@dyrected/core 2.5.61 → 2.5.62

package/dist/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
@@ -46,6 +56,7 @@ __export(index_exports, {
   defineMultiSelectField: () => defineMultiSelectField,
   defineNumberField: () => defineNumberField,
   defineObjectField: () => defineObjectField,
+  definePublishingWorkflow: () => definePublishingWorkflow,
   defineRadioField: () => defineRadioField,
   defineRelationshipField: () => defineRelationshipField,
   defineRichTextField: () => defineRichTextField,
@@ -88,10 +99,47 @@ var LIFECYCLE_EVENT_NAMES = [
   "entry.unpublished"
 ];
 
+// src/auth/token.ts
+var import_jose = require("jose");
+var import_node_util = require("util");
+
+// src/auth/sessions.ts
+var AUTH_SESSIONS_COLLECTION = "__auth_sessions";
+
+// src/observability.ts
+var import_api = require("@opentelemetry/api");
+var import_exporter_metrics_otlp_http = require("@opentelemetry/exporter-metrics-otlp-http");
+var import_exporter_prometheus = require("@opentelemetry/exporter-prometheus");
+var import_exporter_trace_otlp_http = require("@opentelemetry/exporter-trace-otlp-http");
+var import_resources = require("@opentelemetry/resources");
+var import_sdk_metrics = require("@opentelemetry/sdk-metrics");
+var import_sdk_trace_base = require("@opentelemetry/sdk-trace-base");
+var import_pino = __toESM(require("pino"), 1);
+var import_pino_pretty = __toESM(require("pino-pretty"), 1);
+var import_node_stream = require("stream");
+var runtimeByConfig = /* @__PURE__ */ new WeakMap();
+var fallbackLogger = (0, import_pino.default)({
+  name: "dyrected",
+  enabled: process.env.DISABLE_LOGGING !== "true",
+  timestamp: import_pino.stdTimeFunctions.isoTime
+});
+function getObservabilityRuntime(config) {
+  if (!config || typeof config !== "object") return void 0;
+  return runtimeByConfig.get(config);
+}
+function getConfigLogger(config, component) {
+  const base = config?.logger && !("options" in config.logger) ? config.logger : fallbackLogger;
+  return base.child({ component });
+}
+
 // src/workflows.ts
 var WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
 var LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
-function publishingWorkflow() {
+var EDITOR_CAPABILITIES = ["entry.edit", "entry.submit"];
+var PUBLISHER_CAPABILITIES = ["entry.edit", "entry.submit", "entry.publish", "entry.unpublish"];
+function definePublishingWorkflow(options = {}) {
+  const editors = options.editors ?? ["editor"];
+  const publishers = options.publishers ?? ["publisher", "admin"];
   return {
     initialState: "draft",
     draftState: "draft",
@@ -107,12 +155,14 @@ function publishingWorkflow() {
       { name: "unpublish", label: "Unpublish", from: "published", to: "draft", requiredCapabilities: ["entry.unpublish"], unpublish: true }
     ],
     roles: [
-      { role: "editor", capabilities: ["entry.edit", "entry.submit"] },
-      { role: "publisher", capabilities: ["entry.edit", "entry.submit", "entry.publish", "entry.unpublish"] },
-      { role: "admin", capabilities: ["entry.edit", "entry.submit", "entry.publish", "entry.unpublish"] }
+      ...editors.map((role) => ({ role, capabilities: [...EDITOR_CAPABILITIES] })),
+      ...publishers.map((role) => ({ role, capabilities: [...PUBLISHER_CAPABILITIES] }))
     ]
   };
 }
+function publishingWorkflow() {
+  return definePublishingWorkflow();
+}
 function simplePublishingWorkflow() {
   return {
     initialState: "draft",
@@ -125,6 +175,9 @@ function simplePublishingWorkflow() {
       { name: "publish", label: "Publish", from: "draft", to: "published" },
       { name: "unpublish", label: "Unpublish", from: "published", to: "draft", unpublish: true }
     ]
+    // Intentionally no `roles`: this lightweight workflow (synthesized from
+    // `drafts: true`) does no capability-based gating. Draft visibility for a
+    // no-roles workflow is handled in `canViewWorkflowDraft`.
   };
 }
 function publicMetadata(meta) {
@@ -143,9 +196,13 @@ function canViewWorkflowDraft(workflow, user) {
   if (!user) return false;
   const capabilities = workflowCapabilities(workflow, user);
   if (capabilities.has("entry.edit")) return true;
-  return workflow.transitions.some(
+  if (workflow.transitions.some(
     (transition) => (transition.requiredCapabilities ?? []).some((capability) => capabilities.has(capability))
-  );
+  )) {
+    return true;
+  }
+  if (!workflow.roles || workflow.roles.length === 0) return true;
+  return false;
 }
 function availableWorkflowTransitions(workflow, state, user) {
   const capabilities = workflowCapabilities(workflow, user);
@@ -371,7 +428,17 @@ async function transitionWorkflow(args) {
     try {
       await hook({ ...hookContext, doc: updated, event: events[0] });
     } catch (error) {
-      console.error("[dyrected/workflow] afterTransition hook failed:", error);
+      getObservabilityRuntime(config)?.recordWorkflowHookFailure({
+        collection: collection.slug,
+        transition: transition.name
+      });
+      getConfigLogger(config, "workflow").error({
+        err: error,
+        msg: "afterTransition hook failed",
+        collection: collection.slug,
+        transition: transition.name,
+        documentId: id
+      });
     }
   }
   return updated;
@@ -412,6 +479,98 @@ function humanizeProviderName(id, type) {
   return cleaned.replace(/\b\w/g, (char) => char.toUpperCase());
 }
 
+// src/utils/block-references.ts
+function mergeUniqueBlocks(blocks) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const block of blocks) {
+    const existing = seen.get(block.slug);
+    if (existing && existing !== block) {
+      throw new Error(
+        `Duplicate block slug "${block.slug}" found in the reusable block registry. Block slugs must be unique.`
+      );
+    }
+    if (!existing) seen.set(block.slug, block);
+  }
+  return Array.from(seen.values());
+}
+function buildRegistry(blocks) {
+  return new Map(blocks.map((block) => [block.slug, block]));
+}
+function resolveField(field, registry, blockCache) {
+  const next = { ...field };
+  if (next.fields) {
+    next.fields = next.fields.map(
+      (child) => resolveField(child, registry, blockCache)
+    );
+  }
+  if (next.type !== "blocks") return next;
+  const hasInlineBlocks = Array.isArray(next.blocks) && next.blocks.length > 0;
+  const hasReferences = Array.isArray(next.blockReferences) && next.blockReferences.length > 0;
+  if (hasInlineBlocks && hasReferences) {
+    throw new Error(
+      `Blocks field "${next.name ?? "(unnamed)"}" cannot define both "blocks" and "blockReferences". Use one or the other.`
+    );
+  }
+  if (hasReferences) {
+    next.blocks = next.blockReferences.map((slug) => {
+      const block = registry.get(slug);
+      if (!block) {
+        throw new Error(
+          `Unknown block reference "${slug}" on blocks field "${next.name ?? "(unnamed)"}". Add it to defineConfig({ blocks: [...] }).`
+        );
+      }
+      return resolveBlock(block, registry, blockCache);
+    });
+    return next;
+  }
+  if (hasInlineBlocks) {
+    next.blocks = next.blocks.map(
+      (block) => resolveBlock(block, registry, blockCache)
+    );
+  }
+  return next;
+}
+function resolveBlock(block, registry, blockCache) {
+  const cached = blockCache.get(block);
+  if (cached) return cached;
+  const resolved = {
+    ...block,
+    fields: []
+  };
+  blockCache.set(block, resolved);
+  resolved.fields = block.fields.map(
+    (field) => resolveField(field, registry, blockCache)
+  );
+  return resolved;
+}
+function resolveFields(fields, registry, blockCache) {
+  return fields.map((field) => resolveField(field, registry, blockCache));
+}
+function normalizeSchemaFragment(fragment) {
+  const reusableBlocks = mergeUniqueBlocks(fragment.blocks ?? []);
+  const registry = buildRegistry(reusableBlocks);
+  const blockCache = /* @__PURE__ */ new WeakMap();
+  const resolvedBlocks = reusableBlocks.map(
+    (block) => resolveBlock(block, registry, blockCache)
+  );
+  const resolvedCollections = (fragment.collections ?? []).map(
+    (collection) => ({
+      ...collection,
+      fields: resolveFields(collection.fields ?? [], registry, blockCache)
+    })
+  );
+  const resolvedGlobals = (fragment.globals ?? []).map((global) => ({
+    ...global,
+    fields: resolveFields(global.fields ?? [], registry, blockCache)
+  }));
+  return {
+    ...fragment,
+    ...fragment.blocks ? { blocks: resolvedBlocks } : {},
+    ...fragment.collections ? { collections: resolvedCollections } : {},
+    ...fragment.globals ? { globals: resolvedGlobals } : {}
+  };
+}
+
 // src/utils/config.ts
 var AUDIT_COLLECTION_SLUG = "__audit";
 var SYSTEM_FIELDS = [
@@ -446,12 +605,23 @@ var AUDIT_COLLECTION = {
   fields: [
     { name: "collection", type: "text", label: "Collection", required: true },
     { name: "documentId", type: "text", label: "Document ID" },
-    { name: "operation", type: "select", label: "Operation", options: ["create", "update", "delete"], required: true },
+    {
+      name: "operation",
+      type: "select",
+      label: "Operation",
+      options: ["create", "update", "delete"],
+      required: true
+    },
     { name: "user", type: "text", label: "User ID" },
     { name: "timestamp", type: "date", label: "Timestamp", required: true },
     { name: "changes", type: "json", label: "Changes" }
   ],
-  access: { read: () => false, create: () => false, update: () => false, delete: () => false },
+  access: {
+    read: () => false,
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
   admin: { hidden: true }
 };
 var WORKFLOW_HISTORY_COLLECTION_CONFIG = {
@@ -468,7 +638,12 @@ var WORKFLOW_HISTORY_COLLECTION_CONFIG = {
     { name: "actorId", type: "text" },
     { name: "createdAt", type: "date", required: true }
   ],
-  access: { read: ({ user }) => !!user, create: () => false, update: () => false, delete: () => false },
+  access: {
+    read: ({ user }) => !!user,
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
   admin: { hidden: true }
 };
 var LIFECYCLE_EVENTS_COLLECTION_CONFIG = {
@@ -482,22 +657,56 @@ var LIFECYCLE_EVENTS_COLLECTION_CONFIG = {
     { name: "actorId", type: "text" },
     { name: "payload", type: "json", required: true },
     { name: "attempts", type: "number", required: true },
-    { name: "status", type: "select", options: ["pending", "processing", "delivered", "failed"], required: true },
+    {
+      name: "status",
+      type: "select",
+      options: ["pending", "processing", "delivered", "failed"],
+      required: true
+    },
     { name: "nextAttemptAt", type: "date" },
     { name: "deliveredAt", type: "date" },
     { name: "lastError", type: "textarea" }
   ],
-  access: { read: ({ user }) => !!user?.roles?.includes("admin"), create: () => false, update: () => false, delete: () => false },
+  access: {
+    read: ({ user }) => !!user?.roles?.includes("admin"),
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
+  admin: { hidden: true }
+};
+var AUTH_SESSIONS_COLLECTION_CONFIG = {
+  slug: AUTH_SESSIONS_COLLECTION,
+  labels: { singular: "Auth session", plural: "Auth sessions" },
+  fields: [
+    { name: "userId", type: "text", required: true },
+    { name: "email", type: "email", required: true },
+    { name: "collection", type: "text", required: true },
+    { name: "authSource", type: "text" },
+    { name: "providerId", type: "text" },
+    { name: "lastIp", type: "text" },
+    { name: "lastSeenAt", type: "date" },
+    { name: "expiresAt", type: "date" },
+    { name: "revokedAt", type: "date" }
+  ],
+  access: {
+    read: () => false,
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
   admin: { hidden: true }
 };
 function normalizeConfig(config) {
-  const collections = config?.collections || [];
-  const globals = config?.globals || [];
+  const schemaAwareConfig = normalizeSchemaFragment(config);
+  const collections = schemaAwareConfig?.collections || [];
+  const globals = schemaAwareConfig?.globals || [];
   const needsAudit = collections.some((col) => col.audit);
   const needsWorkflow = collections.some((col) => col.workflow || col.drafts);
+  const needsAuthSessions = collections.some((col) => !!col.auth);
   const adminAuthCollectionSlug = getAdminAuthCollection({
     collections,
-    adminAuth: config.adminAuth
+    adminAuth: schemaAwareConfig.adminAuth
   })?.slug;
   const normalizedCollections = collections.map((col) => {
     let fields = col.fields || [];
@@ -594,7 +803,7 @@ function normalizeConfig(config) {
         return field;
       });
     }
-    if (adminAuthCollectionSlug && col.slug === adminAuthCollectionSlug && config.adminAuth?.mode === "external") {
+    if (adminAuthCollectionSlug && col.slug === adminAuthCollectionSlug && schemaAwareConfig.adminAuth?.mode === "external") {
       const externalAdminFields = [
         {
           name: "authProvider",
@@ -628,7 +837,9 @@ function normalizeConfig(config) {
       }
     }
     const updatedFieldNames = new Set(fields.map((f) => f.name));
-    const fieldsToInject = SYSTEM_FIELDS.filter((f) => !updatedFieldNames.has(f.name));
+    const fieldsToInject = SYSTEM_FIELDS.filter(
+      (f) => !updatedFieldNames.has(f.name)
+    );
     const workflow = col.workflow || (col.drafts ? simplePublishingWorkflow() : void 0);
     return {
       ...col,
@@ -636,17 +847,27 @@ function normalizeConfig(config) {
       fields: [...fields, ...fieldsToInject]
     };
   });
-  const hasAuditCollection = normalizedCollections.some((col) => col.slug === AUDIT_COLLECTION_SLUG);
+  const hasAuditCollection = normalizedCollections.some(
+    (col) => col.slug === AUDIT_COLLECTION_SLUG
+  );
   const systemCollections = [];
-  if (needsAudit && !hasAuditCollection) systemCollections.push(AUDIT_COLLECTION);
-  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === WORKFLOW_HISTORY_COLLECTION)) {
+  if (needsAudit && !hasAuditCollection)
+    systemCollections.push(AUDIT_COLLECTION);
+  if (needsWorkflow && !normalizedCollections.some(
+    (col) => col.slug === WORKFLOW_HISTORY_COLLECTION
+  )) {
     systemCollections.push(WORKFLOW_HISTORY_COLLECTION_CONFIG);
   }
-  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === LIFECYCLE_EVENTS_COLLECTION)) {
+  if (needsWorkflow && !normalizedCollections.some(
+    (col) => col.slug === LIFECYCLE_EVENTS_COLLECTION
+  )) {
     systemCollections.push(LIFECYCLE_EVENTS_COLLECTION_CONFIG);
   }
+  if (needsAuthSessions && !normalizedCollections.some((col) => col.slug === AUTH_SESSIONS_COLLECTION)) {
+    systemCollections.push(AUTH_SESSIONS_COLLECTION_CONFIG);
+  }
   return {
-    ...config,
+    ...schemaAwareConfig,
     collections: [...normalizedCollections, ...systemCollections],
     globals
   };
@@ -872,7 +1093,10 @@ async function runCollectionHooks(hooks, args, options = {}) {
       }
     } catch (err) {
       if (options.isolated) {
-        console.error("[dyrected/core] Side-effect hook failed (error isolated \u2014 DB write was successful):", err);
+        getConfigLogger(void 0, "hooks").error({
+          err,
+          msg: "Side-effect hook failed after a successful write"
+        });
       } else {
         throw err;
       }
@@ -917,7 +1141,13 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
           const item = updatedValue[i];
           const origItem = Array.isArray(origValue) ? origValue[i] : null;
           arrayResult.push(
-            await executeFieldBeforeChange(field.fields, item, origItem, user, db)
+            await executeFieldBeforeChange(
+              field.fields,
+              item,
+              origItem,
+              user,
+              db
+            )
           );
         }
         result[field.name] = arrayResult;
@@ -1058,7 +1288,15 @@ function generateOpenApi(config) {
         },
         WorkflowHistoryEntry: {
           type: "object",
-          required: ["collection", "documentId", "transition", "from", "to", "revision", "createdAt"],
+          required: [
+            "collection",
+            "documentId",
+            "transition",
+            "from",
+            "to",
+            "revision",
+            "createdAt"
+          ],
           properties: {
             id: { type: "string" },
             collection: { type: "string" },
@@ -1083,7 +1321,11 @@ function generateOpenApi(config) {
             user: { type: "string", nullable: true },
             timestamp: { type: "string", format: "date-time" },
             changes: {
-              oneOf: [{ type: "string" }, { type: "object", additionalProperties: true }, { type: "null" }]
+              oneOf: [
+                { type: "string" },
+                { type: "object", additionalProperties: true },
+                { type: "null" }
+              ]
             }
           }
         },
@@ -1175,13 +1417,17 @@ function generateOpenApi(config) {
     get: {
       tags: ["Preferences"],
       summary: "Get an authenticated user preference",
-      parameters: [{ name: "key", in: "path", required: true, schema: { type: "string" } }],
+      parameters: [
+        { name: "key", in: "path", required: true, schema: { type: "string" } }
+      ],
       responses: { 200: { description: "Preference value" } }
     },
     put: {
       tags: ["Preferences"],
       summary: "Set an authenticated user preference",
-      parameters: [{ name: "key", in: "path", required: true, schema: { type: "string" } }],
+      parameters: [
+        { name: "key", in: "path", required: true, schema: { type: "string" } }
+      ],
       requestBody: {
         required: true,
         content: { "application/json": { schema: { type: "object" } } }
@@ -1217,10 +1463,23 @@ function generateOpenApi(config) {
       tags: ["Audit"],
       summary: "Get audit entries across all readable audited collections",
       parameters: [
-        { name: "limit", in: "query", schema: { type: "integer", default: 50, maximum: 100 } },
+        {
+          name: "limit",
+          in: "query",
+          schema: { type: "integer", default: 50, maximum: 100 }
+        },
         { name: "page", in: "query", schema: { type: "integer", default: 1 } },
-        { name: "where", in: "query", schema: { type: "string" }, description: "JSON filter" },
-        { name: "sort", in: "query", schema: { type: "string", default: "-timestamp" } }
+        {
+          name: "where",
+          in: "query",
+          schema: { type: "string" },
+          description: "JSON filter"
+        },
+        {
+          name: "sort",
+          in: "query",
+          schema: { type: "string", default: "-timestamp" }
+        }
       ],
       responses: {
         200: {
@@ -1425,10 +1684,27 @@ function generateOpenApi(config) {
           tags: [collectionTag],
           summary: `Get ${labels.singular} audit entries`,
           parameters: [
-            { name: "limit", in: "query", schema: { type: "integer", default: 50, maximum: 100 } },
-            { name: "page", in: "query", schema: { type: "integer", default: 1 } },
-            { name: "where", in: "query", schema: { type: "string" }, description: "JSON filter" },
-            { name: "sort", in: "query", schema: { type: "string", default: "-timestamp" } }
+            {
+              name: "limit",
+              in: "query",
+              schema: { type: "integer", default: 50, maximum: 100 }
+            },
+            {
+              name: "page",
+              in: "query",
+              schema: { type: "integer", default: 1 }
+            },
+            {
+              name: "where",
+              in: "query",
+              schema: { type: "string" },
+              description: "JSON filter"
+            },
+            {
+              name: "sort",
+              in: "query",
+              schema: { type: "string", default: "-timestamp" }
+            }
           ],
           responses: {
             200: {
@@ -1554,6 +1830,15 @@ function generateOpenApi(config) {
         post: {
           tags: [collectionTag],
           summary: `Log out of ${labels.plural}`,
+          parameters: [
+            {
+              name: "allSessions",
+              in: "query",
+              required: false,
+              schema: { type: "boolean" },
+              description: "Revoke every active session for this account instead of only the current one."
+            }
+          ],
           responses: { 200: { description: "Logged out" } }
         }
       };
@@ -1579,7 +1864,11 @@ function generateOpenApi(config) {
         post: {
           tags: [collectionTag],
           summary: "Refresh an authentication token",
-          responses: { 200: { description: "Refreshed token" } }
+          responses: {
+            200: {
+              description: "Refreshed token for the current active session"
+            }
+          }
         }
       };
       spec.paths[`${path}/forgot-password`] = {
@@ -1610,7 +1899,11 @@ function generateOpenApi(config) {
               schema: { type: "string" }
             }
           ],
-          responses: { 200: { description: "Password changed" } }
+          responses: {
+            200: {
+              description: "Password changed and active sessions revoked"
+            }
+          }
         }
       };
     }
@@ -1819,7 +2112,7 @@ function fieldsToProperties(fields) {
   return { properties: props, required };
 }
 function fieldToSchema(field) {
-  let schema = {};
+  let schema;
   switch (field.type) {
     case "text":
     case "textarea":
@@ -1828,7 +2121,10 @@ function fieldToSchema(field) {
       break;
     case "url":
       schema = {
-        oneOf: [{ type: "string" }, { type: "object", additionalProperties: true }]
+        oneOf: [
+          { type: "string" },
+          { type: "object", additionalProperties: true }
+        ]
       };
       break;
     case "icon":
@@ -1998,6 +2294,7 @@ function defineTab(args) {
   defineMultiSelectField,
   defineNumberField,
   defineObjectField,
+  definePublishingWorkflow,
   defineRadioField,
   defineRelationshipField,
   defineRichTextField,

package/dist/index.d.cts

@@ -1,6 +1,7 @@
-import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, W as WorkflowConfig, a as AuthenticatedUser, b as WorkflowTransition, L as LifecycleEventName, c as LifecycleEvent, d as BaseDocument, H as HookRequestContext, e as ArrayField, f as BlocksField, g as BooleanField, h as DateField, i as DateTimeField, E as EmailField, G as GlobalConfig, I as IconField, j as ImageField, J as JoinField, k as JsonField, M as MultiSelectField, N as NumberField, O as ObjectField, R as RadioField, l as RelationshipField, m as RichTextField, n as RowField, S as SelectField, T as TextField, o as TextareaField, p as TimeField, U as UrlField } from './app-config-C0uxEU7Q.cjs';
-export { q as AccessFunction, r as AccessFunctionArgs, s as AccessPolicyResolver, t as AccessResult, u as AccessRule, v as AdminAuthAccessResolution, w as AdminAuthClaimMapping, x as AdminAuthMember, y as AdminAuthProvider, z as AdminAuthProviderMembersConfig, K as AdminAuthProvisioningMode, Q as AdminAuthResolveAccessArgs, V as AdminAuthResolvedIdentity, X as AdminConfig, Y as AdminDashboardComponentSlots, Z as AdminIconName, _ as BaseAdminAuthProvider, $ as BaseFieldAdmin, a0 as BlockVariant, a1 as BooleanFieldAdmin, a2 as BooleanFormat, a3 as CharacterLimitFieldAdmin, a4 as CharacterLimitFieldConfig, a5 as CollectionAfterChangeHook, a6 as CollectionAfterDeleteHook, a7 as CollectionAfterReadHook, a8 as CollectionAfterTransitionHook, a9 as CollectionBeforeChangeHook, aa as CollectionBeforeDeleteHook, ab as CollectionBeforeReadHook, ac as CollectionBeforeTransitionHook, ad as CollectionListComponentSlots, ae as CustomAdminAuthProvider, af as DatabaseAdapter, ag as DateFieldAdmin, ah as DateFormat, ai as DisplayTone, aj as DynamicOptionItem, ak as DynamicOptionsConfig, al as DynamicOptionsResolver, am as DynamicOptionsResolverArgs, an as EmailFieldAdmin, ao as FieldAdminHooks, ap as FieldAdminOnChangeHook, aq as FieldAdminOnChangeHookArgs, ar as FieldAdminOptionsHook, as as FieldAdminOptionsHookArgs, at as FieldAdminOptionsHookResult, au as FieldAfterReadHook, av as FieldAfterReadHookArgs, aw as FieldBase, ax as FieldBeforeChangeHook, ay as FieldBeforeChangeHookArgs, az as FieldHook, aA as FieldHooks, aB as FieldType, aC as FileData, aD as GlobalAfterChangeHook, aE as GlobalAfterReadHook, aF as GlobalBeforeChangeHook, aG as GlobalBeforeReadHook, aH as HeadingLevel, aI as HookFunction, aJ as IconFieldAdmin, aK as ImageService, aL as JsonFieldAdmin, aM as JsonFormat, aN as LIFECYCLE_EVENT_NAMES, aO as LifecycleEventHandler, aP as LinkFormat, aQ as MultiSelectFieldAdmin, aR as NamedAccessPolicy, aS as NumberFieldAdmin, aT as NumberFormat, aU as NumberLimitFieldAdmin, aV as NumberLimitFieldConfig, aW as OIDCAdminAuthProvider, aX as OptionFormat, aY as PaginatedResult, aZ as PublicAdminAuthProvider, a_ as RadioFieldAdmin, a$ as ReadonlyDatabaseAdapter, b0 as RichTextFeature, b1 as RichTextFieldConfig, b2 as SelectFieldAdmin, b3 as StorageAdapter, b4 as TextFieldAdmin, b5 as TextFormat, b6 as TextareaFieldAdmin, b7 as TypedField, b8 as UploadConfig, b9 as UrlFieldAdmin, ba as UrlLinkValue, bb as WordLimitFieldAdmin, bc as WordLimitFieldConfig, bd as WorkflowMetadata, be as WorkflowRole, bf as WorkflowState, bg as WorkflowTransitionContext } from './app-config-C0uxEU7Q.cjs';
+import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, W as WorkflowConfig, a as AuthenticatedUser, b as WorkflowTransition, L as LifecycleEventName, c as LifecycleEvent, d as BaseDocument, H as HookRequestContext, e as ArrayField, f as BlocksField, g as BooleanField, h as AuthConfig, i as DateField, j as DateTimeField, E as EmailField, G as GlobalConfig, I as IconField, k as ImageField, J as JoinField, l as JsonField, M as MultiSelectField, N as NumberField, O as ObjectField, R as RadioField, m as RelationshipField, n as RichTextField, o as RowField, S as SelectField, T as TextField, p as TextareaField, q as TimeField, U as UrlField } from './app-config-Dv5XACR4.cjs';
+export { r as AccessFunction, s as AccessFunctionArgs, t as AccessPolicyResolver, u as AccessResult, v as AccessRule, w as AdminAuthAccessResolution, x as AdminAuthClaimMapping, y as AdminAuthMember, z as AdminAuthProvider, K as AdminAuthProviderMembersConfig, Q as AdminAuthProvisioningMode, V as AdminAuthResolveAccessArgs, X as AdminAuthResolvedIdentity, Y as AdminConfig, Z as AdminDashboardComponentSlots, _ as AdminIconName, $ as BaseAdminAuthProvider, a0 as BaseFieldAdmin, a1 as BlockVariant, a2 as BooleanFieldAdmin, a3 as BooleanFormat, a4 as CharacterLimitFieldAdmin, a5 as CharacterLimitFieldConfig, a6 as CollectionAfterChangeHook, a7 as CollectionAfterDeleteHook, a8 as CollectionAfterReadHook, a9 as CollectionAfterTransitionHook, aa as CollectionBeforeChangeHook, ab as CollectionBeforeDeleteHook, ac as CollectionBeforeReadHook, ad as CollectionBeforeTransitionHook, ae as CollectionListComponentSlots, af as CustomAdminAuthProvider, ag as DatabaseAdapter, ah as DateFieldAdmin, ai as DateFormat, aj as DisplayTone, ak as DynamicOptionItem, al as DynamicOptionsConfig, am as DynamicOptionsResolver, an as DynamicOptionsResolverArgs, ao as DyrectedLoggerConfig, ap as DyrectedObservabilityConfig, aq as EmailFieldAdmin, ar as FieldAdminHooks, as as FieldAdminOnChangeHook, at as FieldAdminOnChangeHookArgs, au as FieldAdminOptionsHook, av as FieldAdminOptionsHookArgs, aw as FieldAdminOptionsHookResult, ax as FieldAfterReadHook, ay as FieldAfterReadHookArgs, az as FieldBase, aA as FieldBeforeChangeHook, aB as FieldBeforeChangeHookArgs, aC as FieldHook, aD as FieldHooks, aE as FieldType, aF as FileData, aG as GlobalAfterChangeHook, aH as GlobalAfterReadHook, aI as GlobalBeforeChangeHook, aJ as GlobalBeforeReadHook, aK as HeadingLevel, aL as HookFunction, aM as IconFieldAdmin, aN as ImageService, aO as JsonFieldAdmin, aP as JsonFormat, aQ as LIFECYCLE_EVENT_NAMES, aR as LifecycleEventHandler, aS as LinkFormat, aT as MultiSelectFieldAdmin, aU as NamedAccessPolicy, aV as NumberFieldAdmin, aW as NumberFormat, aX as NumberLimitFieldAdmin, aY as NumberLimitFieldConfig, aZ as OIDCAdminAuthProvider, a_ as OptionFormat, a$ as PaginatedResult, b0 as PublicAdminAuthProvider, b1 as RadioFieldAdmin, b2 as RateLimitConfig, b3 as ReadonlyDatabaseAdapter, b4 as RichTextFeature, b5 as RichTextFieldConfig, b6 as SelectFieldAdmin, b7 as StorageAdapter, b8 as TextFieldAdmin, b9 as TextFormat, ba as TextareaFieldAdmin, bb as TrustProxyConfig, bc as TypedField, bd as UploadConfig, be as UrlFieldAdmin, bf as UrlLinkValue, bg as WordLimitFieldAdmin, bh as WordLimitFieldConfig, bi as WorkflowMetadata, bj as WorkflowRole, bk as WorkflowState, bl as WorkflowTransitionContext } from './app-config-Dv5XACR4.cjs';
 import 'lucide-react';
+import 'pino';
 
 type Prettify<T> = {
     [K in keyof T]: T[K];
@@ -241,6 +242,35 @@ declare function generateOpenApi(config: DyrectedConfig): any;
 
 declare const WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
 declare const LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
+/**
+ * Role mapping for {@link definePublishingWorkflow}. Map your app's own role
+ * values onto the publishing workflow's two capability tiers.
+ */
+interface PublishingWorkflowOptions {
+    /** Role values allowed to edit and submit for review. Defaults to `["editor"]`. */
+    editors?: string[];
+    /** Role values allowed to also publish and unpublish. Defaults to `["publisher", "admin"]`. */
+    publishers?: string[];
+}
+/**
+ * Build a `draft → in review → published` editorial workflow, mapping your own
+ * role values onto its capability tiers. Reach for this instead of
+ * {@link publishingWorkflow} when your roles aren't named
+ * `editor`/`publisher`/`admin`.
+ *
+ * @example
+ * workflow: definePublishingWorkflow({
+ *   editors: ["writer"],
+ *   publishers: ["managing-editor", "admin"],
+ * })
+ */
+declare function definePublishingWorkflow(options?: PublishingWorkflowOptions): WorkflowConfig;
+/**
+ * The default `draft → in review → published` editorial workflow, using the
+ * conventional role names `editor`, `publisher`, and `admin`. Shorthand for
+ * `definePublishingWorkflow()` — use {@link definePublishingWorkflow} to map
+ * your own role names onto its capability tiers.
+ */
 declare function publishingWorkflow(): WorkflowConfig;
 declare function simplePublishingWorkflow(): WorkflowConfig;
 declare function workflowCapabilities(workflow: WorkflowConfig, user?: AuthenticatedUser): Set<string>;
@@ -326,7 +356,7 @@ declare function defineCollection<const TFields extends Field[]>(config: Omit<Co
     id: string;
 } & InferDocShape<TFields> & SystemDocFields & AuthDocFields>>, "fields" | "auth"> & {
     fields: TFields;
-    auth: true;
+    auth: true | AuthConfig;
 }): CollectionConfig<Prettify<{
     id: string;
 } & InferDocShape<TFields> & SystemDocFields & AuthDocFields>>;
@@ -539,4 +569,4 @@ declare function defineTab<const T extends readonly Field[]>(args: {
     fields: T;
 }): T;
 
-export { AdminAuthConfig, ArrayField, type AuthDocFields, AuthenticatedUser, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, DateField, DateTimeField, DyrectedConfig, EmailField, Field, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MultiSelectField, NumberField, ObjectField, type Prettify, PublicAdminAuthConfig, RadioField, RelationshipField, RichTextField, RowField, SelectField, type SortClause, type SortDirection, type SqlSortDialect, type SqlWhereResult, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhereClause, type WhereOperator, type WhereOperatorName, WorkflowConfig, WorkflowTransition, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, createLifecycleEvent, createWorkflowDocument, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, executeFieldAfterRead, executeFieldBeforeChange, generateOpenApi, getAdminAuthCollection, getPublicAdminAuthConfig, initializeWorkflowDocument, materializeWorkflowDocument, normalizeConfig, numericFieldNames, parseMongoWhere, parseSort, parseSqlWhere, publishingWorkflow, resolveAdminAuthCollection, runCollectionHooks, saveWorkflowDraft, simplePublishingWorkflow, transitionWorkflow, workflowCapabilities };
+export { AdminAuthConfig, ArrayField, AuthConfig, type AuthDocFields, AuthenticatedUser, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, DateField, DateTimeField, DyrectedConfig, EmailField, Field, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MultiSelectField, NumberField, ObjectField, type Prettify, PublicAdminAuthConfig, type PublishingWorkflowOptions, RadioField, RelationshipField, RichTextField, RowField, SelectField, type SortClause, type SortDirection, type SqlSortDialect, type SqlWhereResult, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhereClause, type WhereOperator, type WhereOperatorName, WorkflowConfig, WorkflowTransition, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, createLifecycleEvent, createWorkflowDocument, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, definePublishingWorkflow, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, executeFieldAfterRead, executeFieldBeforeChange, generateOpenApi, getAdminAuthCollection, getPublicAdminAuthConfig, initializeWorkflowDocument, materializeWorkflowDocument, normalizeConfig, numericFieldNames, parseMongoWhere, parseSort, parseSqlWhere, publishingWorkflow, resolveAdminAuthCollection, runCollectionHooks, saveWorkflowDraft, simplePublishingWorkflow, transitionWorkflow, workflowCapabilities };