@dyrected/core 2.6.3 → 2.6.4

package/dist/server.cjs

@@ -1064,21 +1064,629 @@ function createSessionId() {
   return globalThis.crypto?.randomUUID?.() ? globalThis.crypto.randomUUID() : `sess_${Date.now()}_${Math.random().toString(36).slice(2)}`;
 }
 
+// src/utils/hooks.ts
+var import_jexl3 = __toESM(require("jexl"), 1);
+
+// src/utils/declarative-hooks.ts
+var import_jexl2 = __toESM(require("jexl"), 1);
+var SURFACE_ROOTS = {
+  "collection.beforeRead": ["req", "user", "query"],
+  "collection.afterRead": ["req", "user", "doc"],
+  "collection.beforeChange": ["req", "user", "data", "doc", "operation"],
+  "global.beforeRead": ["req", "user", "query"],
+  "global.afterRead": ["req", "user", "doc"],
+  "global.beforeChange": ["req", "user", "data", "doc", "operation"],
+  "field.beforeChange": ["value", "data", "originalDoc", "user"],
+  "field.admin.onChange": ["value", "siblingData", "data"]
+};
+var ACCESS_ROOTS = ["user", "req", "doc", "data", "id", "config"];
+var ADMIN_CONDITION_RESERVED_ROOTS = ["data", "siblingData", "user", "id"];
+var PREVIEW_URL_RESERVED_ROOTS = ["siteUrl", "id"];
+var COMPILE_CACHE = /* @__PURE__ */ new Map();
+function compileExpression(expression) {
+  const cached = COMPILE_CACHE.get(expression);
+  if (cached) return cached;
+  const compiled = import_jexl2.default.compile(expression);
+  const next = { ast: compiled._ast };
+  COMPILE_CACHE.set(expression, next);
+  return next;
+}
+function isPlainObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function quoteSegment(value) {
+  return `["${value.replace(/"/g, '\\"')}"]`;
+}
+function fieldSegment(field, index) {
+  return typeof field.name === "string" && field.name.length > 0 ? `fields${quoteSegment(field.name)}` : `fields[${index}]`;
+}
+function blockSegment(block, index) {
+  return typeof block.slug === "string" && block.slug.length > 0 ? `blocks${quoteSegment(block.slug)}` : `blocks[${index}]`;
+}
+function collectionSegment(collection, index) {
+  return typeof collection.slug === "string" && collection.slug.length > 0 ? `collections${quoteSegment(collection.slug)}` : `collections[${index}]`;
+}
+function globalSegment(global, index) {
+  return typeof global.slug === "string" && global.slug.length > 0 ? `globals${quoteSegment(global.slug)}` : `globals[${index}]`;
+}
+function colorize(value, code, enabled) {
+  return enabled ? `\x1B[${code}m${value}\x1B[0m` : value;
+}
+function collectRootIdentifiers(node, roots, seen) {
+  if (!node || typeof node !== "object" || seen.has(node)) return;
+  seen.add(node);
+  const candidate = node;
+  if (candidate.type === "Identifier") {
+    if (candidate.from) {
+      collectRootIdentifiers(candidate.from, roots, seen);
+      return;
+    }
+    if (typeof candidate.value === "string" && candidate.value !== "null") {
+      roots.add(candidate.value);
+    }
+    return;
+  }
+  if (Array.isArray(node)) {
+    for (const entry of node) collectRootIdentifiers(entry, roots, seen);
+    return;
+  }
+  for (const value of Object.values(node)) {
+    if (Array.isArray(value)) {
+      for (const entry of value) collectRootIdentifiers(entry, roots, seen);
+      continue;
+    }
+    if (value && typeof value === "object") {
+      collectRootIdentifiers(value, roots, seen);
+    }
+  }
+}
+function getInvalidRoots(expression, allowedRoots) {
+  const { ast } = compileExpression(expression);
+  const roots = /* @__PURE__ */ new Set();
+  collectRootIdentifiers(ast, roots, /* @__PURE__ */ new Set());
+  const allowed = new Set(allowedRoots);
+  return [...roots].filter((root) => !allowed.has(root));
+}
+function validateDeclarativeHookExpression(expression, surface, path) {
+  try {
+    const invalidRoots = getInvalidRoots(expression, SURFACE_ROOTS[surface]);
+    if (invalidRoots.length === 0) return [];
+    return [
+      {
+        path,
+        surface,
+        expression,
+        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${SURFACE_ROOTS[surface].map((root) => `"${root}"`).join(", ")}`
+      }
+    ];
+  } catch (error) {
+    return [
+      {
+        path,
+        surface,
+        expression,
+        message: `has invalid syntax: ${error.message}`
+      }
+    ];
+  }
+}
+function validateDeclarativeAccessExpression(expression, surface, path) {
+  try {
+    const invalidRoots = getInvalidRoots(expression, ACCESS_ROOTS);
+    if (invalidRoots.length === 0) return [];
+    return [
+      {
+        path,
+        surface,
+        expression,
+        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${ACCESS_ROOTS.map((root) => `"${root}"`).join(", ")}`
+      }
+    ];
+  } catch (error) {
+    return [
+      {
+        path,
+        surface,
+        expression,
+        message: `has invalid syntax: ${error.message}`
+      }
+    ];
+  }
+}
+function validateAdminConditionExpression(expression, path, allowedRoots) {
+  try {
+    const invalidRoots = getInvalidRoots(expression, allowedRoots);
+    if (invalidRoots.length === 0) return [];
+    return [
+      {
+        path,
+        surface: "field.admin.condition",
+        expression,
+        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${allowedRoots.map((root) => `"${root}"`).join(", ")}`
+      }
+    ];
+  } catch (error) {
+    return [
+      {
+        path,
+        surface: "field.admin.condition",
+        expression,
+        message: `has invalid syntax: ${error.message}`
+      }
+    ];
+  }
+}
+function validatePreviewUrlExpression(expression, path, allowedRoots) {
+  try {
+    const invalidRoots = getInvalidRoots(expression, allowedRoots);
+    if (invalidRoots.length === 0) return [];
+    return [
+      {
+        path,
+        surface: "collection.admin.previewUrl",
+        expression,
+        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${allowedRoots.map((root) => `"${root}"`).join(", ")}`
+      }
+    ];
+  } catch (error) {
+    return [
+      {
+        path,
+        surface: "collection.admin.previewUrl",
+        expression,
+        message: `has invalid syntax: ${error.message}`
+      }
+    ];
+  }
+}
+function assertValidDeclarativeHookExpression(expression, surface, path) {
+  const issues = validateDeclarativeHookExpression(expression, surface, path);
+  if (issues.length === 0) return;
+  throw new Error(`Invalid declarative hook at ${path}: ${issues[0].message}`);
+}
+function assertValidDeclarativeHookResult(result, surface, path) {
+  if (isPlainObject(result)) return;
+  throw new Error(`Invalid declarative hook result at ${path}: ${surface} expressions must return an object`);
+}
+function collectFieldIssues(fields, path, issues) {
+  fields.forEach((field, index) => {
+    const fieldPath = `${path}.${fieldSegment(field, index)}`;
+    field.hooks?.beforeChange?.forEach((hook, hookIndex) => {
+      if (typeof hook !== "string") return;
+      issues.push(
+        ...validateDeclarativeHookExpression(
+          hook,
+          "field.beforeChange",
+          `${fieldPath}.hooks.beforeChange[${hookIndex}]`
+        )
+      );
+    });
+    field.hooks?.afterRead?.forEach((hook, hookIndex) => {
+      if (typeof hook !== "string") return;
+      issues.push({
+        path: `${fieldPath}.hooks.afterRead[${hookIndex}]`,
+        surface: "unsupported",
+        expression: hook,
+        message: "declarative strings are not supported on field hooks.afterRead"
+      });
+    });
+    if (typeof field.admin?.hooks?.onChange === "string") {
+      issues.push(
+        ...validateDeclarativeHookExpression(
+          field.admin.hooks.onChange,
+          "field.admin.onChange",
+          `${fieldPath}.admin.hooks.onChange`
+        )
+      );
+    }
+    if (typeof field.admin?.hooks?.options === "string") {
+      issues.push({
+        path: `${fieldPath}.admin.hooks.options`,
+        surface: "unsupported",
+        expression: field.admin.hooks.options,
+        message: "declarative strings are not supported on field admin.hooks.options"
+      });
+    }
+    if (Array.isArray(field.fields)) {
+      collectFieldIssues(field.fields, fieldPath, issues);
+    }
+    if (Array.isArray(field.blocks)) {
+      field.blocks.forEach((block, blockIndex) => {
+        if (!Array.isArray(block.fields)) return;
+        collectFieldIssues(block.fields, `${fieldPath}.${blockSegment(block, blockIndex)}`, issues);
+      });
+    }
+  });
+}
+function collectFieldNames(fields) {
+  return fields.flatMap(
+    (field) => typeof field.name === "string" && field.name.length > 0 ? [field.name] : []
+  );
+}
+function collectAdminConditionIssues(fields, path, rootFieldNames, issues) {
+  const scopeFieldNames = collectFieldNames(fields);
+  const allowedRoots = [.../* @__PURE__ */ new Set([...ADMIN_CONDITION_RESERVED_ROOTS, ...rootFieldNames, ...scopeFieldNames])];
+  fields.forEach((field, index) => {
+    const fieldPath = `${path}.${fieldSegment(field, index)}`;
+    if (typeof field.admin?.condition === "string") {
+      issues.push(
+        ...validateAdminConditionExpression(
+          field.admin.condition,
+          `${fieldPath}.admin.condition`,
+          allowedRoots
+        )
+      );
+    }
+    if (Array.isArray(field.fields)) {
+      collectAdminConditionIssues(field.fields, fieldPath, rootFieldNames, issues);
+    }
+    if (Array.isArray(field.blocks)) {
+      field.blocks.forEach((block, blockIndex) => {
+        if (!Array.isArray(block.fields)) return;
+        collectAdminConditionIssues(
+          block.fields,
+          `${fieldPath}.${blockSegment(block, blockIndex)}`,
+          rootFieldNames,
+          issues
+        );
+      });
+    }
+  });
+}
+function collectFieldAccessIssues(fields, path, issues) {
+  fields.forEach((field, index) => {
+    const fieldPath = `${path}.${fieldSegment(field, index)}`;
+    if (typeof field.access?.read === "string") {
+      issues.push(...validateDeclarativeAccessExpression(field.access.read, "field.access", `${fieldPath}.access.read`));
+    }
+    if (typeof field.access?.create === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(field.access.create, "field.access", `${fieldPath}.access.create`)
+      );
+    }
+    if (typeof field.access?.update === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(field.access.update, "field.access", `${fieldPath}.access.update`)
+      );
+    }
+    if (Array.isArray(field.fields)) {
+      collectFieldAccessIssues(field.fields, fieldPath, issues);
+    }
+    if (Array.isArray(field.blocks)) {
+      field.blocks.forEach((block, blockIndex) => {
+        if (!Array.isArray(block.fields)) return;
+        collectFieldAccessIssues(
+          block.fields,
+          `${fieldPath}.${blockSegment(block, blockIndex)}`,
+          issues
+        );
+      });
+    }
+  });
+}
+function collectHookIssues(hooks, scope, path, issues) {
+  if (!hooks) return;
+  const supported = {
+    beforeRead: `${scope}.beforeRead`,
+    afterRead: `${scope}.afterRead`,
+    beforeChange: `${scope}.beforeChange`
+  };
+  for (const [key, value] of Object.entries(hooks)) {
+    if (!Array.isArray(value)) continue;
+    value.forEach((hook, index) => {
+      if (typeof hook !== "string") return;
+      const surface = supported[key];
+      if (!surface) {
+        issues.push({
+          path: `${path}.${key}[${index}]`,
+          surface: "unsupported",
+          expression: hook,
+          message: `declarative strings are not supported on ${scope} hooks.${key}`
+        });
+        return;
+      }
+      issues.push(...validateDeclarativeHookExpression(hook, surface, `${path}.${key}[${index}]`));
+    });
+  }
+}
+function collectDeclarativeHookValidationIssues(config) {
+  const issues = [];
+  config.blocks?.forEach((block, blockIndex) => {
+    if (!Array.isArray(block.fields)) return;
+    collectFieldIssues(
+      block.fields,
+      blockSegment(block, blockIndex),
+      issues
+    );
+  });
+  config.collections.forEach((collection, collectionIndex) => {
+    const collectionPath = collectionSegment(collection, collectionIndex);
+    collectHookIssues(
+      collection.hooks,
+      "collection",
+      `${collectionPath}.hooks`,
+      issues
+    );
+    collectFieldIssues(collection.fields, collectionPath, issues);
+  });
+  config.globals?.forEach((global, globalIndex) => {
+    const globalPath = globalSegment(global, globalIndex);
+    collectHookIssues(
+      global.hooks,
+      "global",
+      `${globalPath}.hooks`,
+      issues
+    );
+    collectFieldIssues(global.fields, globalPath, issues);
+  });
+  return issues;
+}
+function collectDeclarativeAccessValidationIssues(config) {
+  const issues = [];
+  Object.entries(config.accessPolicies ?? {}).forEach(([name, value]) => {
+    if (typeof value !== "string") return;
+    issues.push(
+      ...validateDeclarativeAccessExpression(value, "config.accessPolicy", `accessPolicies.${name}`)
+    );
+  });
+  config.blocks?.forEach((block, blockIndex) => {
+    if (!Array.isArray(block.fields)) return;
+    collectFieldAccessIssues(
+      block.fields,
+      blockSegment(block, blockIndex),
+      issues
+    );
+  });
+  config.collections.forEach((collection, collectionIndex) => {
+    const collectionPath = collectionSegment(collection, collectionIndex);
+    if (typeof collection.access?.read === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.read,
+          "collection.access",
+          `${collectionPath}.access.read`
+        )
+      );
+    }
+    if (typeof collection.access?.create === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.create,
+          "collection.access",
+          `${collectionPath}.access.create`
+        )
+      );
+    }
+    if (typeof collection.access?.update === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.update,
+          "collection.access",
+          `${collectionPath}.access.update`
+        )
+      );
+    }
+    if (typeof collection.access?.delete === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.delete,
+          "collection.access",
+          `${collectionPath}.access.delete`
+        )
+      );
+    }
+    if (typeof collection.access?.readAudit === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.readAudit,
+          "collection.access",
+          `${collectionPath}.access.readAudit`
+        )
+      );
+    }
+    collectFieldAccessIssues(collection.fields, collectionPath, issues);
+  });
+  config.globals?.forEach((global, globalIndex) => {
+    const globalPath = globalSegment(global, globalIndex);
+    if (typeof global.access?.read === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(global.access.read, "global.access", `${globalPath}.access.read`)
+      );
+    }
+    if (typeof global.access?.update === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          global.access.update,
+          "global.access",
+          `${globalPath}.access.update`
+        )
+      );
+    }
+    collectFieldAccessIssues(global.fields, globalPath, issues);
+  });
+  return issues;
+}
+function collectAdminConditionValidationIssues(config) {
+  const issues = [];
+  config.blocks?.forEach((block, blockIndex) => {
+    if (!Array.isArray(block.fields)) return;
+    collectAdminConditionIssues(
+      block.fields,
+      blockSegment(block, blockIndex),
+      collectFieldNames(block.fields),
+      issues
+    );
+  });
+  config.collections.forEach((collection, collectionIndex) => {
+    const collectionPath = collectionSegment(collection, collectionIndex);
+    const rootFieldNames = collectFieldNames(collection.fields);
+    collectAdminConditionIssues(collection.fields, collectionPath, rootFieldNames, issues);
+  });
+  config.globals?.forEach((global, globalIndex) => {
+    const globalPath = globalSegment(global, globalIndex);
+    const rootFieldNames = collectFieldNames(global.fields);
+    collectAdminConditionIssues(global.fields, globalPath, rootFieldNames, issues);
+  });
+  return issues;
+}
+function collectPreviewUrlValidationIssues(config) {
+  const issues = [];
+  config.collections.forEach((collection, collectionIndex) => {
+    if (typeof collection.admin?.previewUrl !== "string") return;
+    const collectionPath = collectionSegment(collection, collectionIndex);
+    const allowedRoots = [
+      .../* @__PURE__ */ new Set([...PREVIEW_URL_RESERVED_ROOTS, ...collectFieldNames(collection.fields)])
+    ];
+    issues.push(
+      ...validatePreviewUrlExpression(
+        collection.admin.previewUrl,
+        `${collectionPath}.admin.previewUrl`,
+        allowedRoots
+      )
+    );
+  });
+  return issues;
+}
+function assertValidAdminConditionsInConfig(config, source = "config") {
+  const diagnostics = collectAdminConditionValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "adminCondition",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  if (diagnostics.length === 0) return;
+  throw new ConfigValidationError(source, diagnostics);
+}
+function assertValidPreviewUrlsInConfig(config, source = "config") {
+  const diagnostics = collectPreviewUrlValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "previewUrl",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  if (diagnostics.length === 0) return;
+  throw new ConfigValidationError(source, diagnostics);
+}
+function collectConfigDiagnostics(config) {
+  const hookIssues = collectDeclarativeHookValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "declarativeHook",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  const accessIssues = collectDeclarativeAccessValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "declarativeAccess",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  const adminConditionIssues = collectAdminConditionValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "adminCondition",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  const previewUrlIssues = collectPreviewUrlValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "previewUrl",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  return [...hookIssues, ...accessIssues, ...adminConditionIssues, ...previewUrlIssues];
+}
+function formatConfigDiagnostics(source, diagnostics, options = {}) {
+  const color = options.color ?? false;
+  const header = `${colorize("Config validation failed", 31, color)} in ${colorize(source, 36, color)}`;
+  const lines = diagnostics.flatMap((issue, index) => [
+    `${colorize(`${index + 1}.`, 31, color)} ${colorize(issue.path, 1, color)}`,
+    `   ${issue.message}`,
+    `   ${colorize("surface:", 90, color)} ${issue.surface}`
+  ]);
+  return `${header}
+${lines.join("\n")}`;
+}
+var ConfigValidationError = class extends Error {
+  diagnostics;
+  source;
+  constructor(source, diagnostics) {
+    super(formatConfigDiagnostics(source, diagnostics));
+    this.name = "ConfigValidationError";
+    this.source = source;
+    this.diagnostics = diagnostics;
+  }
+};
+function assertValidDeclarativeHooksInConfig(config, source = "config") {
+  const diagnostics = collectDeclarativeHookValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "declarativeHook",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  if (diagnostics.length === 0) return;
+  throw new ConfigValidationError(source, diagnostics);
+}
+function assertValidDeclarativeAccessInConfig(config, source = "config") {
+  const diagnostics = collectDeclarativeAccessValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "declarativeAccess",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  if (diagnostics.length === 0) return;
+  throw new ConfigValidationError(source, diagnostics);
+}
+
 // src/utils/hooks.ts
 async function runCollectionHooks(hooks, args, options = {}) {
   if (!hooks || hooks.length === 0) {
-    return args.data ?? args.doc ?? void 0;
+    return args.data ?? args.doc ?? args.query ?? void 0;
   }
-  let currentPayload = args.data ?? args.doc ?? void 0;
+  const payloadKey = args.data !== void 0 ? "data" : args.doc !== void 0 ? "doc" : "query" in args ? "query" : void 0;
+  let currentPayload = payloadKey === void 0 ? void 0 : args[payloadKey];
   for (const hook of hooks) {
     try {
-      const result = await hook({
+      const hookArgs = {
         ...args,
-        data: args.data !== void 0 ? currentPayload : void 0,
-        doc: args.doc !== void 0 ? currentPayload : void 0
-      });
+        ...payloadKey !== void 0 ? { [payloadKey]: currentPayload } : {}
+      };
+      const result = typeof hook === "string" ? await (() => {
+        if (options.surface) {
+          assertValidDeclarativeHookExpression(
+            hook,
+            options.surface,
+            options.path ?? options.surface
+          );
+        }
+        return import_jexl3.default.eval(hook, hookArgs);
+      })() : await hook(hookArgs);
       if (result !== void 0) {
-        currentPayload = result;
+        if (typeof hook === "string" && options.surface) {
+          assertValidDeclarativeHookResult(
+            result,
+            options.surface,
+            options.path ?? options.surface
+          );
+        }
+        currentPayload = typeof hook === "string" && currentPayload && typeof currentPayload === "object" && !Array.isArray(currentPayload) && result && typeof result === "object" && !Array.isArray(result) ? {
+          ...currentPayload,
+          ...result
+        } : result;
       }
     } catch (err) {
       if (options.isolated) {
@@ -1093,17 +1701,17 @@ async function runCollectionHooks(hooks, args, options = {}) {
   }
   return currentPayload;
 }
-async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
+async function executeFieldBeforeChange(fields, data, originalDoc, user, db, pathPrefix = "") {
   if (!data || typeof data !== "object") return data;
   const result = { ...data };
   for (const field of fields) {
     if (!field.name) continue;
+    const fieldPath = pathPrefix ? `${pathPrefix}.${field.name}` : field.name;
     const value = result[field.name];
     const origValue = originalDoc?.[field.name];
     let updatedValue = value;
     if (field.hooks?.beforeChange) {
       for (const hook of field.hooks.beforeChange) {
-        const typedHook = hook;
         const hookArgs = {
           value: updatedValue,
           originalDoc: originalDoc ?? void 0,
@@ -1111,7 +1719,14 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
           user,
           db
         };
-        updatedValue = await typedHook(hookArgs);
+        updatedValue = typeof hook === "string" ? await (() => {
+          assertValidDeclarativeHookExpression(
+            hook,
+            "field.beforeChange",
+            fieldPath
+          );
+          return import_jexl3.default.eval(hook, hookArgs);
+        })() : await hook(hookArgs);
       }
       result[field.name] = updatedValue;
     }
@@ -1122,7 +1737,8 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
           updatedValue,
           origValue,
           user,
-          db
+          db,
+          fieldPath
         );
       } else if (field.type === "array" && field.fields && Array.isArray(updatedValue)) {
         const arrayResult = [];
@@ -1135,7 +1751,8 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
               item,
               origItem,
               user,
-              db
+              db,
+              fieldPath
             )
           );
         }
@@ -1155,7 +1772,8 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
                 blockData,
                 origBlock,
                 user,
-                db
+                db,
+                fieldPath
               )
             );
           } else {
@@ -1285,12 +1903,12 @@ function validateUpload(file, config) {
 }
 
 // src/auth/jexl.ts
-var import_jexl2 = __toESM(require("jexl"), 1);
+var import_jexl4 = __toESM(require("jexl"), 1);
 async function evaluateAccess(expression, context) {
   if (expression === void 0 || expression === null) return false;
   if (typeof expression === "boolean") return expression;
   try {
-    const result = await import_jexl2.default.eval(expression, context);
+    const result = await import_jexl4.default.eval(expression, context);
     if (result && typeof result === "object" && !Array.isArray(result)) {
       return result;
     }
@@ -2173,6 +2791,10 @@ var CollectionController = class {
         query: where,
         user,
         db: readonlyDb
+      },
+      {
+        surface: "collection.beforeRead",
+        path: `collection:${this.collection.slug}.hooks.beforeRead`
       }
     );
     if (beforeReadResult !== void 0) {
@@ -2455,6 +3077,9 @@ var CollectionController = class {
       user,
       operation: "create",
       db: readonlyDb
+    }, {
+      surface: "collection.beforeChange",
+      path: `collection:${this.collection.slug}.hooks.beforeChange`
     });
     const doc = this.collection.workflow ? (await createWorkflowDocument({
       config,
@@ -2489,6 +3114,9 @@ var CollectionController = class {
       req: c.req,
       user,
       db: readonlyDb
+    }, {
+      surface: "collection.afterRead",
+      path: `collection:${this.collection.slug}.hooks.afterRead`
     });
     const finalDoc = await executeFieldAfterRead(
       this.collection.fields,
@@ -2586,6 +3214,9 @@ var CollectionController = class {
       user,
       operation: "create",
       db: readonlyDb
+    }, {
+      surface: "collection.beforeChange",
+      path: `collection:${this.collection.slug}.hooks.beforeChange`
     });
     const doc = await db.create({
       collection: this.collection.slug,
@@ -2608,6 +3239,9 @@ var CollectionController = class {
       req: c.req,
       user,
       db: readonlyDb
+    }, {
+      surface: "collection.afterRead",
+      path: `collection:${this.collection.slug}.hooks.afterRead`
     });
     const finalDoc = await executeFieldAfterRead(
       this.collection.fields,
@@ -2716,6 +3350,9 @@ var CollectionController = class {
       user,
       operation: "update",
       db: readonlyDb
+    }, {
+      surface: "collection.beforeChange",
+      path: `collection:${this.collection.slug}.hooks.beforeChange`
     });
     const doc = this.collection.workflow ? (await saveWorkflowDraft({
       config,
@@ -2753,6 +3390,9 @@ var CollectionController = class {
       req: c.req,
       user,
       db: readonlyDb
+    }, {
+      surface: "collection.afterRead",
+      path: `collection:${this.collection.slug}.hooks.afterRead`
     });
     const finalDoc = await executeFieldAfterRead(
       this.collection.fields,
@@ -3147,6 +3787,9 @@ var GlobalController = class {
       query: void 0,
       user,
       db: readonlyDb
+    }, {
+      surface: "global.beforeRead",
+      path: `global:${this.global.slug}.hooks.beforeRead`
     });
     let data = await db.getGlobal({ slug: this.global.slug });
     const isEmpty = !data || isFunctionallyEmpty(data);
@@ -3184,6 +3827,10 @@ var GlobalController = class {
         req: c.req,
         user,
         db: readonlyDb
+      },
+      {
+        surface: "global.afterRead",
+        path: `global:${this.global.slug}.hooks.afterRead`
       }
     );
     const docWithFieldHooks = await executeFieldAfterRead(
@@ -3266,6 +3913,9 @@ var GlobalController = class {
       user,
       operation: "update",
       db: readonlyDb
+    }, {
+      surface: "global.beforeChange",
+      path: `global:${this.global.slug}.hooks.beforeChange`
     });
     const updated = await db.updateGlobal({ slug: this.global.slug, data });
     await runCollectionHooks(
@@ -3285,6 +3935,9 @@ var GlobalController = class {
       req: c.req,
       user,
       db: readonlyDb
+    }, {
+      surface: "global.afterRead",
+      path: `global:${this.global.slug}.hooks.afterRead`
     });
     const finalDoc = await executeFieldAfterRead(
       this.global.fields,
@@ -3438,6 +4091,12 @@ function mergeDynamicConfig(baseConfig, dynamic) {
   return {
     ...baseConfig,
     ...normalizedDynamic.blocks ? { blocks: normalizedDynamic.blocks } : {},
+    ...dynamic.accessPolicies ? {
+      accessPolicies: {
+        ...baseConfig.accessPolicies ?? {},
+        ...dynamic.accessPolicies
+      }
+    } : {},
     ...dynamic.admin ? { admin: { ...baseConfig.admin, ...dynamic.admin } } : {},
     ...dynamic.adminAuth ? { adminAuth: { ...baseConfig.adminAuth, ...dynamic.adminAuth } } : {},
     collections: normalizedDynamic.collections ? [...baseConfig.collections, ...normalizedDynamic.collections] : baseConfig.collections,
@@ -3611,6 +4270,9 @@ var MediaController = class {
   }
 };
 
+// src/controllers/auth.controller.ts
+var import_node_crypto2 = require("crypto");
+
 // src/auth/lockout.ts
 var DEFAULT_MAX_LOGIN_ATTEMPTS = 5;
 var DEFAULT_LOCK_TIME_MS = 10 * 60 * 1e3;
@@ -3655,6 +4317,7 @@ var emailTokens = {
     border: "#dde0d7",
     accent: "#b6ff2e",
     code: "#f1f3ec",
+    codeBorder: "#e2e5dc",
     dangerSurface: "#fff2f0",
     dangerBorder: "#ffc9c2",
     dangerText: "#9f251b"
@@ -3704,7 +4367,13 @@ function table(content, style = "width:100%") {
 }
 function detailBox(content, monospace = false) {
   const font = monospace ? emailTokens.mono : emailTokens.font;
-  return table(row(escapeHtml(content), `padding:14px 16px;font-family:${font};font-size:13px;line-height:1.5;font-weight:${monospace ? "400" : "700"};color:${emailTokens.colors.text};word-break:break-all`), `width:100%;background:${emailTokens.colors.code};border-radius:${emailTokens.radius.control}`);
+  return table(
+    row(
+      escapeHtml(content),
+      `padding:14px 16px;font-family:${font};font-size:13px;line-height:1.5;font-weight:${monospace ? "400" : "700"};color:${emailTokens.colors.text};word-break:break-all`
+    ),
+    `width:100%;background:${emailTokens.colors.code};border:1px solid ${emailTokens.colors.codeBorder};border-radius:${emailTokens.radius.control}`
+  );
 }
 function ctaButton(label, href) {
   const safeHref = safeHttpUrl(href);
@@ -3714,22 +4383,46 @@ function ctaButton(label, href) {
     "padding:8px 0 24px"
   ), "width:auto");
 }
+function safeLinkDetailBox(href) {
+  const safeHref = safeHttpUrl(href);
+  if (!safeHref) return "";
+  return detailBox(safeHref, true);
+}
 function alertBox(content) {
   return table(row(escapeHtml(content), `padding:13px 16px;font-family:${emailTokens.font};font-size:13px;line-height:1.5;color:${emailTokens.colors.dangerText}`), `width:100%;background:${emailTokens.colors.dangerSurface};border:1px solid ${emailTokens.colors.dangerBorder};border-radius:${emailTokens.radius.control}`);
 }
 function layout({ preheader, title, content, footer }) {
   return `<!doctype html>
-<html lang="en">
-  <head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"></head>
-  <body style="margin:0;padding:0;background:${emailTokens.colors.canvas}">
-    <div style="display:none;max-height:0;overflow:hidden;opacity:0;color:transparent">${escapeHtml(preheader)}</div>
-    ${table(row(
-    table(
-      row("&nbsp;", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${sectionLabel("Dyrected")}${heading(title)}`, "padding:30px 32px 24px") + row(content, "padding:0 32px 32px") + row(`${divider()}${paragraph(footer, "20px 0 6px")}${paragraph("Privacy: this message contains account-related information; please avoid forwarding it.", "0")}`, "padding:0 32px 28px"),
-      `width:100%;max-width:${emailTokens.width};background:${emailTokens.colors.surface};border:1px solid ${emailTokens.colors.border};border-radius:${emailTokens.radius.card};overflow:hidden`
+<html lang="en" dir="ltr" xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta http-equiv="X-UA-Compatible" content="IE=edge">
+    <meta name="x-apple-disable-message-reformatting">
+    <meta name="format-detection" content="telephone=no,address=no,email=no,date=no,url=no">
+    <meta name="color-scheme" content="light">
+    <meta name="supported-color-schemes" content="light">
+    <title>${escapeHtml(title)}</title>
+  </head>
+  <body style="margin:0;padding:0;background-color:${emailTokens.colors.canvas};word-spacing:normal;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%">
+    <div style="display:none;max-height:0;max-width:0;overflow:hidden;opacity:0;mso-hide:all;color:transparent;font-size:1px;line-height:1px">
+      ${escapeHtml(preheader)}&#8203;&#847;&zwnj;&nbsp;&#8199;&#8199;&#847;&zwnj;&nbsp;
+    </div>
+    <center lang="en" style="width:100%;background-color:${emailTokens.colors.canvas}">
+      ${table(
+    row(
+      table(
+        row("&nbsp;", `height:5px;background:${emailTokens.colors.accent};font-size:0;line-height:0`) + row(`${sectionLabel("Dyrected")}${heading(title)}`, "padding:30px 32px 24px") + row(content, "padding:0 32px 32px") + row(
+          `${divider()}${paragraph(footer, "20px 0 6px")}${paragraph("Privacy: this message contains account-related information; please avoid forwarding it.", "0")}`,
+          "padding:0 32px 28px"
+        ),
+        `width:100%;max-width:${emailTokens.width};background:${emailTokens.colors.surface};border:1px solid ${emailTokens.colors.border};border-radius:${emailTokens.radius.card};overflow:hidden`
+      ),
+      "padding:32px 12px"
     ),
-    "padding:32px 12px"
-  ), `width:100%;background:${emailTokens.colors.canvas}`)}
+    `width:100%;background:${emailTokens.colors.canvas}`
+  )}
+    </center>
   </body>
 </html>`;
 }
@@ -3815,12 +4508,14 @@ function buildWelcomeEmail(config, args) {
 }
 function buildInviteEmail(config, args) {
   const custom = config.email?.templates?.invite?.(args);
+  const inviteLink = args.url;
+  const inviteLinkBlock = inviteLink ? safeLinkDetailBox(inviteLink) : "";
   return {
     subject: custom?.subject ?? "You've been invited",
     html: custom?.html ?? layout({
-      preheader: "You've been invited to join a Dyrected account.",
+      preheader: "You've been invited to join a Dyrected admin area.",
       title: "You've been invited",
-      content: `${args.invitedByEmail ? paragraph(`You were invited by ${args.invitedByEmail}.`) : ""}${paragraph("Use the token below to accept your invitation. It expires in 7 days.")}${sectionLabel("Invitation token")}${detailBox(args.token, true)}`,
+      content: inviteLink ? `${args.invitedByEmail ? paragraph(`You were invited by ${args.invitedByEmail}.`) : ""}${paragraph("Use the invitation link below to create your account. The link expires in 7 days.")}${ctaButton("Accept invitation", inviteLink)}${sectionLabel("Invitation link")}${inviteLinkBlock}${paragraph("If the button does not work, copy and paste the link above into your browser.", "12px 0 0")}` : `${args.invitedByEmail ? paragraph(`You were invited by ${args.invitedByEmail}.`) : ""}${paragraph("Use the invitation token below to accept your invitation. It expires in 7 days.")}${sectionLabel("Invitation token")}${detailBox(args.token, true)}`,
       footer: "If you weren't expecting this invitation, you can safely ignore this email."
     })
   };
@@ -3828,12 +4523,13 @@ function buildInviteEmail(config, args) {
 function buildResetPasswordEmail(config, args) {
   const custom = config.email?.templates?.resetPassword?.(args);
   const resetLink = args.url;
+  const resetLinkBlock = resetLink ? safeLinkDetailBox(resetLink) : "";
   return {
     subject: custom?.subject ?? "Reset your password",
     html: custom?.html ?? layout({
       preheader: "Reset your Dyrected password.",
       title: "Reset your password",
-      content: `${paragraph("We received a request to reset your password. The reset link and token expire in 1 hour.")}${resetLink ? ctaButton("Reset password", resetLink) : ""}${sectionLabel(resetLink ? "Or use this token" : "Reset token")}${detailBox(args.token, true)}`,
+      content: resetLink ? `${paragraph("We received a request to reset your password. The reset link expires in 1 hour.")}${ctaButton("Reset password", resetLink)}${sectionLabel("Reset link")}${resetLinkBlock}${paragraph("If the button does not work, copy and paste the link above into your browser.", "12px 0 0")}` : `${paragraph("We received a request to reset your password. The reset token expires in 1 hour.")}${sectionLabel("Reset token")}${detailBox(args.token, true)}`,
       footer: "If you didn't request a password reset, you can safely ignore this email."
     })
   };
@@ -3866,6 +4562,36 @@ var AuthController = class {
     } = user;
     return safeUser;
   }
+  hasField(name) {
+    return (this.collection.fields || []).some((field) => field.name === name);
+  }
+  async buildPendingInviteData(email, extraFields = {}) {
+    const {
+      id: _id,
+      password: _password,
+      email: _email,
+      ...safeExtraFields
+    } = extraFields;
+    const data = {
+      ...safeExtraFields,
+      email,
+      password: await hashPassword((0, import_node_crypto2.randomBytes)(32).toString("hex"))
+    };
+    if (this.hasField("status")) {
+      data.status = "pending";
+    }
+    return data;
+  }
+  buildAcceptedInviteData(hashedPassword, extraFields) {
+    const data = {
+      ...extraFields,
+      password: hashedPassword
+    };
+    if (this.hasField("status")) {
+      data.status = "active";
+    }
+    return data;
+  }
   clearLockoutState(c, userId) {
     const db = c.get("config").db;
     if (!db) return Promise.resolve(null);
@@ -4000,6 +4726,12 @@ var AuthController = class {
         401
       );
     }
+    if (user.status === "pending") {
+      return c.json(
+        { error: true, message: "This invitation has not been accepted yet." },
+        403
+      );
+    }
     const lockedUntilMs = getLockedUntilMs(user.lockedUntil);
     if (lockedUntilMs !== null && lockedUntilMs > Date.now()) {
       const retryAfterSeconds = Math.max(
@@ -4264,6 +4996,7 @@ var AuthController = class {
   // ---------------------------------------------------------------------------
   // POST /invite
   // Requires auth. Issues a signed invite token and emails it to the invitee.
+  // If inviteUrl is provided, the email uses a clickable acceptance URL.
   // ---------------------------------------------------------------------------
   async invite(c) {
     const config = c.get("config");
@@ -4277,17 +5010,32 @@ var AuthController = class {
     if (!body?.email) {
       return c.json({ error: true, message: "email is required." }, 400);
     }
+    const inviteData = body?.data && typeof body.data === "object" && !Array.isArray(body.data) ? body.data : {};
     const existing = await db.find({
       collection: this.collection.slug,
       where: { email: body.email },
       limit: 1
     });
-    if (existing.total > 0) {
+    const existingUser = existing.docs[0];
+    const existingIsPending = existingUser?.status === "pending";
+    if (existingUser && !existingIsPending) {
       return c.json(
         { error: true, message: "An account with that email already exists." },
         409
       );
     }
+    if (!existingUser) {
+      await db.create({
+        collection: this.collection.slug,
+        data: await this.buildPendingInviteData(body.email, inviteData)
+      });
+    } else if (Object.keys(inviteData).length > 0) {
+      await db.update({
+        collection: this.collection.slug,
+        id: String(existingUser.id),
+        data: await this.buildPendingInviteData(body.email, inviteData)
+      });
+    }
     const inviteToken = await signCollectionToken(
       {
         sub: body.email,
@@ -4297,10 +5045,13 @@ var AuthController = class {
       },
       "7d"
     );
+    const inviteUrl = body?.inviteUrl;
+    const url = inviteUrl ? `${inviteUrl}${inviteUrl.includes("?") ? "&" : "?"}inviteToken=${encodeURIComponent(inviteToken)}` : void 0;
     try {
       const { subject, html } = buildInviteEmail(config, {
         token: inviteToken,
-        invitedByEmail: requestUser.email
+        invitedByEmail: requestUser.email,
+        url
       });
       await sendEmail(config, { to: body.email, subject, html });
     } catch (err) {
@@ -4310,7 +5061,12 @@ var AuthController = class {
         email: body.email
       });
     }
-    return c.json({ success: true, message: `Invite sent to ${body.email}.` });
+    return c.json({
+      success: true,
+      message: `Invite sent to ${body.email}.`,
+      token: inviteToken,
+      inviteUrl: url
+    });
   }
   // ---------------------------------------------------------------------------
   // POST /accept-invite
@@ -4349,7 +5105,9 @@ var AuthController = class {
       where: { email: inviteeEmail },
       limit: 1
     });
-    if (existing.total > 0) {
+    const existingUser = existing.docs[0];
+    const existingIsPending = existingUser?.status === "pending";
+    if (existingUser && !existingIsPending) {
       return c.json(
         { error: true, message: "An account with that email already exists." },
         409
@@ -4357,9 +5115,17 @@ var AuthController = class {
     }
     const { token: _t, password: _p, ...extraFields } = body;
     const hashedPassword = await hashPassword(body.password);
-    const user = await db.create({
+    const user = existingUser ? await db.update({
+      collection: this.collection.slug,
+      id: String(existingUser.id),
+      data: this.buildAcceptedInviteData(hashedPassword, extraFields)
+    }) : await db.create({
       collection: this.collection.slug,
-      data: { ...extraFields, email: inviteeEmail, password: hashedPassword }
+      data: {
+        ...extraFields,
+        email: inviteeEmail,
+        ...this.buildAcceptedInviteData(hashedPassword, {})
+      }
     });
     const sessionToken = await issueAuthSessionToken({
       config,
@@ -4385,7 +5151,7 @@ var AuthController = class {
 };
 
 // src/controllers/admin-auth.controller.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 var import_node_util3 = require("util");
 var import_jose2 = require("jose");
 var AdminAuthController = class {
@@ -4594,7 +5360,7 @@ var AdminAuthController = class {
             access.roles,
             access.data
           ),
-          password: await hashPassword((0, import_node_crypto2.randomBytes)(32).toString("hex"))
+          password: await hashPassword((0, import_node_crypto3.randomBytes)(32).toString("hex"))
         }
       });
     } else if (user) {
@@ -4680,7 +5446,7 @@ var AdminAuthController = class {
   }
   async buildOidcStartUrl(provider, returnTo, siteId, origin) {
     const discovery = await this.getOidcDiscovery(provider);
-    const nonce = (0, import_node_crypto2.randomBytes)(16).toString("hex");
+    const nonce = (0, import_node_crypto3.randomBytes)(16).toString("hex");
     const state = await this.signState({
       providerId: provider.id,
       returnTo,
@@ -6247,6 +7013,7 @@ function getSwaggerHtml(specUrl) {
 }
 
 // src/router.ts
+var SERIALIZED_ADMIN_HOOK_PREFIX = "__dyrected_fn__:";
 function accessGate(config, target, action) {
   return async (c, next) => {
     const user = c.get("user");
@@ -6273,7 +7040,7 @@ function serializeFieldForApi(f) {
   if (serialized.admin?.hooks) {
     const hooks = { ...serialized.admin.hooks };
     if (typeof hooks.onChange === "function") {
-      hooks.onChange = hooks.onChange.toString();
+      hooks.onChange = `${SERIALIZED_ADMIN_HOOK_PREFIX}${hooks.onChange.toString()}`;
     }
     if (typeof hooks.options === "function") {
       hooks.options = hooks.options.toString();
@@ -6307,6 +7074,10 @@ function registerRoutes(app, config) {
   app.get("/api/schemas", optionalAuth(config), async (c) => {
     const siteId = c.req.header("X-Site-Id");
     const requestConfig = siteId && config.onSchemaFetch ? mergeDynamicConfig(config, await config.onSchemaFetch(siteId)) : config;
+    assertValidDeclarativeHooksInConfig(requestConfig, "/api/schemas");
+    assertValidDeclarativeAccessInConfig(requestConfig, "/api/schemas");
+    assertValidAdminConditionsInConfig(requestConfig, "/api/schemas");
+    assertValidPreviewUrlsInConfig(requestConfig, "/api/schemas");
     const collections = [...requestConfig.collections];
     const globals = [...requestConfig.globals];
     const user = c.get("user");
@@ -6421,7 +7192,18 @@ function registerRoutes(app, config) {
       globals: filteredGlobals,
       admin: requestConfig.admin || {},
       adminAuth: getPublicAdminAuthConfig(requestConfig.adminAuth, collections),
-      hasStorage: !!requestConfig.storage
+      hasStorage: !!requestConfig.storage,
+      configDiagnostics: collectConfigDiagnostics(requestConfig),
+      adminHealth: {
+        emailConfigured: !!requestConfig.email,
+        secureAuthSecretConfigured: !!process.env.DYRECTED_JWT_SECRET,
+        authCollectionConfigured: requestConfig.collections.some(
+          (collection) => !!collection.auth
+        ),
+        uploadCollectionConfigured: requestConfig.collections.some(
+          (collection) => !!collection.upload
+        )
+      }
     });
   });
   app.get(
@@ -7116,6 +7898,10 @@ var AUTH_SESSIONS_COLLECTION_CONFIG = {
 };
 function normalizeConfig(config) {
   const schemaAwareConfig = normalizeSchemaFragment(config);
+  assertValidDeclarativeHooksInConfig(schemaAwareConfig, "config");
+  assertValidDeclarativeAccessInConfig(schemaAwareConfig, "config");
+  assertValidAdminConditionsInConfig(schemaAwareConfig, "config");
+  assertValidPreviewUrlsInConfig(schemaAwareConfig, "config");
   const collections = schemaAwareConfig?.collections || [];
   const globals = schemaAwareConfig?.globals || [];
   const needsAudit = collections.some((col) => col.audit);
@@ -7178,6 +7964,27 @@ function normalizeConfig(config) {
           }
         ];
       }
+      if (!existingFieldNames.has("status")) {
+        fields = [
+          ...fields,
+          {
+            name: "status",
+            type: "select",
+            label: "Status",
+            defaultValue: "active",
+            options: [
+              { value: "active", label: "Active" },
+              { value: "pending", label: "Pending" }
+            ],
+            access: {
+              update: "user.roles && 'admin' in user.roles && user.id != id"
+            },
+            admin: {
+              condition: `!(data.roles && "admin" in data.roles)`
+            }
+          }
+        ];
+      }
       fields = fields.map((field) => {
         if (field.name === "email") {
           return {
@@ -7217,6 +8024,15 @@ function normalizeConfig(config) {
             }
           };
         }
+        if (field.name === "status") {
+          return {
+            ...field,
+            access: {
+              ...field.access || {},
+              update: "user.roles && 'admin' in user.roles && user.id != id"
+            }
+          };
+        }
         return field;
       });
     }
@@ -7254,9 +8070,7 @@ function normalizeConfig(config) {
       }
     }
     const updatedFieldNames = new Set(fields.map((f) => f.name));
-    const fieldsToInject = SYSTEM_FIELDS.filter(
-      (f) => !updatedFieldNames.has(f.name)
-    );
+    const fieldsToInject = SYSTEM_FIELDS.filter((f) => !updatedFieldNames.has(f.name));
     const workflow = col.workflow || (col.drafts ? simplePublishingWorkflow() : void 0);
     return {
       ...col,
@@ -7264,20 +8078,13 @@ function normalizeConfig(config) {
       fields: [...fields, ...fieldsToInject]
     };
   });
-  const hasAuditCollection = normalizedCollections.some(
-    (col) => col.slug === AUDIT_COLLECTION_SLUG
-  );
+  const hasAuditCollection = normalizedCollections.some((col) => col.slug === AUDIT_COLLECTION_SLUG);
   const systemCollections = [];
-  if (needsAudit && !hasAuditCollection)
-    systemCollections.push(AUDIT_COLLECTION);
-  if (needsWorkflow && !normalizedCollections.some(
-    (col) => col.slug === WORKFLOW_HISTORY_COLLECTION
-  )) {
+  if (needsAudit && !hasAuditCollection) systemCollections.push(AUDIT_COLLECTION);
+  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === WORKFLOW_HISTORY_COLLECTION)) {
     systemCollections.push(WORKFLOW_HISTORY_COLLECTION_CONFIG);
   }
-  if (needsWorkflow && !normalizedCollections.some(
-    (col) => col.slug === LIFECYCLE_EVENTS_COLLECTION
-  )) {
+  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === LIFECYCLE_EVENTS_COLLECTION)) {
     systemCollections.push(LIFECYCLE_EVENTS_COLLECTION_CONFIG);
   }
   if (needsAuthSessions && !normalizedCollections.some((col) => col.slug === AUTH_SESSIONS_COLLECTION)) {