@dyrected/core 2.7.0 → 2.7.1

package/dist/chunk-AKYYGMFS.js

@@ -0,0 +1,3365 @@
+// src/observability.ts
+import {
+  TraceFlags,
+  context as otelContext,
+  trace
+} from "@opentelemetry/api";
+import { OTLPMetricExporter } from "@opentelemetry/exporter-metrics-otlp-http";
+import { PrometheusExporter } from "@opentelemetry/exporter-prometheus";
+import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
+import { resourceFromAttributes } from "@opentelemetry/resources";
+import {
+  MeterProvider,
+  PeriodicExportingMetricReader
+} from "@opentelemetry/sdk-metrics";
+import {
+  BasicTracerProvider,
+  BatchSpanProcessor,
+  ConsoleSpanExporter
+} from "@opentelemetry/sdk-trace-base";
+import pino, {
+  destination as pinoDestination,
+  multistream,
+  stdTimeFunctions
+} from "pino";
+import pinoPretty from "pino-pretty";
+import { Writable } from "stream";
+var DEFAULT_REDACT_HEADERS = ["authorization", "cookie", "set-cookie", "x-api-key"];
+var DEFAULT_REDACT_PATHS = [
+  "password",
+  "currentPassword",
+  "newPassword",
+  "confirmPassword",
+  "token",
+  "refreshToken",
+  "accessToken",
+  "secret",
+  "apiKey",
+  "inviteToken",
+  "resetToken"
+];
+var DEFAULT_MAX_BODY_BYTES = 8192;
+var DEFAULT_SUCCESS_SAMPLE_RATE = 0.1;
+var DEFAULT_BODY_SAMPLE_RATE = 0.02;
+var REDACTED_VALUE = "[REDACTED]";
+var runtimeByConfig = /* @__PURE__ */ new WeakMap();
+var fallbackLogger = pino({
+  name: "dyrected",
+  enabled: process.env.DISABLE_LOGGING !== "true",
+  timestamp: stdTimeFunctions.isoTime
+});
+function resolveObservabilityConfig(config) {
+  const requestLogging = config?.requestLogging;
+  const sampling = config?.sampling;
+  const tracing = config?.tracing;
+  const metrics = config?.metrics;
+  return {
+    requestLogging: {
+      enabled: requestLogging?.enabled ?? true,
+      logBodies: requestLogging?.logBodies ?? false,
+      maxBodyBytes: requestLogging?.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES,
+      redactPaths: uniqueValues([
+        ...DEFAULT_REDACT_PATHS,
+        ...requestLogging?.redactPaths ?? []
+      ]),
+      includeHeaders: normalizeHeaderNames(requestLogging?.includeHeaders ?? []),
+      redactHeaders: uniqueValues(
+        normalizeHeaderNames([
+          ...DEFAULT_REDACT_HEADERS,
+          ...requestLogging?.redactHeaders ?? []
+        ])
+      )
+    },
+    sampling: {
+      successRate: clampRate(sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE),
+      traceSuccessRate: clampRate(
+        sampling?.traceSuccessRate ?? sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE
+      ),
+      bodySuccessRate: clampRate(
+        sampling?.bodySuccessRate ?? Math.min(DEFAULT_BODY_SAMPLE_RATE, sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE)
+      ),
+      alwaysKeep4xx: sampling?.alwaysKeep4xx ?? true,
+      alwaysKeep5xx: sampling?.alwaysKeep5xx ?? true
+    },
+    tracing: {
+      enabled: tracing?.enabled ?? false,
+      serviceName: tracing?.serviceName ?? "dyrected",
+      exporter: tracing?.exporter ?? "none",
+      headers: tracing?.headers ?? {},
+      endpoint: tracing?.endpoint
+    },
+    metrics: {
+      enabled: metrics?.enabled ?? false,
+      exporter: metrics?.exporter ?? "none",
+      endpoint: metrics?.endpoint,
+      path: metrics?.path ?? "/metrics"
+    },
+    transports: {
+      targets: config?.transports?.targets && config.transports.targets.length > 0 ? config.transports.targets : [{ type: "stdout" }]
+    }
+  };
+}
+function createObservabilityRuntime(config) {
+  const resolved = resolveObservabilityConfig(config.observability);
+  const logger = createRootLogger(config.logger, resolved);
+  const shutdownTasks = [];
+  const meterRuntime = resolved.metrics.enabled || resolved.metrics.exporter === "prometheus" ? createMeterProvider(resolved) : void 0;
+  const tracerProvider = resolved.tracing.enabled ? createTracerProvider(resolved) : void 0;
+  const tracer = tracerProvider?.getTracer("dyrected");
+  const meter = meterRuntime?.provider.getMeter("dyrected");
+  const metrics = meter ? {
+    requestCount: meter.createCounter("dyrected_http_requests_total", {
+      description: "Total HTTP requests served by Dyrected"
+    }),
+    authFailureCount: meter.createCounter("dyrected_auth_failures_total", {
+      description: "Authentication failures"
+    }),
+    uncaughtErrorCount: meter.createCounter("dyrected_uncaught_errors_total", {
+      description: "Uncaught application errors"
+    }),
+    auditWriteFailureCount: meter.createCounter("dyrected_audit_write_failures_total", {
+      description: "Audit log persistence failures"
+    }),
+    emailSendFailureCount: meter.createCounter("dyrected_email_send_failures_total", {
+      description: "Transactional email delivery failures"
+    }),
+    workflowHookFailureCount: meter.createCounter("dyrected_workflow_hook_failures_total", {
+      description: "Workflow hook failures isolated after successful writes"
+    }),
+    requestDuration: meter.createHistogram("dyrected_http_request_duration_ms", {
+      description: "HTTP request duration in milliseconds",
+      unit: "ms"
+    })
+  } : void 0;
+  if (meterRuntime) {
+    shutdownTasks.push(() => meterRuntime.provider.shutdown());
+  }
+  if (tracerProvider) {
+    shutdownTasks.push(() => tracerProvider.shutdown());
+  }
+  return {
+    logger,
+    config: resolved,
+    tracer,
+    metrics,
+    prometheusExporter: meterRuntime?.prometheusExporter,
+    shutdown: async () => {
+      for (const task of shutdownTasks) {
+        await task();
+      }
+    },
+    recordAuthFailure: (attributes) => metrics?.authFailureCount.add(1, attributes),
+    recordUncaughtError: (attributes) => metrics?.uncaughtErrorCount.add(1, attributes),
+    recordAuditWriteFailure: (attributes) => metrics?.auditWriteFailureCount.add(1, attributes),
+    recordEmailSendFailure: (attributes) => metrics?.emailSendFailureCount.add(1, attributes),
+    recordWorkflowHookFailure: (attributes) => metrics?.workflowHookFailureCount.add(1, attributes)
+  };
+}
+function bindObservabilityRuntime(config, runtime) {
+  runtimeByConfig.set(config, runtime);
+}
+function getObservabilityRuntime(config) {
+  if (!config || typeof config !== "object") return void 0;
+  return runtimeByConfig.get(config);
+}
+function createRootLogger(loggerConfig, observability) {
+  if (loggerConfig && !("options" in loggerConfig)) {
+    return loggerConfig;
+  }
+  const options = loggerConfig?.options ?? {};
+  const enabled = options.enabled ?? process.env.DISABLE_LOGGING !== "true";
+  const name = options.name ?? "dyrected";
+  if (loggerConfig?.destination) {
+    return pino(
+      {
+        ...options,
+        enabled,
+        name,
+        timestamp: options.timestamp ?? stdTimeFunctions.isoTime
+      },
+      loggerConfig.destination
+    );
+  }
+  const streams = buildTransportStreams(observability);
+  const destination = streams.length === 1 ? streams[0] : multistream(streams.map((stream) => ({ stream })));
+  return pino(
+    {
+      ...options,
+      enabled,
+      name,
+      timestamp: options.timestamp ?? stdTimeFunctions.isoTime
+    },
+    destination
+  );
+}
+function buildTransportStreams(observability) {
+  const targets = observability.transports.targets;
+  if (targets.length === 0) {
+    return [defaultLoggerDestination()];
+  }
+  return targets.map((target) => {
+    switch (target.type) {
+      case "stdout":
+        return defaultLoggerDestination();
+      case "stderr":
+        return pinoDestination(2);
+      case "file":
+        return pinoDestination(target.path);
+      case "otlp":
+        return new OtlpLogWritable(target.endpoint, target.headers);
+    }
+  });
+}
+function defaultLoggerDestination() {
+  if (process.env.NODE_ENV !== "production") {
+    return pinoPretty({
+      colorize: true,
+      ignore: "pid,hostname",
+      translateTime: "SYS:HH:MM:ss",
+      destination: 1,
+      sync: true
+    });
+  }
+  return pinoDestination(1);
+}
+var OtlpLogWritable = class extends Writable {
+  constructor(endpoint, headers = {}) {
+    super();
+    this.endpoint = endpoint;
+    this.headers = headers;
+  }
+  endpoint;
+  headers;
+  _write(chunk, _encoding, callback) {
+    const payload = chunk.toString();
+    void fetch(this.endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        ...this.headers
+      },
+      body: JSON.stringify({ logs: payload.trim().split("\n").filter(Boolean) })
+    }).then(() => callback()).catch(
+      (error) => callback(error instanceof Error ? error : new Error(String(error)))
+    );
+  }
+};
+function createTracerProvider(observability) {
+  const exporter = createTraceExporter(observability);
+  const provider = new BasicTracerProvider({
+    resource: resourceFromAttributes({
+      "service.name": observability.tracing.serviceName
+    }),
+    spanProcessors: exporter ? [new BatchSpanProcessor(exporter)] : []
+  });
+  trace.setGlobalTracerProvider(provider);
+  return provider;
+}
+function createTraceExporter(observability) {
+  switch (observability.tracing.exporter) {
+    case "console":
+      return new ConsoleSpanExporter();
+    case "otlp":
+      return new OTLPTraceExporter({
+        url: observability.tracing.endpoint,
+        headers: observability.tracing.headers
+      });
+    default:
+      return void 0;
+  }
+}
+function createMeterProvider(observability) {
+  const readers = [];
+  let prometheusExporter;
+  switch (observability.metrics.exporter) {
+    case "otlp":
+      readers.push(
+        new PeriodicExportingMetricReader({
+          exporter: new OTLPMetricExporter({
+            url: observability.metrics.endpoint
+          })
+        })
+      );
+      break;
+    case "prometheus":
+      prometheusExporter = new PrometheusExporter({
+        endpoint: observability.metrics.path,
+        preventServerStart: true
+      });
+      readers.push(prometheusExporter);
+      break;
+  }
+  const provider = new MeterProvider({
+    resource: resourceFromAttributes({
+      "service.name": observability.tracing.serviceName
+    }),
+    readers
+  });
+  return { provider, prometheusExporter };
+}
+function getConfigLogger(config, component) {
+  const base = config?.logger && !("options" in config.logger) ? config.logger : fallbackLogger;
+  return base.child({ component });
+}
+function getRequestLogger(c, component) {
+  const base = c.get("logger") ?? fallbackLogger;
+  return component ? base.child({ component }) : base;
+}
+function buildRequestLogger(runtime, vars, requestId) {
+  const trace2 = vars.requestTrace;
+  return runtime.logger.child({
+    requestId,
+    siteId: vars.siteId,
+    workspaceId: vars.workspaceId,
+    traceId: trace2?.traceId,
+    spanId: trace2?.spanId
+  });
+}
+function shouldSampleRequest(requestId, statusCode, sampling, kind) {
+  if (statusCode >= 500 && sampling.alwaysKeep5xx) return true;
+  if (statusCode >= 400 && sampling.alwaysKeep4xx) return true;
+  const rate = kind === "trace" ? sampling.traceSuccessRate : kind === "body" ? sampling.bodySuccessRate : sampling.successRate;
+  return deterministicSample(requestId ?? "no-request-id", rate);
+}
+function redactHeaders(headers, observability) {
+  const includeHeaders = new Set(observability.requestLogging.includeHeaders);
+  const redactHeaders2 = new Set(observability.requestLogging.redactHeaders);
+  const output = {};
+  for (const [key, value] of Object.entries(headers)) {
+    const normalizedKey = key.toLowerCase();
+    if (includeHeaders.size > 0 && !includeHeaders.has(normalizedKey)) continue;
+    output[normalizedKey] = redactHeaders2.has(normalizedKey) ? REDACTED_VALUE : value;
+  }
+  return output;
+}
+async function captureRequestBody(request, observability) {
+  const contentType = request.headers.get("content-type") ?? void 0;
+  const contentLength = toNumber(request.headers.get("content-length"));
+  const jsonBody = contentType?.includes("application/json");
+  if (!jsonBody) {
+    return {
+      attempted: false,
+      contentType,
+      contentLength
+    };
+  }
+  try {
+    const text = await request.clone().text();
+    if (!text) {
+      return { attempted: true, contentType, contentLength };
+    }
+    const truncated = text.length > observability.requestLogging.maxBodyBytes;
+    const raw = truncated ? text.slice(0, observability.requestLogging.maxBodyBytes) : text;
+    try {
+      const parsed = JSON.parse(raw);
+      return {
+        attempted: true,
+        contentType,
+        contentLength: contentLength ?? text.length,
+        truncated,
+        body: redactBody(parsed, observability.requestLogging.redactPaths)
+      };
+    } catch {
+      return {
+        attempted: true,
+        contentType,
+        contentLength: contentLength ?? text.length,
+        truncated,
+        parseFailed: true
+      };
+    }
+  } catch {
+    return {
+      attempted: true,
+      contentType,
+      contentLength,
+      parseFailed: true
+    };
+  }
+}
+function redactBody(value, redactPaths) {
+  const cloned = deepClone(value);
+  for (const path of redactPaths) {
+    applyRedaction(cloned, path.split("."));
+  }
+  return cloned;
+}
+function applyRedaction(target, segments) {
+  if (!target || segments.length === 0) return;
+  const [segment, ...rest] = segments;
+  if (Array.isArray(target)) {
+    for (const item of target) {
+      if (segment === "*") {
+        applyRedaction(item, rest);
+      } else {
+        applyRedaction(item, segments);
+      }
+    }
+    return;
+  }
+  if (typeof target !== "object") return;
+  const record = target;
+  if (segment === "*") {
+    for (const value of Object.values(record)) {
+      applyRedaction(value, rest);
+    }
+    return;
+  }
+  if (!(segment in record)) return;
+  if (rest.length === 0) {
+    record[segment] = REDACTED_VALUE;
+    return;
+  }
+  applyRedaction(record[segment], rest);
+}
+function deepClone(value) {
+  if (typeof structuredClone === "function") {
+    return structuredClone(value);
+  }
+  return JSON.parse(JSON.stringify(value));
+}
+function createRequestSpan(runtime, name, attributes) {
+  if (!runtime.tracer) return void 0;
+  const span = runtime.tracer.startSpan(name, { attributes }, otelContext.active());
+  const spanContext = span.spanContext();
+  return {
+    span,
+    traceId: spanContext.traceId,
+    spanId: spanContext.spanId,
+    sampled: spanContext.traceFlags === TraceFlags.SAMPLED
+  };
+}
+function endRequestSpan(requestTrace, statusCode, error) {
+  if (!requestTrace) return;
+  requestTrace.span.setAttribute("http.status_code", statusCode);
+  if (error) {
+    requestTrace.span.recordException(error instanceof Error ? error : new Error(String(error)));
+  }
+  requestTrace.span.end();
+}
+function attachRequestMetrics(runtime, args) {
+  runtime.metrics?.requestCount.add(1, {
+    method: args.method,
+    route: args.route,
+    status_class: `${Math.floor(args.statusCode / 100)}xx`
+  });
+  runtime.metrics?.requestDuration.record(args.durationMs, {
+    method: args.method,
+    route: args.route,
+    status_class: `${Math.floor(args.statusCode / 100)}xx`
+  });
+}
+async function renderPrometheusMetrics(exporter) {
+  let statusCode = 200;
+  const headers = {};
+  let body = "";
+  await new Promise((resolve) => {
+    const response = {
+      statusCode,
+      setHeader(name, value) {
+        headers[name.toLowerCase()] = value;
+      },
+      end(chunk) {
+        if (chunk) body += chunk;
+        statusCode = this.statusCode;
+        resolve();
+      }
+    };
+    exporter.getMetricsRequestHandler({}, response);
+  });
+  return { body, headers, statusCode };
+}
+function normalizeHeaderNames(headers) {
+  return headers.map((value) => value.toLowerCase());
+}
+function uniqueValues(values) {
+  return [...new Set(values)];
+}
+function clampRate(value) {
+  if (Number.isNaN(value)) return 0;
+  return Math.max(0, Math.min(1, value));
+}
+function deterministicSample(seed, rate) {
+  if (rate >= 1) return true;
+  if (rate <= 0) return false;
+  let hash = 0;
+  for (let index = 0; index < seed.length; index += 1) {
+    hash = hash * 31 + seed.charCodeAt(index) >>> 0;
+  }
+  return hash / 4294967295 <= rate;
+}
+function toNumber(value) {
+  if (!value) return void 0;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : void 0;
+}
+
+// src/workflows.ts
+var WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
+var LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
+var EDITOR_CAPABILITIES = ["entry.edit", "entry.submit"];
+var PUBLISHER_CAPABILITIES = ["entry.edit", "entry.submit", "entry.publish", "entry.unpublish"];
+function definePublishingWorkflow(options = {}) {
+  const editors = options.editors ?? ["editor"];
+  const publishers = options.publishers ?? ["publisher", "admin"];
+  return {
+    initialState: "draft",
+    draftState: "draft",
+    states: [
+      { name: "draft", label: "Draft", color: "neutral" },
+      { name: "in_review", label: "In review", color: "warning" },
+      { name: "published", label: "Published", color: "success", published: true }
+    ],
+    transitions: [
+      { name: "submit", label: "Submit for review", from: "draft", to: "in_review", requiredCapabilities: ["entry.submit"] },
+      { name: "publish", label: "Publish", from: "in_review", to: "published", requiredCapabilities: ["entry.publish"] },
+      { name: "reject", label: "Request changes", from: "in_review", to: "draft", requiredCapabilities: ["entry.publish"], requireComment: true },
+      { name: "unpublish", label: "Unpublish", from: "published", to: "draft", requiredCapabilities: ["entry.unpublish"], unpublish: true }
+    ],
+    roles: [
+      ...editors.map((role) => ({ role, capabilities: [...EDITOR_CAPABILITIES] })),
+      ...publishers.map((role) => ({ role, capabilities: [...PUBLISHER_CAPABILITIES] }))
+    ]
+  };
+}
+function publishingWorkflow() {
+  return definePublishingWorkflow();
+}
+function simplePublishingWorkflow() {
+  return {
+    initialState: "draft",
+    draftState: "draft",
+    states: [
+      { name: "draft", label: "Draft", color: "neutral" },
+      { name: "published", label: "Published", color: "success", published: true }
+    ],
+    transitions: [
+      { name: "publish", label: "Publish", from: "draft", to: "published" },
+      { name: "unpublish", label: "Unpublish", from: "published", to: "draft", unpublish: true }
+    ]
+    // Intentionally no `roles`: this lightweight workflow (synthesized from
+    // `drafts: true`) does no capability-based gating. Draft visibility for a
+    // no-roles workflow is handled in `canViewWorkflowDraft`.
+  };
+}
+function publicMetadata(meta) {
+  const { availableTransitions: _availableTransitions, ...safe } = meta;
+  return safe;
+}
+function workflowCapabilities(workflow, user) {
+  const capabilities = new Set(Array.isArray(user?.capabilities) ? user.capabilities : []);
+  const roles = Array.isArray(user?.roles) ? user.roles : [];
+  for (const mapping of workflow.roles ?? []) {
+    if (roles.includes(mapping.role)) mapping.capabilities.forEach((capability) => capabilities.add(capability));
+  }
+  return capabilities;
+}
+function canViewWorkflowDraft(workflow, user) {
+  if (!user) return false;
+  const capabilities = workflowCapabilities(workflow, user);
+  if (capabilities.has("entry.edit")) return true;
+  if (workflow.transitions.some(
+    (transition) => (transition.requiredCapabilities ?? []).some((capability) => capabilities.has(capability))
+  )) {
+    return true;
+  }
+  if (!workflow.roles || workflow.roles.length === 0) return true;
+  return false;
+}
+function availableWorkflowTransitions(workflow, state, user) {
+  const capabilities = workflowCapabilities(workflow, user);
+  return workflow.transitions.filter((transition) => {
+    const from = Array.isArray(transition.from) ? transition.from : [transition.from];
+    return from.includes(state) && (transition.requiredCapabilities ?? []).every((item) => capabilities.has(item));
+  });
+}
+function initializeWorkflowDocument(data, workflow) {
+  return {
+    ...data,
+    __workflow: { state: workflow.initialState, revision: 1 }
+  };
+}
+function publishedStateName(workflow) {
+  return workflow.states.find((state) => state.published)?.name ?? workflow.states[workflow.states.length - 1]?.name ?? workflow.initialState;
+}
+function materializeWorkflowDocument(doc, workflow, user) {
+  const meta = doc.__workflow;
+  const publishedState = publishedStateName(workflow);
+  if (!meta) {
+    const { __published: _legacyPublished, __workflow: _legacyWorkflow, ...working2 } = doc;
+    const state = publishedStateName(workflow);
+    return {
+      ...working2,
+      _workflow: {
+        state,
+        revision: 1,
+        availableTransitions: availableWorkflowTransitions(workflow, state, user).map((item) => item.name)
+      }
+    };
+  }
+  const { __published, __workflow, ...working } = doc;
+  if (!canViewWorkflowDraft(workflow, user)) {
+    if (!__published || typeof __published !== "object") {
+      if (meta.state === publishedState) {
+        return { ...working, _workflow: publicMetadata(meta) };
+      }
+      return null;
+    }
+    return { id: doc.id, ...__published, _workflow: publicMetadata(meta) };
+  }
+  return {
+    ...working,
+    _workflow: {
+      ...meta,
+      availableTransitions: availableWorkflowTransitions(workflow, meta.state, user).map((item) => item.name)
+    }
+  };
+}
+function eventId() {
+  return globalThis.crypto?.randomUUID?.() ?? `evt_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+}
+function createLifecycleEvent(args) {
+  return {
+    id: eventId(),
+    name: args.name,
+    collection: args.collection,
+    documentId: args.documentId,
+    occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+    actorId: args.actorId,
+    payload: args.payload,
+    attempts: 0,
+    status: "pending"
+  };
+}
+async function persistEvent(db, event) {
+  await db.create({ collection: LIFECYCLE_EVENTS_COLLECTION, data: event });
+}
+async function dispatchLifecycleEvent(config, event) {
+  const db = config.db;
+  if (!db || !config.events?.handlers.length) return;
+  const maxAttempts = config.events.maxAttempts ?? 8;
+  const retryDelayMs = config.events.retryDelayMs ?? 1e3;
+  const attempts = event.attempts + 1;
+  try {
+    await db.update({ collection: LIFECYCLE_EVENTS_COLLECTION, id: event.id, data: { status: "processing", attempts } });
+    for (const handler of config.events.handlers) await handler({ ...event, status: "processing", attempts });
+    await db.update({
+      collection: LIFECYCLE_EVENTS_COLLECTION,
+      id: event.id,
+      data: { status: "delivered", attempts, deliveredAt: (/* @__PURE__ */ new Date()).toISOString(), lastError: null }
+    });
+  } catch (error) {
+    const exhausted = attempts >= maxAttempts;
+    await db.update({
+      collection: LIFECYCLE_EVENTS_COLLECTION,
+      id: event.id,
+      data: {
+        status: "failed",
+        attempts,
+        lastError: error instanceof Error ? error.message : String(error),
+        nextAttemptAt: exhausted ? null : new Date(Date.now() + retryDelayMs * 2 ** (attempts - 1)).toISOString()
+      }
+    });
+  }
+}
+async function dispatchPendingLifecycleEvents(config, limit = 50) {
+  if (!config.db || !config.events?.handlers.length) return 0;
+  const maxAttempts = config.events.maxAttempts ?? 8;
+  const result = await config.db.find({
+    collection: LIFECYCLE_EVENTS_COLLECTION,
+    where: { status: { in: ["pending", "failed"] } },
+    sort: "occurredAt",
+    limit
+  });
+  const now = Date.now();
+  const due = result.docs.filter(
+    (doc) => Number(doc.attempts ?? 0) < maxAttempts && (!doc.nextAttemptAt || new Date(doc.nextAttemptAt).getTime() <= now)
+  );
+  for (const event of due) await dispatchLifecycleEvent(config, event);
+  return due.length;
+}
+async function saveWorkflowDraft(args) {
+  const { config, collection, id, originalDoc, data, user } = args;
+  const db = config.db;
+  const workflow = collection.workflow;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  const previous = originalDoc.__workflow;
+  const isLegacyPublishedDoc = !previous;
+  const baselineRevision = previous?.revision ?? 1;
+  const event = createLifecycleEvent({
+    name: "revision.created",
+    collection: collection.slug,
+    documentId: id,
+    actorId: user?.sub,
+    payload: {
+      revision: baselineRevision + 1,
+      previousRevision: isLegacyPublishedDoc ? baselineRevision : previous?.revision ?? null
+    }
+  });
+  const doc = await db.transaction(async (tx) => {
+    const nextMeta = {
+      ...previous ?? {},
+      state: isLegacyPublishedDoc ? workflow.draftState ?? workflow.initialState : originalDoc.__published ? workflow.draftState ?? workflow.initialState : previous.state,
+      revision: baselineRevision + 1,
+      ...isLegacyPublishedDoc ? { publishedRevision: baselineRevision } : {}
+    };
+    const updateData = {
+      ...data,
+      __workflow: nextMeta
+    };
+    if (isLegacyPublishedDoc) {
+      const { __workflow: _legacyWorkflow, __published: _legacyPublished, ...publishedSnapshot } = originalDoc;
+      updateData.__published = publishedSnapshot;
+    }
+    const updated = await tx.update({ collection: collection.slug, id, data: updateData });
+    await persistEvent(tx, event);
+    return updated;
+  });
+  void dispatchLifecycleEvent(config, event);
+  return { doc, event };
+}
+async function createWorkflowDocument(args) {
+  const { config, collection, data, user } = args;
+  const db = config.db;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  let event;
+  const doc = await db.transaction(async (tx) => {
+    const created = await tx.create({ collection: collection.slug, data });
+    event = createLifecycleEvent({
+      name: "revision.created",
+      collection: collection.slug,
+      documentId: created.id,
+      actorId: user?.sub,
+      payload: { revision: 1, previousRevision: null }
+    });
+    await persistEvent(tx, event);
+    return created;
+  });
+  void dispatchLifecycleEvent(config, event);
+  return { doc, event };
+}
+async function transitionWorkflow(args) {
+  const { config, collection, id, transitionName, expectedRevision, comment, user, req } = args;
+  const db = config.db;
+  const workflow = collection.workflow;
+  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
+  const original = await db.findOne({ collection: collection.slug, id });
+  if (!original) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
+  const meta = original.__workflow;
+  if (!meta) throw Object.assign(new Error("Entry has no workflow metadata"), { statusCode: 409 });
+  if (expectedRevision !== void 0 && expectedRevision !== meta.revision) {
+    throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
+  }
+  const transition = workflow.transitions.find((item) => item.name === transitionName);
+  const fromStates = transition ? Array.isArray(transition.from) ? transition.from : [transition.from] : [];
+  if (!transition || !fromStates.includes(meta.state)) {
+    throw Object.assign(new Error(`Transition "${transitionName}" is not valid from "${meta.state}".`), { statusCode: 409 });
+  }
+  if (!availableWorkflowTransitions(workflow, meta.state, user).some((item) => item.name === transition.name)) {
+    throw Object.assign(new Error(`You do not have permission to perform "${transition.label}".`), { statusCode: 403 });
+  }
+  if (transition.requireComment && !comment?.trim()) {
+    throw Object.assign(new Error(`A comment is required for "${transition.label}".`), { statusCode: 400 });
+  }
+  const hookContext = { transition, from: meta.state, to: transition.to, doc: original, user, comment, req, db };
+  for (const hook of workflow.hooks?.beforeTransition ?? []) await hook(hookContext);
+  const events = [createLifecycleEvent({
+    name: "workflow.transitioned",
+    collection: collection.slug,
+    documentId: id,
+    actorId: user?.sub,
+    payload: { transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision, comment }
+  })];
+  const targetState = workflow.states.find((state) => state.name === transition.to);
+  if (targetState.published) {
+    events.push(createLifecycleEvent({ name: "entry.published", collection: collection.slug, documentId: id, actorId: user?.sub, payload: { revision: meta.revision } }));
+  } else if (transition.unpublish) {
+    events.push(createLifecycleEvent({ name: "entry.unpublished", collection: collection.slug, documentId: id, actorId: user?.sub, payload: { revision: meta.publishedRevision } }));
+  }
+  const updated = await db.transaction(async (tx) => {
+    const locked = await tx.findOne({ collection: collection.slug, id });
+    if (!locked) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
+    const lockedMeta = locked.__workflow;
+    if (lockedMeta.revision !== meta.revision || lockedMeta.state !== meta.state || expectedRevision !== void 0 && lockedMeta.revision !== expectedRevision) {
+      throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const { __published: _published, __workflow: _workflow, id: _id, ...working } = locked;
+    const nextMeta = {
+      ...lockedMeta,
+      state: transition.to,
+      ...targetState.published ? { publishedRevision: lockedMeta.revision, publishedAt: now, publishedBy: user?.sub } : {},
+      ...transition.unpublish ? { publishedRevision: void 0, publishedAt: void 0, publishedBy: void 0 } : {}
+    };
+    const data = { __workflow: nextMeta };
+    if (targetState.published) data.__published = working;
+    if (transition.unpublish) data.__published = null;
+    const next = await tx.update({ collection: collection.slug, id, data });
+    await tx.create({
+      collection: WORKFLOW_HISTORY_COLLECTION,
+      data: { collection: collection.slug, documentId: id, transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision, comment: comment ?? null, actorId: user?.sub ?? null, createdAt: now }
+    });
+    for (const event of events) await persistEvent(tx, event);
+    if (collection.audit) {
+      await tx.create({ collection: "__audit", data: { collection: collection.slug, documentId: id, operation: "workflow.transition", user: user?.sub ?? null, timestamp: now, changes: JSON.stringify({ transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision }) } });
+    }
+    return next;
+  });
+  for (const event of events) void dispatchLifecycleEvent(config, event);
+  for (const hook of workflow.hooks?.afterTransition ?? []) {
+    try {
+      await hook({ ...hookContext, doc: updated, event: events[0] });
+    } catch (error) {
+      getObservabilityRuntime(config)?.recordWorkflowHookFailure({
+        collection: collection.slug,
+        transition: transition.name
+      });
+      getConfigLogger(config, "workflow").error({
+        err: error,
+        msg: "afterTransition hook failed",
+        collection: collection.slug,
+        transition: transition.name,
+        documentId: id
+      });
+    }
+  }
+  return updated;
+}
+
+// src/utils/admin-auth.ts
+function getAdminAuthCollection(config) {
+  const adminCollection = resolveAdminAuthCollection(config.collections, config.adminAuth?.collectionSlug);
+  return adminCollection ?? null;
+}
+function resolveAdminAuthCollection(collections, collectionSlug) {
+  const adminsCollection = collections.find((collection) => collection.slug === "__admins");
+  if (adminsCollection) return adminsCollection;
+  if (collectionSlug) {
+    const requestedCollection = collections.find((collection) => collection.slug === collectionSlug);
+    if (requestedCollection) return requestedCollection;
+  }
+  return collections.find((collection) => collection.auth);
+}
+function getPublicAdminAuthConfig(adminAuth, collections) {
+  const providers = (adminAuth?.providers ?? []).map((provider) => ({
+    id: provider.id,
+    type: provider.type,
+    displayName: provider.displayName || humanizeProviderName(provider.id, provider.type),
+    autoRedirect: provider.autoRedirect
+  }));
+  const resolvedCollectionSlug = collections ? resolveAdminAuthCollection(collections, adminAuth?.collectionSlug)?.slug : adminAuth?.collectionSlug;
+  return {
+    mode: adminAuth?.mode ?? "local",
+    collectionSlug: resolvedCollectionSlug,
+    provisioningMode: adminAuth?.provisioningMode,
+    providers
+  };
+}
+function humanizeProviderName(id, type) {
+  const cleaned = id.replace(/[-_]+/g, " ").trim();
+  if (!cleaned) return type.toUpperCase();
+  return cleaned.replace(/\b\w/g, (char) => char.toUpperCase());
+}
+
+// src/utils/declarative-hooks.ts
+import jexl2 from "jexl";
+
+// src/utils/jexl-helpers.ts
+import jexl from "jexl";
+function slugify(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase().trim().replace(/[^a-z0-9\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function lower(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).toLowerCase();
+}
+function upper(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).toUpperCase();
+}
+function trim(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).trim();
+}
+function replace(val, search, replacement) {
+  if (val === void 0 || val === null) return "";
+  return String(val).replace(new RegExp(String(search || ""), "g"), String(replacement ?? ""));
+}
+function includes(arrOrStr, item) {
+  if (Array.isArray(arrOrStr)) {
+    return arrOrStr.includes(item);
+  }
+  if (typeof arrOrStr === "string") {
+    return arrOrStr.includes(String(item ?? ""));
+  }
+  return false;
+}
+function startsWith(str, prefix) {
+  if (str === void 0 || str === null) return false;
+  return String(str).startsWith(String(prefix ?? ""));
+}
+function endsWith(str, suffix) {
+  if (str === void 0 || str === null) return false;
+  return String(str).endsWith(String(suffix ?? ""));
+}
+function defaultValue(val, fallback) {
+  if (val === void 0 || val === null || val === "") return fallback;
+  return val;
+}
+function coalesce(...args) {
+  for (const arg of args) {
+    if (arg !== void 0 && arg !== null && arg !== "") return arg;
+  }
+  return null;
+}
+function length(val) {
+  if (Array.isArray(val) || typeof val === "string") return val.length;
+  if (val && typeof val === "object") return Object.keys(val).length;
+  return 0;
+}
+function registerJexlHelpers(jexlInstance = jexl) {
+  const helpers = {
+    slugify,
+    lower,
+    upper,
+    trim,
+    replace,
+    includes,
+    startsWith,
+    endsWith,
+    default: defaultValue,
+    coalesce,
+    length
+  };
+  for (const [name, fn] of Object.entries(helpers)) {
+    try {
+      jexlInstance.addFunction(name, fn);
+    } catch {
+    }
+  }
+}
+registerJexlHelpers(jexl);
+var BUILTIN_JEXL_HELPERS = [
+  "slugify",
+  "lower",
+  "upper",
+  "trim",
+  "replace",
+  "includes",
+  "startsWith",
+  "endsWith",
+  "default",
+  "coalesce",
+  "length"
+];
+
+// src/utils/declarative-hooks.ts
+registerJexlHelpers(jexl2);
+var SURFACE_ROOTS = {
+  "collection.beforeRead": ["req", "user", "query", ...BUILTIN_JEXL_HELPERS],
+  "collection.afterRead": ["req", "user", "doc", ...BUILTIN_JEXL_HELPERS],
+  "collection.beforeChange": ["req", "user", "data", "doc", "operation", ...BUILTIN_JEXL_HELPERS],
+  "global.beforeRead": ["req", "user", "query", ...BUILTIN_JEXL_HELPERS],
+  "global.afterRead": ["req", "user", "doc", ...BUILTIN_JEXL_HELPERS],
+  "global.beforeChange": ["req", "user", "data", "doc", "operation", ...BUILTIN_JEXL_HELPERS],
+  "field.beforeChange": ["value", "data", "originalDoc", "user", ...BUILTIN_JEXL_HELPERS],
+  "field.admin.onChange": ["value", "siblingData", "data", ...BUILTIN_JEXL_HELPERS]
+};
+var ACCESS_ROOTS = ["user", "req", "doc", "data", "id", "config", ...BUILTIN_JEXL_HELPERS];
+var ADMIN_CONDITION_RESERVED_ROOTS = ["data", "siblingData", "user", "id", ...BUILTIN_JEXL_HELPERS];
+var PREVIEW_URL_RESERVED_ROOTS = ["siteUrl", "id", ...BUILTIN_JEXL_HELPERS];
+var COMPILE_CACHE = /* @__PURE__ */ new Map();
+function compileExpression(expression) {
+  const cached = COMPILE_CACHE.get(expression);
+  if (cached) return cached;
+  const compiled = jexl2.compile(expression);
+  const next = { ast: compiled._ast };
+  COMPILE_CACHE.set(expression, next);
+  return next;
+}
+function isPlainObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function quoteSegment(value) {
+  return `["${value.replace(/"/g, '\\"')}"]`;
+}
+function fieldSegment(field, index) {
+  return typeof field.name === "string" && field.name.length > 0 ? `fields${quoteSegment(field.name)}` : `fields[${index}]`;
+}
+function blockSegment(block, index) {
+  return typeof block.slug === "string" && block.slug.length > 0 ? `blocks${quoteSegment(block.slug)}` : `blocks[${index}]`;
+}
+function collectionSegment(collection, index) {
+  return typeof collection.slug === "string" && collection.slug.length > 0 ? `collections${quoteSegment(collection.slug)}` : `collections[${index}]`;
+}
+function globalSegment(global, index) {
+  return typeof global.slug === "string" && global.slug.length > 0 ? `globals${quoteSegment(global.slug)}` : `globals[${index}]`;
+}
+function colorize(value, code, enabled) {
+  return enabled ? `\x1B[${code}m${value}\x1B[0m` : value;
+}
+function collectRootIdentifiers(node, roots, seen) {
+  if (!node || typeof node !== "object" || seen.has(node)) return;
+  seen.add(node);
+  const candidate = node;
+  if (candidate.type === "Identifier") {
+    if (candidate.from) {
+      collectRootIdentifiers(candidate.from, roots, seen);
+      return;
+    }
+    if (typeof candidate.value === "string" && candidate.value !== "null") {
+      roots.add(candidate.value);
+    }
+    return;
+  }
+  if (Array.isArray(node)) {
+    for (const entry of node) collectRootIdentifiers(entry, roots, seen);
+    return;
+  }
+  for (const value of Object.values(node)) {
+    if (Array.isArray(value)) {
+      for (const entry of value) collectRootIdentifiers(entry, roots, seen);
+      continue;
+    }
+    if (value && typeof value === "object") {
+      collectRootIdentifiers(value, roots, seen);
+    }
+  }
+}
+function getInvalidRoots(expression, allowedRoots) {
+  const { ast } = compileExpression(expression);
+  const roots = /* @__PURE__ */ new Set();
+  collectRootIdentifiers(ast, roots, /* @__PURE__ */ new Set());
+  const allowed = new Set(allowedRoots);
+  return [...roots].filter((root) => !allowed.has(root));
+}
+function validateDeclarativeHookExpression(expression, surface, path) {
+  try {
+    const invalidRoots = getInvalidRoots(expression, SURFACE_ROOTS[surface]);
+    if (invalidRoots.length === 0) return [];
+    return [
+      {
+        path,
+        surface,
+        expression,
+        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${SURFACE_ROOTS[surface].map((root) => `"${root}"`).join(", ")}`
+      }
+    ];
+  } catch (error) {
+    return [
+      {
+        path,
+        surface,
+        expression,
+        message: `has invalid syntax: ${error.message}`
+      }
+    ];
+  }
+}
+function validateDeclarativeAccessExpression(expression, surface, path) {
+  try {
+    const invalidRoots = getInvalidRoots(expression, ACCESS_ROOTS);
+    if (invalidRoots.length === 0) return [];
+    return [
+      {
+        path,
+        surface,
+        expression,
+        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${ACCESS_ROOTS.map((root) => `"${root}"`).join(", ")}`
+      }
+    ];
+  } catch (error) {
+    return [
+      {
+        path,
+        surface,
+        expression,
+        message: `has invalid syntax: ${error.message}`
+      }
+    ];
+  }
+}
+function validateAdminConditionExpression(expression, path, allowedRoots) {
+  try {
+    const invalidRoots = getInvalidRoots(expression, allowedRoots);
+    if (invalidRoots.length === 0) return [];
+    return [
+      {
+        path,
+        surface: "field.admin.condition",
+        expression,
+        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${allowedRoots.map((root) => `"${root}"`).join(", ")}`
+      }
+    ];
+  } catch (error) {
+    return [
+      {
+        path,
+        surface: "field.admin.condition",
+        expression,
+        message: `has invalid syntax: ${error.message}`
+      }
+    ];
+  }
+}
+function validatePreviewUrlExpression(expression, path, allowedRoots) {
+  try {
+    const invalidRoots = getInvalidRoots(expression, allowedRoots);
+    if (invalidRoots.length === 0) return [];
+    return [
+      {
+        path,
+        surface: "collection.admin.previewUrl",
+        expression,
+        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${allowedRoots.map((root) => `"${root}"`).join(", ")}`
+      }
+    ];
+  } catch (error) {
+    return [
+      {
+        path,
+        surface: "collection.admin.previewUrl",
+        expression,
+        message: `has invalid syntax: ${error.message}`
+      }
+    ];
+  }
+}
+function assertValidDeclarativeHookExpression(expression, surface, path) {
+  const issues = validateDeclarativeHookExpression(expression, surface, path);
+  if (issues.length === 0) return;
+  throw new Error(`Invalid declarative hook at ${path}: ${issues[0].message}`);
+}
+function assertValidDeclarativeHookResult(result, surface, path) {
+  if (isPlainObject(result)) return;
+  throw new Error(`Invalid declarative hook result at ${path}: ${surface} expressions must return an object`);
+}
+function collectFieldIssues(fields, path, issues) {
+  fields.forEach((field, index) => {
+    const fieldPath = `${path}.${fieldSegment(field, index)}`;
+    field.hooks?.beforeChange?.forEach((hook, hookIndex) => {
+      if (typeof hook !== "string") return;
+      issues.push(
+        ...validateDeclarativeHookExpression(
+          hook,
+          "field.beforeChange",
+          `${fieldPath}.hooks.beforeChange[${hookIndex}]`
+        )
+      );
+    });
+    field.hooks?.afterRead?.forEach((hook, hookIndex) => {
+      if (typeof hook !== "string") return;
+      issues.push({
+        path: `${fieldPath}.hooks.afterRead[${hookIndex}]`,
+        surface: "unsupported",
+        expression: hook,
+        message: "declarative strings are not supported on field hooks.afterRead"
+      });
+    });
+    if (typeof field.admin?.hooks?.onChange === "string") {
+      issues.push(
+        ...validateDeclarativeHookExpression(
+          field.admin.hooks.onChange,
+          "field.admin.onChange",
+          `${fieldPath}.admin.hooks.onChange`
+        )
+      );
+    }
+    if (typeof field.admin?.hooks?.options === "string") {
+      issues.push({
+        path: `${fieldPath}.admin.hooks.options`,
+        surface: "unsupported",
+        expression: field.admin.hooks.options,
+        message: "declarative strings are not supported on field admin.hooks.options"
+      });
+    }
+    if (Array.isArray(field.fields)) {
+      collectFieldIssues(field.fields, fieldPath, issues);
+    }
+    if (Array.isArray(field.blocks)) {
+      field.blocks.forEach((block, blockIndex) => {
+        if (!Array.isArray(block.fields)) return;
+        collectFieldIssues(block.fields, `${fieldPath}.${blockSegment(block, blockIndex)}`, issues);
+      });
+    }
+  });
+}
+function collectFieldNames(fields) {
+  return fields.flatMap(
+    (field) => typeof field.name === "string" && field.name.length > 0 ? [field.name] : []
+  );
+}
+function collectAdminConditionIssues(fields, path, rootFieldNames, issues) {
+  const scopeFieldNames = collectFieldNames(fields);
+  const allowedRoots = [.../* @__PURE__ */ new Set([...ADMIN_CONDITION_RESERVED_ROOTS, ...rootFieldNames, ...scopeFieldNames])];
+  fields.forEach((field, index) => {
+    const fieldPath = `${path}.${fieldSegment(field, index)}`;
+    if (typeof field.admin?.condition === "string") {
+      issues.push(
+        ...validateAdminConditionExpression(
+          field.admin.condition,
+          `${fieldPath}.admin.condition`,
+          allowedRoots
+        )
+      );
+    }
+    if (Array.isArray(field.fields)) {
+      collectAdminConditionIssues(field.fields, fieldPath, rootFieldNames, issues);
+    }
+    if (Array.isArray(field.blocks)) {
+      field.blocks.forEach((block, blockIndex) => {
+        if (!Array.isArray(block.fields)) return;
+        collectAdminConditionIssues(
+          block.fields,
+          `${fieldPath}.${blockSegment(block, blockIndex)}`,
+          rootFieldNames,
+          issues
+        );
+      });
+    }
+  });
+}
+function collectFieldAccessIssues(fields, path, issues) {
+  fields.forEach((field, index) => {
+    const fieldPath = `${path}.${fieldSegment(field, index)}`;
+    if (typeof field.access?.read === "string") {
+      issues.push(...validateDeclarativeAccessExpression(field.access.read, "field.access", `${fieldPath}.access.read`));
+    }
+    if (typeof field.access?.create === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(field.access.create, "field.access", `${fieldPath}.access.create`)
+      );
+    }
+    if (typeof field.access?.update === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(field.access.update, "field.access", `${fieldPath}.access.update`)
+      );
+    }
+    if (Array.isArray(field.fields)) {
+      collectFieldAccessIssues(field.fields, fieldPath, issues);
+    }
+    if (Array.isArray(field.blocks)) {
+      field.blocks.forEach((block, blockIndex) => {
+        if (!Array.isArray(block.fields)) return;
+        collectFieldAccessIssues(
+          block.fields,
+          `${fieldPath}.${blockSegment(block, blockIndex)}`,
+          issues
+        );
+      });
+    }
+  });
+}
+function collectHookIssues(hooks, scope, path, issues) {
+  if (!hooks) return;
+  const supported = {
+    beforeRead: `${scope}.beforeRead`,
+    afterRead: `${scope}.afterRead`,
+    beforeChange: `${scope}.beforeChange`
+  };
+  for (const [key, value] of Object.entries(hooks)) {
+    if (!Array.isArray(value)) continue;
+    value.forEach((hook, index) => {
+      if (typeof hook !== "string") return;
+      const surface = supported[key];
+      if (!surface) {
+        issues.push({
+          path: `${path}.${key}[${index}]`,
+          surface: "unsupported",
+          expression: hook,
+          message: `declarative strings are not supported on ${scope} hooks.${key}`
+        });
+        return;
+      }
+      issues.push(...validateDeclarativeHookExpression(hook, surface, `${path}.${key}[${index}]`));
+    });
+  }
+}
+function collectDeclarativeHookValidationIssues(config) {
+  const issues = [];
+  config.blocks?.forEach((block, blockIndex) => {
+    if (!Array.isArray(block.fields)) return;
+    collectFieldIssues(
+      block.fields,
+      blockSegment(block, blockIndex),
+      issues
+    );
+  });
+  config.collections.forEach((collection, collectionIndex) => {
+    const collectionPath = collectionSegment(collection, collectionIndex);
+    collectHookIssues(
+      collection.hooks,
+      "collection",
+      `${collectionPath}.hooks`,
+      issues
+    );
+    collectFieldIssues(collection.fields, collectionPath, issues);
+  });
+  config.globals?.forEach((global, globalIndex) => {
+    const globalPath = globalSegment(global, globalIndex);
+    collectHookIssues(
+      global.hooks,
+      "global",
+      `${globalPath}.hooks`,
+      issues
+    );
+    collectFieldIssues(global.fields, globalPath, issues);
+  });
+  return issues;
+}
+function collectDeclarativeAccessValidationIssues(config) {
+  const issues = [];
+  Object.entries(config.accessPolicies ?? {}).forEach(([name, value]) => {
+    if (typeof value !== "string") return;
+    issues.push(
+      ...validateDeclarativeAccessExpression(value, "config.accessPolicy", `accessPolicies.${name}`)
+    );
+  });
+  config.blocks?.forEach((block, blockIndex) => {
+    if (!Array.isArray(block.fields)) return;
+    collectFieldAccessIssues(
+      block.fields,
+      blockSegment(block, blockIndex),
+      issues
+    );
+  });
+  config.collections.forEach((collection, collectionIndex) => {
+    const collectionPath = collectionSegment(collection, collectionIndex);
+    if (typeof collection.access?.read === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.read,
+          "collection.access",
+          `${collectionPath}.access.read`
+        )
+      );
+    }
+    if (typeof collection.access?.create === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.create,
+          "collection.access",
+          `${collectionPath}.access.create`
+        )
+      );
+    }
+    if (typeof collection.access?.update === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.update,
+          "collection.access",
+          `${collectionPath}.access.update`
+        )
+      );
+    }
+    if (typeof collection.access?.delete === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.delete,
+          "collection.access",
+          `${collectionPath}.access.delete`
+        )
+      );
+    }
+    if (typeof collection.access?.readAudit === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          collection.access.readAudit,
+          "collection.access",
+          `${collectionPath}.access.readAudit`
+        )
+      );
+    }
+    collectFieldAccessIssues(collection.fields, collectionPath, issues);
+  });
+  config.globals?.forEach((global, globalIndex) => {
+    const globalPath = globalSegment(global, globalIndex);
+    if (typeof global.access?.read === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(global.access.read, "global.access", `${globalPath}.access.read`)
+      );
+    }
+    if (typeof global.access?.update === "string") {
+      issues.push(
+        ...validateDeclarativeAccessExpression(
+          global.access.update,
+          "global.access",
+          `${globalPath}.access.update`
+        )
+      );
+    }
+    collectFieldAccessIssues(global.fields, globalPath, issues);
+  });
+  return issues;
+}
+function collectAdminConditionValidationIssues(config) {
+  const issues = [];
+  config.blocks?.forEach((block, blockIndex) => {
+    if (!Array.isArray(block.fields)) return;
+    collectAdminConditionIssues(
+      block.fields,
+      blockSegment(block, blockIndex),
+      collectFieldNames(block.fields),
+      issues
+    );
+  });
+  config.collections.forEach((collection, collectionIndex) => {
+    const collectionPath = collectionSegment(collection, collectionIndex);
+    const rootFieldNames = collectFieldNames(collection.fields);
+    collectAdminConditionIssues(collection.fields, collectionPath, rootFieldNames, issues);
+  });
+  config.globals?.forEach((global, globalIndex) => {
+    const globalPath = globalSegment(global, globalIndex);
+    const rootFieldNames = collectFieldNames(global.fields);
+    collectAdminConditionIssues(global.fields, globalPath, rootFieldNames, issues);
+  });
+  return issues;
+}
+function collectPreviewUrlValidationIssues(config) {
+  const issues = [];
+  config.collections.forEach((collection, collectionIndex) => {
+    if (typeof collection.admin?.previewUrl !== "string") return;
+    const collectionPath = collectionSegment(collection, collectionIndex);
+    const allowedRoots = [
+      .../* @__PURE__ */ new Set([...PREVIEW_URL_RESERVED_ROOTS, ...collectFieldNames(collection.fields)])
+    ];
+    issues.push(
+      ...validatePreviewUrlExpression(
+        collection.admin.previewUrl,
+        `${collectionPath}.admin.previewUrl`,
+        allowedRoots
+      )
+    );
+  });
+  return issues;
+}
+function assertValidAdminConditionsInConfig(config, source = "config") {
+  const diagnostics = collectAdminConditionValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "adminCondition",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  if (diagnostics.length === 0) return;
+  throw new ConfigValidationError(source, diagnostics);
+}
+function assertValidPreviewUrlsInConfig(config, source = "config") {
+  const diagnostics = collectPreviewUrlValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "previewUrl",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  if (diagnostics.length === 0) return;
+  throw new ConfigValidationError(source, diagnostics);
+}
+function collectConfigDiagnostics(config) {
+  const hookIssues = collectDeclarativeHookValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "declarativeHook",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  const accessIssues = collectDeclarativeAccessValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "declarativeAccess",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  const adminConditionIssues = collectAdminConditionValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "adminCondition",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  const previewUrlIssues = collectPreviewUrlValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "previewUrl",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  return [...hookIssues, ...accessIssues, ...adminConditionIssues, ...previewUrlIssues];
+}
+function formatConfigDiagnostics(source, diagnostics, options = {}) {
+  const color = options.color ?? false;
+  const header = `${colorize("Config validation failed", 31, color)} in ${colorize(source, 36, color)}`;
+  const docLink = `${colorize("   Learn how to write declarative rules:", 90, color)} ${colorize("https://docs.dyrected.com/docs/features/admin/form-and-field-hooks", 34, color)}`;
+  const lines = diagnostics.flatMap((issue, index) => [
+    `${colorize(`${index + 1}.`, 31, color)} ${colorize(issue.path, 1, color)}`,
+    `   ${issue.message}`,
+    `   ${colorize("surface:", 90, color)} ${issue.surface}`
+  ]);
+  return `${header}
+${lines.join("\n")}
+
+${docLink}`;
+}
+var ConfigValidationError = class extends Error {
+  diagnostics;
+  source;
+  constructor(source, diagnostics) {
+    super(formatConfigDiagnostics(source, diagnostics));
+    this.name = "ConfigValidationError";
+    this.source = source;
+    this.diagnostics = diagnostics;
+  }
+};
+function isConfigValidationError(error) {
+  return error instanceof ConfigValidationError;
+}
+function assertValidDeclarativeHooksInConfig(config, source = "config") {
+  const diagnostics = collectDeclarativeHookValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "declarativeHook",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  if (diagnostics.length === 0) return;
+  throw new ConfigValidationError(source, diagnostics);
+}
+function assertValidDeclarativeAccessInConfig(config, source = "config") {
+  const diagnostics = collectDeclarativeAccessValidationIssues(config).map((issue) => ({
+    severity: "error",
+    source: "declarativeAccess",
+    path: issue.path,
+    surface: issue.surface,
+    message: issue.message,
+    expression: issue.expression
+  }));
+  if (diagnostics.length === 0) return;
+  throw new ConfigValidationError(source, diagnostics);
+}
+
+// src/auth/token.ts
+import { SignJWT, jwtVerify, decodeJwt } from "jose";
+import { TextEncoder } from "util";
+function getSecret() {
+  const secret = process.env.DYRECTED_JWT_SECRET;
+  if (!secret) {
+    throw new Error(
+      "[dyrected/core] DYRECTED_JWT_SECRET is not set. Add it to your environment variables to enable auth collections."
+    );
+  }
+  return new TextEncoder().encode(secret);
+}
+var DEFAULT_EXPIRY = "7d";
+async function signCollectionToken(payload, expiresIn = DEFAULT_EXPIRY) {
+  return new SignJWT({ ...payload }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(expiresIn).sign(getSecret());
+}
+async function verifyCollectionToken(token) {
+  const { payload } = await jwtVerify(token, getSecret());
+  return payload;
+}
+function decodeCollectionToken(token) {
+  try {
+    return decodeJwt(token);
+  } catch {
+    return null;
+  }
+}
+
+// src/auth/sessions.ts
+var AUTH_SESSIONS_COLLECTION = "__auth_sessions";
+async function issueAuthSessionToken(args) {
+  const sessionId = createSessionId();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const db = args.config.db;
+  if (db) {
+    await db.create({
+      collection: AUTH_SESSIONS_COLLECTION,
+      data: {
+        id: sessionId,
+        userId: args.userId,
+        email: args.email,
+        collection: args.collection,
+        authSource: args.authSource ?? "local",
+        providerId: args.providerId,
+        lastIp: args.ip,
+        lastSeenAt: now,
+        revokedAt: null,
+        expiresAt: null
+      }
+    });
+  }
+  const token = await signCollectionToken(
+    {
+      sub: args.userId,
+      email: args.email,
+      collection: args.collection,
+      authSource: args.authSource,
+      providerId: args.providerId,
+      sid: sessionId
+    },
+    args.expiresIn
+  );
+  const payload = decodeCollectionToken(token);
+  const expiresAt = payload?.exp != null ? new Date(payload.exp * 1e3).toISOString() : null;
+  if (db && expiresAt) {
+    await db.update({
+      collection: AUTH_SESSIONS_COLLECTION,
+      id: sessionId,
+      data: {
+        expiresAt,
+        lastSeenAt: now,
+        lastIp: args.ip
+      }
+    });
+  }
+  return token;
+}
+async function getAuthSession(config, sessionId) {
+  const db = config.db;
+  if (!db) return null;
+  return await db.findOne({
+    collection: AUTH_SESSIONS_COLLECTION,
+    id: sessionId
+  });
+}
+function isAuthSessionActive(session) {
+  if (!session) return false;
+  if (session.revokedAt) return false;
+  if (session.expiresAt && new Date(session.expiresAt).getTime() <= Date.now()) {
+    return false;
+  }
+  return true;
+}
+async function touchAuthSession(config, sessionId, args) {
+  const db = config.db;
+  if (!db) return;
+  await db.update({
+    collection: AUTH_SESSIONS_COLLECTION,
+    id: sessionId,
+    data: {
+      lastSeenAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...args.ip ? { lastIp: args.ip } : {}
+    }
+  });
+}
+async function revokeAuthSession(config, sessionId) {
+  const db = config.db;
+  if (!db) return;
+  await db.update({
+    collection: AUTH_SESSIONS_COLLECTION,
+    id: sessionId,
+    data: {
+      revokedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  });
+}
+async function revokeAllAuthSessions(config, args) {
+  const db = config.db;
+  if (!db) return 0;
+  let page = 1;
+  let revoked = 0;
+  while (true) {
+    const result = await db.find({
+      collection: AUTH_SESSIONS_COLLECTION,
+      where: {
+        userId: { equals: args.userId },
+        collection: { equals: args.collection }
+      },
+      page,
+      limit: 100
+    });
+    for (const session of result.docs) {
+      if (session.revokedAt) continue;
+      await revokeAuthSession(config, session.id);
+      revoked += 1;
+    }
+    if (!result.hasNextPage) break;
+    page += 1;
+  }
+  return revoked;
+}
+function createSessionId() {
+  return globalThis.crypto?.randomUUID?.() ? globalThis.crypto.randomUUID() : `sess_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+}
+
+// src/utils/block-references.ts
+function mergeUniqueBlocks(blocks) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const block of blocks) {
+    const existing = seen.get(block.slug);
+    if (existing && existing !== block) {
+      throw new Error(
+        `Duplicate block slug "${block.slug}" found in the reusable block registry. Block slugs must be unique.`
+      );
+    }
+    if (!existing) seen.set(block.slug, block);
+  }
+  return Array.from(seen.values());
+}
+function buildRegistry(blocks) {
+  return new Map(blocks.map((block) => [block.slug, block]));
+}
+function resolveField(field, registry, blockCache) {
+  const next = { ...field };
+  if (next.fields) {
+    next.fields = next.fields.map(
+      (child) => resolveField(child, registry, blockCache)
+    );
+  }
+  if (next.type !== "blocks") return next;
+  const hasInlineBlocks = Array.isArray(next.blocks) && next.blocks.length > 0;
+  const hasReferences = Array.isArray(next.blockReferences) && next.blockReferences.length > 0;
+  if (hasInlineBlocks && hasReferences) {
+    throw new Error(
+      `Blocks field "${next.name ?? "(unnamed)"}" cannot define both "blocks" and "blockReferences". Use one or the other.`
+    );
+  }
+  if (hasReferences) {
+    next.blocks = next.blockReferences.map((slug) => {
+      const block = registry.get(slug);
+      if (!block) {
+        throw new Error(
+          `Unknown block reference "${slug}" on blocks field "${next.name ?? "(unnamed)"}". Add it to defineConfig({ blocks: [...] }).`
+        );
+      }
+      return resolveBlock(block, registry, blockCache);
+    });
+    return next;
+  }
+  if (hasInlineBlocks) {
+    next.blocks = next.blocks.map(
+      (block) => resolveBlock(block, registry, blockCache)
+    );
+  }
+  return next;
+}
+function resolveBlock(block, registry, blockCache) {
+  const cached = blockCache.get(block);
+  if (cached) return cached;
+  const resolved = {
+    ...block,
+    fields: []
+  };
+  blockCache.set(block, resolved);
+  resolved.fields = block.fields.map(
+    (field) => resolveField(field, registry, blockCache)
+  );
+  return resolved;
+}
+function resolveFields(fields, registry, blockCache) {
+  return fields.map((field) => resolveField(field, registry, blockCache));
+}
+function normalizeSchemaFragment(fragment) {
+  const reusableBlocks = mergeUniqueBlocks(fragment.blocks ?? []);
+  const registry = buildRegistry(reusableBlocks);
+  const blockCache = /* @__PURE__ */ new WeakMap();
+  const resolvedBlocks = reusableBlocks.map(
+    (block) => resolveBlock(block, registry, blockCache)
+  );
+  const resolvedCollections = (fragment.collections ?? []).map(
+    (collection) => ({
+      ...collection,
+      fields: resolveFields(collection.fields ?? [], registry, blockCache)
+    })
+  );
+  const resolvedGlobals = (fragment.globals ?? []).map((global) => ({
+    ...global,
+    fields: resolveFields(global.fields ?? [], registry, blockCache)
+  }));
+  return {
+    ...fragment,
+    ...fragment.blocks ? { blocks: resolvedBlocks } : {},
+    ...fragment.collections ? { collections: resolvedCollections } : {},
+    ...fragment.globals ? { globals: resolvedGlobals } : {}
+  };
+}
+function mergeDynamicConfig(baseConfig, dynamic) {
+  const normalizedDynamic = normalizeSchemaFragment({
+    ...dynamic,
+    blocks: [...baseConfig.blocks ?? [], ...dynamic.blocks ?? []]
+  });
+  return {
+    ...baseConfig,
+    ...normalizedDynamic.blocks ? { blocks: normalizedDynamic.blocks } : {},
+    ...dynamic.accessPolicies ? {
+      accessPolicies: {
+        ...baseConfig.accessPolicies ?? {},
+        ...dynamic.accessPolicies
+      }
+    } : {},
+    ...dynamic.admin ? { admin: { ...baseConfig.admin, ...dynamic.admin } } : {},
+    ...dynamic.adminAuth ? { adminAuth: { ...baseConfig.adminAuth, ...dynamic.adminAuth } } : {},
+    collections: normalizedDynamic.collections ? [...baseConfig.collections, ...normalizedDynamic.collections] : baseConfig.collections,
+    globals: normalizedDynamic.globals ? [...baseConfig.globals, ...normalizedDynamic.globals] : baseConfig.globals
+  };
+}
+
+// src/utils/config.ts
+var AUDIT_COLLECTION_SLUG = "__audit";
+var SYSTEM_FIELDS = [
+  {
+    name: "createdAt",
+    type: "date",
+    label: "Created At",
+    admin: { readOnly: true, hidden: true }
+  },
+  {
+    name: "updatedAt",
+    type: "date",
+    label: "Updated At",
+    admin: { readOnly: true, hidden: true }
+  },
+  {
+    name: "createdBy",
+    type: "text",
+    label: "Created By",
+    admin: { readOnly: true, hidden: true }
+  },
+  {
+    name: "updatedBy",
+    type: "text",
+    label: "Updated By",
+    admin: { readOnly: true, hidden: true }
+  }
+];
+var AUDIT_COLLECTION = {
+  slug: AUDIT_COLLECTION_SLUG,
+  labels: { singular: "Audit Log", plural: "Audit Logs" },
+  fields: [
+    { name: "collection", type: "text", label: "Collection", required: true },
+    { name: "documentId", type: "text", label: "Document ID" },
+    {
+      name: "operation",
+      type: "select",
+      label: "Operation",
+      options: ["create", "update", "delete"],
+      required: true
+    },
+    { name: "user", type: "text", label: "User ID" },
+    { name: "timestamp", type: "date", label: "Timestamp", required: true },
+    { name: "changes", type: "json", label: "Changes" }
+  ],
+  access: {
+    read: () => false,
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
+  admin: { hidden: true }
+};
+var WORKFLOW_HISTORY_COLLECTION_CONFIG = {
+  slug: WORKFLOW_HISTORY_COLLECTION,
+  labels: { singular: "Workflow transition", plural: "Workflow transitions" },
+  fields: [
+    { name: "collection", type: "text", required: true },
+    { name: "documentId", type: "text", required: true },
+    { name: "transition", type: "text", required: true },
+    { name: "from", type: "text", required: true },
+    { name: "to", type: "text", required: true },
+    { name: "revision", type: "number", required: true },
+    { name: "comment", type: "textarea" },
+    { name: "actorId", type: "text" },
+    { name: "createdAt", type: "date", required: true }
+  ],
+  access: {
+    read: ({ user }) => !!user,
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
+  admin: { hidden: true }
+};
+var LIFECYCLE_EVENTS_COLLECTION_CONFIG = {
+  slug: LIFECYCLE_EVENTS_COLLECTION,
+  labels: { singular: "Lifecycle event", plural: "Lifecycle events" },
+  fields: [
+    { name: "name", type: "text", required: true },
+    { name: "collection", type: "text", required: true },
+    { name: "documentId", type: "text", required: true },
+    { name: "occurredAt", type: "date", required: true },
+    { name: "actorId", type: "text" },
+    { name: "payload", type: "json", required: true },
+    { name: "attempts", type: "number", required: true },
+    {
+      name: "status",
+      type: "select",
+      options: ["pending", "processing", "delivered", "failed"],
+      required: true
+    },
+    { name: "nextAttemptAt", type: "date" },
+    { name: "deliveredAt", type: "date" },
+    { name: "lastError", type: "textarea" }
+  ],
+  access: {
+    read: ({ user }) => !!user?.roles?.includes("admin"),
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
+  admin: { hidden: true }
+};
+var AUTH_SESSIONS_COLLECTION_CONFIG = {
+  slug: AUTH_SESSIONS_COLLECTION,
+  labels: { singular: "Auth session", plural: "Auth sessions" },
+  fields: [
+    { name: "userId", type: "text", required: true },
+    { name: "email", type: "email", required: true },
+    { name: "collection", type: "text", required: true },
+    { name: "authSource", type: "text" },
+    { name: "providerId", type: "text" },
+    { name: "lastIp", type: "text" },
+    { name: "lastSeenAt", type: "date" },
+    { name: "expiresAt", type: "date" },
+    { name: "revokedAt", type: "date" }
+  ],
+  access: {
+    read: () => false,
+    create: () => false,
+    update: () => false,
+    delete: () => false
+  },
+  admin: { hidden: true }
+};
+function normalizeConfig(config) {
+  const schemaAwareConfig = normalizeSchemaFragment(config);
+  assertValidDeclarativeHooksInConfig(schemaAwareConfig, "config");
+  assertValidDeclarativeAccessInConfig(schemaAwareConfig, "config");
+  assertValidAdminConditionsInConfig(schemaAwareConfig, "config");
+  assertValidPreviewUrlsInConfig(schemaAwareConfig, "config");
+  const collections = schemaAwareConfig?.collections || [];
+  const globals = schemaAwareConfig?.globals || [];
+  const needsAudit = collections.some((col) => col.audit);
+  const needsWorkflow = collections.some((col) => col.workflow || col.drafts);
+  const needsAuthSessions = collections.some((col) => !!col.auth);
+  const adminAuthCollectionSlug = getAdminAuthCollection({
+    collections,
+    adminAuth: schemaAwareConfig.adminAuth
+  })?.slug;
+  const normalizedCollections = collections.map((col) => {
+    let fields = col.fields || [];
+    const existingFieldNames = new Set(fields.map((f) => f.name));
+    if (col.auth) {
+      if (!existingFieldNames.has("email")) {
+        fields = [
+          ...fields,
+          {
+            name: "email",
+            type: "email",
+            label: "Email",
+            required: true,
+            unique: true,
+            promoted: true,
+            access: {
+              update: "!id"
+            }
+          }
+        ];
+      }
+      if (!existingFieldNames.has("password")) {
+        fields = [
+          ...fields,
+          {
+            name: "password",
+            type: "text",
+            label: "Password",
+            required: true,
+            access: {
+              update: "!id || user.id == id"
+            }
+          }
+        ];
+      }
+      if (!existingFieldNames.has("roles")) {
+        fields = [
+          ...fields,
+          {
+            name: "roles",
+            type: "select",
+            label: "Roles",
+            defaultValue: [],
+            options: [
+              { value: "admin", label: "Admin" },
+              { value: "editor", label: "Editor" },
+              { value: "viewer", label: "Viewer" }
+            ],
+            access: {
+              update: "user.roles && 'admin' in user.roles"
+            }
+          }
+        ];
+      }
+      if (!existingFieldNames.has("status")) {
+        fields = [
+          ...fields,
+          {
+            name: "status",
+            type: "select",
+            label: "Status",
+            defaultValue: "active",
+            options: [
+              { value: "active", label: "Active" },
+              { value: "pending", label: "Pending" }
+            ],
+            access: {
+              update: "user.roles && 'admin' in user.roles && user.id != id"
+            },
+            admin: {
+              condition: `!(data.roles && "admin" in data.roles)`
+            }
+          }
+        ];
+      }
+      fields = fields.map((field) => {
+        if (field.name === "email") {
+          return {
+            ...field,
+            // Email is the login identifier. Keep the integrity constraints
+            // auth relies on even when the field is explicitly redefined, so a
+            // custom `email` field can never silently drop uniqueness.
+            required: true,
+            unique: true,
+            promoted: true,
+            access: {
+              ...field.access || {},
+              update: "!id"
+            }
+          };
+        }
+        if (field.name === "password") {
+          return {
+            ...field,
+            // Password is required to authenticate; enforce it regardless of
+            // how the field was declared.
+            required: true,
+            admin: { ...field.admin || {} },
+            access: {
+              ...field.access || {},
+              update: "!id || user.id == id"
+            }
+          };
+        }
+        if (field.name === "roles") {
+          return {
+            ...field,
+            access: {
+              ...field.access || {},
+              // Must be an admin; cannot edit own roles (no self-elevation).
+              update: "user.roles && 'admin' in user.roles && user.id != id"
+            }
+          };
+        }
+        if (field.name === "status") {
+          return {
+            ...field,
+            access: {
+              ...field.access || {},
+              update: "user.roles && 'admin' in user.roles && user.id != id"
+            }
+          };
+        }
+        return field;
+      });
+    }
+    if (adminAuthCollectionSlug && col.slug === adminAuthCollectionSlug && schemaAwareConfig.adminAuth?.mode === "external") {
+      const externalAdminFields = [
+        {
+          name: "authProvider",
+          type: "text",
+          label: "Auth Provider",
+          admin: { readOnly: true, hidden: true }
+        },
+        {
+          name: "externalSubject",
+          type: "text",
+          label: "External Subject",
+          admin: { readOnly: true, hidden: true }
+        },
+        {
+          name: "authSource",
+          type: "text",
+          label: "Auth Source",
+          admin: { readOnly: true, hidden: true }
+        },
+        {
+          name: "lastLoginAt",
+          type: "date",
+          label: "Last Login At",
+          admin: { readOnly: true, hidden: true }
+        }
+      ];
+      for (const field of externalAdminFields) {
+        if (!existingFieldNames.has(field.name)) {
+          fields = [...fields, field];
+        }
+      }
+    }
+    const updatedFieldNames = new Set(fields.map((f) => f.name));
+    const fieldsToInject = SYSTEM_FIELDS.filter((f) => !updatedFieldNames.has(f.name));
+    const workflow = col.workflow || (col.drafts ? simplePublishingWorkflow() : void 0);
+    return {
+      ...col,
+      workflow,
+      fields: [...fields, ...fieldsToInject]
+    };
+  });
+  const hasAuditCollection = normalizedCollections.some((col) => col.slug === AUDIT_COLLECTION_SLUG);
+  const systemCollections = [];
+  if (needsAudit && !hasAuditCollection) systemCollections.push(AUDIT_COLLECTION);
+  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === WORKFLOW_HISTORY_COLLECTION)) {
+    systemCollections.push(WORKFLOW_HISTORY_COLLECTION_CONFIG);
+  }
+  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === LIFECYCLE_EVENTS_COLLECTION)) {
+    systemCollections.push(LIFECYCLE_EVENTS_COLLECTION_CONFIG);
+  }
+  if (needsAuthSessions && !normalizedCollections.some((col) => col.slug === AUTH_SESSIONS_COLLECTION)) {
+    systemCollections.push(AUTH_SESSIONS_COLLECTION_CONFIG);
+  }
+  return {
+    ...schemaAwareConfig,
+    collections: [...normalizedCollections, ...systemCollections],
+    globals
+  };
+}
+
+// src/utils/hooks.ts
+import jexl3 from "jexl";
+async function runCollectionHooks(hooks, args, options = {}) {
+  if (!hooks || hooks.length === 0) {
+    return args.data ?? args.doc ?? args.query ?? void 0;
+  }
+  const payloadKey = args.data !== void 0 ? "data" : args.doc !== void 0 ? "doc" : "query" in args ? "query" : void 0;
+  let currentPayload = payloadKey === void 0 ? void 0 : args[payloadKey];
+  for (const hook of hooks) {
+    try {
+      const hookArgs = {
+        ...args,
+        ...payloadKey !== void 0 ? { [payloadKey]: currentPayload } : {}
+      };
+      const result = typeof hook === "string" ? await (() => {
+        if (options.surface) {
+          assertValidDeclarativeHookExpression(
+            hook,
+            options.surface,
+            options.path ?? options.surface
+          );
+        }
+        return jexl3.eval(hook, hookArgs);
+      })() : await hook(hookArgs);
+      if (result !== void 0) {
+        if (typeof hook === "string" && options.surface) {
+          assertValidDeclarativeHookResult(
+            result,
+            options.surface,
+            options.path ?? options.surface
+          );
+        }
+        currentPayload = typeof hook === "string" && currentPayload && typeof currentPayload === "object" && !Array.isArray(currentPayload) && result && typeof result === "object" && !Array.isArray(result) ? {
+          ...currentPayload,
+          ...result
+        } : result;
+      }
+    } catch (err) {
+      if (options.isolated) {
+        getConfigLogger(void 0, "hooks").error({
+          err,
+          msg: "Side-effect hook failed after a successful write"
+        });
+      } else {
+        throw err;
+      }
+    }
+  }
+  return currentPayload;
+}
+async function executeFieldBeforeChange(fields, data, originalDoc, user, db, pathPrefix = "") {
+  if (!data || typeof data !== "object") return data;
+  const result = { ...data };
+  for (const field of fields) {
+    if (!field.name) continue;
+    const fieldPath = pathPrefix ? `${pathPrefix}.${field.name}` : field.name;
+    const value = result[field.name];
+    const origValue = originalDoc?.[field.name];
+    let updatedValue = value;
+    if (field.hooks?.beforeChange) {
+      for (const hook of field.hooks.beforeChange) {
+        const hookArgs = {
+          value: updatedValue,
+          originalDoc: originalDoc ?? void 0,
+          data: result,
+          user,
+          db
+        };
+        updatedValue = typeof hook === "string" ? await (() => {
+          assertValidDeclarativeHookExpression(
+            hook,
+            "field.beforeChange",
+            fieldPath
+          );
+          return jexl3.eval(hook, hookArgs);
+        })() : await hook(hookArgs);
+      }
+      result[field.name] = updatedValue;
+    }
+    if (updatedValue !== void 0 && updatedValue !== null) {
+      if (field.type === "object" && field.fields) {
+        result[field.name] = await executeFieldBeforeChange(
+          field.fields,
+          updatedValue,
+          origValue,
+          user,
+          db,
+          fieldPath
+        );
+      } else if (field.type === "array" && field.fields && Array.isArray(updatedValue)) {
+        const arrayResult = [];
+        for (let i = 0; i < updatedValue.length; i++) {
+          const item = updatedValue[i];
+          const origItem = Array.isArray(origValue) ? origValue[i] : null;
+          arrayResult.push(
+            await executeFieldBeforeChange(
+              field.fields,
+              item,
+              origItem,
+              user,
+              db,
+              fieldPath
+            )
+          );
+        }
+        result[field.name] = arrayResult;
+      } else if (field.type === "blocks" && field.blocks && Array.isArray(updatedValue)) {
+        const blocksResult = [];
+        for (let i = 0; i < updatedValue.length; i++) {
+          const blockData = updatedValue[i];
+          const origBlock = Array.isArray(origValue) ? origValue[i] : null;
+          const blockConfig = field.blocks.find(
+            (b) => b.slug === blockData.blockType
+          );
+          if (blockConfig) {
+            blocksResult.push(
+              await executeFieldBeforeChange(
+                blockConfig.fields,
+                blockData,
+                origBlock,
+                user,
+                db,
+                fieldPath
+              )
+            );
+          } else {
+            blocksResult.push(blockData);
+          }
+        }
+        result[field.name] = blocksResult;
+      }
+    }
+  }
+  return result;
+}
+async function executeFieldAfterRead(fields, doc, user, db) {
+  if (!doc || typeof doc !== "object") return doc;
+  const result = { ...doc };
+  for (const field of fields) {
+    if (!field.name) continue;
+    const value = result[field.name];
+    let updatedValue = value;
+    if (field.hooks?.afterRead) {
+      for (const hook of field.hooks.afterRead) {
+        const typedHook = hook;
+        const hookArgs = {
+          value: updatedValue,
+          doc: result,
+          user,
+          db
+        };
+        updatedValue = await typedHook(hookArgs);
+      }
+      result[field.name] = updatedValue;
+    }
+    if (updatedValue !== void 0 && updatedValue !== null) {
+      if (field.type === "object" && field.fields) {
+        result[field.name] = await executeFieldAfterRead(
+          field.fields,
+          updatedValue,
+          user,
+          db
+        );
+      } else if (field.type === "array" && field.fields && Array.isArray(updatedValue)) {
+        const arrayResult = [];
+        for (const item of updatedValue) {
+          arrayResult.push(
+            await executeFieldAfterRead(
+              field.fields,
+              item,
+              user,
+              db
+            )
+          );
+        }
+        result[field.name] = arrayResult;
+      } else if (field.type === "blocks" && field.blocks && Array.isArray(updatedValue)) {
+        const blocksResult = [];
+        for (const blockData of updatedValue) {
+          const typedBlock = blockData;
+          const blockConfig = field.blocks.find(
+            (b) => b.slug === typedBlock.blockType
+          );
+          if (blockConfig) {
+            blocksResult.push(
+              await executeFieldAfterRead(
+                blockConfig.fields,
+                typedBlock,
+                user,
+                db
+              )
+            );
+          } else {
+            blocksResult.push(blockData);
+          }
+        }
+        result[field.name] = blocksResult;
+      }
+    }
+  }
+  return result;
+}
+
+// src/utils/openapi.ts
+function getCollectionLabels(collection) {
+  return collection.labels || { singular: collection.slug, plural: collection.slug };
+}
+function getCollectionTag(collection) {
+  return `Collection: ${getCollectionLabels(collection).plural}`;
+}
+function getGlobalTag(global) {
+  return `Global: ${global.label || global.slug}`;
+}
+function generateOpenApi(config) {
+  const spec = {
+    openapi: "3.0.0",
+    info: {
+      title: "Dyrected API",
+      version: "1.0.0",
+      description: "Automatically generated OpenAPI specification for the Dyrected project."
+    },
+    components: {
+      schemas: {
+        WorkflowMetadata: {
+          type: "object",
+          required: ["state", "revision"],
+          properties: {
+            state: { type: "string" },
+            revision: { type: "integer", minimum: 1 },
+            publishedRevision: { type: "integer", minimum: 1 },
+            publishedAt: { type: "string", format: "date-time" },
+            publishedBy: { type: "string" },
+            availableTransitions: { type: "array", items: { type: "string" } }
+          }
+        },
+        WorkflowTransitionRequest: {
+          type: "object",
+          properties: {
+            expectedRevision: { type: "integer", minimum: 1 },
+            comment: { type: "string" }
+          }
+        },
+        WorkflowHistoryEntry: {
+          type: "object",
+          required: [
+            "collection",
+            "documentId",
+            "transition",
+            "from",
+            "to",
+            "revision",
+            "createdAt"
+          ],
+          properties: {
+            id: { type: "string" },
+            collection: { type: "string" },
+            documentId: { type: "string" },
+            transition: { type: "string" },
+            from: { type: "string" },
+            to: { type: "string" },
+            revision: { type: "integer" },
+            comment: { type: "string", nullable: true },
+            actorId: { type: "string", nullable: true },
+            createdAt: { type: "string", format: "date-time" }
+          }
+        },
+        AuditEntry: {
+          type: "object",
+          required: ["collection", "operation", "timestamp"],
+          properties: {
+            id: { type: "string" },
+            collection: { type: "string" },
+            documentId: { type: "string", nullable: true },
+            operation: { type: "string" },
+            user: { type: "string", nullable: true },
+            timestamp: { type: "string", format: "date-time" },
+            changes: {
+              oneOf: [
+                { type: "string" },
+                { type: "object", additionalProperties: true },
+                { type: "null" }
+              ]
+            }
+          }
+        },
+        Error: {
+          type: "object",
+          properties: {
+            message: { type: "string" },
+            errors: {
+              type: "array",
+              items: { type: "object", additionalProperties: true }
+            }
+          }
+        },
+        AuthCredentials: {
+          type: "object",
+          required: ["email", "password"],
+          properties: {
+            email: { type: "string", format: "email" },
+            password: { type: "string" }
+          }
+        },
+        TokenResponse: {
+          type: "object",
+          properties: {
+            token: { type: "string" },
+            user: { type: "object", additionalProperties: true }
+          }
+        }
+      },
+      securitySchemes: {
+        ApiKeyAuth: {
+          type: "apiKey",
+          in: "header",
+          name: "x-api-key"
+        }
+      }
+    },
+    paths: {},
+    security: [{ ApiKeyAuth: [] }]
+  };
+  spec.paths["/api/schemas"] = {
+    get: {
+      tags: ["System"],
+      summary: "Get the serialized Dyrected schema",
+      security: [],
+      responses: {
+        200: { description: "Collection and global schema definitions" }
+      }
+    }
+  };
+  spec.paths["/api/openapi.json"] = {
+    get: {
+      tags: ["System"],
+      summary: "Get the OpenAPI specification",
+      security: [],
+      responses: { 200: { description: "OpenAPI 3.0 document" } }
+    }
+  };
+  spec.paths["/api/docs"] = {
+    get: {
+      tags: ["System"],
+      summary: "Open interactive API documentation",
+      security: [],
+      responses: { 200: { description: "Swagger UI HTML" } }
+    }
+  };
+  spec.paths["/api/dyrected/options/{collection}/{field}"] = {
+    get: {
+      tags: ["System"],
+      summary: "Resolve dynamic field options",
+      parameters: [
+        {
+          name: "collection",
+          in: "path",
+          required: true,
+          schema: { type: "string" }
+        },
+        {
+          name: "field",
+          in: "path",
+          required: true,
+          schema: { type: "string" }
+        }
+      ],
+      responses: { 200: { description: "Resolved option items" } }
+    }
+  };
+  spec.paths["/api/preferences/{key}"] = {
+    get: {
+      tags: ["Preferences"],
+      summary: "Get an authenticated user preference",
+      parameters: [
+        { name: "key", in: "path", required: true, schema: { type: "string" } }
+      ],
+      responses: { 200: { description: "Preference value" } }
+    },
+    put: {
+      tags: ["Preferences"],
+      summary: "Set an authenticated user preference",
+      parameters: [
+        { name: "key", in: "path", required: true, schema: { type: "string" } }
+      ],
+      requestBody: {
+        required: true,
+        content: { "application/json": { schema: { type: "object" } } }
+      },
+      responses: { 200: { description: "Updated preference" } }
+    }
+  };
+  spec.paths["/api/preview-token"] = {
+    post: {
+      tags: ["Preview"],
+      summary: "Create a preview token",
+      responses: { 200: { description: "Short-lived preview token" } }
+    }
+  };
+  spec.paths["/api/preview-data"] = {
+    get: {
+      tags: ["Preview"],
+      summary: "Resolve preview data from a token",
+      security: [],
+      parameters: [
+        {
+          name: "token",
+          in: "query",
+          required: true,
+          schema: { type: "string" }
+        }
+      ],
+      responses: { 200: { description: "Preview document data" } }
+    }
+  };
+  spec.paths["/api/audit"] = {
+    get: {
+      tags: ["Audit"],
+      summary: "Get audit entries across all readable audited collections",
+      parameters: [
+        {
+          name: "limit",
+          in: "query",
+          schema: { type: "integer", default: 50, maximum: 100 }
+        },
+        { name: "page", in: "query", schema: { type: "integer", default: 1 } },
+        {
+          name: "where",
+          in: "query",
+          schema: { type: "string" },
+          description: "JSON filter"
+        },
+        {
+          name: "sort",
+          in: "query",
+          schema: { type: "string", default: "-timestamp" }
+        }
+      ],
+      responses: {
+        200: {
+          description: "Audit entries",
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                properties: {
+                  docs: {
+                    type: "array",
+                    items: { $ref: "#/components/schemas/AuditEntry" }
+                  },
+                  total: { type: "integer" },
+                  limit: { type: "integer" },
+                  page: { type: "integer" }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  };
+  for (const collection of config.collections) {
+    spec.components.schemas[collection.slug] = collectionToSchema(collection);
+  }
+  for (const global of config.globals) {
+    spec.components.schemas[global.slug] = globalToSchema(global);
+  }
+  for (const collection of config.collections) {
+    const slug = collection.slug;
+    const path = `/api/collections/${slug}`;
+    const labels = getCollectionLabels(collection);
+    const collectionTag = getCollectionTag(collection);
+    spec.paths[path] = {
+      get: {
+        tags: [collectionTag],
+        summary: `Find ${labels.plural}`,
+        parameters: [
+          {
+            name: "limit",
+            in: "query",
+            schema: { type: "integer", default: 10 }
+          },
+          {
+            name: "page",
+            in: "query",
+            schema: { type: "integer", default: 1 }
+          },
+          {
+            name: "where",
+            in: "query",
+            schema: { type: "string" },
+            description: "JSON filter"
+          },
+          {
+            name: "search",
+            in: "query",
+            schema: { type: "string" },
+            description: "Free-text search across configured searchable fields"
+          },
+          {
+            name: "sort",
+            in: "query",
+            schema: { type: "string" },
+            description: "Sort field (e.g. -createdAt)"
+          }
+        ],
+        responses: {
+          200: {
+            description: "Success",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    docs: {
+                      type: "array",
+                      items: { $ref: `#/components/schemas/${slug}` }
+                    },
+                    total: { type: "integer" },
+                    limit: { type: "integer" },
+                    page: { type: "integer" }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      post: {
+        tags: [collectionTag],
+        summary: `Create ${labels.singular}`,
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: { $ref: `#/components/schemas/${slug}` }
+            }
+          }
+        },
+        responses: {
+          201: {
+            description: "Created",
+            content: {
+              "application/json": {
+                schema: { $ref: `#/components/schemas/${slug}` }
+              }
+            }
+          }
+        }
+      }
+    };
+    spec.paths[`${path}/{id}`] = {
+      get: {
+        tags: [collectionTag],
+        summary: `Get a single ${labels.singular}`,
+        parameters: [
+          {
+            name: "id",
+            in: "path",
+            required: true,
+            schema: { type: "string" }
+          }
+        ],
+        responses: {
+          200: {
+            description: "Success",
+            content: {
+              "application/json": {
+                schema: { $ref: `#/components/schemas/${slug}` }
+              }
+            }
+          }
+        }
+      },
+      patch: {
+        tags: [collectionTag],
+        summary: `Update ${labels.singular}`,
+        parameters: [
+          {
+            name: "id",
+            in: "path",
+            required: true,
+            schema: { type: "string" }
+          }
+        ],
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: { $ref: `#/components/schemas/${slug}` }
+            }
+          }
+        },
+        responses: {
+          200: {
+            description: "Updated",
+            content: {
+              "application/json": {
+                schema: { $ref: `#/components/schemas/${slug}` }
+              }
+            }
+          }
+        }
+      },
+      delete: {
+        tags: [collectionTag],
+        summary: `Delete ${labels.singular}`,
+        parameters: [
+          {
+            name: "id",
+            in: "path",
+            required: true,
+            schema: { type: "string" }
+          }
+        ],
+        responses: {
+          204: { description: "Deleted" }
+        }
+      }
+    };
+    spec.paths[`${path}/delete-many`] = {
+      delete: {
+        tags: [collectionTag],
+        summary: `Delete multiple ${labels.plural}`,
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                required: ["ids"],
+                properties: {
+                  ids: { type: "array", items: { type: "string" } }
+                }
+              }
+            }
+          }
+        },
+        responses: { 200: { description: "Deleted and failed document IDs" } }
+      }
+    };
+    if (collection.audit) {
+      spec.paths[`${path}/__audit`] = {
+        get: {
+          tags: [collectionTag],
+          summary: `Get ${labels.singular} audit entries`,
+          parameters: [
+            {
+              name: "limit",
+              in: "query",
+              schema: { type: "integer", default: 50, maximum: 100 }
+            },
+            {
+              name: "page",
+              in: "query",
+              schema: { type: "integer", default: 1 }
+            },
+            {
+              name: "where",
+              in: "query",
+              schema: { type: "string" },
+              description: "JSON filter"
+            },
+            {
+              name: "sort",
+              in: "query",
+              schema: { type: "string", default: "-timestamp" }
+            }
+          ],
+          responses: {
+            200: {
+              description: "Audit entries for this collection",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    properties: {
+                      docs: {
+                        type: "array",
+                        items: { $ref: "#/components/schemas/AuditEntry" }
+                      },
+                      total: { type: "integer" },
+                      limit: { type: "integer" },
+                      page: { type: "integer" }
+                    }
+                  }
+                }
+              }
+            },
+            403: { description: "Collection read access denied" },
+            404: { description: "Audit is not enabled for this collection" }
+          }
+        }
+      };
+    }
+    if (collection.upload) {
+      spec.paths[`${path}/media`] = {
+        get: {
+          tags: [collectionTag],
+          summary: `List ${labels.plural}`,
+          responses: { 200: { description: "Paginated media documents" } }
+        },
+        post: {
+          tags: [collectionTag],
+          summary: `Upload ${labels.singular}`,
+          requestBody: {
+            required: true,
+            content: {
+              "multipart/form-data": {
+                schema: {
+                  type: "object",
+                  required: ["file"],
+                  properties: { file: { type: "string", format: "binary" } }
+                }
+              }
+            }
+          },
+          responses: { 201: { description: "Uploaded media document" } }
+        }
+      };
+      spec.paths[`${path}/media/{filename}`] = {
+        get: {
+          tags: [collectionTag],
+          summary: `Serve ${labels.singular} bytes`,
+          parameters: [
+            {
+              name: "filename",
+              in: "path",
+              required: true,
+              schema: { type: "string" }
+            }
+          ],
+          security: [],
+          responses: {
+            200: { description: "Stored file" },
+            404: { description: "File not found" }
+          }
+        }
+      };
+    }
+    if (collection.auth) {
+      const publicAuthPost = (summary) => ({
+        tags: [collectionTag],
+        summary,
+        security: [],
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: { type: "object", additionalProperties: true }
+            }
+          }
+        },
+        responses: {
+          200: { description: "Success" },
+          400: { description: "Invalid request" }
+        }
+      });
+      spec.paths[`${path}/login`] = {
+        post: {
+          ...publicAuthPost(`Log in to ${labels.plural}`),
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/AuthCredentials" }
+              }
+            }
+          },
+          responses: {
+            200: {
+              description: "Authenticated",
+              content: {
+                "application/json": {
+                  schema: { $ref: "#/components/schemas/TokenResponse" }
+                }
+              }
+            },
+            401: { description: "Invalid credentials" }
+          }
+        }
+      };
+      spec.paths[`${path}/logout`] = {
+        post: {
+          tags: [collectionTag],
+          summary: `Log out of ${labels.plural}`,
+          parameters: [
+            {
+              name: "allSessions",
+              in: "query",
+              required: false,
+              schema: { type: "boolean" },
+              description: "Revoke every active session for this account instead of only the current one."
+            }
+          ],
+          responses: { 200: { description: "Logged out" } }
+        }
+      };
+      spec.paths[`${path}/init`] = {
+        get: {
+          tags: [collectionTag],
+          summary: `Get ${labels.plural} initialization state`,
+          security: [],
+          responses: { 200: { description: "Initialization state" } }
+        }
+      };
+      spec.paths[`${path}/first-user`] = {
+        post: publicAuthPost(`Register the first ${labels.singular}`)
+      };
+      spec.paths[`${path}/me`] = {
+        get: {
+          tags: [collectionTag],
+          summary: `Get the current ${labels.singular}`,
+          responses: { 200: { description: "Authenticated user" } }
+        }
+      };
+      spec.paths[`${path}/refresh-token`] = {
+        post: {
+          tags: [collectionTag],
+          summary: "Refresh an authentication token",
+          responses: {
+            200: {
+              description: "Refreshed token for the current active session"
+            }
+          }
+        }
+      };
+      spec.paths[`${path}/forgot-password`] = {
+        post: publicAuthPost("Request a password reset")
+      };
+      spec.paths[`${path}/reset-password`] = {
+        post: publicAuthPost("Reset a password")
+      };
+      spec.paths[`${path}/invite`] = {
+        post: {
+          tags: [collectionTag],
+          summary: `Invite a ${labels.singular}`,
+          responses: { 200: { description: "Invitation sent" } }
+        }
+      };
+      spec.paths[`${path}/accept-invite`] = {
+        post: publicAuthPost("Accept an invitation")
+      };
+      spec.paths[`${path}/{id}/change-password`] = {
+        post: {
+          tags: [collectionTag],
+          summary: `Change a ${labels.singular} password`,
+          parameters: [
+            {
+              name: "id",
+              in: "path",
+              required: true,
+              schema: { type: "string" }
+            }
+          ],
+          responses: {
+            200: {
+              description: "Password changed and active sessions revoked"
+            }
+          }
+        }
+      };
+    }
+    if (collection.workflow) {
+      spec.paths[`${path}/{id}/transitions/{transition}`] = {
+        post: {
+          tags: [collectionTag],
+          summary: `Transition ${labels.singular} workflow`,
+          parameters: [
+            {
+              name: "id",
+              in: "path",
+              required: true,
+              schema: { type: "string" }
+            },
+            {
+              name: "transition",
+              in: "path",
+              required: true,
+              schema: {
+                type: "string",
+                enum: collection.workflow.transitions.map((item) => item.name)
+              }
+            }
+          ],
+          requestBody: {
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/WorkflowTransitionRequest"
+                }
+              }
+            }
+          },
+          responses: {
+            200: {
+              description: "Transition applied",
+              content: {
+                "application/json": {
+                  schema: { $ref: `#/components/schemas/${slug}` }
+                }
+              }
+            },
+            400: { description: "Required transition input is missing" },
+            403: { description: "Transition capability denied" },
+            409: { description: "Invalid state or stale revision" }
+          }
+        }
+      };
+      spec.paths[`${path}/{id}/workflow-history`] = {
+        get: {
+          tags: [collectionTag],
+          summary: `Get ${labels.singular} workflow history`,
+          parameters: [
+            {
+              name: "id",
+              in: "path",
+              required: true,
+              schema: { type: "string" }
+            },
+            {
+              name: "limit",
+              in: "query",
+              schema: { type: "integer", default: 50, maximum: 100 }
+            }
+          ],
+          responses: {
+            200: {
+              description: "Workflow transition history",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    properties: {
+                      docs: {
+                        type: "array",
+                        items: {
+                          $ref: "#/components/schemas/WorkflowHistoryEntry"
+                        }
+                      },
+                      total: { type: "integer" },
+                      limit: { type: "integer" },
+                      page: { type: "integer" }
+                    }
+                  }
+                }
+              }
+            },
+            403: { description: "Collection read access denied" }
+          }
+        }
+      };
+    }
+  }
+  for (const global of config.globals) {
+    const slug = global.slug;
+    const path = `/api/globals/${slug}`;
+    const globalTag = getGlobalTag(global);
+    spec.paths[path] = {
+      get: {
+        tags: [globalTag],
+        summary: `Get ${global.label || slug}`,
+        responses: {
+          200: {
+            description: "Success",
+            content: {
+              "application/json": {
+                schema: { $ref: `#/components/schemas/${slug}` }
+              }
+            }
+          }
+        }
+      },
+      patch: {
+        tags: [globalTag],
+        summary: `Update ${global.label || slug}`,
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: { $ref: `#/components/schemas/${slug}` }
+            }
+          }
+        },
+        responses: {
+          200: {
+            description: "Updated",
+            content: {
+              "application/json": {
+                schema: { $ref: `#/components/schemas/${slug}` }
+              }
+            }
+          }
+        }
+      }
+    };
+  }
+  if (config.storage) {
+    spec.paths["/api/media/{filename}"] = {
+      get: {
+        tags: ["Media"],
+        summary: "Serve a stored file",
+        security: [],
+        parameters: [
+          {
+            name: "filename",
+            in: "path",
+            required: true,
+            schema: { type: "string" }
+          }
+        ],
+        responses: {
+          200: { description: "Stored file bytes" },
+          404: { description: "File not found" }
+        }
+      }
+    };
+  }
+  return spec;
+}
+function collectionToSchema(collection) {
+  const { properties, required } = fieldsToProperties(collection.fields);
+  return {
+    type: "object",
+    properties: {
+      id: { type: "string" },
+      createdAt: { type: "string", format: "date-time" },
+      updatedAt: { type: "string", format: "date-time" },
+      ...collection.workflow ? { _workflow: { $ref: "#/components/schemas/WorkflowMetadata" } } : {},
+      ...properties
+    },
+    required: ["id", ...required]
+  };
+}
+function globalToSchema(global) {
+  const { properties, required } = fieldsToProperties(global.fields);
+  return {
+    type: "object",
+    properties,
+    required
+  };
+}
+function fieldsToProperties(fields) {
+  const props = {};
+  const required = [];
+  for (const field of fields) {
+    if (field.type === "row") {
+      const nested = fieldsToProperties(field.fields || []);
+      Object.assign(props, nested.properties);
+      required.push(...nested.required);
+      continue;
+    }
+    if (!field.name) continue;
+    props[field.name] = fieldToSchema(field);
+    if (field.required) {
+      required.push(field.name);
+    }
+  }
+  return { properties: props, required };
+}
+function fieldToSchema(field) {
+  let schema;
+  switch (field.type) {
+    case "text":
+    case "textarea":
+    case "email":
+      schema = { type: "string" };
+      break;
+    case "url":
+      schema = {
+        oneOf: [
+          { type: "string" },
+          { type: "object", additionalProperties: true }
+        ]
+      };
+      break;
+    case "icon":
+      schema = { type: "string" };
+      break;
+    case "number":
+      schema = { type: "number" };
+      break;
+    case "boolean":
+      schema = { type: "boolean" };
+      break;
+    case "date":
+      schema = { type: "string", format: "date" };
+      break;
+    case "datetime":
+      schema = { type: "string", format: "date-time" };
+      break;
+    case "time":
+      schema = { type: "string", format: "time" };
+      break;
+    case "select":
+    case "radio":
+      schema = {
+        type: "string",
+        enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0
+      };
+      break;
+    case "multiSelect":
+      schema = {
+        type: "array",
+        items: {
+          type: "string",
+          enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0
+        }
+      };
+      break;
+    case "relationship":
+    case "image": {
+      const valueSchema = {
+        type: "string",
+        description: `ID of a ${field.relationTo} record`
+      };
+      schema = field.hasMany ? { type: "array", items: valueSchema } : valueSchema;
+      break;
+    }
+    case "join":
+      schema = {
+        type: "array",
+        readOnly: true,
+        items: { type: "object", additionalProperties: true }
+      };
+      break;
+    case "object": {
+      const { properties, required } = fieldsToProperties(field.fields || []);
+      schema = { type: "object", properties, required };
+      break;
+    }
+    case "array": {
+      const { properties, required } = fieldsToProperties(field.fields || []);
+      schema = {
+        type: "array",
+        items: { type: "object", properties, required }
+      };
+      break;
+    }
+    case "json":
+    case "richText":
+      schema = { type: "object", additionalProperties: true };
+      break;
+    case "blocks":
+      schema = {
+        type: "array",
+        items: {
+          oneOf: field.blocks?.map((block) => {
+            const { properties, required } = fieldsToProperties(block.fields);
+            return {
+              type: "object",
+              properties: {
+                blockType: { type: "string", enum: [block.slug] },
+                ...properties
+              },
+              required: ["blockType", ...required]
+            };
+          })
+        }
+      };
+      break;
+    default:
+      schema = { type: "string" };
+  }
+  if (field.label) schema.description = field.label;
+  return schema;
+}
+
+export {
+  signCollectionToken,
+  verifyCollectionToken,
+  issueAuthSessionToken,
+  getAuthSession,
+  isAuthSessionActive,
+  touchAuthSession,
+  revokeAuthSession,
+  revokeAllAuthSessions,
+  createObservabilityRuntime,
+  bindObservabilityRuntime,
+  getObservabilityRuntime,
+  getConfigLogger,
+  getRequestLogger,
+  buildRequestLogger,
+  shouldSampleRequest,
+  redactHeaders,
+  captureRequestBody,
+  createRequestSpan,
+  endRequestSpan,
+  attachRequestMetrics,
+  renderPrometheusMetrics,
+  WORKFLOW_HISTORY_COLLECTION,
+  LIFECYCLE_EVENTS_COLLECTION,
+  definePublishingWorkflow,
+  publishingWorkflow,
+  simplePublishingWorkflow,
+  workflowCapabilities,
+  canViewWorkflowDraft,
+  availableWorkflowTransitions,
+  initializeWorkflowDocument,
+  publishedStateName,
+  materializeWorkflowDocument,
+  createLifecycleEvent,
+  dispatchLifecycleEvent,
+  dispatchPendingLifecycleEvents,
+  saveWorkflowDraft,
+  createWorkflowDocument,
+  transitionWorkflow,
+  getAdminAuthCollection,
+  resolveAdminAuthCollection,
+  getPublicAdminAuthConfig,
+  mergeDynamicConfig,
+  validateDeclarativeHookExpression,
+  validateDeclarativeAccessExpression,
+  validateAdminConditionExpression,
+  validatePreviewUrlExpression,
+  assertValidDeclarativeHookExpression,
+  assertValidDeclarativeHookResult,
+  collectDeclarativeHookValidationIssues,
+  collectDeclarativeAccessValidationIssues,
+  collectAdminConditionValidationIssues,
+  collectPreviewUrlValidationIssues,
+  assertValidAdminConditionsInConfig,
+  assertValidPreviewUrlsInConfig,
+  collectConfigDiagnostics,
+  formatConfigDiagnostics,
+  ConfigValidationError,
+  isConfigValidationError,
+  assertValidDeclarativeHooksInConfig,
+  assertValidDeclarativeAccessInConfig,
+  normalizeConfig,
+  runCollectionHooks,
+  executeFieldBeforeChange,
+  executeFieldAfterRead,
+  generateOpenApi
+};