filename: string;
+    }): Promise<{
+        buffer: Uint8Array;
+        mimeType: string;
+    } | null>;
+}
+/**
+ * Processes uploaded images — generates metadata (dimensions, BlurHash) and
+ * produces resized variants defined in `UploadConfig.imageSizes`.
+ *
+ * @example
+ * import { SharpImageService } from '@dyrected/image-sharp'
+ * defineConfig({ image: new SharpImageService(), ... })
+ */
+interface ImageService {
+    process(args: {
+        buffer: Uint8Array;
+        mimeType: string;
+        config?: boolean | UploadConfig;
+        focalPoint?: {
+            x: number;
+            y: number;
+        };
+    }): Promise<{
+        metadata: {
+            width?: number;
+            height?: number;
+            /** Base64-encoded BlurHash for progressive loading. */
+            blurhash?: string;
+        };
+        /** Generated image sizes keyed by their `name`. */
+        sizes?: Record<string, {
+            buffer: Uint8Array;
+            width: number;
+            height: number;
+            filename: string;
+        }>;
+    }>;
+}
+
+type FieldType = "text" | "textarea" | "richText" | "number" | "boolean" | "date" | "datetime" | "time" | "select" | "multiSelect" | "radio" | "relationship" | "array" | "object" | "json" | "blocks" | "image" | "email" | "url" | "icon" | "join" | "row";
+interface DynamicOptionsResolverArgs {
+    /** Database adapter available to server-side option resolvers. */
+    db?: DatabaseAdapter;
+    /** Authenticated user making the request, if any. */
+    user?: AuthenticatedUser;
+    /** Current HTTP request context, including query parameters. */
+    req: HookRequestContext;
+}
+type DynamicOptionsResolver = (args: DynamicOptionsResolverArgs) => Promise<DynamicOptionItem[]> | DynamicOptionItem[];
+interface DynamicOptionsConfig {
+    /** Resolver function executed on the server to produce option items. */
+    resolve: DynamicOptionsResolver;
+    /** Cache duration in seconds for identical resolver calls. */
+    cacheTTL?: number;
+}
+type DynamicOptionItem = string | {
+    label: string;
+    value: unknown;
+};
+interface Block {
+    /** Stable identifier stored in each block row as `blockType`. */
+    slug: string;
+    /** Human-readable labels shown in the Admin block picker. */
+    labels?: {
+        /** Singular label, for example `Hero`. */
+        singular: string;
+        /** Plural label, for example `Heroes`. */
+        plural: string;
+    };
+    /**
+     * Lucide icon name shown on the block card and in the block library.
+     * Falls back to a generic layout icon when omitted.
+     */
+    icon?: AdminIconName;
+    /** Short one-line summary shown under the block name (block card subtitle). */
+    description?: string;
+    /**
+     * Presentation variants for this block. All variants share the same `fields`;
+     * only the rendered layout differs. The chosen variant is stored on each block
+     * row under the reserved `variant` key and passed to the render component as a
+     * `variant` prop. Switching variant preserves the author's content.
+     */
+    variants?: BlockVariant[];
+    /** Fields that make up this block's payload. */
+    fields: Field[];
+}
+/**
+ * A single presentation variant of a {@link Block}. Variants are a layout choice
+ * over a shared field set — for example a Hero rendered "centered" vs "split".
+ */
+interface BlockVariant {
+    /** Stable identifier stored on the block row as `variant`. */
+    slug: string;
+    /** Human-readable label shown in the variant switcher. Defaults to `slug`. */
+    label?: string;
+    /** Lucide icon name shown beside the variant label. */
+    icon?: AdminIconName;
+    /** Short one-line summary of what this variant looks like. */
+    description?: string;
+}
+interface FieldBase {
+    /** Stored key for this field. Omit only for layout-only fields such as `row` or `join`. */
+    name?: string;
+    /** Human-readable label shown in the Admin UI. */
+    label?: string;
+    /** Whether the field must have a value when saving. */
+    required?: boolean;
+    /** Whether values for this field must be unique across the collection. */
+    unique?: boolean;
+    /** Default value used when a new document omits this field. */
+    defaultValue?: unknown;
+    /** Static or dynamic option source for supported selection fields. */
+    options?: string[] | {
+        label: string;
+        value: unknown;
+    }[] | DynamicOptionsResolver | DynamicOptionsConfig;
+    /** Target collection slug for `relationship` fields. */
+    relationTo?: string;
+    /** Whether the field stores multiple values instead of one. */
+    hasMany?: boolean;
+    /** Child fields for `object` and `array` field types. */
+    fields?: Field[];
+    /** Allowed block definitions for a `blocks` field. */
+    blocks?: Block[];
+    /** Target collection slug for `join` fields. */
+    collection?: string;
+    /** Back-reference field name on the joined collection. */
+    on?: string;
+    /** Maximum number of joined documents returned by a `join` field. */
+    limit?: number;
+    /** Field-level read, create, and update access rules. Supports functions, Jexl strings, booleans, and named policies. */
+    access?: {
+        /** Controls whether this field is returned in API responses. */
+        read?: AccessRule;
+        /** Controls whether this field may be set when creating a document. Falls back to `update` when omitted. */
+        create?: AccessRule;
+        /** Controls whether incoming writes may change this field on update. */
+        update?: AccessRule;
+    };
+    /** Admin-only presentation options for this field. */
+    admin?: BaseFieldAdmin;
+    /** Previous storage key this field falls back to. When the field has no value, its value is read from the old key at read time, then rewritten under the new key on the next save. */
+    renameTo?: string;
+    /** Whether SQL adapters should promote this field into a first-class column. */
+    promoted?: boolean;
+}
+interface BaseFieldAdmin {
+    /** Placeholder text shown when the input has no value. */
+    placeholder?: string;
+    /** Custom component key registered in the Admin UI. */
+    component?: string;
+    /** Help text rendered below the field. */
+    description?: string;
+    /** Hides the field from the Admin form without deleting stored data. */
+    hidden?: boolean;
+    /** Excludes the field from Admin list filtering. */
+    filterable?: boolean;
+    /** Renders the field as non-editable in the Admin UI. */
+    readOnly?: boolean;
+    /** Hides the field's label in the Admin form (e.g. single-field array rows where the label is redundant). */
+    hideLabel?: boolean;
+    /** Reactive condition controlling whether the field is visible in the Admin UI. */
+    condition?: ((data: Record<string, unknown>, siblingData: Record<string, unknown>) => boolean) | string;
+    /** Tab name used when the edit form is rendered as tabs. */
+    tab?: string;
+    /** CSS width hint used when the field appears inside a `row`. */
+    width?: string;
+}
+interface FieldBeforeChangeHookArgs<TValue = unknown, TDoc extends object = Record<string, unknown>> {
+    /** Current field value after previous hooks in the chain. */
+    value: TValue;
+    /** Existing stored document before the write, if this is an update. */
+    originalDoc?: TDoc;
+    /** Full incoming payload being written. */
+    data: Record<string, unknown>;
+    /** Authenticated user performing the write, if any. */
+    user?: AuthenticatedUser;
+    /** Read-only database adapter for related lookups. */
+    db: ReadonlyDatabaseAdapter;
+}
+type FieldBeforeChangeHook<TValue = unknown, TDoc extends object = Record<string, unknown>> = (args: FieldBeforeChangeHookArgs<TValue, TDoc>) => unknown;
+interface FieldAfterReadHookArgs<TValue = unknown, TDoc extends object = Record<string, unknown>> {
+    /** Raw stored field value before this hook transforms it. */
+    value: TValue;
+    /** Full document currently being returned to the caller. */
+    doc: TDoc;
+    /** Authenticated user requesting the document, if any. */
+    user?: AuthenticatedUser;
+    /** Read-only database adapter for related lookups. */
+    db: ReadonlyDatabaseAdapter;
+}
+type FieldAfterReadHook<TValue = unknown, TDoc extends object = Record<string, unknown>> = (args: FieldAfterReadHookArgs<TValue, TDoc>) => unknown;
+type FieldHooks<TValue> = {
+    hooks?: {
+        beforeChange?: Array<FieldBeforeChangeHook<TValue>>;
+        afterRead?: Array<FieldAfterReadHook<TValue>>;
+    };
+};
+interface FieldAdminOnChangeHookArgs<TValue = unknown> {
+    /** Current field value in the form state. */
+    value: TValue;
+    /** Current values for sibling fields at the same nesting level. */
+    siblingData: Record<string, unknown>;
+    /** Current values for the entire form. */
+    data: Record<string, unknown>;
+    /** Imperative setter for async or derived updates. */
+    setValue: (value: unknown) => void;
+}
+type FieldAdminOnChangeHook<TValue = unknown> = (args: FieldAdminOnChangeHookArgs<TValue>) => unknown;
+type FieldAdminHooks<TValue> = {
+    admin?: {
+        hooks?: {
+            onChange?: FieldAdminOnChangeHook<TValue>;
+        };
+    };
+};
+interface FieldAdminOptionsHookArgs {
+    /** Current values for sibling fields at the same nesting level. */
+    siblingData: Record<string, unknown>;
+    /** Current values for the entire form. */
+    data: Record<string, unknown>;
+}
+type FieldAdminOptionsHookResult = Array<string | {
+    label: string;
+    value: unknown;
+}>;
+type FieldAdminOptionsHook = (args: FieldAdminOptionsHookArgs) => FieldAdminOptionsHookResult | Promise<FieldAdminOptionsHookResult>;
+type TypedField<TType extends FieldType, TValue, TAdminExtra = Record<never, never>> = Omit<FieldBase, "admin"> & {
+    type: TType;
+    admin?: BaseFieldAdmin & TAdminExtra;
+} & FieldHooks<TValue> & FieldAdminHooks<TValue>;
+type BooleanFieldAdmin = {
+    /** Boolean presentation style. */
+    layout?: "checkbox" | "switch";
+};
+type SelectFieldAdmin = {
+    /** Select presentation style. */
+    layout?: "radio" | "select";
+    /** Radio orientation when `layout: 'radio'` is used. */
+    direction?: "horizontal" | "vertical";
+    hooks?: {
+        /** Client-side option recalculation for dependent dropdowns or radios. */
+        options?: FieldAdminOptionsHook;
+    };
+};
+type RadioFieldAdmin = {
+    /** Radio group orientation. */
+    direction?: "horizontal" | "vertical";
+    hooks?: {
+        /** Client-side option recalculation for dependent radio groups. */
+        options?: FieldAdminOptionsHook;
+    };
+};
+type MultiSelectFieldAdmin = {
+    hooks?: {
+        /** Client-side option recalculation for dependent multi-select fields. */
+        options?: FieldAdminOptionsHook;
+    };
+};
+interface CharacterLimitFieldConfig {
+    /** Advisory maximum character count exposed to editors and client tooling. */
+    maxLength?: number;
+}
+interface WordLimitFieldConfig {
+    /** Advisory maximum word count exposed to editors and client tooling. */
+    maxWords?: number;
+}
+interface NumberLimitFieldConfig {
+    /** Advisory minimum numeric value exposed to editors and client tooling. */
+    min?: number;
+    /** Advisory maximum numeric value exposed to editors and client tooling. */
+    max?: number;
+}
+type CharacterLimitFieldAdmin = {
+    /** Admin-only compatibility alias for `field.maxLength`. Prefer the top-level field property. */
+    maxLength?: number;
+};
+type WordLimitFieldAdmin = {
+    /** Admin-only compatibility alias for `field.maxWords`. Prefer the top-level field property. */
+    maxWords?: number;
+};
+type NumberLimitFieldAdmin = {
+    /** Admin-only compatibility alias for `field.min`. Prefer the top-level field property. */
+    min?: number;
+    /** Admin-only compatibility alias for `field.max`. Prefer the top-level field property. */
+    max?: number;
+};
+type TextFieldAdmin = CharacterLimitFieldAdmin & WordLimitFieldAdmin;
+type TextareaFieldAdmin = CharacterLimitFieldAdmin & WordLimitFieldAdmin;
+type EmailFieldAdmin = CharacterLimitFieldAdmin;
+type UrlFieldAdmin = CharacterLimitFieldAdmin;
+type IconFieldAdmin = CharacterLimitFieldAdmin;
+type NumberFieldAdmin = NumberLimitFieldAdmin;
+interface UrlLinkValue {
+    /** Whether the link is a custom URL or a reference to an internal document. */
+    type: "custom" | "internal";
+    /** The link URL. Absolute for custom links; may be a site-relative path for internal links. */
+    url?: string;
+    /** For internal links, the collection slug of the referenced document. */
+    relationTo?: string;
+    /** For internal links, the ID of the referenced document. */
+    value?: string;
+    /** Optional display label shown for the link. */
+    label?: string;
+}
+/**
+ * Editor capabilities available on a `richText` field. Each feature maps to a
+ * formatting control in the Admin editor toolbar and to the underlying editor
+ * schema, so disabling a feature removes both its toolbar button and the
+ * capability itself (including keyboard shortcuts and paste handling).
+ */
+type RichTextFeature = "bold" | "italic" | "underline" | "strike" | "heading" | "bulletList" | "orderedList" | "blockquote" | "align" | "link" | "table" | "image";
+/** Heading levels offered by the `heading` rich-text feature. */
+type HeadingLevel = 1 | 2 | 3 | 4 | 5 | 6;
+interface RichTextFieldConfig {
+    /**
+     * Editor capabilities to enable, in toolbar order. When omitted, every
+     * {@link RichTextFeature} is enabled (the default toolbar). Provide a subset
+     * to restrict what editors can do — for example `['bold', 'italic', 'link']`
+     * for a lightweight inline editor.
+     */
+    features?: RichTextFeature[];
+    /**
+     * Heading levels offered when the `heading` feature is enabled.
+     * Defaults to `[1, 2, 3]`.
+     */
+    headingLevels?: HeadingLevel[];
+    /**
+     * Upload collection slug used by the `image` feature's media picker.
+     * Defaults to the first collection configured with `upload: true`.
+     */
+    uploadCollection?: string;
+}
+type TextField = TypedField<"text", string, TextFieldAdmin> & CharacterLimitFieldConfig & WordLimitFieldConfig;
+type TextareaField = TypedField<"textarea", string, TextareaFieldAdmin> & CharacterLimitFieldConfig & WordLimitFieldConfig;
+type EmailField = TypedField<"email", string, EmailFieldAdmin> & CharacterLimitFieldConfig;
+type UrlField = TypedField<"url", string | UrlLinkValue, UrlFieldAdmin> & CharacterLimitFieldConfig;
+type IconField = TypedField<"icon", string, IconFieldAdmin> & CharacterLimitFieldConfig;
+type DateField = TypedField<"date", string>;
+type DateTimeField = TypedField<"datetime", string>;
+type TimeField = TypedField<"time", string>;
+type SelectField = TypedField<"select", string, SelectFieldAdmin>;
+type RadioField = TypedField<"radio", string, RadioFieldAdmin>;
+type NumberField = TypedField<"number", number, NumberFieldAdmin> & NumberLimitFieldConfig;
+type BooleanField = TypedField<"boolean", boolean, BooleanFieldAdmin>;
+type MultiSelectField = TypedField<"multiSelect", string[], MultiSelectFieldAdmin>;
+type RelationshipField = TypedField<"relationship", string | string[]>;
+type ImageField = TypedField<"image", string | string[]>;
+type RichTextField = TypedField<"richText", string> & RichTextFieldConfig;
+type JsonField = TypedField<"json", Record<string, unknown>>;
+type ObjectField = TypedField<"object", unknown>;
+type ArrayField = TypedField<"array", unknown>;
+type BlocksField = TypedField<"blocks", unknown>;
+type JoinField = TypedField<"join", unknown>;
+type RowField = TypedField<"row", unknown>;
+type Field = TextField | TextareaField | EmailField | UrlField | IconField | DateField | DateTimeField | TimeField | SelectField | RadioField | NumberField | BooleanField | MultiSelectField | RelationshipField | ImageField | RichTextField | JsonField | ObjectField | ArrayField | BlocksField | JoinField | RowField;
+interface UploadConfig {
+    /** Allowed MIME types for uploaded files. */
+    allowedMimeTypes?: string[];
+    /** Maximum upload size in bytes. */
+    maxFileSize?: number;
+    /** Local filesystem destination used by disk-based storage adapters. */
+    staticDir?: string;
+    /** Public URL prefix for disk-based uploads. */
+    staticURL?: string;
+    /** Generated image size name used as the Admin media thumbnail. */
+    adminThumbnail?: string;
+    imageSizes?: {
+        /** Stable name used to reference this generated size. */
+        name: string;
+        /** Target width in pixels. */
+        width?: number;
+        /** Target height in pixels. */
+        height?: number;
+        /** Crop strategy forwarded to the image processor. */
+        crop?: string;
+        /** Resize fit strategy forwarded to the image processor. */
+        fit?: string;
+        /** Prevents upscaling smaller source images. */
+        withoutEnlargement?: boolean;
+        /** Format-specific options forwarded to the image processor. */
+        formatOptions?: Record<string, unknown>;
+    }[];
+}
+
+interface AdminAuthMember {
+    id: string;
+    email: string;
+    name?: string;
+    roles: string[];
+    siteAccess?: string[];
+    status?: "active" | "pending";
+    [key: string]: any;
+}
+type AdminAuthProvisioningMode = "jit_only" | "jit_plus_membership_management" | "preprovisioned_only";
+interface AdminAuthClaimMapping {
+    sub?: string;
+    email?: string;
+    name?: string;
+    roles?: string;
+    groups?: string;
+    siteIds?: string;
+    workspaceIds?: string;
+}
+interface AdminAuthResolvedIdentity {
+    sub: string;
+    email?: string;
+    name?: string;
+    roles?: string[];
+    groups?: string[];
+    siteIds?: string[];
+    workspaceIds?: string[];
+    rawClaims?: Record<string, unknown>;
+}
+interface AdminAuthAccessResolution {
+    allowed: boolean;
+    roles?: string[];
+    data?: Record<string, unknown>;
+}
+interface AdminAuthResolveAccessArgs {
+    identity: AdminAuthResolvedIdentity;
+    providerId: string;
+    siteId?: string;
+    workspaceId?: string;
+    req: {
+        method: string;
+        path: string;
+        url: string;
+        headers: Record<string, string | undefined>;
+    };
+    user: Record<string, unknown> | null;
+}
+interface AdminAuthProviderMembersConfig {
+    list?: (args: {
+        limit?: number;
+        page?: number;
+        sort?: string;
+        where?: Record<string, any>;
+        req: HookRequestContext;
+    }) => Promise<{
+        docs: AdminAuthMember[];
+        totalDocs: number;
+        limit: number;
+        page: number;
+        totalPages: number;
+        hasNextPage: boolean;
+        hasPrevPage: boolean;
+    }>;
+    get?: (args: {
+        externalSubject: string;
+        req: HookRequestContext;
+    }) => Promise<AdminAuthMember | null>;
+    create?: (args: {
+        data: Record<string, any>;
+        req: HookRequestContext;
+    }) => Promise<AdminAuthMember>;
+    update?: (args: {
+        externalSubject: string;
+        data: Record<string, any>;
+        req: HookRequestContext;
+    }) => Promise<AdminAuthMember>;
+    delete?: (args: {
+        externalSubject: string;
+        req: HookRequestContext;
+    }) => Promise<void>;
+}
+interface BaseAdminAuthProvider {
+    id: string;
+    type: "oidc" | "custom" | "cloud";
+    displayName?: string;
+    autoRedirect?: boolean;
+    allowJitProvisioning?: boolean;
+    claimMapping?: AdminAuthClaimMapping;
+    members?: AdminAuthProviderMembersConfig;
+}
+interface OIDCAdminAuthProvider extends BaseAdminAuthProvider {
+    type: "oidc";
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    redirectUri?: string;
+    scopes?: string[];
+    authorizationEndpoint?: string;
+    tokenEndpoint?: string;
+    userInfoEndpoint?: string;
+}
+interface CustomAdminAuthProvider extends BaseAdminAuthProvider {
+    type: "custom" | "cloud";
+    startUrl?: string;
+    issuer?: string;
+    audience?: string;
+    secret?: string;
+    jwksUri?: string;
+    tokenParam?: string;
+}
+type AdminAuthProvider = OIDCAdminAuthProvider | CustomAdminAuthProvider;
+interface PublicAdminAuthProvider {
+    id: string;
+    type: AdminAuthProvider["type"];
+    displayName: string;
+    autoRedirect?: boolean;
+}
+interface PublicAdminAuthConfig {
+    mode: "local" | "external";
+    collectionSlug?: string;
+    provisioningMode?: AdminAuthProvisioningMode;
+    providers: PublicAdminAuthProvider[];
+}
+interface AdminAuthConfig {
+    mode: "local" | "external";
+    collectionSlug?: string;
+    provisioningMode?: AdminAuthProvisioningMode;
+    providers: AdminAuthProvider[];
+    resolveAccess?: (args: AdminAuthResolveAccessArgs) => Promise<AdminAuthAccessResolution> | AdminAuthAccessResolution;
+}
+
+/**
+ * The root configuration object passed to `createDyrectedApp`.
+ *
+ * This is the single source of truth for your entire Dyrected instance —
+ * collections, globals, database adapter, storage, email, and more.
+ *
+ * @example
+ * import { defineConfig } from '@dyrected/core'
+ * import { SQLiteAdapter } from '@dyrected/db-sqlite'
+ *
+ * export default defineConfig({
+ *   db: new SQLiteAdapter({ filename: './db.sqlite' }),
+ *   collections: [Posts, Users],
+ *   globals: [SiteSettings],
+ * })
+ */
+interface DyrectedConfig<TUser extends AuthenticatedUser = AuthenticatedUser> {
+    /** Collection definitions. Each collection maps to a database table/collection. */
+    collections: CollectionConfig<any>[];
+    /** Global (singleton) definitions. Each global maps to a single document. */
+    globals: GlobalConfig<any>[];
+    /**
+     * The database adapter. Required for all data operations.
+     * @see DatabaseAdapter
+     */
+    db?: DatabaseAdapter;
+    /**
+     * The storage adapter for file uploads.
+     * Required when any collection has `upload: true`.
+     * @see StorageAdapter
+     */
+    storage?: StorageAdapter;
+    /**
+     * The image processing service. Required when any upload collection
+     * defines `imageSizes`.
+     * @see ImageService
+     */
+    image?: ImageService;
+    /** Admin UI branding and metadata. */
+    admin?: AdminConfig;
+    /**
+     * Deployment-level authentication strategy for the CMS dashboard (`/admin`).
+     * This is separate from collection-level `auth: true`, which continues to
+     * power application/customer auth independently.
+     */
+    adminAuth?: AdminAuthConfig;
+    /**
+     * Named access policies available to collection, global, and field access
+     * rules via `{ policy: 'name' }`.
+     *
+     * A policy can be a **function** (full server logic, evaluated to a static
+     * boolean when serialized for the admin panel) or a **Jexl string** (or
+     * boolean). String policies are inlined when the schema is sent to the admin,
+     * so the admin panel evaluates them live against the current form — the same
+     * way it evaluates inline Jexl rules.
+     */
+    accessPolicies?: Record<string, AccessPolicyResolver<Record<string, unknown>, TUser> | string | boolean>;
+    /**
+     * Email transport configuration. Required for welcome emails, password
+     * resets, and invite links.
+     *
+     * @example
+     * email: {
+     *   from: 'no-reply@myapp.com',
+     *   send: async ({ to, subject, html }) => {
+     *     await resend.emails.send({ from, to, subject, html })
+     *   },
+     * }
+     */
+    email?: {
+        /** The `From` address for all outbound emails. */
+        from: string;
+        /** The send function. Wire in any email provider (Resend, SendGrid, SES, etc.). */
+        send: (args: {
+            to: string;
+            subject: string;
+            html: string;
+        }) => Promise<void>;
+        /** Override the default email templates. */
+        templates?: {
+            welcome?: (args: {
+                email: string;
+            }) => {
+                subject?: string;
+                html: string;
+            };
+            invite?: (args: {
+                token: string;
+                invitedByEmail?: string;
+            }) => {
+                subject?: string;
+                html: string;
+            };
+            resetPassword?: (args: {
+                token: string;
+                url?: string;
+            }) => {
+                subject?: string;
+                html: string;
+            };
+            passwordChanged?: (args: {
+                email: string;
+            }) => {
+                subject?: string;
+                html: string;
+            };
+        };
+    };
+    /**
+     * Redis connection URL. Required for distributed caching of dynamic option
+     * resolvers and other server-side caches in multi-instance deployments.
+     *
+     * @example
+     * redis: { url: process.env.REDIS_URL }
+     */
+    redis?: {
+        url: string;
+    };
+    /** Durable lifecycle-event delivery configuration. */
+    events?: {
+        handlers: LifecycleEventHandler[];
+        /** Maximum delivery attempts before an event remains failed. Defaults to 8. */
+        maxAttempts?: number;
+        /** Initial exponential-backoff delay in milliseconds. Defaults to 1000. */
+        retryDelayMs?: number;
+    };
+    /**
+     * Cross-Origin Resource Sharing (CORS) configuration.
+     * List all origins that are allowed to call the Dyrected API.
+     *
+     * @example
+     * cors: { origins: ['https://myapp.com', 'https://www.myapp.com'] }
+     */
+    cors?: {
+        origins: string[];
+    };
+    /**
+     * Callback to dynamically fetch additional collections and globals for a
+     * given site ID at request time. Used in multi-tenant deployments where each
+     * site has its own schema stored in the database.
+     */
+    onSchemaFetch?: (siteId: string) => Promise<{
+        collections?: CollectionConfig<any>[];
+        globals?: GlobalConfig<any>[];
+        admin?: AdminConfig;
+        adminAuth?: AdminAuthConfig;
+    }>;
+}
+
+export { type BaseFieldAdmin as $, type AdminAuthConfig as A, type Block as B, type CollectionConfig as C, type DyrectedConfig as D, type EmailField as E, type Field as F, type GlobalConfig as G, type HookRequestContext as H, type IconField as I, type JoinField as J, type AdminAuthProvisioningMode as K, type LifecycleEventName as L, type MultiSelectField as M, type NumberField as N, type ObjectField as O, type PublicAdminAuthConfig as P, type AdminAuthResolveAccessArgs as Q, type RadioField as R, type SelectField as S, type TextField as T, type UrlField as U, type AdminAuthResolvedIdentity as V, type WorkflowConfig as W, type AdminConfig as X, type AdminDashboardComponentSlots as Y, type AdminIconName as Z, type BaseAdminAuthProvider as _, type AuthenticatedUser as a, type UrlFieldAdmin as a$, type BlockVariant as a0, type BooleanFieldAdmin as a1, type CharacterLimitFieldAdmin as a2, type CharacterLimitFieldConfig as a3, type CollectionAfterChangeHook as a4, type CollectionAfterDeleteHook as a5, type CollectionAfterReadHook as a6, type CollectionAfterTransitionHook as a7, type CollectionBeforeChangeHook as a8, type CollectionBeforeDeleteHook as a9, type GlobalAfterReadHook as aA, type GlobalBeforeChangeHook as aB, type GlobalBeforeReadHook as aC, type HeadingLevel as aD, type HookFunction as aE, type IconFieldAdmin as aF, type ImageService as aG, LIFECYCLE_EVENT_NAMES as aH, type LifecycleEventHandler as aI, type MultiSelectFieldAdmin as aJ, type NamedAccessPolicy as aK, type NumberFieldAdmin as aL, type NumberLimitFieldAdmin as aM, type NumberLimitFieldConfig as aN, type OIDCAdminAuthProvider as aO, type PaginatedResult as aP, type PublicAdminAuthProvider as aQ, type RadioFieldAdmin as aR, type ReadonlyDatabaseAdapter as aS, type RichTextFeature as aT, type RichTextFieldConfig as aU, type SelectFieldAdmin as aV, type StorageAdapter as aW, type TextFieldAdmin as aX, type TextareaFieldAdmin as aY, type TypedField as aZ, type UploadConfig as a_, type CollectionBeforeReadHook as aa, type CollectionBeforeTransitionHook as ab, type CollectionListComponentSlots as ac, type CustomAdminAuthProvider as ad, type DatabaseAdapter as ae, type DynamicOptionItem as af, type DynamicOptionsConfig as ag, type DynamicOptionsResolver as ah, type DynamicOptionsResolverArgs as ai, type EmailFieldAdmin as aj, type FieldAdminHooks as ak, type FieldAdminOnChangeHook as al, type FieldAdminOnChangeHookArgs as am, type FieldAdminOptionsHook as an, type FieldAdminOptionsHookArgs as ao, type FieldAdminOptionsHookResult as ap, type FieldAfterReadHook as aq, type FieldAfterReadHookArgs as ar, type FieldBase as as, type FieldBeforeChangeHook as at, type FieldBeforeChangeHookArgs as au, type FieldHook as av, type FieldHooks as aw, type FieldType as ax, type FileData as ay, type GlobalAfterChangeHook as az, type WorkflowTransition as b, type UrlLinkValue as b0, type WordLimitFieldAdmin as b1, type WordLimitFieldConfig as b2, type WorkflowMetadata as b3, type WorkflowRole as b4, type WorkflowState as b5, type WorkflowTransitionContext as b6, type LifecycleEvent as c, type BaseDocument as d, type ArrayField as e, type BlocksField as f, type BooleanField as g, type DateField as h, type DateTimeField as i, type ImageField as j, type JsonField as k, type RelationshipField as l, type RichTextField as m, type RowField as n, type TextareaField as o, type TimeField as p, type AccessFunction as q, type AccessFunctionArgs as r, type AccessPolicyResolver as s, type AccessResult as t, type AccessRule as u, type AdminAuthAccessResolution as v, type AdminAuthClaimMapping as w, type AdminAuthMember as x, type AdminAuthProvider as y, type AdminAuthProviderMembersConfig as z };