@dyrected/core 2.6.4 → 2.7.1

package/dist/server.cjs

@@ -30,838 +30,884 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// src/utils/where-sanitizer.ts
-var where_sanitizer_exports = {};
-__export(where_sanitizer_exports, {
-  sanitizeWhereClause: () => sanitizeWhereClause
+// src/observability.ts
+var observability_exports = {};
+__export(observability_exports, {
+  attachRequestMetrics: () => attachRequestMetrics,
+  bindObservabilityRuntime: () => bindObservabilityRuntime,
+  buildRequestLogger: () => buildRequestLogger,
+  captureRequestBody: () => captureRequestBody,
+  createObservabilityRuntime: () => createObservabilityRuntime,
+  createRequestSpan: () => createRequestSpan,
+  endRequestSpan: () => endRequestSpan,
+  getConfigLogger: () => getConfigLogger,
+  getObservabilityRuntime: () => getObservabilityRuntime,
+  getRequestLogger: () => getRequestLogger,
+  redactBody: () => redactBody,
+  redactHeaders: () => redactHeaders,
+  renderPrometheusMetrics: () => renderPrometheusMetrics,
+  resolveObservabilityConfig: () => resolveObservabilityConfig,
+  shouldSampleRequest: () => shouldSampleRequest
 });
-function sanitizeWhereClause(where, fields) {
-  const fieldMap = /* @__PURE__ */ new Map();
-  function addFieldsToMap(fList, prefix = "") {
-    for (const f of fList) {
-      if ("name" in f && f.name) {
-        fieldMap.set(prefix + f.name, f);
-      }
-      if (f.type === "object" || f.type === "row" || f.type === "array") {
-        if ("fields" in f && Array.isArray(f.fields)) {
-          addFieldsToMap(f.fields, f.type === "object" || f.type === "array" ? `${prefix}${f.name}.` : prefix);
-        }
-      }
+function resolveObservabilityConfig(config) {
+  const requestLogging = config?.requestLogging;
+  const sampling = config?.sampling;
+  const tracing = config?.tracing;
+  const metrics = config?.metrics;
+  return {
+    requestLogging: {
+      enabled: requestLogging?.enabled ?? true,
+      logBodies: requestLogging?.logBodies ?? false,
+      maxBodyBytes: requestLogging?.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES,
+      redactPaths: uniqueValues([
+        ...DEFAULT_REDACT_PATHS,
+        ...requestLogging?.redactPaths ?? []
+      ]),
+      includeHeaders: normalizeHeaderNames(requestLogging?.includeHeaders ?? []),
+      redactHeaders: uniqueValues(
+        normalizeHeaderNames([
+          ...DEFAULT_REDACT_HEADERS,
+          ...requestLogging?.redactHeaders ?? []
+        ])
+      )
+    },
+    sampling: {
+      successRate: clampRate(sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE),
+      traceSuccessRate: clampRate(
+        sampling?.traceSuccessRate ?? sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE
+      ),
+      bodySuccessRate: clampRate(
+        sampling?.bodySuccessRate ?? Math.min(DEFAULT_BODY_SAMPLE_RATE, sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE)
+      ),
+      alwaysKeep4xx: sampling?.alwaysKeep4xx ?? true,
+      alwaysKeep5xx: sampling?.alwaysKeep5xx ?? true
+    },
+    tracing: {
+      enabled: tracing?.enabled ?? false,
+      serviceName: tracing?.serviceName ?? "dyrected",
+      exporter: tracing?.exporter ?? "none",
+      headers: tracing?.headers ?? {},
+      endpoint: tracing?.endpoint
+    },
+    metrics: {
+      enabled: metrics?.enabled ?? false,
+      exporter: metrics?.exporter ?? "none",
+      endpoint: metrics?.endpoint,
+      path: metrics?.path ?? "/metrics"
+    },
+    transports: {
+      targets: config?.transports?.targets && config.transports.targets.length > 0 ? config.transports.targets : [{ type: "stdout" }]
     }
+  };
+}
+function createObservabilityRuntime(config) {
+  const resolved = resolveObservabilityConfig(config.observability);
+  const logger = createRootLogger(config.logger, resolved);
+  const shutdownTasks = [];
+  const meterRuntime = resolved.metrics.enabled || resolved.metrics.exporter === "prometheus" ? createMeterProvider(resolved) : void 0;
+  const tracerProvider = resolved.tracing.enabled ? createTracerProvider(resolved) : void 0;
+  const tracer = tracerProvider?.getTracer("dyrected");
+  const meter = meterRuntime?.provider.getMeter("dyrected");
+  const metrics = meter ? {
+    requestCount: meter.createCounter("dyrected_http_requests_total", {
+      description: "Total HTTP requests served by Dyrected"
+    }),
+    authFailureCount: meter.createCounter("dyrected_auth_failures_total", {
+      description: "Authentication failures"
+    }),
+    uncaughtErrorCount: meter.createCounter("dyrected_uncaught_errors_total", {
+      description: "Uncaught application errors"
+    }),
+    auditWriteFailureCount: meter.createCounter("dyrected_audit_write_failures_total", {
+      description: "Audit log persistence failures"
+    }),
+    emailSendFailureCount: meter.createCounter("dyrected_email_send_failures_total", {
+      description: "Transactional email delivery failures"
+    }),
+    workflowHookFailureCount: meter.createCounter("dyrected_workflow_hook_failures_total", {
+      description: "Workflow hook failures isolated after successful writes"
+    }),
+    requestDuration: meter.createHistogram("dyrected_http_request_duration_ms", {
+      description: "HTTP request duration in milliseconds",
+      unit: "ms"
+    })
+  } : void 0;
+  if (meterRuntime) {
+    shutdownTasks.push(() => meterRuntime.provider.shutdown());
   }
-  addFieldsToMap(fields);
-  function walk(node) {
-    const result = {};
-    for (const [key, value] of Object.entries(node)) {
-      if (key === "AND" || key === "OR") {
-        if (Array.isArray(value)) {
-          const processed = value.map((v) => walk(v)).filter((v) => Object.keys(v).length > 0);
-          if (processed.length > 0) {
-            result[key] = processed;
-          }
-        }
-        continue;
+  if (tracerProvider) {
+    shutdownTasks.push(() => tracerProvider.shutdown());
+  }
+  return {
+    logger,
+    config: resolved,
+    tracer,
+    metrics,
+    prometheusExporter: meterRuntime?.prometheusExporter,
+    shutdown: async () => {
+      for (const task of shutdownTasks) {
+        await task();
       }
-      if (key === "id") {
-        result[key] = value;
-        continue;
+    },
+    recordAuthFailure: (attributes) => metrics?.authFailureCount.add(1, attributes),
+    recordUncaughtError: (attributes) => metrics?.uncaughtErrorCount.add(1, attributes),
+    recordAuditWriteFailure: (attributes) => metrics?.auditWriteFailureCount.add(1, attributes),
+    recordEmailSendFailure: (attributes) => metrics?.emailSendFailureCount.add(1, attributes),
+    recordWorkflowHookFailure: (attributes) => metrics?.workflowHookFailureCount.add(1, attributes)
+  };
+}
+function bindObservabilityRuntime(config, runtime) {
+  runtimeByConfig.set(config, runtime);
+}
+function getObservabilityRuntime(config) {
+  if (!config || typeof config !== "object") return void 0;
+  return runtimeByConfig.get(config);
+}
+function createRootLogger(loggerConfig, observability) {
+  if (loggerConfig && !("options" in loggerConfig)) {
+    return loggerConfig;
+  }
+  const options = loggerConfig?.options ?? {};
+  const enabled = options.enabled ?? process.env.DISABLE_LOGGING !== "true";
+  const name = options.name ?? "dyrected";
+  if (loggerConfig?.destination) {
+    return (0, import_pino.default)(
+      {
+        ...options,
+        enabled,
+        name,
+        timestamp: options.timestamp ?? import_pino.stdTimeFunctions.isoTime
+      },
+      loggerConfig.destination
+    );
+  }
+  const streams = buildTransportStreams(observability);
+  const destination = streams.length === 1 ? streams[0] : (0, import_pino.multistream)(streams.map((stream) => ({ stream })));
+  return (0, import_pino.default)(
+    {
+      ...options,
+      enabled,
+      name,
+      timestamp: options.timestamp ?? import_pino.stdTimeFunctions.isoTime
+    },
+    destination
+  );
+}
+function buildTransportStreams(observability) {
+  const targets = observability.transports.targets;
+  if (targets.length === 0) {
+    return [defaultLoggerDestination()];
+  }
+  return targets.map((target) => {
+    switch (target.type) {
+      case "stdout":
+        return defaultLoggerDestination();
+      case "stderr":
+        return (0, import_pino.destination)(2);
+      case "file":
+        return (0, import_pino.destination)(target.path);
+      case "otlp":
+        return new OtlpLogWritable(target.endpoint, target.headers);
+    }
+  });
+}
+function defaultLoggerDestination() {
+  if (process.env.NODE_ENV !== "production" && typeof window === "undefined") {
+    try {
+      const req = globalThis.require;
+      if (req) {
+        const pinoPretty = req("pino-pretty");
+        return pinoPretty({
+          colorize: true,
+          ignore: "pid,hostname",
+          translateTime: "SYS:HH:MM:ss",
+          destination: 1,
+          sync: true
+        });
       }
-      const fieldDef = fieldMap.get(key);
-      if (!fieldDef) continue;
-      if (fieldDef.admin?.filterable === false) continue;
-      if (NEVER_FILTERABLE_TYPES.includes(fieldDef.type)) continue;
-      result[key] = value;
+    } catch {
     }
-    return result;
   }
-  return walk(where);
+  return (0, import_pino.destination)(1);
 }
-var NEVER_FILTERABLE_TYPES;
-var init_where_sanitizer = __esm({
-  "src/utils/where-sanitizer.ts"() {
-    "use strict";
-    NEVER_FILTERABLE_TYPES = [
-      "password",
-      "richText",
-      "json",
-      "file",
-      "image",
-      "join",
-      "collapsible"
-    ];
+function createTracerProvider(observability) {
+  const exporter = createTraceExporter(observability);
+  const provider = new import_sdk_trace_base.BasicTracerProvider({
+    resource: (0, import_resources.resourceFromAttributes)({
+      "service.name": observability.tracing.serviceName
+    }),
+    spanProcessors: exporter ? [new import_sdk_trace_base.BatchSpanProcessor(exporter)] : []
+  });
+  import_api.trace.setGlobalTracerProvider(provider);
+  return provider;
+}
+function createTraceExporter(observability) {
+  switch (observability.tracing.exporter) {
+    case "console":
+      return new import_sdk_trace_base.ConsoleSpanExporter();
+    case "otlp":
+      return new import_exporter_trace_otlp_http.OTLPTraceExporter({
+        url: observability.tracing.endpoint,
+        headers: observability.tracing.headers
+      });
+    default:
+      return void 0;
   }
-});
-
-// src/server.ts
-var server_exports = {};
-__export(server_exports, {
-  AuthController: () => AuthController,
-  CollectionController: () => CollectionController,
-  GlobalController: () => GlobalController,
-  MediaController: () => MediaController,
-  PreviewController: () => PreviewController,
-  createDyrectedApp: () => createDyrectedApp,
-  registerRoutes: () => registerRoutes
-});
-module.exports = __toCommonJS(server_exports);
-
-// src/app.ts
-var import_hono = require("hono");
-var import_cors = require("hono/cors");
-var import_request_id = require("hono/request-id");
-
-// src/services/defaults.service.ts
-var DefaultsService = class {
-  /**
-   * Recursively apply default values to a data object based on field definitions.
-   */
-  static apply(fields, data = {}) {
-    const result = { ...data || {} };
-    fields.forEach((field) => {
-      if (field.type === "join") return;
-      if (field.type === "row" && field.fields) {
-        Object.assign(result, this.apply(field.fields, data));
-        return;
-      }
-      if (!field.name) return;
-      let value = result[field.name];
-      if ((value === void 0 || value === null) && field.renameTo) {
-        const legacyValue = result[field.renameTo];
-        if (legacyValue !== void 0 && legacyValue !== null) {
-          value = legacyValue;
-          result[field.name] = legacyValue;
-        }
-      }
-      if (value === void 0 || value === null) {
-        if (field.defaultValue !== void 0) {
-          result[field.name] = field.defaultValue;
-        } else {
-          if (field.type === "boolean") result[field.name] = false;
-          else if (field.type === "array") result[field.name] = [];
-          else if (field.type === "multiSelect") result[field.name] = [];
-          else if (field.type === "object") {
-            result[field.name] = this.apply(field.fields || [], {});
-          }
-        }
-      } else if (field.type === "object" && field.fields) {
-        result[field.name] = this.apply(field.fields, value);
-      } else if (field.type === "array" && field.fields && Array.isArray(value)) {
-        result[field.name] = value.map((item) => this.apply(field.fields, item));
-      }
-    });
-    return result;
+}
+function createMeterProvider(observability) {
+  const readers = [];
+  let prometheusExporter;
+  switch (observability.metrics.exporter) {
+    case "otlp":
+      readers.push(
+        new import_sdk_metrics.PeriodicExportingMetricReader({
+          exporter: new import_exporter_metrics_otlp_http.OTLPMetricExporter({
+            url: observability.metrics.endpoint
+          })
+        })
+      );
+      break;
+    case "prometheus":
+      prometheusExporter = new import_exporter_prometheus.PrometheusExporter({
+        endpoint: observability.metrics.path,
+        preventServerStart: true
+      });
+      readers.push(prometheusExporter);
+      break;
   }
-};
-
-// src/services/population.service.ts
-var import_jexl = __toESM(require("jexl"), 1);
-var PopulationService = class {
-  db;
-  collections;
-  constructor(db, collections) {
-    this.db = db;
-    this.collections = collections;
+  const provider = new import_sdk_metrics.MeterProvider({
+    resource: (0, import_resources.resourceFromAttributes)({
+      "service.name": observability.tracing.serviceName
+    }),
+    readers
+  });
+  return { provider, prometheusExporter };
+}
+function getConfigLogger(config, component) {
+  const base = config?.logger && !("options" in config.logger) ? config.logger : fallbackLogger;
+  return base.child({ component });
+}
+function getRequestLogger(c, component) {
+  const base = c.get("logger") ?? fallbackLogger;
+  return component ? base.child({ component }) : base;
+}
+function buildRequestLogger(runtime, vars, requestId2) {
+  const trace2 = vars.requestTrace;
+  return runtime.logger.child({
+    requestId: requestId2,
+    siteId: vars.siteId,
+    workspaceId: vars.workspaceId,
+    traceId: trace2?.traceId,
+    spanId: trace2?.spanId
+  });
+}
+function shouldSampleRequest(requestId2, statusCode, sampling, kind) {
+  if (statusCode >= 500 && sampling.alwaysKeep5xx) return true;
+  if (statusCode >= 400 && sampling.alwaysKeep4xx) return true;
+  const rate = kind === "trace" ? sampling.traceSuccessRate : kind === "body" ? sampling.bodySuccessRate : sampling.successRate;
+  return deterministicSample(requestId2 ?? "no-request-id", rate);
+}
+function redactHeaders(headers, observability) {
+  const includeHeaders = new Set(observability.requestLogging.includeHeaders);
+  const redactHeaders2 = new Set(observability.requestLogging.redactHeaders);
+  const output = {};
+  for (const [key, value] of Object.entries(headers)) {
+    const normalizedKey = key.toLowerCase();
+    if (includeHeaders.size > 0 && !includeHeaders.has(normalizedKey)) continue;
+    output[normalizedKey] = redactHeaders2.has(normalizedKey) ? REDACTED_VALUE : value;
   }
-  /**
-   * Recursively populate relationship fields in a document or array of documents.
-   */
-  async populate(args) {
-    const { data, fields, currentDepth = 0, maxDepth = 10 } = args;
-    if (currentDepth >= maxDepth || !data) {
-      return data;
+  return output;
+}
+async function captureRequestBody(request, observability) {
+  const contentType = request.headers.get("content-type") ?? void 0;
+  const contentLength = toNumber(request.headers.get("content-length"));
+  const jsonBody = contentType?.includes("application/json");
+  if (!jsonBody) {
+    return {
+      attempted: false,
+      contentType,
+      contentLength
+    };
+  }
+  try {
+    const text = await request.clone().text();
+    if (!text) {
+      return { attempted: true, contentType, contentLength };
     }
-    if (Array.isArray(data)) {
-      return Promise.all(
-        data.map((item) => this.populate({ ...args, data: item }))
-      );
+    const truncated = text.length > observability.requestLogging.maxBodyBytes;
+    const raw = truncated ? text.slice(0, observability.requestLogging.maxBodyBytes) : text;
+    try {
+      const parsed = JSON.parse(raw);
+      return {
+        attempted: true,
+        contentType,
+        contentLength: contentLength ?? text.length,
+        truncated,
+        body: redactBody(parsed, observability.requestLogging.redactPaths)
+      };
+    } catch {
+      return {
+        attempted: true,
+        contentType,
+        contentLength: contentLength ?? text.length,
+        truncated,
+        parseFailed: true
+      };
     }
-    const populatedDoc = { ...data };
-    for (const field of fields) {
-      if (field.type === "join" && field.collection && field.on && currentDepth < maxDepth) {
-        const targetCollection = this.collections.find(
-          (c) => c.slug === field.collection
-        );
-        if (targetCollection) {
-          const docId = populatedDoc.id;
-          if (docId) {
-            const where = { [field.on]: { equals: docId } };
-            const joinLimit = field.limit ?? 10;
-            const result = await this.db.find({
-              collection: field.collection,
-              where,
-              limit: joinLimit
-            });
-            const populatedDocs = await this.populate({
-              data: result.docs.map(
-                (doc) => DefaultsService.apply(targetCollection.fields, doc)
-              ),
-              fields: targetCollection.fields,
-              currentDepth: currentDepth + 1,
-              maxDepth
-            });
-            populatedDoc[field.name] = {
-              docs: populatedDocs,
-              hasNextPage: result.page * result.limit < result.total,
-              totalDocs: result.total
-            };
-          }
-        }
-        continue;
-      }
-      if (field.type === "row" && field.fields) {
-        const rowPopulated = await this.populate({
-          data,
-          fields: field.fields,
-          currentDepth,
-          maxDepth
-        });
-        Object.assign(populatedDoc, rowPopulated);
-        continue;
+  } catch {
+    return {
+      attempted: true,
+      contentType,
+      contentLength,
+      parseFailed: true
+    };
+  }
+}
+function redactBody(value, redactPaths) {
+  const cloned = deepClone(value);
+  for (const path of redactPaths) {
+    applyRedaction(cloned, path.split("."));
+  }
+  return cloned;
+}
+function applyRedaction(target, segments) {
+  if (!target || segments.length === 0) return;
+  const [segment, ...rest] = segments;
+  if (Array.isArray(target)) {
+    for (const item of target) {
+      if (segment === "*") {
+        applyRedaction(item, rest);
+      } else {
+        applyRedaction(item, segments);
       }
-      if (!field.name) continue;
-      const value = populatedDoc[field.name];
-      if (field.type === "relationship" && field.relationTo && value) {
-        const relatedCollection = this.collections.find(
-          (c) => c.slug === field.relationTo
-        );
-        if (!relatedCollection) continue;
-        if (Array.isArray(value)) {
-          populatedDoc[field.name] = await Promise.all(
-            value.map(async (id) => {
-              if (!id) return id;
-              let doc = id;
-              if (typeof id === "string") {
-                doc = await this.db.findOne({
-                  collection: field.relationTo,
-                  id
-                });
-              }
-              if (!doc || typeof doc !== "object") return id;
-              const docWithDefaults = DefaultsService.apply(
-                relatedCollection.fields,
-                doc
-              );
-              return this.populate({
-                data: docWithDefaults,
-                fields: relatedCollection.fields,
-                currentDepth: currentDepth + 1,
-                maxDepth
-              });
-            })
-          );
-        } else if (value) {
-          let doc = value;
-          if (typeof value === "string") {
-            doc = await this.db.findOne({
-              collection: field.relationTo,
-              id: value
-            });
-          }
-          if (doc && typeof doc === "object") {
-            const docWithDefaults = DefaultsService.apply(
-              relatedCollection.fields,
-              doc
-            );
-            populatedDoc[field.name] = await this.populate({
-              data: docWithDefaults,
-              fields: relatedCollection.fields,
-              currentDepth: currentDepth + 1,
-              maxDepth
-            });
-          }
-        }
-      }
-      if (field.type === "url" && value && typeof value === "object" && value.type === "internal" && value.relationTo && value.value) {
-        const relatedCollection = this.collections.find(
-          (c) => c.slug === value.relationTo
-        );
-        if (relatedCollection) {
-          const doc = await this.db.findOne({
-            collection: value.relationTo,
-            id: value.value
-          });
-          if (doc && typeof doc === "object") {
-            const docWithDefaults = DefaultsService.apply(
-              relatedCollection.fields,
-              doc
-            );
-            const populatedDocValue = await this.populate({
-              data: docWithDefaults,
-              fields: relatedCollection.fields,
-              currentDepth: currentDepth + 1,
-              maxDepth
-            });
-            const identifier = docWithDefaults.slug || docWithDefaults.id;
-            let resolvedUrl = `/collections/${value.relationTo}/${identifier}`;
-            const previewUrlPattern = relatedCollection.admin?.previewUrl || relatedCollection.admin?.urlPattern;
-            if (previewUrlPattern) {
-              if (typeof previewUrlPattern === "function") {
-                try {
-                  resolvedUrl = previewUrlPattern(docWithDefaults, { locale: "en" }) || resolvedUrl;
-                } catch {
-                }
-              } else if (typeof previewUrlPattern === "string") {
-                if (previewUrlPattern.includes("{{")) {
-                  resolvedUrl = previewUrlPattern.replace(
-                    /{{(.*?)}}/g,
-                    (_, key) => String(docWithDefaults[key.trim()] || "")
-                  );
-                } else if (previewUrlPattern.includes("+") || previewUrlPattern.includes("?") || previewUrlPattern.includes("==") || previewUrlPattern.includes("siteUrl")) {
-                  try {
-                    resolvedUrl = import_jexl.default.evalSync(
-                      previewUrlPattern,
-                      docWithDefaults
-                    );
-                  } catch (_err) {
-                    resolvedUrl = previewUrlPattern.replace(
-                      /:([a-zA-Z0-9_]+)/g,
-                      (_, key) => String(docWithDefaults[key] || "")
-                    );
-                  }
-                } else {
-                  resolvedUrl = previewUrlPattern.replace(
-                    /:([a-zA-Z0-9_]+)/g,
-                    (_, key) => String(docWithDefaults[key] || "")
-                  );
-                }
-              }
-            }
-            populatedDoc[field.name] = {
-              ...value,
-              url: resolvedUrl,
-              doc: populatedDocValue
-            };
-          }
-        }
+    }
+    return;
+  }
+  if (typeof target !== "object") return;
+  const record = target;
+  if (segment === "*") {
+    for (const value of Object.values(record)) {
+      applyRedaction(value, rest);
+    }
+    return;
+  }
+  if (!(segment in record)) return;
+  if (rest.length === 0) {
+    record[segment] = REDACTED_VALUE;
+    return;
+  }
+  applyRedaction(record[segment], rest);
+}
+function deepClone(value) {
+  if (typeof structuredClone === "function") {
+    return structuredClone(value);
+  }
+  return JSON.parse(JSON.stringify(value));
+}
+function createRequestSpan(runtime, name, attributes) {
+  if (!runtime.tracer) return void 0;
+  const span = runtime.tracer.startSpan(name, { attributes }, import_api.context.active());
+  const spanContext = span.spanContext();
+  return {
+    span,
+    traceId: spanContext.traceId,
+    spanId: spanContext.spanId,
+    sampled: spanContext.traceFlags === import_api.TraceFlags.SAMPLED
+  };
+}
+function endRequestSpan(requestTrace, statusCode, error) {
+  if (!requestTrace) return;
+  requestTrace.span.setAttribute("http.status_code", statusCode);
+  if (error) {
+    requestTrace.span.recordException(error instanceof Error ? error : new Error(String(error)));
+  }
+  requestTrace.span.end();
+}
+function attachRequestMetrics(runtime, args) {
+  runtime.metrics?.requestCount.add(1, {
+    method: args.method,
+    route: args.route,
+    status_class: `${Math.floor(args.statusCode / 100)}xx`
+  });
+  runtime.metrics?.requestDuration.record(args.durationMs, {
+    method: args.method,
+    route: args.route,
+    status_class: `${Math.floor(args.statusCode / 100)}xx`
+  });
+}
+async function renderPrometheusMetrics(exporter) {
+  let statusCode = 200;
+  const headers = {};
+  let body = "";
+  await new Promise((resolve) => {
+    const response = {
+      statusCode,
+      setHeader(name, value) {
+        headers[name.toLowerCase()] = value;
+      },
+      end(chunk) {
+        if (chunk) body += chunk;
+        statusCode = this.statusCode;
+        resolve();
       }
-      if ((field.type === "array" || field.type === "object") && field.fields && value) {
-        populatedDoc[field.name] = await this.populate({
-          data: value,
-          fields: field.fields,
-          currentDepth,
-          // Nested fields don't consume depth, only relationships do
-          maxDepth
-        });
+    };
+    exporter.getMetricsRequestHandler({}, response);
+  });
+  return { body, headers, statusCode };
+}
+function normalizeHeaderNames(headers) {
+  return headers.map((value) => value.toLowerCase());
+}
+function uniqueValues(values) {
+  return [...new Set(values)];
+}
+function clampRate(value) {
+  if (Number.isNaN(value)) return 0;
+  return Math.max(0, Math.min(1, value));
+}
+function deterministicSample(seed, rate) {
+  if (rate >= 1) return true;
+  if (rate <= 0) return false;
+  let hash = 0;
+  for (let index = 0; index < seed.length; index += 1) {
+    hash = hash * 31 + seed.charCodeAt(index) >>> 0;
+  }
+  return hash / 4294967295 <= rate;
+}
+function toNumber(value) {
+  if (!value) return void 0;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : void 0;
+}
+var import_api, import_exporter_metrics_otlp_http, import_exporter_prometheus, import_exporter_trace_otlp_http, import_resources, import_sdk_metrics, import_sdk_trace_base, import_pino, import_node_stream, DEFAULT_REDACT_HEADERS, DEFAULT_REDACT_PATHS, DEFAULT_MAX_BODY_BYTES, DEFAULT_SUCCESS_SAMPLE_RATE, DEFAULT_BODY_SAMPLE_RATE, REDACTED_VALUE, runtimeByConfig, fallbackLogger, OtlpLogWritable;
+var init_observability = __esm({
+  "src/observability.ts"() {
+    "use strict";
+    import_api = require("@opentelemetry/api");
+    import_exporter_metrics_otlp_http = require("@opentelemetry/exporter-metrics-otlp-http");
+    import_exporter_prometheus = require("@opentelemetry/exporter-prometheus");
+    import_exporter_trace_otlp_http = require("@opentelemetry/exporter-trace-otlp-http");
+    import_resources = require("@opentelemetry/resources");
+    import_sdk_metrics = require("@opentelemetry/sdk-metrics");
+    import_sdk_trace_base = require("@opentelemetry/sdk-trace-base");
+    import_pino = __toESM(require("pino"), 1);
+    import_node_stream = require("stream");
+    DEFAULT_REDACT_HEADERS = ["authorization", "cookie", "set-cookie", "x-api-key"];
+    DEFAULT_REDACT_PATHS = [
+      "password",
+      "currentPassword",
+      "newPassword",
+      "confirmPassword",
+      "token",
+      "refreshToken",
+      "accessToken",
+      "secret",
+      "apiKey",
+      "inviteToken",
+      "resetToken"
+    ];
+    DEFAULT_MAX_BODY_BYTES = 8192;
+    DEFAULT_SUCCESS_SAMPLE_RATE = 0.1;
+    DEFAULT_BODY_SAMPLE_RATE = 0.02;
+    REDACTED_VALUE = "[REDACTED]";
+    runtimeByConfig = /* @__PURE__ */ new WeakMap();
+    fallbackLogger = (0, import_pino.default)({
+      name: "dyrected",
+      enabled: process.env.DISABLE_LOGGING !== "true",
+      timestamp: import_pino.stdTimeFunctions.isoTime
+    });
+    OtlpLogWritable = class extends import_node_stream.Writable {
+      constructor(endpoint, headers = {}) {
+        super();
+        this.endpoint = endpoint;
+        this.headers = headers;
       }
-      if (field.type === "blocks" && field.blocks && Array.isArray(value)) {
-        populatedDoc[field.name] = await Promise.all(
-          value.map(async (blockData) => {
-            const blockConfig = field.blocks.find(
-              (b) => b.slug === blockData.blockType
-            );
-            if (!blockConfig) return blockData;
-            return this.populate({
-              data: blockData,
-              fields: blockConfig.fields,
-              currentDepth,
-              maxDepth
-            });
-          })
+      endpoint;
+      headers;
+      _write(chunk, _encoding, callback) {
+        const payload = chunk.toString();
+        void fetch(this.endpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            ...this.headers
+          },
+          body: JSON.stringify({ logs: payload.trim().split("\n").filter(Boolean) })
+        }).then(() => callback()).catch(
+          (error) => callback(error instanceof Error ? error : new Error(String(error)))
         );
       }
-    }
-    return populatedDoc;
-  }
-  /**
-   * Helper to populate a PaginatedResult
-   */
-  async populateResult(result, fields, maxDepth) {
-    if (maxDepth <= 0) return result;
-    const populatedDocs = await this.populate({
-      data: result.docs,
-      fields,
-      currentDepth: 0,
-      maxDepth
-    });
-    return {
-      ...result,
-      docs: populatedDocs
     };
   }
-};
+});
 
-// src/observability.ts
-var import_api = require("@opentelemetry/api");
-var import_exporter_metrics_otlp_http = require("@opentelemetry/exporter-metrics-otlp-http");
-var import_exporter_prometheus = require("@opentelemetry/exporter-prometheus");
-var import_exporter_trace_otlp_http = require("@opentelemetry/exporter-trace-otlp-http");
-var import_resources = require("@opentelemetry/resources");
-var import_sdk_metrics = require("@opentelemetry/sdk-metrics");
-var import_sdk_trace_base = require("@opentelemetry/sdk-trace-base");
-var import_pino = __toESM(require("pino"), 1);
-var import_pino_pretty = __toESM(require("pino-pretty"), 1);
-var import_node_stream = require("stream");
-var DEFAULT_REDACT_HEADERS = ["authorization", "cookie", "set-cookie", "x-api-key"];
-var DEFAULT_REDACT_PATHS = [
-  "password",
-  "currentPassword",
-  "newPassword",
-  "confirmPassword",
-  "token",
-  "refreshToken",
-  "accessToken",
-  "secret",
-  "apiKey",
-  "inviteToken",
-  "resetToken"
-];
-var DEFAULT_MAX_BODY_BYTES = 8192;
-var DEFAULT_SUCCESS_SAMPLE_RATE = 0.1;
-var DEFAULT_BODY_SAMPLE_RATE = 0.02;
-var REDACTED_VALUE = "[REDACTED]";
-var runtimeByConfig = /* @__PURE__ */ new WeakMap();
-var fallbackLogger = (0, import_pino.default)({
-  name: "dyrected",
-  enabled: process.env.DISABLE_LOGGING !== "true",
-  timestamp: import_pino.stdTimeFunctions.isoTime
+// src/utils/where-sanitizer.ts
+var where_sanitizer_exports = {};
+__export(where_sanitizer_exports, {
+  sanitizeWhereClause: () => sanitizeWhereClause
 });
-function resolveObservabilityConfig(config) {
-  const requestLogging = config?.requestLogging;
-  const sampling = config?.sampling;
-  const tracing = config?.tracing;
-  const metrics = config?.metrics;
-  return {
-    requestLogging: {
-      enabled: requestLogging?.enabled ?? true,
-      logBodies: requestLogging?.logBodies ?? false,
-      maxBodyBytes: requestLogging?.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES,
-      redactPaths: uniqueValues([
-        ...DEFAULT_REDACT_PATHS,
-        ...requestLogging?.redactPaths ?? []
-      ]),
-      includeHeaders: normalizeHeaderNames(requestLogging?.includeHeaders ?? []),
-      redactHeaders: uniqueValues(
-        normalizeHeaderNames([
-          ...DEFAULT_REDACT_HEADERS,
-          ...requestLogging?.redactHeaders ?? []
-        ])
-      )
-    },
-    sampling: {
-      successRate: clampRate(sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE),
-      traceSuccessRate: clampRate(
-        sampling?.traceSuccessRate ?? sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE
-      ),
-      bodySuccessRate: clampRate(
-        sampling?.bodySuccessRate ?? Math.min(DEFAULT_BODY_SAMPLE_RATE, sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE)
-      ),
-      alwaysKeep4xx: sampling?.alwaysKeep4xx ?? true,
-      alwaysKeep5xx: sampling?.alwaysKeep5xx ?? true
-    },
-    tracing: {
-      enabled: tracing?.enabled ?? false,
-      serviceName: tracing?.serviceName ?? "dyrected",
-      exporter: tracing?.exporter ?? "none",
-      headers: tracing?.headers ?? {},
-      endpoint: tracing?.endpoint
-    },
-    metrics: {
-      enabled: metrics?.enabled ?? false,
-      exporter: metrics?.exporter ?? "none",
-      endpoint: metrics?.endpoint,
-      path: metrics?.path ?? "/metrics"
-    },
-    transports: {
-      targets: config?.transports?.targets && config.transports.targets.length > 0 ? config.transports.targets : [{ type: "stdout" }]
+function sanitizeWhereClause(where, fields) {
+  const fieldMap = /* @__PURE__ */ new Map();
+  function addFieldsToMap(fList, prefix = "") {
+    for (const f of fList) {
+      if ("name" in f && f.name) {
+        fieldMap.set(prefix + f.name, f);
+      }
+      if (f.type === "object" || f.type === "row" || f.type === "array") {
+        if ("fields" in f && Array.isArray(f.fields)) {
+          addFieldsToMap(f.fields, f.type === "object" || f.type === "array" ? `${prefix}${f.name}.` : prefix);
+        }
+      }
     }
-  };
-}
-function createObservabilityRuntime(config) {
-  const resolved = resolveObservabilityConfig(config.observability);
-  const logger = createRootLogger(config.logger, resolved);
-  const shutdownTasks = [];
-  const meterRuntime = resolved.metrics.enabled || resolved.metrics.exporter === "prometheus" ? createMeterProvider(resolved) : void 0;
-  const tracerProvider = resolved.tracing.enabled ? createTracerProvider(resolved) : void 0;
-  const tracer = tracerProvider?.getTracer("dyrected");
-  const meter = meterRuntime?.provider.getMeter("dyrected");
-  const metrics = meter ? {
-    requestCount: meter.createCounter("dyrected_http_requests_total", {
-      description: "Total HTTP requests served by Dyrected"
-    }),
-    authFailureCount: meter.createCounter("dyrected_auth_failures_total", {
-      description: "Authentication failures"
-    }),
-    uncaughtErrorCount: meter.createCounter("dyrected_uncaught_errors_total", {
-      description: "Uncaught application errors"
-    }),
-    auditWriteFailureCount: meter.createCounter("dyrected_audit_write_failures_total", {
-      description: "Audit log persistence failures"
-    }),
-    emailSendFailureCount: meter.createCounter("dyrected_email_send_failures_total", {
-      description: "Transactional email delivery failures"
-    }),
-    workflowHookFailureCount: meter.createCounter("dyrected_workflow_hook_failures_total", {
-      description: "Workflow hook failures isolated after successful writes"
-    }),
-    requestDuration: meter.createHistogram("dyrected_http_request_duration_ms", {
-      description: "HTTP request duration in milliseconds",
-      unit: "ms"
-    })
-  } : void 0;
-  if (meterRuntime) {
-    shutdownTasks.push(() => meterRuntime.provider.shutdown());
-  }
-  if (tracerProvider) {
-    shutdownTasks.push(() => tracerProvider.shutdown());
   }
-  return {
-    logger,
-    config: resolved,
-    tracer,
-    metrics,
-    prometheusExporter: meterRuntime?.prometheusExporter,
-    shutdown: async () => {
-      for (const task of shutdownTasks) {
-        await task();
+  addFieldsToMap(fields);
+  function walk(node) {
+    const result = {};
+    for (const [key, value] of Object.entries(node)) {
+      if (key === "AND" || key === "OR") {
+        if (Array.isArray(value)) {
+          const processed = value.map((v) => walk(v)).filter((v) => Object.keys(v).length > 0);
+          if (processed.length > 0) {
+            result[key] = processed;
+          }
+        }
+        continue;
       }
-    },
-    recordAuthFailure: (attributes) => metrics?.authFailureCount.add(1, attributes),
-    recordUncaughtError: (attributes) => metrics?.uncaughtErrorCount.add(1, attributes),
-    recordAuditWriteFailure: (attributes) => metrics?.auditWriteFailureCount.add(1, attributes),
-    recordEmailSendFailure: (attributes) => metrics?.emailSendFailureCount.add(1, attributes),
-    recordWorkflowHookFailure: (attributes) => metrics?.workflowHookFailureCount.add(1, attributes)
-  };
-}
-function bindObservabilityRuntime(config, runtime) {
-  runtimeByConfig.set(config, runtime);
-}
-function getObservabilityRuntime(config) {
-  if (!config || typeof config !== "object") return void 0;
-  return runtimeByConfig.get(config);
-}
-function createRootLogger(loggerConfig, observability) {
-  if (loggerConfig && !("options" in loggerConfig)) {
-    return loggerConfig;
-  }
-  const options = loggerConfig?.options ?? {};
-  const enabled = options.enabled ?? process.env.DISABLE_LOGGING !== "true";
-  const name = options.name ?? "dyrected";
-  if (loggerConfig?.destination) {
-    return (0, import_pino.default)(
-      {
-        ...options,
-        enabled,
-        name,
-        timestamp: options.timestamp ?? import_pino.stdTimeFunctions.isoTime
-      },
-      loggerConfig.destination
-    );
+      if (key === "id") {
+        result[key] = value;
+        continue;
+      }
+      const fieldDef = fieldMap.get(key);
+      if (!fieldDef) continue;
+      if (fieldDef.admin?.filterable === false) continue;
+      if (NEVER_FILTERABLE_TYPES.includes(fieldDef.type)) continue;
+      result[key] = value;
+    }
+    return result;
   }
-  const streams = buildTransportStreams(observability);
-  const destination = streams.length === 1 ? streams[0] : (0, import_pino.multistream)(streams.map((stream) => ({ stream })));
-  return (0, import_pino.default)(
-    {
-      ...options,
-      enabled,
-      name,
-      timestamp: options.timestamp ?? import_pino.stdTimeFunctions.isoTime
-    },
-    destination
-  );
+  return walk(where);
 }
-function buildTransportStreams(observability) {
-  const targets = observability.transports.targets;
-  if (targets.length === 0) {
-    return [defaultLoggerDestination()];
+var NEVER_FILTERABLE_TYPES;
+var init_where_sanitizer = __esm({
+  "src/utils/where-sanitizer.ts"() {
+    "use strict";
+    NEVER_FILTERABLE_TYPES = [
+      "password",
+      "richText",
+      "json",
+      "file",
+      "image",
+      "join",
+      "collapsible"
+    ];
   }
-  return targets.map((target) => {
-    switch (target.type) {
-      case "stdout":
-        return defaultLoggerDestination();
-      case "stderr":
-        return (0, import_pino.destination)(2);
-      case "file":
-        return (0, import_pino.destination)(target.path);
-      case "otlp":
-        return new OtlpLogWritable(target.endpoint, target.headers);
-    }
-  });
-}
-function defaultLoggerDestination() {
-  if (process.env.NODE_ENV !== "production") {
-    return (0, import_pino_pretty.default)({
-      colorize: true,
-      ignore: "pid,hostname",
-      translateTime: "SYS:HH:MM:ss",
-      destination: 1,
-      sync: true
+});
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  AuthController: () => AuthController,
+  CollectionController: () => CollectionController,
+  GlobalController: () => GlobalController,
+  MediaController: () => MediaController,
+  PreviewController: () => PreviewController,
+  attachRequestMetrics: () => attachRequestMetrics,
+  bindObservabilityRuntime: () => bindObservabilityRuntime,
+  buildRequestLogger: () => buildRequestLogger,
+  captureRequestBody: () => captureRequestBody,
+  createDyrectedApp: () => createDyrectedApp,
+  createObservabilityRuntime: () => createObservabilityRuntime,
+  createRequestSpan: () => createRequestSpan,
+  endRequestSpan: () => endRequestSpan,
+  getConfigLogger: () => getConfigLogger,
+  getObservabilityRuntime: () => getObservabilityRuntime,
+  getRequestLogger: () => getRequestLogger,
+  redactBody: () => redactBody,
+  redactHeaders: () => redactHeaders,
+  registerRoutes: () => registerRoutes,
+  renderPrometheusMetrics: () => renderPrometheusMetrics,
+  resolveObservabilityConfig: () => resolveObservabilityConfig,
+  shouldSampleRequest: () => shouldSampleRequest
+});
+module.exports = __toCommonJS(server_exports);
+
+// src/app.ts
+var import_hono = require("hono");
+var import_cors = require("hono/cors");
+var import_request_id = require("hono/request-id");
+
+// src/services/defaults.service.ts
+var DefaultsService = class {
+  /**
+   * Recursively apply default values to a data object based on field definitions.
+   */
+  static apply(fields, data = {}) {
+    const result = { ...data || {} };
+    fields.forEach((field) => {
+      if (field.type === "join") return;
+      if (field.type === "row" && field.fields) {
+        Object.assign(result, this.apply(field.fields, data));
+        return;
+      }
+      if (!field.name) return;
+      let value = result[field.name];
+      if ((value === void 0 || value === null) && field.renameTo) {
+        const legacyValue = result[field.renameTo];
+        if (legacyValue !== void 0 && legacyValue !== null) {
+          value = legacyValue;
+          result[field.name] = legacyValue;
+        }
+      }
+      if (value === void 0 || value === null) {
+        if (field.defaultValue !== void 0) {
+          result[field.name] = field.defaultValue;
+        } else {
+          if (field.type === "boolean") result[field.name] = false;
+          else if (field.type === "array") result[field.name] = [];
+          else if (field.type === "multiSelect") result[field.name] = [];
+          else if (field.type === "object") {
+            result[field.name] = this.apply(field.fields || [], {});
+          }
+        }
+      } else if (field.type === "object" && field.fields) {
+        result[field.name] = this.apply(field.fields, value);
+      } else if (field.type === "array" && field.fields && Array.isArray(value)) {
+        result[field.name] = value.map((item) => this.apply(field.fields, item));
+      }
     });
-  }
-  return (0, import_pino.destination)(1);
-}
-var OtlpLogWritable = class extends import_node_stream.Writable {
-  constructor(endpoint, headers = {}) {
-    super();
-    this.endpoint = endpoint;
-    this.headers = headers;
-  }
-  endpoint;
-  headers;
-  _write(chunk, _encoding, callback) {
-    const payload = chunk.toString();
-    void fetch(this.endpoint, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        ...this.headers
-      },
-      body: JSON.stringify({ logs: payload.trim().split("\n").filter(Boolean) })
-    }).then(() => callback()).catch(
-      (error) => callback(error instanceof Error ? error : new Error(String(error)))
-    );
+    return result;
   }
 };
-function createTracerProvider(observability) {
-  const exporter = createTraceExporter(observability);
-  const provider = new import_sdk_trace_base.BasicTracerProvider({
-    resource: (0, import_resources.resourceFromAttributes)({
-      "service.name": observability.tracing.serviceName
-    }),
-    spanProcessors: exporter ? [new import_sdk_trace_base.BatchSpanProcessor(exporter)] : []
-  });
-  import_api.trace.setGlobalTracerProvider(provider);
-  return provider;
-}
-function createTraceExporter(observability) {
-  switch (observability.tracing.exporter) {
-    case "console":
-      return new import_sdk_trace_base.ConsoleSpanExporter();
-    case "otlp":
-      return new import_exporter_trace_otlp_http.OTLPTraceExporter({
-        url: observability.tracing.endpoint,
-        headers: observability.tracing.headers
-      });
-    default:
-      return void 0;
-  }
-}
-function createMeterProvider(observability) {
-  const readers = [];
-  let prometheusExporter;
-  switch (observability.metrics.exporter) {
-    case "otlp":
-      readers.push(
-        new import_sdk_metrics.PeriodicExportingMetricReader({
-          exporter: new import_exporter_metrics_otlp_http.OTLPMetricExporter({
-            url: observability.metrics.endpoint
-          })
-        })
-      );
-      break;
-    case "prometheus":
-      prometheusExporter = new import_exporter_prometheus.PrometheusExporter({
-        endpoint: observability.metrics.path,
-        preventServerStart: true
-      });
-      readers.push(prometheusExporter);
-      break;
-  }
-  const provider = new import_sdk_metrics.MeterProvider({
-    resource: (0, import_resources.resourceFromAttributes)({
-      "service.name": observability.tracing.serviceName
-    }),
-    readers
-  });
-  return { provider, prometheusExporter };
-}
-function getConfigLogger(config, component) {
-  const base = config?.logger && !("options" in config.logger) ? config.logger : fallbackLogger;
-  return base.child({ component });
-}
-function getRequestLogger(c, component) {
-  const base = c.get("logger") ?? fallbackLogger;
-  return component ? base.child({ component }) : base;
-}
-function buildRequestLogger(runtime, vars, requestId2) {
-  const trace2 = vars.requestTrace;
-  return runtime.logger.child({
-    requestId: requestId2,
-    siteId: vars.siteId,
-    workspaceId: vars.workspaceId,
-    traceId: trace2?.traceId,
-    spanId: trace2?.spanId
-  });
-}
-function shouldSampleRequest(requestId2, statusCode, sampling, kind) {
-  if (statusCode >= 500 && sampling.alwaysKeep5xx) return true;
-  if (statusCode >= 400 && sampling.alwaysKeep4xx) return true;
-  const rate = kind === "trace" ? sampling.traceSuccessRate : kind === "body" ? sampling.bodySuccessRate : sampling.successRate;
-  return deterministicSample(requestId2 ?? "no-request-id", rate);
-}
-function redactHeaders(headers, observability) {
-  const includeHeaders = new Set(observability.requestLogging.includeHeaders);
-  const redactHeaders2 = new Set(observability.requestLogging.redactHeaders);
-  const output = {};
-  for (const [key, value] of Object.entries(headers)) {
-    const normalizedKey = key.toLowerCase();
-    if (includeHeaders.size > 0 && !includeHeaders.has(normalizedKey)) continue;
-    output[normalizedKey] = redactHeaders2.has(normalizedKey) ? REDACTED_VALUE : value;
-  }
-  return output;
-}
-async function captureRequestBody(request, observability) {
-  const contentType = request.headers.get("content-type") ?? void 0;
-  const contentLength = toNumber(request.headers.get("content-length"));
-  const jsonBody = contentType?.includes("application/json");
-  if (!jsonBody) {
-    return {
-      attempted: false,
-      contentType,
-      contentLength
-    };
+
+// src/services/population.service.ts
+var import_jexl = __toESM(require("jexl"), 1);
+var PopulationService = class {
+  db;
+  collections;
+  constructor(db, collections) {
+    this.db = db;
+    this.collections = collections;
   }
-  try {
-    const text = await request.clone().text();
-    if (!text) {
-      return { attempted: true, contentType, contentLength };
+  /**
+   * Recursively populate relationship fields in a document or array of documents.
+   */
+  async populate(args) {
+    const { data, fields, currentDepth = 0, maxDepth = 10 } = args;
+    if (currentDepth >= maxDepth || !data) {
+      return data;
     }
-    const truncated = text.length > observability.requestLogging.maxBodyBytes;
-    const raw = truncated ? text.slice(0, observability.requestLogging.maxBodyBytes) : text;
-    try {
-      const parsed = JSON.parse(raw);
-      return {
-        attempted: true,
-        contentType,
-        contentLength: contentLength ?? text.length,
-        truncated,
-        body: redactBody(parsed, observability.requestLogging.redactPaths)
-      };
-    } catch {
-      return {
-        attempted: true,
-        contentType,
-        contentLength: contentLength ?? text.length,
-        truncated,
-        parseFailed: true
-      };
+    if (Array.isArray(data)) {
+      return Promise.all(
+        data.map((item) => this.populate({ ...args, data: item }))
+      );
     }
-  } catch {
-    return {
-      attempted: true,
-      contentType,
-      contentLength,
-      parseFailed: true
-    };
-  }
-}
-function redactBody(value, redactPaths) {
-  const cloned = deepClone(value);
-  for (const path of redactPaths) {
-    applyRedaction(cloned, path.split("."));
-  }
-  return cloned;
-}
-function applyRedaction(target, segments) {
-  if (!target || segments.length === 0) return;
-  const [segment, ...rest] = segments;
-  if (Array.isArray(target)) {
-    for (const item of target) {
-      if (segment === "*") {
-        applyRedaction(item, rest);
-      } else {
-        applyRedaction(item, segments);
+    const populatedDoc = { ...data };
+    for (const field of fields) {
+      if (field.type === "join" && field.collection && field.on && currentDepth < maxDepth) {
+        const targetCollection = this.collections.find(
+          (c) => c.slug === field.collection
+        );
+        if (targetCollection) {
+          const docId = populatedDoc.id;
+          if (docId) {
+            const where = { [field.on]: { equals: docId } };
+            const joinLimit = field.limit ?? 10;
+            const result = await this.db.find({
+              collection: field.collection,
+              where,
+              limit: joinLimit
+            });
+            const populatedDocs = await this.populate({
+              data: result.docs.map(
+                (doc) => DefaultsService.apply(targetCollection.fields, doc)
+              ),
+              fields: targetCollection.fields,
+              currentDepth: currentDepth + 1,
+              maxDepth
+            });
+            populatedDoc[field.name] = {
+              docs: populatedDocs,
+              hasNextPage: result.page * result.limit < result.total,
+              totalDocs: result.total
+            };
+          }
+        }
+        continue;
+      }
+      if (field.type === "row" && field.fields) {
+        const rowPopulated = await this.populate({
+          data,
+          fields: field.fields,
+          currentDepth,
+          maxDepth
+        });
+        Object.assign(populatedDoc, rowPopulated);
+        continue;
+      }
+      if (!field.name) continue;
+      const value = populatedDoc[field.name];
+      if (field.type === "relationship" && field.relationTo && value) {
+        const relatedCollection = this.collections.find(
+          (c) => c.slug === field.relationTo
+        );
+        if (!relatedCollection) continue;
+        if (Array.isArray(value)) {
+          populatedDoc[field.name] = await Promise.all(
+            value.map(async (id) => {
+              if (!id) return id;
+              let doc = id;
+              if (typeof id === "string") {
+                doc = await this.db.findOne({
+                  collection: field.relationTo,
+                  id
+                });
+              }
+              if (!doc || typeof doc !== "object") return id;
+              const docWithDefaults = DefaultsService.apply(
+                relatedCollection.fields,
+                doc
+              );
+              return this.populate({
+                data: docWithDefaults,
+                fields: relatedCollection.fields,
+                currentDepth: currentDepth + 1,
+                maxDepth
+              });
+            })
+          );
+        } else if (value) {
+          let doc = value;
+          if (typeof value === "string") {
+            doc = await this.db.findOne({
+              collection: field.relationTo,
+              id: value
+            });
+          }
+          if (doc && typeof doc === "object") {
+            const docWithDefaults = DefaultsService.apply(
+              relatedCollection.fields,
+              doc
+            );
+            populatedDoc[field.name] = await this.populate({
+              data: docWithDefaults,
+              fields: relatedCollection.fields,
+              currentDepth: currentDepth + 1,
+              maxDepth
+            });
+          }
+        }
+      }
+      if (field.type === "url" && value && typeof value === "object" && value.type === "internal" && value.relationTo && value.value) {
+        const relatedCollection = this.collections.find(
+          (c) => c.slug === value.relationTo
+        );
+        if (relatedCollection) {
+          const doc = await this.db.findOne({
+            collection: value.relationTo,
+            id: value.value
+          });
+          if (doc && typeof doc === "object") {
+            const docWithDefaults = DefaultsService.apply(
+              relatedCollection.fields,
+              doc
+            );
+            const populatedDocValue = await this.populate({
+              data: docWithDefaults,
+              fields: relatedCollection.fields,
+              currentDepth: currentDepth + 1,
+              maxDepth
+            });
+            const identifier = docWithDefaults.slug || docWithDefaults.id;
+            let resolvedUrl = `/collections/${value.relationTo}/${identifier}`;
+            const previewUrlPattern = relatedCollection.admin?.previewUrl || relatedCollection.admin?.urlPattern;
+            if (previewUrlPattern) {
+              if (typeof previewUrlPattern === "function") {
+                try {
+                  resolvedUrl = previewUrlPattern(docWithDefaults, { locale: "en" }) || resolvedUrl;
+                } catch {
+                }
+              } else if (typeof previewUrlPattern === "string") {
+                if (previewUrlPattern.includes("{{")) {
+                  resolvedUrl = previewUrlPattern.replace(
+                    /{{(.*?)}}/g,
+                    (_, key) => String(docWithDefaults[key.trim()] || "")
+                  );
+                } else if (previewUrlPattern.includes("+") || previewUrlPattern.includes("?") || previewUrlPattern.includes("==") || previewUrlPattern.includes("siteUrl")) {
+                  try {
+                    resolvedUrl = import_jexl.default.evalSync(
+                      previewUrlPattern,
+                      docWithDefaults
+                    );
+                  } catch (_err) {
+                    resolvedUrl = previewUrlPattern.replace(
+                      /:([a-zA-Z0-9_]+)/g,
+                      (_, key) => String(docWithDefaults[key] || "")
+                    );
+                  }
+                } else {
+                  resolvedUrl = previewUrlPattern.replace(
+                    /:([a-zA-Z0-9_]+)/g,
+                    (_, key) => String(docWithDefaults[key] || "")
+                  );
+                }
+              }
+            }
+            populatedDoc[field.name] = {
+              ...value,
+              url: resolvedUrl,
+              doc: populatedDocValue
+            };
+          }
+        }
+      }
+      if ((field.type === "array" || field.type === "object") && field.fields && value) {
+        populatedDoc[field.name] = await this.populate({
+          data: value,
+          fields: field.fields,
+          currentDepth,
+          // Nested fields don't consume depth, only relationships do
+          maxDepth
+        });
+      }
+      if (field.type === "blocks" && field.blocks && Array.isArray(value)) {
+        populatedDoc[field.name] = await Promise.all(
+          value.map(async (blockData) => {
+            const blockConfig = field.blocks.find(
+              (b) => b.slug === blockData.blockType
+            );
+            if (!blockConfig) return blockData;
+            return this.populate({
+              data: blockData,
+              fields: blockConfig.fields,
+              currentDepth,
+              maxDepth
+            });
+          })
+        );
       }
     }
-    return;
-  }
-  if (typeof target !== "object") return;
-  const record = target;
-  if (segment === "*") {
-    for (const value of Object.values(record)) {
-      applyRedaction(value, rest);
-    }
-    return;
-  }
-  if (!(segment in record)) return;
-  if (rest.length === 0) {
-    record[segment] = REDACTED_VALUE;
-    return;
-  }
-  applyRedaction(record[segment], rest);
-}
-function deepClone(value) {
-  if (typeof structuredClone === "function") {
-    return structuredClone(value);
-  }
-  return JSON.parse(JSON.stringify(value));
-}
-function createRequestSpan(runtime, name, attributes) {
-  if (!runtime.tracer) return void 0;
-  const span = runtime.tracer.startSpan(name, { attributes }, import_api.context.active());
-  const spanContext = span.spanContext();
-  return {
-    span,
-    traceId: spanContext.traceId,
-    spanId: spanContext.spanId,
-    sampled: spanContext.traceFlags === import_api.TraceFlags.SAMPLED
-  };
-}
-function endRequestSpan(requestTrace, statusCode, error) {
-  if (!requestTrace) return;
-  requestTrace.span.setAttribute("http.status_code", statusCode);
-  if (error) {
-    requestTrace.span.recordException(error instanceof Error ? error : new Error(String(error)));
+    return populatedDoc;
   }
-  requestTrace.span.end();
-}
-function attachRequestMetrics(runtime, args) {
-  runtime.metrics?.requestCount.add(1, {
-    method: args.method,
-    route: args.route,
-    status_class: `${Math.floor(args.statusCode / 100)}xx`
-  });
-  runtime.metrics?.requestDuration.record(args.durationMs, {
-    method: args.method,
-    route: args.route,
-    status_class: `${Math.floor(args.statusCode / 100)}xx`
-  });
-}
-async function renderPrometheusMetrics(exporter) {
-  let statusCode = 200;
-  const headers = {};
-  let body = "";
-  await new Promise((resolve) => {
-    const response = {
-      statusCode,
-      setHeader(name, value) {
-        headers[name.toLowerCase()] = value;
-      },
-      end(chunk) {
-        if (chunk) body += chunk;
-        statusCode = this.statusCode;
-        resolve();
-      }
+  /**
+   * Helper to populate a PaginatedResult
+   */
+  async populateResult(result, fields, maxDepth) {
+    if (maxDepth <= 0) return result;
+    const populatedDocs = await this.populate({
+      data: result.docs,
+      fields,
+      currentDepth: 0,
+      maxDepth
+    });
+    return {
+      ...result,
+      docs: populatedDocs
     };
-    exporter.getMetricsRequestHandler({}, response);
-  });
-  return { body, headers, statusCode };
-}
-function normalizeHeaderNames(headers) {
-  return headers.map((value) => value.toLowerCase());
-}
-function uniqueValues(values) {
-  return [...new Set(values)];
-}
-function clampRate(value) {
-  if (Number.isNaN(value)) return 0;
-  return Math.max(0, Math.min(1, value));
-}
-function deterministicSample(seed, rate) {
-  if (rate >= 1) return true;
-  if (rate <= 0) return false;
-  let hash = 0;
-  for (let index = 0; index < seed.length; index += 1) {
-    hash = hash * 31 + seed.charCodeAt(index) >>> 0;
   }
-  return hash / 4294967295 <= rate;
-}
-function toNumber(value) {
-  if (!value) return void 0;
-  const parsed = Number(value);
-  return Number.isFinite(parsed) ? parsed : void 0;
-}
+};
 
 // src/services/audit.service.ts
+init_observability();
 var AuditService = class {
   /**
    * Writes a single entry to the __audit collection.
@@ -921,7 +967,6 @@ async function verifyPassword(plain, stored) {
 
 // src/auth/token.ts
 var import_jose = require("jose");
-var import_node_util2 = require("util");
 function getSecret() {
   const secret = process.env.DYRECTED_JWT_SECRET;
   if (!secret) {
@@ -929,7 +974,7 @@ function getSecret() {
       "[dyrected/core] DYRECTED_JWT_SECRET is not set. Add it to your environment variables to enable auth collections."
     );
   }
-  return new import_node_util2.TextEncoder().encode(secret);
+  return new TextEncoder().encode(secret);
 }
 var DEFAULT_EXPIRY = "7d";
 async function signCollectionToken(payload, expiresIn = DEFAULT_EXPIRY) {
@@ -951,7 +996,7 @@ function decodeCollectionToken(token) {
 var AUTH_SESSIONS_COLLECTION = "__auth_sessions";
 async function issueAuthSessionToken(args) {
   const sessionId = createSessionId();
-  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const now2 = (/* @__PURE__ */ new Date()).toISOString();
   const db = args.config.db;
   if (db) {
     await db.create({
@@ -964,7 +1009,7 @@ async function issueAuthSessionToken(args) {
         authSource: args.authSource ?? "local",
         providerId: args.providerId,
         lastIp: args.ip,
-        lastSeenAt: now,
+        lastSeenAt: now2,
         revokedAt: null,
         expiresAt: null
       }
@@ -989,7 +1034,7 @@ async function issueAuthSessionToken(args) {
       id: sessionId,
       data: {
         expiresAt,
-        lastSeenAt: now,
+        lastSeenAt: now2,
         lastIp: args.ip
       }
     });
@@ -1065,28 +1110,293 @@ function createSessionId() {
 }
 
 // src/utils/hooks.ts
-var import_jexl3 = __toESM(require("jexl"), 1);
+var import_jexl4 = __toESM(require("jexl"), 1);
 
 // src/utils/declarative-hooks.ts
+var import_jexl3 = __toESM(require("jexl"), 1);
+
+// src/utils/jexl-helpers.ts
 var import_jexl2 = __toESM(require("jexl"), 1);
+function slugify(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase().trim().replace(/[^a-z0-9\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function lower(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).toLowerCase();
+}
+function upper(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).toUpperCase();
+}
+function trim(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).trim();
+}
+function capitalize(val) {
+  if (val === void 0 || val === null) return "";
+  const str = String(val).trim();
+  if (!str) return "";
+  return str.charAt(0).toUpperCase() + str.slice(1).toLowerCase();
+}
+function truncate(val, length2, ellipsis = "...") {
+  if (val === void 0 || val === null) return "";
+  const str = String(val);
+  const maxLen = typeof length2 === "number" && length2 > 0 ? length2 : 100;
+  if (str.length <= maxLen) return str;
+  return str.slice(0, maxLen).trim() + String(ellipsis ?? "...");
+}
+function readingTime(val, wpm = 200) {
+  if (val === void 0 || val === null) return 1;
+  const str = String(val).trim();
+  if (!str) return 1;
+  const words = str.split(/\s+/).filter(Boolean).length;
+  return Math.max(1, Math.ceil(words / (typeof wpm === "number" && wpm > 0 ? wpm : 200)));
+}
+function wordCount(val) {
+  if (val === void 0 || val === null) return 0;
+  const str = String(val).trim();
+  if (!str) return 0;
+  return str.split(/\s+/).filter(Boolean).length;
+}
+function replace(val, search, replacement) {
+  if (val === void 0 || val === null) return "";
+  return String(val).replace(new RegExp(String(search || ""), "g"), String(replacement ?? ""));
+}
+function startsWith(str, prefix) {
+  if (str === void 0 || str === null) return false;
+  return String(str).startsWith(String(prefix ?? ""));
+}
+function endsWith(str, suffix) {
+  if (str === void 0 || str === null) return false;
+  return String(str).endsWith(String(suffix ?? ""));
+}
+function now() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function today() {
+  return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+}
+function formatDate(val, style = "short") {
+  if (!val) return "";
+  const d = new Date(val);
+  if (Number.isNaN(d.getTime())) return "";
+  const styleStr = String(style).toLowerCase();
+  if (styleStr === "iso" || styleStr === "date") return d.toISOString().slice(0, 10);
+  if (styleStr === "datetime" || styleStr === "full") return d.toISOString();
+  return d.toLocaleDateString("en-US", {
+    year: "numeric",
+    month: "short",
+    day: "numeric"
+  });
+}
+function addDays(val, days) {
+  const d = val ? new Date(val) : /* @__PURE__ */ new Date();
+  if (Number.isNaN(d.getTime())) return "";
+  const daysNum = typeof days === "number" ? days : Number(days) || 0;
+  d.setDate(d.getDate() + daysNum);
+  return d.toISOString();
+}
+function diffDays(dateA, dateB) {
+  const dA = dateA ? new Date(dateA) : /* @__PURE__ */ new Date();
+  const dB = dateB ? new Date(dateB) : /* @__PURE__ */ new Date();
+  if (Number.isNaN(dA.getTime()) || Number.isNaN(dB.getTime())) return 0;
+  const diffMs = Math.abs(dA.getTime() - dB.getTime());
+  return Math.floor(diffMs / (1e3 * 60 * 60 * 24));
+}
+function isPast(val) {
+  if (!val) return false;
+  const d = new Date(val);
+  if (Number.isNaN(d.getTime())) return false;
+  return d.getTime() < Date.now();
+}
+function isFuture(val) {
+  if (!val) return false;
+  const d = new Date(val);
+  if (Number.isNaN(d.getTime())) return false;
+  return d.getTime() > Date.now();
+}
+function includes(arrOrStr, item) {
+  if (Array.isArray(arrOrStr)) {
+    return arrOrStr.includes(item);
+  }
+  if (typeof arrOrStr === "string") {
+    return arrOrStr.includes(String(item ?? ""));
+  }
+  return false;
+}
+function join(arr, separator = ", ") {
+  if (!Array.isArray(arr)) return "";
+  return arr.filter((item) => item !== void 0 && item !== null).join(String(separator));
+}
+function first(arr) {
+  if (Array.isArray(arr)) return arr[0] ?? null;
+  return null;
+}
+function last(arr) {
+  if (Array.isArray(arr)) return arr[arr.length - 1] ?? null;
+  return null;
+}
+function compact(arr) {
+  if (!Array.isArray(arr)) return [];
+  return arr.filter((item) => item !== void 0 && item !== null && item !== "");
+}
+function unique(arr) {
+  if (!Array.isArray(arr)) return [];
+  return Array.from(new Set(arr));
+}
+function length(val) {
+  if (Array.isArray(val) || typeof val === "string") return val.length;
+  if (val && typeof val === "object") return Object.keys(val).length;
+  return 0;
+}
+function round(val, decimals = 0) {
+  const num = Number(val);
+  if (Number.isNaN(num)) return 0;
+  const dec = typeof decimals === "number" ? decimals : Number(decimals) || 0;
+  const factor = Math.pow(10, dec);
+  return Math.round(num * factor) / factor;
+}
+function clamp(val, minVal, maxVal) {
+  const num = Number(val) || 0;
+  const min = Number(minVal) || 0;
+  const max = Number(maxVal) || 0;
+  return Math.min(Math.max(num, min), max);
+}
+function defaultValue(val, fallback) {
+  if (val === void 0 || val === null || val === "") return fallback;
+  return val;
+}
+function coalesce(...args) {
+  for (const arg of args) {
+    if (arg !== void 0 && arg !== null && arg !== "") return arg;
+  }
+  return null;
+}
+function isEmpty(val) {
+  if (val === void 0 || val === null || val === "") return true;
+  if (Array.isArray(val)) return val.length === 0;
+  if (typeof val === "object") return Object.keys(val).length === 0;
+  return false;
+}
+function get(obj, path, fallback = null) {
+  if (!obj || typeof obj !== "object") return fallback;
+  const pathStr = String(path || "").trim();
+  if (!pathStr) return fallback;
+  const parts = pathStr.split(".");
+  let curr = obj;
+  for (const part of parts) {
+    if (curr === void 0 || curr === null) return fallback;
+    curr = curr[part];
+  }
+  return curr === void 0 || curr === null ? fallback : curr;
+}
+function registerJexlHelpers(jexlInstance = import_jexl2.default) {
+  const helpers = {
+    // Strings
+    slugify,
+    lower,
+    upper,
+    trim,
+    capitalize,
+    truncate,
+    readingTime,
+    wordCount,
+    replace,
+    startsWith,
+    endsWith,
+    // Dates
+    now,
+    today,
+    formatDate,
+    addDays,
+    diffDays,
+    isPast,
+    isFuture,
+    // Arrays
+    includes,
+    join,
+    first,
+    last,
+    compact,
+    unique,
+    length,
+    // Math
+    round,
+    clamp,
+    // Objects & Logical
+    default: defaultValue,
+    coalesce,
+    isEmpty,
+    get
+  };
+  for (const [name, fn] of Object.entries(helpers)) {
+    try {
+      jexlInstance.addFunction(name, fn);
+    } catch {
+    }
+  }
+}
+registerJexlHelpers(import_jexl2.default);
+var BUILTIN_JEXL_HELPERS = [
+  // Strings
+  "slugify",
+  "lower",
+  "upper",
+  "trim",
+  "capitalize",
+  "truncate",
+  "readingTime",
+  "wordCount",
+  "replace",
+  "startsWith",
+  "endsWith",
+  // Dates
+  "now",
+  "today",
+  "formatDate",
+  "addDays",
+  "diffDays",
+  "isPast",
+  "isFuture",
+  // Arrays
+  "includes",
+  "join",
+  "first",
+  "last",
+  "compact",
+  "unique",
+  "length",
+  // Math
+  "round",
+  "clamp",
+  // Objects & Logical
+  "default",
+  "coalesce",
+  "isEmpty",
+  "get"
+];
+
+// src/utils/declarative-hooks.ts
+registerJexlHelpers(import_jexl3.default);
 var SURFACE_ROOTS = {
-  "collection.beforeRead": ["req", "user", "query"],
-  "collection.afterRead": ["req", "user", "doc"],
-  "collection.beforeChange": ["req", "user", "data", "doc", "operation"],
-  "global.beforeRead": ["req", "user", "query"],
-  "global.afterRead": ["req", "user", "doc"],
-  "global.beforeChange": ["req", "user", "data", "doc", "operation"],
-  "field.beforeChange": ["value", "data", "originalDoc", "user"],
-  "field.admin.onChange": ["value", "siblingData", "data"]
+  "collection.beforeRead": ["req", "user", "query", ...BUILTIN_JEXL_HELPERS],
+  "collection.afterRead": ["req", "user", "doc", ...BUILTIN_JEXL_HELPERS],
+  "collection.beforeChange": ["req", "user", "data", "doc", "operation", ...BUILTIN_JEXL_HELPERS],
+  "global.beforeRead": ["req", "user", "query", ...BUILTIN_JEXL_HELPERS],
+  "global.afterRead": ["req", "user", "doc", ...BUILTIN_JEXL_HELPERS],
+  "global.beforeChange": ["req", "user", "data", "doc", "operation", ...BUILTIN_JEXL_HELPERS],
+  "field.beforeChange": ["value", "data", "originalDoc", "user", ...BUILTIN_JEXL_HELPERS],
+  "field.admin.onChange": ["value", "siblingData", "data", ...BUILTIN_JEXL_HELPERS]
 };
-var ACCESS_ROOTS = ["user", "req", "doc", "data", "id", "config"];
-var ADMIN_CONDITION_RESERVED_ROOTS = ["data", "siblingData", "user", "id"];
-var PREVIEW_URL_RESERVED_ROOTS = ["siteUrl", "id"];
+var ACCESS_ROOTS = ["user", "req", "doc", "data", "id", "config", ...BUILTIN_JEXL_HELPERS];
+var ADMIN_CONDITION_RESERVED_ROOTS = ["data", "siblingData", "user", "id", ...BUILTIN_JEXL_HELPERS];
+var PREVIEW_URL_RESERVED_ROOTS = ["siteUrl", "id", ...BUILTIN_JEXL_HELPERS];
 var COMPILE_CACHE = /* @__PURE__ */ new Map();
 function compileExpression(expression) {
   const cached = COMPILE_CACHE.get(expression);
   if (cached) return cached;
-  const compiled = import_jexl2.default.compile(expression);
+  const compiled = import_jexl3.default.compile(expression);
   const next = { ast: compiled._ast };
   COMPILE_CACHE.set(expression, next);
   return next;
@@ -1609,13 +1919,16 @@ function collectConfigDiagnostics(config) {
 function formatConfigDiagnostics(source, diagnostics, options = {}) {
   const color = options.color ?? false;
   const header = `${colorize("Config validation failed", 31, color)} in ${colorize(source, 36, color)}`;
+  const docLink = `${colorize("   Learn how to write declarative rules:", 90, color)} ${colorize("https://docs.dyrected.com/docs/features/admin/form-and-field-hooks", 34, color)}`;
   const lines = diagnostics.flatMap((issue, index) => [
     `${colorize(`${index + 1}.`, 31, color)} ${colorize(issue.path, 1, color)}`,
     `   ${issue.message}`,
     `   ${colorize("surface:", 90, color)} ${issue.surface}`
   ]);
   return `${header}
-${lines.join("\n")}`;
+${lines.join("\n")}
+
+${docLink}`;
 }
 var ConfigValidationError = class extends Error {
   diagnostics;
@@ -1673,7 +1986,7 @@ async function runCollectionHooks(hooks, args, options = {}) {
             options.path ?? options.surface
           );
         }
-        return import_jexl3.default.eval(hook, hookArgs);
+        return import_jexl4.default.eval(hook, hookArgs);
       })() : await hook(hookArgs);
       if (result !== void 0) {
         if (typeof hook === "string" && options.surface) {
@@ -1690,10 +2003,7 @@ async function runCollectionHooks(hooks, args, options = {}) {
       }
     } catch (err) {
       if (options.isolated) {
-        getConfigLogger(void 0, "hooks").error({
-          err,
-          msg: "Side-effect hook failed after a successful write"
-        });
+        console.error("Side-effect hook failed after a successful write", err);
       } else {
         throw err;
       }
@@ -1725,7 +2035,7 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db, pat
             "field.beforeChange",
             fieldPath
           );
-          return import_jexl3.default.eval(hook, hookArgs);
+          return import_jexl4.default.eval(hook, hookArgs);
         })() : await hook(hookArgs);
       }
       result[field.name] = updatedValue;
@@ -1903,22 +2213,18 @@ function validateUpload(file, config) {
 }
 
 // src/auth/jexl.ts
-var import_jexl4 = __toESM(require("jexl"), 1);
+var import_jexl5 = __toESM(require("jexl"), 1);
 async function evaluateAccess(expression, context) {
   if (expression === void 0 || expression === null) return false;
   if (typeof expression === "boolean") return expression;
   try {
-    const result = await import_jexl4.default.eval(expression, context);
+    const result = await import_jexl5.default.eval(expression, context);
     if (result && typeof result === "object" && !Array.isArray(result)) {
       return result;
     }
     return !!result;
   } catch (err) {
-    getConfigLogger(context.config, "access").error({
-      err,
-      msg: "Jexl evaluation failed",
-      expression
-    });
+    console.error("[dyrected:access] Failed to evaluate access expression:", err);
     return false;
   }
 }
@@ -1936,20 +2242,14 @@ async function resolveAccess(config, access, args) {
     try {
       return await access(args);
     } catch (err) {
-      getConfigLogger(config, "access").error({
-        err,
-        msg: "Functional access check failed"
-      });
+      console.error("[dyrected:access] Functional access check failed:", err);
       return false;
     }
   }
   if (isNamedAccessPolicy(access)) {
     const policy = config.accessPolicies?.[access.policy];
     if (policy === void 0) {
-      getConfigLogger(config, "access").error({
-        msg: "Unknown access policy",
-        policy: access.policy
-      });
+      console.error(`[dyrected:access] Unknown access policy "${access.policy}"`);
       return false;
     }
     if (typeof policy === "string" || typeof policy === "boolean") {
@@ -1959,11 +2259,7 @@ async function resolveAccess(config, access, args) {
       const resolver = policy;
       return await resolver({ ...args, params: access.params });
     } catch (err) {
-      getConfigLogger(config, "access").error({
-        err,
-        msg: "Access policy failed",
-        policy: access.policy
-      });
+      console.error(`[dyrected:access] Access policy "${access.policy}" failed:`, err);
       return false;
     }
   }
@@ -2383,7 +2679,7 @@ function simplePublishingWorkflow() {
       { name: "published", label: "Published", color: "success", published: true }
     ],
     transitions: [
-      { name: "publish", label: "Publish", from: "draft", to: "published" },
+      { name: "publish", label: "Publish", from: ["draft", "published"], to: "published" },
       { name: "unpublish", label: "Unpublish", from: "published", to: "draft", unpublish: true }
     ]
     // Intentionally no `roles`: this lightweight workflow (synthesized from
@@ -2490,7 +2786,11 @@ async function dispatchLifecycleEvent(config, event) {
   const retryDelayMs = config.events.retryDelayMs ?? 1e3;
   const attempts = event.attempts + 1;
   try {
-    await db.update({ collection: LIFECYCLE_EVENTS_COLLECTION, id: event.id, data: { status: "processing", attempts } });
+    await db.update({
+      collection: LIFECYCLE_EVENTS_COLLECTION,
+      id: event.id,
+      data: { status: "processing", attempts }
+    });
     for (const handler of config.events.handlers) await handler({ ...event, status: "processing", attempts });
     await db.update({
       collection: LIFECYCLE_EVENTS_COLLECTION,
@@ -2581,12 +2881,16 @@ async function transitionWorkflow(args) {
   const meta = original.__workflow;
   if (!meta) throw Object.assign(new Error("Entry has no workflow metadata"), { statusCode: 409 });
   if (expectedRevision !== void 0 && expectedRevision !== meta.revision) {
-    throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
+    throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), {
+      statusCode: 409
+    });
   }
   const transition = workflow.transitions.find((item) => item.name === transitionName);
   const fromStates = transition ? Array.isArray(transition.from) ? transition.from : [transition.from] : [];
   if (!transition || !fromStates.includes(meta.state)) {
-    throw Object.assign(new Error(`Transition "${transitionName}" is not valid from "${meta.state}".`), { statusCode: 409 });
+    throw Object.assign(new Error(`Transition "${transitionName}" is not valid from "${meta.state}".`), {
+      statusCode: 409
+    });
   }
   if (!availableWorkflowTransitions(workflow, meta.state, user).some((item) => item.name === transition.name)) {
     throw Object.assign(new Error(`You do not have permission to perform "${transition.label}".`), { statusCode: 403 });
@@ -2596,32 +2900,52 @@ async function transitionWorkflow(args) {
   }
   const hookContext = { transition, from: meta.state, to: transition.to, doc: original, user, comment, req, db };
   for (const hook of workflow.hooks?.beforeTransition ?? []) await hook(hookContext);
-  const events = [createLifecycleEvent({
-    name: "workflow.transitioned",
-    collection: collection.slug,
-    documentId: id,
-    actorId: user?.sub,
-    payload: { transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision, comment }
-  })];
+  const events = [
+    createLifecycleEvent({
+      name: "workflow.transitioned",
+      collection: collection.slug,
+      documentId: id,
+      actorId: user?.sub,
+      payload: { transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision, comment }
+    })
+  ];
   const targetState = workflow.states.find((state) => state.name === transition.to);
   if (targetState.published) {
-    events.push(createLifecycleEvent({ name: "entry.published", collection: collection.slug, documentId: id, actorId: user?.sub, payload: { revision: meta.revision } }));
+    events.push(
+      createLifecycleEvent({
+        name: "entry.published",
+        collection: collection.slug,
+        documentId: id,
+        actorId: user?.sub,
+        payload: { revision: meta.revision }
+      })
+    );
   } else if (transition.unpublish) {
-    events.push(createLifecycleEvent({ name: "entry.unpublished", collection: collection.slug, documentId: id, actorId: user?.sub, payload: { revision: meta.publishedRevision } }));
+    events.push(
+      createLifecycleEvent({
+        name: "entry.unpublished",
+        collection: collection.slug,
+        documentId: id,
+        actorId: user?.sub,
+        payload: { revision: meta.publishedRevision }
+      })
+    );
   }
   const updated = await db.transaction(async (tx) => {
     const locked = await tx.findOne({ collection: collection.slug, id });
     if (!locked) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
     const lockedMeta = locked.__workflow;
     if (lockedMeta.revision !== meta.revision || lockedMeta.state !== meta.state || expectedRevision !== void 0 && lockedMeta.revision !== expectedRevision) {
-      throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
+      throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), {
+        statusCode: 409
+      });
     }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const now2 = (/* @__PURE__ */ new Date()).toISOString();
     const { __published: _published, __workflow: _workflow, id: _id, ...working } = locked;
     const nextMeta = {
       ...lockedMeta,
       state: transition.to,
-      ...targetState.published ? { publishedRevision: lockedMeta.revision, publishedAt: now, publishedBy: user?.sub } : {},
+      ...targetState.published ? { publishedRevision: lockedMeta.revision, publishedAt: now2, publishedBy: user?.sub } : {},
       ...transition.unpublish ? { publishedRevision: void 0, publishedAt: void 0, publishedBy: void 0 } : {}
     };
     const data = { __workflow: nextMeta };
@@ -2630,11 +2954,36 @@ async function transitionWorkflow(args) {
     const next = await tx.update({ collection: collection.slug, id, data });
     await tx.create({
       collection: WORKFLOW_HISTORY_COLLECTION,
-      data: { collection: collection.slug, documentId: id, transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision, comment: comment ?? null, actorId: user?.sub ?? null, createdAt: now }
+      data: {
+        collection: collection.slug,
+        documentId: id,
+        transition: transition.name,
+        from: lockedMeta.state,
+        to: transition.to,
+        revision: lockedMeta.revision,
+        comment: comment ?? null,
+        actorId: user?.sub ?? null,
+        createdAt: now2
+      }
     });
     for (const event of events) await persistEvent(tx, event);
     if (collection.audit) {
-      await tx.create({ collection: "__audit", data: { collection: collection.slug, documentId: id, operation: "workflow.transition", user: user?.sub ?? null, timestamp: now, changes: JSON.stringify({ transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision }) } });
+      await tx.create({
+        collection: "__audit",
+        data: {
+          collection: collection.slug,
+          documentId: id,
+          operation: "workflow.transition",
+          user: user?.sub ?? null,
+          timestamp: now2,
+          changes: JSON.stringify({
+            transition: transition.name,
+            from: lockedMeta.state,
+            to: transition.to,
+            revision: lockedMeta.revision
+          })
+        }
+      });
     }
     return next;
   });
@@ -2643,23 +2992,29 @@ async function transitionWorkflow(args) {
     try {
       await hook({ ...hookContext, doc: updated, event: events[0] });
     } catch (error) {
-      getObservabilityRuntime(config)?.recordWorkflowHookFailure({
-        collection: collection.slug,
-        transition: transition.name
-      });
-      getConfigLogger(config, "workflow").error({
-        err: error,
-        msg: "afterTransition hook failed",
-        collection: collection.slug,
-        transition: transition.name,
-        documentId: id
-      });
+      try {
+        const { getConfigLogger: getConfigLogger2, getObservabilityRuntime: getObservabilityRuntime2 } = await Promise.resolve().then(() => (init_observability(), observability_exports));
+        getObservabilityRuntime2(config)?.recordWorkflowHookFailure({
+          collection: collection.slug,
+          transition: transition.name
+        });
+        getConfigLogger2(config, "workflow").error({
+          err: error,
+          msg: "afterTransition hook failed",
+          collection: collection.slug,
+          transition: transition.name,
+          documentId: id
+        });
+      } catch {
+        console.error("afterTransition hook failed:", error);
+      }
     }
   }
   return updated;
 }
 
 // src/controllers/collection.controller.ts
+init_observability();
 var CollectionController = class {
   collection;
   constructor(collection) {
@@ -3029,11 +3384,11 @@ var CollectionController = class {
     }
     const body = await c.req.json();
     const user = c.get("user");
-    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const now2 = (/* @__PURE__ */ new Date()).toISOString();
     let data = {
       ...body,
-      createdAt: now,
-      updatedAt: now,
+      createdAt: now2,
+      updatedAt: now2,
       createdBy: user?.sub ?? null,
       updatedBy: user?.sub ?? null
     };
@@ -3171,12 +3526,12 @@ var CollectionController = class {
       }
     });
     const user = c.get("user");
-    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const now2 = (/* @__PURE__ */ new Date()).toISOString();
     let data = {
       ...otherData,
       ...fileData,
-      createdAt: now,
-      updatedAt: now,
+      createdAt: now2,
+      updatedAt: now2,
       createdBy: user?.sub ?? null,
       updatedBy: user?.sub ?? null
     };
@@ -3770,6 +4125,7 @@ var CollectionController = class {
 };
 
 // src/controllers/global.controller.ts
+init_observability();
 var GlobalController = class {
   global;
   constructor(global) {
@@ -3792,8 +4148,8 @@ var GlobalController = class {
       path: `global:${this.global.slug}.hooks.beforeRead`
     });
     let data = await db.getGlobal({ slug: this.global.slug });
-    const isEmpty = !data || isFunctionallyEmpty(data);
-    if (isEmpty && this.global.initialData) {
+    const isEmpty2 = !data || isFunctionallyEmpty(data);
+    if (isEmpty2 && this.global.initialData) {
       getRequestLogger(c, "global").info({
         msg: "Auto-seeding global from config.initialData",
         global: this.global.slug
@@ -4105,6 +4461,7 @@ function mergeDynamicConfig(baseConfig, dynamic) {
 }
 
 // src/controllers/media.controller.ts
+init_observability();
 var MediaController = class {
   collection;
   loggerComponent = "media";
@@ -4428,6 +4785,7 @@ function layout({ preheader, title, content, footer }) {
 }
 
 // src/services/email.service.ts
+init_observability();
 var _devSend = null;
 var _devSendPromise = null;
 async function getDevSend() {
@@ -4548,6 +4906,7 @@ function buildPasswordChangedEmail(config, args) {
 }
 
 // src/controllers/auth.controller.ts
+init_observability();
 var AuthController = class {
   collection;
   constructor(collection) {
@@ -4612,13 +4971,13 @@ var AuthController = class {
     if (!lockout.enabled) {
       return { justLocked: false, retryAfterSeconds: null };
     }
-    const now = Date.now();
+    const now2 = Date.now();
     const lockedUntilMs = getLockedUntilMs(user.lockedUntil);
-    const lockExpired = lockedUntilMs !== null && lockedUntilMs <= now;
+    const lockExpired = lockedUntilMs !== null && lockedUntilMs <= now2;
     const currentAttempts = !lockExpired && typeof user.loginAttempts === "number" && user.loginAttempts > 0 ? user.loginAttempts : 0;
     const loginAttempts = currentAttempts + 1;
     const justLocked = loginAttempts >= lockout.maxLoginAttempts;
-    const nextLockedUntil = justLocked ? new Date(now + lockout.lockTime).toISOString() : null;
+    const nextLockedUntil = justLocked ? new Date(now2 + lockout.lockTime).toISOString() : null;
     await db.update({
       collection: this.collection.slug,
       id: String(user.id),
@@ -5152,7 +5511,7 @@ var AuthController = class {
 
 // src/controllers/admin-auth.controller.ts
 var import_node_crypto3 = require("crypto");
-var import_node_util3 = require("util");
+var import_node_util2 = require("util");
 var import_jose2 = require("jose");
 var AdminAuthController = class {
   constructor(config) {
@@ -5533,7 +5892,7 @@ var AdminAuthController = class {
     }
     let claims;
     if (provider.secret) {
-      const secret = new import_node_util3.TextEncoder().encode(provider.secret);
+      const secret = new import_node_util2.TextEncoder().encode(provider.secret);
       const verified = await (0, import_jose2.jwtVerify)(token, secret, {
         issuer: provider.issuer,
         audience: provider.audience
@@ -5649,7 +6008,7 @@ var AdminAuthController = class {
     if (!secret) {
       throw new Error("[dyrected/core] DYRECTED_JWT_SECRET is not set.");
     }
-    return new import_node_util3.TextEncoder().encode(secret);
+    return new import_node_util2.TextEncoder().encode(secret);
   }
   normalizeReturnTo(returnTo, c) {
     if (returnTo) return returnTo;
@@ -5660,11 +6019,11 @@ var AdminAuthController = class {
 
 // src/controllers/preview.controller.ts
 var import_jose3 = require("jose");
-var import_node_util4 = require("util");
+var import_node_util3 = require("util");
 var PreviewController = class {
   getSecret() {
     const secret = process.env.DYRECTED_JWT_SECRET || "dyrected-preview-secret-change-me";
-    return new import_node_util4.TextEncoder().encode(secret);
+    return new import_node_util3.TextEncoder().encode(secret);
   }
   /**
    * POST /api/preview-token
@@ -5873,6 +6232,7 @@ var AuditController = class {
 };
 
 // src/middleware/auth.ts
+init_observability();
 function getBearerToken(c) {
   const authHeader = c.req.header("Authorization");
   return authHeader?.replace(/^Bearer\s+/i, "") || void 0;
@@ -7013,6 +7373,7 @@ function getSwaggerHtml(specUrl) {
 }
 
 // src/router.ts
+init_observability();
 var SERIALIZED_ADMIN_HOOK_PREFIX = "__dyrected_fn__:";
 function accessGate(config, target, action) {
   return async (c, next) => {
@@ -8182,15 +8543,15 @@ function createRateLimitMiddleware(config) {
     })) {
       return next();
     }
-    const now = Date.now();
+    const now2 = Date.now();
     const key = ip;
     const existing = buckets.get(key);
-    const bucket = existing && existing.resetAt > now ? existing : { count: 0, resetAt: now + settings.window };
+    const bucket = existing && existing.resetAt > now2 ? existing : { count: 0, resetAt: now2 + settings.window };
     bucket.count += 1;
     buckets.set(key, bucket);
-    pruneExpiredBuckets(buckets, now);
+    pruneExpiredBuckets(buckets, now2);
     const remaining = Math.max(0, settings.max - bucket.count);
-    const resetSeconds = Math.max(1, Math.ceil((bucket.resetAt - now) / 1e3));
+    const resetSeconds = Math.max(1, Math.ceil((bucket.resetAt - now2) / 1e3));
     c.res.headers.set("X-RateLimit-Limit", String(settings.max));
     c.res.headers.set("X-RateLimit-Remaining", String(remaining));
     c.res.headers.set("X-RateLimit-Reset", String(Math.ceil(bucket.resetAt / 1e3)));
@@ -8221,16 +8582,17 @@ function normalizeRateLimitConfig(config) {
 function matchesLimitedPath(path, prefixes) {
   return prefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
 }
-function pruneExpiredBuckets(buckets, now) {
+function pruneExpiredBuckets(buckets, now2) {
   if (buckets.size < 1e3) return;
   for (const [key, bucket] of buckets) {
-    if (bucket.resetAt <= now) {
+    if (bucket.resetAt <= now2) {
       buckets.delete(key);
     }
   }
 }
 
 // src/app.ts
+init_observability();
 async function createDyrectedApp(rawConfig) {
   const config = normalizeConfig(rawConfig);
   const observability = createObservabilityRuntime(config);
@@ -8382,6 +8744,9 @@ async function createDyrectedApp(rawConfig) {
   registerRoutes(app, config);
   return app;
 }
+
+// src/server.ts
+init_observability();
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthController,
@@ -8389,6 +8754,21 @@ async function createDyrectedApp(rawConfig) {
   GlobalController,
   MediaController,
   PreviewController,
+  attachRequestMetrics,
+  bindObservabilityRuntime,
+  buildRequestLogger,
+  captureRequestBody,
   createDyrectedApp,
-  registerRoutes
+  createObservabilityRuntime,
+  createRequestSpan,
+  endRequestSpan,
+  getConfigLogger,
+  getObservabilityRuntime,
+  getRequestLogger,
+  redactBody,
+  redactHeaders,
+  registerRoutes,
+  renderPrometheusMetrics,
+  resolveObservabilityConfig,
+  shouldSampleRequest
 });