@dyrected/core 2.5.61 → 2.5.62

package/dist/server.cjs

@@ -171,12 +171,16 @@ var PopulationService = class {
       return data;
     }
     if (Array.isArray(data)) {
-      return Promise.all(data.map((item) => this.populate({ ...args, data: item })));
+      return Promise.all(
+        data.map((item) => this.populate({ ...args, data: item }))
+      );
     }
     const populatedDoc = { ...data };
     for (const field of fields) {
       if (field.type === "join" && field.collection && field.on && currentDepth === 0) {
-        const targetCollection = this.collections.find((c) => c.slug === field.collection);
+        const targetCollection = this.collections.find(
+          (c) => c.slug === field.collection
+        );
         if (targetCollection) {
           const docId = populatedDoc.id;
           if (docId) {
@@ -188,7 +192,9 @@ var PopulationService = class {
               limit: joinLimit
             });
             const populatedDocs = await this.populate({
-              data: result.docs.map((doc) => DefaultsService.apply(targetCollection.fields, doc)),
+              data: result.docs.map(
+                (doc) => DefaultsService.apply(targetCollection.fields, doc)
+              ),
               fields: targetCollection.fields,
               currentDepth: 1,
               maxDepth
@@ -203,14 +209,21 @@ var PopulationService = class {
         continue;
       }
       if (field.type === "row" && field.fields) {
-        const rowPopulated = await this.populate({ data, fields: field.fields, currentDepth, maxDepth });
+        const rowPopulated = await this.populate({
+          data,
+          fields: field.fields,
+          currentDepth,
+          maxDepth
+        });
         Object.assign(populatedDoc, rowPopulated);
         continue;
       }
       if (!field.name) continue;
       const value = populatedDoc[field.name];
       if (field.type === "relationship" && field.relationTo && value) {
-        const relatedCollection = this.collections.find((c) => c.slug === field.relationTo);
+        const relatedCollection = this.collections.find(
+          (c) => c.slug === field.relationTo
+        );
         if (!relatedCollection) continue;
         if (Array.isArray(value)) {
           populatedDoc[field.name] = await Promise.all(
@@ -218,10 +231,16 @@ var PopulationService = class {
               if (!id) return id;
               let doc = id;
               if (typeof id === "string") {
-                doc = await this.db.findOne({ collection: field.relationTo, id });
+                doc = await this.db.findOne({
+                  collection: field.relationTo,
+                  id
+                });
               }
               if (!doc || typeof doc !== "object") return id;
-              const docWithDefaults = DefaultsService.apply(relatedCollection.fields, doc);
+              const docWithDefaults = DefaultsService.apply(
+                relatedCollection.fields,
+                doc
+              );
               return this.populate({
                 data: docWithDefaults,
                 fields: relatedCollection.fields,
@@ -233,10 +252,16 @@ var PopulationService = class {
         } else if (value) {
           let doc = value;
           if (typeof value === "string") {
-            doc = await this.db.findOne({ collection: field.relationTo, id: value });
+            doc = await this.db.findOne({
+              collection: field.relationTo,
+              id: value
+            });
           }
           if (doc && typeof doc === "object") {
-            const docWithDefaults = DefaultsService.apply(relatedCollection.fields, doc);
+            const docWithDefaults = DefaultsService.apply(
+              relatedCollection.fields,
+              doc
+            );
             populatedDoc[field.name] = await this.populate({
               data: docWithDefaults,
               fields: relatedCollection.fields,
@@ -247,11 +272,19 @@ var PopulationService = class {
         }
       }
       if (field.type === "url" && value && typeof value === "object" && value.type === "internal" && value.relationTo && value.value) {
-        const relatedCollection = this.collections.find((c) => c.slug === value.relationTo);
+        const relatedCollection = this.collections.find(
+          (c) => c.slug === value.relationTo
+        );
         if (relatedCollection) {
-          const doc = await this.db.findOne({ collection: value.relationTo, id: value.value });
+          const doc = await this.db.findOne({
+            collection: value.relationTo,
+            id: value.value
+          });
           if (doc && typeof doc === "object") {
-            const docWithDefaults = DefaultsService.apply(relatedCollection.fields, doc);
+            const docWithDefaults = DefaultsService.apply(
+              relatedCollection.fields,
+              doc
+            );
             const populatedDocValue = await this.populate({
               data: docWithDefaults,
               fields: relatedCollection.fields,
@@ -269,15 +302,27 @@ var PopulationService = class {
                 }
               } else if (typeof previewUrlPattern === "string") {
                 if (previewUrlPattern.includes("{{")) {
-                  resolvedUrl = previewUrlPattern.replace(/{{(.*?)}}/g, (_, key) => String(docWithDefaults[key.trim()] || ""));
+                  resolvedUrl = previewUrlPattern.replace(
+                    /{{(.*?)}}/g,
+                    (_, key) => String(docWithDefaults[key.trim()] || "")
+                  );
                 } else if (previewUrlPattern.includes("+") || previewUrlPattern.includes("?") || previewUrlPattern.includes("==") || previewUrlPattern.includes("siteUrl")) {
                   try {
-                    resolvedUrl = import_jexl.default.evalSync(previewUrlPattern, docWithDefaults);
-                  } catch (err) {
-                    resolvedUrl = previewUrlPattern.replace(/:([a-zA-Z0-9_]+)/g, (_, key) => String(docWithDefaults[key] || ""));
+                    resolvedUrl = import_jexl.default.evalSync(
+                      previewUrlPattern,
+                      docWithDefaults
+                    );
+                  } catch (_err) {
+                    resolvedUrl = previewUrlPattern.replace(
+                      /:([a-zA-Z0-9_]+)/g,
+                      (_, key) => String(docWithDefaults[key] || "")
+                    );
                   }
                 } else {
-                  resolvedUrl = previewUrlPattern.replace(/:([a-zA-Z0-9_]+)/g, (_, key) => String(docWithDefaults[key] || ""));
+                  resolvedUrl = previewUrlPattern.replace(
+                    /:([a-zA-Z0-9_]+)/g,
+                    (_, key) => String(docWithDefaults[key] || "")
+                  );
                 }
               }
             }
@@ -301,7 +346,9 @@ var PopulationService = class {
       if (field.type === "blocks" && field.blocks && Array.isArray(value)) {
         populatedDoc[field.name] = await Promise.all(
           value.map(async (blockData) => {
-            const blockConfig = field.blocks.find((b) => b.slug === blockData.blockType);
+            const blockConfig = field.blocks.find(
+              (b) => b.slug === blockData.blockType
+            );
             if (!blockConfig) return blockData;
             return this.populate({
               data: blockData,
@@ -333,13 +380,494 @@ var PopulationService = class {
   }
 };
 
+// src/observability.ts
+var import_api = require("@opentelemetry/api");
+var import_exporter_metrics_otlp_http = require("@opentelemetry/exporter-metrics-otlp-http");
+var import_exporter_prometheus = require("@opentelemetry/exporter-prometheus");
+var import_exporter_trace_otlp_http = require("@opentelemetry/exporter-trace-otlp-http");
+var import_resources = require("@opentelemetry/resources");
+var import_sdk_metrics = require("@opentelemetry/sdk-metrics");
+var import_sdk_trace_base = require("@opentelemetry/sdk-trace-base");
+var import_pino = __toESM(require("pino"), 1);
+var import_pino_pretty = __toESM(require("pino-pretty"), 1);
+var import_node_stream = require("stream");
+var DEFAULT_REDACT_HEADERS = ["authorization", "cookie", "set-cookie", "x-api-key"];
+var DEFAULT_REDACT_PATHS = [
+  "password",
+  "currentPassword",
+  "newPassword",
+  "confirmPassword",
+  "token",
+  "refreshToken",
+  "accessToken",
+  "secret",
+  "apiKey",
+  "inviteToken",
+  "resetToken"
+];
+var DEFAULT_MAX_BODY_BYTES = 8192;
+var DEFAULT_SUCCESS_SAMPLE_RATE = 0.1;
+var DEFAULT_BODY_SAMPLE_RATE = 0.02;
+var REDACTED_VALUE = "[REDACTED]";
+var runtimeByConfig = /* @__PURE__ */ new WeakMap();
+var fallbackLogger = (0, import_pino.default)({
+  name: "dyrected",
+  enabled: process.env.DISABLE_LOGGING !== "true",
+  timestamp: import_pino.stdTimeFunctions.isoTime
+});
+function resolveObservabilityConfig(config) {
+  const requestLogging = config?.requestLogging;
+  const sampling = config?.sampling;
+  const tracing = config?.tracing;
+  const metrics = config?.metrics;
+  return {
+    requestLogging: {
+      enabled: requestLogging?.enabled ?? true,
+      logBodies: requestLogging?.logBodies ?? false,
+      maxBodyBytes: requestLogging?.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES,
+      redactPaths: uniqueValues([
+        ...DEFAULT_REDACT_PATHS,
+        ...requestLogging?.redactPaths ?? []
+      ]),
+      includeHeaders: normalizeHeaderNames(requestLogging?.includeHeaders ?? []),
+      redactHeaders: uniqueValues(
+        normalizeHeaderNames([
+          ...DEFAULT_REDACT_HEADERS,
+          ...requestLogging?.redactHeaders ?? []
+        ])
+      )
+    },
+    sampling: {
+      successRate: clampRate(sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE),
+      traceSuccessRate: clampRate(
+        sampling?.traceSuccessRate ?? sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE
+      ),
+      bodySuccessRate: clampRate(
+        sampling?.bodySuccessRate ?? Math.min(DEFAULT_BODY_SAMPLE_RATE, sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE)
+      ),
+      alwaysKeep4xx: sampling?.alwaysKeep4xx ?? true,
+      alwaysKeep5xx: sampling?.alwaysKeep5xx ?? true
+    },
+    tracing: {
+      enabled: tracing?.enabled ?? false,
+      serviceName: tracing?.serviceName ?? "dyrected",
+      exporter: tracing?.exporter ?? "none",
+      headers: tracing?.headers ?? {},
+      endpoint: tracing?.endpoint
+    },
+    metrics: {
+      enabled: metrics?.enabled ?? false,
+      exporter: metrics?.exporter ?? "none",
+      endpoint: metrics?.endpoint,
+      path: metrics?.path ?? "/metrics"
+    },
+    transports: {
+      targets: config?.transports?.targets && config.transports.targets.length > 0 ? config.transports.targets : [{ type: "stdout" }]
+    }
+  };
+}
+function createObservabilityRuntime(config) {
+  const resolved = resolveObservabilityConfig(config.observability);
+  const logger = createRootLogger(config.logger, resolved);
+  const shutdownTasks = [];
+  const meterRuntime = resolved.metrics.enabled || resolved.metrics.exporter === "prometheus" ? createMeterProvider(resolved) : void 0;
+  const tracerProvider = resolved.tracing.enabled ? createTracerProvider(resolved) : void 0;
+  const tracer = tracerProvider?.getTracer("dyrected");
+  const meter = meterRuntime?.provider.getMeter("dyrected");
+  const metrics = meter ? {
+    requestCount: meter.createCounter("dyrected_http_requests_total", {
+      description: "Total HTTP requests served by Dyrected"
+    }),
+    authFailureCount: meter.createCounter("dyrected_auth_failures_total", {
+      description: "Authentication failures"
+    }),
+    uncaughtErrorCount: meter.createCounter("dyrected_uncaught_errors_total", {
+      description: "Uncaught application errors"
+    }),
+    auditWriteFailureCount: meter.createCounter("dyrected_audit_write_failures_total", {
+      description: "Audit log persistence failures"
+    }),
+    emailSendFailureCount: meter.createCounter("dyrected_email_send_failures_total", {
+      description: "Transactional email delivery failures"
+    }),
+    workflowHookFailureCount: meter.createCounter("dyrected_workflow_hook_failures_total", {
+      description: "Workflow hook failures isolated after successful writes"
+    }),
+    requestDuration: meter.createHistogram("dyrected_http_request_duration_ms", {
+      description: "HTTP request duration in milliseconds",
+      unit: "ms"
+    })
+  } : void 0;
+  if (meterRuntime) {
+    shutdownTasks.push(() => meterRuntime.provider.shutdown());
+  }
+  if (tracerProvider) {
+    shutdownTasks.push(() => tracerProvider.shutdown());
+  }
+  return {
+    logger,
+    config: resolved,
+    tracer,
+    metrics,
+    prometheusExporter: meterRuntime?.prometheusExporter,
+    shutdown: async () => {
+      for (const task of shutdownTasks) {
+        await task();
+      }
+    },
+    recordAuthFailure: (attributes) => metrics?.authFailureCount.add(1, attributes),
+    recordUncaughtError: (attributes) => metrics?.uncaughtErrorCount.add(1, attributes),
+    recordAuditWriteFailure: (attributes) => metrics?.auditWriteFailureCount.add(1, attributes),
+    recordEmailSendFailure: (attributes) => metrics?.emailSendFailureCount.add(1, attributes),
+    recordWorkflowHookFailure: (attributes) => metrics?.workflowHookFailureCount.add(1, attributes)
+  };
+}
+function bindObservabilityRuntime(config, runtime) {
+  runtimeByConfig.set(config, runtime);
+}
+function getObservabilityRuntime(config) {
+  if (!config || typeof config !== "object") return void 0;
+  return runtimeByConfig.get(config);
+}
+function createRootLogger(loggerConfig, observability) {
+  if (loggerConfig && !("options" in loggerConfig)) {
+    return loggerConfig;
+  }
+  const options = loggerConfig?.options ?? {};
+  const enabled = options.enabled ?? process.env.DISABLE_LOGGING !== "true";
+  const name = options.name ?? "dyrected";
+  if (loggerConfig?.destination) {
+    return (0, import_pino.default)(
+      {
+        ...options,
+        enabled,
+        name,
+        timestamp: options.timestamp ?? import_pino.stdTimeFunctions.isoTime
+      },
+      loggerConfig.destination
+    );
+  }
+  const streams = buildTransportStreams(observability);
+  const destination = streams.length === 1 ? streams[0] : (0, import_pino.multistream)(streams.map((stream) => ({ stream })));
+  return (0, import_pino.default)(
+    {
+      ...options,
+      enabled,
+      name,
+      timestamp: options.timestamp ?? import_pino.stdTimeFunctions.isoTime
+    },
+    destination
+  );
+}
+function buildTransportStreams(observability) {
+  const targets = observability.transports.targets;
+  if (targets.length === 0) {
+    return [defaultLoggerDestination()];
+  }
+  return targets.map((target) => {
+    switch (target.type) {
+      case "stdout":
+        return defaultLoggerDestination();
+      case "stderr":
+        return (0, import_pino.destination)(2);
+      case "file":
+        return (0, import_pino.destination)(target.path);
+      case "otlp":
+        return new OtlpLogWritable(target.endpoint, target.headers);
+    }
+  });
+}
+function defaultLoggerDestination() {
+  if (process.env.NODE_ENV !== "production") {
+    return (0, import_pino_pretty.default)({
+      colorize: true,
+      ignore: "pid,hostname",
+      translateTime: "SYS:HH:MM:ss",
+      destination: 1,
+      sync: true
+    });
+  }
+  return (0, import_pino.destination)(1);
+}
+var OtlpLogWritable = class extends import_node_stream.Writable {
+  constructor(endpoint, headers = {}) {
+    super();
+    this.endpoint = endpoint;
+    this.headers = headers;
+  }
+  endpoint;
+  headers;
+  _write(chunk, _encoding, callback) {
+    const payload = chunk.toString();
+    void fetch(this.endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        ...this.headers
+      },
+      body: JSON.stringify({ logs: payload.trim().split("\n").filter(Boolean) })
+    }).then(() => callback()).catch(
+      (error) => callback(error instanceof Error ? error : new Error(String(error)))
+    );
+  }
+};
+function createTracerProvider(observability) {
+  const exporter = createTraceExporter(observability);
+  const provider = new import_sdk_trace_base.BasicTracerProvider({
+    resource: (0, import_resources.resourceFromAttributes)({
+      "service.name": observability.tracing.serviceName
+    }),
+    spanProcessors: exporter ? [new import_sdk_trace_base.BatchSpanProcessor(exporter)] : []
+  });
+  import_api.trace.setGlobalTracerProvider(provider);
+  return provider;
+}
+function createTraceExporter(observability) {
+  switch (observability.tracing.exporter) {
+    case "console":
+      return new import_sdk_trace_base.ConsoleSpanExporter();
+    case "otlp":
+      return new import_exporter_trace_otlp_http.OTLPTraceExporter({
+        url: observability.tracing.endpoint,
+        headers: observability.tracing.headers
+      });
+    default:
+      return void 0;
+  }
+}
+function createMeterProvider(observability) {
+  const readers = [];
+  let prometheusExporter;
+  switch (observability.metrics.exporter) {
+    case "otlp":
+      readers.push(
+        new import_sdk_metrics.PeriodicExportingMetricReader({
+          exporter: new import_exporter_metrics_otlp_http.OTLPMetricExporter({
+            url: observability.metrics.endpoint
+          })
+        })
+      );
+      break;
+    case "prometheus":
+      prometheusExporter = new import_exporter_prometheus.PrometheusExporter({
+        endpoint: observability.metrics.path,
+        preventServerStart: true
+      });
+      readers.push(prometheusExporter);
+      break;
+  }
+  const provider = new import_sdk_metrics.MeterProvider({
+    resource: (0, import_resources.resourceFromAttributes)({
+      "service.name": observability.tracing.serviceName
+    }),
+    readers
+  });
+  return { provider, prometheusExporter };
+}
+function getConfigLogger(config, component) {
+  const base = config?.logger && !("options" in config.logger) ? config.logger : fallbackLogger;
+  return base.child({ component });
+}
+function getRequestLogger(c, component) {
+  const base = c.get("logger") ?? fallbackLogger;
+  return component ? base.child({ component }) : base;
+}
+function buildRequestLogger(runtime, vars, requestId2) {
+  const trace2 = vars.requestTrace;
+  return runtime.logger.child({
+    requestId: requestId2,
+    siteId: vars.siteId,
+    workspaceId: vars.workspaceId,
+    traceId: trace2?.traceId,
+    spanId: trace2?.spanId
+  });
+}
+function shouldSampleRequest(requestId2, statusCode, sampling, kind) {
+  if (statusCode >= 500 && sampling.alwaysKeep5xx) return true;
+  if (statusCode >= 400 && sampling.alwaysKeep4xx) return true;
+  const rate = kind === "trace" ? sampling.traceSuccessRate : kind === "body" ? sampling.bodySuccessRate : sampling.successRate;
+  return deterministicSample(requestId2 ?? "no-request-id", rate);
+}
+function redactHeaders(headers, observability) {
+  const includeHeaders = new Set(observability.requestLogging.includeHeaders);
+  const redactHeaders2 = new Set(observability.requestLogging.redactHeaders);
+  const output = {};
+  for (const [key, value] of Object.entries(headers)) {
+    const normalizedKey = key.toLowerCase();
+    if (includeHeaders.size > 0 && !includeHeaders.has(normalizedKey)) continue;
+    output[normalizedKey] = redactHeaders2.has(normalizedKey) ? REDACTED_VALUE : value;
+  }
+  return output;
+}
+async function captureRequestBody(request, observability) {
+  const contentType = request.headers.get("content-type") ?? void 0;
+  const contentLength = toNumber(request.headers.get("content-length"));
+  const jsonBody = contentType?.includes("application/json");
+  if (!jsonBody) {
+    return {
+      attempted: false,
+      contentType,
+      contentLength
+    };
+  }
+  try {
+    const text = await request.clone().text();
+    if (!text) {
+      return { attempted: true, contentType, contentLength };
+    }
+    const truncated = text.length > observability.requestLogging.maxBodyBytes;
+    const raw = truncated ? text.slice(0, observability.requestLogging.maxBodyBytes) : text;
+    try {
+      const parsed = JSON.parse(raw);
+      return {
+        attempted: true,
+        contentType,
+        contentLength: contentLength ?? text.length,
+        truncated,
+        body: redactBody(parsed, observability.requestLogging.redactPaths)
+      };
+    } catch {
+      return {
+        attempted: true,
+        contentType,
+        contentLength: contentLength ?? text.length,
+        truncated,
+        parseFailed: true
+      };
+    }
+  } catch {
+    return {
+      attempted: true,
+      contentType,
+      contentLength,
+      parseFailed: true
+    };
+  }
+}
+function redactBody(value, redactPaths) {
+  const cloned = deepClone(value);
+  for (const path of redactPaths) {
+    applyRedaction(cloned, path.split("."));
+  }
+  return cloned;
+}
+function applyRedaction(target, segments) {
+  if (!target || segments.length === 0) return;
+  const [segment, ...rest] = segments;
+  if (Array.isArray(target)) {
+    for (const item of target) {
+      if (segment === "*") {
+        applyRedaction(item, rest);
+      } else {
+        applyRedaction(item, segments);
+      }
+    }
+    return;
+  }
+  if (typeof target !== "object") return;
+  const record = target;
+  if (segment === "*") {
+    for (const value of Object.values(record)) {
+      applyRedaction(value, rest);
+    }
+    return;
+  }
+  if (!(segment in record)) return;
+  if (rest.length === 0) {
+    record[segment] = REDACTED_VALUE;
+    return;
+  }
+  applyRedaction(record[segment], rest);
+}
+function deepClone(value) {
+  if (typeof structuredClone === "function") {
+    return structuredClone(value);
+  }
+  return JSON.parse(JSON.stringify(value));
+}
+function createRequestSpan(runtime, name, attributes) {
+  if (!runtime.tracer) return void 0;
+  const span = runtime.tracer.startSpan(name, { attributes }, import_api.context.active());
+  const spanContext = span.spanContext();
+  return {
+    span,
+    traceId: spanContext.traceId,
+    spanId: spanContext.spanId,
+    sampled: spanContext.traceFlags === import_api.TraceFlags.SAMPLED
+  };
+}
+function endRequestSpan(requestTrace, statusCode, error) {
+  if (!requestTrace) return;
+  requestTrace.span.setAttribute("http.status_code", statusCode);
+  if (error) {
+    requestTrace.span.recordException(error instanceof Error ? error : new Error(String(error)));
+  }
+  requestTrace.span.end();
+}
+function attachRequestMetrics(runtime, args) {
+  runtime.metrics?.requestCount.add(1, {
+    method: args.method,
+    route: args.route,
+    status_class: `${Math.floor(args.statusCode / 100)}xx`
+  });
+  runtime.metrics?.requestDuration.record(args.durationMs, {
+    method: args.method,
+    route: args.route,
+    status_class: `${Math.floor(args.statusCode / 100)}xx`
+  });
+}
+async function renderPrometheusMetrics(exporter) {
+  let statusCode = 200;
+  const headers = {};
+  let body = "";
+  await new Promise((resolve) => {
+    const response = {
+      statusCode,
+      setHeader(name, value) {
+        headers[name.toLowerCase()] = value;
+      },
+      end(chunk) {
+        if (chunk) body += chunk;
+        statusCode = this.statusCode;
+        resolve();
+      }
+    };
+    exporter.getMetricsRequestHandler({}, response);
+  });
+  return { body, headers, statusCode };
+}
+function normalizeHeaderNames(headers) {
+  return headers.map((value) => value.toLowerCase());
+}
+function uniqueValues(values) {
+  return [...new Set(values)];
+}
+function clampRate(value) {
+  if (Number.isNaN(value)) return 0;
+  return Math.max(0, Math.min(1, value));
+}
+function deterministicSample(seed, rate) {
+  if (rate >= 1) return true;
+  if (rate <= 0) return false;
+  let hash = 0;
+  for (let index = 0; index < seed.length; index += 1) {
+    hash = hash * 31 + seed.charCodeAt(index) >>> 0;
+  }
+  return hash / 4294967295 <= rate;
+}
+function toNumber(value) {
+  if (!value) return void 0;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : void 0;
+}
+
 // src/services/audit.service.ts
 var AuditService = class {
   /**
    * Writes a single entry to the __audit collection.
    * Called without await — runs asynchronously and never blocks the primary operation.
    */
-  static async log(db, args) {
+  static async log(db, args, config) {
     try {
       await db.create({
         collection: "__audit",
@@ -356,7 +884,17 @@ var AuditService = class {
         }
       });
     } catch (err) {
-      console.error("[dyrected/audit] Failed to write audit log:", err);
+      getObservabilityRuntime(config)?.recordAuditWriteFailure({
+        collection: args.collection,
+        operation: args.operation
+      });
+      getConfigLogger(config, "audit").error({
+        err,
+        msg: "Failed to write audit log",
+        collection: args.collection,
+        operation: args.operation,
+        documentId: args.documentId
+      });
     }
   }
 };
@@ -381,6 +919,151 @@ async function verifyPassword(plain, stored) {
   return (0, import_node_crypto.timingSafeEqual)(derivedKey, storedBuffer);
 }
 
+// src/auth/token.ts
+var import_jose = require("jose");
+var import_node_util2 = require("util");
+function getSecret() {
+  const secret = process.env.DYRECTED_JWT_SECRET;
+  if (!secret) {
+    throw new Error(
+      "[dyrected/core] DYRECTED_JWT_SECRET is not set. Add it to your environment variables to enable auth collections."
+    );
+  }
+  return new import_node_util2.TextEncoder().encode(secret);
+}
+var DEFAULT_EXPIRY = "7d";
+async function signCollectionToken(payload, expiresIn = DEFAULT_EXPIRY) {
+  return new import_jose.SignJWT({ ...payload }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(expiresIn).sign(getSecret());
+}
+async function verifyCollectionToken(token) {
+  const { payload } = await (0, import_jose.jwtVerify)(token, getSecret());
+  return payload;
+}
+function decodeCollectionToken(token) {
+  try {
+    return (0, import_jose.decodeJwt)(token);
+  } catch {
+    return null;
+  }
+}
+
+// src/auth/sessions.ts
+var AUTH_SESSIONS_COLLECTION = "__auth_sessions";
+async function issueAuthSessionToken(args) {
+  const sessionId = createSessionId();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const db = args.config.db;
+  if (db) {
+    await db.create({
+      collection: AUTH_SESSIONS_COLLECTION,
+      data: {
+        id: sessionId,
+        userId: args.userId,
+        email: args.email,
+        collection: args.collection,
+        authSource: args.authSource ?? "local",
+        providerId: args.providerId,
+        lastIp: args.ip,
+        lastSeenAt: now,
+        revokedAt: null,
+        expiresAt: null
+      }
+    });
+  }
+  const token = await signCollectionToken(
+    {
+      sub: args.userId,
+      email: args.email,
+      collection: args.collection,
+      authSource: args.authSource,
+      providerId: args.providerId,
+      sid: sessionId
+    },
+    args.expiresIn
+  );
+  const payload = decodeCollectionToken(token);
+  const expiresAt = payload?.exp != null ? new Date(payload.exp * 1e3).toISOString() : null;
+  if (db && expiresAt) {
+    await db.update({
+      collection: AUTH_SESSIONS_COLLECTION,
+      id: sessionId,
+      data: {
+        expiresAt,
+        lastSeenAt: now,
+        lastIp: args.ip
+      }
+    });
+  }
+  return token;
+}
+async function getAuthSession(config, sessionId) {
+  const db = config.db;
+  if (!db) return null;
+  return await db.findOne({
+    collection: AUTH_SESSIONS_COLLECTION,
+    id: sessionId
+  });
+}
+function isAuthSessionActive(session) {
+  if (!session) return false;
+  if (session.revokedAt) return false;
+  if (session.expiresAt && new Date(session.expiresAt).getTime() <= Date.now()) {
+    return false;
+  }
+  return true;
+}
+async function touchAuthSession(config, sessionId, args) {
+  const db = config.db;
+  if (!db) return;
+  await db.update({
+    collection: AUTH_SESSIONS_COLLECTION,
+    id: sessionId,
+    data: {
+      lastSeenAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...args.ip ? { lastIp: args.ip } : {}
+    }
+  });
+}
+async function revokeAuthSession(config, sessionId) {
+  const db = config.db;
+  if (!db) return;
+  await db.update({
+    collection: AUTH_SESSIONS_COLLECTION,
+    id: sessionId,
+    data: {
+      revokedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  });
+}
+async function revokeAllAuthSessions(config, args) {
+  const db = config.db;
+  if (!db) return 0;
+  let page = 1;
+  let revoked = 0;
+  while (true) {
+    const result = await db.find({
+      collection: AUTH_SESSIONS_COLLECTION,
+      where: {
+        userId: { equals: args.userId },
+        collection: { equals: args.collection }
+      },
+      page,
+      limit: 100
+    });
+    for (const session of result.docs) {
+      if (session.revokedAt) continue;
+      await revokeAuthSession(config, session.id);
+      revoked += 1;
+    }
+    if (!result.hasNextPage) break;
+    page += 1;
+  }
+  return revoked;
+}
+function createSessionId() {
+  return globalThis.crypto?.randomUUID?.() ? globalThis.crypto.randomUUID() : `sess_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+}
+
 // src/utils/hooks.ts
 async function runCollectionHooks(hooks, args, options = {}) {
   if (!hooks || hooks.length === 0) {
@@ -399,7 +1082,10 @@ async function runCollectionHooks(hooks, args, options = {}) {
       }
     } catch (err) {
       if (options.isolated) {
-        console.error("[dyrected/core] Side-effect hook failed (error isolated \u2014 DB write was successful):", err);
+        getConfigLogger(void 0, "hooks").error({
+          err,
+          msg: "Side-effect hook failed after a successful write"
+        });
       } else {
         throw err;
       }
@@ -444,7 +1130,13 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
           const item = updatedValue[i];
           const origItem = Array.isArray(origValue) ? origValue[i] : null;
           arrayResult.push(
-            await executeFieldBeforeChange(field.fields, item, origItem, user, db)
+            await executeFieldBeforeChange(
+              field.fields,
+              item,
+              origItem,
+              user,
+              db
+            )
           );
         }
         result[field.name] = arrayResult;
@@ -604,7 +1296,11 @@ async function evaluateAccess(expression, context) {
     }
     return !!result;
   } catch (err) {
-    console.error("[dyrected/core] Jexl evaluation failed:", err);
+    getConfigLogger(context.config, "access").error({
+      err,
+      msg: "Jexl evaluation failed",
+      expression
+    });
     return false;
   }
 }
@@ -616,30 +1312,40 @@ function isNamedAccessPolicy(value) {
 async function resolveAccess(config, access, args) {
   if (access === void 0 || access === null) return void 0;
   if (typeof access === "boolean" || typeof access === "string") {
-    return evaluateAccess(access, args);
+    return evaluateAccess(access, { ...args, config });
   }
   if (typeof access === "function") {
     try {
       return await access(args);
     } catch (err) {
-      console.error("[dyrected/core] Functional access check failed:", err);
+      getConfigLogger(config, "access").error({
+        err,
+        msg: "Functional access check failed"
+      });
       return false;
     }
   }
   if (isNamedAccessPolicy(access)) {
     const policy = config.accessPolicies?.[access.policy];
     if (policy === void 0) {
-      console.error(`[dyrected/core] Unknown access policy "${access.policy}".`);
+      getConfigLogger(config, "access").error({
+        msg: "Unknown access policy",
+        policy: access.policy
+      });
       return false;
     }
     if (typeof policy === "string" || typeof policy === "boolean") {
-      return evaluateAccess(policy, args);
+      return evaluateAccess(policy, { ...args, config });
     }
     try {
       const resolver = policy;
       return await resolver({ ...args, params: access.params });
     } catch (err) {
-      console.error(`[dyrected/core] Access policy "${access.policy}" failed:`, err);
+      getConfigLogger(config, "access").error({
+        err,
+        msg: "Access policy failed",
+        policy: access.policy
+      });
       return false;
     }
   }
@@ -726,32 +1432,48 @@ async function applyFieldReadAccess(context, doc) {
   const result = { ...doc };
   for (const field of context.fields) {
     if (field.type === "row" && field.fields) {
-      Object.assign(result, await applyFieldReadAccess({ ...context, fields: field.fields }, result));
+      Object.assign(
+        result,
+        await applyFieldReadAccess(
+          { ...context, fields: field.fields },
+          result
+        )
+      );
       continue;
     }
     if (!field.name) continue;
     const value = result[field.name];
-    const canRead = await resolveBooleanAccess(context.config, field.access?.read, {
-      user: context.user,
-      req: context.req,
-      doc: context.doc,
-      data: context.data,
-      id: resolveFieldAccessId(context)
-    });
+    const canRead = await resolveBooleanAccess(
+      context.config,
+      field.access?.read,
+      {
+        user: context.user,
+        req: context.req,
+        doc: context.doc,
+        data: context.data,
+        id: resolveFieldAccessId(context)
+      }
+    );
     if (!canRead) {
       delete result[field.name];
       continue;
     }
     if (value === void 0 || value === null) continue;
     if (field.type === "object" && field.fields && typeof value === "object" && !Array.isArray(value)) {
-      result[field.name] = await applyFieldReadAccess({ ...context, fields: field.fields }, value);
+      result[field.name] = await applyFieldReadAccess(
+        { ...context, fields: field.fields },
+        value
+      );
       continue;
     }
     if (field.type === "array" && field.fields && Array.isArray(value)) {
       const childFields = field.fields;
       result[field.name] = await Promise.all(
         value.map(
-          (item) => typeof item === "object" && item !== null ? applyFieldReadAccess({ ...context, fields: childFields }, item) : item
+          (item) => typeof item === "object" && item !== null ? applyFieldReadAccess(
+            { ...context, fields: childFields },
+            item
+          ) : item
         )
       );
       continue;
@@ -761,9 +1483,14 @@ async function applyFieldReadAccess(context, doc) {
         value.map(async (item) => {
           if (typeof item !== "object" || item === null) return item;
           const typedItem = item;
-          const block = field.blocks?.find((candidate) => candidate.slug === typedItem.blockType);
+          const block = field.blocks?.find(
+            (candidate) => candidate.slug === typedItem.blockType
+          );
           if (!block || !block.fields) return item;
-          return applyFieldReadAccess({ ...context, fields: block.fields }, typedItem);
+          return applyFieldReadAccess(
+            { ...context, fields: block.fields },
+            typedItem
+          );
         })
       );
     }
@@ -775,7 +1502,13 @@ async function applyFieldWriteAccess(context, data) {
   const result = { ...data };
   for (const field of context.fields) {
     if (field.type === "row" && field.fields) {
-      Object.assign(result, await applyFieldWriteAccess({ ...context, fields: field.fields }, result));
+      Object.assign(
+        result,
+        await applyFieldWriteAccess(
+          { ...context, fields: field.fields },
+          result
+        )
+      );
       continue;
     }
     if (!field.name || !(field.name in result)) continue;
@@ -794,14 +1527,20 @@ async function applyFieldWriteAccess(context, data) {
     const value = result[field.name];
     if (value === void 0 || value === null) continue;
     if (field.type === "object" && field.fields && typeof value === "object" && !Array.isArray(value)) {
-      result[field.name] = await applyFieldWriteAccess({ ...context, fields: field.fields }, value);
+      result[field.name] = await applyFieldWriteAccess(
+        { ...context, fields: field.fields },
+        value
+      );
       continue;
     }
     if (field.type === "array" && field.fields && Array.isArray(value)) {
       const childFields = field.fields;
       result[field.name] = await Promise.all(
         value.map(
-          (item) => typeof item === "object" && item !== null ? applyFieldWriteAccess({ ...context, fields: childFields }, item) : item
+          (item) => typeof item === "object" && item !== null ? applyFieldWriteAccess(
+            { ...context, fields: childFields },
+            item
+          ) : item
         )
       );
       continue;
@@ -811,9 +1550,14 @@ async function applyFieldWriteAccess(context, data) {
         value.map(async (item) => {
           if (typeof item !== "object" || item === null) return item;
           const typedItem = item;
-          const block = field.blocks?.find((candidate) => candidate.slug === typedItem.blockType);
+          const block = field.blocks?.find(
+            (candidate) => candidate.slug === typedItem.blockType
+          );
           if (!block || !block.fields) return item;
-          return applyFieldWriteAccess({ ...context, fields: block.fields }, typedItem);
+          return applyFieldWriteAccess(
+            { ...context, fields: block.fields },
+            typedItem
+          );
         })
       );
     }
@@ -839,6 +1583,9 @@ function simplePublishingWorkflow() {
       { name: "publish", label: "Publish", from: "draft", to: "published" },
       { name: "unpublish", label: "Unpublish", from: "published", to: "draft", unpublish: true }
     ]
+    // Intentionally no `roles`: this lightweight workflow (synthesized from
+    // `drafts: true`) does no capability-based gating. Draft visibility for a
+    // no-roles workflow is handled in `canViewWorkflowDraft`.
   };
 }
 function publicMetadata(meta) {
@@ -857,9 +1604,13 @@ function canViewWorkflowDraft(workflow, user) {
   if (!user) return false;
   const capabilities = workflowCapabilities(workflow, user);
   if (capabilities.has("entry.edit")) return true;
-  return workflow.transitions.some(
+  if (workflow.transitions.some(
     (transition) => (transition.requiredCapabilities ?? []).some((capability) => capabilities.has(capability))
-  );
+  )) {
+    return true;
+  }
+  if (!workflow.roles || workflow.roles.length === 0) return true;
+  return false;
 }
 function availableWorkflowTransitions(workflow, state, user) {
   const capabilities = workflowCapabilities(workflow, user);
@@ -1069,7 +1820,17 @@ async function transitionWorkflow(args) {
     try {
       await hook({ ...hookContext, doc: updated, event: events[0] });
     } catch (error) {
-      console.error("[dyrected/workflow] afterTransition hook failed:", error);
+      getObservabilityRuntime(config)?.recordWorkflowHookFailure({
+        collection: collection.slug,
+        transition: transition.name
+      });
+      getConfigLogger(config, "workflow").error({
+        err: error,
+        msg: "afterTransition hook failed",
+        collection: collection.slug,
+        transition: transition.name,
+        documentId: id
+      });
     }
   }
   return updated;
@@ -1126,7 +1887,13 @@ var CollectionController = class {
         } catch {
         }
       }
-      const paginatedResult = await provider.members.list({ limit: limit2, page: page2, sort: sort2, where: where2, req: hookReq });
+      const paginatedResult = await provider.members.list({
+        limit: limit2,
+        page: page2,
+        sort: sort2,
+        where: where2,
+        req: hookReq
+      });
       const mappedDocs = [];
       for (const m of paginatedResult.docs) {
         let localId = m.id;
@@ -1174,12 +1941,15 @@ var CollectionController = class {
         }
       }
     }
-    const beforeReadResult = await runCollectionHooks(this.collection.hooks?.beforeRead, {
-      req: c.req,
-      query: where,
-      user,
-      db: readonlyDb
-    });
+    const beforeReadResult = await runCollectionHooks(
+      this.collection.hooks?.beforeRead,
+      {
+        req: c.req,
+        query: where,
+        user,
+        db: readonlyDb
+      }
+    );
     if (beforeReadResult !== void 0) {
       where = beforeReadResult;
     }
@@ -1188,7 +1958,13 @@ var CollectionController = class {
     }
     const access = await this.evaluateAccess(c, "read");
     if (!access.allowed) {
-      return c.json({ error: true, message: `Access denied: read on ${this.collection.slug}` }, 403);
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: read on ${this.collection.slug}`
+        },
+        403
+      );
     }
     if (access.constraint) {
       where = mergeWhereConstraint(where, access.constraint);
@@ -1202,7 +1978,10 @@ var CollectionController = class {
       fields: this.collection.fields
     });
     if (result.total === 0 && this.collection.initialData && !where && page === 1) {
-      console.log(`[dyrected/core] Auto-seeding collection "${this.collection.slug}" from config.initialData`);
+      getRequestLogger(c, "collection").info({
+        msg: "Auto-seeding collection from config.initialData",
+        collection: this.collection.slug
+      });
       for (const data of this.collection.initialData) {
         await db.create({ collection: this.collection.slug, data });
       }
@@ -1215,31 +1994,54 @@ var CollectionController = class {
         fields: this.collection.fields
       });
     }
-    result.docs = result.docs.map((doc) => this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc).filter((doc) => doc !== null);
+    result.docs = result.docs.map(
+      (doc) => this.collection.workflow ? materializeWorkflowDocument(
+        doc,
+        this.collection.workflow,
+        user
+      ) : doc
+    ).filter((doc) => doc !== null);
     const processedDocs = [];
-    const readonlyDbForHooks = createReadonlyDb(db);
     for (const doc of result.docs) {
-      const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
-      const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
-        doc: docWithDefaults,
-        req: c.req,
+      const docWithDefaults = DefaultsService.apply(
+        this.collection.fields,
+        doc
+      );
+      const docWithCollectionHooks = await runCollectionHooks(
+        this.collection.hooks?.afterRead,
+        {
+          doc: docWithDefaults,
+          req: c.req,
+          user,
+          db: readonlyDb
+        }
+      );
+      const docWithFieldHooks = await executeFieldAfterRead(
+        this.collection.fields,
+        docWithCollectionHooks,
         user,
-        db: readonlyDb
-      });
-      const docWithFieldHooks = await executeFieldAfterRead(this.collection.fields, docWithCollectionHooks, user, readonlyDb);
-      const docWithFieldAccess = await applyFieldReadAccess({
-        config,
-        fields: this.collection.fields,
-        user,
-        req: this.toHookRequestContext(c),
-        doc: docWithFieldHooks
-      }, docWithFieldHooks);
+        readonlyDb
+      );
+      const docWithFieldAccess = await applyFieldReadAccess(
+        {
+          config,
+          fields: this.collection.fields,
+          user,
+          req: this.toHookRequestContext(c),
+          doc: docWithFieldHooks
+        },
+        docWithFieldHooks
+      );
       processedDocs.push(docWithFieldAccess);
     }
     result.docs = processedDocs;
     if (depth > 0) {
       const populationService = new PopulationService(db, config.collections);
-      result = await populationService.populateResult(result, this.collection.fields, depth);
+      result = await populationService.populateResult(
+        result,
+        this.collection.fields,
+        depth
+      );
     }
     return c.json(result);
   }
@@ -1252,7 +2054,10 @@ var CollectionController = class {
       const hookReq = this.toHookRequestContext(c);
       const id2 = c.req.param("id");
       if (!id2) return c.json({ message: "Missing ID" }, 400);
-      const localDoc = await db.findOne({ collection: this.collection.slug, id: id2 });
+      const localDoc = await db.findOne({
+        collection: this.collection.slug,
+        id: id2
+      });
       const externalSubject = localDoc?.externalSubject || id2;
       let member = null;
       if (provider.members.get) {
@@ -1281,23 +2086,40 @@ var CollectionController = class {
     }
     const access = await this.evaluateAccess(c, "read", { id, doc });
     if (!access.allowed) {
-      return c.json({ error: true, message: `Access denied: read on ${this.collection.slug}` }, 403);
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: read on ${this.collection.slug}`
+        },
+        403
+      );
     }
     const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
-    const docWithCollectionHooks = await runCollectionHooks(this.collection.hooks?.afterRead, {
-      doc: docWithDefaults,
-      req: c.req,
-      user,
-      db: readonlyDb
-    });
-    const docWithFieldHooks = await executeFieldAfterRead(this.collection.fields, docWithCollectionHooks, user, readonlyDb);
-    const docWithFieldAccess = await applyFieldReadAccess({
-      config,
-      fields: this.collection.fields,
+    const docWithCollectionHooks = await runCollectionHooks(
+      this.collection.hooks?.afterRead,
+      {
+        doc: docWithDefaults,
+        req: c.req,
+        user,
+        db: readonlyDb
+      }
+    );
+    const docWithFieldHooks = await executeFieldAfterRead(
+      this.collection.fields,
+      docWithCollectionHooks,
       user,
-      req: this.toHookRequestContext(c),
-      doc: docWithFieldHooks
-    }, docWithFieldHooks);
+      readonlyDb
+    );
+    const docWithFieldAccess = await applyFieldReadAccess(
+      {
+        config,
+        fields: this.collection.fields,
+        user,
+        req: this.toHookRequestContext(c),
+        doc: docWithFieldHooks
+      },
+      docWithFieldHooks
+    );
     if (depth > 0 && docWithFieldAccess) {
       const populationService = new PopulationService(db, config.collections);
       const populatedDoc = await populationService.populate({
@@ -1322,12 +2144,18 @@ var CollectionController = class {
         return this.upload(c);
       }
       const body2 = await c.req.json();
-      const member = await provider.members.create({ data: body2, req: hookReq });
-      return c.json({
-        ...member,
-        id: member.id,
-        externalSubject: member.id
-      }, 201);
+      const member = await provider.members.create({
+        data: body2,
+        req: hookReq
+      });
+      return c.json(
+        {
+          ...member,
+          id: member.id,
+          externalSubject: member.id
+        },
+        201
+      );
     }
     const readonlyDb = createReadonlyDb(db);
     const contentType = c.req.header("Content-Type") || "";
@@ -1349,20 +2177,35 @@ var CollectionController = class {
     }
     const createAccess = await this.evaluateAccess(c, "create", { data });
     if (!createAccess.allowed) {
-      return c.json({ error: true, message: `Access denied: create on ${this.collection.slug}` }, 403);
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: create on ${this.collection.slug}`
+        },
+        403
+      );
     }
     if (this.collection.auth && data.password) {
       data.password = await hashPassword(data.password);
     }
-    data = await applyFieldWriteAccess({
-      config,
-      fields: this.collection.fields,
-      user,
-      req: this.toHookRequestContext(c),
+    data = await applyFieldWriteAccess(
+      {
+        config,
+        fields: this.collection.fields,
+        user,
+        req: this.toHookRequestContext(c),
+        data,
+        operation: "create"
+      },
+      data
+    );
+    data = await executeFieldBeforeChange(
+      this.collection.fields,
       data,
-      operation: "create"
-    }, data);
-    data = await executeFieldBeforeChange(this.collection.fields, data, null, user, readonlyDb);
+      null,
+      user,
+      readonlyDb
+    );
     data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
       data,
       req: c.req,
@@ -1370,7 +2213,12 @@ var CollectionController = class {
       operation: "create",
       db: readonlyDb
     });
-    const doc = this.collection.workflow ? (await createWorkflowDocument({ config, collection: this.collection, data, user })).doc : await db.create({ collection: this.collection.slug, data });
+    const doc = this.collection.workflow ? (await createWorkflowDocument({
+      config,
+      collection: this.collection,
+      data,
+      user
+    })).doc : await db.create({ collection: this.collection.slug, data });
     if (this.collection.audit && db) {
       AuditService.log(db, {
         operation: "create",
@@ -1379,15 +2227,19 @@ var CollectionController = class {
         user: user ? { id: user.sub, collection: user.collection, email: user.email } : void 0,
         before: null,
         after: doc
-      });
+      }, config);
     }
-    await runCollectionHooks(this.collection.hooks?.afterChange, {
-      doc,
-      user,
-      req: c.req,
-      operation: "create",
-      db
-    }, { isolated: true });
+    await runCollectionHooks(
+      this.collection.hooks?.afterChange,
+      {
+        doc,
+        user,
+        req: c.req,
+        operation: "create",
+        db
+      },
+      { isolated: true }
+    );
     const responseDoc = this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc;
     const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
       doc: responseDoc,
@@ -1395,14 +2247,22 @@ var CollectionController = class {
       user,
       db: readonlyDb
     });
-    const finalDoc = await executeFieldAfterRead(this.collection.fields, readDoc, user, readonlyDb);
-    const accessibleDoc = await applyFieldReadAccess({
-      config,
-      fields: this.collection.fields,
+    const finalDoc = await executeFieldAfterRead(
+      this.collection.fields,
+      readDoc,
       user,
-      req: this.toHookRequestContext(c),
-      doc: finalDoc
-    }, finalDoc);
+      readonlyDb
+    );
+    const accessibleDoc = await applyFieldReadAccess(
+      {
+        config,
+        fields: this.collection.fields,
+        user,
+        req: this.toHookRequestContext(c),
+        doc: finalDoc
+      },
+      finalDoc
+    );
     return c.json(accessibleDoc, 201);
   }
   async upload(c) {
@@ -1418,7 +2278,10 @@ var CollectionController = class {
     const uploadConfig = typeof this.collection.upload === "object" ? this.collection.upload : void 0;
     const validationError = validateUpload(file, uploadConfig);
     if (validationError) {
-      return c.json({ message: validationError.message }, validationError.status);
+      return c.json(
+        { message: validationError.message },
+        validationError.status
+      );
     }
     const buffer = new Uint8Array(await file.arrayBuffer());
     const siteId = c.get("siteId");
@@ -1448,17 +2311,32 @@ var CollectionController = class {
     };
     const createAccess = await this.evaluateAccess(c, "create", { data });
     if (!createAccess.allowed) {
-      return c.json({ error: true, message: `Access denied: create on ${this.collection.slug}` }, 403);
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: create on ${this.collection.slug}`
+        },
+        403
+      );
     }
-    data = await applyFieldWriteAccess({
-      config,
-      fields: this.collection.fields,
-      user,
-      req: this.toHookRequestContext(c),
+    data = await applyFieldWriteAccess(
+      {
+        config,
+        fields: this.collection.fields,
+        user,
+        req: this.toHookRequestContext(c),
+        data,
+        operation: "create"
+      },
+      data
+    );
+    data = await executeFieldBeforeChange(
+      this.collection.fields,
       data,
-      operation: "create"
-    }, data);
-    data = await executeFieldBeforeChange(this.collection.fields, data, null, user, readonlyDb);
+      null,
+      user,
+      readonlyDb
+    );
     data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
       data,
       req: c.req,
@@ -1470,13 +2348,17 @@ var CollectionController = class {
       collection: this.collection.slug,
       data
     });
-    await runCollectionHooks(this.collection.hooks?.afterChange, {
-      doc,
-      user,
-      req: c.req,
-      operation: "create",
-      db
-    }, { isolated: true });
+    await runCollectionHooks(
+      this.collection.hooks?.afterChange,
+      {
+        doc,
+        user,
+        req: c.req,
+        operation: "create",
+        db
+      },
+      { isolated: true }
+    );
     const responseDoc = this.collection.workflow ? materializeWorkflowDocument(doc, this.collection.workflow, user) : doc;
     const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
       doc: responseDoc,
@@ -1484,14 +2366,22 @@ var CollectionController = class {
       user,
       db: readonlyDb
     });
-    const finalDoc = await executeFieldAfterRead(this.collection.fields, readDoc, user, readonlyDb);
-    const accessibleDoc = await applyFieldReadAccess({
-      config,
-      fields: this.collection.fields,
+    const finalDoc = await executeFieldAfterRead(
+      this.collection.fields,
+      readDoc,
       user,
-      req: this.toHookRequestContext(c),
-      doc: finalDoc
-    }, finalDoc);
+      readonlyDb
+    );
+    const accessibleDoc = await applyFieldReadAccess(
+      {
+        config,
+        fields: this.collection.fields,
+        user,
+        req: this.toHookRequestContext(c),
+        doc: finalDoc
+      },
+      finalDoc
+    );
     return c.json(accessibleDoc, 201);
   }
   async update(c) {
@@ -1504,9 +2394,16 @@ var CollectionController = class {
       const id2 = c.req.param("id");
       if (!id2) return c.json({ message: "Missing ID" }, 400);
       const body2 = await c.req.json();
-      const localDoc = await db.findOne({ collection: this.collection.slug, id: id2 });
+      const localDoc = await db.findOne({
+        collection: this.collection.slug,
+        id: id2
+      });
       const externalSubject = localDoc?.externalSubject || id2;
-      const member = await provider.members.update({ externalSubject, data: body2, req: hookReq });
+      const member = await provider.members.update({
+        externalSubject,
+        data: body2,
+        req: hookReq
+      });
       return c.json({
         ...member,
         id: localDoc ? localDoc.id : member.id,
@@ -1528,25 +2425,47 @@ var CollectionController = class {
       updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
       updatedBy: user?.sub ?? null
     });
-    const originalDoc = await db.findOne({ collection: this.collection.slug, id });
+    const originalDoc = await db.findOne({
+      collection: this.collection.slug,
+      id
+    });
     if (!originalDoc) return c.json({ message: "Not Found" }, 404);
-    const updateAccess = await this.evaluateAccess(c, "update", { id, doc: originalDoc, data });
+    const updateAccess = await this.evaluateAccess(c, "update", {
+      id,
+      doc: originalDoc,
+      data
+    });
     if (!updateAccess.allowed) {
-      return c.json({ error: true, message: `Access denied: update on ${this.collection.slug}` }, 403);
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: update on ${this.collection.slug}`
+        },
+        403
+      );
     }
     let before = null;
     if (this.collection.audit) {
       before = originalDoc;
     }
-    data = await applyFieldWriteAccess({
-      config,
-      fields: this.collection.fields,
-      user,
-      req: this.toHookRequestContext(c),
-      doc: originalDoc,
+    data = await applyFieldWriteAccess(
+      {
+        config,
+        fields: this.collection.fields,
+        user,
+        req: this.toHookRequestContext(c),
+        doc: originalDoc,
+        data
+      },
       data
-    }, data);
-    data = await executeFieldBeforeChange(this.collection.fields, data, originalDoc, user, readonlyDb);
+    );
+    data = await executeFieldBeforeChange(
+      this.collection.fields,
+      data,
+      originalDoc,
+      user,
+      readonlyDb
+    );
     data = await runCollectionHooks(this.collection.hooks?.beforeChange, {
       data,
       doc: originalDoc,
@@ -1555,7 +2474,14 @@ var CollectionController = class {
       operation: "update",
       db: readonlyDb
     });
-    const doc = this.collection.workflow ? (await saveWorkflowDraft({ config, collection: this.collection, id, originalDoc, data, user })).doc : await db.update({ collection: this.collection.slug, id, data });
+    const doc = this.collection.workflow ? (await saveWorkflowDraft({
+      config,
+      collection: this.collection,
+      id,
+      originalDoc,
+      data,
+      user
+    })).doc : await db.update({ collection: this.collection.slug, id, data });
     if (this.collection.audit && db) {
       AuditService.log(db, {
         operation: "update",
@@ -1564,36 +2490,52 @@ var CollectionController = class {
         user: user ? { id: user.sub, collection: user.collection, email: user.email } : void 0,
         before,
         after: doc
-      });
+      }, config);
     }
-    await runCollectionHooks(this.collection.hooks?.afterChange, {
-      doc,
-      previousDoc: originalDoc,
-      user,
-      req: c.req,
-      operation: "update",
-      db
-    }, { isolated: true });
+    await runCollectionHooks(
+      this.collection.hooks?.afterChange,
+      {
+        doc,
+        previousDoc: originalDoc,
+        user,
+        req: c.req,
+        operation: "update",
+        db
+      },
+      { isolated: true }
+    );
     const readDoc = await runCollectionHooks(this.collection.hooks?.afterRead, {
       doc,
       req: c.req,
       user,
       db: readonlyDb
     });
-    const finalDoc = await executeFieldAfterRead(this.collection.fields, readDoc, user, readonlyDb);
-    const accessibleDoc = await applyFieldReadAccess({
-      config,
-      fields: this.collection.fields,
+    const finalDoc = await executeFieldAfterRead(
+      this.collection.fields,
+      readDoc,
       user,
-      req: this.toHookRequestContext(c),
-      doc: finalDoc
-    }, finalDoc);
+      readonlyDb
+    );
+    const accessibleDoc = await applyFieldReadAccess(
+      {
+        config,
+        fields: this.collection.fields,
+        user,
+        req: this.toHookRequestContext(c),
+        doc: finalDoc
+      },
+      finalDoc
+    );
     return c.json(accessibleDoc);
   }
   async transition(c) {
     const config = c.get("config");
     if (!config.db) return c.json({ message: "Database not configured" }, 500);
-    if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    if (!this.collection.workflow)
+      return c.json(
+        { message: "Workflows are not enabled for this collection" },
+        404
+      );
     const id = c.req.param("id");
     const transitionName = c.req.param("transition");
     const body = await c.req.json().catch(() => ({}));
@@ -1608,19 +2550,38 @@ var CollectionController = class {
         user: c.get("user"),
         req: { query: c.req.query(), headers: c.req.header(), raw: c.req.raw }
       });
-      return c.json(materializeWorkflowDocument(doc, this.collection.workflow, c.get("user")));
+      return c.json(
+        materializeWorkflowDocument(
+          doc,
+          this.collection.workflow,
+          c.get("user")
+        )
+      );
     } catch (error) {
       const status = typeof error.statusCode === "number" ? error.statusCode : 500;
-      return c.json({ error: true, message: error instanceof Error ? error.message : String(error) }, status);
+      return c.json(
+        {
+          error: true,
+          message: error instanceof Error ? error.message : String(error)
+        },
+        status
+      );
     }
   }
   async workflowHistory(c) {
     const config = c.get("config");
     if (!config.db) return c.json({ message: "Database not configured" }, 500);
-    if (!this.collection.workflow) return c.json({ message: "Workflows are not enabled for this collection" }, 404);
+    if (!this.collection.workflow)
+      return c.json(
+        { message: "Workflows are not enabled for this collection" },
+        404
+      );
     const documentId = c.req.param("id");
     if (!documentId) return c.json({ message: "Missing ID" }, 400);
-    const document = await config.db.findOne({ collection: this.collection.slug, id: documentId });
+    const document = await config.db.findOne({
+      collection: this.collection.slug,
+      id: documentId
+    });
     if (!document) return c.json({ message: "Not Found" }, 404);
     const readAccess = this.collection.access?.read;
     if (readAccess !== void 0 && readAccess !== null) {
@@ -1635,11 +2596,21 @@ var CollectionController = class {
         });
         allowed = match.total > 0;
       }
-      if (!allowed) return c.json({ error: true, message: `Access denied: read on ${this.collection.slug}` }, 403);
+      if (!allowed)
+        return c.json(
+          {
+            error: true,
+            message: `Access denied: read on ${this.collection.slug}`
+          },
+          403
+        );
     }
     const result = await config.db.find({
       collection: WORKFLOW_HISTORY_COLLECTION,
-      where: { collection: { equals: this.collection.slug }, documentId: { equals: documentId } },
+      where: {
+        collection: { equals: this.collection.slug },
+        documentId: { equals: documentId }
+      },
       sort: "-createdAt",
       limit: Math.min(Number(c.req.query("limit")) || 50, 100)
     });
@@ -1661,7 +2632,10 @@ var CollectionController = class {
     const db = config.db;
     if (!db) return c.json({ message: "Database not configured" }, 500);
     if (!this.collection.auth) {
-      return c.json({ message: "This collection does not support authentication" }, 400);
+      return c.json(
+        { message: "This collection does not support authentication" },
+        400
+      );
     }
     const id = c.req.param("id");
     if (!id) return c.json({ message: "Missing ID" }, 400);
@@ -1681,29 +2655,44 @@ var CollectionController = class {
     const isAdmin = Array.isArray(user.roles) && user.roles.includes("admin");
     const isSelf = user.sub === id;
     if (!isAdmin && !isSelf) {
-      return c.json({ message: "You are not authorised to change this password" }, 403);
+      return c.json(
+        { message: "You are not authorised to change this password" },
+        403
+      );
     }
     if (!isAdmin) {
       if (!oldPassword) {
         return c.json({ message: "Current password is required" }, 400);
       }
-      const existing = await db.findOne({ collection: this.collection.slug, id });
+      const existing = await db.findOne({
+        collection: this.collection.slug,
+        id
+      });
       if (!existing) return c.json({ message: "User not found" }, 404);
-      const valid = await verifyPassword(oldPassword, existing.password);
+      const valid = await verifyPassword(
+        oldPassword,
+        existing.password
+      );
       if (!valid) {
         return c.json({ message: "Invalid current password" }, 400);
       }
     }
     const hashed = await hashPassword(newPassword);
-    const doc = await db.update({
+    await db.update({
       collection: this.collection.slug,
       id,
       data: {
         password: hashed,
+        loginAttempts: 0,
+        lockedUntil: null,
         updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
         updatedBy: user.sub
       }
     });
+    await revokeAllAuthSessions(config, {
+      userId: id,
+      collection: this.collection.slug
+    });
     if (this.collection.audit) {
       AuditService.log(db, {
         operation: "update",
@@ -1712,7 +2701,7 @@ var CollectionController = class {
         user: { id: user.sub, collection: user.collection, email: user.email },
         before: null,
         after: { id }
-      });
+      }, config);
     }
     return c.json({ success: true, message: "Password updated successfully" });
   }
@@ -1725,7 +2714,10 @@ var CollectionController = class {
       const hookReq = this.toHookRequestContext(c);
       const id2 = c.req.param("id");
       if (!id2) return c.json({ message: "Missing ID" }, 400);
-      const localDoc = await db.findOne({ collection: this.collection.slug, id: id2 });
+      const localDoc = await db.findOne({
+        collection: this.collection.slug,
+        id: id2
+      });
       const externalSubject = localDoc?.externalSubject || id2;
       await provider.members.delete({ externalSubject, req: hookReq });
       return c.json({ message: "Deleted" });
@@ -1738,7 +2730,13 @@ var CollectionController = class {
     if (!doc) return c.json({ message: "Not Found" }, 404);
     const deleteAccess = await this.evaluateAccess(c, "delete", { id, doc });
     if (!deleteAccess.allowed) {
-      return c.json({ error: true, message: `Access denied: delete on ${this.collection.slug}` }, 403);
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: delete on ${this.collection.slug}`
+        },
+        403
+      );
     }
     let before = null;
     if (this.collection.audit) {
@@ -1760,15 +2758,19 @@ var CollectionController = class {
         user: user ? { id: user.sub, collection: user.collection, email: user.email } : void 0,
         before,
         after: null
-      });
+      }, config);
     }
-    await runCollectionHooks(this.collection.hooks?.afterDelete, {
-      id,
-      doc,
-      user,
-      req: c.req,
-      db
-    }, { isolated: true });
+    await runCollectionHooks(
+      this.collection.hooks?.afterDelete,
+      {
+        id,
+        doc,
+        user,
+        req: c.req,
+        db
+      },
+      { isolated: true }
+    );
     return c.json({ message: "Deleted" });
   }
   async deleteMany(c) {
@@ -1799,7 +2801,10 @@ var CollectionController = class {
           failed.push({ id, error: "Not Found" });
           continue;
         }
-        const deleteAccess = await this.evaluateAccess(c, "delete", { id, doc });
+        const deleteAccess = await this.evaluateAccess(c, "delete", {
+          id,
+          doc
+        });
         if (!deleteAccess.allowed) {
           failed.push({ id, error: "Access denied" });
           continue;
@@ -1825,15 +2830,19 @@ var CollectionController = class {
             user: user ? { id: user.sub, collection: user.collection, email: user.email } : void 0,
             before,
             after: null
-          });
+          }, config);
         }
-        await runCollectionHooks(this.collection.hooks?.afterDelete, {
-          id,
-          doc,
-          user,
-          req: c.req,
-          db
-        }, { isolated: true });
+        await runCollectionHooks(
+          this.collection.hooks?.afterDelete,
+          {
+            id,
+            doc,
+            user,
+            req: c.req,
+            db
+          },
+          { isolated: true }
+        );
       } catch (err) {
         failed.push({ id, error: err?.message ?? "Unknown error" });
       }
@@ -1853,17 +2862,26 @@ var CollectionController = class {
     if (!initialData || !Array.isArray(initialData)) {
       return c.json({ message: "Invalid initial data" }, 400);
     }
-    const result = await db.find({ collection: this.collection.slug, limit: 1 });
+    const result = await db.find({
+      collection: this.collection.slug,
+      limit: 1
+    });
     if (result.total > 0) {
       return c.json({ message: "Collection is not empty, skipping seed" });
     }
-    console.log(`[dyrected/core] Auto-seeding collection: ${this.collection.slug}`);
+    getRequestLogger(c, "collection").info({
+      msg: "Auto-seeding collection",
+      collection: this.collection.slug
+    });
     const createdDocs = [];
     for (const data of initialData) {
       const doc = await db.create({ collection: this.collection.slug, data });
       createdDocs.push(doc);
     }
-    return c.json({ message: "Seed successful", count: createdDocs.length }, 201);
+    return c.json(
+      { message: "Seed successful", count: createdDocs.length },
+      201
+    );
   }
 };
 
@@ -1880,46 +2898,66 @@ var GlobalController = class {
     const readonlyDb = createReadonlyDb(db);
     const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
     const user = c.get("user");
-    let query = void 0;
-    const beforeReadResult = await runCollectionHooks(this.global.hooks?.beforeRead, {
+    await runCollectionHooks(this.global.hooks?.beforeRead, {
       req: c.req,
-      query,
+      query: void 0,
       user,
       db: readonlyDb
     });
-    if (beforeReadResult !== void 0) {
-      query = beforeReadResult;
-    }
     let data = await db.getGlobal({ slug: this.global.slug });
     const isEmpty = !data || isFunctionallyEmpty(data);
     if (isEmpty && this.global.initialData) {
-      console.log(`[dyrected/core] Auto-seeding global "${this.global.slug}" from config.initialData`);
-      await db.updateGlobal({ slug: this.global.slug, data: this.global.initialData });
+      getRequestLogger(c, "global").info({
+        msg: "Auto-seeding global from config.initialData",
+        global: this.global.slug
+      });
+      await db.updateGlobal({
+        slug: this.global.slug,
+        data: this.global.initialData
+      });
       data = this.global.initialData;
     }
-    const canRead = await resolveBooleanAccess(config, this.global.access?.read, {
-      user,
-      req: toHookRequestContext(c.req),
-      doc: data
-    });
+    const canRead = await resolveBooleanAccess(
+      config,
+      this.global.access?.read,
+      {
+        user,
+        req: toHookRequestContext(c.req),
+        doc: data
+      }
+    );
     if (!canRead) {
-      return c.json({ error: true, message: `Access denied: read on ${this.global.slug}` }, 403);
+      return c.json(
+        { error: true, message: `Access denied: read on ${this.global.slug}` },
+        403
+      );
     }
     const dataWithDefaults = DefaultsService.apply(this.global.fields, data);
-    const docWithCollectionHooks = await runCollectionHooks(this.global.hooks?.afterRead, {
-      doc: dataWithDefaults,
-      req: c.req,
-      user,
-      db: readonlyDb
-    });
-    const docWithFieldHooks = await executeFieldAfterRead(this.global.fields, docWithCollectionHooks, user, readonlyDb);
-    const docWithFieldAccess = await applyFieldReadAccess({
-      config,
-      fields: this.global.fields,
+    const docWithCollectionHooks = await runCollectionHooks(
+      this.global.hooks?.afterRead,
+      {
+        doc: dataWithDefaults,
+        req: c.req,
+        user,
+        db: readonlyDb
+      }
+    );
+    const docWithFieldHooks = await executeFieldAfterRead(
+      this.global.fields,
+      docWithCollectionHooks,
       user,
-      req: toHookRequestContext(c.req),
-      doc: docWithFieldHooks
-    }, docWithFieldHooks);
+      readonlyDb
+    );
+    const docWithFieldAccess = await applyFieldReadAccess(
+      {
+        config,
+        fields: this.global.fields,
+        user,
+        req: toHookRequestContext(c.req),
+        doc: docWithFieldHooks
+      },
+      docWithFieldHooks
+    );
     if (depth > 0 && docWithFieldAccess) {
       const populationService = new PopulationService(db, config.collections);
       const populatedData = await populationService.populate({
@@ -1940,24 +2978,43 @@ var GlobalController = class {
     const body = await c.req.json();
     const user = c.get("user");
     const originalDoc = await db.getGlobal({ slug: this.global.slug }) || {};
-    const canUpdate = await resolveBooleanAccess(config, this.global.access?.update, {
-      user,
-      req: toHookRequestContext(c.req),
-      doc: originalDoc,
-      data: body
-    });
+    const canUpdate = await resolveBooleanAccess(
+      config,
+      this.global.access?.update,
+      {
+        user,
+        req: toHookRequestContext(c.req),
+        doc: originalDoc,
+        data: body
+      }
+    );
     if (!canUpdate) {
-      return c.json({ error: true, message: `Access denied: update on ${this.global.slug}` }, 403);
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: update on ${this.global.slug}`
+        },
+        403
+      );
     }
-    let sanitizedBody = await applyFieldWriteAccess({
-      config,
-      fields: this.global.fields,
+    const sanitizedBody = await applyFieldWriteAccess(
+      {
+        config,
+        fields: this.global.fields,
+        user,
+        req: toHookRequestContext(c.req),
+        doc: originalDoc,
+        data: body
+      },
+      body
+    );
+    let data = await executeFieldBeforeChange(
+      this.global.fields,
+      sanitizedBody,
+      originalDoc,
       user,
-      req: toHookRequestContext(c.req),
-      doc: originalDoc,
-      data: body
-    }, body);
-    let data = await executeFieldBeforeChange(this.global.fields, sanitizedBody, originalDoc, user, readonlyDb);
+      readonlyDb
+    );
     data = await runCollectionHooks(this.global.hooks?.beforeChange, {
       data,
       doc: originalDoc,
@@ -1967,28 +3024,40 @@ var GlobalController = class {
       db: readonlyDb
     });
     const updated = await db.updateGlobal({ slug: this.global.slug, data });
-    await runCollectionHooks(this.global.hooks?.afterChange, {
-      doc: updated,
-      previousDoc: originalDoc,
-      user,
-      req: c.req,
-      operation: "update",
-      db
-    }, { isolated: true });
+    await runCollectionHooks(
+      this.global.hooks?.afterChange,
+      {
+        doc: updated,
+        previousDoc: originalDoc,
+        user,
+        req: c.req,
+        operation: "update",
+        db
+      },
+      { isolated: true }
+    );
     const readDoc = await runCollectionHooks(this.global.hooks?.afterRead, {
       doc: updated,
       req: c.req,
       user,
       db: readonlyDb
     });
-    const finalDoc = await executeFieldAfterRead(this.global.fields, readDoc, user, readonlyDb);
-    const accessibleDoc = await applyFieldReadAccess({
-      config,
-      fields: this.global.fields,
+    const finalDoc = await executeFieldAfterRead(
+      this.global.fields,
+      readDoc,
       user,
-      req: toHookRequestContext(c.req),
-      doc: finalDoc
-    }, finalDoc);
+      readonlyDb
+    );
+    const accessibleDoc = await applyFieldReadAccess(
+      {
+        config,
+        fields: this.global.fields,
+        user,
+        req: toHookRequestContext(c.req),
+        doc: finalDoc
+      },
+      finalDoc
+    );
     return c.json(accessibleDoc);
   }
   async seed(c) {
@@ -2004,7 +3073,10 @@ var GlobalController = class {
     if (existing && !isFunctionallyEmpty(existing)) {
       return c.json({ message: "Global is not empty, skipping seed" });
     }
-    console.log(`[dyrected/core] Auto-seeding global: ${this.global.slug}`);
+    getRequestLogger(c, "global").info({
+      msg: "Auto-seeding global",
+      global: this.global.slug
+    });
     await db.updateGlobal({ slug: this.global.slug, data: initialData });
     return c.json({ message: "Seed successful", data: initialData }, 201);
   }
@@ -2023,9 +3095,116 @@ function isFunctionallyEmpty(obj) {
   return false;
 }
 
+// src/utils/block-references.ts
+function mergeUniqueBlocks(blocks) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const block of blocks) {
+    const existing = seen.get(block.slug);
+    if (existing && existing !== block) {
+      throw new Error(
+        `Duplicate block slug "${block.slug}" found in the reusable block registry. Block slugs must be unique.`
+      );
+    }
+    if (!existing) seen.set(block.slug, block);
+  }
+  return Array.from(seen.values());
+}
+function buildRegistry(blocks) {
+  return new Map(blocks.map((block) => [block.slug, block]));
+}
+function resolveField(field, registry, blockCache) {
+  const next = { ...field };
+  if (next.fields) {
+    next.fields = next.fields.map(
+      (child) => resolveField(child, registry, blockCache)
+    );
+  }
+  if (next.type !== "blocks") return next;
+  const hasInlineBlocks = Array.isArray(next.blocks) && next.blocks.length > 0;
+  const hasReferences = Array.isArray(next.blockReferences) && next.blockReferences.length > 0;
+  if (hasInlineBlocks && hasReferences) {
+    throw new Error(
+      `Blocks field "${next.name ?? "(unnamed)"}" cannot define both "blocks" and "blockReferences". Use one or the other.`
+    );
+  }
+  if (hasReferences) {
+    next.blocks = next.blockReferences.map((slug) => {
+      const block = registry.get(slug);
+      if (!block) {
+        throw new Error(
+          `Unknown block reference "${slug}" on blocks field "${next.name ?? "(unnamed)"}". Add it to defineConfig({ blocks: [...] }).`
+        );
+      }
+      return resolveBlock(block, registry, blockCache);
+    });
+    return next;
+  }
+  if (hasInlineBlocks) {
+    next.blocks = next.blocks.map(
+      (block) => resolveBlock(block, registry, blockCache)
+    );
+  }
+  return next;
+}
+function resolveBlock(block, registry, blockCache) {
+  const cached = blockCache.get(block);
+  if (cached) return cached;
+  const resolved = {
+    ...block,
+    fields: []
+  };
+  blockCache.set(block, resolved);
+  resolved.fields = block.fields.map(
+    (field) => resolveField(field, registry, blockCache)
+  );
+  return resolved;
+}
+function resolveFields(fields, registry, blockCache) {
+  return fields.map((field) => resolveField(field, registry, blockCache));
+}
+function normalizeSchemaFragment(fragment) {
+  const reusableBlocks = mergeUniqueBlocks(fragment.blocks ?? []);
+  const registry = buildRegistry(reusableBlocks);
+  const blockCache = /* @__PURE__ */ new WeakMap();
+  const resolvedBlocks = reusableBlocks.map(
+    (block) => resolveBlock(block, registry, blockCache)
+  );
+  const resolvedCollections = (fragment.collections ?? []).map(
+    (collection) => ({
+      ...collection,
+      fields: resolveFields(collection.fields ?? [], registry, blockCache)
+    })
+  );
+  const resolvedGlobals = (fragment.globals ?? []).map((global) => ({
+    ...global,
+    fields: resolveFields(global.fields ?? [], registry, blockCache)
+  }));
+  return {
+    ...fragment,
+    ...fragment.blocks ? { blocks: resolvedBlocks } : {},
+    ...fragment.collections ? { collections: resolvedCollections } : {},
+    ...fragment.globals ? { globals: resolvedGlobals } : {}
+  };
+}
+function mergeDynamicConfig(baseConfig, dynamic) {
+  const normalizedDynamic = normalizeSchemaFragment({
+    ...dynamic,
+    blocks: [...baseConfig.blocks ?? [], ...dynamic.blocks ?? []]
+  });
+  return {
+    ...baseConfig,
+    ...normalizedDynamic.blocks ? { blocks: normalizedDynamic.blocks } : {},
+    ...dynamic.admin ? { admin: { ...baseConfig.admin, ...dynamic.admin } } : {},
+    ...dynamic.adminAuth ? { adminAuth: { ...baseConfig.adminAuth, ...dynamic.adminAuth } } : {},
+    collections: normalizedDynamic.collections ? [...baseConfig.collections, ...normalizedDynamic.collections] : baseConfig.collections,
+    globals: normalizedDynamic.globals ? [...baseConfig.globals, ...normalizedDynamic.globals] : baseConfig.globals
+  };
+}
+
 // src/controllers/media.controller.ts
 var MediaController = class {
   collection;
+  loggerComponent = "media";
   constructor(collection = "media") {
     this.collection = collection;
   }
@@ -2044,15 +3223,25 @@ var MediaController = class {
       return c.json({ message: "No file uploaded" }, 400);
     }
     const siteId = c.get("siteId");
-    let colConfig = config.collections.find((col) => col.slug === this.collection);
+    let colConfig = config.collections.find(
+      (col) => col.slug === this.collection
+    );
     if (!colConfig && config.onSchemaFetch && siteId) {
-      const dynamic = await config.onSchemaFetch(siteId);
-      colConfig = dynamic.collections?.find((col) => col.slug === this.collection);
+      const requestConfig = mergeDynamicConfig(
+        config,
+        await config.onSchemaFetch(siteId)
+      );
+      colConfig = requestConfig.collections.find(
+        (col) => col.slug === this.collection
+      );
     }
     const uploadConfig = typeof colConfig?.upload === "object" ? colConfig.upload : void 0;
     const validationError = validateUpload(file, uploadConfig);
     if (validationError) {
-      return c.json({ message: validationError.message }, validationError.status);
+      return c.json(
+        { message: validationError.message },
+        validationError.status
+      );
     }
     const buffer = new Uint8Array(await file.arrayBuffer());
     const workspaceId = c.get("workspaceId");
@@ -2070,7 +3259,12 @@ var MediaController = class {
         imageMetadata = processed.metadata;
         imageSizes = processed.sizes;
       } catch (err) {
-        console.error("[MediaController] Image processing failed:", err);
+        getRequestLogger(c, this.loggerComponent).error({
+          err,
+          msg: "Image processing failed",
+          collection: this.collection,
+          filename: file.name
+        });
       }
     }
     const fileData = await storage.upload({
@@ -2103,7 +3297,13 @@ var MediaController = class {
             height: sizeData.height
           };
         } catch (err) {
-          console.error(`[MediaController] Failed to upload size ${sizeName}:`, err);
+          getRequestLogger(c, this.loggerComponent).error({
+            err,
+            msg: "Failed to upload image size",
+            collection: this.collection,
+            filename: file.name,
+            sizeName
+          });
         }
       }
     }
@@ -2167,25 +3367,37 @@ var MediaController = class {
   }
 };
 
-// src/auth/token.ts
-var import_jose = require("jose");
-var import_node_util2 = require("util");
-function getSecret() {
-  const secret = process.env.DYRECTED_JWT_SECRET;
-  if (!secret) {
-    throw new Error(
-      "[dyrected/core] DYRECTED_JWT_SECRET is not set. Add it to your environment variables to enable auth collections."
-    );
+// src/auth/lockout.ts
+var DEFAULT_MAX_LOGIN_ATTEMPTS = 5;
+var DEFAULT_LOCK_TIME_MS = 10 * 60 * 1e3;
+function resolveAuthLockoutConfig(collection) {
+  const auth = collection.auth;
+  if (!auth) {
+    return {
+      enabled: false,
+      maxLoginAttempts: DEFAULT_MAX_LOGIN_ATTEMPTS,
+      lockTime: DEFAULT_LOCK_TIME_MS
+    };
   }
-  return new import_node_util2.TextEncoder().encode(secret);
-}
-var DEFAULT_EXPIRY = "7d";
-async function signCollectionToken(payload, expiresIn = DEFAULT_EXPIRY) {
-  return new import_jose.SignJWT({ ...payload }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(expiresIn).sign(getSecret());
+  if (auth === true) {
+    return {
+      enabled: true,
+      maxLoginAttempts: DEFAULT_MAX_LOGIN_ATTEMPTS,
+      lockTime: DEFAULT_LOCK_TIME_MS
+    };
+  }
+  const maxLoginAttempts = typeof auth.maxLoginAttempts === "number" ? auth.maxLoginAttempts : DEFAULT_MAX_LOGIN_ATTEMPTS;
+  const lockTime = typeof auth.lockTime === "number" && auth.lockTime > 0 ? auth.lockTime : DEFAULT_LOCK_TIME_MS;
+  return {
+    enabled: maxLoginAttempts > 0,
+    maxLoginAttempts,
+    lockTime
+  };
 }
-async function verifyCollectionToken(token) {
-  const { payload } = await (0, import_jose.jwtVerify)(token, getSecret());
-  return payload;
+function getLockedUntilMs(value) {
+  if (typeof value !== "string") return null;
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) ? parsed : null;
 }
 
 // src/services/email-template.ts
@@ -2285,6 +3497,7 @@ async function getDevSend() {
   if (_devSend) return _devSend;
   if (_devSendPromise) return _devSendPromise;
   _devSendPromise = (async () => {
+    const logger = getConfigLogger(void 0, "email");
     try {
       const nodemailer = await import("nodemailer");
       const account = await nodemailer.default.createTestAccount();
@@ -2293,23 +3506,50 @@ async function getDevSend() {
         port: 587,
         auth: { user: account.user, pass: account.pass }
       });
-      console.log("[dyrected/core] No email config \u2014 using Ethereal for dev email preview.");
-      console.log(`[dyrected/core] Ethereal login: https://ethereal.email  user: ${account.user}  pass: ${account.pass}`);
+      logger.info({
+        msg: "No email config; using Ethereal for development email preview"
+      });
+      logger.info({
+        msg: "Ethereal credentials",
+        loginUrl: "https://ethereal.email",
+        user: account.user,
+        password: account.pass
+      });
       _devSend = async ({ to, subject, html }) => {
         const info = await transport.sendMail({ from: '"Dyrected Dev" <dev@dyrected.local>', to, subject, html });
-        console.log(`[dyrected/core] Email preview URL: ${nodemailer.default.getTestMessageUrl(info)}`);
+        logger.info({
+          msg: "Email preview URL",
+          previewUrl: nodemailer.default.getTestMessageUrl(info)
+        });
       };
       return _devSend;
     } catch {
-      console.warn("[dyrected/core] nodemailer not available \u2014 emails will not be sent in dev.");
+      logger.warn({
+        msg: "nodemailer not available; development emails will not be sent"
+      });
       return null;
     }
   })();
   return _devSendPromise;
 }
 async function sendEmail(config, payload) {
+  const logger = getConfigLogger(config, "email");
+  const observability = getObservabilityRuntime(config);
   if (config.email) {
-    await config.email.send(payload);
+    try {
+      await config.email.send(payload);
+    } catch (err) {
+      observability?.recordEmailSendFailure({
+        to: payload.to
+      });
+      logger.error({
+        err,
+        msg: "Email provider send failed",
+        to: payload.to,
+        subject: payload.subject
+      });
+      throw err;
+    }
     return;
   }
   if (process.env.NODE_ENV !== "production") {
@@ -2373,6 +3613,55 @@ var AuthController = class {
   constructor(collection) {
     this.collection = collection;
   }
+  sanitizeUser(user) {
+    const {
+      password: _password,
+      loginAttempts: _loginAttempts,
+      lockedUntil: _lockedUntil,
+      ...safeUser
+    } = user;
+    return safeUser;
+  }
+  clearLockoutState(c, userId) {
+    const db = c.get("config").db;
+    if (!db) return Promise.resolve(null);
+    return db.update({
+      collection: this.collection.slug,
+      id: userId,
+      data: {
+        loginAttempts: 0,
+        lockedUntil: null
+      }
+    });
+  }
+  async recordFailedLogin(c, user) {
+    const db = c.get("config").db;
+    if (!db)
+      return { justLocked: false, retryAfterSeconds: null };
+    const lockout = resolveAuthLockoutConfig(this.collection);
+    if (!lockout.enabled) {
+      return { justLocked: false, retryAfterSeconds: null };
+    }
+    const now = Date.now();
+    const lockedUntilMs = getLockedUntilMs(user.lockedUntil);
+    const lockExpired = lockedUntilMs !== null && lockedUntilMs <= now;
+    const currentAttempts = !lockExpired && typeof user.loginAttempts === "number" && user.loginAttempts > 0 ? user.loginAttempts : 0;
+    const loginAttempts = currentAttempts + 1;
+    const justLocked = loginAttempts >= lockout.maxLoginAttempts;
+    const nextLockedUntil = justLocked ? new Date(now + lockout.lockTime).toISOString() : null;
+    await db.update({
+      collection: this.collection.slug,
+      id: String(user.id),
+      data: {
+        loginAttempts,
+        lockedUntil: nextLockedUntil
+      }
+    });
+    return {
+      justLocked,
+      retryAfterSeconds: justLocked ? Math.max(1, Math.ceil(lockout.lockTime / 1e3)) : null
+    };
+  }
   // ---------------------------------------------------------------------------
   // GET /init
   // Checks if the first user needs to be created.
@@ -2401,11 +3690,17 @@ var AuthController = class {
       limit: 1
     });
     if (check.total > 0) {
-      return c.json({ error: true, message: "Initial user already exists." }, 403);
+      return c.json(
+        { error: true, message: "Initial user already exists." },
+        403
+      );
     }
     const body = await c.req.json().catch(() => null);
     if (!body?.email || !body?.password) {
-      return c.json({ error: true, message: "email and password are required." }, 400);
+      return c.json(
+        { error: true, message: "email and password are required." },
+        400
+      );
     }
     const hashedPassword = await hashPassword(body.password);
     const user = await db.create({
@@ -2417,16 +3712,23 @@ var AuthController = class {
         // Default first user to admin
       }
     });
-    const token = await signCollectionToken({
-      sub: user.id,
+    const token = await issueAuthSessionToken({
+      config,
+      userId: user.id,
       email: user.email,
-      collection: this.collection.slug
+      collection: this.collection.slug,
+      ip: c.get("clientIp"),
+      authSource: "local"
     });
     const { subject, html } = buildWelcomeEmail(config, { email: body.email });
     sendEmail(config, { to: body.email, subject, html }).catch(
-      (err) => console.error("[dyrected/core] Failed to send welcome email:", err)
+      (err) => getRequestLogger(c, "auth").error({
+        err,
+        msg: "Failed to send welcome email",
+        email: body.email
+      })
     );
-    const { password: _, ...safeUser } = user;
+    const safeUser = this.sanitizeUser(user);
     return c.json({ token, user: safeUser });
   }
   // ---------------------------------------------------------------------------
@@ -2437,7 +3739,10 @@ var AuthController = class {
     if (!db) return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json().catch(() => null);
     if (!body?.email || !body?.password) {
-      return c.json({ error: true, message: "email and password are required." }, 400);
+      return c.json(
+        { error: true, message: "email and password are required." },
+        400
+      );
     }
     const result = await db.find({
       collection: this.collection.slug,
@@ -2446,27 +3751,107 @@ var AuthController = class {
     });
     const user = result.docs[0];
     if (!user) {
-      return c.json({ error: true, message: "Invalid email or password." }, 401);
+      return c.json(
+        { error: true, message: "Invalid email or password." },
+        401
+      );
+    }
+    const lockedUntilMs = getLockedUntilMs(user.lockedUntil);
+    if (lockedUntilMs !== null && lockedUntilMs > Date.now()) {
+      const retryAfterSeconds = Math.max(
+        1,
+        Math.ceil((lockedUntilMs - Date.now()) / 1e3)
+      );
+      c.header("Retry-After", String(retryAfterSeconds));
+      return c.json(
+        {
+          error: true,
+          message: "Too many login attempts. Try again later.",
+          retryAfterSeconds
+        },
+        429
+      );
     }
     const valid = await verifyPassword(body.password, user.password);
     if (!valid) {
-      return c.json({ error: true, message: "Invalid email or password." }, 401);
+      const { justLocked, retryAfterSeconds } = await this.recordFailedLogin(
+        c,
+        user
+      );
+      if (justLocked && retryAfterSeconds) {
+        c.header("Retry-After", String(retryAfterSeconds));
+        return c.json(
+          {
+            error: true,
+            message: "Too many login attempts. Try again later.",
+            retryAfterSeconds
+          },
+          429
+        );
+      }
+      return c.json(
+        { error: true, message: "Invalid email or password." },
+        401
+      );
+    }
+    if (typeof user.loginAttempts === "number" && user.loginAttempts > 0 || user.lockedUntil != null) {
+      await this.clearLockoutState(c, String(user.id));
     }
-    const token = await signCollectionToken({
-      sub: user.id,
+    const token = await issueAuthSessionToken({
+      config: c.get("config"),
+      userId: user.id,
       email: user.email,
-      collection: this.collection.slug
+      collection: this.collection.slug,
+      ip: c.get("clientIp"),
+      authSource: "local"
     });
-    const { password: _, ...safeUser } = user;
+    const safeUser = this.sanitizeUser(user);
     return c.json({ token, user: safeUser });
   }
   // ---------------------------------------------------------------------------
   // POST /logout
-  // Auth collections use stateless JWTs — logout is handled client-side.
-  // This endpoint exists so clients have a consistent API surface.
+  // Revoke the current session by default. Pass `?allSessions=true` to revoke
+  // every active session for the current account.
   // ---------------------------------------------------------------------------
   async logout(c) {
-    return c.json({ success: true, message: "Logged out. Discard your token." });
+    const requestUser = c.get("user");
+    const tokenPayload = c.get("authTokenPayload");
+    const allSessions = ["1", "true", "yes"].includes(
+      (c.req.query("allSessions") || "").toLowerCase()
+    );
+    if (!requestUser) {
+      if (allSessions) {
+        return c.json(
+          { error: true, message: "Authentication required." },
+          401
+        );
+      }
+      return c.json({
+        success: true,
+        message: "Logged out. Discard your token."
+      });
+    }
+    if (allSessions) {
+      await revokeAllAuthSessions(c.get("config"), {
+        userId: requestUser.sub,
+        collection: this.collection.slug
+      });
+      return c.json({
+        success: true,
+        message: "All sessions have been logged out."
+      });
+    }
+    if (tokenPayload?.sid) {
+      await revokeAuthSession(c.get("config"), tokenPayload.sid);
+      return c.json({
+        success: true,
+        message: "Logged out."
+      });
+    }
+    return c.json({
+      success: true,
+      message: "Logged out. Discard your token."
+    });
   }
   // ---------------------------------------------------------------------------
   // GET /me
@@ -2478,11 +3863,14 @@ var AuthController = class {
     if (!requestUser) {
       return c.json({ error: true, message: "Authentication required." }, 401);
     }
-    const user = await db.findOne({ collection: this.collection.slug, id: requestUser.sub });
+    const user = await db.findOne({
+      collection: this.collection.slug,
+      id: requestUser.sub
+    });
     if (!user) {
       return c.json({ error: true, message: "User not found." }, 404);
     }
-    const { password: _, ...safeUser } = user;
+    const safeUser = this.sanitizeUser(user);
     return c.json(safeUser);
   }
   // ---------------------------------------------------------------------------
@@ -2493,10 +3881,29 @@ var AuthController = class {
     if (!requestUser) {
       return c.json({ error: true, message: "Authentication required." }, 401);
     }
-    const token = await signCollectionToken({
-      sub: requestUser.sub,
+    if (!requestUser.email) {
+      return c.json(
+        { error: true, message: "Authenticated user is missing an email." },
+        400
+      );
+    }
+    const tokenPayload = c.get("authTokenPayload");
+    if (tokenPayload?.sid) {
+      const token2 = await signCollectionToken({
+        sub: requestUser.sub,
+        email: requestUser.email,
+        collection: this.collection.slug,
+        sid: tokenPayload.sid
+      });
+      return c.json({ token: token2 });
+    }
+    const token = await issueAuthSessionToken({
+      config: c.get("config"),
+      userId: requestUser.sub,
       email: requestUser.email,
-      collection: this.collection.slug
+      collection: this.collection.slug,
+      ip: c.get("clientIp"),
+      authSource: "local"
     });
     return c.json({ token });
   }
@@ -2521,16 +3928,28 @@ var AuthController = class {
     const user = result.docs[0];
     if (user) {
       const resetToken = await signCollectionToken(
-        { sub: user.id, email: user.email, collection: this.collection.slug, purpose: "reset" },
+        {
+          sub: user.id,
+          email: user.email,
+          collection: this.collection.slug,
+          purpose: "reset"
+        },
         "1h"
       );
       const resetUrl = body?.resetUrl;
       const url = resetUrl ? `${resetUrl}${resetUrl.includes("?") ? "&" : "?"}token=${encodeURIComponent(resetToken)}` : void 0;
       try {
-        const { subject, html } = buildResetPasswordEmail(config, { token: resetToken, url });
+        const { subject, html } = buildResetPasswordEmail(config, {
+          token: resetToken,
+          url
+        });
         await sendEmail(config, { to: user.email, subject, html });
       } catch (err) {
-        console.error("[dyrected/core] Failed to send password reset email:", err);
+        getRequestLogger(c, "auth").error({
+          err,
+          msg: "Failed to send password reset email",
+          email: user.email
+        });
       }
     }
     return c.json({
@@ -2549,28 +3968,54 @@ var AuthController = class {
     if (!db) return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json().catch(() => null);
     if (!body?.token || !body?.password) {
-      return c.json({ error: true, message: "token and password are required." }, 400);
+      return c.json(
+        { error: true, message: "token and password are required." },
+        400
+      );
     }
     let payload;
     try {
       payload = await verifyCollectionToken(body.token);
     } catch {
-      return c.json({ error: true, message: "Reset token is invalid or has expired." }, 400);
+      return c.json(
+        { error: true, message: "Reset token is invalid or has expired." },
+        400
+      );
     }
     if (payload.collection !== this.collection.slug || payload.purpose !== "reset") {
-      return c.json({ error: true, message: "Reset token is invalid or has expired." }, 400);
+      return c.json(
+        { error: true, message: "Reset token is invalid or has expired." },
+        400
+      );
     }
     const hashedPassword = await hashPassword(body.password);
     await db.update({
       collection: this.collection.slug,
       id: payload.sub,
-      data: { password: hashedPassword }
+      data: {
+        password: hashedPassword,
+        loginAttempts: 0,
+        lockedUntil: null
+      }
+    });
+    await revokeAllAuthSessions(config, {
+      userId: payload.sub,
+      collection: this.collection.slug
+    });
+    const { subject, html } = buildPasswordChangedEmail(config, {
+      email: payload.email
     });
-    const { subject, html } = buildPasswordChangedEmail(config, { email: payload.email });
     sendEmail(config, { to: payload.email, subject, html }).catch(
-      (err) => console.error("[dyrected/core] Failed to send password-changed email:", err)
+      (err) => getRequestLogger(c, "auth").error({
+        err,
+        msg: "Failed to send password-changed email",
+        email: payload.email
+      })
     );
-    return c.json({ success: true, message: "Password has been reset. You can now log in." });
+    return c.json({
+      success: true,
+      message: "Password has been reset. You can now log in."
+    });
   }
   // ---------------------------------------------------------------------------
   // POST /invite
@@ -2594,10 +4039,18 @@ var AuthController = class {
       limit: 1
     });
     if (existing.total > 0) {
-      return c.json({ error: true, message: "An account with that email already exists." }, 409);
+      return c.json(
+        { error: true, message: "An account with that email already exists." },
+        409
+      );
     }
     const inviteToken = await signCollectionToken(
-      { sub: body.email, email: body.email, collection: this.collection.slug, purpose: "invite" },
+      {
+        sub: body.email,
+        email: body.email,
+        collection: this.collection.slug,
+        purpose: "invite"
+      },
       "7d"
     );
     try {
@@ -2607,7 +4060,11 @@ var AuthController = class {
       });
       await sendEmail(config, { to: body.email, subject, html });
     } catch (err) {
-      console.error("[dyrected/core] Failed to send invite email:", err);
+      getRequestLogger(c, "auth").error({
+        err,
+        msg: "Failed to send invite email",
+        email: body.email
+      });
     }
     return c.json({ success: true, message: `Invite sent to ${body.email}.` });
   }
@@ -2622,16 +4079,25 @@ var AuthController = class {
     if (!db) return c.json({ message: "Database not configured" }, 500);
     const body = await c.req.json().catch(() => null);
     if (!body?.token || !body?.password) {
-      return c.json({ error: true, message: "token and password are required." }, 400);
+      return c.json(
+        { error: true, message: "token and password are required." },
+        400
+      );
     }
     let payload;
     try {
       payload = await verifyCollectionToken(body.token);
     } catch {
-      return c.json({ error: true, message: "Invite token is invalid or has expired." }, 400);
+      return c.json(
+        { error: true, message: "Invite token is invalid or has expired." },
+        400
+      );
     }
     if (payload.collection !== this.collection.slug || payload.purpose !== "invite") {
-      return c.json({ error: true, message: "Invite token is invalid or has expired." }, 400);
+      return c.json(
+        { error: true, message: "Invite token is invalid or has expired." },
+        400
+      );
     }
     const inviteeEmail = payload.sub;
     const existing = await db.find({
@@ -2640,7 +4106,10 @@ var AuthController = class {
       limit: 1
     });
     if (existing.total > 0) {
-      return c.json({ error: true, message: "An account with that email already exists." }, 409);
+      return c.json(
+        { error: true, message: "An account with that email already exists." },
+        409
+      );
     }
     const { token: _t, password: _p, ...extraFields } = body;
     const hashedPassword = await hashPassword(body.password);
@@ -2648,16 +4117,25 @@ var AuthController = class {
       collection: this.collection.slug,
       data: { ...extraFields, email: inviteeEmail, password: hashedPassword }
     });
-    const sessionToken = await signCollectionToken({
-      sub: user.id,
+    const sessionToken = await issueAuthSessionToken({
+      config,
+      userId: user.id,
       email: inviteeEmail,
-      collection: this.collection.slug
+      collection: this.collection.slug,
+      ip: c.get("clientIp"),
+      authSource: "local"
+    });
+    const { subject, html } = buildWelcomeEmail(config, {
+      email: inviteeEmail
     });
-    const { subject, html } = buildWelcomeEmail(config, { email: inviteeEmail });
     sendEmail(config, { to: inviteeEmail, subject, html }).catch(
-      (err) => console.error("[dyrected/core] Failed to send welcome email:", err)
+      (err) => getRequestLogger(c, "auth").error({
+        err,
+        msg: "Failed to send welcome email",
+        email: inviteeEmail
+      })
     );
-    const { password: _, ...safeUser } = user;
+    const safeUser = this.sanitizeUser(user);
     return c.json({ token: sessionToken, user: safeUser }, 201);
   }
 };
@@ -2673,13 +4151,21 @@ var AdminAuthController = class {
   config;
   async providers(c) {
     const requestConfig = await this.getRequestConfig(c);
-    return c.json(getPublicAdminAuthConfig(requestConfig.adminAuth, requestConfig.collections));
+    return c.json(
+      getPublicAdminAuthConfig(
+        requestConfig.adminAuth,
+        requestConfig.collections
+      )
+    );
   }
   async start(c) {
     const requestConfig = await this.getRequestConfig(c);
     const provider = this.getProvider(requestConfig, c.req.param("provider"));
     if (!provider) {
-      return c.json({ error: true, message: "Admin auth provider not found." }, 404);
+      return c.json(
+        { error: true, message: "Admin auth provider not found." },
+        404
+      );
     }
     const siteId = this.getSiteId(c);
     const returnTo = this.normalizeReturnTo(c.req.query("returnTo"), c);
@@ -2693,9 +4179,15 @@ var AdminAuthController = class {
       return c.redirect(redirectUrl, 302);
     }
     if (!provider.startUrl) {
-      return c.json({ error: true, message: "This provider does not expose a start URL." }, 400);
+      return c.json(
+        { error: true, message: "This provider does not expose a start URL." },
+        400
+      );
     }
-    const url = this.buildCustomProviderStartUrl(provider.startUrl, new URL(c.req.url).origin);
+    const url = this.buildCustomProviderStartUrl(
+      provider.startUrl,
+      new URL(c.req.url).origin
+    );
     if (!url) {
       return c.json(
         {
@@ -2714,13 +4206,23 @@ var AdminAuthController = class {
     const requestConfig = await this.getRequestConfig(c);
     const provider = this.getProvider(requestConfig, c.req.param("provider"));
     if (!provider) {
-      return c.json({ error: true, message: "Admin auth provider not found." }, 404);
+      return c.json(
+        { error: true, message: "Admin auth provider not found." },
+        404
+      );
     }
     try {
-      const exchange = await this.completeProviderAuth(requestConfig, provider, c);
+      const exchange = await this.completeProviderAuth(
+        requestConfig,
+        provider,
+        c
+      );
       const redirectUrl = new URL(exchange.returnTo);
       redirectUrl.searchParams.set("dyrectedExternalToken", exchange.token);
-      redirectUrl.searchParams.set("dyrectedAdminCollection", exchange.collectionSlug);
+      redirectUrl.searchParams.set(
+        "dyrectedAdminCollection",
+        exchange.collectionSlug
+      );
       return c.redirect(redirectUrl.toString(), 302);
     } catch (error) {
       const message = error instanceof Error ? error.message : "External authentication failed.";
@@ -2734,10 +4236,17 @@ var AdminAuthController = class {
     const requestConfig = await this.getRequestConfig(c);
     const provider = this.getProvider(requestConfig, c.req.param("provider"));
     if (!provider) {
-      return c.json({ error: true, message: "Admin auth provider not found." }, 404);
+      return c.json(
+        { error: true, message: "Admin auth provider not found." },
+        404
+      );
     }
     try {
-      const exchange = await this.completeProviderAuth(requestConfig, provider, c);
+      const exchange = await this.completeProviderAuth(
+        requestConfig,
+        provider,
+        c
+      );
       return c.json({
         token: exchange.token,
         collectionSlug: exchange.collectionSlug,
@@ -2750,7 +4259,44 @@ var AdminAuthController = class {
     }
   }
   async logout(c) {
-    return c.json({ success: true, message: "Logged out. Discard your token." });
+    const requestUser = c.get("user");
+    const tokenPayload = c.get("authTokenPayload");
+    const allSessions = ["1", "true", "yes"].includes(
+      (c.req.query("allSessions") || "").toLowerCase()
+    );
+    if (!requestUser) {
+      if (allSessions) {
+        return c.json(
+          { error: true, message: "Authentication required." },
+          401
+        );
+      }
+      return c.json({
+        success: true,
+        message: "Logged out. Discard your token."
+      });
+    }
+    if (allSessions) {
+      await revokeAllAuthSessions(c.get("config"), {
+        userId: requestUser.sub,
+        collection: requestUser.collection
+      });
+      return c.json({
+        success: true,
+        message: "All sessions have been logged out."
+      });
+    }
+    if (tokenPayload?.sid) {
+      await revokeAuthSession(c.get("config"), tokenPayload.sid);
+      return c.json({
+        success: true,
+        message: "Logged out."
+      });
+    }
+    return c.json({
+      success: true,
+      message: "Logged out. Discard your token."
+    });
   }
   getProvider(config, id) {
     if (config.adminAuth?.mode !== "external") return void 0;
@@ -2766,7 +4312,12 @@ var AdminAuthController = class {
     }
     const db = c.get("config").db;
     if (!db) throw new Error("Database not configured.");
-    let user = await this.findUserByExternalIdentity(db, adminCollection.slug, provider.id, identity.sub) ?? (identity.email ? (await db.find({
+    let user = await this.findUserByExternalIdentity(
+      db,
+      adminCollection.slug,
+      provider.id,
+      identity.sub
+    ) ?? (identity.email ? (await db.find({
       collection: adminCollection.slug,
       where: { email: identity.email },
       limit: 1
@@ -2774,9 +4325,18 @@ var AdminAuthController = class {
     const provisioningMode = requestConfig.adminAuth?.provisioningMode ?? "jit_plus_membership_management";
     const allowJitProvisioning = provisioningMode !== "preprovisioned_only" && provider.allowJitProvisioning !== false;
     if (!user && !allowJitProvisioning) {
-      throw new Error("This account has not been provisioned for admin access.");
+      throw new Error(
+        "This account has not been provisioned for admin access."
+      );
     }
-    const access = await this.resolveAccess(requestConfig, identity, provider.id, siteId, c, user);
+    const access = await this.resolveAccess(
+      requestConfig,
+      identity,
+      provider.id,
+      siteId,
+      c,
+      user
+    );
     if (!access.allowed) {
       throw new Error("Access denied for this site.");
     }
@@ -2784,7 +4344,12 @@ var AdminAuthController = class {
       user = await db.create({
         collection: adminCollection.slug,
         data: {
-          ...await this.buildUserData(identity, provider.id, access.roles, access.data),
+          ...await this.buildUserData(
+            identity,
+            provider.id,
+            access.roles,
+            access.data
+          ),
           password: await hashPassword((0, import_node_crypto2.randomBytes)(32).toString("hex"))
         }
       });
@@ -2792,18 +4357,25 @@ var AdminAuthController = class {
       user = await db.update({
         collection: adminCollection.slug,
         id: user.id,
-        data: await this.buildUserData(identity, provider.id, access.roles, access.data)
+        data: await this.buildUserData(
+          identity,
+          provider.id,
+          access.roles,
+          access.data
+        )
       });
     }
     if (!user?.email) {
       throw new Error("Authenticated admin user is missing an email address.");
     }
-    const token = await signCollectionToken({
-      sub: user.id,
+    const token = await issueAuthSessionToken({
+      config: c.get("config"),
+      userId: user.id,
       email: user.email,
       collection: adminCollection.slug,
       providerId: provider.id,
-      authSource: "external"
+      authSource: "external",
+      ip: c.get("clientIp")
     });
     return {
       token,
@@ -2857,14 +4429,10 @@ var AdminAuthController = class {
   async getRequestConfig(c) {
     const siteId = this.getSiteId(c);
     if (!siteId || !this.config.onSchemaFetch) return this.config;
-    const dynamic = await this.config.onSchemaFetch(siteId);
-    return {
-      ...this.config,
-      ...dynamic.admin ? { admin: { ...this.config.admin, ...dynamic.admin } } : {},
-      ...dynamic.adminAuth ? { adminAuth: { ...this.config.adminAuth, ...dynamic.adminAuth } } : {},
-      collections: dynamic.collections ? [...this.config.collections, ...dynamic.collections] : this.config.collections,
-      globals: dynamic.globals ? [...this.config.globals, ...dynamic.globals] : this.config.globals
-    };
+    return mergeDynamicConfig(
+      this.config,
+      await this.config.onSchemaFetch(siteId)
+    );
   }
   async buildOidcStartUrl(provider, returnTo, siteId, origin) {
     const discovery = await this.getOidcDiscovery(provider);
@@ -2875,11 +4443,19 @@ var AdminAuthController = class {
       siteId,
       nonce
     });
-    const url = new URL(provider.authorizationEndpoint || discovery.authorization_endpoint);
+    const url = new URL(
+      provider.authorizationEndpoint || discovery.authorization_endpoint
+    );
     url.searchParams.set("response_type", "code");
     url.searchParams.set("client_id", provider.clientId);
-    url.searchParams.set("redirect_uri", provider.redirectUri || this.defaultCallbackPath(provider.id, origin));
-    url.searchParams.set("scope", (provider.scopes ?? ["openid", "profile", "email"]).join(" "));
+    url.searchParams.set(
+      "redirect_uri",
+      provider.redirectUri || this.defaultCallbackPath(provider.id, origin)
+    );
+    url.searchParams.set(
+      "scope",
+      (provider.scopes ?? ["openid", "profile", "email"]).join(" ")
+    );
     url.searchParams.set("state", state);
     url.searchParams.set("nonce", nonce);
     return url.toString();
@@ -2891,23 +4467,26 @@ var AdminAuthController = class {
     const parsedState = await this.verifyState(state, provider.id);
     const discovery = await this.getOidcDiscovery(provider);
     const redirectUri = provider.redirectUri || this.defaultCallbackPath(provider.id, new URL(c.req.url).origin);
-    const tokenResponse = await fetch(provider.tokenEndpoint || discovery.token_endpoint, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({
-        grant_type: "authorization_code",
-        code,
-        redirect_uri: redirectUri,
-        client_id: provider.clientId,
-        client_secret: provider.clientSecret
-      })
-    });
+    const tokenResponse = await fetch(
+      provider.tokenEndpoint || discovery.token_endpoint,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "authorization_code",
+          code,
+          redirect_uri: redirectUri,
+          client_id: provider.clientId,
+          client_secret: provider.clientSecret
+        })
+      }
+    );
     if (!tokenResponse.ok) {
       throw new Error("OIDC token exchange failed.");
     }
     const tokenBody = await tokenResponse.json();
     const idToken = tokenBody.id_token;
-    let claims = {};
+    let claims;
     if (idToken) {
       const jwks = (0, import_jose2.createRemoteJWKSet)(new URL(discovery.jwks_uri));
       const { payload } = await (0, import_jose2.jwtVerify)(idToken, jwks, {
@@ -2919,9 +4498,12 @@ var AdminAuthController = class {
       }
       claims = payload;
     } else if (tokenBody.access_token && (provider.userInfoEndpoint || discovery.userinfo_endpoint)) {
-      const userInfo = await fetch(provider.userInfoEndpoint || discovery.userinfo_endpoint, {
-        headers: { Authorization: `Bearer ${tokenBody.access_token}` }
-      });
+      const userInfo = await fetch(
+        provider.userInfoEndpoint || discovery.userinfo_endpoint,
+        {
+          headers: { Authorization: `Bearer ${tokenBody.access_token}` }
+        }
+      );
       if (!userInfo.ok) throw new Error("OIDC userinfo request failed.");
       claims = await userInfo.json();
     } else {
@@ -2966,7 +4548,10 @@ var AdminAuthController = class {
       }
     }
     return {
-      identity: this.mapClaims(claims, provider.claimMapping),
+      identity: this.mapClaims(
+        claims,
+        provider.claimMapping
+      ),
       returnTo: this.normalizeReturnTo(
         body?.returnTo || c.req.query("returnTo"),
         c
@@ -2990,9 +4575,15 @@ var AdminAuthController = class {
       email: this.readStringClaim(claims[emailKey]),
       name: this.readStringClaim(claims[nameKey]),
       roles: this.readStringArrayClaim(rolesKey ? claims[rolesKey] : void 0),
-      groups: this.readStringArrayClaim(groupsKey ? claims[groupsKey] : void 0),
-      siteIds: this.readStringArrayClaim(siteIdsKey ? claims[siteIdsKey] : void 0),
-      workspaceIds: this.readStringArrayClaim(workspaceIdsKey ? claims[workspaceIdsKey] : void 0),
+      groups: this.readStringArrayClaim(
+        groupsKey ? claims[groupsKey] : void 0
+      ),
+      siteIds: this.readStringArrayClaim(
+        siteIdsKey ? claims[siteIdsKey] : void 0
+      ),
+      workspaceIds: this.readStringArrayClaim(
+        workspaceIdsKey ? claims[workspaceIdsKey] : void 0
+      ),
       rawClaims: claims
     };
   }
@@ -3002,7 +4593,9 @@ var AdminAuthController = class {
   readStringArrayClaim(value) {
     if (!value) return void 0;
     if (Array.isArray(value)) {
-      return value.filter((entry) => typeof entry === "string");
+      return value.filter(
+        (entry) => typeof entry === "string"
+      );
     }
     if (typeof value === "string") return [value];
     return void 0;
@@ -3012,7 +4605,8 @@ var AdminAuthController = class {
       provider.issuer.replace(/\/$/, "") + "/.well-known/openid-configuration"
     );
     const response = await fetch(discoveryUrl.toString());
-    if (!response.ok) throw new Error("Failed to load OIDC discovery document.");
+    if (!response.ok)
+      throw new Error("Failed to load OIDC discovery document.");
     return response.json();
   }
   defaultCallbackPath(providerId, origin = "") {
@@ -3069,7 +4663,10 @@ var PreviewController = class {
   async createToken(c) {
     const body = await c.req.json().catch(() => null);
     if (!body?.collectionSlug || !body?.data) {
-      return c.json({ error: true, message: "collectionSlug and data are required." }, 400);
+      return c.json(
+        { error: true, message: "collectionSlug and data are required." },
+        400
+      );
     }
     const token = await new import_jose3.SignJWT({
       collectionSlug: body.collectionSlug,
@@ -3086,13 +4683,19 @@ var PreviewController = class {
   async getData(c) {
     const token = c.req.query("token");
     if (!token) {
-      return c.json({ error: true, message: "token query parameter is required." }, 400);
+      return c.json(
+        { error: true, message: "token query parameter is required." },
+        400
+      );
     }
     try {
       const { payload } = await (0, import_jose3.jwtVerify)(token, this.getSecret());
       return c.json(payload);
-    } catch (err) {
-      return c.json({ error: true, message: "Invalid or expired preview token." }, 401);
+    } catch (_err) {
+      return c.json(
+        { error: true, message: "Invalid or expired preview token." },
+        401
+      );
     }
   }
 };
@@ -3168,9 +4771,15 @@ var AuditController = class {
     if (!access.allowed) {
       return { denied: true, where: {} };
     }
-    let where = { collection: { equals: collection.slug } };
+    let where = {
+      collection: { equals: collection.slug }
+    };
     if (access.constraint) {
-      const ids = await this.collectAccessibleDocumentIds(config.db, collection, access.constraint);
+      const ids = await this.collectAccessibleDocumentIds(
+        config.db,
+        collection,
+        access.constraint
+      );
       where = mergeWhereConstraint(where, { documentId: { in: ids } });
     }
     return { denied: false, where };
@@ -3183,8 +4792,11 @@ var AuditController = class {
     }
     const siteId = c.req.header("X-Site-Id") || c.get("siteId");
     if (config.onSchemaFetch && siteId) {
-      const dynamic = await config.onSchemaFetch(siteId);
-      for (const collection of dynamic.collections || []) {
+      const requestConfig = mergeDynamicConfig(
+        config,
+        await config.onSchemaFetch(siteId)
+      );
+      for (const collection of requestConfig.collections) {
         if (!collections.has(collection.slug)) {
           collections.set(collection.slug, collection);
         }
@@ -3195,11 +4807,18 @@ var AuditController = class {
   async findForCollection(c, collection) {
     const config = c.get("config");
     if (!config.db) return c.json({ message: "Database not configured" }, 500);
-    if (!collection.audit) return c.json({ message: "Audit is not enabled for this collection" }, 404);
+    if (!collection.audit)
+      return c.json(
+        { message: "Audit is not enabled for this collection" },
+        404
+      );
     const query = this.parseQuery(c);
     const scope = await this.buildCollectionAuditScope(c, collection);
     if (scope.denied) {
-      return c.json({ error: true, message: `Access denied: read on ${collection.slug}` }, 403);
+      return c.json(
+        { error: true, message: `Access denied: read on ${collection.slug}` },
+        403
+      );
     }
     const where = query.where ? mergeWhereConstraint(scope.where, query.where) : scope.where;
     const result = await config.db.find({
@@ -3215,7 +4834,9 @@ var AuditController = class {
     const config = c.get("config");
     if (!config.db) return c.json({ message: "Database not configured" }, 500);
     const query = this.parseQuery(c);
-    const collections = (await this.getVisibleCollections(c)).filter((collection) => collection.audit);
+    const collections = (await this.getVisibleCollections(c)).filter(
+      (collection) => collection.audit
+    );
     const scopes = [];
     for (const collection of collections) {
       const scope = await this.buildCollectionAuditScope(c, collection);
@@ -3246,8 +4867,7 @@ function getBearerToken(c) {
   const authHeader = c.req.header("Authorization");
   return authHeader?.replace(/^Bearer\s+/i, "") || void 0;
 }
-async function resolveUser(token, config) {
-  const payload = await verifyCollectionToken(token);
+async function resolveUser(payload, config) {
   if (payload.purpose) {
     return payload;
   }
@@ -3262,7 +4882,12 @@ async function resolveUser(token, config) {
       id: payload.sub
     });
   } catch (err) {
-    console.error("[dyrected/core] Failed to hydrate user from token:", err);
+    getConfigLogger(config, "auth").error({
+      err,
+      msg: "Failed to hydrate user from token",
+      collection: payload.collection,
+      userId: payload.sub
+    });
     return payload;
   }
   if (!doc) {
@@ -3276,6 +4901,18 @@ async function resolveUser(token, config) {
     collection: payload.collection
   };
 }
+async function resolveAuthenticatedRequest(token, config, clientIp) {
+  const payload = await verifyCollectionToken(token);
+  if (payload.sid && config?.db) {
+    const session = await getAuthSession(config, payload.sid);
+    if (!isAuthSessionActive(session) || session.userId !== payload.sub || session.collection !== payload.collection) {
+      throw new Error("Invalid or expired session.");
+    }
+    await touchAuthSession(config, payload.sid, { ip: clientIp });
+  }
+  const user = await resolveUser(payload, config);
+  return { user, payload };
+}
 function requireAuth(config) {
   return async (c, next) => {
     if (c.get("user")) {
@@ -3283,18 +4920,42 @@ function requireAuth(config) {
     }
     const token = getBearerToken(c);
     if (!token) {
+      c.get("observability")?.recordAuthFailure({
+        reason: "missing_token",
+        path: c.req.path
+      });
       return c.json({ error: true, message: "Authentication required." }, 401);
     }
     let user;
+    let payload;
     try {
-      user = await resolveUser(token, config ?? c.get("config"));
-    } catch {
+      const resolved = await resolveAuthenticatedRequest(
+        token,
+        config ?? c.get("config"),
+        c.get("clientIp")
+      );
+      user = resolved.user;
+      payload = resolved.payload;
+    } catch (err) {
+      c.get("observability")?.recordAuthFailure({
+        reason: "invalid_token",
+        path: c.req.path
+      });
+      getRequestLogger(c, "auth").warn({
+        err,
+        msg: "Rejected invalid or expired token"
+      });
       return c.json({ error: true, message: "Invalid or expired token." }, 401);
     }
     if (!user) {
+      c.get("observability")?.recordAuthFailure({
+        reason: "missing_user",
+        path: c.req.path
+      });
       return c.json({ error: true, message: "Invalid or expired token." }, 401);
     }
     c.set("user", user);
+    c.set("authTokenPayload", payload);
     await next();
   };
 }
@@ -3306,10 +4967,16 @@ function optionalAuth(config) {
     const token = getBearerToken(c);
     if (token) {
       try {
-        const user = await resolveUser(token, config ?? c.get("config"));
+        const resolved = await resolveAuthenticatedRequest(
+          token,
+          config ?? c.get("config"),
+          c.get("clientIp")
+        );
+        const user = resolved.user;
         if (user) {
           c.set("user", user);
         }
+        c.set("authTokenPayload", resolved.payload);
       } catch {
       }
     }
@@ -3358,7 +5025,15 @@ function generateOpenApi(config) {
         },
         WorkflowHistoryEntry: {
           type: "object",
-          required: ["collection", "documentId", "transition", "from", "to", "revision", "createdAt"],
+          required: [
+            "collection",
+            "documentId",
+            "transition",
+            "from",
+            "to",
+            "revision",
+            "createdAt"
+          ],
           properties: {
             id: { type: "string" },
             collection: { type: "string" },
@@ -3383,7 +5058,11 @@ function generateOpenApi(config) {
             user: { type: "string", nullable: true },
             timestamp: { type: "string", format: "date-time" },
             changes: {
-              oneOf: [{ type: "string" }, { type: "object", additionalProperties: true }, { type: "null" }]
+              oneOf: [
+                { type: "string" },
+                { type: "object", additionalProperties: true },
+                { type: "null" }
+              ]
             }
           }
         },
@@ -3475,13 +5154,17 @@ function generateOpenApi(config) {
     get: {
       tags: ["Preferences"],
       summary: "Get an authenticated user preference",
-      parameters: [{ name: "key", in: "path", required: true, schema: { type: "string" } }],
+      parameters: [
+        { name: "key", in: "path", required: true, schema: { type: "string" } }
+      ],
       responses: { 200: { description: "Preference value" } }
     },
     put: {
       tags: ["Preferences"],
       summary: "Set an authenticated user preference",
-      parameters: [{ name: "key", in: "path", required: true, schema: { type: "string" } }],
+      parameters: [
+        { name: "key", in: "path", required: true, schema: { type: "string" } }
+      ],
       requestBody: {
         required: true,
         content: { "application/json": { schema: { type: "object" } } }
@@ -3517,10 +5200,23 @@ function generateOpenApi(config) {
       tags: ["Audit"],
       summary: "Get audit entries across all readable audited collections",
       parameters: [
-        { name: "limit", in: "query", schema: { type: "integer", default: 50, maximum: 100 } },
+        {
+          name: "limit",
+          in: "query",
+          schema: { type: "integer", default: 50, maximum: 100 }
+        },
         { name: "page", in: "query", schema: { type: "integer", default: 1 } },
-        { name: "where", in: "query", schema: { type: "string" }, description: "JSON filter" },
-        { name: "sort", in: "query", schema: { type: "string", default: "-timestamp" } }
+        {
+          name: "where",
+          in: "query",
+          schema: { type: "string" },
+          description: "JSON filter"
+        },
+        {
+          name: "sort",
+          in: "query",
+          schema: { type: "string", default: "-timestamp" }
+        }
       ],
       responses: {
         200: {
@@ -3725,10 +5421,27 @@ function generateOpenApi(config) {
           tags: [collectionTag],
           summary: `Get ${labels.singular} audit entries`,
           parameters: [
-            { name: "limit", in: "query", schema: { type: "integer", default: 50, maximum: 100 } },
-            { name: "page", in: "query", schema: { type: "integer", default: 1 } },
-            { name: "where", in: "query", schema: { type: "string" }, description: "JSON filter" },
-            { name: "sort", in: "query", schema: { type: "string", default: "-timestamp" } }
+            {
+              name: "limit",
+              in: "query",
+              schema: { type: "integer", default: 50, maximum: 100 }
+            },
+            {
+              name: "page",
+              in: "query",
+              schema: { type: "integer", default: 1 }
+            },
+            {
+              name: "where",
+              in: "query",
+              schema: { type: "string" },
+              description: "JSON filter"
+            },
+            {
+              name: "sort",
+              in: "query",
+              schema: { type: "string", default: "-timestamp" }
+            }
           ],
           responses: {
             200: {
@@ -3854,6 +5567,15 @@ function generateOpenApi(config) {
         post: {
           tags: [collectionTag],
           summary: `Log out of ${labels.plural}`,
+          parameters: [
+            {
+              name: "allSessions",
+              in: "query",
+              required: false,
+              schema: { type: "boolean" },
+              description: "Revoke every active session for this account instead of only the current one."
+            }
+          ],
           responses: { 200: { description: "Logged out" } }
         }
       };
@@ -3879,7 +5601,11 @@ function generateOpenApi(config) {
         post: {
           tags: [collectionTag],
           summary: "Refresh an authentication token",
-          responses: { 200: { description: "Refreshed token" } }
+          responses: {
+            200: {
+              description: "Refreshed token for the current active session"
+            }
+          }
         }
       };
       spec.paths[`${path}/forgot-password`] = {
@@ -3910,7 +5636,11 @@ function generateOpenApi(config) {
               schema: { type: "string" }
             }
           ],
-          responses: { 200: { description: "Password changed" } }
+          responses: {
+            200: {
+              description: "Password changed and active sessions revoked"
+            }
+          }
         }
       };
     }
@@ -4119,7 +5849,7 @@ function fieldsToProperties(fields) {
   return { properties: props, required };
 }
 function fieldToSchema(field) {
-  let schema = {};
+  let schema;
   switch (field.type) {
     case "text":
     case "textarea":
@@ -4128,7 +5858,10 @@ function fieldToSchema(field) {
       break;
     case "url":
       schema = {
-        oneOf: [{ type: "string" }, { type: "object", additionalProperties: true }]
+        oneOf: [
+          { type: "string" },
+          { type: "object", additionalProperties: true }
+        ]
       };
       break;
     case "icon":
@@ -4290,7 +6023,10 @@ function accessGate(config, target, action) {
       req: toHookRequestContext(c.req)
     });
     if (!allowed) {
-      return c.json({ error: true, message: `Access denied: ${action} on ${target.slug}` }, 403);
+      return c.json(
+        { error: true, message: `Access denied: ${action} on ${target.slug}` },
+        403
+      );
     }
     await next();
   };
@@ -4314,228 +6050,276 @@ function serializeFieldForApi(f) {
   if (serialized.fields) {
     serialized.fields = serialized.fields.map(serializeFieldForApi);
   }
-  if (serialized.blocks) {
+  if (serialized.blocks && !serialized.blockReferences?.length) {
     serialized.blocks = serialized.blocks.map((b) => ({
       ...b,
       fields: b.fields?.map(serializeFieldForApi)
     }));
+  } else if (serialized.blockReferences?.length) {
+    delete serialized.blocks;
   }
   return serialized;
 }
+function serializeBlockForApi(block) {
+  return {
+    ...block,
+    fields: block.fields?.map(serializeFieldForApi)
+  };
+}
 function registerRoutes(app, config) {
   const optionsCache = /* @__PURE__ */ new Map();
   app.get("/api/schemas", optionalAuth(config), async (c) => {
     const siteId = c.req.header("X-Site-Id");
-    let collections = [...config.collections];
-    let globals = [...config.globals];
-    if (siteId && config.onSchemaFetch) {
-      const dynamic = await config.onSchemaFetch(siteId);
-      if (dynamic.collections) collections = [...collections, ...dynamic.collections];
-      if (dynamic.globals) globals = [...globals, ...dynamic.globals];
-      if (dynamic.admin) {
-        config.admin = { ...config.admin, ...dynamic.admin };
-      }
-      if (dynamic.adminAuth) {
-        config.adminAuth = { ...config.adminAuth, ...dynamic.adminAuth };
-      }
-    }
+    const requestConfig = siteId && config.onSchemaFetch ? mergeDynamicConfig(config, await config.onSchemaFetch(siteId)) : config;
+    const collections = [...requestConfig.collections];
+    const globals = [...requestConfig.globals];
     const user = c.get("user");
     const accessArgs = { user, req: toHookRequestContext(c.req) };
     const serializeAccess = async (access) => {
       if (typeof access === "string") return access;
       if (typeof access === "boolean") return access;
       if (access && typeof access === "object" && typeof access.policy === "string") {
-        const policy = config.accessPolicies?.[access.policy];
-        if (typeof policy === "string" || typeof policy === "boolean") return policy;
+        const policy = requestConfig.accessPolicies?.[access.policy];
+        if (typeof policy === "string" || typeof policy === "boolean")
+          return policy;
       }
-      return resolveBooleanAccess(config, access, accessArgs);
+      return resolveBooleanAccess(requestConfig, access, accessArgs);
     };
-    const filteredCollections = await Promise.all(collections.filter((col) => !siteId || col.shared || !col.siteId || col.siteId === siteId).map(async (col) => ({
-      slug: col.slug,
-      labels: col.labels,
-      access: {
-        read: await serializeAccess(col.access?.read),
-        create: await serializeAccess(col.access?.create),
-        update: await serializeAccess(col.access?.update),
-        delete: await serializeAccess(col.access?.delete)
-      },
-      fields: await Promise.all(col.fields.map(serializeFieldForApi).map(async (f) => ({
-        name: f.name,
-        type: f.type,
-        label: f.label,
-        required: f.required,
-        defaultValue: f.defaultValue,
-        options: f.options,
-        relationTo: f.relationTo,
-        hasMany: f.hasMany,
-        fields: f.fields,
-        blocks: f.blocks,
-        collection: f.collection,
-        on: f.on,
-        limit: f.limit,
-        admin: f.admin,
+    const filteredCollections = await Promise.all(
+      collections.filter(
+        (col) => !siteId || col.shared || !col.siteId || col.siteId === siteId
+      ).map(async (col) => ({
+        slug: col.slug,
+        labels: col.labels,
         access: {
-          read: await serializeAccess(f.access?.read),
-          create: await serializeAccess(f.access?.create),
-          update: await serializeAccess(f.access?.update)
-        }
-      }))),
-      upload: !!col.upload,
-      auth: !!col.auth,
-      audit: !!col.audit,
-      drafts: !!col.drafts,
-      admin: col.admin,
-      workflow: col.workflow ? {
-        initialState: col.workflow.initialState,
-        draftState: col.workflow.draftState,
-        states: col.workflow.states,
-        transitions: col.workflow.transitions.map((t) => ({
-          name: t.name,
-          label: t.label,
-          from: t.from,
-          to: t.to,
-          requiredCapabilities: t.requiredCapabilities,
-          requireComment: t.requireComment,
-          unpublish: t.unpublish
-        })),
-        roles: col.workflow.roles
-      } : void 0
-    })));
-    const filteredGlobals = await Promise.all(globals.filter((glb) => !siteId || glb.shared || !glb.siteId || glb.siteId === siteId).map(async (glb) => ({
-      slug: glb.slug,
-      label: glb.label,
-      access: {
-        read: await serializeAccess(glb.access?.read),
-        update: await serializeAccess(glb.access?.update)
-      },
-      fields: await Promise.all(glb.fields.map(serializeFieldForApi).map(async (f) => ({
-        name: f.name,
-        type: f.type,
-        label: f.label,
-        required: f.required,
-        defaultValue: f.defaultValue,
-        options: f.options,
-        relationTo: f.relationTo,
-        hasMany: f.hasMany,
-        fields: f.fields,
-        blocks: f.blocks,
-        collection: f.collection,
-        on: f.on,
-        limit: f.limit,
-        admin: f.admin,
+          read: await serializeAccess(col.access?.read),
+          create: await serializeAccess(col.access?.create),
+          update: await serializeAccess(col.access?.update),
+          delete: await serializeAccess(col.access?.delete)
+        },
+        fields: await Promise.all(
+          col.fields.map(serializeFieldForApi).map(async (f) => ({
+            name: f.name,
+            type: f.type,
+            label: f.label,
+            required: f.required,
+            defaultValue: f.defaultValue,
+            options: f.options,
+            relationTo: f.relationTo,
+            hasMany: f.hasMany,
+            fields: f.fields,
+            blocks: f.blocks,
+            blockReferences: f.blockReferences,
+            collection: f.collection,
+            on: f.on,
+            limit: f.limit,
+            admin: f.admin,
+            access: {
+              read: await serializeAccess(f.access?.read),
+              create: await serializeAccess(f.access?.create),
+              update: await serializeAccess(f.access?.update)
+            }
+          }))
+        ),
+        upload: !!col.upload,
+        auth: !!col.auth,
+        audit: !!col.audit,
+        drafts: !!col.drafts,
+        admin: col.admin,
+        workflow: col.workflow ? {
+          initialState: col.workflow.initialState,
+          draftState: col.workflow.draftState,
+          states: col.workflow.states,
+          transitions: col.workflow.transitions.map((t) => ({
+            name: t.name,
+            label: t.label,
+            from: t.from,
+            to: t.to,
+            requiredCapabilities: t.requiredCapabilities,
+            requireComment: t.requireComment,
+            unpublish: t.unpublish
+          })),
+          roles: col.workflow.roles
+        } : void 0
+      }))
+    );
+    const filteredGlobals = await Promise.all(
+      globals.filter(
+        (glb) => !siteId || glb.shared || !glb.siteId || glb.siteId === siteId
+      ).map(async (glb) => ({
+        slug: glb.slug,
+        label: glb.label,
         access: {
-          read: await serializeAccess(f.access?.read),
-          update: await serializeAccess(f.access?.update)
-        }
-      }))),
-      admin: glb.admin
-    })));
+          read: await serializeAccess(glb.access?.read),
+          update: await serializeAccess(glb.access?.update)
+        },
+        fields: await Promise.all(
+          glb.fields.map(serializeFieldForApi).map(async (f) => ({
+            name: f.name,
+            type: f.type,
+            label: f.label,
+            required: f.required,
+            defaultValue: f.defaultValue,
+            options: f.options,
+            relationTo: f.relationTo,
+            hasMany: f.hasMany,
+            fields: f.fields,
+            blocks: f.blocks,
+            blockReferences: f.blockReferences,
+            collection: f.collection,
+            on: f.on,
+            limit: f.limit,
+            admin: f.admin,
+            access: {
+              read: await serializeAccess(f.access?.read),
+              update: await serializeAccess(f.access?.update)
+            }
+          }))
+        ),
+        admin: glb.admin
+      }))
+    );
     return c.json({
+      blocks: requestConfig.blocks?.map(serializeBlockForApi),
       collections: filteredCollections,
       globals: filteredGlobals,
-      admin: config.admin || {},
-      adminAuth: getPublicAdminAuthConfig(config.adminAuth, collections)
+      admin: requestConfig.admin || {},
+      adminAuth: getPublicAdminAuthConfig(requestConfig.adminAuth, collections)
     });
   });
-  app.get("/api/dyrected/options/:collection/:field", optionalAuth(config), async (c) => {
-    const { collection: colSlug, field: fieldName } = c.req.param();
-    const siteId = c.req.header("X-Site-Id");
-    let collections = [...config.collections];
-    if (siteId && config.onSchemaFetch) {
-      const dynamic = await config.onSchemaFetch(siteId);
-      if (dynamic.collections) collections = [...collections, ...dynamic.collections];
-    }
-    const user = c.get("user");
-    let collection = collections.find((col) => col.slug === colSlug);
-    let field;
-    if (collection) {
-      const accessExpr = collection.access?.read;
-      if (accessExpr !== void 0 && accessExpr !== null) {
-        const allowed = await resolveBooleanAccess(config, accessExpr, {
-          user,
-          req: toHookRequestContext(c.req)
-        });
-        if (!allowed) {
-          return c.json({ error: true, message: `Access denied: read on ${colSlug}` }, 403);
+  app.get(
+    "/api/dyrected/options/:collection/:field",
+    optionalAuth(config),
+    async (c) => {
+      const { collection: colSlug, field: fieldName } = c.req.param();
+      const siteId = c.req.header("X-Site-Id");
+      const requestConfig = siteId && config.onSchemaFetch ? mergeDynamicConfig(config, await config.onSchemaFetch(siteId)) : config;
+      let collections = [...requestConfig.collections];
+      const user = c.get("user");
+      let collection = collections.find((col) => col.slug === colSlug);
+      let field;
+      if (collection) {
+        const accessExpr = collection.access?.read;
+        if (accessExpr !== void 0 && accessExpr !== null) {
+          const allowed = await resolveBooleanAccess(config, accessExpr, {
+            user,
+            req: toHookRequestContext(c.req)
+          });
+          if (!allowed) {
+            return c.json(
+              { error: true, message: `Access denied: read on ${colSlug}` },
+              403
+            );
+          }
+        }
+        field = collection.fields.find((f) => f.name === fieldName);
+      } else {
+        const globals = [...requestConfig.globals];
+        const glb = globals.find((g) => g.slug === colSlug);
+        if (!glb) {
+          return c.json(
+            {
+              error: true,
+              message: `${colSlug} not found as collection or global`
+            },
+            404
+          );
+        }
+        const accessExpr = glb.access?.read;
+        if (accessExpr !== void 0 && accessExpr !== null) {
+          const allowed = await resolveBooleanAccess(config, accessExpr, {
+            user,
+            req: toHookRequestContext(c.req)
+          });
+          if (!allowed) {
+            return c.json(
+              {
+                error: true,
+                message: `Access denied: read on global ${colSlug}`
+              },
+              403
+            );
+          }
         }
+        field = glb.fields.find((f) => f.name === fieldName);
       }
-      field = collection.fields.find((f) => f.name === fieldName);
-    } else {
-      let globals = [...config.globals];
-      if (siteId && config.onSchemaFetch) {
-        const dynamic = await config.onSchemaFetch(siteId);
-        if (dynamic.globals) globals = [...globals, ...dynamic.globals];
+      if (!field) {
+        return c.json(
+          {
+            error: true,
+            message: `Field ${fieldName} not found in ${colSlug}`
+          },
+          404
+        );
+      }
+      let resolver;
+      let cacheTTL;
+      if (typeof field.options === "function") {
+        resolver = field.options;
+      } else if (field.options && typeof field.options === "object" && "resolve" in field.options) {
+        resolver = field.options.resolve;
+        cacheTTL = field.options.cacheTTL;
       }
-      const glb = globals.find((g) => g.slug === colSlug);
-      if (!glb) {
-        return c.json({ error: true, message: `${colSlug} not found as collection or global` }, 404);
+      if (!resolver) {
+        return c.json(
+          {
+            error: true,
+            message: `Field ${fieldName} in ${colSlug} is not dynamic`
+          },
+          400
+        );
       }
-      const accessExpr = glb.access?.read;
-      if (accessExpr !== void 0 && accessExpr !== null) {
-        const allowed = await resolveBooleanAccess(config, accessExpr, {
+      try {
+        const db = c.get("db") || config.db;
+        const queryParams = c.req.query();
+        const reqContext = {
+          query: queryParams,
+          headers: c.req.header(),
+          raw: c.req.raw
+        };
+        const shouldCache = typeof cacheTTL === "number" && cacheTTL > 0;
+        let cacheKey = "";
+        if (shouldCache) {
+          cacheKey = JSON.stringify([
+            siteId ?? "",
+            colSlug,
+            fieldName,
+            user?.id ?? null,
+            queryParams
+          ]);
+          const hit = optionsCache.get(cacheKey);
+          if (hit && hit.expires > Date.now()) {
+            return c.json(hit.value);
+          }
+        }
+        const result = await resolver({
+          db,
           user,
-          req: toHookRequestContext(c.req)
+          req: reqContext
         });
-        if (!allowed) {
-          return c.json({ error: true, message: `Access denied: read on global ${colSlug}` }, 403);
-        }
-      }
-      field = glb.fields.find((f) => f.name === fieldName);
-    }
-    if (!field) {
-      return c.json({ error: true, message: `Field ${fieldName} not found in ${colSlug}` }, 404);
-    }
-    let resolver;
-    let cacheTTL;
-    if (typeof field.options === "function") {
-      resolver = field.options;
-    } else if (field.options && typeof field.options === "object" && "resolve" in field.options) {
-      resolver = field.options.resolve;
-      cacheTTL = field.options.cacheTTL;
-    }
-    if (!resolver) {
-      return c.json({ error: true, message: `Field ${fieldName} in ${colSlug} is not dynamic` }, 400);
-    }
-    try {
-      const db = c.get("db") || config.db;
-      const queryParams = c.req.query();
-      const reqContext = {
-        query: queryParams,
-        headers: c.req.header(),
-        raw: c.req.raw
-      };
-      const shouldCache = typeof cacheTTL === "number" && cacheTTL > 0;
-      let cacheKey = "";
-      if (shouldCache) {
-        cacheKey = JSON.stringify([
-          siteId ?? "",
-          colSlug,
-          fieldName,
-          user?.id ?? null,
-          queryParams
-        ]);
-        const hit = optionsCache.get(cacheKey);
-        if (hit && hit.expires > Date.now()) {
-          return c.json(hit.value);
+        if (shouldCache) {
+          optionsCache.set(cacheKey, {
+            expires: Date.now() + cacheTTL * 1e3,
+            value: result
+          });
         }
-      }
-      const result = await resolver({
-        db,
-        user,
-        req: reqContext
-      });
-      if (shouldCache) {
-        optionsCache.set(cacheKey, {
-          expires: Date.now() + cacheTTL * 1e3,
-          value: result
+        return c.json(result);
+      } catch (err) {
+        getRequestLogger(c, "router").error({
+          err,
+          msg: "Failed to resolve dynamic field options",
+          fieldName
         });
+        return c.json(
+          {
+            error: true,
+            message: err.message || "Failed to resolve dynamic options"
+          },
+          500
+        );
       }
-      return c.json(result);
-    } catch (err) {
-      console.error(`[dyrected/core] Failed to resolve dynamic options for field ${fieldName}:`, err);
-      return c.json({ error: true, message: err.message || "Failed to resolve dynamic options" }, 500);
     }
-  });
+  );
   app.get("/api/openapi.json", (c) => {
     return c.json(generateOpenApi(config));
   });
@@ -4548,10 +6332,18 @@ function registerRoutes(app, config) {
     const key = c.req.param("key");
     const scope = c.req.query("scope");
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
+    if (!user?.collection || !user.sub)
+      return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key)
+      return c.json(
+        { error: true, message: "Preference key is required." },
+        400
+      );
     const getGlobalPreference = async () => {
-      const globalDoc = await db.findOne({ collection: "__global_preferences", id: key });
+      const globalDoc = await db.findOne({
+        collection: "__global_preferences",
+        id: key
+      });
       return globalDoc ? globalDoc.value : null;
     };
     if (scope === "global") {
@@ -4573,15 +6365,29 @@ function registerRoutes(app, config) {
     const key = c.req.param("key");
     const scope = c.req.query("scope");
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
+    if (!user?.collection || !user.sub)
+      return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key)
+      return c.json(
+        { error: true, message: "Preference key is required." },
+        400
+      );
     const body = await c.req.json().catch(() => ({}));
     if (scope === "global") {
       const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
       if (!isAdminUser) {
-        return c.json({ error: true, message: "Only administrators can save global preferences." }, 403);
+        return c.json(
+          {
+            error: true,
+            message: "Only administrators can save global preferences."
+          },
+          403
+        );
       }
-      const existing = await db.findOne({ collection: "__global_preferences", id: key });
+      const existing = await db.findOne({
+        collection: "__global_preferences",
+        id: key
+      });
       if (existing) {
         await db.update({
           collection: "__global_preferences",
@@ -4613,12 +6419,23 @@ function registerRoutes(app, config) {
     const key = c.req.param("key");
     const scope = c.req.query("scope");
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
+    if (!user?.collection || !user.sub)
+      return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key)
+      return c.json(
+        { error: true, message: "Preference key is required." },
+        400
+      );
     if (scope === "global") {
       const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
       if (!isAdminUser) {
-        return c.json({ error: true, message: "Only administrators can delete global preferences." }, 403);
+        return c.json(
+          {
+            error: true,
+            message: "Only administrators can delete global preferences."
+          },
+          403
+        );
       }
       await db.delete({ collection: "__global_preferences", id: key });
       return c.json({ success: true });
@@ -4647,17 +6464,41 @@ function registerRoutes(app, config) {
     for (const col of uploadCollections) {
       const mediaController = new MediaController(col.slug);
       const prefix = `/api/collections/${col.slug}`;
-      app.get(`${prefix}/media`, accessGate(config, col, "read"), (c) => mediaController.find(c));
-      app.get(`${prefix}/media/:filename{.+$}`, (c) => mediaController.serve(c));
-      app.post(`${prefix}/media`, accessGate(config, col, "create"), (c) => mediaController.upload(c));
-      app.delete(`${prefix}/media/:id`, accessGate(config, col, "delete"), (c) => mediaController.delete(c));
+      app.get(
+        `${prefix}/media`,
+        accessGate(config, col, "read"),
+        (c) => mediaController.find(c)
+      );
+      app.get(
+        `${prefix}/media/:filename{.+$}`,
+        (c) => mediaController.serve(c)
+      );
+      app.post(
+        `${prefix}/media`,
+        accessGate(config, col, "create"),
+        (c) => mediaController.upload(c)
+      );
+      app.delete(
+        `${prefix}/media/:id`,
+        accessGate(config, col, "delete"),
+        (c) => mediaController.delete(c)
+      );
     }
   }
   const adminAuthController = new AdminAuthController(config);
   app.get("/api/admin/auth/providers", (c) => adminAuthController.providers(c));
-  app.get("/api/admin/auth/:provider/start", (c) => adminAuthController.start(c));
-  app.get("/api/admin/auth/:provider/callback", (c) => adminAuthController.callback(c));
-  app.post("/api/admin/auth/:provider/exchange", (c) => adminAuthController.exchange(c));
+  app.get(
+    "/api/admin/auth/:provider/start",
+    (c) => adminAuthController.start(c)
+  );
+  app.get(
+    "/api/admin/auth/:provider/callback",
+    (c) => adminAuthController.callback(c)
+  );
+  app.post(
+    "/api/admin/auth/:provider/exchange",
+    (c) => adminAuthController.exchange(c)
+  );
   app.post("/api/admin/logout", (c) => adminAuthController.logout(c));
   for (const collection of config.collections) {
     if (!collection.auth) continue;
@@ -4668,10 +6509,21 @@ function registerRoutes(app, config) {
     app.get(`${path}/init`, (c) => authController.init(c));
     app.post(`${path}/first-user`, (c) => authController.registerFirstUser(c));
     app.get(`${path}/me`, requireAuth(config), (c) => authController.me(c));
-    app.post(`${path}/refresh-token`, requireAuth(config), (c) => authController.refreshToken(c));
-    app.post(`${path}/forgot-password`, (c) => authController.forgotPassword(c));
+    app.post(
+      `${path}/refresh-token`,
+      requireAuth(config),
+      (c) => authController.refreshToken(c)
+    );
+    app.post(
+      `${path}/forgot-password`,
+      (c) => authController.forgotPassword(c)
+    );
     app.post(`${path}/reset-password`, (c) => authController.resetPassword(c));
-    app.post(`${path}/invite`, requireAuth(config), (c) => authController.invite(c));
+    app.post(
+      `${path}/invite`,
+      requireAuth(config),
+      (c) => authController.invite(c)
+    );
     app.post(`${path}/accept-invite`, (c) => authController.acceptInvite(c));
   }
   const auditController = new AuditController();
@@ -4683,18 +6535,33 @@ function registerRoutes(app, config) {
     app.post(`${path}/media`, (c) => controller.create(c));
     app.delete(`${path}/delete-many`, (c) => controller.deleteMany(c));
     if (collection.audit) {
-      app.get(`${path}/__audit`, (c) => auditController.findForCollection(c, collection));
+      app.get(
+        `${path}/__audit`,
+        (c) => auditController.findForCollection(c, collection)
+      );
     }
     app.get(`${path}/:id`, (c) => controller.findOne(c));
     app.patch(`${path}/:id`, (c) => controller.update(c));
     app.delete(`${path}/:id`, (c) => controller.delete(c));
     app.post(`${path}/seed`, (c) => controller.seed(c));
     if (collection.auth) {
-      app.post(`${path}/:id/change-password`, requireAuth(config), (c) => controller.changePassword(c));
+      app.post(
+        `${path}/:id/change-password`,
+        requireAuth(config),
+        (c) => controller.changePassword(c)
+      );
     }
     if (collection.workflow) {
-      app.post(`${path}/:id/transitions/:transition`, requireAuth(config), (c) => controller.transition(c));
-      app.get(`${path}/:id/workflow-history`, requireAuth(config), (c) => controller.workflowHistory(c));
+      app.post(
+        `${path}/:id/transitions/:transition`,
+        requireAuth(config),
+        (c) => controller.transition(c)
+      );
+      app.get(
+        `${path}/:id/workflow-history`,
+        requireAuth(config),
+        (c) => controller.workflowHistory(c)
+      );
     }
   }
   for (const global of config.globals) {
@@ -4705,12 +6572,16 @@ function registerRoutes(app, config) {
     app.post(`${path}/seed`, (c) => controller.seed(c));
   }
   if (!process.env.DYRECTED_JWT_SECRET) {
-    console.warn(
-      '[dyrected] DYRECTED_JWT_SECRET is not set \u2014 token-mode live preview is signing with an insecure default. Set DYRECTED_JWT_SECRET before relying on `previewMode: "token"` in production.'
-    );
+    getConfigLogger(config, "router").warn({
+      msg: "DYRECTED_JWT_SECRET is not set; token-mode live preview is signing with an insecure default"
+    });
   }
   const previewController = new PreviewController();
-  app.post("/api/preview-token", requireAuth(config), (c) => previewController.createToken(c));
+  app.post(
+    "/api/preview-token",
+    requireAuth(config),
+    (c) => previewController.createToken(c)
+  );
   app.get("/api/preview-data", (c) => previewController.getData(c));
   app.get("/api/audit", (c) => auditController.findAll(c));
   app.get("/api/collections/:slug/__audit", async (c) => {
@@ -4723,49 +6594,81 @@ function registerRoutes(app, config) {
     if (!config2.onSchemaFetch || !siteId) {
       return c.json({ message: `Collection "${slug}" not found` }, 404);
     }
-    const dynamic = await config2.onSchemaFetch(siteId);
-    const collection = dynamic.collections?.find((col) => col.slug === slug);
+    const requestConfig = mergeDynamicConfig(
+      config2,
+      await config2.onSchemaFetch(siteId)
+    );
+    const collection = requestConfig.collections.find(
+      (col) => col.slug === slug
+    );
     if (!collection?.audit) {
-      return c.json({ message: `Collection "${slug}" not found or has no audit log` }, 404);
+      return c.json(
+        { message: `Collection "${slug}" not found or has no audit log` },
+        404
+      );
     }
     return auditController.findForCollection(c, collection);
   });
-  app.post("/api/collections/:slug/:id/transitions/:transition", requireAuth(config), async (c) => {
-    const slug = c.req.param("slug");
-    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
-    const config2 = c.get("config");
-    if (config2.collections.some((col) => col.slug === slug)) {
-      return c.json({ message: "Not Found" }, 404);
-    }
-    if (!config2.onSchemaFetch || !siteId) {
-      return c.json({ message: `Collection "${slug}" not found` }, 404);
-    }
-    const dynamic = await config2.onSchemaFetch(siteId);
-    const collection = dynamic.collections?.find((col) => col.slug === slug);
-    if (!collection?.workflow) {
-      return c.json({ message: `Collection "${slug}" not found or has no workflow` }, 404);
-    }
-    const controller = new CollectionController(collection);
-    return controller.transition(c);
-  });
-  app.get("/api/collections/:slug/:id/workflow-history", requireAuth(config), async (c) => {
-    const slug = c.req.param("slug");
-    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
-    const config2 = c.get("config");
-    if (config2.collections.some((col) => col.slug === slug)) {
-      return c.json({ message: "Not Found" }, 404);
-    }
-    if (!config2.onSchemaFetch || !siteId) {
-      return c.json({ message: `Collection "${slug}" not found` }, 404);
+  app.post(
+    "/api/collections/:slug/:id/transitions/:transition",
+    requireAuth(config),
+    async (c) => {
+      const slug = c.req.param("slug");
+      const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+      const config2 = c.get("config");
+      if (config2.collections.some((col) => col.slug === slug)) {
+        return c.json({ message: "Not Found" }, 404);
+      }
+      if (!config2.onSchemaFetch || !siteId) {
+        return c.json({ message: `Collection "${slug}" not found` }, 404);
+      }
+      const requestConfig = mergeDynamicConfig(
+        config2,
+        await config2.onSchemaFetch(siteId)
+      );
+      const collection = requestConfig.collections.find(
+        (col) => col.slug === slug
+      );
+      if (!collection?.workflow) {
+        return c.json(
+          { message: `Collection "${slug}" not found or has no workflow` },
+          404
+        );
+      }
+      const controller = new CollectionController(collection);
+      return controller.transition(c);
     }
-    const dynamic = await config2.onSchemaFetch(siteId);
-    const collection = dynamic.collections?.find((col) => col.slug === slug);
-    if (!collection?.workflow) {
-      return c.json({ message: `Collection "${slug}" not found or has no workflow` }, 404);
+  );
+  app.get(
+    "/api/collections/:slug/:id/workflow-history",
+    requireAuth(config),
+    async (c) => {
+      const slug = c.req.param("slug");
+      const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+      const config2 = c.get("config");
+      if (config2.collections.some((col) => col.slug === slug)) {
+        return c.json({ message: "Not Found" }, 404);
+      }
+      if (!config2.onSchemaFetch || !siteId) {
+        return c.json({ message: `Collection "${slug}" not found` }, 404);
+      }
+      const requestConfig = mergeDynamicConfig(
+        config2,
+        await config2.onSchemaFetch(siteId)
+      );
+      const collection = requestConfig.collections.find(
+        (col) => col.slug === slug
+      );
+      if (!collection?.workflow) {
+        return c.json(
+          { message: `Collection "${slug}" not found or has no workflow` },
+          404
+        );
+      }
+      const controller = new CollectionController(collection);
+      return controller.workflowHistory(c);
     }
-    const controller = new CollectionController(collection);
-    return controller.workflowHistory(c);
-  });
+  );
   app.all("/api/collections/:slug/:id?", async (c) => {
     const slug = c.req.param("slug");
     const id = c.req.param("id");
@@ -4775,8 +6678,13 @@ function registerRoutes(app, config) {
       return c.json({ message: "Method Not Allowed" }, 405);
     }
     if (config2.onSchemaFetch && siteId) {
-      const dynamic = await config2.onSchemaFetch(siteId);
-      let collection = dynamic.collections?.find((col) => col.slug === slug);
+      const requestConfig = mergeDynamicConfig(
+        config2,
+        await config2.onSchemaFetch(siteId)
+      );
+      let collection = requestConfig.collections.find(
+        (col) => col.slug === slug
+      );
       if (!collection && slug === "media") {
         collection = {
           slug: "media",
@@ -4789,19 +6697,25 @@ function registerRoutes(app, config) {
         if (collection.auth && id) {
           const authController = new AuthController(collection);
           const method2 = c.req.method;
-          if (method2 === "POST" && id === "login") return authController.login(c);
-          if (method2 === "POST" && id === "logout") return authController.logout(c);
+          if (method2 === "POST" && id === "login")
+            return authController.login(c);
+          if (method2 === "POST" && id === "logout")
+            return authController.logout(c);
           if (method2 === "GET" && id === "me") return authController.me(c);
-          if (method2 === "POST" && id === "refresh-token") return authController.refreshToken(c);
-          if (method2 === "POST" && id === "forgot-password") return authController.forgotPassword(c);
-          if (method2 === "POST" && id === "reset-password") return authController.resetPassword(c);
+          if (method2 === "POST" && id === "refresh-token")
+            return authController.refreshToken(c);
+          if (method2 === "POST" && id === "forgot-password")
+            return authController.forgotPassword(c);
+          if (method2 === "POST" && id === "reset-password")
+            return authController.resetPassword(c);
         }
         const controller = new CollectionController(collection);
         const method = c.req.method;
         if (id) {
           if (method === "GET") return controller.findOne(c);
           if (method === "PATCH") return controller.update(c);
-          if (method === "DELETE" && id === "delete-many") return controller.deleteMany(c);
+          if (method === "DELETE" && id === "delete-many")
+            return controller.deleteMany(c);
           if (method === "DELETE") return controller.delete(c);
           if (method === "POST" && id === "media") return controller.create(c);
           if (method === "POST" && id === "seed") return controller.seed(c);
@@ -4822,8 +6736,11 @@ function registerRoutes(app, config) {
       return c.json({ message: "Method Not Allowed" }, 405);
     }
     if (config2.onSchemaFetch && siteId) {
-      const dynamic = await config2.onSchemaFetch(siteId);
-      const global = dynamic.globals?.find((glb) => glb.slug === slug);
+      const requestConfig = mergeDynamicConfig(
+        config2,
+        await config2.onSchemaFetch(siteId)
+      );
+      const global = requestConfig.globals.find((glb) => glb.slug === slug);
       if (global) {
         const controller = new GlobalController(global);
         const method = c.req.method;
@@ -4873,12 +6790,23 @@ var AUDIT_COLLECTION = {
   fields: [
     { name: "collection", type: "text", label: "Collection", required: true },
     { name: "documentId", type: "text", label: "Document ID" },
-    { name: "operation", type: "select", label: "Operation", options: ["create", "update", "delete"], required: true },
+    {
+      name: "operation",
+      type: "select",
+      label: "Operation",
+      options: ["create", "update", "delete"],
+      required: true
+    },
     { name: "user", type: "text", label: "User ID" },
     { name: "timestamp", type: "date", label: "Timestamp", required: true },
     { name: "changes", type: "json", label: "Changes" }
   ],
-  access: { read: () => false, create: () => false, update: () => false, delete: () => false },
+  access: {
+    read: () => false,
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
   admin: { hidden: true }
 };
 var WORKFLOW_HISTORY_COLLECTION_CONFIG = {
@@ -4895,7 +6823,12 @@ var WORKFLOW_HISTORY_COLLECTION_CONFIG = {
     { name: "actorId", type: "text" },
     { name: "createdAt", type: "date", required: true }
   ],
-  access: { read: ({ user }) => !!user, create: () => false, update: () => false, delete: () => false },
+  access: {
+    read: ({ user }) => !!user,
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
   admin: { hidden: true }
 };
 var LIFECYCLE_EVENTS_COLLECTION_CONFIG = {
@@ -4909,22 +6842,56 @@ var LIFECYCLE_EVENTS_COLLECTION_CONFIG = {
     { name: "actorId", type: "text" },
     { name: "payload", type: "json", required: true },
     { name: "attempts", type: "number", required: true },
-    { name: "status", type: "select", options: ["pending", "processing", "delivered", "failed"], required: true },
+    {
+      name: "status",
+      type: "select",
+      options: ["pending", "processing", "delivered", "failed"],
+      required: true
+    },
     { name: "nextAttemptAt", type: "date" },
     { name: "deliveredAt", type: "date" },
     { name: "lastError", type: "textarea" }
   ],
-  access: { read: ({ user }) => !!user?.roles?.includes("admin"), create: () => false, update: () => false, delete: () => false },
+  access: {
+    read: ({ user }) => !!user?.roles?.includes("admin"),
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
+  admin: { hidden: true }
+};
+var AUTH_SESSIONS_COLLECTION_CONFIG = {
+  slug: AUTH_SESSIONS_COLLECTION,
+  labels: { singular: "Auth session", plural: "Auth sessions" },
+  fields: [
+    { name: "userId", type: "text", required: true },
+    { name: "email", type: "email", required: true },
+    { name: "collection", type: "text", required: true },
+    { name: "authSource", type: "text" },
+    { name: "providerId", type: "text" },
+    { name: "lastIp", type: "text" },
+    { name: "lastSeenAt", type: "date" },
+    { name: "expiresAt", type: "date" },
+    { name: "revokedAt", type: "date" }
+  ],
+  access: {
+    read: () => false,
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
   admin: { hidden: true }
 };
 function normalizeConfig(config) {
-  const collections = config?.collections || [];
-  const globals = config?.globals || [];
+  const schemaAwareConfig = normalizeSchemaFragment(config);
+  const collections = schemaAwareConfig?.collections || [];
+  const globals = schemaAwareConfig?.globals || [];
   const needsAudit = collections.some((col) => col.audit);
   const needsWorkflow = collections.some((col) => col.workflow || col.drafts);
+  const needsAuthSessions = collections.some((col) => !!col.auth);
   const adminAuthCollectionSlug = getAdminAuthCollection({
     collections,
-    adminAuth: config.adminAuth
+    adminAuth: schemaAwareConfig.adminAuth
   })?.slug;
   const normalizedCollections = collections.map((col) => {
     let fields = col.fields || [];
@@ -5021,7 +6988,7 @@ function normalizeConfig(config) {
         return field;
       });
     }
-    if (adminAuthCollectionSlug && col.slug === adminAuthCollectionSlug && config.adminAuth?.mode === "external") {
+    if (adminAuthCollectionSlug && col.slug === adminAuthCollectionSlug && schemaAwareConfig.adminAuth?.mode === "external") {
       const externalAdminFields = [
         {
           name: "authProvider",
@@ -5055,7 +7022,9 @@ function normalizeConfig(config) {
       }
     }
     const updatedFieldNames = new Set(fields.map((f) => f.name));
-    const fieldsToInject = SYSTEM_FIELDS.filter((f) => !updatedFieldNames.has(f.name));
+    const fieldsToInject = SYSTEM_FIELDS.filter(
+      (f) => !updatedFieldNames.has(f.name)
+    );
     const workflow = col.workflow || (col.drafts ? simplePublishingWorkflow() : void 0);
     return {
       ...col,
@@ -5063,52 +7032,309 @@ function normalizeConfig(config) {
       fields: [...fields, ...fieldsToInject]
     };
   });
-  const hasAuditCollection = normalizedCollections.some((col) => col.slug === AUDIT_COLLECTION_SLUG);
+  const hasAuditCollection = normalizedCollections.some(
+    (col) => col.slug === AUDIT_COLLECTION_SLUG
+  );
   const systemCollections = [];
-  if (needsAudit && !hasAuditCollection) systemCollections.push(AUDIT_COLLECTION);
-  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === WORKFLOW_HISTORY_COLLECTION)) {
+  if (needsAudit && !hasAuditCollection)
+    systemCollections.push(AUDIT_COLLECTION);
+  if (needsWorkflow && !normalizedCollections.some(
+    (col) => col.slug === WORKFLOW_HISTORY_COLLECTION
+  )) {
     systemCollections.push(WORKFLOW_HISTORY_COLLECTION_CONFIG);
   }
-  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === LIFECYCLE_EVENTS_COLLECTION)) {
+  if (needsWorkflow && !normalizedCollections.some(
+    (col) => col.slug === LIFECYCLE_EVENTS_COLLECTION
+  )) {
     systemCollections.push(LIFECYCLE_EVENTS_COLLECTION_CONFIG);
   }
+  if (needsAuthSessions && !normalizedCollections.some((col) => col.slug === AUTH_SESSIONS_COLLECTION)) {
+    systemCollections.push(AUTH_SESSIONS_COLLECTION_CONFIG);
+  }
   return {
-    ...config,
+    ...schemaAwareConfig,
     collections: [...normalizedCollections, ...systemCollections],
     globals
   };
 }
 
+// src/network.ts
+var DIRECT_IP_HEADERS = [
+  "cf-connecting-ip",
+  "fly-client-ip",
+  "true-client-ip",
+  "x-real-ip",
+  "x-client-ip",
+  "fastly-client-ip"
+];
+function toHookRequestContext2(c) {
+  const headers = Object.fromEntries(
+    Object.entries(c.req.header()).map(([key, value]) => [key.toLowerCase(), value])
+  );
+  return {
+    query: c.req.query(),
+    headers,
+    raw: c.req.raw
+  };
+}
+function resolveClientIp(req, trustProxy = false) {
+  for (const header of DIRECT_IP_HEADERS) {
+    const value = normalizeIp(req.headers[header]);
+    if (value) return value;
+  }
+  if (trustProxy) {
+    const forwardedFor = pickForwardedFor(req.headers, trustProxy);
+    if (forwardedFor) return forwardedFor;
+  }
+  return "127.0.0.1";
+}
+function pickForwardedFor(headers, trustProxy) {
+  const forwardedHeader = headers["x-forwarded-for"];
+  if (forwardedHeader) {
+    const chain2 = forwardedHeader.split(",").map((entry) => normalizeIp(entry)).filter((entry) => !!entry);
+    if (chain2.length > 0) {
+      if (trustProxy === true) return chain2[0];
+      const trustedHops2 = Math.max(1, Math.floor(trustProxy));
+      const candidateIndex2 = Math.max(0, chain2.length - trustedHops2);
+      return chain2[candidateIndex2] ?? chain2[0];
+    }
+  }
+  const forwarded = headers.forwarded;
+  if (!forwarded) return null;
+  const matches = [...forwarded.matchAll(/for=(?:"?\[?([^;\],"]+)\]?"?)/gi)];
+  if (matches.length === 0) return null;
+  const chain = matches.map((match) => normalizeIp(match[1])).filter((entry) => !!entry);
+  if (chain.length === 0) return null;
+  if (trustProxy === true) return chain[0];
+  const trustedHops = Math.max(1, Math.floor(trustProxy));
+  const candidateIndex = Math.max(0, chain.length - trustedHops);
+  return chain[candidateIndex] ?? chain[0];
+}
+function normalizeIp(value) {
+  if (!value) return null;
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.toLowerCase() === "unknown") return null;
+  return trimmed.replace(/^\[(.*)\]$/, "$1");
+}
+
+// src/middleware/rate-limit.ts
+var DEFAULT_WINDOW_MS = 15 * 60 * 1e3;
+var DEFAULT_MAX_REQUESTS = 500;
+var DEFAULT_PATHS = ["/api"];
+function createRateLimitMiddleware(config) {
+  const settings = normalizeRateLimitConfig(config.rateLimit);
+  const buckets = /* @__PURE__ */ new Map();
+  return async (c, next) => {
+    const req = toHookRequestContext2(c);
+    const ip = resolveClientIp(req, settings.trustProxy);
+    c.set("clientIp", ip);
+    if (!settings.enabled) {
+      return next();
+    }
+    const path = c.req.path;
+    if (!matchesLimitedPath(path, settings.paths)) {
+      return next();
+    }
+    if (settings.skip && await settings.skip({
+      ip,
+      path,
+      method: c.req.method,
+      req
+    })) {
+      return next();
+    }
+    const now = Date.now();
+    const key = ip;
+    const existing = buckets.get(key);
+    const bucket = existing && existing.resetAt > now ? existing : { count: 0, resetAt: now + settings.window };
+    bucket.count += 1;
+    buckets.set(key, bucket);
+    pruneExpiredBuckets(buckets, now);
+    const remaining = Math.max(0, settings.max - bucket.count);
+    const resetSeconds = Math.max(1, Math.ceil((bucket.resetAt - now) / 1e3));
+    c.res.headers.set("X-RateLimit-Limit", String(settings.max));
+    c.res.headers.set("X-RateLimit-Remaining", String(remaining));
+    c.res.headers.set("X-RateLimit-Reset", String(Math.ceil(bucket.resetAt / 1e3)));
+    if (bucket.count > settings.max) {
+      c.res.headers.set("Retry-After", String(resetSeconds));
+      return c.json(
+        {
+          error: true,
+          message: "Too many requests. Try again later.",
+          retryAfterSeconds: resetSeconds
+        },
+        429
+      );
+    }
+    await next();
+  };
+}
+function normalizeRateLimitConfig(config) {
+  return {
+    enabled: config?.enabled ?? true,
+    window: config?.window ?? DEFAULT_WINDOW_MS,
+    max: config?.max ?? DEFAULT_MAX_REQUESTS,
+    paths: config?.paths?.length ? config.paths : DEFAULT_PATHS,
+    skip: config?.skip,
+    trustProxy: config?.trustProxy ?? false
+  };
+}
+function matchesLimitedPath(path, prefixes) {
+  return prefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+}
+function pruneExpiredBuckets(buckets, now) {
+  if (buckets.size < 1e3) return;
+  for (const [key, bucket] of buckets) {
+    if (bucket.resetAt <= now) {
+      buckets.delete(key);
+    }
+  }
+}
+
 // src/app.ts
 async function createDyrectedApp(rawConfig) {
   const config = normalizeConfig(rawConfig);
+  const observability = createObservabilityRuntime(config);
+  bindObservabilityRuntime(config, observability);
+  config.logger = observability.logger;
   const app = new import_hono.Hono();
   if (config.db?.sync) {
     await config.db.sync(config.collections, config.globals);
   }
   app.use("*", (0, import_request_id.requestId)());
-  app.use("*", optionalAuth(config));
-  app.use("*", async (c, next) => {
-    const start = Date.now();
-    await next();
-    const ms = Date.now() - start;
-    console.log(`[dyrected/api] ${c.req.method} ${c.req.path} ${c.res.status} - ${ms}ms`);
-  });
-  app.use("*", (0, import_cors.cors)());
   app.use("*", async (c, next) => {
     c.set("config", config);
+    c.set("observability", observability);
     if (!c.get("siteId")) {
       c.set("siteId", "default");
     }
+    c.set("logger", buildRequestLogger(observability, c.var, c.get("requestId")));
     await next();
   });
+  app.use("*", async (c, next) => {
+    const start = Date.now();
+    const method = c.req.method;
+    const path = c.req.path;
+    const requestId2 = c.get("requestId");
+    const observabilityConfig = observability.config;
+    const traceSampled = shouldSampleRequest(
+      requestId2,
+      200,
+      observabilityConfig.sampling,
+      "trace"
+    );
+    const requestTrace = traceSampled ? createRequestSpan(observability, `${method} ${path}`, {
+      "http.method": method,
+      "http.route": path,
+      requestId: requestId2,
+      siteId: c.get("siteId"),
+      workspaceId: c.get("workspaceId")
+    }) : void 0;
+    if (requestTrace) {
+      c.set("requestTrace", requestTrace);
+      c.set("logger", buildRequestLogger(observability, c.var, requestId2));
+    }
+    let bodyCapturePromise;
+    if (observabilityConfig.requestLogging.logBodies) {
+      const bodySampled = shouldSampleRequest(
+        requestId2,
+        200,
+        observabilityConfig.sampling,
+        "body"
+      );
+      if (bodySampled) {
+        bodyCapturePromise = captureRequestBody(c.req.raw, observabilityConfig);
+      }
+    }
+    let caughtError;
+    try {
+      await next();
+    } catch (error) {
+      caughtError = error;
+      throw error;
+    } finally {
+      const durationMs = Date.now() - start;
+      const statusCode = c.res.status || (caughtError ? 500 : 200);
+      const sampled = shouldSampleRequest(
+        requestId2,
+        statusCode,
+        observabilityConfig.sampling,
+        "log"
+      );
+      const requestLogger = getRequestLogger(c, "api");
+      const requestHeaders = redactHeaders(
+        Object.fromEntries(c.req.raw.headers.entries()),
+        observabilityConfig
+      );
+      const requestBodyCapture = bodyCapturePromise ? await bodyCapturePromise : void 0;
+      if (requestBodyCapture) {
+        c.set("requestBodyCapture", requestBodyCapture);
+      }
+      attachRequestMetrics(observability, {
+        method,
+        route: path,
+        statusCode,
+        durationMs
+      });
+      if (observabilityConfig.requestLogging.enabled && sampled) {
+        const level = statusCode >= 500 ? "error" : statusCode >= 400 ? "warn" : "info";
+        requestLogger[level]({
+          msg: "HTTP request completed",
+          method,
+          path,
+          statusCode,
+          durationMs,
+          requestId: requestId2,
+          siteId: c.get("siteId"),
+          workspaceId: c.get("workspaceId"),
+          contentType: c.req.header("content-type") ?? void 0,
+          contentLength: c.req.header("content-length") ? Number(c.req.header("content-length")) : void 0,
+          sampled,
+          headers: Object.keys(requestHeaders).length > 0 ? requestHeaders : void 0,
+          body: requestBodyCapture?.body,
+          bodyCapture: requestBodyCapture && requestBodyCapture.body === void 0 ? {
+            attempted: requestBodyCapture.attempted,
+            contentType: requestBodyCapture.contentType,
+            contentLength: requestBodyCapture.contentLength,
+            truncated: requestBodyCapture.truncated,
+            parseFailed: requestBodyCapture.parseFailed
+          } : void 0
+        });
+      }
+      endRequestSpan(requestTrace, statusCode, caughtError);
+    }
+  });
+  app.use("*", createRateLimitMiddleware(config));
+  app.use("*", optionalAuth(config));
+  app.use("*", (0, import_cors.cors)(config.cors ? { origin: config.cors.origins } : {}));
   app.get("/health", (c) => c.json({ status: "ok", version: "0.0.1" }));
+  if (observability.config.metrics.enabled && observability.config.metrics.exporter === "prometheus" && observability.prometheusExporter) {
+    app.get(observability.config.metrics.path, async (c) => {
+      const metrics = await renderPrometheusMetrics(
+        observability.prometheusExporter
+      );
+      return new Response(metrics.body, {
+        status: metrics.statusCode,
+        headers: metrics.headers
+      });
+    });
+  }
   app.get("/routes", (c) => {
     const routes = app.routes.map((r) => ({ method: r.method, path: r.path }));
     return c.json({ routes });
   });
   app.onError((err, c) => {
-    console.error(`[dyrected/core] Uncaught Error:`, err);
+    const logger = getRequestLogger(c, "core");
+    logger.error({
+      err,
+      msg: "Uncaught error",
+      path: c.req.path,
+      method: c.req.method
+    });
+    observability.recordUncaughtError({
+      path: c.req.path,
+      method: c.req.method
+    });
     return c.json({
       message: err.message || "Internal Server Error",
       stack: process.env.NODE_ENV === "development" ? err.stack : void 0