@dyrected/core 2.6.3 → 2.6.4

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, W as WorkflowConfig, a as AuthenticatedUser, b as WorkflowTransition, L as LifecycleEventName, c as LifecycleEvent, d as BaseDocument, H as HookRequestContext, e as ArrayField, f as BlocksField, g as BooleanField, h as AuthConfig, G as GlobalConfig, i as AccessPolicyResolver, j as DateField, k as DateTimeField, E as EmailField, I as IconField, l as ImageField, J as JoinField, m as JsonField, M as MultiSelectField, N as NumberField, O as ObjectField, R as RadioField, n as RelationshipField, o as RichTextField, p as RowField, S as SelectField, T as TextField, q as TextareaField, r as TimeField, U as UrlField } from './app-config-DCWinlNK.cjs';
-export { s as AccessFunction, t as AccessFunctionArgs, u as AccessResult, v as AccessRule, w as AdminAuthAccessResolution, x as AdminAuthClaimMapping, y as AdminAuthMember, z as AdminAuthProvider, K as AdminAuthProviderMembersConfig, Q as AdminAuthProvisioningMode, V as AdminAuthResolveAccessArgs, X as AdminAuthResolvedIdentity, Y as AdminConfig, Z as AdminDashboardComponentSlots, _ as AdminIconName, $ as BaseAdminAuthProvider, a0 as BaseFieldAdmin, a1 as BlockVariant, a2 as BooleanFieldAdmin, a3 as BooleanFormat, a4 as CharacterLimitFieldAdmin, a5 as CharacterLimitFieldConfig, a6 as CollectionAfterChangeHook, a7 as CollectionAfterDeleteHook, a8 as CollectionAfterReadHook, a9 as CollectionAfterTransitionHook, aa as CollectionBeforeChangeHook, ab as CollectionBeforeDeleteHook, ac as CollectionBeforeReadHook, ad as CollectionBeforeTransitionHook, ae as CollectionListComponentSlots, af as CustomAdminAuthProvider, ag as DatabaseAdapter, ah as DateFieldAdmin, ai as DateFormat, aj as DisplayTone, ak as DynamicOptionItem, al as DynamicOptionsConfig, am as DynamicOptionsResolver, an as DynamicOptionsResolverArgs, ao as DyrectedLoggerConfig, ap as DyrectedObservabilityConfig, aq as EmailFieldAdmin, ar as FieldAdminHooks, as as FieldAdminOnChangeHook, at as FieldAdminOnChangeHookArgs, au as FieldAdminOptionsHook, av as FieldAdminOptionsHookArgs, aw as FieldAdminOptionsHookResult, ax as FieldAfterReadHook, ay as FieldAfterReadHookArgs, az as FieldBase, aA as FieldBeforeChangeHook, aB as FieldBeforeChangeHookArgs, aC as FieldHook, aD as FieldHooks, aE as FieldType, aF as FileData, aG as GlobalAfterChangeHook, aH as GlobalAfterReadHook, aI as GlobalBeforeChangeHook, aJ as GlobalBeforeReadHook, aK as HeadingLevel, aL as HookFunction, aM as IconFieldAdmin, aN as ImageService, aO as JoinFieldAdmin, aP as JsonFieldAdmin, aQ as JsonFormat, aR as LIFECYCLE_EVENT_NAMES, aS as LifecycleEventHandler, aT as LinkFormat, aU as MultiSelectFieldAdmin, aV as NamedAccessPolicy, aW as NumberFieldAdmin, aX as NumberFormat, aY as NumberLimitFieldAdmin, aZ as NumberLimitFieldConfig, a_ as OIDCAdminAuthProvider, a$ as OptionFormat, b0 as PaginatedResult, b1 as PublicAdminAuthProvider, b2 as RadioFieldAdmin, b3 as RateLimitConfig, b4 as ReadonlyDatabaseAdapter, b5 as RichTextFeature, b6 as RichTextFieldConfig, b7 as SelectFieldAdmin, b8 as StorageAdapter, b9 as TextFieldAdmin, ba as TextFormat, bb as TextareaFieldAdmin, bc as TrustProxyConfig, bd as TypedField, be as UploadConfig, bf as UrlFieldAdmin, bg as UrlLinkValue, bh as WordLimitFieldAdmin, bi as WordLimitFieldConfig, bj as WorkflowMetadata, bk as WorkflowRole, bl as WorkflowState, bm as WorkflowTransitionContext } from './app-config-DCWinlNK.cjs';
+import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, G as GlobalConfig, a as DeclarativeHookExpression, W as WorkflowConfig, b as AuthenticatedUser, c as WorkflowTransition, L as LifecycleEventName, d as LifecycleEvent, e as BaseDocument, H as HookRequestContext, f as ArrayField, g as BlocksField, h as BooleanField, i as AuthConfig, j as AccessPolicyResolver, k as DateField, l as DateTimeField, E as EmailField, I as IconField, m as ImageField, J as JoinField, n as JsonField, M as MultiSelectField, N as NumberField, O as ObjectField, R as RadioField, o as RelationshipField, p as RichTextField, q as RowField, S as SelectField, T as TextField, r as TextareaField, s as TimeField, U as UrlField } from './app-config-CYV70eoF.cjs';
+export { t as AccessFunction, u as AccessFunctionArgs, v as AccessResult, w as AccessRule, x as AdminAuthAccessResolution, y as AdminAuthClaimMapping, z as AdminAuthMember, K as AdminAuthProvider, Q as AdminAuthProviderMembersConfig, V as AdminAuthProvisioningMode, X as AdminAuthResolveAccessArgs, Y as AdminAuthResolvedIdentity, Z as AdminConfig, _ as AdminDashboardComponentSlots, $ as AdminIconName, a0 as BaseAdminAuthProvider, a1 as BaseFieldAdmin, a2 as BlockVariant, a3 as BooleanFieldAdmin, a4 as BooleanFormat, a5 as CharacterLimitFieldAdmin, a6 as CharacterLimitFieldConfig, a7 as CollectionAfterChangeHook, a8 as CollectionAfterDeleteHook, a9 as CollectionAfterReadHook, aa as CollectionAfterReadHookEntry, ab as CollectionAfterTransitionHook, ac as CollectionBeforeChangeHook, ad as CollectionBeforeChangeHookEntry, ae as CollectionBeforeDeleteHook, af as CollectionBeforeReadHook, ag as CollectionBeforeReadHookEntry, ah as CollectionBeforeTransitionHook, ai as CollectionListComponentSlots, aj as CustomAdminAuthProvider, ak as DatabaseAdapter, al as DateFieldAdmin, am as DateFormat, an as DisplayTone, ao as DynamicOptionItem, ap as DynamicOptionsConfig, aq as DynamicOptionsResolver, ar as DynamicOptionsResolverArgs, as as DyrectedLoggerConfig, at as DyrectedObservabilityConfig, au as EmailFieldAdmin, av as FieldAdminHooks, aw as FieldAdminOnChangeHook, ax as FieldAdminOnChangeHookArgs, ay as FieldAdminOptionsHook, az as FieldAdminOptionsHookArgs, aA as FieldAdminOptionsHookResult, aB as FieldAfterReadHook, aC as FieldAfterReadHookArgs, aD as FieldBase, aE as FieldBeforeChangeHook, aF as FieldBeforeChangeHookArgs, aG as FieldHook, aH as FieldHooks, aI as FieldType, aJ as FileData, aK as GlobalAfterChangeHook, aL as GlobalAfterReadHook, aM as GlobalAfterReadHookEntry, aN as GlobalBeforeChangeHook, aO as GlobalBeforeChangeHookEntry, aP as GlobalBeforeReadHook, aQ as GlobalBeforeReadHookEntry, aR as HeadingLevel, aS as HookFunction, aT as IconFieldAdmin, aU as ImageService, aV as JoinFieldAdmin, aW as JsonFieldAdmin, aX as JsonFormat, aY as LIFECYCLE_EVENT_NAMES, aZ as LifecycleEventHandler, a_ as LinkFormat, a$ as MultiSelectFieldAdmin, b0 as NamedAccessPolicy, b1 as NumberFieldAdmin, b2 as NumberFormat, b3 as NumberLimitFieldAdmin, b4 as NumberLimitFieldConfig, b5 as OIDCAdminAuthProvider, b6 as OptionFormat, b7 as PaginatedResult, b8 as PublicAdminAuthProvider, b9 as RadioFieldAdmin, ba as RateLimitConfig, bb as ReadonlyDatabaseAdapter, bc as RichTextFeature, bd as RichTextFieldConfig, be as SelectFieldAdmin, bf as StorageAdapter, bg as TextFieldAdmin, bh as TextFormat, bi as TextareaFieldAdmin, bj as TrustProxyConfig, bk as TypedField, bl as UploadConfig, bm as UrlFieldAdmin, bn as UrlLinkValue, bo as WordLimitFieldAdmin, bp as WordLimitFieldConfig, bq as WorkflowMetadata, br as WorkflowRole, bs as WorkflowState, bt as WorkflowTransitionContext } from './app-config-CYV70eoF.cjs';
 import 'lucide-react';
 import 'pino';
 
@@ -196,7 +196,76 @@ interface SqlSortDialect {
  */
 declare function buildSqlOrderBy(sort: string | undefined, existingColumns: string[], numericFields: Set<string>, dialect: SqlSortDialect): string;
 
+type DeclarativeHookSurface = "collection.beforeRead" | "collection.afterRead" | "collection.beforeChange" | "global.beforeRead" | "global.afterRead" | "global.beforeChange" | "field.beforeChange" | "field.admin.onChange";
+interface DeclarativeHookValidationIssue {
+    path: string;
+    surface: DeclarativeHookSurface | "unsupported";
+    expression: string;
+    message: string;
+}
+type DeclarativeAccessSurface = "config.accessPolicy" | "collection.access" | "global.access" | "field.access";
+interface DeclarativeAccessValidationIssue {
+    path: string;
+    surface: DeclarativeAccessSurface;
+    expression: string;
+    message: string;
+}
+type DeclarativeAdminSurface = "field.admin.condition";
+type DeclarativePreviewSurface = "collection.admin.previewUrl";
+interface DeclarativeAdminValidationIssue {
+    path: string;
+    surface: DeclarativeAdminSurface;
+    expression: string;
+    message: string;
+}
+interface DeclarativePreviewValidationIssue {
+    path: string;
+    surface: DeclarativePreviewSurface;
+    expression: string;
+    message: string;
+}
+interface ConfigDiagnostic {
+    severity: "error" | "warning";
+    source: "declarativeHook" | "declarativeAccess" | "adminCondition" | "previewUrl";
+    path: string;
+    surface: string;
+    message: string;
+    expression: string;
+}
+type DiagnosticFormatOptions = {
+    color?: boolean;
+};
+type DeclarativeValidationConfig = {
+    blocks?: Array<Pick<Block, "fields"> & Partial<Pick<Block, "slug">>>;
+    collections: Array<Pick<CollectionConfig, "fields" | "hooks" | "access" | "admin"> & Partial<Pick<CollectionConfig, "slug">>>;
+    globals?: Array<Pick<GlobalConfig, "fields" | "hooks" | "access"> & Partial<Pick<GlobalConfig, "slug">>>;
+    accessPolicies?: Record<string, unknown>;
+};
+declare function validateDeclarativeHookExpression(expression: string, surface: DeclarativeHookSurface, path: string): DeclarativeHookValidationIssue[];
+declare function validateDeclarativeAccessExpression(expression: string, surface: DeclarativeAccessSurface, path: string): DeclarativeAccessValidationIssue[];
+declare function validateAdminConditionExpression(expression: string, path: string, allowedRoots: readonly string[]): DeclarativeAdminValidationIssue[];
+declare function validatePreviewUrlExpression(expression: string, path: string, allowedRoots: readonly string[]): DeclarativePreviewValidationIssue[];
+declare function assertValidDeclarativeHookExpression(expression: string, surface: DeclarativeHookSurface, path: string): void;
+declare function assertValidDeclarativeHookResult(result: unknown, surface: "collection.beforeRead" | "collection.afterRead" | "collection.beforeChange" | "global.beforeRead" | "global.afterRead" | "global.beforeChange", path: string): void;
+declare function collectDeclarativeHookValidationIssues(config: DeclarativeValidationConfig): DeclarativeHookValidationIssue[];
+declare function collectDeclarativeAccessValidationIssues(config: DeclarativeValidationConfig): DeclarativeAccessValidationIssue[];
+declare function collectAdminConditionValidationIssues(config: DeclarativeValidationConfig): DeclarativeAdminValidationIssue[];
+declare function collectPreviewUrlValidationIssues(config: DeclarativeValidationConfig): DeclarativePreviewValidationIssue[];
+declare function assertValidAdminConditionsInConfig(config: DeclarativeValidationConfig, source?: string): void;
+declare function assertValidPreviewUrlsInConfig(config: DeclarativeValidationConfig, source?: string): void;
+declare function collectConfigDiagnostics(config: DeclarativeValidationConfig): ConfigDiagnostic[];
+declare function formatConfigDiagnostics(source: string, diagnostics: ConfigDiagnostic[], options?: DiagnosticFormatOptions): string;
+declare class ConfigValidationError extends Error {
+    diagnostics: ConfigDiagnostic[];
+    source: string;
+    constructor(source: string, diagnostics: ConfigDiagnostic[]);
+}
+declare function isConfigValidationError(error: unknown): error is ConfigValidationError;
+declare function assertValidDeclarativeHooksInConfig(config: DeclarativeValidationConfig, source?: string): void;
+declare function assertValidDeclarativeAccessInConfig(config: DeclarativeValidationConfig, source?: string): void;
+
 type AnyHookFn = (args: any) => any;
+type AnyHook = AnyHookFn | DeclarativeHookExpression;
 /**
  * Run a list of hook functions sequentially.
  *
@@ -209,9 +278,10 @@ type AnyHookFn = (args: any) => any;
  * wrapped in a try/catch so a failing side-effect (email, webhook, etc.) never
  * surfaces as an HTTP 500 to the caller — the write already succeeded.
  */
-declare function runCollectionHooks(hooks: AnyHookFn[] | undefined, args: {
+declare function runCollectionHooks(hooks: AnyHook[] | undefined, args: {
     data?: unknown;
     doc?: unknown;
+    query?: unknown;
     user?: unknown;
     req?: unknown;
     db?: unknown;
@@ -219,6 +289,8 @@ declare function runCollectionHooks(hooks: AnyHookFn[] | undefined, args: {
     [key: string]: unknown;
 }, options?: {
     isolated?: boolean;
+    surface?: "collection.beforeRead" | "collection.afterRead" | "collection.beforeChange" | "global.beforeRead" | "global.afterRead" | "global.beforeChange";
+    path?: string;
 }): Promise<any>;
 /**
  * Execute field-level `beforeChange` hooks recursively on a data payload.
@@ -226,7 +298,7 @@ declare function runCollectionHooks(hooks: AnyHookFn[] | undefined, args: {
  * Traverses `array`, `object`, and `blocks` fields depth-first so that nested
  * field hooks fire on every item automatically.
  */
-declare function executeFieldBeforeChange(fields: Field[], data: Record<string, unknown>, originalDoc: Record<string, unknown> | null, user: unknown, db?: unknown): Promise<Record<string, unknown>>;
+declare function executeFieldBeforeChange(fields: Field[], data: Record<string, unknown>, originalDoc: Record<string, unknown> | null, user: unknown, db?: unknown, pathPrefix?: string): Promise<Record<string, unknown>>;
 /**
  * Execute field-level `afterRead` hooks recursively on a document.
  *
@@ -743,4 +815,4 @@ declare function defineTab<const T extends readonly Field[]>(args: {
     fields: T;
 }): T;
 
-export { AccessPolicyResolver, AdminAuthConfig, ArrayField, AuthConfig, type AuthDocFields, AuthenticatedUser, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, DateField, DateTimeField, DyrectedConfig, EmailField, Field, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MultiSelectField, NumberField, ObjectField, type Prettify, PublicAdminAuthConfig, type PublishingWorkflowOptions, RadioField, RelationshipField, RichTextField, RowField, SelectField, type SortClause, type SortDirection, type SqlSortDialect, type SqlWhereResult, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhereClause, type WhereOperator, type WhereOperatorName, WorkflowConfig, WorkflowTransition, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, createLifecycleEvent, createWorkflowDocument, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, definePublishingWorkflow, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, executeFieldAfterRead, executeFieldBeforeChange, generateOpenApi, getAdminAuthCollection, getPublicAdminAuthConfig, initializeWorkflowDocument, materializeWorkflowDocument, normalizeConfig, numericFieldNames, parseMongoWhere, parseSort, parseSqlWhere, publishedStateName, publishingWorkflow, resolveAdminAuthCollection, runCollectionHooks, saveWorkflowDraft, simplePublishingWorkflow, transitionWorkflow, workflowCapabilities };
+export { AccessPolicyResolver, AdminAuthConfig, ArrayField, AuthConfig, type AuthDocFields, AuthenticatedUser, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, type ConfigDiagnostic, ConfigValidationError, DateField, DateTimeField, type DeclarativeAccessSurface, type DeclarativeAccessValidationIssue, type DeclarativeAdminSurface, type DeclarativeAdminValidationIssue, DeclarativeHookExpression, type DeclarativeHookSurface, type DeclarativeHookValidationIssue, type DeclarativePreviewSurface, type DeclarativePreviewValidationIssue, DyrectedConfig, EmailField, Field, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MultiSelectField, NumberField, ObjectField, type Prettify, PublicAdminAuthConfig, type PublishingWorkflowOptions, RadioField, RelationshipField, RichTextField, RowField, SelectField, type SortClause, type SortDirection, type SqlSortDialect, type SqlWhereResult, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhereClause, type WhereOperator, type WhereOperatorName, WorkflowConfig, WorkflowTransition, assertValidAdminConditionsInConfig, assertValidDeclarativeAccessInConfig, assertValidDeclarativeHookExpression, assertValidDeclarativeHookResult, assertValidDeclarativeHooksInConfig, assertValidPreviewUrlsInConfig, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, collectAdminConditionValidationIssues, collectConfigDiagnostics, collectDeclarativeAccessValidationIssues, collectDeclarativeHookValidationIssues, collectPreviewUrlValidationIssues, createLifecycleEvent, createWorkflowDocument, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, definePublishingWorkflow, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, executeFieldAfterRead, executeFieldBeforeChange, formatConfigDiagnostics, generateOpenApi, getAdminAuthCollection, getPublicAdminAuthConfig, initializeWorkflowDocument, isConfigValidationError, materializeWorkflowDocument, normalizeConfig, numericFieldNames, parseMongoWhere, parseSort, parseSqlWhere, publishedStateName, publishingWorkflow, resolveAdminAuthCollection, runCollectionHooks, saveWorkflowDraft, simplePublishingWorkflow, transitionWorkflow, validateAdminConditionExpression, validateDeclarativeAccessExpression, validateDeclarativeHookExpression, validatePreviewUrlExpression, workflowCapabilities };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, W as WorkflowConfig, a as AuthenticatedUser, b as WorkflowTransition, L as LifecycleEventName, c as LifecycleEvent, d as BaseDocument, H as HookRequestContext, e as ArrayField, f as BlocksField, g as BooleanField, h as AuthConfig, G as GlobalConfig, i as AccessPolicyResolver, j as DateField, k as DateTimeField, E as EmailField, I as IconField, l as ImageField, J as JoinField, m as JsonField, M as MultiSelectField, N as NumberField, O as ObjectField, R as RadioField, n as RelationshipField, o as RichTextField, p as RowField, S as SelectField, T as TextField, q as TextareaField, r as TimeField, U as UrlField } from './app-config-DCWinlNK.js';
-export { s as AccessFunction, t as AccessFunctionArgs, u as AccessResult, v as AccessRule, w as AdminAuthAccessResolution, x as AdminAuthClaimMapping, y as AdminAuthMember, z as AdminAuthProvider, K as AdminAuthProviderMembersConfig, Q as AdminAuthProvisioningMode, V as AdminAuthResolveAccessArgs, X as AdminAuthResolvedIdentity, Y as AdminConfig, Z as AdminDashboardComponentSlots, _ as AdminIconName, $ as BaseAdminAuthProvider, a0 as BaseFieldAdmin, a1 as BlockVariant, a2 as BooleanFieldAdmin, a3 as BooleanFormat, a4 as CharacterLimitFieldAdmin, a5 as CharacterLimitFieldConfig, a6 as CollectionAfterChangeHook, a7 as CollectionAfterDeleteHook, a8 as CollectionAfterReadHook, a9 as CollectionAfterTransitionHook, aa as CollectionBeforeChangeHook, ab as CollectionBeforeDeleteHook, ac as CollectionBeforeReadHook, ad as CollectionBeforeTransitionHook, ae as CollectionListComponentSlots, af as CustomAdminAuthProvider, ag as DatabaseAdapter, ah as DateFieldAdmin, ai as DateFormat, aj as DisplayTone, ak as DynamicOptionItem, al as DynamicOptionsConfig, am as DynamicOptionsResolver, an as DynamicOptionsResolverArgs, ao as DyrectedLoggerConfig, ap as DyrectedObservabilityConfig, aq as EmailFieldAdmin, ar as FieldAdminHooks, as as FieldAdminOnChangeHook, at as FieldAdminOnChangeHookArgs, au as FieldAdminOptionsHook, av as FieldAdminOptionsHookArgs, aw as FieldAdminOptionsHookResult, ax as FieldAfterReadHook, ay as FieldAfterReadHookArgs, az as FieldBase, aA as FieldBeforeChangeHook, aB as FieldBeforeChangeHookArgs, aC as FieldHook, aD as FieldHooks, aE as FieldType, aF as FileData, aG as GlobalAfterChangeHook, aH as GlobalAfterReadHook, aI as GlobalBeforeChangeHook, aJ as GlobalBeforeReadHook, aK as HeadingLevel, aL as HookFunction, aM as IconFieldAdmin, aN as ImageService, aO as JoinFieldAdmin, aP as JsonFieldAdmin, aQ as JsonFormat, aR as LIFECYCLE_EVENT_NAMES, aS as LifecycleEventHandler, aT as LinkFormat, aU as MultiSelectFieldAdmin, aV as NamedAccessPolicy, aW as NumberFieldAdmin, aX as NumberFormat, aY as NumberLimitFieldAdmin, aZ as NumberLimitFieldConfig, a_ as OIDCAdminAuthProvider, a$ as OptionFormat, b0 as PaginatedResult, b1 as PublicAdminAuthProvider, b2 as RadioFieldAdmin, b3 as RateLimitConfig, b4 as ReadonlyDatabaseAdapter, b5 as RichTextFeature, b6 as RichTextFieldConfig, b7 as SelectFieldAdmin, b8 as StorageAdapter, b9 as TextFieldAdmin, ba as TextFormat, bb as TextareaFieldAdmin, bc as TrustProxyConfig, bd as TypedField, be as UploadConfig, bf as UrlFieldAdmin, bg as UrlLinkValue, bh as WordLimitFieldAdmin, bi as WordLimitFieldConfig, bj as WorkflowMetadata, bk as WorkflowRole, bl as WorkflowState, bm as WorkflowTransitionContext } from './app-config-DCWinlNK.js';
+import { F as Field, B as Block, D as DyrectedConfig, C as CollectionConfig, A as AdminAuthConfig, P as PublicAdminAuthConfig, G as GlobalConfig, a as DeclarativeHookExpression, W as WorkflowConfig, b as AuthenticatedUser, c as WorkflowTransition, L as LifecycleEventName, d as LifecycleEvent, e as BaseDocument, H as HookRequestContext, f as ArrayField, g as BlocksField, h as BooleanField, i as AuthConfig, j as AccessPolicyResolver, k as DateField, l as DateTimeField, E as EmailField, I as IconField, m as ImageField, J as JoinField, n as JsonField, M as MultiSelectField, N as NumberField, O as ObjectField, R as RadioField, o as RelationshipField, p as RichTextField, q as RowField, S as SelectField, T as TextField, r as TextareaField, s as TimeField, U as UrlField } from './app-config-CYV70eoF.js';
+export { t as AccessFunction, u as AccessFunctionArgs, v as AccessResult, w as AccessRule, x as AdminAuthAccessResolution, y as AdminAuthClaimMapping, z as AdminAuthMember, K as AdminAuthProvider, Q as AdminAuthProviderMembersConfig, V as AdminAuthProvisioningMode, X as AdminAuthResolveAccessArgs, Y as AdminAuthResolvedIdentity, Z as AdminConfig, _ as AdminDashboardComponentSlots, $ as AdminIconName, a0 as BaseAdminAuthProvider, a1 as BaseFieldAdmin, a2 as BlockVariant, a3 as BooleanFieldAdmin, a4 as BooleanFormat, a5 as CharacterLimitFieldAdmin, a6 as CharacterLimitFieldConfig, a7 as CollectionAfterChangeHook, a8 as CollectionAfterDeleteHook, a9 as CollectionAfterReadHook, aa as CollectionAfterReadHookEntry, ab as CollectionAfterTransitionHook, ac as CollectionBeforeChangeHook, ad as CollectionBeforeChangeHookEntry, ae as CollectionBeforeDeleteHook, af as CollectionBeforeReadHook, ag as CollectionBeforeReadHookEntry, ah as CollectionBeforeTransitionHook, ai as CollectionListComponentSlots, aj as CustomAdminAuthProvider, ak as DatabaseAdapter, al as DateFieldAdmin, am as DateFormat, an as DisplayTone, ao as DynamicOptionItem, ap as DynamicOptionsConfig, aq as DynamicOptionsResolver, ar as DynamicOptionsResolverArgs, as as DyrectedLoggerConfig, at as DyrectedObservabilityConfig, au as EmailFieldAdmin, av as FieldAdminHooks, aw as FieldAdminOnChangeHook, ax as FieldAdminOnChangeHookArgs, ay as FieldAdminOptionsHook, az as FieldAdminOptionsHookArgs, aA as FieldAdminOptionsHookResult, aB as FieldAfterReadHook, aC as FieldAfterReadHookArgs, aD as FieldBase, aE as FieldBeforeChangeHook, aF as FieldBeforeChangeHookArgs, aG as FieldHook, aH as FieldHooks, aI as FieldType, aJ as FileData, aK as GlobalAfterChangeHook, aL as GlobalAfterReadHook, aM as GlobalAfterReadHookEntry, aN as GlobalBeforeChangeHook, aO as GlobalBeforeChangeHookEntry, aP as GlobalBeforeReadHook, aQ as GlobalBeforeReadHookEntry, aR as HeadingLevel, aS as HookFunction, aT as IconFieldAdmin, aU as ImageService, aV as JoinFieldAdmin, aW as JsonFieldAdmin, aX as JsonFormat, aY as LIFECYCLE_EVENT_NAMES, aZ as LifecycleEventHandler, a_ as LinkFormat, a$ as MultiSelectFieldAdmin, b0 as NamedAccessPolicy, b1 as NumberFieldAdmin, b2 as NumberFormat, b3 as NumberLimitFieldAdmin, b4 as NumberLimitFieldConfig, b5 as OIDCAdminAuthProvider, b6 as OptionFormat, b7 as PaginatedResult, b8 as PublicAdminAuthProvider, b9 as RadioFieldAdmin, ba as RateLimitConfig, bb as ReadonlyDatabaseAdapter, bc as RichTextFeature, bd as RichTextFieldConfig, be as SelectFieldAdmin, bf as StorageAdapter, bg as TextFieldAdmin, bh as TextFormat, bi as TextareaFieldAdmin, bj as TrustProxyConfig, bk as TypedField, bl as UploadConfig, bm as UrlFieldAdmin, bn as UrlLinkValue, bo as WordLimitFieldAdmin, bp as WordLimitFieldConfig, bq as WorkflowMetadata, br as WorkflowRole, bs as WorkflowState, bt as WorkflowTransitionContext } from './app-config-CYV70eoF.js';
 import 'lucide-react';
 import 'pino';
 
@@ -196,7 +196,76 @@ interface SqlSortDialect {
  */
 declare function buildSqlOrderBy(sort: string | undefined, existingColumns: string[], numericFields: Set<string>, dialect: SqlSortDialect): string;
 
+type DeclarativeHookSurface = "collection.beforeRead" | "collection.afterRead" | "collection.beforeChange" | "global.beforeRead" | "global.afterRead" | "global.beforeChange" | "field.beforeChange" | "field.admin.onChange";
+interface DeclarativeHookValidationIssue {
+    path: string;
+    surface: DeclarativeHookSurface | "unsupported";
+    expression: string;
+    message: string;
+}
+type DeclarativeAccessSurface = "config.accessPolicy" | "collection.access" | "global.access" | "field.access";
+interface DeclarativeAccessValidationIssue {
+    path: string;
+    surface: DeclarativeAccessSurface;
+    expression: string;
+    message: string;
+}
+type DeclarativeAdminSurface = "field.admin.condition";
+type DeclarativePreviewSurface = "collection.admin.previewUrl";
+interface DeclarativeAdminValidationIssue {
+    path: string;
+    surface: DeclarativeAdminSurface;
+    expression: string;
+    message: string;
+}
+interface DeclarativePreviewValidationIssue {
+    path: string;
+    surface: DeclarativePreviewSurface;
+    expression: string;
+    message: string;
+}
+interface ConfigDiagnostic {
+    severity: "error" | "warning";
+    source: "declarativeHook" | "declarativeAccess" | "adminCondition" | "previewUrl";
+    path: string;
+    surface: string;
+    message: string;
+    expression: string;
+}
+type DiagnosticFormatOptions = {
+    color?: boolean;
+};
+type DeclarativeValidationConfig = {
+    blocks?: Array<Pick<Block, "fields"> & Partial<Pick<Block, "slug">>>;
+    collections: Array<Pick<CollectionConfig, "fields" | "hooks" | "access" | "admin"> & Partial<Pick<CollectionConfig, "slug">>>;
+    globals?: Array<Pick<GlobalConfig, "fields" | "hooks" | "access"> & Partial<Pick<GlobalConfig, "slug">>>;
+    accessPolicies?: Record<string, unknown>;
+};
+declare function validateDeclarativeHookExpression(expression: string, surface: DeclarativeHookSurface, path: string): DeclarativeHookValidationIssue[];
+declare function validateDeclarativeAccessExpression(expression: string, surface: DeclarativeAccessSurface, path: string): DeclarativeAccessValidationIssue[];
+declare function validateAdminConditionExpression(expression: string, path: string, allowedRoots: readonly string[]): DeclarativeAdminValidationIssue[];
+declare function validatePreviewUrlExpression(expression: string, path: string, allowedRoots: readonly string[]): DeclarativePreviewValidationIssue[];
+declare function assertValidDeclarativeHookExpression(expression: string, surface: DeclarativeHookSurface, path: string): void;
+declare function assertValidDeclarativeHookResult(result: unknown, surface: "collection.beforeRead" | "collection.afterRead" | "collection.beforeChange" | "global.beforeRead" | "global.afterRead" | "global.beforeChange", path: string): void;
+declare function collectDeclarativeHookValidationIssues(config: DeclarativeValidationConfig): DeclarativeHookValidationIssue[];
+declare function collectDeclarativeAccessValidationIssues(config: DeclarativeValidationConfig): DeclarativeAccessValidationIssue[];
+declare function collectAdminConditionValidationIssues(config: DeclarativeValidationConfig): DeclarativeAdminValidationIssue[];
+declare function collectPreviewUrlValidationIssues(config: DeclarativeValidationConfig): DeclarativePreviewValidationIssue[];
+declare function assertValidAdminConditionsInConfig(config: DeclarativeValidationConfig, source?: string): void;
+declare function assertValidPreviewUrlsInConfig(config: DeclarativeValidationConfig, source?: string): void;
+declare function collectConfigDiagnostics(config: DeclarativeValidationConfig): ConfigDiagnostic[];
+declare function formatConfigDiagnostics(source: string, diagnostics: ConfigDiagnostic[], options?: DiagnosticFormatOptions): string;
+declare class ConfigValidationError extends Error {
+    diagnostics: ConfigDiagnostic[];
+    source: string;
+    constructor(source: string, diagnostics: ConfigDiagnostic[]);
+}
+declare function isConfigValidationError(error: unknown): error is ConfigValidationError;
+declare function assertValidDeclarativeHooksInConfig(config: DeclarativeValidationConfig, source?: string): void;
+declare function assertValidDeclarativeAccessInConfig(config: DeclarativeValidationConfig, source?: string): void;
+
 type AnyHookFn = (args: any) => any;
+type AnyHook = AnyHookFn | DeclarativeHookExpression;
 /**
  * Run a list of hook functions sequentially.
  *
@@ -209,9 +278,10 @@ type AnyHookFn = (args: any) => any;
  * wrapped in a try/catch so a failing side-effect (email, webhook, etc.) never
  * surfaces as an HTTP 500 to the caller — the write already succeeded.
  */
-declare function runCollectionHooks(hooks: AnyHookFn[] | undefined, args: {
+declare function runCollectionHooks(hooks: AnyHook[] | undefined, args: {
     data?: unknown;
     doc?: unknown;
+    query?: unknown;
     user?: unknown;
     req?: unknown;
     db?: unknown;
@@ -219,6 +289,8 @@ declare function runCollectionHooks(hooks: AnyHookFn[] | undefined, args: {
     [key: string]: unknown;
 }, options?: {
     isolated?: boolean;
+    surface?: "collection.beforeRead" | "collection.afterRead" | "collection.beforeChange" | "global.beforeRead" | "global.afterRead" | "global.beforeChange";
+    path?: string;
 }): Promise<any>;
 /**
  * Execute field-level `beforeChange` hooks recursively on a data payload.
@@ -226,7 +298,7 @@ declare function runCollectionHooks(hooks: AnyHookFn[] | undefined, args: {
  * Traverses `array`, `object`, and `blocks` fields depth-first so that nested
  * field hooks fire on every item automatically.
  */
-declare function executeFieldBeforeChange(fields: Field[], data: Record<string, unknown>, originalDoc: Record<string, unknown> | null, user: unknown, db?: unknown): Promise<Record<string, unknown>>;
+declare function executeFieldBeforeChange(fields: Field[], data: Record<string, unknown>, originalDoc: Record<string, unknown> | null, user: unknown, db?: unknown, pathPrefix?: string): Promise<Record<string, unknown>>;
 /**
  * Execute field-level `afterRead` hooks recursively on a document.
  *
@@ -743,4 +815,4 @@ declare function defineTab<const T extends readonly Field[]>(args: {
     fields: T;
 }): T;
 
-export { AccessPolicyResolver, AdminAuthConfig, ArrayField, AuthConfig, type AuthDocFields, AuthenticatedUser, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, DateField, DateTimeField, DyrectedConfig, EmailField, Field, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MultiSelectField, NumberField, ObjectField, type Prettify, PublicAdminAuthConfig, type PublishingWorkflowOptions, RadioField, RelationshipField, RichTextField, RowField, SelectField, type SortClause, type SortDirection, type SqlSortDialect, type SqlWhereResult, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhereClause, type WhereOperator, type WhereOperatorName, WorkflowConfig, WorkflowTransition, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, createLifecycleEvent, createWorkflowDocument, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, definePublishingWorkflow, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, executeFieldAfterRead, executeFieldBeforeChange, generateOpenApi, getAdminAuthCollection, getPublicAdminAuthConfig, initializeWorkflowDocument, materializeWorkflowDocument, normalizeConfig, numericFieldNames, parseMongoWhere, parseSort, parseSqlWhere, publishedStateName, publishingWorkflow, resolveAdminAuthCollection, runCollectionHooks, saveWorkflowDraft, simplePublishingWorkflow, transitionWorkflow, workflowCapabilities };
+export { AccessPolicyResolver, AdminAuthConfig, ArrayField, AuthConfig, type AuthDocFields, AuthenticatedUser, BaseDocument, Block, BlocksField, BooleanField, CollectionConfig, type ConfigDiagnostic, ConfigValidationError, DateField, DateTimeField, type DeclarativeAccessSurface, type DeclarativeAccessValidationIssue, type DeclarativeAdminSurface, type DeclarativeAdminValidationIssue, DeclarativeHookExpression, type DeclarativeHookSurface, type DeclarativeHookValidationIssue, type DeclarativePreviewSurface, type DeclarativePreviewValidationIssue, DyrectedConfig, EmailField, Field, GlobalConfig, HookRequestContext, IconField, ImageField, type InferDocShape, JoinField, JsonField, LIFECYCLE_EVENTS_COLLECTION, LifecycleEvent, LifecycleEventName, MultiSelectField, NumberField, ObjectField, type Prettify, PublicAdminAuthConfig, type PublishingWorkflowOptions, RadioField, RelationshipField, RichTextField, RowField, SelectField, type SortClause, type SortDirection, type SqlSortDialect, type SqlWhereResult, type SystemDocFields, TextField, TextareaField, TimeField, type UploadDocFields, UrlField, WORKFLOW_HISTORY_COLLECTION, type WhereClause, type WhereOperator, type WhereOperatorName, WorkflowConfig, WorkflowTransition, assertValidAdminConditionsInConfig, assertValidDeclarativeAccessInConfig, assertValidDeclarativeHookExpression, assertValidDeclarativeHookResult, assertValidDeclarativeHooksInConfig, assertValidPreviewUrlsInConfig, availableWorkflowTransitions, buildSqlOrderBy, canViewWorkflowDraft, collectAdminConditionValidationIssues, collectConfigDiagnostics, collectDeclarativeAccessValidationIssues, collectDeclarativeHookValidationIssues, collectPreviewUrlValidationIssues, createLifecycleEvent, createWorkflowDocument, defineArrayField, defineBlock, defineBlocksField, defineBooleanField, defineCollection, defineConfig, defineDateField, defineDateTimeField, defineEmailField, defineField, defineGlobal, defineIconField, defineImageField, defineJoinField, defineJsonField, defineMultiSelectField, defineNumberField, defineObjectField, definePublishingWorkflow, defineRadioField, defineRelationshipField, defineRichTextField, defineRowField, defineSelectField, defineTab, defineTextField, defineTextareaField, defineTimeField, defineUrlField, dispatchLifecycleEvent, dispatchPendingLifecycleEvents, executeFieldAfterRead, executeFieldBeforeChange, formatConfigDiagnostics, generateOpenApi, getAdminAuthCollection, getPublicAdminAuthConfig, initializeWorkflowDocument, isConfigValidationError, materializeWorkflowDocument, normalizeConfig, numericFieldNames, parseMongoWhere, parseSort, parseSqlWhere, publishedStateName, publishingWorkflow, resolveAdminAuthCollection, runCollectionHooks, saveWorkflowDraft, simplePublishingWorkflow, transitionWorkflow, validateAdminConditionExpression, validateDeclarativeAccessExpression, validateDeclarativeHookExpression, validatePreviewUrlExpression, workflowCapabilities };

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,UAAU,EACV,KAAK,EACL,gBAAgB,EAChB,cAAc,EACd,KAAK,EAEL,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,eAAe,EACf,aAAa,EACb,eAAe,EAChB,MAAM,kBAAkB,CAAC;AAE1B,KAAK,iBAAiB,CAAC,OAAO,SAAS,SAAS,KAAK,EAAE,IAAI,OAAO,CAChE,OAAO,CAAC,MAAM,CAAC,EACf;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CACjB,CAAC,MAAM,CAAC,CAAC;AAEV,KAAK,gBAAgB,CACnB,MAAM,SAAS,MAAM,EACrB,SAAS,EACT,SAAS,SAAS,MAAM,IACtB;IACF,kBAAkB,EAAE,WAAW,MAAM,EAAE,CAAC;IACxC,qBAAqB,EAAE,SAAS,CAAC;IACjC,qBAAqB,EAAE,SAAS,CAAC;CAClC,CAAC;AAEF,KAAK,cAAc,CACjB,MAAM,EACN,SAAS,SAAS,MAAM,EACxB,MAAM,SAAS,MAAM,IACnB,MAAM,SAAS,SAAS,GACxB,SAAS,GACT,MAAM,SAAS,SAAS,GACtB,MAAM,GACN,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAElD,KAAK,kBAAkB,CACrB,MAAM,EACN,SAAS,SAAS,MAAM,EACxB,MAAM,SAAS,MAAM,IACnB,MAAM,SAAS,SAAS,OAAO,EAAE,GACjC;KACG,CAAC,IAAI,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC;CAClE,GACD,gBAAgB,CAAC,GAAG,MAAM,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAE1D,KAAK,oBAAoB,CACvB,OAAO,SAAS,SAAS,KAAK,EAAE,EAChC,IAAI,SAAS,MAAM,EACnB,MAAM,SAAS,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,IACrE,IAAI,CACN,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,EAC5C,YAAY,GAAG,gBAAgB,GAAG,kBAAkB,CACrD,GAAG;IACF,UAAU,CAAC,EAAE,cAAc,CACzB,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,EAC/C,iBAAiB,CAAC,OAAO,CAAC,EAC1B,YAAY,CACb,CAAC;IACF,cAAc,CAAC,EAAE,kBAAkB,CACjC,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,EACnD,iBAAiB,CAAC,OAAO,CAAC,EAC1B,YAAY,CACb,CAAC;IACF,gBAAgB,CAAC,EAAE,kBAAkB,CACnC,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,EACrD,iBAAiB,CAAC,OAAO,CAAC,EAC1B,YAAY,CACb,CAAC;CACH,CAAC;AAEF,KAAK,qBAAqB,CACxB,OAAO,SAAS,SAAS,KAAK,EAAE,EAChC,MAAM,SAAS,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,IACpD,IAAI,CACN,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAC3B,YAAY,CACb,GAAG;IACF,UAAU,CAAC,EAAE,cAAc,CACzB,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,EAC/C,iBAAiB,CAAC,OAAO,CAAC,EAC1B,YAAY,CACb,CAAC;CACH,CAAC;AAEF,KAAK,YAAY,CAAC,CAAC,EAAE,CAAC,SAAS,WAAW,IAAI,CAAC,SAAS;KACrD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;CACnB,GACG,CAAC,GACD,KAAK,CAAC;AAEV,KAAK,WAAW,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;AAE5E,KAAK,oBAAoB,CACvB,YAAY,SAAS,MAAM,EAC3B,OAAO,SAAS,MAAM,GAAG,SAAS,IAChC;IACF,MAAM,EAAE,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEF,KAAK,eAAe,CAAC,KAAK,EAAE,YAAY,SAAS,MAAM,IACnD,OAAO,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAClC,oBAAoB,CAClB,YAAY,EACZ,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAC/C,CAAC;AAEN,KAAK,kBAAkB,CACrB,OAAO,EACP,KAAK,SAAS,WAAW,EACzB,YAAY,SAAS,MAAM,IACzB,OAAO,SAAS,MAAM,GACtB,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC,GAAG;KAC5C,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,eAAe,CACpD,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,EACxB,YAAY,CACb;CACF,GACD,OAAO,CAAC;AAEZ,KAAK,gBAAgB,CAAC,OAAO,EAAE,YAAY,SAAS,MAAM,IAAI,kBAAkB,CAC9E,OAAO,EACP,MAAM,GAAG,QAAQ,GAAG,QAAQ,EAC5B,YAAY,CACb,CAAC;AAEF,KAAK,qBAAqB,CACxB,OAAO,EACP,YAAY,SAAS,MAAM,IACzB,kBAAkB,CACpB,OAAO,EACP,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,EACrD,YAAY,CACb,CAAC;AAEF,KAAK,iBAAiB,CAAC,OAAO,EAAE,YAAY,SAAS,MAAM,IAAI,kBAAkB,CAC/E,OAAO,EACP,MAAM,GAAG,QAAQ,EACjB,YAAY,CACb,CAAC;AAEF,KAAK,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,KAAK,SAAS,MAAM,CAAA;CAAE,GAAG,KAAK,GAAG,KAAK,CAAC;AAEhF,KAAK,cAAc,CAAC,YAAY,SAAS,SAAS,OAAO,EAAE,IAAI,MAAM,CACnE,YAAY,CAAC,MAAM,CAAC,CACrB,CAAC;AAEF,KAAK,SAAS,CAAC,OAAO,SAAS,SAAS,OAAO,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AAE7E,KAAK,oBAAoB,CAAC,YAAY,SAAS,SAAS,OAAO,EAAE,IAAI,MAAM,CACzE,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CACnD,CAAC;AAEF,KAAK,kBAAkB,CAAC,YAAY,SAAS,SAAS,OAAO,EAAE,IAAI,MAAM,CACvE,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CACjD,CAAC;AAEF,KAAK,gBAAgB,CACnB,YAAY,SAAS,SAAS,OAAO,EAAE,EACvC,KAAK,SAAS,MAAM,IAClB,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC;AAEnD,KAAK,0BAA0B,CAC7B,YAAY,SAAS,SAAS,OAAO,EAAE,EACvC,KAAK,SAAS,MAAM,IAClB,gBAAgB,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS;IAChD,MAAM,EAAE,MAAM,OAAO,SAAS,SAAS,KAAK,EAAE,CAAC;CAChD,GACG,iBAAiB,CAAC,OAAO,CAAC,GAC1B,KAAK,CAAC;AAEV,KAAK,iBAAiB,CAAC,SAAS,IAAI,SAAS,SAAS;IACpD,MAAM,EAAE,MAAM,OAAO,SAAS,SAAS,OAAO,EAAE,CAAC;CAClD,GACG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,MAAM,CAAC,GAClD,KAAK,CAAC;AAEV,KAAK,uBAAuB,CAAC,MAAM,EAAE,SAAS,IAAI,MAAM,SAAS,SAAS,OAAO,EAAE,GAC/E;KACG,CAAC,IAAI,MAAM,MAAM,GAAG,cAAc,CACjC,MAAM,CAAC,CAAC,CAAC,EACT,iBAAiB,CAAC,SAAS,CAAC,EAC5B,qBAAqB,CACtB;CACF,GACD,cAAc,CAAC,MAAM,EAAE,iBAAiB,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAEhF,KAAK,uBAAuB,CAAC,WAAW,EAAE,SAAS,IAAI,IAAI,CACzD,WAAW,EACX,MAAM,GAAG,IAAI,CACd,GAAG;IACF,IAAI,EAAE,uBAAuB,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5E,EAAE,EAAE,cAAc,CAChB,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,EAC/B,iBAAiB,CAAC,SAAS,CAAC,EAC5B,qBAAqB,CACtB,CAAC;CACH,CAAC;AAEF,KAAK,aAAa,CAAC,SAAS,IAAI,SAAS,SAAS;IAChD,WAAW,EAAE,MAAM,YAAY,SAAS,SAAS,OAAO,EAAE,CAAC;CAC5D,GACG,IAAI,CAAC,SAAS,EAAE,cAAc,GAAG,YAAY,GAAG,aAAa,CAAC,GAAG;IAC/D,YAAY,EAAE,cAAc,CAC1B,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,EACvC,iBAAiB,CAAC,SAAS,CAAC,EAC5B,qBAAqB,CACtB,CAAC;IACF,UAAU,CAAC,EAAE,cAAc,CACzB,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,EACrC,iBAAiB,CAAC,SAAS,CAAC,EAC5B,qBAAqB,CACtB,CAAC;IACF,WAAW,EAAE;SACV,CAAC,IAAI,MAAM,YAAY,GAAG,uBAAuB,CAChD,YAAY,CAAC,CAAC,CAAC,EACf,SAAS,CACV;KACF,CAAC;CACH,GACD,SAAS,CAAC;AAEd,KAAK,mBAAmB,CACtB,MAAM,SAAS,KAAK,EACpB,YAAY,SAAS,SAAS,OAAO,EAAE,EACvC,WAAW,SAAS,SAAS,KAAK,EAAE,EACpC,YAAY,SAAS,MAAM,IACzB,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,SAAS,KAAK,EAAE,GAC7C,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,CAAC,GACtE,MAAM,CAAC,QAAQ,CAAC,CAAC;CACtB,CAAC;AAEF,KAAK,oBAAoB,CACvB,OAAO,SAAS,SAAS,KAAK,EAAE,EAChC,YAAY,SAAS,SAAS,OAAO,EAAE,EACvC,WAAW,SAAS,SAAS,KAAK,EAAE,EACpC,YAAY,SAAS,MAAM,IACzB;KACD,CAAC,IAAI,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,KAAK,GAC1C,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,CAAC,GACxE,OAAO,CAAC,CAAC,CAAC;CACf,CAAC;AAEF,KAAK,mBAAmB,CACtB,MAAM,SAAS,KAAK,EACpB,YAAY,SAAS,SAAS,OAAO,EAAE,EACvC,OAAO,SAAS,SAAS,KAAK,EAAE,EAChC,YAAY,SAAS,MAAM,IACzB,MAAM,SAAS;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACvC,IAAI,CAAC,MAAM,EAAE,YAAY,GAAG,QAAQ,CAAC,GAAG;IACtC,UAAU,CAAC,EAAE,cAAc,CACzB,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,EAClC,cAAc,CAAC,YAAY,CAAC,EAC5B,iBAAiB,CAClB,CAAC;IACF,MAAM,CAAC,EAAE,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACxE,GACD,MAAM,SAAS;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAC9B,IAAI,CAAC,MAAM,EAAE,YAAY,GAAG,QAAQ,CAAC,GAAG;IACtC,UAAU,CAAC,EAAE,cAAc,CACzB,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,EAClC,oBAAoB,CAAC,YAAY,CAAC,EAClC,wBAAwB,CACzB,CAAC;IACF,MAAM,CAAC,EAAE,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACxE,GACD,MAAM,SAAS;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACjC,IAAI,CAAC,MAAM,EAAE,kBAAkB,GAAG,QAAQ,CAAC,GAAG;IAC5C,gBAAgB,CAAC,EAAE,cAAc,CAC/B,YAAY,CAAC,MAAM,EAAE,kBAAkB,CAAC,EACxC,oBAAoB,CAAC,YAAY,CAAC,EAClC,wBAAwB,CACzB,CAAC;IACF,MAAM,CAAC,EAAE,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACxE,GACD,MAAM,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAC7B,IAAI,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,GAAG,QAAQ,CAAC,GAAG;IAC7C,UAAU,CAAC,EAAE,cAAc,CACzB,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,EAClC,cAAc,CAAC,YAAY,CAAC,EAC5B,iBAAiB,CAClB,CAAC;IACF,EAAE,CAAC,EAAE,cAAc,CACjB,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,EAC1B,0BAA0B,CACxB,YAAY,EACZ,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CACpD,GAAG,iBAAiB,CACnB,OAAO,CACL,gBAAgB,CACd,YAAY,EACZ,cAAc,CAAC,YAAY,CAAC,CAC7B,EACD;QAAE,MAAM,EAAE,SAAS,KAAK,EAAE,CAAA;KAAE,CAC7B,CAAC,QAAQ,CAAC,CACZ,EACD,YAAY,CACb,CAAC;IACF,MAAM,CAAC,EAAE,gBAAgB,CACvB,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAC7B,YAAY,CACb,CAAC;CACH,GACD,MAAM,SAAS;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC/B,IAAI,CAAC,MAAM,EAAE,QAAQ,GAAG,iBAAiB,GAAG,QAAQ,CAAC,GAAG;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,SAAS,KAAK,EAAE,GAC9C,oBAAoB,CAClB,MAAM,CAAC,QAAQ,CAAC,EAChB,YAAY,EACZ,OAAO,EACP,YAAY,CACb,GACD,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrB,eAAe,CAAC,EAAE,kBAAkB,CAClC,YAAY,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACvC,SAAS,CAAC,OAAO,CAAC,EAClB,YAAY,CACb,CAAC;IACF,MAAM,CAAC,EAAE,gBAAgB,CACvB,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAC7B,YAAY,CACb,CAAC;CACH,GACD,MAAM,SAAS;IACX,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,UAAU,SAAS,SAAS,KAAK,EAAE,CAAC;CACnD,GACD,IAAI,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC,GAAG;IAC5C,MAAM,EAAE,WAAW,CACjB,UAAU,EACV,YAAY,EACZ,OAAO,EACP,YAAY,CACb,CAAC;IACF,MAAM,CAAC,EAAE,gBAAgB,CACvB,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAC7B,YAAY,CACb,CAAC;IACF,KAAK,CAAC,EAAE,qBAAqB,CAC3B,UAAU,EACV,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAC9B,CAAC;CACH,GACD,MAAM,SAAS;IACX,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,UAAU,SAAS,SAAS,KAAK,EAAE,CAAC;CACnD,GACD,IAAI,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC,GAAG;IAC5C,MAAM,EAAE,WAAW,CACjB,UAAU,EACV,YAAY,EACZ,OAAO,EACP,YAAY,CACb,CAAC;IACF,MAAM,CAAC,EAAE,gBAAgB,CACvB,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAC7B,YAAY,CACb,CAAC;IACF,KAAK,CAAC,EAAE,qBAAqB,CAC3B,UAAU,EACV,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAC9B,CAAC;CACH,GACL,MAAM,SAAS;IAAE,MAAM,EAAE,MAAM,UAAU,SAAS,SAAS,KAAK,EAAE,CAAA;CAAE,GAClE,IAAI,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC,GAAG;IAClC,MAAM,EAAE,WAAW,CACjB,UAAU,EACV,YAAY,EACZ,OAAO,EACP,YAAY,CACb,CAAC;IACF,MAAM,CAAC,EAAE,gBAAgB,CACvB,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAC7B,YAAY,CACb,CAAC;CACH,GACD,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG;IACvB,MAAM,CAAC,EAAE,gBAAgB,CACvB,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAC7B,YAAY,CACb,CAAC;CACH,CAAC;AAEhB,KAAK,WAAW,CACd,OAAO,SAAS,SAAS,KAAK,EAAE,EAChC,YAAY,SAAS,SAAS,OAAO,EAAE,EACvC,OAAO,SAAS,SAAS,KAAK,EAAE,EAChC,YAAY,SAAS,MAAM,IACzB;KACD,CAAC,IAAI,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,KAAK,GAC1C,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,CAAC,GACpE,OAAO,CAAC,CAAC,CAAC;CACf,CAAC;AAEF,KAAK,wBAAwB,CAC3B,WAAW,SAAS,gBAAgB,CAAC,GAAG,CAAC,EACzC,YAAY,SAAS,SAAS,gBAAgB,CAAC,GAAG,CAAC,EAAE,EACrD,OAAO,SAAS,SAAS,KAAK,EAAE,EAChC,YAAY,SAAS,MAAM,IACzB,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC,GAAG;IACxD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,SAAS,KAAK,EAAE,GAClD,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,CAAC,GACvE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC1B,MAAM,CAAC,EAAE,qBAAqB,CAC5B,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAClC,YAAY,CACb,CAAC;IACF,QAAQ,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;CAChE,CAAC;AAEF,KAAK,gBAAgB,CACnB,YAAY,SAAS,SAAS,gBAAgB,CAAC,GAAG,CAAC,EAAE,EACrD,eAAe,SAAS,SAAS,gBAAgB,CAAC,GAAG,CAAC,EAAE,EACxD,OAAO,SAAS,SAAS,KAAK,EAAE,EAChC,YAAY,SAAS,MAAM,IACzB;KACD,CAAC,IAAI,MAAM,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS,gBAAgB,CAAC,GAAG,CAAC,GACpE,wBAAwB,CACtB,YAAY,CAAC,CAAC,CAAC,EACf,eAAe,EACf,OAAO,EACP,YAAY,CACb,GACD,YAAY,CAAC,CAAC,CAAC;CACpB,CAAC;AAEF,KAAK,oBAAoB,CACvB,OAAO,SAAS,YAAY,CAAC,GAAG,CAAC,EACjC,YAAY,SAAS,SAAS,gBAAgB,CAAC,GAAG,CAAC,EAAE,EACrD,OAAO,SAAS,SAAS,KAAK,EAAE,EAChC,YAAY,SAAS,MAAM,IACzB,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACvC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,SAAS,KAAK,EAAE,GAC9C,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,CAAC,GACnE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtB,MAAM,CAAC,EAAE,iBAAiB,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CAC1E,CAAC;AAEF,KAAK,YAAY,CACf,QAAQ,SAAS,SAAS,YAAY,CAAC,GAAG,CAAC,EAAE,EAC7C,YAAY,SAAS,SAAS,gBAAgB,CAAC,GAAG,CAAC,EAAE,EACrD,OAAO,SAAS,SAAS,KAAK,EAAE,EAChC,YAAY,SAAS,MAAM,IACzB;KACD,CAAC,IAAI,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,YAAY,CAAC,GAAG,CAAC,GACxD,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,CAAC,GACtE,QAAQ,CAAC,CAAC,CAAC;CAChB,CAAC;AAEF,KAAK,oBAAoB,CACvB,UAAU,EACV,YAAY,SAAS,SAAS,gBAAgB,CAAC,GAAG,CAAC,EAAE,IACnD,UAAU,SAAS,MAAM,GACzB,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,GAAG;IACnC,cAAc,CAAC,EAAE,cAAc,CAC7B,YAAY,CAAC,UAAU,EAAE,gBAAgB,CAAC,EAC1C,kBAAkB,CAAC,YAAY,CAAC,EAChC,sBAAsB,CACvB,CAAC;CACH,GACD,UAAU,CAAC;AAEf;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,KAAK,SAAS,MAAM,EAC1B,KAAK,CAAC,OAAO,SAAS,KAAK,EAAE,EAC7B,KAAK,CAAC,MAAM,SAAS,WAAW,CAC9B,gBAAgB,CACd,QAAQ,CACN;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAAC,OAAO,CAAC,GACrC,eAAe,GACf,aAAa,CAChB,CACF,CAAC,OAAO,CAAC,CACX,GAAG,SAAS,EACb,KAAK,CAAC,OAAO,SAAS,IAAI,CACxB,gBAAgB,CACd,QAAQ,CACN;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAAC,OAAO,CAAC,GACrC,eAAe,GACf,aAAa,CAChB,CACF,EACD,QAAQ,GAAG,MAAM,GAAG,OAAO,CAC5B,GAAG;IACF,IAAI,EAAE,KAAK,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,IAAI,GAAG,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,oBAAoB,CAC1B,OAAO,EACP,QAAQ,CACN;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,eAAe,GAAG,aAAa,CAC1E,EACD,MAAM,CACP,CAAC;CACH,EAED,MAAM,EAAE,OAAO,GACd,OAAO,CAAC;AAEX,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,KAAK,SAAS,MAAM,EAC1B,KAAK,CAAC,OAAO,SAAS,KAAK,EAAE,EAC7B,KAAK,CAAC,MAAM,SAAS,WAAW,CAC9B,gBAAgB,CACd,QAAQ,CACN;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAAC,OAAO,CAAC,GACrC,eAAe,GACf,eAAe,CAClB,CACF,CAAC,OAAO,CAAC,CACX,GAAG,SAAS,EACb,KAAK,CAAC,OAAO,SAAS,IAAI,CACxB,gBAAgB,CACd,QAAQ,CACN;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAAC,OAAO,CAAC,GACrC,eAAe,GACf,eAAe,CAClB,CACF,EACD,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAC9B,GAAG;IACF,IAAI,EAAE,KAAK,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,IAAI,CAAC;IACb,KAAK,CAAC,EAAE,oBAAoB,CAC1B,OAAO,EACP,QAAQ,CACN;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,eAAe,GAAG,eAAe,CAC5E,EACD,MAAM,CACP,CAAC;CACH,EAED,MAAM,EAAE,OAAO,GACd,OAAO,CAAC;AAEX,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,KAAK,SAAS,MAAM,EAC1B,KAAK,CAAC,OAAO,SAAS,KAAK,EAAE,EAC7B,KAAK,CAAC,MAAM,SAAS,WAAW,CAC9B,gBAAgB,CACd,QAAQ,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,eAAe,CAAC,CACpE,CAAC,OAAO,CAAC,CACX,GAAG,SAAS,EACb,KAAK,CAAC,OAAO,SAAS,IAAI,CACxB,gBAAgB,CACd,QAAQ,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,eAAe,CAAC,CACpE,EACD,QAAQ,GAAG,OAAO,CACnB,GAAG;IACF,IAAI,EAAE,KAAK,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,oBAAoB,CAC1B,OAAO,EACP,QAAQ,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,eAAe,CAAC,EACnE,MAAM,CACP,CAAC;CACH,EAED,MAAM,EAAE,OAAO,GACd,OAAO,CAAC;AAEX,wBAAgB,gBAAgB,CAC9B,IAAI,SAAS,MAAM,EACnB,KAAK,CAAC,OAAO,SAAS,gBAAgB,CAAC,IAAI,CAAC,EAC5C,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;AAM5B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,wBAAgB,YAAY,CAC1B,KAAK,CAAC,KAAK,SAAS,MAAM,EAC1B,KAAK,CAAC,OAAO,SAAS,KAAK,EAAE,EAC7B,KAAK,CAAC,OAAO,SAAS,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG;IACrF,IAAI,EAAE,KAAK,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;CACjB,EACD,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;AAE5B,wBAAgB,YAAY,CAC1B,IAAI,SAAS,MAAM,EACnB,KAAK,CAAC,OAAO,SAAS,YAAY,CAAC,IAAI,CAAC,EACxC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;AAM5B;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,KAAK,SAAS,iBAAiB,GAAG,iBAAiB,EACnD,KAAK,CAAC,OAAO,SAAS,SAAS,KAAK,EAAE,GAAG,EAAE,EAC3C,KAAK,CAAC,YAAY,SAAS,SAAS,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,EAChE,KAAK,CAAC,QAAQ,SAAS,SAAS,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,EACxD,KAAK,CAAC,UAAU,SAAS,cAAc,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,SAAS,GAAG,SAAS,EACnF,KAAK,CAAC,SAAS,SACX,MAAM,CACJ,MAAM,EACN,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,GAAG,OAAO,CACxE,GACD,SAAS,GAAG,SAAS,EAEzB,MAAM,EAAE,IAAI,CACV,cAAc,CAAC,KAAK,CAAC,EACrB,QAAQ,GAAG,aAAa,GAAG,SAAS,GAAG,gBAAgB,GAAG,WAAW,CACtE,GAAG;IACF,MAAM,CAAC,EAAE,oBAAoB,CAC3B,OAAO,EACP,YAAY,EACZ,OAAO,EACP,WAAW,CAAC,SAAS,CAAC,CACvB,CAAC;IACF,WAAW,EAAE,gBAAgB,CAC3B,YAAY,EACZ,YAAY,EACZ,OAAO,EACP,WAAW,CAAC,SAAS,CAAC,CACvB,CAAC;IACF,OAAO,EAAE,YAAY,CACnB,QAAQ,EACR,YAAY,EACZ,OAAO,EACP,WAAW,CAAC,SAAS,CAAC,CACvB,CAAC;IACF,cAAc,CAAC,EAAE,SAAS,CAAC;IAC3B,SAAS,CAAC,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;CAC5D,GACA,OAAO,MAAM,CAEf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,CAAC,SAAS,KAAK,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAE9D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,CAAC,SAAS,KAAK,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAE9D;AAiBD,6BAA6B;AAC7B,eAAO,MAAM,eAAe,SANZ,CAAC;;CAMwC,CAAC;AAC1D,iCAAiC;AACjC,eAAO,MAAM,mBAAmB,SARhB,CAAC;;CAQgD,CAAC;AAClE,sFAAsF;AACtF,eAAO,MAAM,mBAAmB,SAVhB,CAAC;;CAUgD,CAAC;AAClE,+BAA+B;AAC/B,eAAO,MAAM,iBAAiB,SAZd,CAAC;;CAY4C,CAAC;AAC9D,gCAAgC;AAChC,eAAO,MAAM,kBAAkB,SAdf,CAAC;;CAc8C,CAAC;AAChE,6BAA6B;AAC7B,eAAO,MAAM,eAAe,SAhBZ,CAAC;;CAgBwC,CAAC;AAC1D,iCAAiC;AACjC,eAAO,MAAM,mBAAmB,SAlBhB,CAAC;;CAkBgD,CAAC;AAClE,6BAA6B;AAC7B,eAAO,MAAM,eAAe,SApBZ,CAAC;;CAoBwC,CAAC;AAC1D,+BAA+B;AAC/B,eAAO,MAAM,iBAAiB,SAtBd,CAAC;;CAsB4C,CAAC;AAC9D,oCAAoC;AACpC,eAAO,MAAM,sBAAsB,SAxBnB,CAAC;;CAwBsD,CAAC;AACxE,8BAA8B;AAC9B,eAAO,MAAM,gBAAgB,SA1Bb,CAAC;;CA0B0C,CAAC;AAC5D,qCAAqC;AACrC,eAAO,MAAM,uBAAuB,SA5BpB,CAAC;;CA4BwD,CAAC;AAC1E,+BAA+B;AAC/B,eAAO,MAAM,gBAAgB,SA9Bb,CAAC;;CA8B0C,CAAC;AAC5D,gCAAgC;AAChC,eAAO,MAAM,iBAAiB,SAhCd,CAAC;;CAgC4C,CAAC;AAC9D,6BAA6B;AAC7B,eAAO,MAAM,eAAe,SAlCZ,CAAC;;CAkCwC,CAAC;AAC1D,+BAA+B;AAC/B,eAAO,MAAM,iBAAiB,SApCd,CAAC;;CAoC4C,CAAC;AAC9D,+BAA+B;AAC/B,eAAO,MAAM,gBAAgB,SAtCb,CAAC;;CAsC0C,CAAC;AAC5D,+BAA+B;AAC/B,eAAO,MAAM,gBAAgB,SAxCb,CAAC;;CAwC0C,CAAC;AAC5D,4BAA4B;AAC5B,eAAO,MAAM,cAAc,SA1CX,CAAC;;CA0CsC,CAAC;AACxD,8BAA8B;AAC9B,eAAO,MAAM,eAAe,SA5CZ,CAAC;;CA4CwC,CAAC;AAC1D,6BAA6B;AAC7B,eAAO,MAAM,eAAe,SA9CZ,CAAC;;CA8CwC,CAAC;AAC1D,wCAAwC;AACxC,eAAO,MAAM,cAAc,SAhDX,CAAC;;CAgDsC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,SAAS,CAAC,KAAK,CAAC,CAAC,SAAS,SAAS,KAAK,EAAE,EAAE,IAAI,EAAE;IAChE,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,MAAM,EAAE,CAAC,CAAC;CACX,GAAG,CAAC,CAKJ;AAED,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC"}

package/dist/index.js

@@ -1,8 +1,20 @@
 import {
+  ConfigValidationError,
   LIFECYCLE_EVENTS_COLLECTION,
   WORKFLOW_HISTORY_COLLECTION,
+  assertValidAdminConditionsInConfig,
+  assertValidDeclarativeAccessInConfig,
+  assertValidDeclarativeHookExpression,
+  assertValidDeclarativeHookResult,
+  assertValidDeclarativeHooksInConfig,
+  assertValidPreviewUrlsInConfig,
   availableWorkflowTransitions,
   canViewWorkflowDraft,
+  collectAdminConditionValidationIssues,
+  collectConfigDiagnostics,
+  collectDeclarativeAccessValidationIssues,
+  collectDeclarativeHookValidationIssues,
+  collectPreviewUrlValidationIssues,
   createLifecycleEvent,
   createWorkflowDocument,
   definePublishingWorkflow,
@@ -10,10 +22,12 @@ import {
   dispatchPendingLifecycleEvents,
   executeFieldAfterRead,
   executeFieldBeforeChange,
+  formatConfigDiagnostics,
   generateOpenApi,
   getAdminAuthCollection,
   getPublicAdminAuthConfig,
   initializeWorkflowDocument,
+  isConfigValidationError,
   materializeWorkflowDocument,
   normalizeConfig,
   publishedStateName,
@@ -23,8 +37,12 @@ import {
   saveWorkflowDraft,
   simplePublishingWorkflow,
   transitionWorkflow,
+  validateAdminConditionExpression,
+  validateDeclarativeAccessExpression,
+  validateDeclarativeHookExpression,
+  validatePreviewUrlExpression,
   workflowCapabilities
-} from "./chunk-K3ASMUKV.js";
+} from "./chunk-YEBCT77K.js";
 
 // src/types/workflows.ts
 var LIFECYCLE_EVENT_NAMES = [
@@ -284,12 +302,24 @@ function defineTab(args) {
   }));
 }
 export {
+  ConfigValidationError,
   LIFECYCLE_EVENTS_COLLECTION,
   LIFECYCLE_EVENT_NAMES,
   WORKFLOW_HISTORY_COLLECTION,
+  assertValidAdminConditionsInConfig,
+  assertValidDeclarativeAccessInConfig,
+  assertValidDeclarativeHookExpression,
+  assertValidDeclarativeHookResult,
+  assertValidDeclarativeHooksInConfig,
+  assertValidPreviewUrlsInConfig,
   availableWorkflowTransitions,
   buildSqlOrderBy,
   canViewWorkflowDraft,
+  collectAdminConditionValidationIssues,
+  collectConfigDiagnostics,
+  collectDeclarativeAccessValidationIssues,
+  collectDeclarativeHookValidationIssues,
+  collectPreviewUrlValidationIssues,
   createLifecycleEvent,
   createWorkflowDocument,
   defineArrayField,
@@ -325,10 +355,12 @@ export {
   dispatchPendingLifecycleEvents,
   executeFieldAfterRead,
   executeFieldBeforeChange,
+  formatConfigDiagnostics,
   generateOpenApi,
   getAdminAuthCollection,
   getPublicAdminAuthConfig,
   initializeWorkflowDocument,
+  isConfigValidationError,
   materializeWorkflowDocument,
   normalizeConfig,
   numericFieldNames,
@@ -342,5 +374,9 @@ export {
   saveWorkflowDraft,
   simplePublishingWorkflow,
   transitionWorkflow,
+  validateAdminConditionExpression,
+  validateDeclarativeAccessExpression,
+  validateDeclarativeHookExpression,
+  validatePreviewUrlExpression,
   workflowCapabilities
 };

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA4lBA,iBAAiB;AACjB,MAAM,UAAU,gBAAgB,CAAC,MAAe;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC;AAyCD,iBAAiB;AACjB,MAAM,UAAU,YAAY,CAAC,MAAe;IAC1C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAa1B,MAwBC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,WAAW,CAAwB,KAAQ;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAwB,KAAQ;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAKD;;;;;GAKG;AACH,SAAS,kBAAkB,CAA0B,IAAW;IAC9D,OAAO,CACL,KAAQ,EACa,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAwB,CAAC;AACxE,CAAC;AAED,6BAA6B;AAC7B,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAC1D,iCAAiC;AACjC,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;AAClE,sFAAsF;AACtF,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;AAClE,+BAA+B;AAC/B,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AAC9D,gCAAgC;AAChC,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;AAChE,6BAA6B;AAC7B,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAC1D,iCAAiC;AACjC,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;AAClE,6BAA6B;AAC7B,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAC1D,+BAA+B;AAC/B,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AAC9D,oCAAoC;AACpC,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;AACxE,8BAA8B;AAC9B,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC5D,qCAAqC;AACrC,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;AAC1E,+BAA+B;AAC/B,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC5D,gCAAgC;AAChC,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AAC9D,6BAA6B;AAC7B,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAC1D,+BAA+B;AAC/B,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AAC9D,+BAA+B;AAC/B,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC5D,+BAA+B;AAC/B,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC5D,4BAA4B;AAC5B,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACxD,8BAA8B;AAC9B,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAC1D,6BAA6B;AAC7B,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAC1D,wCAAwC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,SAAS,CAAmC,IAK3D;IACC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjC,GAAG,KAAK;QACR,KAAK,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE;KACnD,CAAC,CAAiB,CAAC;AACtB,CAAC;AAED,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC"}

package/dist/middleware/auth.d.ts

@@ -0,0 +1,19 @@
+import type { Context, Next } from 'hono';
+import type { DyrectedContext } from '../app.js';
+import type { DyrectedConfig } from '../types/index.js';
+/**
+ * Middleware that requires a valid Bearer JWT.
+ * On success: sets `c.get('user')` to the resolved user (full record when a db is configured).
+ * On failure: returns 401.
+ */
+export declare function requireAuth(config?: DyrectedConfig): (c: Context<DyrectedContext>, next: Next) => Promise<void | (Response & import("hono").TypedResponse<{
+    error: true;
+    message: string;
+}, 401, "json">)>;
+/**
+ * Middleware that optionally resolves a Bearer JWT.
+ * Does NOT block the request if the token is missing or invalid — it just won't set `user`.
+ * Use this for routes that behave differently when authenticated.
+ */
+export declare function optionalAuth(config?: DyrectedConfig): (c: Context<DyrectedContext>, next: Next) => Promise<void>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAwGxD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,CAAC,EAAE,cAAc,IACnC,GAAG,OAAO,CAAC,eAAe,CAAC,EAAE,MAAM,IAAI;;;kBAkDtD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,CAAC,EAAE,cAAc,IACpC,GAAG,OAAO,CAAC,eAAe,CAAC,EAAE,MAAM,IAAI,mBA2BtD"}

package/dist/middleware/auth.js

@@ -0,0 +1,157 @@
+import { verifyCollectionToken } from '../auth/token.js';
+import { getAuthSession, isAuthSessionActive, touchAuthSession, } from '../auth/sessions.js';
+import { getConfigLogger, getRequestLogger } from '../observability.js';
+function getBearerToken(c) {
+    const authHeader = c.req.header('Authorization');
+    return authHeader?.replace(/^Bearer\s+/i, '') || undefined;
+}
+/**
+ * Verify a bearer token and resolve the authenticated user.
+ *
+ * The JWT only carries identity claims (`sub`, `email`, `collection`), so on its
+ * own it can't answer role/ownership questions in access functions. When a database
+ * adapter is available we re-hydrate the full user document (minus `password`) — the
+ * same record `GET /me` returns — and merge the token's identity claims on top. This
+ * is what makes `user.roles`, `user.id`, and any other collection field usable inside
+ * server-side access control and hooks.
+ *
+ * @returns the resolved user, or `null` when the token is valid but the user no longer
+ *   exists (deleted). Throws only when the token itself is invalid or expired.
+ */
+async function resolveUser(payload, config) {
+    // Purpose tokens (invite/reset) are not full user sessions — their `sub` may be an
+    // invited email rather than a document id, so never try to hydrate them.
+    if (payload.purpose) {
+        return payload;
+    }
+    const db = config?.db;
+    if (!db) {
+        // No database configured — fall back to the token's identity claims.
+        return payload;
+    }
+    let doc;
+    try {
+        doc = (await db.findOne({
+            collection: payload.collection,
+            id: payload.sub,
+        }));
+    }
+    catch (err) {
+        // A transient database error must not be mistaken for a logged-out user. The token
+        // is cryptographically valid, so degrade gracefully to its identity claims.
+        getConfigLogger(config, 'auth').error({
+            err,
+            msg: 'Failed to hydrate user from token',
+            collection: payload.collection,
+            userId: payload.sub,
+        });
+        return payload;
+    }
+    // The token is valid but the underlying record is gone — treat as unauthenticated.
+    if (!doc) {
+        return null;
+    }
+    const { password: _password, ...safe } = doc;
+    // Token identity claims win over the stored document so `sub`/`collection` always
+    // reflect the session, while everything else (roles, ownership, custom fields) comes
+    // from the live record.
+    return {
+        ...safe,
+        sub: payload.sub,
+        email: payload.email ?? safe.email,
+        collection: payload.collection,
+    };
+}
+async function resolveAuthenticatedRequest(token, config, clientIp) {
+    const payload = await verifyCollectionToken(token);
+    if (payload.sid && config?.db) {
+        const session = await getAuthSession(config, payload.sid);
+        if (!isAuthSessionActive(session) ||
+            session.userId !== payload.sub ||
+            session.collection !== payload.collection) {
+            throw new Error('Invalid or expired session.');
+        }
+        await touchAuthSession(config, payload.sid, { ip: clientIp });
+    }
+    const user = await resolveUser(payload, config);
+    return { user, payload };
+}
+/**
+ * Middleware that requires a valid Bearer JWT.
+ * On success: sets `c.get('user')` to the resolved user (full record when a db is configured).
+ * On failure: returns 401.
+ */
+export function requireAuth(config) {
+    return async (c, next) => {
+        // The global optionalAuth middleware has already resolved the user for this request,
+        // so reuse it instead of re-hitting the database.
+        if (c.get('user')) {
+            return next();
+        }
+        const token = getBearerToken(c);
+        if (!token) {
+            c.get('observability')?.recordAuthFailure({
+                reason: 'missing_token',
+                path: c.req.path,
+            });
+            return c.json({ error: true, message: 'Authentication required.' }, 401);
+        }
+        let user;
+        let payload;
+        try {
+            const resolved = await resolveAuthenticatedRequest(token, config ?? c.get('config'), c.get('clientIp'));
+            user = resolved.user;
+            payload = resolved.payload;
+        }
+        catch (err) {
+            c.get('observability')?.recordAuthFailure({
+                reason: 'invalid_token',
+                path: c.req.path,
+            });
+            getRequestLogger(c, 'auth').warn({
+                err,
+                msg: 'Rejected invalid or expired token',
+            });
+            return c.json({ error: true, message: 'Invalid or expired token.' }, 401);
+        }
+        if (!user) {
+            c.get('observability')?.recordAuthFailure({
+                reason: 'missing_user',
+                path: c.req.path,
+            });
+            return c.json({ error: true, message: 'Invalid or expired token.' }, 401);
+        }
+        c.set('user', user);
+        c.set('authTokenPayload', payload);
+        await next();
+    };
+}
+/**
+ * Middleware that optionally resolves a Bearer JWT.
+ * Does NOT block the request if the token is missing or invalid — it just won't set `user`.
+ * Use this for routes that behave differently when authenticated.
+ */
+export function optionalAuth(config) {
+    return async (c, next) => {
+        // The global optionalAuth middleware may have already resolved the user; don't re-fetch.
+        if (c.get('user')) {
+            return next();
+        }
+        const token = getBearerToken(c);
+        if (token) {
+            try {
+                const resolved = await resolveAuthenticatedRequest(token, config ?? c.get('config'), c.get('clientIp'));
+                const user = resolved.user;
+                if (user) {
+                    c.set('user', user);
+                }
+                c.set('authTokenPayload', resolved.payload);
+            }
+            catch {
+                // Invalid token — proceed without user
+            }
+        }
+        await next();
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,qBAAqB,EAA+B,MAAM,kBAAkB,CAAC;AACtF,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAExE,SAAS,cAAc,CAAC,CAA2B;IACjD,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,OAAO,UAAU,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,WAAW,CACxB,OAA+B,EAC/B,MAAkC;IAElC,mFAAmF;IACnF,yEAAyE;IACzE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,OAA4B,CAAC;IACtC,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;IACtB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,qEAAqE;QACrE,OAAO,OAA4B,CAAC;IACtC,CAAC;IAED,IAAI,GAAmC,CAAC;IACxC,IAAI,CAAC;QACH,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,EAAE,EAAE,OAAO,CAAC,GAAG;SAChB,CAAC,CAAmC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mFAAmF;QACnF,4EAA4E;QAC5E,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC;YACpC,GAAG;YACH,GAAG,EAAE,mCAAmC;YACxC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,MAAM,EAAE,OAAO,CAAC,GAAG;SACpB,CAAC,CAAC;QACH,OAAO,OAA4B,CAAC;IACtC,CAAC;IAED,mFAAmF;IACnF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IAE7C,kFAAkF;IAClF,qFAAqF;IACrF,wBAAwB;IACxB,OAAO;QACL,GAAG,IAAI;QACP,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAK,IAAI,CAAC,KAA4B;QAC1D,UAAU,EAAE,OAAO,CAAC,UAAU;KACV,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAAa,EACb,MAAkC,EAClC,QAAiB;IAEjB,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAEnD,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,EAAE,EAAE,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1D,IACE,CAAC,mBAAmB,CAAC,OAAO,CAAC;YAC7B,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG;YAC9B,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,EACzC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAuB;IACjD,OAAO,KAAK,EAAE,CAA2B,EAAE,IAAU,EAAE,EAAE;QACvD,qFAAqF;QACrF,kDAAkD;QAClD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,iBAAiB,CAAC;gBACxC,MAAM,EAAE,eAAe;gBACvB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;aACjB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,IAA8B,CAAC;QACnC,IAAI,OAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,KAAK,EACL,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EACzB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAClB,CAAC;YACF,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YACrB,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,iBAAiB,CAAC;gBACxC,MAAM,EAAE,eAAe;gBACvB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;aACjB,CAAC,CAAC;YACH,gBAAgB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC;gBAC/B,GAAG;gBACH,GAAG,EAAE,mCAAmC;aACzC,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,iBAAiB,CAAC;gBACxC,MAAM,EAAE,cAAc;gBACtB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;aACjB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAQ,CAAC,CAAC;QACpC,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAuB;IAClD,OAAO,KAAK,EAAE,CAA2B,EAAE,IAAU,EAAE,EAAE;QACvD,yFAAyF;QACzF,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAEhC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD,KAAK,EACL,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EACzB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAClB,CAAC;gBACF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;gBAC3B,IAAI,IAAI,EAAE,CAAC;oBACT,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACtB,CAAC;gBACD,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;YACzC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}