@dyrected/core 2.6.3 → 2.7.0

package/dist/index.cjs

@@ -30,12 +30,24 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ConfigValidationError: () => ConfigValidationError,
   LIFECYCLE_EVENTS_COLLECTION: () => LIFECYCLE_EVENTS_COLLECTION,
   LIFECYCLE_EVENT_NAMES: () => LIFECYCLE_EVENT_NAMES,
   WORKFLOW_HISTORY_COLLECTION: () => WORKFLOW_HISTORY_COLLECTION,
+  assertValidAdminConditionsInConfig: () => assertValidAdminConditionsInConfig,
+  assertValidDeclarativeAccessInConfig: () => assertValidDeclarativeAccessInConfig,
+  assertValidDeclarativeHookExpression: () => assertValidDeclarativeHookExpression,
+  assertValidDeclarativeHookResult: () => assertValidDeclarativeHookResult,
+  assertValidDeclarativeHooksInConfig: () => assertValidDeclarativeHooksInConfig,
+  assertValidPreviewUrlsInConfig: () => assertValidPreviewUrlsInConfig,
   availableWorkflowTransitions: () => availableWorkflowTransitions,
   buildSqlOrderBy: () => buildSqlOrderBy,
   canViewWorkflowDraft: () => canViewWorkflowDraft,
+  collectAdminConditionValidationIssues: () => collectAdminConditionValidationIssues,
+  collectConfigDiagnostics: () => collectConfigDiagnostics,
+  collectDeclarativeAccessValidationIssues: () => collectDeclarativeAccessValidationIssues,
+  collectDeclarativeHookValidationIssues: () => collectDeclarativeHookValidationIssues,
+  collectPreviewUrlValidationIssues: () => collectPreviewUrlValidationIssues,
   createLifecycleEvent: () => createLifecycleEvent,
   createWorkflowDocument: () => createWorkflowDocument,
   defineArrayField: () => defineArrayField,
@@ -71,10 +83,12 @@ __export(index_exports, {
   dispatchPendingLifecycleEvents: () => dispatchPendingLifecycleEvents,
   executeFieldAfterRead: () => executeFieldAfterRead,
   executeFieldBeforeChange: () => executeFieldBeforeChange,
+  formatConfigDiagnostics: () => formatConfigDiagnostics,
   generateOpenApi: () => generateOpenApi,
   getAdminAuthCollection: () => getAdminAuthCollection,
   getPublicAdminAuthConfig: () => getPublicAdminAuthConfig,
   initializeWorkflowDocument: () => initializeWorkflowDocument,
+  isConfigValidationError: () => isConfigValidationError,
   materializeWorkflowDocument: () => materializeWorkflowDocument,
   normalizeConfig: () => normalizeConfig,
   numericFieldNames: () => numericFieldNames,
@@ -88,6 +102,10 @@ __export(index_exports, {
   saveWorkflowDraft: () => saveWorkflowDraft,
   simplePublishingWorkflow: () => simplePublishingWorkflow,
   transitionWorkflow: () => transitionWorkflow,
+  validateAdminConditionExpression: () => validateAdminConditionExpression,
+  validateDeclarativeAccessExpression: () => validateDeclarativeAccessExpression,
+  validateDeclarativeHookExpression: () => validateDeclarativeHookExpression,
+  validatePreviewUrlExpression: () => validatePreviewUrlExpression,
   workflowCapabilities: () => workflowCapabilities
 });
 module.exports = __toCommonJS(index_exports);
@@ -592,6 +610,594 @@ function normalizeSchemaFragment(fragment) {
   };
 }
 
+// src/utils/declarative-hooks.ts
+var import_jexl = __toESM(require("jexl"), 1);
+var SURFACE_ROOTS = {
+  "collection.beforeRead": ["req", "user", "query"],
+  "collection.afterRead": ["req", "user", "doc"],
+  "collection.beforeChange": ["req", "user", "data", "doc", "operation"],
+  "global.beforeRead": ["req", "user", "query"],
+  "global.afterRead": ["req", "user", "doc"],
+  "global.beforeChange": ["req", "user", "data", "doc", "operation"],
+  "field.beforeChange": ["value", "data", "originalDoc", "user"],
+  "field.admin.onChange": ["value", "siblingData", "data"]
+};
+var ACCESS_ROOTS = ["user", "req", "doc", "data", "id", "config"];
+var ADMIN_CONDITION_RESERVED_ROOTS = ["data", "siblingData", "user", "id"];
+var PREVIEW_URL_RESERVED_ROOTS = ["siteUrl", "id"];
+var COMPILE_CACHE = /* @__PURE__ */ new Map();
+function compileExpression(expression) {
+  const cached = COMPILE_CACHE.get(expression);
+  if (cached) return cached;
+  const compiled = import_jexl.default.compile(expression);
+  const next = { ast: compiled._ast };
+  COMPILE_CACHE.set(expression, next);
+  return next;
+}
+function isPlainObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function quoteSegment(value) {
+  return `["${value.replace(/"/g, '\\"')}"]`;
+}
+function fieldSegment(field, index) {
+  return typeof field.name === "string" && field.name.length > 0 ? `fields${quoteSegment(field.name)}` : `fields[${index}]`;
+}
+function blockSegment(block, index) {
+  return typeof block.slug === "string" && block.slug.length > 0 ? `blocks${quoteSegment(block.slug)}` : `blocks[${index}]`;
+}
+function collectionSegment(collection, index) {
+  return typeof collection.slug === "string" && collection.slug.length > 0 ? `collections${quoteSegment(collection.slug)}` : `collections[${index}]`;
+}
+function globalSegment(global, index) {
+  return typeof global.slug === "string" && global.slug.length > 0 ? `globals${quoteSegment(global.slug)}` : `globals[${index}]`;
+}
+function colorize(value, code, enabled) {
+  return enabled ? `\x1B[${code}m${value}\x1B[0m` : value;
+}
+function collectRootIdentifiers(node, roots, seen) {
+  if (!node || typeof node !== "object" || seen.has(node)) return;
+  seen.add(node);
+  const candidate = node;
+  if (candidate.type === "Identifier") {
+    if (candidate.from) {
+      collectRootIdentifiers(candidate.from, roots, seen);
+      return;
+    }
+    if (typeof candidate.value === "string" && candidate.value !== "null") {
+      roots.add(candidate.value);
+    }
+    return;
+  }
+  if (Array.isArray(node)) {
+    for (const entry of node) collectRootIdentifiers(entry, roots, seen);
+    return;
+  }
+  for (const value of Object.values(node)) {
+    if (Array.isArray(value)) {
+      for (const entry of value) collectRootIdentifiers(entry, roots, seen);
+      continue;
+    }
+    if (value && typeof value === "object") {
+      collectRootIdentifiers(value, roots, seen);
+    }
+  }
+}
+function getInvalidRoots(expression, allowedRoots) {
+  const { ast } = compileExpression(expression);
+  const roots = /* @__PURE__ */ new Set();
+  collectRootIdentifiers(ast, roots, /* @__PURE__ */ new Set());
+  const allowed = new Set(allowedRoots);
+  return [...roots].filter((root) => !allowed.has(root));
+}
+function validateDeclarativeHookExpression(expression, surface, path) {
+  try {
+    const invalidRoots = getInvalidRoots(expression, SURFACE_ROOTS[surface]);
+    if (invalidRoots.length === 0) return [];
+    return [
+      {
+        path,
+        surface,
+        expression,
+        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${SURFACE_ROOTS[surface].map((root) => `"${root}"`).join(", ")}`
+      }
+    ];
+  } catch (error) {
+    return [
+      {
+        path,
+        surface,
+        expression,
+        message: `has invalid syntax: ${error.message}`
+      }
+    ];
+  }
+}
+function validateDeclarativeAccessExpression(expression, surface, path) {
+  try {
+    const invalidRoots = getInvalidRoots(expression, ACCESS_ROOTS);
+    if (invalidRoots.length === 0) return [];
+    return [
+      {
+        path,
+        surface,
+        expression,
+        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${ACCESS_ROOTS.map((root) => `"${root}"`).join(", ")}`
+      }
+    ];
+  } catch (error) {
+    return [
+      {
+        path,
+        surface,
+        expression,
+        message: `has invalid syntax: ${error.message}`
+      }
+    ];
+  }
+}
+function validateAdminConditionExpression(expression, path, allowedRoots) {
+  try {
+    const invalidRoots = getInvalidRoots(expression, allowedRoots);
+    if (invalidRoots.length === 0) return [];
+    return [
+      {
+        path,
+        surface: "field.admin.condition",
+        expression,
+        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${allowedRoots.map((root) => `"${root}"`).join(", ")}`
+      }
+    ];
+  } catch (error) {
+    return [
+      {
+        path,
+        surface: "field.admin.condition",
+        expression,
+        message: `has invalid syntax: ${error.message}`
+      }
+    ];
+  }
+}
+function validatePreviewUrlExpression(expression, path, allowedRoots) {
+  try {
+    const invalidRoots = getInvalidRoots(expression, allowedRoots);
+    if (invalidRoots.length === 0) return [];
+    return [
+      {
+        path,
+        surface: "collection.admin.previewUrl",
+        expression,
+        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${allowedRoots.map((root) => `"${root}"`).join(", ")}`
+      }
+    ];
+  } catch (error) {
+    return [
+      {
+        path,
+        surface: "collection.admin.previewUrl",
+        expression,
+        message: `has invalid syntax: ${error.message}`
+      }
+    ];
+  }
+}
+function assertValidDeclarativeHookExpression(expression, surface, path) {
+  const issues = validateDeclarativeHookExpression(expression, surface, path);
+  if (issues.length === 0) return;
+  throw new Error(`Invalid declarative hook at ${path}: ${issues[0].message}`);
+}
+function assertValidDeclarativeHookResult(result, surface, path) {
+  if (isPlainObject(result)) return;
+  throw new Error(`Invalid declarative hook result at ${path}: ${surface} expressions must return an object`);
+}
+function collectFieldIssues(fields, path, issues) {
+  fields.forEach((field, index) => {
+    const fieldPath = `${path}.${fieldSegment(field, index)}`;
+    field.hooks?.beforeChange?.forEach((hook, hookIndex) => {
+      if (typeof hook !== "string") return;
+      issues.push(
+        ...validateDeclarativeHookExpression(
+          hook,
+          "field.beforeChange",
+          `${fieldPath}.hooks.beforeChange[${hookIndex}]`
+        )
+      );
+    });
+    field.hooks?.afterRead?.forEach((hook, hookIndex) => {
+      if (typeof hook !== "string") return;
+      issues.push({
+        path: `${fieldPath}.hooks.afterRead[${hookIndex}]`,
+        surface: "unsupported",
+        expression: hook,
+        message: "declarative strings are not supported on field hooks.afterRead"
+      });
+    });
+    if (typeof field.admin?.hooks?.onChange === "string") {
+      issues.push(
+        ...validateDeclarativeHookExpression(
+          field.admin.hooks.onChange,
+          "field.admin.onChange",
+          `${fieldPath}.admin.hooks.onChange`
+        )
+      );
+    }
+    if (typeof field.admin?.hooks?.options === "string") {
+      issues.push({
+        path: `${fieldPath}.admin.hooks.options`,
+        surface: "unsupported",
+        expression: field.admin.hooks.options,
+        message: "declarative strings are not supported on field admin.hooks.options"
+      });
+    }
+    if (Array.isArray(field.fields)) {
+      collectFieldIssues(field.fields, fieldPath, issues);
+    }
+    if (Array.isArray(field.blocks)) {
+      field.blocks.forEach((block, blockIndex) => {
+        if (!Array.isArray(block.fields)) return;
+        collectFieldIssues(block.fields, `${fieldPath}.${blockSegment(block, blockIndex)}`, issues);
+      });
+    }
+  });
+}
+function collectFieldNames(fields) {
+  return fields.flatMap(
+    (field) => typeof field.name === "string" && field.name.length > 0 ? [field.name] : []
+  );
+}
+function collectAdminConditionIssues(fields, path, rootFieldNames, issues) {
+  const scopeFieldNames = collectFieldNames(fields);
+  const allowedRoots = [.../* @__PURE__ */ new Set([...ADMIN_CONDITION_RESERVED_ROOTS, ...rootFieldNames, ...scopeFieldNames])];
+  fields.forEach((field, index) => {
+    const fieldPath = `${path}.${fieldSegment(field, index)}`;
+    if (typeof field.admin?.condition === "string") {
+      issues.push(
+        ...validateAdminConditionExpression(
+          field.admin.condition,
+          `${fieldPath}.admin.condition`,
+          allowedRoots
+        )
+      );
+    }
+    if (Array.isArray(field.fields)) {
+      collectAdminConditionIssues(field.fields, fieldPath, rootFieldNames, issues);
+    }
+    if (Array.isArray(field.blocks)) {
+      field.blocks.forEach((block, blockIndex) => {
+        if (!Array.isArray(block.fields)) return;
+        collectAdminConditionIssues(
+          block.fields,
+          `${fieldPath}.${blockSegment(block, blockIndex)}`,
+          rootFieldNames,
+          issues
+        );
+      });
+    }
+  });
+}
+function collectFieldAccessIssues(fields, path, issues) {
+  fields.forEach((field, index) => {
+    const fieldPath = `${path}.${fieldSegment(field, index)}`;
+    if (typeof field.access?.read === "string") {
+      issues.push(...validateDeclarativeAccessExpression(field.access.read, "field.access", `${fieldPath}.access.read`));
+    }
+    if (typeof field.access?.create === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(field.access.create, "field.access", `${fieldPath}.access.create`)
+      );
+    }
+    if (typeof field.access?.update === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(field.access.update, "field.access", `${fieldPath}.access.update`)
+      );
+    }
+    if (Array.isArray(field.fields)) {
+      collectFieldAccessIssues(field.fields, fieldPath, issues);
+    }
+    if (Array.isArray(field.blocks)) {
+      field.blocks.forEach((block, blockIndex) => {
+        if (!Array.isArray(block.fields)) return;
+        collectFieldAccessIssues(
+          block.fields,
+          `${fieldPath}.${blockSegment(block, blockIndex)}`,
+          issues
+        );
+      });
+    }
+  });
+}
+function collectHookIssues(hooks, scope, path, issues) {
+  if (!hooks) return;
+  const supported = {
+    beforeRead: `${scope}.beforeRead`,
+    afterRead: `${scope}.afterRead`,
+    beforeChange: `${scope}.beforeChange`
+  };
+  for (const [key, value] of Object.entries(hooks)) {
+    if (!Array.isArray(value)) continue;
+    value.forEach((hook, index) => {
+      if (typeof hook !== "string") return;
+      const surface = supported[key];
+      if (!surface) {
+        issues.push({
+          path: `${path}.${key}[${index}]`,
+          surface: "unsupported",
+          expression: hook,
+          message: `declarative strings are not supported on ${scope} hooks.${key}`
+        });
+        return;
+      }
+      issues.push(...validateDeclarativeHookExpression(hook, surface, `${path}.${key}[${index}]`));
+    });
+  }
+}
+function collectDeclarativeHookValidationIssues(config) {
+  const issues = [];
+  config.blocks?.forEach((block, blockIndex) => {
+    if (!Array.isArray(block.fields)) return;
+    collectFieldIssues(
+      block.fields,
+      blockSegment(block, blockIndex),
+      issues
+    );
+  });
+  config.collections.forEach((collection, collectionIndex) => {
+    const collectionPath = collectionSegment(collection, collectionIndex);
+    collectHookIssues(
+      collection.hooks,
+      "collection",
+      `${collectionPath}.hooks`,
+      issues
+    );
+    collectFieldIssues(collection.fields, collectionPath, issues);
+  });
+  config.globals?.forEach((global, globalIndex) => {
+    const globalPath = globalSegment(global, globalIndex);
+    collectHookIssues(
+      global.hooks,
+      "global",
+      `${globalPath}.hooks`,
+      issues
+    );
+    collectFieldIssues(global.fields, globalPath, issues);
+  });
+  return issues;
+}
+function collectDeclarativeAccessValidationIssues(config) {
+  const issues = [];
+  Object.entries(config.accessPolicies ?? {}).forEach(([name, value]) => {
+    if (typeof value !== "string") return;
+    issues.push(
+      ...validateDeclarativeAccessExpression(value, "config.accessPolicy", `accessPolicies.${name}`)
+    );
+  });
+  config.blocks?.forEach((block, blockIndex) => {
+    if (!Array.isArray(block.fields)) return;
+    collectFieldAccessIssues(
+      block.fields,
+      blockSegment(block, blockIndex),
+      issues
+    );
+  });
+  config.collections.forEach((collection, collectionIndex) => {
+    const collectionPath = collectionSegment(collection, collectionIndex);
+    if (typeof collection.access?.read === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.read,
+          "collection.access",
+          `${collectionPath}.access.read`
+        )
+      );
+    }
+    if (typeof collection.access?.create === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.create,
+          "collection.access",
+          `${collectionPath}.access.create`
+        )
+      );
+    }
+    if (typeof collection.access?.update === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.update,
+          "collection.access",
+          `${collectionPath}.access.update`
+        )
+      );
+    }
+    if (typeof collection.access?.delete === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.delete,
+          "collection.access",
+          `${collectionPath}.access.delete`
+        )
+      );
+    }
+    if (typeof collection.access?.readAudit === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.readAudit,
+          "collection.access",
+          `${collectionPath}.access.readAudit`
+        )
+      );
+    }
+    collectFieldAccessIssues(collection.fields, collectionPath, issues);
+  });
+  config.globals?.forEach((global, globalIndex) => {
+    const globalPath = globalSegment(global, globalIndex);
+    if (typeof global.access?.read === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(global.access.read, "global.access", `${globalPath}.access.read`)
+      );
+    }
+    if (typeof global.access?.update === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          global.access.update,
+          "global.access",
+          `${globalPath}.access.update`
+        )
+      );
+    }
+    collectFieldAccessIssues(global.fields, globalPath, issues);
+  });
+  return issues;
+}
+function collectAdminConditionValidationIssues(config) {
+  const issues = [];
+  config.blocks?.forEach((block, blockIndex) => {
+    if (!Array.isArray(block.fields)) return;
+    collectAdminConditionIssues(
+      block.fields,
+      blockSegment(block, blockIndex),
+      collectFieldNames(block.fields),
+      issues
+    );
+  });
+  config.collections.forEach((collection, collectionIndex) => {
+    const collectionPath = collectionSegment(collection, collectionIndex);
+    const rootFieldNames = collectFieldNames(collection.fields);
+    collectAdminConditionIssues(collection.fields, collectionPath, rootFieldNames, issues);
+  });
+  config.globals?.forEach((global, globalIndex) => {
+    const globalPath = globalSegment(global, globalIndex);
+    const rootFieldNames = collectFieldNames(global.fields);
+    collectAdminConditionIssues(global.fields, globalPath, rootFieldNames, issues);
+  });
+  return issues;
+}
+function collectPreviewUrlValidationIssues(config) {
+  const issues = [];
+  config.collections.forEach((collection, collectionIndex) => {
+    if (typeof collection.admin?.previewUrl !== "string") return;
+    const collectionPath = collectionSegment(collection, collectionIndex);
+    const allowedRoots = [
+      .../* @__PURE__ */ new Set([...PREVIEW_URL_RESERVED_ROOTS, ...collectFieldNames(collection.fields)])
+    ];
+    issues.push(
+      ...validatePreviewUrlExpression(
+        collection.admin.previewUrl,
+        `${collectionPath}.admin.previewUrl`,
+        allowedRoots
+      )
+    );
+  });
+  return issues;
+}
+function assertValidAdminConditionsInConfig(config, source = "config") {
+  const diagnostics = collectAdminConditionValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "adminCondition",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  if (diagnostics.length === 0) return;
+  throw new ConfigValidationError(source, diagnostics);
+}
+function assertValidPreviewUrlsInConfig(config, source = "config") {
+  const diagnostics = collectPreviewUrlValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "previewUrl",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  if (diagnostics.length === 0) return;
+  throw new ConfigValidationError(source, diagnostics);
+}
+function collectConfigDiagnostics(config) {
+  const hookIssues = collectDeclarativeHookValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "declarativeHook",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  const accessIssues = collectDeclarativeAccessValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "declarativeAccess",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  const adminConditionIssues = collectAdminConditionValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "adminCondition",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  const previewUrlIssues = collectPreviewUrlValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "previewUrl",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  return [...hookIssues, ...accessIssues, ...adminConditionIssues, ...previewUrlIssues];
+}
+function formatConfigDiagnostics(source, diagnostics, options = {}) {
+  const color = options.color ?? false;
+  const header = `${colorize("Config validation failed", 31, color)} in ${colorize(source, 36, color)}`;
+  const lines = diagnostics.flatMap((issue, index) => [
+    `${colorize(`${index + 1}.`, 31, color)} ${colorize(issue.path, 1, color)}`,
+    `   ${issue.message}`,
+    `   ${colorize("surface:", 90, color)} ${issue.surface}`
+  ]);
+  return `${header}
+${lines.join("\n")}`;
+}
+var ConfigValidationError = class extends Error {
+  diagnostics;
+  source;
+  constructor(source, diagnostics) {
+    super(formatConfigDiagnostics(source, diagnostics));
+    this.name = "ConfigValidationError";
+    this.source = source;
+    this.diagnostics = diagnostics;
+  }
+};
+function isConfigValidationError(error) {
+  return error instanceof ConfigValidationError;
+}
+function assertValidDeclarativeHooksInConfig(config, source = "config") {
+  const diagnostics = collectDeclarativeHookValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "declarativeHook",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  if (diagnostics.length === 0) return;
+  throw new ConfigValidationError(source, diagnostics);
+}
+function assertValidDeclarativeAccessInConfig(config, source = "config") {
+  const diagnostics = collectDeclarativeAccessValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "declarativeAccess",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  if (diagnostics.length === 0) return;
+  throw new ConfigValidationError(source, diagnostics);
+}
+
 // src/utils/config.ts
 var AUDIT_COLLECTION_SLUG = "__audit";
 var SYSTEM_FIELDS = [
@@ -720,6 +1326,10 @@ var AUTH_SESSIONS_COLLECTION_CONFIG = {
 };
 function normalizeConfig(config) {
   const schemaAwareConfig = normalizeSchemaFragment(config);
+  assertValidDeclarativeHooksInConfig(schemaAwareConfig, "config");
+  assertValidDeclarativeAccessInConfig(schemaAwareConfig, "config");
+  assertValidAdminConditionsInConfig(schemaAwareConfig, "config");
+  assertValidPreviewUrlsInConfig(schemaAwareConfig, "config");
   const collections = schemaAwareConfig?.collections || [];
   const globals = schemaAwareConfig?.globals || [];
   const needsAudit = collections.some((col) => col.audit);
@@ -782,6 +1392,27 @@ function normalizeConfig(config) {
           }
         ];
       }
+      if (!existingFieldNames.has("status")) {
+        fields = [
+          ...fields,
+          {
+            name: "status",
+            type: "select",
+            label: "Status",
+            defaultValue: "active",
+            options: [
+              { value: "active", label: "Active" },
+              { value: "pending", label: "Pending" }
+            ],
+            access: {
+              update: "user.roles && 'admin' in user.roles && user.id != id"
+            },
+            admin: {
+              condition: `!(data.roles && "admin" in data.roles)`
+            }
+          }
+        ];
+      }
       fields = fields.map((field) => {
         if (field.name === "email") {
           return {
@@ -821,6 +1452,15 @@ function normalizeConfig(config) {
             }
           };
         }
+        if (field.name === "status") {
+          return {
+            ...field,
+            access: {
+              ...field.access || {},
+              update: "user.roles && 'admin' in user.roles && user.id != id"
+            }
+          };
+        }
         return field;
       });
     }
@@ -858,9 +1498,7 @@ function normalizeConfig(config) {
       }
     }
     const updatedFieldNames = new Set(fields.map((f) => f.name));
-    const fieldsToInject = SYSTEM_FIELDS.filter(
-      (f) => !updatedFieldNames.has(f.name)
-    );
+    const fieldsToInject = SYSTEM_FIELDS.filter((f) => !updatedFieldNames.has(f.name));
     const workflow = col.workflow || (col.drafts ? simplePublishingWorkflow() : void 0);
     return {
       ...col,
@@ -868,20 +1506,13 @@ function normalizeConfig(config) {
       fields: [...fields, ...fieldsToInject]
     };
   });
-  const hasAuditCollection = normalizedCollections.some(
-    (col) => col.slug === AUDIT_COLLECTION_SLUG
-  );
+  const hasAuditCollection = normalizedCollections.some((col) => col.slug === AUDIT_COLLECTION_SLUG);
   const systemCollections = [];
-  if (needsAudit && !hasAuditCollection)
-    systemCollections.push(AUDIT_COLLECTION);
-  if (needsWorkflow && !normalizedCollections.some(
-    (col) => col.slug === WORKFLOW_HISTORY_COLLECTION
-  )) {
+  if (needsAudit && !hasAuditCollection) systemCollections.push(AUDIT_COLLECTION);
+  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === WORKFLOW_HISTORY_COLLECTION)) {
     systemCollections.push(WORKFLOW_HISTORY_COLLECTION_CONFIG);
   }
-  if (needsWorkflow && !normalizedCollections.some(
-    (col) => col.slug === LIFECYCLE_EVENTS_COLLECTION
-  )) {
+  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === LIFECYCLE_EVENTS_COLLECTION)) {
     systemCollections.push(LIFECYCLE_EVENTS_COLLECTION_CONFIG);
   }
   if (needsAuthSessions && !normalizedCollections.some((col) => col.slug === AUTH_SESSIONS_COLLECTION)) {
@@ -1097,20 +1728,41 @@ function buildSqlOrderBy(sort, existingColumns, numericFields, dialect) {
 }
 
 // src/utils/hooks.ts
+var import_jexl2 = __toESM(require("jexl"), 1);
 async function runCollectionHooks(hooks, args, options = {}) {
   if (!hooks || hooks.length === 0) {
-    return args.data ?? args.doc ?? void 0;
+    return args.data ?? args.doc ?? args.query ?? void 0;
   }
-  let currentPayload = args.data ?? args.doc ?? void 0;
+  const payloadKey = args.data !== void 0 ? "data" : args.doc !== void 0 ? "doc" : "query" in args ? "query" : void 0;
+  let currentPayload = payloadKey === void 0 ? void 0 : args[payloadKey];
   for (const hook of hooks) {
     try {
-      const result = await hook({
+      const hookArgs = {
         ...args,
-        data: args.data !== void 0 ? currentPayload : void 0,
-        doc: args.doc !== void 0 ? currentPayload : void 0
-      });
+        ...payloadKey !== void 0 ? { [payloadKey]: currentPayload } : {}
+      };
+      const result = typeof hook === "string" ? await (() => {
+        if (options.surface) {
+          assertValidDeclarativeHookExpression(
+            hook,
+            options.surface,
+            options.path ?? options.surface
+          );
+        }
+        return import_jexl2.default.eval(hook, hookArgs);
+      })() : await hook(hookArgs);
       if (result !== void 0) {
-        currentPayload = result;
+        if (typeof hook === "string" && options.surface) {
+          assertValidDeclarativeHookResult(
+            result,
+            options.surface,
+            options.path ?? options.surface
+          );
+        }
+        currentPayload = typeof hook === "string" && currentPayload && typeof currentPayload === "object" && !Array.isArray(currentPayload) && result && typeof result === "object" && !Array.isArray(result) ? {
+          ...currentPayload,
+          ...result
+        } : result;
       }
     } catch (err) {
       if (options.isolated) {
@@ -1125,17 +1777,17 @@ async function runCollectionHooks(hooks, args, options = {}) {
   }
   return currentPayload;
 }
-async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
+async function executeFieldBeforeChange(fields, data, originalDoc, user, db, pathPrefix = "") {
   if (!data || typeof data !== "object") return data;
   const result = { ...data };
   for (const field of fields) {
     if (!field.name) continue;
+    const fieldPath = pathPrefix ? `${pathPrefix}.${field.name}` : field.name;
     const value = result[field.name];
     const origValue = originalDoc?.[field.name];
     let updatedValue = value;
     if (field.hooks?.beforeChange) {
       for (const hook of field.hooks.beforeChange) {
-        const typedHook = hook;
         const hookArgs = {
           value: updatedValue,
           originalDoc: originalDoc ?? void 0,
@@ -1143,7 +1795,14 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
           user,
           db
         };
-        updatedValue = await typedHook(hookArgs);
+        updatedValue = typeof hook === "string" ? await (() => {
+          assertValidDeclarativeHookExpression(
+            hook,
+            "field.beforeChange",
+            fieldPath
+          );
+          return import_jexl2.default.eval(hook, hookArgs);
+        })() : await hook(hookArgs);
       }
       result[field.name] = updatedValue;
     }
@@ -1154,7 +1813,8 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
           updatedValue,
           origValue,
           user,
-          db
+          db,
+          fieldPath
         );
       } else if (field.type === "array" && field.fields && Array.isArray(updatedValue)) {
         const arrayResult = [];
@@ -1167,7 +1827,8 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
               item,
               origItem,
               user,
-              db
+              db,
+              fieldPath
             )
           );
         }
@@ -1187,7 +1848,8 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db) {
                 blockData,
                 origBlock,
                 user,
-                db
+                db,
+                fieldPath
               )
             );
           } else {
@@ -2281,12 +2943,24 @@ function defineTab(args) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ConfigValidationError,
   LIFECYCLE_EVENTS_COLLECTION,
   LIFECYCLE_EVENT_NAMES,
   WORKFLOW_HISTORY_COLLECTION,
+  assertValidAdminConditionsInConfig,
+  assertValidDeclarativeAccessInConfig,
+  assertValidDeclarativeHookExpression,
+  assertValidDeclarativeHookResult,
+  assertValidDeclarativeHooksInConfig,
+  assertValidPreviewUrlsInConfig,
   availableWorkflowTransitions,
   buildSqlOrderBy,
   canViewWorkflowDraft,
+  collectAdminConditionValidationIssues,
+  collectConfigDiagnostics,
+  collectDeclarativeAccessValidationIssues,
+  collectDeclarativeHookValidationIssues,
+  collectPreviewUrlValidationIssues,
   createLifecycleEvent,
   createWorkflowDocument,
   defineArrayField,
@@ -2322,10 +2996,12 @@ function defineTab(args) {
   dispatchPendingLifecycleEvents,
   executeFieldAfterRead,
   executeFieldBeforeChange,
+  formatConfigDiagnostics,
   generateOpenApi,
   getAdminAuthCollection,
   getPublicAdminAuthConfig,
   initializeWorkflowDocument,
+  isConfigValidationError,
   materializeWorkflowDocument,
   normalizeConfig,
   numericFieldNames,
@@ -2339,5 +3015,9 @@ function defineTab(args) {
   saveWorkflowDraft,
   simplePublishingWorkflow,
   transitionWorkflow,
+  validateAdminConditionExpression,
+  validateDeclarativeAccessExpression,
+  validateDeclarativeHookExpression,
+  validatePreviewUrlExpression,
   workflowCapabilities
 });