@dyrected/core 2.5.60 → 2.5.62

package/dist/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
@@ -24,6 +34,7 @@ __export(index_exports, {
   LIFECYCLE_EVENT_NAMES: () => LIFECYCLE_EVENT_NAMES,
   WORKFLOW_HISTORY_COLLECTION: () => WORKFLOW_HISTORY_COLLECTION,
   availableWorkflowTransitions: () => availableWorkflowTransitions,
+  buildSqlOrderBy: () => buildSqlOrderBy,
   canViewWorkflowDraft: () => canViewWorkflowDraft,
   createLifecycleEvent: () => createLifecycleEvent,
   createWorkflowDocument: () => createWorkflowDocument,
@@ -45,6 +56,7 @@ __export(index_exports, {
   defineMultiSelectField: () => defineMultiSelectField,
   defineNumberField: () => defineNumberField,
   defineObjectField: () => defineObjectField,
+  definePublishingWorkflow: () => definePublishingWorkflow,
   defineRadioField: () => defineRadioField,
   defineRelationshipField: () => defineRelationshipField,
   defineRichTextField: () => defineRichTextField,
@@ -65,6 +77,7 @@ __export(index_exports, {
   initializeWorkflowDocument: () => initializeWorkflowDocument,
   materializeWorkflowDocument: () => materializeWorkflowDocument,
   normalizeConfig: () => normalizeConfig,
+  numericFieldNames: () => numericFieldNames,
   parseMongoWhere: () => parseMongoWhere,
   parseSort: () => parseSort,
   parseSqlWhere: () => parseSqlWhere,
@@ -72,6 +85,7 @@ __export(index_exports, {
   resolveAdminAuthCollection: () => resolveAdminAuthCollection,
   runCollectionHooks: () => runCollectionHooks,
   saveWorkflowDraft: () => saveWorkflowDraft,
+  simplePublishingWorkflow: () => simplePublishingWorkflow,
   transitionWorkflow: () => transitionWorkflow,
   workflowCapabilities: () => workflowCapabilities
 });
@@ -85,10 +99,47 @@ var LIFECYCLE_EVENT_NAMES = [
   "entry.unpublished"
 ];
 
+// src/auth/token.ts
+var import_jose = require("jose");
+var import_node_util = require("util");
+
+// src/auth/sessions.ts
+var AUTH_SESSIONS_COLLECTION = "__auth_sessions";
+
+// src/observability.ts
+var import_api = require("@opentelemetry/api");
+var import_exporter_metrics_otlp_http = require("@opentelemetry/exporter-metrics-otlp-http");
+var import_exporter_prometheus = require("@opentelemetry/exporter-prometheus");
+var import_exporter_trace_otlp_http = require("@opentelemetry/exporter-trace-otlp-http");
+var import_resources = require("@opentelemetry/resources");
+var import_sdk_metrics = require("@opentelemetry/sdk-metrics");
+var import_sdk_trace_base = require("@opentelemetry/sdk-trace-base");
+var import_pino = __toESM(require("pino"), 1);
+var import_pino_pretty = __toESM(require("pino-pretty"), 1);
+var import_node_stream = require("stream");
+var runtimeByConfig = /* @__PURE__ */ new WeakMap();
+var fallbackLogger = (0, import_pino.default)({
+  name: "dyrected",
+  enabled: process.env.DISABLE_LOGGING !== "true",
+  timestamp: import_pino.stdTimeFunctions.isoTime
+});
+function getObservabilityRuntime(config) {
+  if (!config || typeof config !== "object") return void 0;
+  return runtimeByConfig.get(config);
+}
+function getConfigLogger(config, component) {
+  const base = config?.logger && !("options" in config.logger) ? config.logger : fallbackLogger;
+  return base.child({ component });
+}
+
 // src/workflows.ts
 var WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
 var LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
-function publishingWorkflow() {
+var EDITOR_CAPABILITIES = ["entry.edit", "entry.submit"];
+var PUBLISHER_CAPABILITIES = ["entry.edit", "entry.submit", "entry.publish", "entry.unpublish"];
+function definePublishingWorkflow(options = {}) {
+  const editors = options.editors ?? ["editor"];
+  const publishers = options.publishers ?? ["publisher", "admin"];
   return {
     initialState: "draft",
     draftState: "draft",
@@ -104,10 +155,29 @@ function publishingWorkflow() {
       { name: "unpublish", label: "Unpublish", from: "published", to: "draft", requiredCapabilities: ["entry.unpublish"], unpublish: true }
     ],
     roles: [
-      { role: "editor", capabilities: ["entry.edit", "entry.submit"] },
-      { role: "publisher", capabilities: ["entry.edit", "entry.submit", "entry.publish", "entry.unpublish"] },
-      { role: "admin", capabilities: ["entry.edit", "entry.submit", "entry.publish", "entry.unpublish"] }
+      ...editors.map((role) => ({ role, capabilities: [...EDITOR_CAPABILITIES] })),
+      ...publishers.map((role) => ({ role, capabilities: [...PUBLISHER_CAPABILITIES] }))
+    ]
+  };
+}
+function publishingWorkflow() {
+  return definePublishingWorkflow();
+}
+function simplePublishingWorkflow() {
+  return {
+    initialState: "draft",
+    draftState: "draft",
+    states: [
+      { name: "draft", label: "Draft", color: "neutral" },
+      { name: "published", label: "Published", color: "success", published: true }
+    ],
+    transitions: [
+      { name: "publish", label: "Publish", from: "draft", to: "published" },
+      { name: "unpublish", label: "Unpublish", from: "published", to: "draft", unpublish: true }
     ]
+    // Intentionally no `roles`: this lightweight workflow (synthesized from
+    // `drafts: true`) does no capability-based gating. Draft visibility for a
+    // no-roles workflow is handled in `canViewWorkflowDraft`.
   };
 }
 function publicMetadata(meta) {
@@ -126,9 +196,13 @@ function canViewWorkflowDraft(workflow, user) {
   if (!user) return false;
   const capabilities = workflowCapabilities(workflow, user);
   if (capabilities.has("entry.edit")) return true;
-  return workflow.transitions.some(
+  if (workflow.transitions.some(
     (transition) => (transition.requiredCapabilities ?? []).some((capability) => capabilities.has(capability))
-  );
+  )) {
+    return true;
+  }
+  if (!workflow.roles || workflow.roles.length === 0) return true;
+  return false;
 }
 function availableWorkflowTransitions(workflow, state, user) {
   const capabilities = workflowCapabilities(workflow, user);
@@ -143,9 +217,23 @@ function initializeWorkflowDocument(data, workflow) {
     __workflow: { state: workflow.initialState, revision: 1 }
   };
 }
+function publishedStateName(workflow) {
+  return workflow.states.find((state) => state.published)?.name ?? workflow.states[workflow.states.length - 1]?.name ?? workflow.initialState;
+}
 function materializeWorkflowDocument(doc, workflow, user) {
   const meta = doc.__workflow;
-  if (!meta) return doc;
+  if (!meta) {
+    const { __published: _legacyPublished, __workflow: _legacyWorkflow, ...working2 } = doc;
+    const state = publishedStateName(workflow);
+    return {
+      ...working2,
+      _workflow: {
+        state,
+        revision: 1,
+        availableTransitions: availableWorkflowTransitions(workflow, state, user).map((item) => item.name)
+      }
+    };
+  }
   const { __published, __workflow, ...working } = doc;
   if (!canViewWorkflowDraft(workflow, user)) {
     if (!__published || typeof __published !== "object") return null;
@@ -340,7 +428,17 @@ async function transitionWorkflow(args) {
     try {
       await hook({ ...hookContext, doc: updated, event: events[0] });
     } catch (error) {
-      console.error("[dyrected/workflow] afterTransition hook failed:", error);
+      getObservabilityRuntime(config)?.recordWorkflowHookFailure({
+        collection: collection.slug,
+        transition: transition.name
+      });
+      getConfigLogger(config, "workflow").error({
+        err: error,
+        msg: "afterTransition hook failed",
+        collection: collection.slug,
+        transition: transition.name,
+        documentId: id
+      });
     }
   }
   return updated;
@@ -381,6 +479,98 @@ function humanizeProviderName(id, type) {
   return cleaned.replace(/\b\w/g, (char) => char.toUpperCase());
 }
 
+// src/utils/block-references.ts
+function mergeUniqueBlocks(blocks) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const block of blocks) {
+    const existing = seen.get(block.slug);
+    if (existing && existing !== block) {
+      throw new Error(
+        `Duplicate block slug "${block.slug}" found in the reusable block registry. Block slugs must be unique.`
+      );
+    }
+    if (!existing) seen.set(block.slug, block);
+  }
+  return Array.from(seen.values());
+}
+function buildRegistry(blocks) {
+  return new Map(blocks.map((block) => [block.slug, block]));
+}
+function resolveField(field, registry, blockCache) {
+  const next = { ...field };
+  if (next.fields) {
+    next.fields = next.fields.map(
+      (child) => resolveField(child, registry, blockCache)
+    );
+  }
+  if (next.type !== "blocks") return next;
+  const hasInlineBlocks = Array.isArray(next.blocks) && next.blocks.length > 0;
+  const hasReferences = Array.isArray(next.blockReferences) && next.blockReferences.length > 0;
+  if (hasInlineBlocks && hasReferences) {
+    throw new Error(
+      `Blocks field "${next.name ?? "(unnamed)"}" cannot define both "blocks" and "blockReferences". Use one or the other.`
+    );
+  }
+  if (hasReferences) {
+    next.blocks = next.blockReferences.map((slug) => {
+      const block = registry.get(slug);
+      if (!block) {
+        throw new Error(
+          `Unknown block reference "${slug}" on blocks field "${next.name ?? "(unnamed)"}". Add it to defineConfig({ blocks: [...] }).`
+        );
+      }
+      return resolveBlock(block, registry, blockCache);
+    });
+    return next;
+  }
+  if (hasInlineBlocks) {
+    next.blocks = next.blocks.map(
+      (block) => resolveBlock(block, registry, blockCache)
+    );
+  }
+  return next;
+}
+function resolveBlock(block, registry, blockCache) {
+  const cached = blockCache.get(block);
+  if (cached) return cached;
+  const resolved = {
+    ...block,
+    fields: []
+  };
+  blockCache.set(block, resolved);
+  resolved.fields = block.fields.map(
+    (field) => resolveField(field, registry, blockCache)
+  );
+  return resolved;
+}
+function resolveFields(fields, registry, blockCache) {
+  return fields.map((field) => resolveField(field, registry, blockCache));
+}
+function normalizeSchemaFragment(fragment) {
+  const reusableBlocks = mergeUniqueBlocks(fragment.blocks ?? []);
+  const registry = buildRegistry(reusableBlocks);
+  const blockCache = /* @__PURE__ */ new WeakMap();
+  const resolvedBlocks = reusableBlocks.map(
+    (block) => resolveBlock(block, registry, blockCache)
+  );
+  const resolvedCollections = (fragment.collections ?? []).map(
+    (collection) => ({
+      ...collection,
+      fields: resolveFields(collection.fields ?? [], registry, blockCache)
+    })
+  );
+  const resolvedGlobals = (fragment.globals ?? []).map((global) => ({
+    ...global,
+    fields: resolveFields(global.fields ?? [], registry, blockCache)
+  }));
+  return {
+    ...fragment,
+    ...fragment.blocks ? { blocks: resolvedBlocks } : {},
+    ...fragment.collections ? { collections: resolvedCollections } : {},
+    ...fragment.globals ? { globals: resolvedGlobals } : {}
+  };
+}
+
 // src/utils/config.ts
 var AUDIT_COLLECTION_SLUG = "__audit";
 var SYSTEM_FIELDS = [
@@ -415,12 +605,23 @@ var AUDIT_COLLECTION = {
   fields: [
     { name: "collection", type: "text", label: "Collection", required: true },
     { name: "documentId", type: "text", label: "Document ID" },
-    { name: "operation", type: "select", label: "Operation", options: ["create", "update", "delete"], required: true },
+    {
+      name: "operation",
+      type: "select",
+      label: "Operation",
+      options: ["create", "update", "delete"],
+      required: true
+    },
     { name: "user", type: "text", label: "User ID" },
     { name: "timestamp", type: "date", label: "Timestamp", required: true },
     { name: "changes", type: "json", label: "Changes" }
   ],
-  access: { read: () => false, create: () => false, update: () => false, delete: () => false },
+  access: {
+    read: () => false,
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
   admin: { hidden: true }
 };
 var WORKFLOW_HISTORY_COLLECTION_CONFIG = {
@@ -437,7 +638,12 @@ var WORKFLOW_HISTORY_COLLECTION_CONFIG = {
     { name: "actorId", type: "text" },
     { name: "createdAt", type: "date", required: true }
   ],
-  access: { read: ({ user }) => !!user, create: () => false, update: () => false, delete: () => false },
+  access: {
+    read: ({ user }) => !!user,
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
   admin: { hidden: true }
 };
 var LIFECYCLE_EVENTS_COLLECTION_CONFIG = {
@@ -451,22 +657,56 @@ var LIFECYCLE_EVENTS_COLLECTION_CONFIG = {
     { name: "actorId", type: "text" },
     { name: "payload", type: "json", required: true },
     { name: "attempts", type: "number", required: true },
-    { name: "status", type: "select", options: ["pending", "processing", "delivered", "failed"], required: true },
+    {
+      name: "status",
+      type: "select",
+      options: ["pending", "processing", "delivered", "failed"],
+      required: true
+    },
     { name: "nextAttemptAt", type: "date" },
     { name: "deliveredAt", type: "date" },
     { name: "lastError", type: "textarea" }
   ],
-  access: { read: ({ user }) => !!user?.roles?.includes("admin"), create: () => false, update: () => false, delete: () => false },
+  access: {
+    read: ({ user }) => !!user?.roles?.includes("admin"),
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
+  admin: { hidden: true }
+};
+var AUTH_SESSIONS_COLLECTION_CONFIG = {
+  slug: AUTH_SESSIONS_COLLECTION,
+  labels: { singular: "Auth session", plural: "Auth sessions" },
+  fields: [
+    { name: "userId", type: "text", required: true },
+    { name: "email", type: "email", required: true },
+    { name: "collection", type: "text", required: true },
+    { name: "authSource", type: "text" },
+    { name: "providerId", type: "text" },
+    { name: "lastIp", type: "text" },
+    { name: "lastSeenAt", type: "date" },
+    { name: "expiresAt", type: "date" },
+    { name: "revokedAt", type: "date" }
+  ],
+  access: {
+    read: () => false,
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
   admin: { hidden: true }
 };
 function normalizeConfig(config) {
-  const collections = config?.collections || [];
-  const globals = config?.globals || [];
+  const schemaAwareConfig = normalizeSchemaFragment(config);
+  const collections = schemaAwareConfig?.collections || [];
+  const globals = schemaAwareConfig?.globals || [];
   const needsAudit = collections.some((col) => col.audit);
-  const needsWorkflow = collections.some((col) => col.workflow);
+  const needsWorkflow = collections.some((col) => col.workflow || col.drafts);
+  const needsAuthSessions = collections.some((col) => !!col.auth);
   const adminAuthCollectionSlug = getAdminAuthCollection({
     collections,
-    adminAuth: config.adminAuth
+    adminAuth: schemaAwareConfig.adminAuth
   })?.slug;
   const normalizedCollections = collections.map((col) => {
     let fields = col.fields || [];
@@ -563,7 +803,7 @@ function normalizeConfig(config) {
         return field;
       });
     }
-    if (adminAuthCollectionSlug && col.slug === adminAuthCollectionSlug && config.adminAuth?.mode === "external") {
+    if (adminAuthCollectionSlug && col.slug === adminAuthCollectionSlug && schemaAwareConfig.adminAuth?.mode === "external") {
       const externalAdminFields = [
         {
           name: "authProvider",
@@ -597,23 +837,37 @@ function normalizeConfig(config) {
       }
     }
     const updatedFieldNames = new Set(fields.map((f) => f.name));
-    const fieldsToInject = SYSTEM_FIELDS.filter((f) => !updatedFieldNames.has(f.name));
+    const fieldsToInject = SYSTEM_FIELDS.filter(
+      (f) => !updatedFieldNames.has(f.name)
+    );
+    const workflow = col.workflow || (col.drafts ? simplePublishingWorkflow() : void 0);
     return {
       ...col,
+      workflow,
       fields: [...fields, ...fieldsToInject]
     };
   });
-  const hasAuditCollection = normalizedCollections.some((col) => col.slug === AUDIT_COLLECTION_SLUG);
+  const hasAuditCollection = normalizedCollections.some(
+    (col) => col.slug === AUDIT_COLLECTION_SLUG
+  );
   const systemCollections = [];
-  if (needsAudit && !hasAuditCollection) systemCollections.push(AUDIT_COLLECTION);
-  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === WORKFLOW_HISTORY_COLLECTION)) {
+  if (needsAudit && !hasAuditCollection)
+    systemCollections.push(AUDIT_COLLECTION);
+  if (needsWorkflow && !normalizedCollections.some(
+    (col) => col.slug === WORKFLOW_HISTORY_COLLECTION
+  )) {
     systemCollections.push(WORKFLOW_HISTORY_COLLECTION_CONFIG);
   }
-  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === LIFECYCLE_EVENTS_COLLECTION)) {
+  if (needsWorkflow && !normalizedCollections.some(
+    (col) => col.slug === LIFECYCLE_EVENTS_COLLECTION
+  )) {
     systemCollections.push(LIFECYCLE_EVENTS_COLLECTION_CONFIG);
   }
+  if (needsAuthSessions && !normalizedCollections.some((col) => col.slug === AUTH_SESSIONS_COLLECTION)) {
+    systemCollections.push(AUTH_SESSIONS_COLLECTION_CONFIG);
+  }
   return {
-    ...config,
+    ...schemaAwareConfig,
     collections: [...normalizedCollections, ...systemCollections],
     globals
   };
@@ -623,7 +877,7 @@ function normalizeConfig(config) {
 function assertNever(op, context) {
   throw new Error(`[dyrected/core] Unhandled where operator "${op}" in ${context}`);
 }
-function parseSqlWhere(where, getJsonField, placeholder = "?") {
+function parseSqlWhere(where, getJsonField, placeholder = "?", likeOperator = "LIKE") {
   const params = [];
   let pgIndex = 1;
   function next() {
@@ -685,10 +939,10 @@ function parseSqlWhere(where, getJsonField, placeholder = "?") {
         return `${c} <= ${next()}`;
       case "contains":
         params.push(`%${operand}%`);
-        return `${c} LIKE ${next()}`;
+        return `${c} ${likeOperator} ${next()}`;
       case "starts_with":
         params.push(`${operand}%`);
-        return `${c} LIKE ${next()}`;
+        return `${c} ${likeOperator} ${next()}`;
       case "exists":
         return operand ? `${c} IS NOT NULL` : `${c} IS NULL`;
       default:
@@ -793,6 +1047,33 @@ function parseSort(sort, fallback = { field: "createdAt", direction: "DESC" }) {
   }).filter((clause) => Boolean(clause));
   return clauses.length > 0 ? clauses : [fallback];
 }
+function numericFieldNames(fields) {
+  const names = /* @__PURE__ */ new Set();
+  for (const field of fields ?? []) {
+    if (field.type === "number" && "name" in field && field.name) {
+      names.add(field.name);
+    }
+  }
+  return names;
+}
+var TIMESTAMP_COLUMNS = {
+  createdat: "created_at",
+  created_at: "created_at",
+  updatedat: "updated_at",
+  updated_at: "updated_at"
+};
+function buildSqlOrderBy(sort, existingColumns, numericFields, dialect) {
+  return parseSort(sort).map(({ field, direction }) => {
+    const timestamp = TIMESTAMP_COLUMNS[field.toLowerCase()];
+    if (timestamp) return `${dialect.quoteIdent(timestamp)} ${direction}`;
+    if (existingColumns.includes(field) && field !== "id" && field !== "data") {
+      return `${dialect.quoteIdent(field)} ${direction}`;
+    }
+    const extracted = dialect.jsonExtract(field);
+    const expr = numericFields.has(field) ? dialect.castNumeric(extracted) : extracted;
+    return `${expr} ${direction}`;
+  }).join(", ");
+}
 
 // src/utils/hooks.ts
 async function runCollectionHooks(hooks, args, options = {}) {
@@ -812,7 +1093,10 @@ async function runCollectionHooks(hooks, args, options = {}) {
       }
     } catch (err) {
       if (options.isolated) {
-        console.error("[dyrected/core] Side-effect hook failed (error isolated \u2014 DB write was successful):", err);
+        getConfigLogger(void 0, "hooks").error({
+          err,
+          msg: "Side-effect hook failed after a successful write"
+        });
       } else {
         throw err;
       }
@@ -857,7 +1141,13 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
           const item = updatedValue[i];
           const origItem = Array.isArray(origValue) ? origValue[i] : null;
           arrayResult.push(
-            await executeFieldBeforeChange(field.fields, item, origItem, user, db)
+            await executeFieldBeforeChange(
+              field.fields,
+              item,
+              origItem,
+              user,
+              db
+            )
           );
         }
         result[field.name] = arrayResult;
@@ -998,7 +1288,15 @@ function generateOpenApi(config) {
         },
         WorkflowHistoryEntry: {
           type: "object",
-          required: ["collection", "documentId", "transition", "from", "to", "revision", "createdAt"],
+          required: [
+            "collection",
+            "documentId",
+            "transition",
+            "from",
+            "to",
+            "revision",
+            "createdAt"
+          ],
           properties: {
             id: { type: "string" },
             collection: { type: "string" },
@@ -1023,7 +1321,11 @@ function generateOpenApi(config) {
             user: { type: "string", nullable: true },
             timestamp: { type: "string", format: "date-time" },
             changes: {
-              oneOf: [{ type: "string" }, { type: "object", additionalProperties: true }, { type: "null" }]
+              oneOf: [
+                { type: "string" },
+                { type: "object", additionalProperties: true },
+                { type: "null" }
+              ]
             }
           }
         },
@@ -1115,13 +1417,17 @@ function generateOpenApi(config) {
     get: {
       tags: ["Preferences"],
       summary: "Get an authenticated user preference",
-      parameters: [{ name: "key", in: "path", required: true, schema: { type: "string" } }],
+      parameters: [
+        { name: "key", in: "path", required: true, schema: { type: "string" } }
+      ],
       responses: { 200: { description: "Preference value" } }
     },
     put: {
       tags: ["Preferences"],
       summary: "Set an authenticated user preference",
-      parameters: [{ name: "key", in: "path", required: true, schema: { type: "string" } }],
+      parameters: [
+        { name: "key", in: "path", required: true, schema: { type: "string" } }
+      ],
       requestBody: {
         required: true,
         content: { "application/json": { schema: { type: "object" } } }
@@ -1157,10 +1463,23 @@ function generateOpenApi(config) {
       tags: ["Audit"],
       summary: "Get audit entries across all readable audited collections",
       parameters: [
-        { name: "limit", in: "query", schema: { type: "integer", default: 50, maximum: 100 } },
+        {
+          name: "limit",
+          in: "query",
+          schema: { type: "integer", default: 50, maximum: 100 }
+        },
         { name: "page", in: "query", schema: { type: "integer", default: 1 } },
-        { name: "where", in: "query", schema: { type: "string" }, description: "JSON filter" },
-        { name: "sort", in: "query", schema: { type: "string", default: "-timestamp" } }
+        {
+          name: "where",
+          in: "query",
+          schema: { type: "string" },
+          description: "JSON filter"
+        },
+        {
+          name: "sort",
+          in: "query",
+          schema: { type: "string", default: "-timestamp" }
+        }
       ],
       responses: {
         200: {
@@ -1365,10 +1684,27 @@ function generateOpenApi(config) {
           tags: [collectionTag],
           summary: `Get ${labels.singular} audit entries`,
           parameters: [
-            { name: "limit", in: "query", schema: { type: "integer", default: 50, maximum: 100 } },
-            { name: "page", in: "query", schema: { type: "integer", default: 1 } },
-            { name: "where", in: "query", schema: { type: "string" }, description: "JSON filter" },
-            { name: "sort", in: "query", schema: { type: "string", default: "-timestamp" } }
+            {
+              name: "limit",
+              in: "query",
+              schema: { type: "integer", default: 50, maximum: 100 }
+            },
+            {
+              name: "page",
+              in: "query",
+              schema: { type: "integer", default: 1 }
+            },
+            {
+              name: "where",
+              in: "query",
+              schema: { type: "string" },
+              description: "JSON filter"
+            },
+            {
+              name: "sort",
+              in: "query",
+              schema: { type: "string", default: "-timestamp" }
+            }
           ],
           responses: {
             200: {
@@ -1494,6 +1830,15 @@ function generateOpenApi(config) {
         post: {
           tags: [collectionTag],
           summary: `Log out of ${labels.plural}`,
+          parameters: [
+            {
+              name: "allSessions",
+              in: "query",
+              required: false,
+              schema: { type: "boolean" },
+              description: "Revoke every active session for this account instead of only the current one."
+            }
+          ],
           responses: { 200: { description: "Logged out" } }
         }
       };
@@ -1519,7 +1864,11 @@ function generateOpenApi(config) {
         post: {
           tags: [collectionTag],
           summary: "Refresh an authentication token",
-          responses: { 200: { description: "Refreshed token" } }
+          responses: {
+            200: {
+              description: "Refreshed token for the current active session"
+            }
+          }
         }
       };
       spec.paths[`${path}/forgot-password`] = {
@@ -1550,7 +1899,11 @@ function generateOpenApi(config) {
               schema: { type: "string" }
             }
           ],
-          responses: { 200: { description: "Password changed" } }
+          responses: {
+            200: {
+              description: "Password changed and active sessions revoked"
+            }
+          }
         }
       };
     }
@@ -1759,7 +2112,7 @@ function fieldsToProperties(fields) {
   return { properties: props, required };
 }
 function fieldToSchema(field) {
-  let schema = {};
+  let schema;
   switch (field.type) {
     case "text":
     case "textarea":
@@ -1768,7 +2121,10 @@ function fieldToSchema(field) {
       break;
     case "url":
       schema = {
-        oneOf: [{ type: "string" }, { type: "object", additionalProperties: true }]
+        oneOf: [
+          { type: "string" },
+          { type: "object", additionalProperties: true }
+        ]
       };
       break;
     case "icon":
@@ -1916,6 +2272,7 @@ function defineTab(args) {
   LIFECYCLE_EVENT_NAMES,
   WORKFLOW_HISTORY_COLLECTION,
   availableWorkflowTransitions,
+  buildSqlOrderBy,
   canViewWorkflowDraft,
   createLifecycleEvent,
   createWorkflowDocument,
@@ -1937,6 +2294,7 @@ function defineTab(args) {
   defineMultiSelectField,
   defineNumberField,
   defineObjectField,
+  definePublishingWorkflow,
   defineRadioField,
   defineRelationshipField,
   defineRichTextField,
@@ -1957,6 +2315,7 @@ function defineTab(args) {
   initializeWorkflowDocument,
   materializeWorkflowDocument,
   normalizeConfig,
+  numericFieldNames,
   parseMongoWhere,
   parseSort,
   parseSqlWhere,
@@ -1964,6 +2323,7 @@ function defineTab(args) {
   resolveAdminAuthCollection,
   runCollectionHooks,
   saveWorkflowDraft,
+  simplePublishingWorkflow,
   transitionWorkflow,
   workflowCapabilities
 });