@dyrected/core 2.5.60 → 2.5.62

package/dist/server.js

@@ -1,19 +1,41 @@
 import {
   WORKFLOW_HISTORY_COLLECTION,
+  attachRequestMetrics,
+  bindObservabilityRuntime,
+  buildRequestLogger,
   canViewWorkflowDraft,
+  captureRequestBody,
+  createObservabilityRuntime,
+  createRequestSpan,
   createWorkflowDocument,
+  endRequestSpan,
   executeFieldAfterRead,
   executeFieldBeforeChange,
   generateOpenApi,
   getAdminAuthCollection,
+  getAuthSession,
+  getConfigLogger,
+  getObservabilityRuntime,
   getPublicAdminAuthConfig,
+  getRequestLogger,
   initializeWorkflowDocument,
+  isAuthSessionActive,
+  issueAuthSessionToken,
   materializeWorkflowDocument,
+  mergeDynamicConfig,
   normalizeConfig,
+  redactHeaders,
+  renderPrometheusMetrics,
+  revokeAllAuthSessions,
+  revokeAuthSession,
   runCollectionHooks,
   saveWorkflowDraft,
-  transitionWorkflow
-} from "./chunk-2WODKOUB.js";
+  shouldSampleRequest,
+  signCollectionToken,
+  touchAuthSession,
+  transitionWorkflow,
+  verifyCollectionToken
+} from "./chunk-BQV3QW3Y.js";
 
 // src/app.ts
 import { Hono } from "hono";
@@ -81,12 +103,16 @@ var PopulationService = class {
       return data;
     }
     if (Array.isArray(data)) {
-      return Promise.all(data.map((item) => this.populate({ ...args, data: item })));
+      return Promise.all(
+        data.map((item) => this.populate({ ...args, data: item }))
+      );
     }
     const populatedDoc = { ...data };
     for (const field of fields) {
       if (field.type === "join" && field.collection && field.on && currentDepth === 0) {
-        const targetCollection = this.collections.find((c) => c.slug === field.collection);
+        const targetCollection = this.collections.find(
+          (c) => c.slug === field.collection
+        );
         if (targetCollection) {
           const docId = populatedDoc.id;
           if (docId) {
@@ -98,7 +124,9 @@ var PopulationService = class {
               limit: joinLimit
             });
             const populatedDocs = await this.populate({
-              data: result.docs.map((doc) => DefaultsService.apply(targetCollection.fields, doc)),
+              data: result.docs.map(
+                (doc) => DefaultsService.apply(targetCollection.fields, doc)
+              ),
               fields: targetCollection.fields,
               currentDepth: 1,
               maxDepth
@@ -113,14 +141,21 @@ var PopulationService = class {
         continue;
       }
       if (field.type === "row" && field.fields) {
-        const rowPopulated = await this.populate({ data, fields: field.fields, currentDepth, maxDepth });
+        const rowPopulated = await this.populate({
+          data,
+          fields: field.fields,
+          currentDepth,
+          maxDepth
+        });
         Object.assign(populatedDoc, rowPopulated);
         continue;
       }
       if (!field.name) continue;
       const value = populatedDoc[field.name];
       if (field.type === "relationship" && field.relationTo && value) {
-        const relatedCollection = this.collections.find((c) => c.slug === field.relationTo);
+        const relatedCollection = this.collections.find(
+          (c) => c.slug === field.relationTo
+        );
         if (!relatedCollection) continue;
         if (Array.isArray(value)) {
           populatedDoc[field.name] = await Promise.all(
@@ -128,10 +163,16 @@ var PopulationService = class {
               if (!id) return id;
               let doc = id;
               if (typeof id === "string") {
-                doc = await this.db.findOne({ collection: field.relationTo, id });
+                doc = await this.db.findOne({
+                  collection: field.relationTo,
+                  id
+                });
               }
               if (!doc || typeof doc !== "object") return id;
-              const docWithDefaults = DefaultsService.apply(relatedCollection.fields, doc);
+              const docWithDefaults = DefaultsService.apply(
+                relatedCollection.fields,
+                doc
+              );
               return this.populate({
                 data: docWithDefaults,
                 fields: relatedCollection.fields,
@@ -143,10 +184,16 @@ var PopulationService = class {
         } else if (value) {
           let doc = value;
           if (typeof value === "string") {
-            doc = await this.db.findOne({ collection: field.relationTo, id: value });
+            doc = await this.db.findOne({
+              collection: field.relationTo,
+              id: value
+            });
           }
           if (doc && typeof doc === "object") {
-            const docWithDefaults = DefaultsService.apply(relatedCollection.fields, doc);
+            const docWithDefaults = DefaultsService.apply(
+              relatedCollection.fields,
+              doc
+            );
             populatedDoc[field.name] = await this.populate({
               data: docWithDefaults,
               fields: relatedCollection.fields,
@@ -157,11 +204,19 @@ var PopulationService = class {
         }
       }
       if (field.type === "url" && value && typeof value === "object" && value.type === "internal" && value.relationTo && value.value) {
-        const relatedCollection = this.collections.find((c) => c.slug === value.relationTo);
+        const relatedCollection = this.collections.find(
+          (c) => c.slug === value.relationTo
+        );
         if (relatedCollection) {
-          const doc = await this.db.findOne({ collection: value.relationTo, id: value.value });
+          const doc = await this.db.findOne({
+            collection: value.relationTo,
+            id: value.value
+          });
           if (doc && typeof doc === "object") {
-            const docWithDefaults = DefaultsService.apply(relatedCollection.fields, doc);
+            const docWithDefaults = DefaultsService.apply(
+              relatedCollection.fields,
+              doc
+            );
             const populatedDocValue = await this.populate({
               data: docWithDefaults,
               fields: relatedCollection.fields,
@@ -179,15 +234,27 @@ var PopulationService = class {
                 }
               } else if (typeof previewUrlPattern === "string") {
                 if (previewUrlPattern.includes("{{")) {
-                  resolvedUrl = previewUrlPattern.replace(/{{(.*?)}}/g, (_, key) => String(docWithDefaults[key.trim()] || ""));
+                  resolvedUrl = previewUrlPattern.replace(
+                    /{{(.*?)}}/g,
+                    (_, key) => String(docWithDefaults[key.trim()] || "")
+                  );
                 } else if (previewUrlPattern.includes("+") || previewUrlPattern.includes("?") || previewUrlPattern.includes("==") || previewUrlPattern.includes("siteUrl")) {
                   try {
-                    resolvedUrl = jexl.evalSync(previewUrlPattern, docWithDefaults);
-                  } catch (err) {
-                    resolvedUrl = previewUrlPattern.replace(/:([a-zA-Z0-9_]+)/g, (_, key) => String(docWithDefaults[key] || ""));
+                    resolvedUrl = jexl.evalSync(
+                      previewUrlPattern,
+                      docWithDefaults
+                    );
+                  } catch (_err) {
+                    resolvedUrl = previewUrlPattern.replace(
+                      /:([a-zA-Z0-9_]+)/g,
+                      (_, key) => String(docWithDefaults[key] || "")
+                    );
                   }
                 } else {
-                  resolvedUrl = previewUrlPattern.replace(/:([a-zA-Z0-9_]+)/g, (_, key) => String(docWithDefaults[key] || ""));
+                  resolvedUrl = previewUrlPattern.replace(
+                    /:([a-zA-Z0-9_]+)/g,
+                    (_, key) => String(docWithDefaults[key] || "")
+                  );
                 }
               }
             }
@@ -211,7 +278,9 @@ var PopulationService = class {
       if (field.type === "blocks" && field.blocks && Array.isArray(value)) {
         populatedDoc[field.name] = await Promise.all(
           value.map(async (blockData) => {
-            const blockConfig = field.blocks.find((b) => b.slug === blockData.blockType);
+            const blockConfig = field.blocks.find(
+              (b) => b.slug === blockData.blockType
+            );
             if (!blockConfig) return blockData;
             return this.populate({
               data: blockData,
@@ -249,7 +318,7 @@ var AuditService = class {
    * Writes a single entry to the __audit collection.
    * Called without await — runs asynchronously and never blocks the primary operation.
    */
-  static async log(db, args) {
+  static async log(db, args, config) {
     try {
       await db.create({
         collection: "__audit",
@@ -266,7 +335,17 @@ var AuditService = class {
         }
       });
     } catch (err) {
-      console.error("[dyrected/audit] Failed to write audit log:", err);
+      getObservabilityRuntime(config)?.recordAuditWriteFailure({
+        collection: args.collection,
+        operation: args.operation
+      });
+      getConfigLogger(config, "audit").error({
+        err,
+        msg: "Failed to write audit log",
+        collection: args.collection,
+        operation: args.operation,
+        documentId: args.documentId
+      });
     }
   }
 };
@@ -351,7 +430,11 @@ async function evaluateAccess(expression, context) {
     }
     return !!result;
   } catch (err) {
-    console.error("[dyrected/core] Jexl evaluation failed:", err);
+    getConfigLogger(context.config, "access").error({
+      err,
+      msg: "Jexl evaluation failed",
+      expression
+    });
     return false;
   }
 }
@@ -363,30 +446,40 @@ function isNamedAccessPolicy(value) {
 async function resolveAccess(config, access, args) {
   if (access === void 0 || access === null) return void 0;
   if (typeof access === "boolean" || typeof access === "string") {
-    return evaluateAccess(access, args);
+    return evaluateAccess(access, { ...args, config });
   }
   if (typeof access === "function") {
     try {
       return await access(args);
     } catch (err) {
-      console.error("[dyrected/core] Functional access check failed:", err);
+      getConfigLogger(config, "access").error({
+        err,
+        msg: "Functional access check failed"
+      });
       return false;
     }
   }
   if (isNamedAccessPolicy(access)) {
     const policy = config.accessPolicies?.[access.policy];
     if (policy === void 0) {
-      console.error(`[dyrected/core] Unknown access policy "${access.policy}".`);
+      getConfigLogger(config, "access").error({
+        msg: "Unknown access policy",
+        policy: access.policy
+      });
       return false;
     }
     if (typeof policy === "string" || typeof policy === "boolean") {
-      return evaluateAccess(policy, args);
+      return evaluateAccess(policy, { ...args, config });
     }
     try {
       const resolver = policy;
       return await resolver({ ...args, params: access.params });
     } catch (err) {
-      console.error(`[dyrected/core] Access policy "${access.policy}" failed:`, err);
+      getConfigLogger(config, "access").error({
+        err,
+        msg: "Access policy failed",
+        policy: access.policy
+      });
       return false;
     }
   }
@@ -438,32 +531,48 @@ async function applyFieldReadAccess(context, doc) {
   const result = { ...doc };
   for (const field of context.fields) {
     if (field.type === "row" && field.fields) {
-      Object.assign(result, await applyFieldReadAccess({ ...context, fields: field.fields }, result));
+      Object.assign(
+        result,
+        await applyFieldReadAccess(
+          { ...context, fields: field.fields },
+          result
+        )
+      );
       continue;
     }
     if (!field.name) continue;
     const value = result[field.name];
-    const canRead = await resolveBooleanAccess(context.config, field.access?.read, {
-      user: context.user,
-      req: context.req,
-      doc: context.doc,
-      data: context.data,
-      id: resolveFieldAccessId(context)
-    });
+    const canRead = await resolveBooleanAccess(
+      context.config,
+      field.access?.read,
+      {
+        user: context.user,
+        req: context.req,
+        doc: context.doc,
+        data: context.data,
+        id: resolveFieldAccessId(context)
+      }
+    );
     if (!canRead) {
       delete result[field.name];
       continue;
     }
     if (value === void 0 || value === null) continue;
     if (field.type === "object" && field.fields && typeof value === "object" && !Array.isArray(value)) {
-      result[field.name] = await applyFieldReadAccess({ ...context, fields: field.fields }, value);
+      result[field.name] = await applyFieldReadAccess(
+        { ...context, fields: field.fields },
+        value
+      );
       continue;
     }
     if (field.type === "array" && field.fields && Array.isArray(value)) {
       const childFields = field.fields;
       result[field.name] = await Promise.all(
         value.map(
-          (item) => typeof item === "object" && item !== null ? applyFieldReadAccess({ ...context, fields: childFields }, item) : item
+          (item) => typeof item === "object" && item !== null ? applyFieldReadAccess(
+            { ...context, fields: childFields },
+            item
+          ) : item
         )
       );
       continue;
@@ -473,9 +582,14 @@ async function applyFieldReadAccess(context, doc) {
         value.map(async (item) => {
           if (typeof item !== "object" || item === null) return item;
           const typedItem = item;
-          const block = field.blocks?.find((candidate) => candidate.slug === typedItem.blockType);
+          const block = field.blocks?.find(
+            (candidate) => candidate.slug === typedItem.blockType
+          );
           if (!block || !block.fields) return item;
-          return applyFieldReadAccess({ ...context, fields: block.fields }, typedItem);
+          return applyFieldReadAccess(
+            { ...context, fields: block.fields },
+            typedItem
+          );
         })
       );
     }
@@ -487,7 +601,13 @@ async function applyFieldWriteAccess(context, data) {
   const result = { ...data };
   for (const field of context.fields) {
     if (field.type === "row" && field.fields) {
-      Object.assign(result, await applyFieldWriteAccess({ ...context, fields: field.fields }, result));
+      Object.assign(
+        result,
+        await applyFieldWriteAccess(
+          { ...context, fields: field.fields },
+          result
+        )
+      );
       continue;
     }
     if (!field.name || !(field.name in result)) continue;
@@ -506,14 +626,20 @@ async function applyFieldWriteAccess(context, data) {
     const value = result[field.name];
     if (value === void 0 || value === null) continue;
     if (field.type === "object" && field.fields && typeof value === "object" && !Array.isArray(value)) {
-      result[field.name] = await applyFieldWriteAccess({ ...context, fields: field.fields }, value);
+      result[field.name] = await applyFieldWriteAccess(
+        { ...context, fields: field.fields },
+        value
+      );
       continue;
     }
     if (field.type === "array" && field.fields && Array.isArray(value)) {
       const childFields = field.fields;
       result[field.name] = await Promise.all(
         value.map(
-          (item) => typeof item === "object" && item !== null ? applyFieldWriteAccess({ ...context, fields: childFields }, item) : item
+          (item) => typeof item === "object" && item !== null ? applyFieldWriteAccess(
+            { ...context, fields: childFields },
+            item
+          ) : item
         )
       );
       continue;
@@ -523,9 +649,14 @@ async function applyFieldWriteAccess(context, data) {
         value.map(async (item) => {
           if (typeof item !== "object" || item === null) return item;
           const typedItem = item;
-          const block = field.blocks?.find((candidate) => candidate.slug === typedItem.blockType);
+          const block = field.blocks?.find(
+            (candidate) => candidate.slug === typedItem.blockType
+          );
           if (!block || !block.fields) return item;
-          return applyFieldWriteAccess({ ...context, fields: block.fields }, typedItem);
+          return applyFieldWriteAccess(
+            { ...context, fields: block.fields },
+            typedItem
+          );
         })
       );
     }
@@ -587,7 +718,13 @@ var CollectionController = class {
         } catch {
         }
       }
-      const paginatedResult = await provider.members.list({ limit: limit2, page: page2, sort: sort2, where: where2, req: hookReq });
+      const paginatedResult = await provider.members.list({
+        limit: limit2,
+        page: page2,
+        sort: sort2,
+        where: where2,
+        req: hookReq
+      });
       const mappedDocs = [];
       for (const m of paginatedResult.docs) {
         let localId = m.id;
@@ -611,7 +748,7 @@ var CollectionController = class {
       });
     }
     const readonlyDb = createReadonlyDb(db);
-    const limit = Number(c.req.query("limit")) || 10;
+    const limit = Math.min(Number(c.req.query("limit")) || 10, 100);
     const page = Number(c.req.query("page")) || 1;
     const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const sort = c.req.query("sort") || void 0;
@@ -635,12 +772,15 @@ var CollectionController = class {
         }
       }
     }
-    const beforeReadResult = await runCollectionHooks(this.collection.hooks?.beforeRead, {
-      req: c.req,
-      query: where,
-      user,
-      db: readonlyDb
-    });
+    const beforeReadResult = await runCollectionHooks(
+      this.collection.hooks?.beforeRead,
+      {
+        req: c.req,
+        query: where,
+        user,
+        db: readonlyDb
+      }
+    );
     if (beforeReadResult !== void 0) {
       where = beforeReadResult;
     }
@@ -649,7 +789,13 @@ var CollectionController = class {
     }
     const access = await this.evaluateAccess(c, "read");
     if (!access.allowed) {
-      return c.json({ error: true, message: `Access denied: read on ${this.collection.slug}` }, 403);
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: read on ${this.collection.slug}`
+        },
+        403
+      );
     }
     if (access.constraint) {
       where = mergeWhereConstraint(where, access.constraint);
@@ -659,10 +805,14 @@ var CollectionController = class {
       limit,
       page,
       sort,
-      where
+      where,
+      fields: this.collection.fields
     });
     if (result.total === 0 && this.collection.initialData && !where && page === 1) {
-      console.log(`[dyrected/core] Auto-seeding collection "${this.collection.slug}" from config.initialData`);
+      getRequestLogger(c, "collection").info({
+        msg: "Auto-seeding collection from config.initialData",
+        collection: this.collection.slug
+      });
       for (const data of this.collection.initialData) {
         await db.create({ collection: this.collection.slug, data });
       }
@@ -671,34 +821,58 @@ var CollectionController = class {
         limit,
         page,
         sort,
-        where
+        where,
+        fields: this.collection.fields
       });
     }
-    result.docs = result.docs.map((doc) => this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc).filter((doc) => doc !== null);
+    result.docs = result.docs.map(
+      (doc) => this.collection.workflow ? materializeWorkflowDocument(
+        doc,
+        this.collection.workflow,
+        user
+      ) : doc
+    ).filter((doc) => doc !== null);
     const processedDocs = [];
-    const readonlyDbForHooks = createReadonlyDb(db);
     for (const doc of result.docs) {
-      const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
-      const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
-        doc: docWithDefaults,
-        req: c.req,
-        user,
-        db: readonlyDb
-      });
-      const docWithFieldHooks = await executeFieldAfterRead(this.collection.fields, docWithCollectionHooks, user, readonlyDb);
-      const docWithFieldAccess = await applyFieldReadAccess({
-        config,
-        fields: this.collection.fields,
+      const docWithDefaults = DefaultsService.apply(
+        this.collection.fields,
+        doc
+      );
+      const docWithCollectionHooks = await runCollectionHooks(
+        this.collection.hooks?.afterRead,
+        {
+          doc: docWithDefaults,
+          req: c.req,
+          user,
+          db: readonlyDb
+        }
+      );
+      const docWithFieldHooks = await executeFieldAfterRead(
+        this.collection.fields,
+        docWithCollectionHooks,
         user,
-        req: this.toHookRequestContext(c),
-        doc: docWithFieldHooks
-      }, docWithFieldHooks);
+        readonlyDb
+      );
+      const docWithFieldAccess = await applyFieldReadAccess(
+        {
+          config,
+          fields: this.collection.fields,
+          user,
+          req: this.toHookRequestContext(c),
+          doc: docWithFieldHooks
+        },
+        docWithFieldHooks
+      );
       processedDocs.push(docWithFieldAccess);
     }
     result.docs = processedDocs;
     if (depth > 0) {
       const populationService = new PopulationService(db, config.collections);
-      result = await populationService.populateResult(result, this.collection.fields, depth);
+      result = await populationService.populateResult(
+        result,
+        this.collection.fields,
+        depth
+      );
     }
     return c.json(result);
   }
@@ -711,7 +885,10 @@ var CollectionController = class {
       const hookReq = this.toHookRequestContext(c);
       const id2 = c.req.param("id");
       if (!id2) return c.json({ message: "Missing ID" }, 400);
-      const localDoc = await db.findOne({ collection: this.collection.slug, id: id2 });
+      const localDoc = await db.findOne({
+        collection: this.collection.slug,
+        id: id2
+      });
       const externalSubject = localDoc?.externalSubject || id2;
       let member = null;
       if (provider.members.get) {
@@ -740,23 +917,40 @@ var CollectionController = class {
     }
     const access = await this.evaluateAccess(c, "read", { id, doc });
     if (!access.allowed) {
-      return c.json({ error: true, message: `Access denied: read on ${this.collection.slug}` }, 403);
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: read on ${this.collection.slug}`
+        },
+        403
+      );
     }
     const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
-    const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
-      doc: docWithDefaults,
-      req: c.req,
-      user,
-      db: readonlyDb
-    });
-    const docWithFieldHooks = await executeFieldAfterRead(this.collection.fields, docWithCollectionHooks, user, readonlyDb);
-    const docWithFieldAccess = await applyFieldReadAccess({
-      config,
-      fields: this.collection.fields,
+    const docWithCollectionHooks = await runCollectionHooks(
+      this.collection.hooks?.afterRead,
+      {
+        doc: docWithDefaults,
+        req: c.req,
+        user,
+        db: readonlyDb
+      }
+    );
+    const docWithFieldHooks = await executeFieldAfterRead(
+      this.collection.fields,
+      docWithCollectionHooks,
       user,
-      req: this.toHookRequestContext(c),
-      doc: docWithFieldHooks
-    }, docWithFieldHooks);
+      readonlyDb
+    );
+    const docWithFieldAccess = await applyFieldReadAccess(
+      {
+        config,
+        fields: this.collection.fields,
+        user,
+        req: this.toHookRequestContext(c),
+        doc: docWithFieldHooks
+      },
+      docWithFieldHooks
+    );
     if (depth > 0 && docWithFieldAccess) {
       const populationService = new PopulationService(db, config.collections);
       const populatedDoc = await populationService.populate({
@@ -781,12 +975,18 @@ var CollectionController = class {
         return this.upload(c);
       }
       const body2 = await c.req.json();
-      const member = await provider.members.create({ data: body2, req: hookReq });
-      return c.json({
-        ...member,
-        id: member.id,
-        externalSubject: member.id
-      }, 201);
+      const member = await provider.members.create({
+        data: body2,
+        req: hookReq
+      });
+      return c.json(
+        {
+          ...member,
+          id: member.id,
+          externalSubject: member.id
+        },
+        201
+      );
     }
     const readonlyDb = createReadonlyDb(db);
     const contentType = c.req.header("Content-Type") || "";
@@ -808,20 +1008,35 @@ var CollectionController = class {
     }
     const createAccess = await this.evaluateAccess(c, "create", { data });
     if (!createAccess.allowed) {
-      return c.json({ error: true, message: `Access denied: create on ${this.collection.slug}` }, 403);
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: create on ${this.collection.slug}`
+        },
+        403
+      );
     }
     if (this.collection.auth && data.password) {
       data.password = await hashPassword(data.password);
     }
-    data = await applyFieldWriteAccess({
-      config,
-      fields: this.collection.fields,
-      user,
-      req: this.toHookRequestContext(c),
+    data = await applyFieldWriteAccess(
+      {
+        config,
+        fields: this.collection.fields,
+        user,
+        req: this.toHookRequestContext(c),
+        data,
+        operation: "create"
+      },
+      data
+    );
+    data = await executeFieldBeforeChange(
+      this.collection.fields,
       data,
-      operation: "create"
-    }, data);
-    data = await executeFieldBeforeChange(this.collection.fields, data, null, user, readonlyDb);
+      null,
+      user,
+      readonlyDb
+    );
     data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
       data,
       req: c.req,
@@ -829,7 +1044,12 @@ var CollectionController = class {
       operation: "create",
       db: readonlyDb
     });
-    const doc = this.collection.workflow ? (await createWorkflowDocument({ config, collection: this.collection, data, user })).doc : await db.create({ collection: this.collection.slug, data });
+    const doc = this.collection.workflow ? (await createWorkflowDocument({
+      config,
+      collection: this.collection,
+      data,
+      user
+    })).doc : await db.create({ collection: this.collection.slug, data });
     if (this.collection.audit && db) {
       AuditService.log(db, {
         operation: "create",
@@ -838,15 +1058,19 @@ var CollectionController = class {
         user: user ? { id: user.sub, collection: user.collection, email: user.email } : void 0,
         before: null,
         after: doc
-      });
+      }, config);
     }
-    await runCollectionHooks(this.collection.hooks?.afterChange, {
-      doc,
-      user,
-      req: c.req,
-      operation: "create",
-      db
-    }, { isolated: true });
+    await runCollectionHooks(
+      this.collection.hooks?.afterChange,
+      {
+        doc,
+        user,
+        req: c.req,
+        operation: "create",
+        db
+      },
+      { isolated: true }
+    );
     const responseDoc = this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc;
     const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
       doc: responseDoc,
@@ -854,14 +1078,22 @@ var CollectionController = class {
       user,
       db: readonlyDb
     });
-    const finalDoc = await executeFieldAfterRead(this.collection.fields, readDoc, user, readonlyDb);
-    const accessibleDoc = await applyFieldReadAccess({
-      config,
-      fields: this.collection.fields,
+    const finalDoc = await executeFieldAfterRead(
+      this.collection.fields,
+      readDoc,
       user,
-      req: this.toHookRequestContext(c),
-      doc: finalDoc
-    }, finalDoc);
+      readonlyDb
+    );
+    const accessibleDoc = await applyFieldReadAccess(
+      {
+        config,
+        fields: this.collection.fields,
+        user,
+        req: this.toHookRequestContext(c),
+        doc: finalDoc
+      },
+      finalDoc
+    );
     return c.json(accessibleDoc, 201);
   }
   async upload(c) {
@@ -877,7 +1109,10 @@ var CollectionController = class {
     const uploadConfig = typeof this.collection.upload === "object" ? this.collection.upload : void 0;
     const validationError = validateUpload(file, uploadConfig);
     if (validationError) {
-      return c.json({ message: validationError.message }, validationError.status);
+      return c.json(
+        { message: validationError.message },
+        validationError.status
+      );
     }
     const buffer = new Uint8Array(await file.arrayBuffer());
     const siteId = c.get("siteId");
@@ -907,17 +1142,32 @@ var CollectionController = class {
     };
     const createAccess = await this.evaluateAccess(c, "create", { data });
     if (!createAccess.allowed) {
-      return c.json({ error: true, message: `Access denied: create on ${this.collection.slug}` }, 403);
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: create on ${this.collection.slug}`
+        },
+        403
+      );
     }
-    data = await applyFieldWriteAccess({
-      config,
-      fields: this.collection.fields,
-      user,
-      req: this.toHookRequestContext(c),
+    data = await applyFieldWriteAccess(
+      {
+        config,
+        fields: this.collection.fields,
+        user,
+        req: this.toHookRequestContext(c),
+        data,
+        operation: "create"
+      },
+      data
+    );
+    data = await executeFieldBeforeChange(
+      this.collection.fields,
       data,
-      operation: "create"
-    }, data);
-    data = await executeFieldBeforeChange(this.collection.fields, data, null, user, readonlyDb);
+      null,
+      user,
+      readonlyDb
+    );
     data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
       data,
       req: c.req,
@@ -929,13 +1179,17 @@ var CollectionController = class {
       collection: this.collection.slug,
       data
     });
-    await runCollectionHooks(this.collection.hooks?.afterChange, {
-      doc,
-      user,
-      req: c.req,
-      operation: "create",
-      db
-    }, { isolated: true });
+    await runCollectionHooks(
+      this.collection.hooks?.afterChange,
+      {
+        doc,
+        user,
+        req: c.req,
+        operation: "create",
+        db
+      },
+      { isolated: true }
+    );
     const responseDoc = this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc;
     const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
       doc: responseDoc,
@@ -943,14 +1197,22 @@ var CollectionController = class {
       user,
       db: readonlyDb
     });
-    const finalDoc = await executeFieldAfterRead(this.collection.fields, readDoc, user, readonlyDb);
-    const accessibleDoc = await applyFieldReadAccess({
-      config,
-      fields: this.collection.fields,
+    const finalDoc = await executeFieldAfterRead(
+      this.collection.fields,
+      readDoc,
       user,
-      req: this.toHookRequestContext(c),
-      doc: finalDoc
-    }, finalDoc);
+      readonlyDb
+    );
+    const accessibleDoc = await applyFieldReadAccess(
+      {
+        config,
+        fields: this.collection.fields,
+        user,
+        req: this.toHookRequestContext(c),
+        doc: finalDoc
+      },
+      finalDoc
+    );
     return c.json(accessibleDoc, 201);
   }
   async update(c) {
@@ -963,9 +1225,16 @@ var CollectionController = class {
       const id2 = c.req.param("id");
       if (!id2) return c.json({ message: "Missing ID" }, 400);
       const body2 = await c.req.json();
-      const localDoc = await db.findOne({ collection: this.collection.slug, id: id2 });
+      const localDoc = await db.findOne({
+        collection: this.collection.slug,
+        id: id2
+      });
       const externalSubject = localDoc?.externalSubject || id2;
-      const member = await provider.members.update({ externalSubject, data: body2, req: hookReq });
+      const member = await provider.members.update({
+        externalSubject,
+        data: body2,
+        req: hookReq
+      });
       return c.json({
         ...member,
         id: localDoc ? localDoc.id : member.id,
@@ -987,25 +1256,47 @@ var CollectionController = class {
       updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
       updatedBy: user?.sub ?? null
     });
-    const originalDoc = await db.findOne({ collection: this.collection.slug, id });
+    const originalDoc = await db.findOne({
+      collection: this.collection.slug,
+      id
+    });
     if (!originalDoc) return c.json({ message: "Not Found" }, 404);
-    const updateAccess = await this.evaluateAccess(c, "update", { id, doc: originalDoc, data });
+    const updateAccess = await this.evaluateAccess(c, "update", {
+      id,
+      doc: originalDoc,
+      data
+    });
     if (!updateAccess.allowed) {
-      return c.json({ error: true, message: `Access denied: update on ${this.collection.slug}` }, 403);
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: update on ${this.collection.slug}`
+        },
+        403
+      );
     }
     let before = null;
     if (this.collection.audit) {
       before = originalDoc;
     }
-    data = await applyFieldWriteAccess({
-      config,
-      fields: this.collection.fields,
-      user,
-      req: this.toHookRequestContext(c),
-      doc: originalDoc,
+    data = await applyFieldWriteAccess(
+      {
+        config,
+        fields: this.collection.fields,
+        user,
+        req: this.toHookRequestContext(c),
+        doc: originalDoc,
+        data
+      },
       data
-    }, data);
-    data = await executeFieldBeforeChange(this.collection.fields, data, originalDoc, user, readonlyDb);
+    );
+    data = await executeFieldBeforeChange(
+      this.collection.fields,
+      data,
+      originalDoc,
+      user,
+      readonlyDb
+    );
     data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
       data,
       doc: originalDoc,
@@ -1014,7 +1305,14 @@ var CollectionController = class {
       operation: "update",
       db: readonlyDb
     });
-    const doc = this.collection.workflow ? (await saveWorkflowDraft({ config, collection: this.collection, id, originalDoc, data, user })).doc : await db.update({ collection: this.collection.slug, id, data });
+    const doc = this.collection.workflow ? (await saveWorkflowDraft({
+      config,
+      collection: this.collection,
+      id,
+      originalDoc,
+      data,
+      user
+    })).doc : await db.update({ collection: this.collection.slug, id, data });
     if (this.collection.audit && db) {
       AuditService.log(db, {
         operation: "update",
@@ -1023,36 +1321,52 @@ var CollectionController = class {
         user: user ? { id: user.sub, collection: user.collection, email: user.email } : void 0,
         before,
         after: doc
-      });
+      }, config);
     }
-    await runCollectionHooks(this.collection.hooks?.afterChange, {
-      doc,
-      previousDoc: originalDoc,
-      user,
-      req: c.req,
-      operation: "update",
-      db
-    }, { isolated: true });
+    await runCollectionHooks(
+      this.collection.hooks?.afterChange,
+      {
+        doc,
+        previousDoc: originalDoc,
+        user,
+        req: c.req,
+        operation: "update",
+        db
+      },
+      { isolated: true }
+    );
     const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
       doc,
       req: c.req,
       user,
       db: readonlyDb
     });
-    const finalDoc = await executeFieldAfterRead(this.collection.fields, readDoc, user, readonlyDb);
-    const accessibleDoc = await applyFieldReadAccess({
-      config,
-      fields: this.collection.fields,
+    const finalDoc = await executeFieldAfterRead(
+      this.collection.fields,
+      readDoc,
       user,
-      req: this.toHookRequestContext(c),
-      doc: finalDoc
-    }, finalDoc);
+      readonlyDb
+    );
+    const accessibleDoc = await applyFieldReadAccess(
+      {
+        config,
+        fields: this.collection.fields,
+        user,
+        req: this.toHookRequestContext(c),
+        doc: finalDoc
+      },
+      finalDoc
+    );
     return c.json(accessibleDoc);
   }
   async transition(c) {
     const config = c.get("config");
     if (!config.db) return c.json({ message: "Database not configured" }, 500);
-    if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    if (!this.collection.workflow)
+      return c.json(
+        { message: "Workflows are not enabled for this collection" },
+        404
+      );
     const id = c.req.param("id");
     const transitionName = c.req.param("transition");
     const body = await c.req.json().catch(() => ({}));
@@ -1067,19 +1381,38 @@ var CollectionController = class {
         user: c.get("user"),
         req: { query: c.req.query(), headers: c.req.header(), raw: c.req.raw }
       });
-      return c.json(materializeWorkflowDocument(doc, this.collection.workflow, c.get("user")));
+      return c.json(
+        materializeWorkflowDocument(
+          doc,
+          this.collection.workflow,
+          c.get("user")
+        )
+      );
     } catch (error) {
       const status = typeof error.statusCode === "number" ? error.statusCode : 500;
-      return c.json({ error: true, message: error instanceof Error ? error.message : String(error) }, status);
+      return c.json(
+        {
+          error: true,
+          message: error instanceof Error ? error.message : String(error)
+        },
+        status
+      );
     }
   }
   async workflowHistory(c) {
     const config = c.get("config");
     if (!config.db) return c.json({ message: "Database not configured" }, 500);
-    if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    if (!this.collection.workflow)
+      return c.json(
+        { message: "Workflows are not enabled for this collection" },
+        404
+      );
     const documentId = c.req.param("id");
     if (!documentId) return c.json({ message: "Missing ID" }, 400);
-    const document = await config.db.findOne({ collection: this.collection.slug, id: documentId });
+    const document = await config.db.findOne({
+      collection: this.collection.slug,
+      id: documentId
+    });
     if (!document) return c.json({ message: "Not Found" }, 404);
     const readAccess = this.collection.access?.read;
     if (readAccess !== void 0 && readAccess !== null) {
@@ -1094,11 +1427,21 @@ var CollectionController = class {
         });
         allowed = match.total > 0;
       }
-      if (!allowed) return c.json({ error: true, message: `Access denied: read on ${this.collection.slug}` }, 403);
+      if (!allowed)
+        return c.json(
+          {
+            error: true,
+            message: `Access denied: read on ${this.collection.slug}`
+          },
+          403
+        );
     }
     const result = await config.db.find({
       collection: WORKFLOW_HISTORY_COLLECTION,
-      where: { collection: { equals: this.collection.slug }, documentId: { equals: documentId } },
+      where: {
+        collection: { equals: this.collection.slug },
+        documentId: { equals: documentId }
+      },
       sort: "-createdAt",
       limit: Math.min(Number(c.req.query("limit")) || 50, 100)
     });
@@ -1120,7 +1463,10 @@ var CollectionController = class {
     const db = config.db;
     if (!db) return c.json({ message: "Database not configured" }, 500);
     if (!this.collection.auth) {
-      return c.json({ message: "This collection does not support authentication" }, 400);
+      return c.json(
+        { message: "This collection does not support authentication" },
+        400
+      );
     }
     const id = c.req.param("id");
     if (!id) return c.json({ message: "Missing ID" }, 400);
@@ -1140,29 +1486,44 @@ var CollectionController = class {
     const isAdmin = Array.isArray(user.roles) && user.roles.includes("admin");
     const isSelf = user.sub === id;
     if (!isAdmin && !isSelf) {
-      return c.json({ message: "You are not authorised to change this password" }, 403);
+      return c.json(
+        { message: "You are not authorised to change this password" },
+        403
+      );
     }
     if (!isAdmin) {
       if (!oldPassword) {
         return c.json({ message: "Current password is required" }, 400);
       }
-      const existing = await db.findOne({ collection: this.collection.slug, id });
+      const existing = await db.findOne({
+        collection: this.collection.slug,
+        id
+      });
       if (!existing) return c.json({ message: "User not found" }, 404);
-      const valid = await verifyPassword(oldPassword, existing.password);
+      const valid = await verifyPassword(
+        oldPassword,
+        existing.password
+      );
       if (!valid) {
         return c.json({ message: "Invalid current password" }, 400);
       }
     }
     const hashed = await hashPassword(newPassword);
-    const doc = await db.update({
+    await db.update({
       collection: this.collection.slug,
       id,
       data: {
         password: hashed,
+        loginAttempts: 0,
+        lockedUntil: null,
         updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
         updatedBy: user.sub
       }
     });
+    await revokeAllAuthSessions(config, {
+      userId: id,
+      collection: this.collection.slug
+    });
     if (this.collection.audit) {
       AuditService.log(db, {
         operation: "update",
@@ -1171,7 +1532,7 @@ var CollectionController = class {
         user: { id: user.sub, collection: user.collection, email: user.email },
         before: null,
         after: { id }
-      });
+      }, config);
     }
     return c.json({ success: true, message: "Password updated successfully" });
   }
@@ -1184,7 +1545,10 @@ var CollectionController = class {
       const hookReq = this.toHookRequestContext(c);
       const id2 = c.req.param("id");
       if (!id2) return c.json({ message: "Missing ID" }, 400);
-      const localDoc = await db.findOne({ collection: this.collection.slug, id: id2 });
+      const localDoc = await db.findOne({
+        collection: this.collection.slug,
+        id: id2
+      });
       const externalSubject = localDoc?.externalSubject || id2;
       await provider.members.delete({ externalSubject, req: hookReq });
       return c.json({ message: "Deleted" });
@@ -1197,7 +1561,13 @@ var CollectionController = class {
     if (!doc) return c.json({ message: "Not Found" }, 404);
     const deleteAccess = await this.evaluateAccess(c, "delete", { id, doc });
     if (!deleteAccess.allowed) {
-      return c.json({ error: true, message: `Access denied: delete on ${this.collection.slug}` }, 403);
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: delete on ${this.collection.slug}`
+        },
+        403
+      );
     }
     let before = null;
     if (this.collection.audit) {
@@ -1219,15 +1589,19 @@ var CollectionController = class {
         user: user ? { id: user.sub, collection: user.collection, email: user.email } : void 0,
         before,
         after: null
-      });
+      }, config);
     }
-    await runCollectionHooks(this.collection.hooks?.afterDelete, {
-      id,
-      doc,
-      user,
-      req: c.req,
-      db
-    }, { isolated: true });
+    await runCollectionHooks(
+      this.collection.hooks?.afterDelete,
+      {
+        id,
+        doc,
+        user,
+        req: c.req,
+        db
+      },
+      { isolated: true }
+    );
     return c.json({ message: "Deleted" });
   }
   async deleteMany(c) {
@@ -1258,7 +1632,10 @@ var CollectionController = class {
           failed.push({ id, error: "Not Found" });
           continue;
         }
-        const deleteAccess = await this.evaluateAccess(c, "delete", { id, doc });
+        const deleteAccess = await this.evaluateAccess(c, "delete", {
+          id,
+          doc
+        });
         if (!deleteAccess.allowed) {
           failed.push({ id, error: "Access denied" });
           continue;
@@ -1284,15 +1661,19 @@ var CollectionController = class {
             user: user ? { id: user.sub, collection: user.collection, email: user.email } : void 0,
             before,
             after: null
-          });
+          }, config);
         }
-        await runCollectionHooks(this.collection.hooks?.afterDelete, {
-          id,
-          doc,
-          user,
-          req: c.req,
-          db
-        }, { isolated: true });
+        await runCollectionHooks(
+          this.collection.hooks?.afterDelete,
+          {
+            id,
+            doc,
+            user,
+            req: c.req,
+            db
+          },
+          { isolated: true }
+        );
       } catch (err) {
         failed.push({ id, error: err?.message ?? "Unknown error" });
       }
@@ -1312,17 +1693,26 @@ var CollectionController = class {
     if (!initialData || !Array.isArray(initialData)) {
       return c.json({ message: "Invalid initial data" }, 400);
     }
-    const result = await db.find({ collection: this.collection.slug, limit: 1 });
+    const result = await db.find({
+      collection: this.collection.slug,
+      limit: 1
+    });
     if (result.total > 0) {
       return c.json({ message: "Collection is not empty, skipping seed" });
     }
-    console.log(`[dyrected/core] Auto-seeding collection: ${this.collection.slug}`);
+    getRequestLogger(c, "collection").info({
+      msg: "Auto-seeding collection",
+      collection: this.collection.slug
+    });
     const createdDocs = [];
     for (const data of initialData) {
       const doc = await db.create({ collection: this.collection.slug, data });
       createdDocs.push(doc);
     }
-    return c.json({ message: "Seed successful", count: createdDocs.length }, 201);
+    return c.json(
+      { message: "Seed successful", count: createdDocs.length },
+      201
+    );
   }
 };
 
@@ -1339,46 +1729,66 @@ var GlobalController = class {
     const readonlyDb = createReadonlyDb(db);
     const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const user = c.get("user");
-    let query = void 0;
-    const beforeReadResult = await runCollectionHooks(this.global.hooks?.beforeRead, {
+    await runCollectionHooks(this.global.hooks?.beforeRead, {
       req: c.req,
-      query,
+      query: void 0,
       user,
       db: readonlyDb
     });
-    if (beforeReadResult !== void 0) {
-      query = beforeReadResult;
-    }
     let data = await db.getGlobal({ slug: this.global.slug });
     const isEmpty = !data || isFunctionallyEmpty(data);
     if (isEmpty && this.global.initialData) {
-      console.log(`[dyrected/core] Auto-seeding global "${this.global.slug}" from config.initialData`);
-      await db.updateGlobal({ slug: this.global.slug, data: this.global.initialData });
+      getRequestLogger(c, "global").info({
+        msg: "Auto-seeding global from config.initialData",
+        global: this.global.slug
+      });
+      await db.updateGlobal({
+        slug: this.global.slug,
+        data: this.global.initialData
+      });
       data = this.global.initialData;
     }
-    const canRead = await resolveBooleanAccess(config, this.global.access?.read, {
-      user,
-      req: toHookRequestContext(c.req),
-      doc: data
-    });
+    const canRead = await resolveBooleanAccess(
+      config,
+      this.global.access?.read,
+      {
+        user,
+        req: toHookRequestContext(c.req),
+        doc: data
+      }
+    );
     if (!canRead) {
-      return c.json({ error: true, message: `Access denied: read on ${this.global.slug}` }, 403);
+      return c.json(
+        { error: true, message: `Access denied: read on ${this.global.slug}` },
+        403
+      );
     }
     const dataWithDefaults = DefaultsService.apply(this.global.fields, data);
-    const docWithCollectionHooks = await runCollectionHooks(this.global.hooks?.afterRead, {
-      doc: dataWithDefaults,
-      req: c.req,
-      user,
-      db: readonlyDb
-    });
-    const docWithFieldHooks = await executeFieldAfterRead(this.global.fields, docWithCollectionHooks, user, readonlyDb);
-    const docWithFieldAccess = await applyFieldReadAccess({
-      config,
-      fields: this.global.fields,
+    const docWithCollectionHooks = await runCollectionHooks(
+      this.global.hooks?.afterRead,
+      {
+        doc: dataWithDefaults,
+        req: c.req,
+        user,
+        db: readonlyDb
+      }
+    );
+    const docWithFieldHooks = await executeFieldAfterRead(
+      this.global.fields,
+      docWithCollectionHooks,
       user,
-      req: toHookRequestContext(c.req),
-      doc: docWithFieldHooks
-    }, docWithFieldHooks);
+      readonlyDb
+    );
+    const docWithFieldAccess = await applyFieldReadAccess(
+      {
+        config,
+        fields: this.global.fields,
+        user,
+        req: toHookRequestContext(c.req),
+        doc: docWithFieldHooks
+      },
+      docWithFieldHooks
+    );
     if (depth > 0 && docWithFieldAccess) {
       const populationService = new PopulationService(db, config.collections);
       const populatedData = await populationService.populate({
@@ -1399,24 +1809,43 @@ var GlobalController = class {
     const body = await c.req.json();
     const user = c.get("user");
     const originalDoc = await db.getGlobal({ slug: this.global.slug }) || {};
-    const canUpdate = await resolveBooleanAccess(config, this.global.access?.update, {
-      user,
-      req: toHookRequestContext(c.req),
-      doc: originalDoc,
-      data: body
-    });
+    const canUpdate = await resolveBooleanAccess(
+      config,
+      this.global.access?.update,
+      {
+        user,
+        req: toHookRequestContext(c.req),
+        doc: originalDoc,
+        data: body
+      }
+    );
     if (!canUpdate) {
-      return c.json({ error: true, message: `Access denied: update on ${this.global.slug}` }, 403);
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: update on ${this.global.slug}`
+        },
+        403
+      );
     }
-    let sanitizedBody = await applyFieldWriteAccess({
-      config,
-      fields: this.global.fields,
+    const sanitizedBody = await applyFieldWriteAccess(
+      {
+        config,
+        fields: this.global.fields,
+        user,
+        req: toHookRequestContext(c.req),
+        doc: originalDoc,
+        data: body
+      },
+      body
+    );
+    let data = await executeFieldBeforeChange(
+      this.global.fields,
+      sanitizedBody,
+      originalDoc,
       user,
-      req: toHookRequestContext(c.req),
-      doc: originalDoc,
-      data: body
-    }, body);
-    let data = await executeFieldBeforeChange(this.global.fields, sanitizedBody, originalDoc, user, readonlyDb);
+      readonlyDb
+    );
     data = await runCollectionHooks(this.global.hooks?.beforeChange, {
       data,
       doc: originalDoc,
@@ -1426,28 +1855,40 @@ var GlobalController = class {
       db: readonlyDb
     });
     const updated = await db.updateGlobal({ slug: this.global.slug, data });
-    await runCollectionHooks(this.global.hooks?.afterChange, {
-      doc: updated,
-      previousDoc: originalDoc,
-      user,
-      req: c.req,
-      operation: "update",
-      db
-    }, { isolated: true });
+    await runCollectionHooks(
+      this.global.hooks?.afterChange,
+      {
+        doc: updated,
+        previousDoc: originalDoc,
+        user,
+        req: c.req,
+        operation: "update",
+        db
+      },
+      { isolated: true }
+    );
     const readDoc = await runCollectionHooks(this.global.hooks?.afterRead, {
       doc: updated,
       req: c.req,
       user,
       db: readonlyDb
     });
-    const finalDoc = await executeFieldAfterRead(this.global.fields, readDoc, user, readonlyDb);
-    const accessibleDoc = await applyFieldReadAccess({
-      config,
-      fields: this.global.fields,
+    const finalDoc = await executeFieldAfterRead(
+      this.global.fields,
+      readDoc,
       user,
-      req: toHookRequestContext(c.req),
-      doc: finalDoc
-    }, finalDoc);
+      readonlyDb
+    );
+    const accessibleDoc = await applyFieldReadAccess(
+      {
+        config,
+        fields: this.global.fields,
+        user,
+        req: toHookRequestContext(c.req),
+        doc: finalDoc
+      },
+      finalDoc
+    );
     return c.json(accessibleDoc);
   }
   async seed(c) {
@@ -1463,7 +1904,10 @@ var GlobalController = class {
     if (existing && !isFunctionallyEmpty(existing)) {
       return c.json({ message: "Global is not empty, skipping seed" });
     }
-    console.log(`[dyrected/core] Auto-seeding global: ${this.global.slug}`);
+    getRequestLogger(c, "global").info({
+      msg: "Auto-seeding global",
+      global: this.global.slug
+    });
     await db.updateGlobal({ slug: this.global.slug, data: initialData });
     return c.json({ message: "Seed successful", data: initialData }, 201);
   }
@@ -1485,6 +1929,7 @@ function isFunctionallyEmpty(obj) {
 // src/controllers/media.controller.ts
 var MediaController = class {
   collection;
+  loggerComponent = "media";
   constructor(collection = "media") {
     this.collection = collection;
   }
@@ -1503,15 +1948,25 @@ var MediaController = class {
       return c.json({ message: "No file uploaded" }, 400);
     }
     const siteId = c.get("siteId");
-    let colConfig = config.collections.find((col) => col.slug === this.collection);
+    let colConfig = config.collections.find(
+      (col) => col.slug === this.collection
+    );
     if (!colConfig && config.onSchemaFetch && siteId) {
-      const dynamic = await config.onSchemaFetch(siteId);
-      colConfig = dynamic.collections?.find((col) => col.slug === this.collection);
+      const requestConfig = mergeDynamicConfig(
+        config,
+        await config.onSchemaFetch(siteId)
+      );
+      colConfig = requestConfig.collections.find(
+        (col) => col.slug === this.collection
+      );
     }
     const uploadConfig = typeof colConfig?.upload === "object" ? colConfig.upload : void 0;
     const validationError = validateUpload(file, uploadConfig);
     if (validationError) {
-      return c.json({ message: validationError.message }, validationError.status);
+      return c.json(
+        { message: validationError.message },
+        validationError.status
+      );
     }
     const buffer = new Uint8Array(await file.arrayBuffer());
     const workspaceId = c.get("workspaceId");
@@ -1529,7 +1984,12 @@ var MediaController = class {
         imageMetadata = processed.metadata;
         imageSizes = processed.sizes;
       } catch (err) {
-        console.error("[MediaController] Image processing failed:", err);
+        getRequestLogger(c, this.loggerComponent).error({
+          err,
+          msg: "Image processing failed",
+          collection: this.collection,
+          filename: file.name
+        });
       }
     }
     const fileData = await storage.upload({
@@ -1562,7 +2022,13 @@ var MediaController = class {
             height: sizeData.height
           };
         } catch (err) {
-          console.error(`[MediaController] Failed to upload size ${sizeName}:`, err);
+          getRequestLogger(c, this.loggerComponent).error({
+            err,
+            msg: "Failed to upload image size",
+            collection: this.collection,
+            filename: file.name,
+            sizeName
+          });
         }
       }
     }
@@ -1626,25 +2092,37 @@ var MediaController = class {
   }
 };
 
-// src/auth/token.ts
-import { SignJWT, jwtVerify, decodeJwt } from "jose";
-import { TextEncoder } from "util";
-function getSecret() {
-  const secret = process.env.DYRECTED_JWT_SECRET;
-  if (!secret) {
-    throw new Error(
-      "[dyrected/core] DYRECTED_JWT_SECRET is not set. Add it to your environment variables to enable auth collections."
-    );
+// src/auth/lockout.ts
+var DEFAULT_MAX_LOGIN_ATTEMPTS = 5;
+var DEFAULT_LOCK_TIME_MS = 10 * 60 * 1e3;
+function resolveAuthLockoutConfig(collection) {
+  const auth = collection.auth;
+  if (!auth) {
+    return {
+      enabled: false,
+      maxLoginAttempts: DEFAULT_MAX_LOGIN_ATTEMPTS,
+      lockTime: DEFAULT_LOCK_TIME_MS
+    };
   }
-  return new TextEncoder().encode(secret);
-}
-var DEFAULT_EXPIRY = "7d";
-async function signCollectionToken(payload, expiresIn = DEFAULT_EXPIRY) {
-  return new SignJWT({ ...payload }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(expiresIn).sign(getSecret());
+  if (auth === true) {
+    return {
+      enabled: true,
+      maxLoginAttempts: DEFAULT_MAX_LOGIN_ATTEMPTS,
+      lockTime: DEFAULT_LOCK_TIME_MS
+    };
+  }
+  const maxLoginAttempts = typeof auth.maxLoginAttempts === "number" ? auth.maxLoginAttempts : DEFAULT_MAX_LOGIN_ATTEMPTS;
+  const lockTime = typeof auth.lockTime === "number" && auth.lockTime > 0 ? auth.lockTime : DEFAULT_LOCK_TIME_MS;
+  return {
+    enabled: maxLoginAttempts > 0,
+    maxLoginAttempts,
+    lockTime
+  };
 }
-async function verifyCollectionToken(token) {
-  const { payload } = await jwtVerify(token, getSecret());
-  return payload;
+function getLockedUntilMs(value) {
+  if (typeof value !== "string") return null;
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) ? parsed : null;
 }
 
 // src/services/email-template.ts
@@ -1744,6 +2222,7 @@ async function getDevSend() {
   if (_devSend) return _devSend;
   if (_devSendPromise) return _devSendPromise;
   _devSendPromise = (async () => {
+    const logger = getConfigLogger(void 0, "email");
     try {
       const nodemailer = await import("nodemailer");
       const account = await nodemailer.default.createTestAccount();
@@ -1752,23 +2231,50 @@ async function getDevSend() {
         port: 587,
         auth: { user: account.user, pass: account.pass }
       });
-      console.log("[dyrected/core] No email config \u2014 using Ethereal for dev email preview.");
-      console.log(`[dyrected/core] Ethereal login: https://ethereal.email  user: ${account.user}  pass: ${account.pass}`);
+      logger.info({
+        msg: "No email config; using Ethereal for development email preview"
+      });
+      logger.info({
+        msg: "Ethereal credentials",
+        loginUrl: "https://ethereal.email",
+        user: account.user,
+        password: account.pass
+      });
       _devSend = async ({ to, subject, html }) => {
         const info = await transport.sendMail({ from: '"Dyrected Dev" <dev@dyrected.local>', to, subject, html });
-        console.log(`[dyrected/core] Email preview URL: ${nodemailer.default.getTestMessageUrl(info)}`);
+        logger.info({
+          msg: "Email preview URL",
+          previewUrl: nodemailer.default.getTestMessageUrl(info)
+        });
       };
       return _devSend;
     } catch {
-      console.warn("[dyrected/core] nodemailer not available \u2014 emails will not be sent in dev.");
+      logger.warn({
+        msg: "nodemailer not available; development emails will not be sent"
+      });
       return null;
     }
   })();
   return _devSendPromise;
 }
 async function sendEmail(config, payload) {
+  const logger = getConfigLogger(config, "email");
+  const observability = getObservabilityRuntime(config);
   if (config.email) {
-    await config.email.send(payload);
+    try {
+      await config.email.send(payload);
+    } catch (err) {
+      observability?.recordEmailSendFailure({
+        to: payload.to
+      });
+      logger.error({
+        err,
+        msg: "Email provider send failed",
+        to: payload.to,
+        subject: payload.subject
+      });
+      throw err;
+    }
     return;
   }
   if (process.env.NODE_ENV !== "production") {
@@ -1832,6 +2338,55 @@ var AuthController = class {
   constructor(collection) {
     this.collection = collection;
   }
+  sanitizeUser(user) {
+    const {
+      password: _password,
+      loginAttempts: _loginAttempts,
+      lockedUntil: _lockedUntil,
+      ...safeUser
+    } = user;
+    return safeUser;
+  }
+  clearLockoutState(c, userId) {
+    const db = c.get("config").db;
+    if (!db) return Promise.resolve(null);
+    return db.update({
+      collection: this.collection.slug,
+      id: userId,
+      data: {
+        loginAttempts: 0,
+        lockedUntil: null
+      }
+    });
+  }
+  async recordFailedLogin(c, user) {
+    const db = c.get("config").db;
+    if (!db)
+      return { justLocked: false, retryAfterSeconds: null };
+    const lockout = resolveAuthLockoutConfig(this.collection);
+    if (!lockout.enabled) {
+      return { justLocked: false, retryAfterSeconds: null };
+    }
+    const now = Date.now();
+    const lockedUntilMs = getLockedUntilMs(user.lockedUntil);
+    const lockExpired = lockedUntilMs !== null && lockedUntilMs <= now;
+    const currentAttempts = !lockExpired && typeof user.loginAttempts === "number" && user.loginAttempts > 0 ? user.loginAttempts : 0;
+    const loginAttempts = currentAttempts + 1;
+    const justLocked = loginAttempts >= lockout.maxLoginAttempts;
+    const nextLockedUntil = justLocked ? new Date(now + lockout.lockTime).toISOString() : null;
+    await db.update({
+      collection: this.collection.slug,
+      id: String(user.id),
+      data: {
+        loginAttempts,
+        lockedUntil: nextLockedUntil
+      }
+    });
+    return {
+      justLocked,
+      retryAfterSeconds: justLocked ? Math.max(1, Math.ceil(lockout.lockTime / 1e3)) : null
+    };
+  }
   // ---------------------------------------------------------------------------
   // GET /init
   // Checks if the first user needs to be created.
@@ -1860,11 +2415,17 @@ var AuthController = class {
       limit: 1
     });
     if (check.total > 0) {
-      return c.json({ error: true, message: "Initial user already exists." }, 403);
+      return c.json(
+        { error: true, message: "Initial user already exists." },
+        403
+      );
     }
     const body = await c.req.json().catch(() => null);
     if (!body?.email || !body?.password) {
-      return c.json({ error: true, message: "email and password are required." }, 400);
+      return c.json(
+        { error: true, message: "email and password are required." },
+        400
+      );
     }
     const hashedPassword = await hashPassword(body.password);
     const user = await db.create({
@@ -1876,16 +2437,23 @@ var AuthController = class {
         // Default first user to admin
       }
     });
-    const token = await signCollectionToken({
-      sub: user.id,
+    const token = await issueAuthSessionToken({
+      config,
+      userId: user.id,
       email: user.email,
-      collection: this.collection.slug
+      collection: this.collection.slug,
+      ip: c.get("clientIp"),
+      authSource: "local"
     });
     const { subject, html } = buildWelcomeEmail(config, { email: body.email });
     sendEmail(config, { to: body.email, subject, html }).catch(
-      (err) => console.error("[dyrected/core] Failed to send welcome email:", err)
+      (err) => getRequestLogger(c, "auth").error({
+        err,
+        msg: "Failed to send welcome email",
+        email: body.email
+      })
     );
-    const { password: _, ...safeUser } = user;
+    const safeUser = this.sanitizeUser(user);
     return c.json({ token, user: safeUser });
   }
   // ---------------------------------------------------------------------------
@@ -1896,7 +2464,10 @@ var AuthController = class {
     if (!db) return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json().catch(() => null);
     if (!body?.email || !body?.password) {
-      return c.json({ error: true, message: "email and password are required." }, 400);
+      return c.json(
+        { error: true, message: "email and password are required." },
+        400
+      );
     }
     const result = await db.find({
       collection: this.collection.slug,
@@ -1905,27 +2476,107 @@ var AuthController = class {
     });
     const user = result.docs[0];
     if (!user) {
-      return c.json({ error: true, message: "Invalid email or password." }, 401);
+      return c.json(
+        { error: true, message: "Invalid email or password." },
+        401
+      );
+    }
+    const lockedUntilMs = getLockedUntilMs(user.lockedUntil);
+    if (lockedUntilMs !== null && lockedUntilMs > Date.now()) {
+      const retryAfterSeconds = Math.max(
+        1,
+        Math.ceil((lockedUntilMs - Date.now()) / 1e3)
+      );
+      c.header("Retry-After", String(retryAfterSeconds));
+      return c.json(
+        {
+          error: true,
+          message: "Too many login attempts. Try again later.",
+          retryAfterSeconds
+        },
+        429
+      );
     }
     const valid = await verifyPassword(body.password, user.password);
     if (!valid) {
-      return c.json({ error: true, message: "Invalid email or password." }, 401);
+      const { justLocked, retryAfterSeconds } = await this.recordFailedLogin(
+        c,
+        user
+      );
+      if (justLocked && retryAfterSeconds) {
+        c.header("Retry-After", String(retryAfterSeconds));
+        return c.json(
+          {
+            error: true,
+            message: "Too many login attempts. Try again later.",
+            retryAfterSeconds
+          },
+          429
+        );
+      }
+      return c.json(
+        { error: true, message: "Invalid email or password." },
+        401
+      );
+    }
+    if (typeof user.loginAttempts === "number" && user.loginAttempts > 0 || user.lockedUntil != null) {
+      await this.clearLockoutState(c, String(user.id));
     }
-    const token = await signCollectionToken({
-      sub: user.id,
+    const token = await issueAuthSessionToken({
+      config: c.get("config"),
+      userId: user.id,
       email: user.email,
-      collection: this.collection.slug
+      collection: this.collection.slug,
+      ip: c.get("clientIp"),
+      authSource: "local"
     });
-    const { password: _, ...safeUser } = user;
+    const safeUser = this.sanitizeUser(user);
     return c.json({ token, user: safeUser });
   }
   // ---------------------------------------------------------------------------
   // POST /logout
-  // Auth collections use stateless JWTs — logout is handled client-side.
-  // This endpoint exists so clients have a consistent API surface.
+  // Revoke the current session by default. Pass `?allSessions=true` to revoke
+  // every active session for the current account.
   // ---------------------------------------------------------------------------
   async logout(c) {
-    return c.json({ success: true, message: "Logged out. Discard your token." });
+    const requestUser = c.get("user");
+    const tokenPayload = c.get("authTokenPayload");
+    const allSessions = ["1", "true", "yes"].includes(
+      (c.req.query("allSessions") || "").toLowerCase()
+    );
+    if (!requestUser) {
+      if (allSessions) {
+        return c.json(
+          { error: true, message: "Authentication required." },
+          401
+        );
+      }
+      return c.json({
+        success: true,
+        message: "Logged out. Discard your token."
+      });
+    }
+    if (allSessions) {
+      await revokeAllAuthSessions(c.get("config"), {
+        userId: requestUser.sub,
+        collection: this.collection.slug
+      });
+      return c.json({
+        success: true,
+        message: "All sessions have been logged out."
+      });
+    }
+    if (tokenPayload?.sid) {
+      await revokeAuthSession(c.get("config"), tokenPayload.sid);
+      return c.json({
+        success: true,
+        message: "Logged out."
+      });
+    }
+    return c.json({
+      success: true,
+      message: "Logged out. Discard your token."
+    });
   }
   // ---------------------------------------------------------------------------
   // GET /me
@@ -1937,11 +2588,14 @@ var AuthController = class {
     if (!requestUser) {
       return c.json({ error: true, message: "Authentication required." }, 401);
     }
-    const user = await db.findOne({ collection: this.collection.slug, id: requestUser.sub });
+    const user = await db.findOne({
+      collection: this.collection.slug,
+      id: requestUser.sub
+    });
     if (!user) {
       return c.json({ error: true, message: "User not found." }, 404);
     }
-    const { password: _, ...safeUser } = user;
+    const safeUser = this.sanitizeUser(user);
     return c.json(safeUser);
   }
   // ---------------------------------------------------------------------------
@@ -1952,10 +2606,29 @@ var AuthController = class {
     if (!requestUser) {
       return c.json({ error: true, message: "Authentication required." }, 401);
     }
-    const token = await signCollectionToken({
-      sub: requestUser.sub,
+    if (!requestUser.email) {
+      return c.json(
+        { error: true, message: "Authenticated user is missing an email." },
+        400
+      );
+    }
+    const tokenPayload = c.get("authTokenPayload");
+    if (tokenPayload?.sid) {
+      const token2 = await signCollectionToken({
+        sub: requestUser.sub,
+        email: requestUser.email,
+        collection: this.collection.slug,
+        sid: tokenPayload.sid
+      });
+      return c.json({ token: token2 });
+    }
+    const token = await issueAuthSessionToken({
+      config: c.get("config"),
+      userId: requestUser.sub,
       email: requestUser.email,
-      collection: this.collection.slug
+      collection: this.collection.slug,
+      ip: c.get("clientIp"),
+      authSource: "local"
     });
     return c.json({ token });
   }
@@ -1980,16 +2653,28 @@ var AuthController = class {
     const user = result.docs[0];
     if (user) {
       const resetToken = await signCollectionToken(
-        { sub: user.id, email: user.email, collection: this.collection.slug, purpose: "reset" },
+        {
+          sub: user.id,
+          email: user.email,
+          collection: this.collection.slug,
+          purpose: "reset"
+        },
         "1h"
       );
       const resetUrl = body?.resetUrl;
       const url = resetUrl ? `${resetUrl}${resetUrl.includes("?") ? "&" : "?"}token=${encodeURIComponent(resetToken)}` : void 0;
       try {
-        const { subject, html } = buildResetPasswordEmail(config, { token: resetToken, url });
+        const { subject, html } = buildResetPasswordEmail(config, {
+          token: resetToken,
+          url
+        });
         await sendEmail(config, { to: user.email, subject, html });
       } catch (err) {
-        console.error("[dyrected/core] Failed to send password reset email:", err);
+        getRequestLogger(c, "auth").error({
+          err,
+          msg: "Failed to send password reset email",
+          email: user.email
+        });
       }
     }
     return c.json({
@@ -2008,28 +2693,54 @@ var AuthController = class {
     if (!db) return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json().catch(() => null);
     if (!body?.token || !body?.password) {
-      return c.json({ error: true, message: "token and password are required." }, 400);
+      return c.json(
+        { error: true, message: "token and password are required." },
+        400
+      );
     }
     let payload;
     try {
       payload = await verifyCollectionToken(body.token);
     } catch {
-      return c.json({ error: true, message: "Reset token is invalid or has expired." }, 400);
+      return c.json(
+        { error: true, message: "Reset token is invalid or has expired." },
+        400
+      );
     }
     if (payload.collection !== this.collection.slug || payload.purpose !== "reset") {
-      return c.json({ error: true, message: "Reset token is invalid or has expired." }, 400);
+      return c.json(
+        { error: true, message: "Reset token is invalid or has expired." },
+        400
+      );
     }
     const hashedPassword = await hashPassword(body.password);
     await db.update({
       collection: this.collection.slug,
       id: payload.sub,
-      data: { password: hashedPassword }
+      data: {
+        password: hashedPassword,
+        loginAttempts: 0,
+        lockedUntil: null
+      }
+    });
+    await revokeAllAuthSessions(config, {
+      userId: payload.sub,
+      collection: this.collection.slug
+    });
+    const { subject, html } = buildPasswordChangedEmail(config, {
+      email: payload.email
     });
-    const { subject, html } = buildPasswordChangedEmail(config, { email: payload.email });
     sendEmail(config, { to: payload.email, subject, html }).catch(
-      (err) => console.error("[dyrected/core] Failed to send password-changed email:", err)
+      (err) => getRequestLogger(c, "auth").error({
+        err,
+        msg: "Failed to send password-changed email",
+        email: payload.email
+      })
     );
-    return c.json({ success: true, message: "Password has been reset. You can now log in." });
+    return c.json({
+      success: true,
+      message: "Password has been reset. You can now log in."
+    });
   }
   // ---------------------------------------------------------------------------
   // POST /invite
@@ -2053,10 +2764,18 @@ var AuthController = class {
       limit: 1
     });
     if (existing.total > 0) {
-      return c.json({ error: true, message: "An account with that email already exists." }, 409);
+      return c.json(
+        { error: true, message: "An account with that email already exists." },
+        409
+      );
     }
     const inviteToken = await signCollectionToken(
-      { sub: body.email, email: body.email, collection: this.collection.slug, purpose: "invite" },
+      {
+        sub: body.email,
+        email: body.email,
+        collection: this.collection.slug,
+        purpose: "invite"
+      },
       "7d"
     );
     try {
@@ -2066,7 +2785,11 @@ var AuthController = class {
       });
       await sendEmail(config, { to: body.email, subject, html });
     } catch (err) {
-      console.error("[dyrected/core] Failed to send invite email:", err);
+      getRequestLogger(c, "auth").error({
+        err,
+        msg: "Failed to send invite email",
+        email: body.email
+      });
     }
     return c.json({ success: true, message: `Invite sent to ${body.email}.` });
   }
@@ -2081,16 +2804,25 @@ var AuthController = class {
     if (!db) return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json().catch(() => null);
     if (!body?.token || !body?.password) {
-      return c.json({ error: true, message: "token and password are required." }, 400);
+      return c.json(
+        { error: true, message: "token and password are required." },
+        400
+      );
     }
     let payload;
     try {
       payload = await verifyCollectionToken(body.token);
     } catch {
-      return c.json({ error: true, message: "Invite token is invalid or has expired." }, 400);
+      return c.json(
+        { error: true, message: "Invite token is invalid or has expired." },
+        400
+      );
     }
     if (payload.collection !== this.collection.slug || payload.purpose !== "invite") {
-      return c.json({ error: true, message: "Invite token is invalid or has expired." }, 400);
+      return c.json(
+        { error: true, message: "Invite token is invalid or has expired." },
+        400
+      );
     }
     const inviteeEmail = payload.sub;
     const existing = await db.find({
@@ -2099,7 +2831,10 @@ var AuthController = class {
       limit: 1
     });
     if (existing.total > 0) {
-      return c.json({ error: true, message: "An account with that email already exists." }, 409);
+      return c.json(
+        { error: true, message: "An account with that email already exists." },
+        409
+      );
     }
     const { token: _t, password: _p, ...extraFields } = body;
     const hashedPassword = await hashPassword(body.password);
@@ -2107,28 +2842,37 @@ var AuthController = class {
       collection: this.collection.slug,
       data: { ...extraFields, email: inviteeEmail, password: hashedPassword }
     });
-    const sessionToken = await signCollectionToken({
-      sub: user.id,
+    const sessionToken = await issueAuthSessionToken({
+      config,
+      userId: user.id,
       email: inviteeEmail,
-      collection: this.collection.slug
+      collection: this.collection.slug,
+      ip: c.get("clientIp"),
+      authSource: "local"
+    });
+    const { subject, html } = buildWelcomeEmail(config, {
+      email: inviteeEmail
     });
-    const { subject, html } = buildWelcomeEmail(config, { email: inviteeEmail });
     sendEmail(config, { to: inviteeEmail, subject, html }).catch(
-      (err) => console.error("[dyrected/core] Failed to send welcome email:", err)
+      (err) => getRequestLogger(c, "auth").error({
+        err,
+        msg: "Failed to send welcome email",
+        email: inviteeEmail
+      })
     );
-    const { password: _, ...safeUser } = user;
+    const safeUser = this.sanitizeUser(user);
     return c.json({ token: sessionToken, user: safeUser }, 201);
   }
 };
 
 // src/controllers/admin-auth.controller.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { TextEncoder as TextEncoder2 } from "util";
+import { TextEncoder } from "util";
 import {
-  SignJWT as SignJWT2,
+  SignJWT,
   createRemoteJWKSet,
-  jwtVerify as jwtVerify2,
-  decodeJwt as decodeJwt2
+  jwtVerify,
+  decodeJwt
 } from "jose";
 var AdminAuthController = class {
   constructor(config) {
@@ -2137,13 +2881,21 @@ var AdminAuthController = class {
   config;
   async providers(c) {
     const requestConfig = await this.getRequestConfig(c);
-    return c.json(getPublicAdminAuthConfig(requestConfig.adminAuth, requestConfig.collections));
+    return c.json(
+      getPublicAdminAuthConfig(
+        requestConfig.adminAuth,
+        requestConfig.collections
+      )
+    );
   }
   async start(c) {
     const requestConfig = await this.getRequestConfig(c);
     const provider = this.getProvider(requestConfig, c.req.param("provider"));
     if (!provider) {
-      return c.json({ error: true, message: "Admin auth provider not found." }, 404);
+      return c.json(
+        { error: true, message: "Admin auth provider not found." },
+        404
+      );
     }
     const siteId = this.getSiteId(c);
     const returnTo = this.normalizeReturnTo(c.req.query("returnTo"), c);
@@ -2157,9 +2909,15 @@ var AdminAuthController = class {
       return c.redirect(redirectUrl, 302);
     }
     if (!provider.startUrl) {
-      return c.json({ error: true, message: "This provider does not expose a start URL." }, 400);
+      return c.json(
+        { error: true, message: "This provider does not expose a start URL." },
+        400
+      );
     }
-    const url = this.buildCustomProviderStartUrl(provider.startUrl, new URL(c.req.url).origin);
+    const url = this.buildCustomProviderStartUrl(
+      provider.startUrl,
+      new URL(c.req.url).origin
+    );
     if (!url) {
       return c.json(
         {
@@ -2178,13 +2936,23 @@ var AdminAuthController = class {
     const requestConfig = await this.getRequestConfig(c);
     const provider = this.getProvider(requestConfig, c.req.param("provider"));
     if (!provider) {
-      return c.json({ error: true, message: "Admin auth provider not found." }, 404);
+      return c.json(
+        { error: true, message: "Admin auth provider not found." },
+        404
+      );
     }
     try {
-      const exchange = await this.completeProviderAuth(requestConfig, provider, c);
+      const exchange = await this.completeProviderAuth(
+        requestConfig,
+        provider,
+        c
+      );
       const redirectUrl = new URL(exchange.returnTo);
       redirectUrl.searchParams.set("dyrectedExternalToken", exchange.token);
-      redirectUrl.searchParams.set("dyrectedAdminCollection", exchange.collectionSlug);
+      redirectUrl.searchParams.set(
+        "dyrectedAdminCollection",
+        exchange.collectionSlug
+      );
       return c.redirect(redirectUrl.toString(), 302);
     } catch (error) {
       const message = error instanceof Error ? error.message : "External authentication failed.";
@@ -2198,10 +2966,17 @@ var AdminAuthController = class {
     const requestConfig = await this.getRequestConfig(c);
     const provider = this.getProvider(requestConfig, c.req.param("provider"));
     if (!provider) {
-      return c.json({ error: true, message: "Admin auth provider not found." }, 404);
+      return c.json(
+        { error: true, message: "Admin auth provider not found." },
+        404
+      );
     }
     try {
-      const exchange = await this.completeProviderAuth(requestConfig, provider, c);
+      const exchange = await this.completeProviderAuth(
+        requestConfig,
+        provider,
+        c
+      );
       return c.json({
         token: exchange.token,
         collectionSlug: exchange.collectionSlug,
@@ -2212,9 +2987,46 @@ var AdminAuthController = class {
       const status = message === "Access denied for this site." ? 403 : 401;
       return c.json({ error: true, message }, status);
     }
-  }
-  async logout(c) {
-    return c.json({ success: true, message: "Logged out. Discard your token." });
+  }
+  async logout(c) {
+    const requestUser = c.get("user");
+    const tokenPayload = c.get("authTokenPayload");
+    const allSessions = ["1", "true", "yes"].includes(
+      (c.req.query("allSessions") || "").toLowerCase()
+    );
+    if (!requestUser) {
+      if (allSessions) {
+        return c.json(
+          { error: true, message: "Authentication required." },
+          401
+        );
+      }
+      return c.json({
+        success: true,
+        message: "Logged out. Discard your token."
+      });
+    }
+    if (allSessions) {
+      await revokeAllAuthSessions(c.get("config"), {
+        userId: requestUser.sub,
+        collection: requestUser.collection
+      });
+      return c.json({
+        success: true,
+        message: "All sessions have been logged out."
+      });
+    }
+    if (tokenPayload?.sid) {
+      await revokeAuthSession(c.get("config"), tokenPayload.sid);
+      return c.json({
+        success: true,
+        message: "Logged out."
+      });
+    }
+    return c.json({
+      success: true,
+      message: "Logged out. Discard your token."
+    });
   }
   getProvider(config, id) {
     if (config.adminAuth?.mode !== "external") return void 0;
@@ -2230,7 +3042,12 @@ var AdminAuthController = class {
     }
     const db = c.get("config").db;
     if (!db) throw new Error("Database not configured.");
-    let user = await this.findUserByExternalIdentity(db, adminCollection.slug, provider.id, identity.sub) ?? (identity.email ? (await db.find({
+    let user = await this.findUserByExternalIdentity(
+      db,
+      adminCollection.slug,
+      provider.id,
+      identity.sub
+    ) ?? (identity.email ? (await db.find({
       collection: adminCollection.slug,
       where: { email: identity.email },
       limit: 1
@@ -2238,9 +3055,18 @@ var AdminAuthController = class {
     const provisioningMode = requestConfig.adminAuth?.provisioningMode ?? "jit_plus_membership_management";
     const allowJitProvisioning = provisioningMode !== "preprovisioned_only" && provider.allowJitProvisioning !== false;
     if (!user && !allowJitProvisioning) {
-      throw new Error("This account has not been provisioned for admin access.");
+      throw new Error(
+        "This account has not been provisioned for admin access."
+      );
     }
-    const access = await this.resolveAccess(requestConfig, identity, provider.id, siteId, c, user);
+    const access = await this.resolveAccess(
+      requestConfig,
+      identity,
+      provider.id,
+      siteId,
+      c,
+      user
+    );
     if (!access.allowed) {
       throw new Error("Access denied for this site.");
     }
@@ -2248,7 +3074,12 @@ var AdminAuthController = class {
       user = await db.create({
         collection: adminCollection.slug,
         data: {
-          ...await this.buildUserData(identity, provider.id, access.roles, access.data),
+          ...await this.buildUserData(
+            identity,
+            provider.id,
+            access.roles,
+            access.data
+          ),
           password: await hashPassword(randomBytes2(32).toString("hex"))
         }
       });
@@ -2256,18 +3087,25 @@ var AdminAuthController = class {
       user = await db.update({
         collection: adminCollection.slug,
         id: user.id,
-        data: await this.buildUserData(identity, provider.id, access.roles, access.data)
+        data: await this.buildUserData(
+          identity,
+          provider.id,
+          access.roles,
+          access.data
+        )
       });
     }
     if (!user?.email) {
       throw new Error("Authenticated admin user is missing an email address.");
     }
-    const token = await signCollectionToken({
-      sub: user.id,
+    const token = await issueAuthSessionToken({
+      config: c.get("config"),
+      userId: user.id,
       email: user.email,
       collection: adminCollection.slug,
       providerId: provider.id,
-      authSource: "external"
+      authSource: "external",
+      ip: c.get("clientIp")
     });
     return {
       token,
@@ -2321,14 +3159,10 @@ var AdminAuthController = class {
   async getRequestConfig(c) {
     const siteId = this.getSiteId(c);
     if (!siteId || !this.config.onSchemaFetch) return this.config;
-    const dynamic = await this.config.onSchemaFetch(siteId);
-    return {
-      ...this.config,
-      ...dynamic.admin ? { admin: { ...this.config.admin, ...dynamic.admin } } : {},
-      ...dynamic.adminAuth ? { adminAuth: { ...this.config.adminAuth, ...dynamic.adminAuth } } : {},
-      collections: dynamic.collections ? [...this.config.collections, ...dynamic.collections] : this.config.collections,
-      globals: dynamic.globals ? [...this.config.globals, ...dynamic.globals] : this.config.globals
-    };
+    return mergeDynamicConfig(
+      this.config,
+      await this.config.onSchemaFetch(siteId)
+    );
   }
   async buildOidcStartUrl(provider, returnTo, siteId, origin) {
     const discovery = await this.getOidcDiscovery(provider);
@@ -2339,11 +3173,19 @@ var AdminAuthController = class {
       siteId,
       nonce
     });
-    const url = new URL(provider.authorizationEndpoint || discovery.authorization_endpoint);
+    const url = new URL(
+      provider.authorizationEndpoint || discovery.authorization_endpoint
+    );
     url.searchParams.set("response_type", "code");
     url.searchParams.set("client_id", provider.clientId);
-    url.searchParams.set("redirect_uri", provider.redirectUri || this.defaultCallbackPath(provider.id, origin));
-    url.searchParams.set("scope", (provider.scopes ?? ["openid", "profile", "email"]).join(" "));
+    url.searchParams.set(
+      "redirect_uri",
+      provider.redirectUri || this.defaultCallbackPath(provider.id, origin)
+    );
+    url.searchParams.set(
+      "scope",
+      (provider.scopes ?? ["openid", "profile", "email"]).join(" ")
+    );
     url.searchParams.set("state", state);
     url.searchParams.set("nonce", nonce);
     return url.toString();
@@ -2355,26 +3197,29 @@ var AdminAuthController = class {
     const parsedState = await this.verifyState(state, provider.id);
     const discovery = await this.getOidcDiscovery(provider);
     const redirectUri = provider.redirectUri || this.defaultCallbackPath(provider.id, new URL(c.req.url).origin);
-    const tokenResponse = await fetch(provider.tokenEndpoint || discovery.token_endpoint, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        code,
-        redirect_uri: redirectUri,
-        client_id: provider.clientId,
-        client_secret: provider.clientSecret
-      })
-    });
+    const tokenResponse = await fetch(
+      provider.tokenEndpoint || discovery.token_endpoint,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "authorization_code",
+          code,
+          redirect_uri: redirectUri,
+          client_id: provider.clientId,
+          client_secret: provider.clientSecret
+        })
+      }
+    );
     if (!tokenResponse.ok) {
       throw new Error("OIDC token exchange failed.");
     }
     const tokenBody = await tokenResponse.json();
     const idToken = tokenBody.id_token;
-    let claims = {};
+    let claims;
     if (idToken) {
       const jwks = createRemoteJWKSet(new URL(discovery.jwks_uri));
-      const { payload } = await jwtVerify2(idToken, jwks, {
+      const { payload } = await jwtVerify(idToken, jwks, {
         issuer: provider.issuer,
         audience: provider.clientId
       });
@@ -2383,9 +3228,12 @@ var AdminAuthController = class {
       }
       claims = payload;
     } else if (tokenBody.access_token && (provider.userInfoEndpoint || discovery.userinfo_endpoint)) {
-      const userInfo = await fetch(provider.userInfoEndpoint || discovery.userinfo_endpoint, {
-        headers: { Authorization: `Bearer ${tokenBody.access_token}` }
-      });
+      const userInfo = await fetch(
+        provider.userInfoEndpoint || discovery.userinfo_endpoint,
+        {
+          headers: { Authorization: `Bearer ${tokenBody.access_token}` }
+        }
+      );
       if (!userInfo.ok) throw new Error("OIDC userinfo request failed.");
       claims = await userInfo.json();
     } else {
@@ -2405,21 +3253,21 @@ var AdminAuthController = class {
     }
     let claims;
     if (provider.secret) {
-      const secret = new TextEncoder2().encode(provider.secret);
-      const verified = await jwtVerify2(token, secret, {
+      const secret = new TextEncoder().encode(provider.secret);
+      const verified = await jwtVerify(token, secret, {
         issuer: provider.issuer,
         audience: provider.audience
       });
       claims = verified.payload;
     } else if (provider.jwksUri) {
       const jwks = createRemoteJWKSet(new URL(provider.jwksUri));
-      const verified = await jwtVerify2(token, jwks, {
+      const verified = await jwtVerify(token, jwks, {
         issuer: provider.issuer,
         audience: provider.audience
       });
       claims = verified.payload;
     } else {
-      claims = decodeJwt2(token);
+      claims = decodeJwt(token);
       if (provider.issuer && claims.iss !== provider.issuer) {
         throw new Error("External auth issuer mismatch.");
       }
@@ -2430,7 +3278,10 @@ var AdminAuthController = class {
       }
     }
     return {
-      identity: this.mapClaims(claims, provider.claimMapping),
+      identity: this.mapClaims(
+        claims,
+        provider.claimMapping
+      ),
       returnTo: this.normalizeReturnTo(
         body?.returnTo || c.req.query("returnTo"),
         c
@@ -2454,9 +3305,15 @@ var AdminAuthController = class {
       email: this.readStringClaim(claims[emailKey]),
       name: this.readStringClaim(claims[nameKey]),
       roles: this.readStringArrayClaim(rolesKey ? claims[rolesKey] : void 0),
-      groups: this.readStringArrayClaim(groupsKey ? claims[groupsKey] : void 0),
-      siteIds: this.readStringArrayClaim(siteIdsKey ? claims[siteIdsKey] : void 0),
-      workspaceIds: this.readStringArrayClaim(workspaceIdsKey ? claims[workspaceIdsKey] : void 0),
+      groups: this.readStringArrayClaim(
+        groupsKey ? claims[groupsKey] : void 0
+      ),
+      siteIds: this.readStringArrayClaim(
+        siteIdsKey ? claims[siteIdsKey] : void 0
+      ),
+      workspaceIds: this.readStringArrayClaim(
+        workspaceIdsKey ? claims[workspaceIdsKey] : void 0
+      ),
       rawClaims: claims
     };
   }
@@ -2466,7 +3323,9 @@ var AdminAuthController = class {
   readStringArrayClaim(value) {
     if (!value) return void 0;
     if (Array.isArray(value)) {
-      return value.filter((entry) => typeof entry === "string");
+      return value.filter(
+        (entry) => typeof entry === "string"
+      );
     }
     if (typeof value === "string") return [value];
     return void 0;
@@ -2476,7 +3335,8 @@ var AdminAuthController = class {
       provider.issuer.replace(/\/$/, "") + "/.well-known/openid-configuration"
     );
     const response = await fetch(discoveryUrl.toString());
-    if (!response.ok) throw new Error("Failed to load OIDC discovery document.");
+    if (!response.ok)
+      throw new Error("Failed to load OIDC discovery document.");
     return response.json();
   }
   defaultCallbackPath(providerId, origin = "") {
@@ -2494,10 +3354,10 @@ var AdminAuthController = class {
     }
   }
   async signState(payload) {
-    return new SignJWT2(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("15m").sign(this.getStateSecret());
+    return new SignJWT(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("15m").sign(this.getStateSecret());
   }
   async verifyState(token, providerId) {
-    const { payload } = await jwtVerify2(token, this.getStateSecret());
+    const { payload } = await jwtVerify(token, this.getStateSecret());
     const state = payload;
     if (state.providerId !== providerId) {
       throw new Error("OIDC state verification failed.");
@@ -2509,7 +3369,7 @@ var AdminAuthController = class {
     if (!secret) {
       throw new Error("[dyrected/core] DYRECTED_JWT_SECRET is not set.");
     }
-    return new TextEncoder2().encode(secret);
+    return new TextEncoder().encode(secret);
   }
   normalizeReturnTo(returnTo, c) {
     if (returnTo) return returnTo;
@@ -2519,12 +3379,12 @@ var AdminAuthController = class {
 };
 
 // src/controllers/preview.controller.ts
-import { SignJWT as SignJWT3, jwtVerify as jwtVerify3 } from "jose";
-import { TextEncoder as TextEncoder3 } from "util";
+import { SignJWT as SignJWT2, jwtVerify as jwtVerify2 } from "jose";
+import { TextEncoder as TextEncoder2 } from "util";
 var PreviewController = class {
   getSecret() {
     const secret = process.env.DYRECTED_JWT_SECRET || "dyrected-preview-secret-change-me";
-    return new TextEncoder3().encode(secret);
+    return new TextEncoder2().encode(secret);
   }
   /**
    * POST /api/preview-token
@@ -2533,9 +3393,12 @@ var PreviewController = class {
   async createToken(c) {
     const body = await c.req.json().catch(() => null);
     if (!body?.collectionSlug || !body?.data) {
-      return c.json({ error: true, message: "collectionSlug and data are required." }, 400);
+      return c.json(
+        { error: true, message: "collectionSlug and data are required." },
+        400
+      );
     }
-    const token = await new SignJWT3({
+    const token = await new SignJWT2({
       collectionSlug: body.collectionSlug,
       documentId: body.documentId,
       data: body.data
@@ -2550,13 +3413,19 @@ var PreviewController = class {
   async getData(c) {
     const token = c.req.query("token");
     if (!token) {
-      return c.json({ error: true, message: "token query parameter is required." }, 400);
+      return c.json(
+        { error: true, message: "token query parameter is required." },
+        400
+      );
     }
     try {
-      const { payload } = await jwtVerify3(token, this.getSecret());
+      const { payload } = await jwtVerify2(token, this.getSecret());
       return c.json(payload);
-    } catch (err) {
-      return c.json({ error: true, message: "Invalid or expired preview token." }, 401);
+    } catch (_err) {
+      return c.json(
+        { error: true, message: "Invalid or expired preview token." },
+        401
+      );
     }
   }
 };
@@ -2632,9 +3501,15 @@ var AuditController = class {
     if (!access.allowed) {
       return { denied: true, where: {} };
     }
-    let where = { collection: { equals: collection.slug } };
+    let where = {
+      collection: { equals: collection.slug }
+    };
     if (access.constraint) {
-      const ids = await this.collectAccessibleDocumentIds(config.db, collection, access.constraint);
+      const ids = await this.collectAccessibleDocumentIds(
+        config.db,
+        collection,
+        access.constraint
+      );
       where = mergeWhereConstraint(where, { documentId: { in: ids } });
     }
     return { denied: false, where };
@@ -2647,8 +3522,11 @@ var AuditController = class {
     }
     const siteId = c.req.header("X-Site-Id") || c.get("siteId");
     if (config.onSchemaFetch && siteId) {
-      const dynamic = await config.onSchemaFetch(siteId);
-      for (const collection of dynamic.collections || []) {
+      const requestConfig = mergeDynamicConfig(
+        config,
+        await config.onSchemaFetch(siteId)
+      );
+      for (const collection of requestConfig.collections) {
         if (!collections.has(collection.slug)) {
           collections.set(collection.slug, collection);
         }
@@ -2659,11 +3537,18 @@ var AuditController = class {
   async findForCollection(c, collection) {
     const config = c.get("config");
     if (!config.db) return c.json({ message: "Database not configured" }, 500);
-    if (!collection.audit) return c.json({ message: "Audit is not enabled for this collection" }, 404);
+    if (!collection.audit)
+      return c.json(
+        { message: "Audit is not enabled for this collection" },
+        404
+      );
     const query = this.parseQuery(c);
     const scope = await this.buildCollectionAuditScope(c, collection);
     if (scope.denied) {
-      return c.json({ error: true, message: `Access denied: read on ${collection.slug}` }, 403);
+      return c.json(
+        { error: true, message: `Access denied: read on ${collection.slug}` },
+        403
+      );
     }
     const where = query.where ? mergeWhereConstraint(scope.where, query.where) : scope.where;
     const result = await config.db.find({
@@ -2679,7 +3564,9 @@ var AuditController = class {
     const config = c.get("config");
     if (!config.db) return c.json({ message: "Database not configured" }, 500);
     const query = this.parseQuery(c);
-    const collections = (await this.getVisibleCollections(c)).filter((collection) => collection.audit);
+    const collections = (await this.getVisibleCollections(c)).filter(
+      (collection) => collection.audit
+    );
     const scopes = [];
     for (const collection of collections) {
       const scope = await this.buildCollectionAuditScope(c, collection);
@@ -2710,8 +3597,7 @@ function getBearerToken(c) {
   const authHeader = c.req.header("Authorization");
   return authHeader?.replace(/^Bearer\s+/i, "") || void 0;
 }
-async function resolveUser(token, config) {
-  const payload = await verifyCollectionToken(token);
+async function resolveUser(payload, config) {
   if (payload.purpose) {
     return payload;
   }
@@ -2726,7 +3612,12 @@ async function resolveUser(token, config) {
       id: payload.sub
     });
   } catch (err) {
-    console.error("[dyrected/core] Failed to hydrate user from token:", err);
+    getConfigLogger(config, "auth").error({
+      err,
+      msg: "Failed to hydrate user from token",
+      collection: payload.collection,
+      userId: payload.sub
+    });
     return payload;
   }
   if (!doc) {
@@ -2740,6 +3631,18 @@ async function resolveUser(token, config) {
     collection: payload.collection
   };
 }
+async function resolveAuthenticatedRequest(token, config, clientIp) {
+  const payload = await verifyCollectionToken(token);
+  if (payload.sid && config?.db) {
+    const session = await getAuthSession(config, payload.sid);
+    if (!isAuthSessionActive(session) || session.userId !== payload.sub || session.collection !== payload.collection) {
+      throw new Error("Invalid or expired session.");
+    }
+    await touchAuthSession(config, payload.sid, { ip: clientIp });
+  }
+  const user = await resolveUser(payload, config);
+  return { user, payload };
+}
 function requireAuth(config) {
   return async (c, next) => {
     if (c.get("user")) {
@@ -2747,18 +3650,42 @@ function requireAuth(config) {
     }
     const token = getBearerToken(c);
     if (!token) {
+      c.get("observability")?.recordAuthFailure({
+        reason: "missing_token",
+        path: c.req.path
+      });
       return c.json({ error: true, message: "Authentication required." }, 401);
     }
     let user;
+    let payload;
     try {
-      user = await resolveUser(token, config ?? c.get("config"));
-    } catch {
+      const resolved = await resolveAuthenticatedRequest(
+        token,
+        config ?? c.get("config"),
+        c.get("clientIp")
+      );
+      user = resolved.user;
+      payload = resolved.payload;
+    } catch (err) {
+      c.get("observability")?.recordAuthFailure({
+        reason: "invalid_token",
+        path: c.req.path
+      });
+      getRequestLogger(c, "auth").warn({
+        err,
+        msg: "Rejected invalid or expired token"
+      });
       return c.json({ error: true, message: "Invalid or expired token." }, 401);
     }
     if (!user) {
+      c.get("observability")?.recordAuthFailure({
+        reason: "missing_user",
+        path: c.req.path
+      });
       return c.json({ error: true, message: "Invalid or expired token." }, 401);
     }
     c.set("user", user);
+    c.set("authTokenPayload", payload);
     await next();
   };
 }
@@ -2770,10 +3697,16 @@ function optionalAuth(config) {
     const token = getBearerToken(c);
     if (token) {
       try {
-        const user = await resolveUser(token, config ?? c.get("config"));
+        const resolved = await resolveAuthenticatedRequest(
+          token,
+          config ?? c.get("config"),
+          c.get("clientIp")
+        );
+        const user = resolved.user;
         if (user) {
           c.set("user", user);
         }
+        c.set("authTokenPayload", resolved.payload);
       } catch {
       }
     }
@@ -2848,7 +3781,10 @@ function accessGate(config, target, action) {
       req: toHookRequestContext(c.req)
     });
     if (!allowed) {
-      return c.json({ error: true, message: `Access denied: ${action} on ${target.slug}` }, 403);
+      return c.json(
+        { error: true, message: `Access denied: ${action} on ${target.slug}` },
+        403
+      );
     }
     await next();
   };
@@ -2872,226 +3808,276 @@ function serializeFieldForApi(f) {
   if (serialized.fields) {
     serialized.fields = serialized.fields.map(serializeFieldForApi);
   }
-  if (serialized.blocks) {
+  if (serialized.blocks && !serialized.blockReferences?.length) {
     serialized.blocks = serialized.blocks.map((b) => ({
       ...b,
       fields: b.fields?.map(serializeFieldForApi)
     }));
+  } else if (serialized.blockReferences?.length) {
+    delete serialized.blocks;
   }
   return serialized;
 }
+function serializeBlockForApi(block) {
+  return {
+    ...block,
+    fields: block.fields?.map(serializeFieldForApi)
+  };
+}
 function registerRoutes(app, config) {
   const optionsCache = /* @__PURE__ */ new Map();
   app.get("/api/schemas", optionalAuth(config), async (c) => {
     const siteId = c.req.header("X-Site-Id");
-    let collections = [...config.collections];
-    let globals = [...config.globals];
-    if (siteId && config.onSchemaFetch) {
-      const dynamic = await config.onSchemaFetch(siteId);
-      if (dynamic.collections) collections = [...collections, ...dynamic.collections];
-      if (dynamic.globals) globals = [...globals, ...dynamic.globals];
-      if (dynamic.admin) {
-        config.admin = { ...config.admin, ...dynamic.admin };
-      }
-      if (dynamic.adminAuth) {
-        config.adminAuth = { ...config.adminAuth, ...dynamic.adminAuth };
-      }
-    }
+    const requestConfig = siteId && config.onSchemaFetch ? mergeDynamicConfig(config, await config.onSchemaFetch(siteId)) : config;
+    const collections = [...requestConfig.collections];
+    const globals = [...requestConfig.globals];
     const user = c.get("user");
     const accessArgs = { user, req: toHookRequestContext(c.req) };
     const serializeAccess = async (access) => {
       if (typeof access === "string") return access;
       if (typeof access === "boolean") return access;
       if (access && typeof access === "object" && typeof access.policy === "string") {
-        const policy = config.accessPolicies?.[access.policy];
-        if (typeof policy === "string" || typeof policy === "boolean") return policy;
+        const policy = requestConfig.accessPolicies?.[access.policy];
+        if (typeof policy === "string" || typeof policy === "boolean")
+          return policy;
       }
-      return resolveBooleanAccess(config, access, accessArgs);
+      return resolveBooleanAccess(requestConfig, access, accessArgs);
     };
-    const filteredCollections = await Promise.all(collections.filter((col) => !siteId || col.shared || !col.siteId || col.siteId === siteId).map(async (col) => ({
-      slug: col.slug,
-      labels: col.labels,
-      access: {
-        read: await serializeAccess(col.access?.read),
-        create: await serializeAccess(col.access?.create),
-        update: await serializeAccess(col.access?.update),
-        delete: await serializeAccess(col.access?.delete)
-      },
-      fields: await Promise.all(col.fields.map(serializeFieldForApi).map(async (f) => ({
-        name: f.name,
-        type: f.type,
-        label: f.label,
-        required: f.required,
-        defaultValue: f.defaultValue,
-        options: f.options,
-        relationTo: f.relationTo,
-        hasMany: f.hasMany,
-        fields: f.fields,
-        blocks: f.blocks,
-        collection: f.collection,
-        on: f.on,
-        limit: f.limit,
-        admin: f.admin,
+    const filteredCollections = await Promise.all(
+      collections.filter(
+        (col) => !siteId || col.shared || !col.siteId || col.siteId === siteId
+      ).map(async (col) => ({
+        slug: col.slug,
+        labels: col.labels,
         access: {
-          read: await serializeAccess(f.access?.read),
-          create: await serializeAccess(f.access?.create),
-          update: await serializeAccess(f.access?.update)
-        }
-      }))),
-      upload: !!col.upload,
-      auth: !!col.auth,
-      admin: col.admin,
-      workflow: col.workflow ? {
-        initialState: col.workflow.initialState,
-        draftState: col.workflow.draftState,
-        states: col.workflow.states,
-        transitions: col.workflow.transitions.map((t) => ({
-          name: t.name,
-          label: t.label,
-          from: t.from,
-          to: t.to,
-          requiredCapabilities: t.requiredCapabilities,
-          requireComment: t.requireComment,
-          unpublish: t.unpublish
-        })),
-        roles: col.workflow.roles
-      } : void 0
-    })));
-    const filteredGlobals = await Promise.all(globals.filter((glb) => !siteId || glb.shared || !glb.siteId || glb.siteId === siteId).map(async (glb) => ({
-      slug: glb.slug,
-      label: glb.label,
-      access: {
-        read: await serializeAccess(glb.access?.read),
-        update: await serializeAccess(glb.access?.update)
-      },
-      fields: await Promise.all(glb.fields.map(serializeFieldForApi).map(async (f) => ({
-        name: f.name,
-        type: f.type,
-        label: f.label,
-        required: f.required,
-        defaultValue: f.defaultValue,
-        options: f.options,
-        relationTo: f.relationTo,
-        hasMany: f.hasMany,
-        fields: f.fields,
-        blocks: f.blocks,
-        collection: f.collection,
-        on: f.on,
-        limit: f.limit,
-        admin: f.admin,
+          read: await serializeAccess(col.access?.read),
+          create: await serializeAccess(col.access?.create),
+          update: await serializeAccess(col.access?.update),
+          delete: await serializeAccess(col.access?.delete)
+        },
+        fields: await Promise.all(
+          col.fields.map(serializeFieldForApi).map(async (f) => ({
+            name: f.name,
+            type: f.type,
+            label: f.label,
+            required: f.required,
+            defaultValue: f.defaultValue,
+            options: f.options,
+            relationTo: f.relationTo,
+            hasMany: f.hasMany,
+            fields: f.fields,
+            blocks: f.blocks,
+            blockReferences: f.blockReferences,
+            collection: f.collection,
+            on: f.on,
+            limit: f.limit,
+            admin: f.admin,
+            access: {
+              read: await serializeAccess(f.access?.read),
+              create: await serializeAccess(f.access?.create),
+              update: await serializeAccess(f.access?.update)
+            }
+          }))
+        ),
+        upload: !!col.upload,
+        auth: !!col.auth,
+        audit: !!col.audit,
+        drafts: !!col.drafts,
+        admin: col.admin,
+        workflow: col.workflow ? {
+          initialState: col.workflow.initialState,
+          draftState: col.workflow.draftState,
+          states: col.workflow.states,
+          transitions: col.workflow.transitions.map((t) => ({
+            name: t.name,
+            label: t.label,
+            from: t.from,
+            to: t.to,
+            requiredCapabilities: t.requiredCapabilities,
+            requireComment: t.requireComment,
+            unpublish: t.unpublish
+          })),
+          roles: col.workflow.roles
+        } : void 0
+      }))
+    );
+    const filteredGlobals = await Promise.all(
+      globals.filter(
+        (glb) => !siteId || glb.shared || !glb.siteId || glb.siteId === siteId
+      ).map(async (glb) => ({
+        slug: glb.slug,
+        label: glb.label,
         access: {
-          read: await serializeAccess(f.access?.read),
-          update: await serializeAccess(f.access?.update)
-        }
-      }))),
-      admin: glb.admin
-    })));
+          read: await serializeAccess(glb.access?.read),
+          update: await serializeAccess(glb.access?.update)
+        },
+        fields: await Promise.all(
+          glb.fields.map(serializeFieldForApi).map(async (f) => ({
+            name: f.name,
+            type: f.type,
+            label: f.label,
+            required: f.required,
+            defaultValue: f.defaultValue,
+            options: f.options,
+            relationTo: f.relationTo,
+            hasMany: f.hasMany,
+            fields: f.fields,
+            blocks: f.blocks,
+            blockReferences: f.blockReferences,
+            collection: f.collection,
+            on: f.on,
+            limit: f.limit,
+            admin: f.admin,
+            access: {
+              read: await serializeAccess(f.access?.read),
+              update: await serializeAccess(f.access?.update)
+            }
+          }))
+        ),
+        admin: glb.admin
+      }))
+    );
     return c.json({
+      blocks: requestConfig.blocks?.map(serializeBlockForApi),
       collections: filteredCollections,
       globals: filteredGlobals,
-      admin: config.admin || {},
-      adminAuth: getPublicAdminAuthConfig(config.adminAuth, collections)
+      admin: requestConfig.admin || {},
+      adminAuth: getPublicAdminAuthConfig(requestConfig.adminAuth, collections)
     });
   });
-  app.get("/api/dyrected/options/:collection/:field", optionalAuth(config), async (c) => {
-    const { collection: colSlug, field: fieldName } = c.req.param();
-    const siteId = c.req.header("X-Site-Id");
-    let collections = [...config.collections];
-    if (siteId && config.onSchemaFetch) {
-      const dynamic = await config.onSchemaFetch(siteId);
-      if (dynamic.collections) collections = [...collections, ...dynamic.collections];
-    }
-    const user = c.get("user");
-    let collection = collections.find((col) => col.slug === colSlug);
-    let field;
-    if (collection) {
-      const accessExpr = collection.access?.read;
-      if (accessExpr !== void 0 && accessExpr !== null) {
-        const allowed = await resolveBooleanAccess(config, accessExpr, {
-          user,
-          req: toHookRequestContext(c.req)
-        });
-        if (!allowed) {
-          return c.json({ error: true, message: `Access denied: read on ${colSlug}` }, 403);
+  app.get(
+    "/api/dyrected/options/:collection/:field",
+    optionalAuth(config),
+    async (c) => {
+      const { collection: colSlug, field: fieldName } = c.req.param();
+      const siteId = c.req.header("X-Site-Id");
+      const requestConfig = siteId && config.onSchemaFetch ? mergeDynamicConfig(config, await config.onSchemaFetch(siteId)) : config;
+      let collections = [...requestConfig.collections];
+      const user = c.get("user");
+      let collection = collections.find((col) => col.slug === colSlug);
+      let field;
+      if (collection) {
+        const accessExpr = collection.access?.read;
+        if (accessExpr !== void 0 && accessExpr !== null) {
+          const allowed = await resolveBooleanAccess(config, accessExpr, {
+            user,
+            req: toHookRequestContext(c.req)
+          });
+          if (!allowed) {
+            return c.json(
+              { error: true, message: `Access denied: read on ${colSlug}` },
+              403
+            );
+          }
+        }
+        field = collection.fields.find((f) => f.name === fieldName);
+      } else {
+        const globals = [...requestConfig.globals];
+        const glb = globals.find((g) => g.slug === colSlug);
+        if (!glb) {
+          return c.json(
+            {
+              error: true,
+              message: `${colSlug} not found as collection or global`
+            },
+            404
+          );
         }
+        const accessExpr = glb.access?.read;
+        if (accessExpr !== void 0 && accessExpr !== null) {
+          const allowed = await resolveBooleanAccess(config, accessExpr, {
+            user,
+            req: toHookRequestContext(c.req)
+          });
+          if (!allowed) {
+            return c.json(
+              {
+                error: true,
+                message: `Access denied: read on global ${colSlug}`
+              },
+              403
+            );
+          }
+        }
+        field = glb.fields.find((f) => f.name === fieldName);
       }
-      field = collection.fields.find((f) => f.name === fieldName);
-    } else {
-      let globals = [...config.globals];
-      if (siteId && config.onSchemaFetch) {
-        const dynamic = await config.onSchemaFetch(siteId);
-        if (dynamic.globals) globals = [...globals, ...dynamic.globals];
-      }
-      const glb = globals.find((g) => g.slug === colSlug);
-      if (!glb) {
-        return c.json({ error: true, message: `${colSlug} not found as collection or global` }, 404);
-      }
-      const accessExpr = glb.access?.read;
-      if (accessExpr !== void 0 && accessExpr !== null) {
-        const allowed = await resolveBooleanAccess(config, accessExpr, {
+      if (!field) {
+        return c.json(
+          {
+            error: true,
+            message: `Field ${fieldName} not found in ${colSlug}`
+          },
+          404
+        );
+      }
+      let resolver;
+      let cacheTTL;
+      if (typeof field.options === "function") {
+        resolver = field.options;
+      } else if (field.options && typeof field.options === "object" && "resolve" in field.options) {
+        resolver = field.options.resolve;
+        cacheTTL = field.options.cacheTTL;
+      }
+      if (!resolver) {
+        return c.json(
+          {
+            error: true,
+            message: `Field ${fieldName} in ${colSlug} is not dynamic`
+          },
+          400
+        );
+      }
+      try {
+        const db = c.get("db") || config.db;
+        const queryParams = c.req.query();
+        const reqContext = {
+          query: queryParams,
+          headers: c.req.header(),
+          raw: c.req.raw
+        };
+        const shouldCache = typeof cacheTTL === "number" && cacheTTL > 0;
+        let cacheKey = "";
+        if (shouldCache) {
+          cacheKey = JSON.stringify([
+            siteId ?? "",
+            colSlug,
+            fieldName,
+            user?.id ?? null,
+            queryParams
+          ]);
+          const hit = optionsCache.get(cacheKey);
+          if (hit && hit.expires > Date.now()) {
+            return c.json(hit.value);
+          }
+        }
+        const result = await resolver({
+          db,
           user,
-          req: toHookRequestContext(c.req)
+          req: reqContext
         });
-        if (!allowed) {
-          return c.json({ error: true, message: `Access denied: read on global ${colSlug}` }, 403);
-        }
-      }
-      field = glb.fields.find((f) => f.name === fieldName);
-    }
-    if (!field) {
-      return c.json({ error: true, message: `Field ${fieldName} not found in ${colSlug}` }, 404);
-    }
-    let resolver;
-    let cacheTTL;
-    if (typeof field.options === "function") {
-      resolver = field.options;
-    } else if (field.options && typeof field.options === "object" && "resolve" in field.options) {
-      resolver = field.options.resolve;
-      cacheTTL = field.options.cacheTTL;
-    }
-    if (!resolver) {
-      return c.json({ error: true, message: `Field ${fieldName} in ${colSlug} is not dynamic` }, 400);
-    }
-    try {
-      const db = c.get("db") || config.db;
-      const queryParams = c.req.query();
-      const reqContext = {
-        query: queryParams,
-        headers: c.req.header(),
-        raw: c.req.raw
-      };
-      const shouldCache = typeof cacheTTL === "number" && cacheTTL > 0;
-      let cacheKey = "";
-      if (shouldCache) {
-        cacheKey = JSON.stringify([
-          siteId ?? "",
-          colSlug,
-          fieldName,
-          user?.id ?? null,
-          queryParams
-        ]);
-        const hit = optionsCache.get(cacheKey);
-        if (hit && hit.expires > Date.now()) {
-          return c.json(hit.value);
+        if (shouldCache) {
+          optionsCache.set(cacheKey, {
+            expires: Date.now() + cacheTTL * 1e3,
+            value: result
+          });
         }
-      }
-      const result = await resolver({
-        db,
-        user,
-        req: reqContext
-      });
-      if (shouldCache) {
-        optionsCache.set(cacheKey, {
-          expires: Date.now() + cacheTTL * 1e3,
-          value: result
+        return c.json(result);
+      } catch (err) {
+        getRequestLogger(c, "router").error({
+          err,
+          msg: "Failed to resolve dynamic field options",
+          fieldName
         });
+        return c.json(
+          {
+            error: true,
+            message: err.message || "Failed to resolve dynamic options"
+          },
+          500
+        );
       }
-      return c.json(result);
-    } catch (err) {
-      console.error(`[dyrected/core] Failed to resolve dynamic options for field ${fieldName}:`, err);
-      return c.json({ error: true, message: err.message || "Failed to resolve dynamic options" }, 500);
     }
-  });
+  );
   app.get("/api/openapi.json", (c) => {
     return c.json(generateOpenApi(config));
   });
@@ -3104,10 +4090,18 @@ function registerRoutes(app, config) {
     const key = c.req.param("key");
     const scope = c.req.query("scope");
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
+    if (!user?.collection || !user.sub)
+      return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key)
+      return c.json(
+        { error: true, message: "Preference key is required." },
+        400
+      );
     const getGlobalPreference = async () => {
-      const globalDoc = await db.findOne({ collection: "__global_preferences", id: key });
+      const globalDoc = await db.findOne({
+        collection: "__global_preferences",
+        id: key
+      });
       return globalDoc ? globalDoc.value : null;
     };
     if (scope === "global") {
@@ -3129,15 +4123,29 @@ function registerRoutes(app, config) {
     const key = c.req.param("key");
     const scope = c.req.query("scope");
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
+    if (!user?.collection || !user.sub)
+      return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key)
+      return c.json(
+        { error: true, message: "Preference key is required." },
+        400
+      );
     const body = await c.req.json().catch(() => ({}));
     if (scope === "global") {
       const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
       if (!isAdminUser) {
-        return c.json({ error: true, message: "Only administrators can save global preferences." }, 403);
+        return c.json(
+          {
+            error: true,
+            message: "Only administrators can save global preferences."
+          },
+          403
+        );
       }
-      const existing = await db.findOne({ collection: "__global_preferences", id: key });
+      const existing = await db.findOne({
+        collection: "__global_preferences",
+        id: key
+      });
       if (existing) {
         await db.update({
           collection: "__global_preferences",
@@ -3169,12 +4177,23 @@ function registerRoutes(app, config) {
     const key = c.req.param("key");
     const scope = c.req.query("scope");
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
+    if (!user?.collection || !user.sub)
+      return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key)
+      return c.json(
+        { error: true, message: "Preference key is required." },
+        400
+      );
     if (scope === "global") {
       const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
       if (!isAdminUser) {
-        return c.json({ error: true, message: "Only administrators can delete global preferences." }, 403);
+        return c.json(
+          {
+            error: true,
+            message: "Only administrators can delete global preferences."
+          },
+          403
+        );
       }
       await db.delete({ collection: "__global_preferences", id: key });
       return c.json({ success: true });
@@ -3203,17 +4222,41 @@ function registerRoutes(app, config) {
     for (const col of uploadCollections) {
       const mediaController = new MediaController(col.slug);
       const prefix = `/api/collections/${col.slug}`;
-      app.get(`${prefix}/media`, accessGate(config, col, "read"), (c) => mediaController.find(c));
-      app.get(`${prefix}/media/:filename{.+$}`, (c) => mediaController.serve(c));
-      app.post(`${prefix}/media`, accessGate(config, col, "create"), (c) => mediaController.upload(c));
-      app.delete(`${prefix}/media/:id`, accessGate(config, col, "delete"), (c) => mediaController.delete(c));
+      app.get(
+        `${prefix}/media`,
+        accessGate(config, col, "read"),
+        (c) => mediaController.find(c)
+      );
+      app.get(
+        `${prefix}/media/:filename{.+$}`,
+        (c) => mediaController.serve(c)
+      );
+      app.post(
+        `${prefix}/media`,
+        accessGate(config, col, "create"),
+        (c) => mediaController.upload(c)
+      );
+      app.delete(
+        `${prefix}/media/:id`,
+        accessGate(config, col, "delete"),
+        (c) => mediaController.delete(c)
+      );
     }
   }
   const adminAuthController = new AdminAuthController(config);
   app.get("/api/admin/auth/providers", (c) => adminAuthController.providers(c));
-  app.get("/api/admin/auth/:provider/start", (c) => adminAuthController.start(c));
-  app.get("/api/admin/auth/:provider/callback", (c) => adminAuthController.callback(c));
-  app.post("/api/admin/auth/:provider/exchange", (c) => adminAuthController.exchange(c));
+  app.get(
+    "/api/admin/auth/:provider/start",
+    (c) => adminAuthController.start(c)
+  );
+  app.get(
+    "/api/admin/auth/:provider/callback",
+    (c) => adminAuthController.callback(c)
+  );
+  app.post(
+    "/api/admin/auth/:provider/exchange",
+    (c) => adminAuthController.exchange(c)
+  );
   app.post("/api/admin/logout", (c) => adminAuthController.logout(c));
   for (const collection of config.collections) {
     if (!collection.auth) continue;
@@ -3224,10 +4267,21 @@ function registerRoutes(app, config) {
     app.get(`${path}/init`, (c) => authController.init(c));
     app.post(`${path}/first-user`, (c) => authController.registerFirstUser(c));
     app.get(`${path}/me`, requireAuth(config), (c) => authController.me(c));
-    app.post(`${path}/refresh-token`, requireAuth(config), (c) => authController.refreshToken(c));
-    app.post(`${path}/forgot-password`, (c) => authController.forgotPassword(c));
+    app.post(
+      `${path}/refresh-token`,
+      requireAuth(config),
+      (c) => authController.refreshToken(c)
+    );
+    app.post(
+      `${path}/forgot-password`,
+      (c) => authController.forgotPassword(c)
+    );
     app.post(`${path}/reset-password`, (c) => authController.resetPassword(c));
-    app.post(`${path}/invite`, requireAuth(config), (c) => authController.invite(c));
+    app.post(
+      `${path}/invite`,
+      requireAuth(config),
+      (c) => authController.invite(c)
+    );
     app.post(`${path}/accept-invite`, (c) => authController.acceptInvite(c));
   }
   const auditController = new AuditController();
@@ -3239,18 +4293,33 @@ function registerRoutes(app, config) {
     app.post(`${path}/media`, (c) => controller.create(c));
     app.delete(`${path}/delete-many`, (c) => controller.deleteMany(c));
     if (collection.audit) {
-      app.get(`${path}/__audit`, (c) => auditController.findForCollection(c, collection));
+      app.get(
+        `${path}/__audit`,
+        (c) => auditController.findForCollection(c, collection)
+      );
     }
     app.get(`${path}/:id`, (c) => controller.findOne(c));
     app.patch(`${path}/:id`, (c) => controller.update(c));
     app.delete(`${path}/:id`, (c) => controller.delete(c));
     app.post(`${path}/seed`, (c) => controller.seed(c));
     if (collection.auth) {
-      app.post(`${path}/:id/change-password`, requireAuth(config), (c) => controller.changePassword(c));
+      app.post(
+        `${path}/:id/change-password`,
+        requireAuth(config),
+        (c) => controller.changePassword(c)
+      );
     }
     if (collection.workflow) {
-      app.post(`${path}/:id/transitions/:transition`, requireAuth(config), (c) => controller.transition(c));
-      app.get(`${path}/:id/workflow-history`, requireAuth(config), (c) => controller.workflowHistory(c));
+      app.post(
+        `${path}/:id/transitions/:transition`,
+        requireAuth(config),
+        (c) => controller.transition(c)
+      );
+      app.get(
+        `${path}/:id/workflow-history`,
+        requireAuth(config),
+        (c) => controller.workflowHistory(c)
+      );
     }
   }
   for (const global of config.globals) {
@@ -3260,8 +4329,17 @@ function registerRoutes(app, config) {
     app.patch(path, (c) => controller.update(c));
     app.post(`${path}/seed`, (c) => controller.seed(c));
   }
+  if (!process.env.DYRECTED_JWT_SECRET) {
+    getConfigLogger(config, "router").warn({
+      msg: "DYRECTED_JWT_SECRET is not set; token-mode live preview is signing with an insecure default"
+    });
+  }
   const previewController = new PreviewController();
-  app.post("/api/preview-token", requireAuth(config), (c) => previewController.createToken(c));
+  app.post(
+    "/api/preview-token",
+    requireAuth(config),
+    (c) => previewController.createToken(c)
+  );
   app.get("/api/preview-data", (c) => previewController.getData(c));
   app.get("/api/audit", (c) => auditController.findAll(c));
   app.get("/api/collections/:slug/__audit", async (c) => {
@@ -3274,49 +4352,81 @@ function registerRoutes(app, config) {
     if (!config2.onSchemaFetch || !siteId) {
       return c.json({ message: `Collection "${slug}" not found` }, 404);
     }
-    const dynamic = await config2.onSchemaFetch(siteId);
-    const collection = dynamic.collections?.find((col) => col.slug === slug);
+    const requestConfig = mergeDynamicConfig(
+      config2,
+      await config2.onSchemaFetch(siteId)
+    );
+    const collection = requestConfig.collections.find(
+      (col) => col.slug === slug
+    );
     if (!collection?.audit) {
-      return c.json({ message: `Collection "${slug}" not found or has no audit log` }, 404);
+      return c.json(
+        { message: `Collection "${slug}" not found or has no audit log` },
+        404
+      );
     }
     return auditController.findForCollection(c, collection);
   });
-  app.post("/api/collections/:slug/:id/transitions/:transition", requireAuth(config), async (c) => {
-    const slug = c.req.param("slug");
-    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
-    const config2 = c.get("config");
-    if (config2.collections.some((col) => col.slug === slug)) {
-      return c.json({ message: "Not Found" }, 404);
-    }
-    if (!config2.onSchemaFetch || !siteId) {
-      return c.json({ message: `Collection "${slug}" not found` }, 404);
-    }
-    const dynamic = await config2.onSchemaFetch(siteId);
-    const collection = dynamic.collections?.find((col) => col.slug === slug);
-    if (!collection?.workflow) {
-      return c.json({ message: `Collection "${slug}" not found or has no workflow` }, 404);
-    }
-    const controller = new CollectionController(collection);
-    return controller.transition(c);
-  });
-  app.get("/api/collections/:slug/:id/workflow-history", requireAuth(config), async (c) => {
-    const slug = c.req.param("slug");
-    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
-    const config2 = c.get("config");
-    if (config2.collections.some((col) => col.slug === slug)) {
-      return c.json({ message: "Not Found" }, 404);
-    }
-    if (!config2.onSchemaFetch || !siteId) {
-      return c.json({ message: `Collection "${slug}" not found` }, 404);
-    }
-    const dynamic = await config2.onSchemaFetch(siteId);
-    const collection = dynamic.collections?.find((col) => col.slug === slug);
-    if (!collection?.workflow) {
-      return c.json({ message: `Collection "${slug}" not found or has no workflow` }, 404);
+  app.post(
+    "/api/collections/:slug/:id/transitions/:transition",
+    requireAuth(config),
+    async (c) => {
+      const slug = c.req.param("slug");
+      const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+      const config2 = c.get("config");
+      if (config2.collections.some((col) => col.slug === slug)) {
+        return c.json({ message: "Not Found" }, 404);
+      }
+      if (!config2.onSchemaFetch || !siteId) {
+        return c.json({ message: `Collection "${slug}" not found` }, 404);
+      }
+      const requestConfig = mergeDynamicConfig(
+        config2,
+        await config2.onSchemaFetch(siteId)
+      );
+      const collection = requestConfig.collections.find(
+        (col) => col.slug === slug
+      );
+      if (!collection?.workflow) {
+        return c.json(
+          { message: `Collection "${slug}" not found or has no workflow` },
+          404
+        );
+      }
+      const controller = new CollectionController(collection);
+      return controller.transition(c);
+    }
+  );
+  app.get(
+    "/api/collections/:slug/:id/workflow-history",
+    requireAuth(config),
+    async (c) => {
+      const slug = c.req.param("slug");
+      const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+      const config2 = c.get("config");
+      if (config2.collections.some((col) => col.slug === slug)) {
+        return c.json({ message: "Not Found" }, 404);
+      }
+      if (!config2.onSchemaFetch || !siteId) {
+        return c.json({ message: `Collection "${slug}" not found` }, 404);
+      }
+      const requestConfig = mergeDynamicConfig(
+        config2,
+        await config2.onSchemaFetch(siteId)
+      );
+      const collection = requestConfig.collections.find(
+        (col) => col.slug === slug
+      );
+      if (!collection?.workflow) {
+        return c.json(
+          { message: `Collection "${slug}" not found or has no workflow` },
+          404
+        );
+      }
+      const controller = new CollectionController(collection);
+      return controller.workflowHistory(c);
     }
-    const controller = new CollectionController(collection);
-    return controller.workflowHistory(c);
-  });
+  );
   app.all("/api/collections/:slug/:id?", async (c) => {
     const slug = c.req.param("slug");
     const id = c.req.param("id");
@@ -3326,8 +4436,13 @@ function registerRoutes(app, config) {
       return c.json({ message: "Method Not Allowed" }, 405);
     }
     if (config2.onSchemaFetch && siteId) {
-      const dynamic = await config2.onSchemaFetch(siteId);
-      let collection = dynamic.collections?.find((col) => col.slug === slug);
+      const requestConfig = mergeDynamicConfig(
+        config2,
+        await config2.onSchemaFetch(siteId)
+      );
+      let collection = requestConfig.collections.find(
+        (col) => col.slug === slug
+      );
       if (!collection && slug === "media") {
         collection = {
           slug: "media",
@@ -3340,19 +4455,25 @@ function registerRoutes(app, config) {
         if (collection.auth && id) {
           const authController = new AuthController(collection);
           const method2 = c.req.method;
-          if (method2 === "POST" && id === "login") return authController.login(c);
-          if (method2 === "POST" && id === "logout") return authController.logout(c);
+          if (method2 === "POST" && id === "login")
+            return authController.login(c);
+          if (method2 === "POST" && id === "logout")
+            return authController.logout(c);
           if (method2 === "GET" && id === "me") return authController.me(c);
-          if (method2 === "POST" && id === "refresh-token") return authController.refreshToken(c);
-          if (method2 === "POST" && id === "forgot-password") return authController.forgotPassword(c);
-          if (method2 === "POST" && id === "reset-password") return authController.resetPassword(c);
+          if (method2 === "POST" && id === "refresh-token")
+            return authController.refreshToken(c);
+          if (method2 === "POST" && id === "forgot-password")
+            return authController.forgotPassword(c);
+          if (method2 === "POST" && id === "reset-password")
+            return authController.resetPassword(c);
         }
         const controller = new CollectionController(collection);
         const method = c.req.method;
         if (id) {
           if (method === "GET") return controller.findOne(c);
           if (method === "PATCH") return controller.update(c);
-          if (method === "DELETE" && id === "delete-many") return controller.deleteMany(c);
+          if (method === "DELETE" && id === "delete-many")
+            return controller.deleteMany(c);
           if (method === "DELETE") return controller.delete(c);
           if (method === "POST" && id === "media") return controller.create(c);
           if (method === "POST" && id === "seed") return controller.seed(c);
@@ -3373,8 +4494,11 @@ function registerRoutes(app, config) {
       return c.json({ message: "Method Not Allowed" }, 405);
     }
     if (config2.onSchemaFetch && siteId) {
-      const dynamic = await config2.onSchemaFetch(siteId);
-      const global = dynamic.globals?.find((glb) => glb.slug === slug);
+      const requestConfig = mergeDynamicConfig(
+        config2,
+        await config2.onSchemaFetch(siteId)
+      );
+      const global = requestConfig.globals.find((glb) => glb.slug === slug);
       if (global) {
         const controller = new GlobalController(global);
         const method = c.req.method;
@@ -3390,36 +4514,283 @@ function registerRoutes(app, config) {
   });
 }
 
+// src/network.ts
+var DIRECT_IP_HEADERS = [
+  "cf-connecting-ip",
+  "fly-client-ip",
+  "true-client-ip",
+  "x-real-ip",
+  "x-client-ip",
+  "fastly-client-ip"
+];
+function toHookRequestContext2(c) {
+  const headers = Object.fromEntries(
+    Object.entries(c.req.header()).map(([key, value]) => [key.toLowerCase(), value])
+  );
+  return {
+    query: c.req.query(),
+    headers,
+    raw: c.req.raw
+  };
+}
+function resolveClientIp(req, trustProxy = false) {
+  for (const header of DIRECT_IP_HEADERS) {
+    const value = normalizeIp(req.headers[header]);
+    if (value) return value;
+  }
+  if (trustProxy) {
+    const forwardedFor = pickForwardedFor(req.headers, trustProxy);
+    if (forwardedFor) return forwardedFor;
+  }
+  return "127.0.0.1";
+}
+function pickForwardedFor(headers, trustProxy) {
+  const forwardedHeader = headers["x-forwarded-for"];
+  if (forwardedHeader) {
+    const chain2 = forwardedHeader.split(",").map((entry) => normalizeIp(entry)).filter((entry) => !!entry);
+    if (chain2.length > 0) {
+      if (trustProxy === true) return chain2[0];
+      const trustedHops2 = Math.max(1, Math.floor(trustProxy));
+      const candidateIndex2 = Math.max(0, chain2.length - trustedHops2);
+      return chain2[candidateIndex2] ?? chain2[0];
+    }
+  }
+  const forwarded = headers.forwarded;
+  if (!forwarded) return null;
+  const matches = [...forwarded.matchAll(/for=(?:"?\[?([^;\],"]+)\]?"?)/gi)];
+  if (matches.length === 0) return null;
+  const chain = matches.map((match) => normalizeIp(match[1])).filter((entry) => !!entry);
+  if (chain.length === 0) return null;
+  if (trustProxy === true) return chain[0];
+  const trustedHops = Math.max(1, Math.floor(trustProxy));
+  const candidateIndex = Math.max(0, chain.length - trustedHops);
+  return chain[candidateIndex] ?? chain[0];
+}
+function normalizeIp(value) {
+  if (!value) return null;
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.toLowerCase() === "unknown") return null;
+  return trimmed.replace(/^\[(.*)\]$/, "$1");
+}
+
+// src/middleware/rate-limit.ts
+var DEFAULT_WINDOW_MS = 15 * 60 * 1e3;
+var DEFAULT_MAX_REQUESTS = 500;
+var DEFAULT_PATHS = ["/api"];
+function createRateLimitMiddleware(config) {
+  const settings = normalizeRateLimitConfig(config.rateLimit);
+  const buckets = /* @__PURE__ */ new Map();
+  return async (c, next) => {
+    const req = toHookRequestContext2(c);
+    const ip = resolveClientIp(req, settings.trustProxy);
+    c.set("clientIp", ip);
+    if (!settings.enabled) {
+      return next();
+    }
+    const path = c.req.path;
+    if (!matchesLimitedPath(path, settings.paths)) {
+      return next();
+    }
+    if (settings.skip && await settings.skip({
+      ip,
+      path,
+      method: c.req.method,
+      req
+    })) {
+      return next();
+    }
+    const now = Date.now();
+    const key = ip;
+    const existing = buckets.get(key);
+    const bucket = existing && existing.resetAt > now ? existing : { count: 0, resetAt: now + settings.window };
+    bucket.count += 1;
+    buckets.set(key, bucket);
+    pruneExpiredBuckets(buckets, now);
+    const remaining = Math.max(0, settings.max - bucket.count);
+    const resetSeconds = Math.max(1, Math.ceil((bucket.resetAt - now) / 1e3));
+    c.res.headers.set("X-RateLimit-Limit", String(settings.max));
+    c.res.headers.set("X-RateLimit-Remaining", String(remaining));
+    c.res.headers.set("X-RateLimit-Reset", String(Math.ceil(bucket.resetAt / 1e3)));
+    if (bucket.count > settings.max) {
+      c.res.headers.set("Retry-After", String(resetSeconds));
+      return c.json(
+        {
+          error: true,
+          message: "Too many requests. Try again later.",
+          retryAfterSeconds: resetSeconds
+        },
+        429
+      );
+    }
+    await next();
+  };
+}
+function normalizeRateLimitConfig(config) {
+  return {
+    enabled: config?.enabled ?? true,
+    window: config?.window ?? DEFAULT_WINDOW_MS,
+    max: config?.max ?? DEFAULT_MAX_REQUESTS,
+    paths: config?.paths?.length ? config.paths : DEFAULT_PATHS,
+    skip: config?.skip,
+    trustProxy: config?.trustProxy ?? false
+  };
+}
+function matchesLimitedPath(path, prefixes) {
+  return prefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+}
+function pruneExpiredBuckets(buckets, now) {
+  if (buckets.size < 1e3) return;
+  for (const [key, bucket] of buckets) {
+    if (bucket.resetAt <= now) {
+      buckets.delete(key);
+    }
+  }
+}
+
 // src/app.ts
 async function createDyrectedApp(rawConfig) {
   const config = normalizeConfig(rawConfig);
+  const observability = createObservabilityRuntime(config);
+  bindObservabilityRuntime(config, observability);
+  config.logger = observability.logger;
   const app = new Hono();
   if (config.db?.sync) {
     await config.db.sync(config.collections, config.globals);
   }
   app.use("*", requestId());
-  app.use("*", optionalAuth(config));
-  app.use("*", async (c, next) => {
-    const start = Date.now();
-    await next();
-    const ms = Date.now() - start;
-    console.log(`[dyrected/api] ${c.req.method} ${c.req.path} ${c.res.status} - ${ms}ms`);
-  });
-  app.use("*", cors());
   app.use("*", async (c, next) => {
     c.set("config", config);
+    c.set("observability", observability);
     if (!c.get("siteId")) {
       c.set("siteId", "default");
     }
+    c.set("logger", buildRequestLogger(observability, c.var, c.get("requestId")));
     await next();
   });
+  app.use("*", async (c, next) => {
+    const start = Date.now();
+    const method = c.req.method;
+    const path = c.req.path;
+    const requestId2 = c.get("requestId");
+    const observabilityConfig = observability.config;
+    const traceSampled = shouldSampleRequest(
+      requestId2,
+      200,
+      observabilityConfig.sampling,
+      "trace"
+    );
+    const requestTrace = traceSampled ? createRequestSpan(observability, `${method} ${path}`, {
+      "http.method": method,
+      "http.route": path,
+      requestId: requestId2,
+      siteId: c.get("siteId"),
+      workspaceId: c.get("workspaceId")
+    }) : void 0;
+    if (requestTrace) {
+      c.set("requestTrace", requestTrace);
+      c.set("logger", buildRequestLogger(observability, c.var, requestId2));
+    }
+    let bodyCapturePromise;
+    if (observabilityConfig.requestLogging.logBodies) {
+      const bodySampled = shouldSampleRequest(
+        requestId2,
+        200,
+        observabilityConfig.sampling,
+        "body"
+      );
+      if (bodySampled) {
+        bodyCapturePromise = captureRequestBody(c.req.raw, observabilityConfig);
+      }
+    }
+    let caughtError;
+    try {
+      await next();
+    } catch (error) {
+      caughtError = error;
+      throw error;
+    } finally {
+      const durationMs = Date.now() - start;
+      const statusCode = c.res.status || (caughtError ? 500 : 200);
+      const sampled = shouldSampleRequest(
+        requestId2,
+        statusCode,
+        observabilityConfig.sampling,
+        "log"
+      );
+      const requestLogger = getRequestLogger(c, "api");
+      const requestHeaders = redactHeaders(
+        Object.fromEntries(c.req.raw.headers.entries()),
+        observabilityConfig
+      );
+      const requestBodyCapture = bodyCapturePromise ? await bodyCapturePromise : void 0;
+      if (requestBodyCapture) {
+        c.set("requestBodyCapture", requestBodyCapture);
+      }
+      attachRequestMetrics(observability, {
+        method,
+        route: path,
+        statusCode,
+        durationMs
+      });
+      if (observabilityConfig.requestLogging.enabled && sampled) {
+        const level = statusCode >= 500 ? "error" : statusCode >= 400 ? "warn" : "info";
+        requestLogger[level]({
+          msg: "HTTP request completed",
+          method,
+          path,
+          statusCode,
+          durationMs,
+          requestId: requestId2,
+          siteId: c.get("siteId"),
+          workspaceId: c.get("workspaceId"),
+          contentType: c.req.header("content-type") ?? void 0,
+          contentLength: c.req.header("content-length") ? Number(c.req.header("content-length")) : void 0,
+          sampled,
+          headers: Object.keys(requestHeaders).length > 0 ? requestHeaders : void 0,
+          body: requestBodyCapture?.body,
+          bodyCapture: requestBodyCapture && requestBodyCapture.body === void 0 ? {
+            attempted: requestBodyCapture.attempted,
+            contentType: requestBodyCapture.contentType,
+            contentLength: requestBodyCapture.contentLength,
+            truncated: requestBodyCapture.truncated,
+            parseFailed: requestBodyCapture.parseFailed
+          } : void 0
+        });
+      }
+      endRequestSpan(requestTrace, statusCode, caughtError);
+    }
+  });
+  app.use("*", createRateLimitMiddleware(config));
+  app.use("*", optionalAuth(config));
+  app.use("*", cors(config.cors ? { origin: config.cors.origins } : {}));
   app.get("/health", (c) => c.json({ status: "ok", version: "0.0.1" }));
+  if (observability.config.metrics.enabled && observability.config.metrics.exporter === "prometheus" && observability.prometheusExporter) {
+    app.get(observability.config.metrics.path, async (c) => {
+      const metrics = await renderPrometheusMetrics(
+        observability.prometheusExporter
+      );
+      return new Response(metrics.body, {
+        status: metrics.statusCode,
+        headers: metrics.headers
+      });
+    });
+  }
   app.get("/routes", (c) => {
     const routes = app.routes.map((r) => ({ method: r.method, path: r.path }));
     return c.json({ routes });
   });
   app.onError((err, c) => {
-    console.error(`[dyrected/core] Uncaught Error:`, err);
+    const logger = getRequestLogger(c, "core");
+    logger.error({
+      err,
+      msg: "Uncaught error",
+      path: c.req.path,
+      method: c.req.method
+    });
+    observability.recordUncaughtError({
+      path: c.req.path,
+      method: c.req.method
+    });
     return c.json({
       message: err.message || "Internal Server Error",
       stack: process.env.NODE_ENV === "development" ? err.stack : void 0