@dyrected/core 2.7.0 → 2.8.0

package/dist/index.cjs

@@ -5,6 +5,9 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -27,13 +30,527 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/observability.ts
+var observability_exports = {};
+__export(observability_exports, {
+  attachRequestMetrics: () => attachRequestMetrics,
+  bindObservabilityRuntime: () => bindObservabilityRuntime,
+  buildRequestLogger: () => buildRequestLogger,
+  captureRequestBody: () => captureRequestBody,
+  createObservabilityRuntime: () => createObservabilityRuntime,
+  createRequestSpan: () => createRequestSpan,
+  endRequestSpan: () => endRequestSpan,
+  getConfigLogger: () => getConfigLogger,
+  getObservabilityRuntime: () => getObservabilityRuntime,
+  getRequestLogger: () => getRequestLogger,
+  redactBody: () => redactBody,
+  redactHeaders: () => redactHeaders,
+  renderPrometheusMetrics: () => renderPrometheusMetrics,
+  resolveObservabilityConfig: () => resolveObservabilityConfig,
+  shouldSampleRequest: () => shouldSampleRequest
+});
+function resolveObservabilityConfig(config) {
+  const requestLogging = config?.requestLogging;
+  const sampling = config?.sampling;
+  const tracing = config?.tracing;
+  const metrics = config?.metrics;
+  return {
+    requestLogging: {
+      enabled: requestLogging?.enabled ?? true,
+      logBodies: requestLogging?.logBodies ?? false,
+      maxBodyBytes: requestLogging?.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES,
+      redactPaths: uniqueValues([
+        ...DEFAULT_REDACT_PATHS,
+        ...requestLogging?.redactPaths ?? []
+      ]),
+      includeHeaders: normalizeHeaderNames(requestLogging?.includeHeaders ?? []),
+      redactHeaders: uniqueValues(
+        normalizeHeaderNames([
+          ...DEFAULT_REDACT_HEADERS,
+          ...requestLogging?.redactHeaders ?? []
+        ])
+      )
+    },
+    sampling: {
+      successRate: clampRate(sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE),
+      traceSuccessRate: clampRate(
+        sampling?.traceSuccessRate ?? sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE
+      ),
+      bodySuccessRate: clampRate(
+        sampling?.bodySuccessRate ?? Math.min(DEFAULT_BODY_SAMPLE_RATE, sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE)
+      ),
+      alwaysKeep4xx: sampling?.alwaysKeep4xx ?? true,
+      alwaysKeep5xx: sampling?.alwaysKeep5xx ?? true
+    },
+    tracing: {
+      enabled: tracing?.enabled ?? false,
+      serviceName: tracing?.serviceName ?? "dyrected",
+      exporter: tracing?.exporter ?? "none",
+      headers: tracing?.headers ?? {},
+      endpoint: tracing?.endpoint
+    },
+    metrics: {
+      enabled: metrics?.enabled ?? false,
+      exporter: metrics?.exporter ?? "none",
+      endpoint: metrics?.endpoint,
+      path: metrics?.path ?? "/metrics"
+    },
+    transports: {
+      targets: config?.transports?.targets && config.transports.targets.length > 0 ? config.transports.targets : [{ type: "stdout" }]
+    }
+  };
+}
+function createObservabilityRuntime(config) {
+  const resolved = resolveObservabilityConfig(config.observability);
+  const logger = createRootLogger(config.logger, resolved);
+  const shutdownTasks = [];
+  const meterRuntime = resolved.metrics.enabled || resolved.metrics.exporter === "prometheus" ? createMeterProvider(resolved) : void 0;
+  const tracerProvider = resolved.tracing.enabled ? createTracerProvider(resolved) : void 0;
+  const tracer = tracerProvider?.getTracer("dyrected");
+  const meter = meterRuntime?.provider.getMeter("dyrected");
+  const metrics = meter ? {
+    requestCount: meter.createCounter("dyrected_http_requests_total", {
+      description: "Total HTTP requests served by Dyrected"
+    }),
+    authFailureCount: meter.createCounter("dyrected_auth_failures_total", {
+      description: "Authentication failures"
+    }),
+    uncaughtErrorCount: meter.createCounter("dyrected_uncaught_errors_total", {
+      description: "Uncaught application errors"
+    }),
+    auditWriteFailureCount: meter.createCounter("dyrected_audit_write_failures_total", {
+      description: "Audit log persistence failures"
+    }),
+    emailSendFailureCount: meter.createCounter("dyrected_email_send_failures_total", {
+      description: "Transactional email delivery failures"
+    }),
+    workflowHookFailureCount: meter.createCounter("dyrected_workflow_hook_failures_total", {
+      description: "Workflow hook failures isolated after successful writes"
+    }),
+    requestDuration: meter.createHistogram("dyrected_http_request_duration_ms", {
+      description: "HTTP request duration in milliseconds",
+      unit: "ms"
+    })
+  } : void 0;
+  if (meterRuntime) {
+    shutdownTasks.push(() => meterRuntime.provider.shutdown());
+  }
+  if (tracerProvider) {
+    shutdownTasks.push(() => tracerProvider.shutdown());
+  }
+  return {
+    logger,
+    config: resolved,
+    tracer,
+    metrics,
+    prometheusExporter: meterRuntime?.prometheusExporter,
+    shutdown: async () => {
+      for (const task of shutdownTasks) {
+        await task();
+      }
+    },
+    recordAuthFailure: (attributes) => metrics?.authFailureCount.add(1, attributes),
+    recordUncaughtError: (attributes) => metrics?.uncaughtErrorCount.add(1, attributes),
+    recordAuditWriteFailure: (attributes) => metrics?.auditWriteFailureCount.add(1, attributes),
+    recordEmailSendFailure: (attributes) => metrics?.emailSendFailureCount.add(1, attributes),
+    recordWorkflowHookFailure: (attributes) => metrics?.workflowHookFailureCount.add(1, attributes)
+  };
+}
+function bindObservabilityRuntime(config, runtime) {
+  runtimeByConfig.set(config, runtime);
+}
+function getObservabilityRuntime(config) {
+  if (!config || typeof config !== "object") return void 0;
+  return runtimeByConfig.get(config);
+}
+function createRootLogger(loggerConfig, observability) {
+  if (loggerConfig && !("options" in loggerConfig)) {
+    return loggerConfig;
+  }
+  const options = loggerConfig?.options ?? {};
+  const enabled = options.enabled ?? process.env.DISABLE_LOGGING !== "true";
+  const name = options.name ?? "dyrected";
+  if (loggerConfig?.destination) {
+    return (0, import_pino.default)(
+      {
+        ...options,
+        enabled,
+        name,
+        timestamp: options.timestamp ?? import_pino.stdTimeFunctions.isoTime
+      },
+      loggerConfig.destination
+    );
+  }
+  const streams = buildTransportStreams(observability);
+  const destination = streams.length === 1 ? streams[0] : (0, import_pino.multistream)(streams.map((stream) => ({ stream })));
+  return (0, import_pino.default)(
+    {
+      ...options,
+      enabled,
+      name,
+      timestamp: options.timestamp ?? import_pino.stdTimeFunctions.isoTime
+    },
+    destination
+  );
+}
+function buildTransportStreams(observability) {
+  const targets = observability.transports.targets;
+  if (targets.length === 0) {
+    return [defaultLoggerDestination()];
+  }
+  return targets.map((target) => {
+    switch (target.type) {
+      case "stdout":
+        return defaultLoggerDestination();
+      case "stderr":
+        return (0, import_pino.destination)(2);
+      case "file":
+        return (0, import_pino.destination)(target.path);
+      case "otlp":
+        return new OtlpLogWritable(target.endpoint, target.headers);
+    }
+  });
+}
+function defaultLoggerDestination() {
+  if (process.env.NODE_ENV !== "production" && typeof window === "undefined") {
+    try {
+      const req = globalThis.require;
+      if (req) {
+        const pinoPretty = req("pino-pretty");
+        return pinoPretty({
+          colorize: true,
+          ignore: "pid,hostname",
+          translateTime: "SYS:HH:MM:ss",
+          destination: 1,
+          sync: true
+        });
+      }
+    } catch {
+    }
+  }
+  return (0, import_pino.destination)(1);
+}
+function createTracerProvider(observability) {
+  const exporter = createTraceExporter(observability);
+  const provider = new import_sdk_trace_base.BasicTracerProvider({
+    resource: (0, import_resources.resourceFromAttributes)({
+      "service.name": observability.tracing.serviceName
+    }),
+    spanProcessors: exporter ? [new import_sdk_trace_base.BatchSpanProcessor(exporter)] : []
+  });
+  import_api.trace.setGlobalTracerProvider(provider);
+  return provider;
+}
+function createTraceExporter(observability) {
+  switch (observability.tracing.exporter) {
+    case "console":
+      return new import_sdk_trace_base.ConsoleSpanExporter();
+    case "otlp":
+      return new import_exporter_trace_otlp_http.OTLPTraceExporter({
+        url: observability.tracing.endpoint,
+        headers: observability.tracing.headers
+      });
+    default:
+      return void 0;
+  }
+}
+function createMeterProvider(observability) {
+  const readers = [];
+  let prometheusExporter;
+  switch (observability.metrics.exporter) {
+    case "otlp":
+      readers.push(
+        new import_sdk_metrics.PeriodicExportingMetricReader({
+          exporter: new import_exporter_metrics_otlp_http.OTLPMetricExporter({
+            url: observability.metrics.endpoint
+          })
+        })
+      );
+      break;
+    case "prometheus":
+      prometheusExporter = new import_exporter_prometheus.PrometheusExporter({
+        endpoint: observability.metrics.path,
+        preventServerStart: true
+      });
+      readers.push(prometheusExporter);
+      break;
+  }
+  const provider = new import_sdk_metrics.MeterProvider({
+    resource: (0, import_resources.resourceFromAttributes)({
+      "service.name": observability.tracing.serviceName
+    }),
+    readers
+  });
+  return { provider, prometheusExporter };
+}
+function getConfigLogger(config, component) {
+  const base = config?.logger && !("options" in config.logger) ? config.logger : fallbackLogger;
+  return base.child({ component });
+}
+function getRequestLogger(c, component) {
+  const base = c.get("logger") ?? fallbackLogger;
+  return component ? base.child({ component }) : base;
+}
+function buildRequestLogger(runtime, vars, requestId) {
+  const trace2 = vars.requestTrace;
+  return runtime.logger.child({
+    requestId,
+    siteId: vars.siteId,
+    workspaceId: vars.workspaceId,
+    traceId: trace2?.traceId,
+    spanId: trace2?.spanId
+  });
+}
+function shouldSampleRequest(requestId, statusCode, sampling, kind) {
+  if (statusCode >= 500 && sampling.alwaysKeep5xx) return true;
+  if (statusCode >= 400 && sampling.alwaysKeep4xx) return true;
+  const rate = kind === "trace" ? sampling.traceSuccessRate : kind === "body" ? sampling.bodySuccessRate : sampling.successRate;
+  return deterministicSample(requestId ?? "no-request-id", rate);
+}
+function redactHeaders(headers, observability) {
+  const includeHeaders = new Set(observability.requestLogging.includeHeaders);
+  const redactHeaders2 = new Set(observability.requestLogging.redactHeaders);
+  const output = {};
+  for (const [key, value] of Object.entries(headers)) {
+    const normalizedKey = key.toLowerCase();
+    if (includeHeaders.size > 0 && !includeHeaders.has(normalizedKey)) continue;
+    output[normalizedKey] = redactHeaders2.has(normalizedKey) ? REDACTED_VALUE : value;
+  }
+  return output;
+}
+async function captureRequestBody(request, observability) {
+  const contentType = request.headers.get("content-type") ?? void 0;
+  const contentLength = toNumber(request.headers.get("content-length"));
+  const jsonBody = contentType?.includes("application/json");
+  if (!jsonBody) {
+    return {
+      attempted: false,
+      contentType,
+      contentLength
+    };
+  }
+  try {
+    const text = await request.clone().text();
+    if (!text) {
+      return { attempted: true, contentType, contentLength };
+    }
+    const truncated = text.length > observability.requestLogging.maxBodyBytes;
+    const raw = truncated ? text.slice(0, observability.requestLogging.maxBodyBytes) : text;
+    try {
+      const parsed = JSON.parse(raw);
+      return {
+        attempted: true,
+        contentType,
+        contentLength: contentLength ?? text.length,
+        truncated,
+        body: redactBody(parsed, observability.requestLogging.redactPaths)
+      };
+    } catch {
+      return {
+        attempted: true,
+        contentType,
+        contentLength: contentLength ?? text.length,
+        truncated,
+        parseFailed: true
+      };
+    }
+  } catch {
+    return {
+      attempted: true,
+      contentType,
+      contentLength,
+      parseFailed: true
+    };
+  }
+}
+function redactBody(value, redactPaths) {
+  const cloned = deepClone(value);
+  for (const path of redactPaths) {
+    applyRedaction(cloned, path.split("."));
+  }
+  return cloned;
+}
+function applyRedaction(target, segments) {
+  if (!target || segments.length === 0) return;
+  const [segment, ...rest] = segments;
+  if (Array.isArray(target)) {
+    for (const item of target) {
+      if (segment === "*") {
+        applyRedaction(item, rest);
+      } else {
+        applyRedaction(item, segments);
+      }
+    }
+    return;
+  }
+  if (typeof target !== "object") return;
+  const record = target;
+  if (segment === "*") {
+    for (const value of Object.values(record)) {
+      applyRedaction(value, rest);
+    }
+    return;
+  }
+  if (!(segment in record)) return;
+  if (rest.length === 0) {
+    record[segment] = REDACTED_VALUE;
+    return;
+  }
+  applyRedaction(record[segment], rest);
+}
+function deepClone(value) {
+  if (typeof structuredClone === "function") {
+    return structuredClone(value);
+  }
+  return JSON.parse(JSON.stringify(value));
+}
+function createRequestSpan(runtime, name, attributes) {
+  if (!runtime.tracer) return void 0;
+  const span = runtime.tracer.startSpan(name, { attributes }, import_api.context.active());
+  const spanContext = span.spanContext();
+  return {
+    span,
+    traceId: spanContext.traceId,
+    spanId: spanContext.spanId,
+    sampled: spanContext.traceFlags === import_api.TraceFlags.SAMPLED
+  };
+}
+function endRequestSpan(requestTrace, statusCode, error) {
+  if (!requestTrace) return;
+  requestTrace.span.setAttribute("http.status_code", statusCode);
+  if (error) {
+    requestTrace.span.recordException(error instanceof Error ? error : new Error(String(error)));
+  }
+  requestTrace.span.end();
+}
+function attachRequestMetrics(runtime, args) {
+  runtime.metrics?.requestCount.add(1, {
+    method: args.method,
+    route: args.route,
+    status_class: `${Math.floor(args.statusCode / 100)}xx`
+  });
+  runtime.metrics?.requestDuration.record(args.durationMs, {
+    method: args.method,
+    route: args.route,
+    status_class: `${Math.floor(args.statusCode / 100)}xx`
+  });
+}
+async function renderPrometheusMetrics(exporter) {
+  let statusCode = 200;
+  const headers = {};
+  let body = "";
+  await new Promise((resolve) => {
+    const response = {
+      statusCode,
+      setHeader(name, value) {
+        headers[name.toLowerCase()] = value;
+      },
+      end(chunk) {
+        if (chunk) body += chunk;
+        statusCode = this.statusCode;
+        resolve();
+      }
+    };
+    exporter.getMetricsRequestHandler({}, response);
+  });
+  return { body, headers, statusCode };
+}
+function normalizeHeaderNames(headers) {
+  return headers.map((value) => value.toLowerCase());
+}
+function uniqueValues(values) {
+  return [...new Set(values)];
+}
+function clampRate(value) {
+  if (Number.isNaN(value)) return 0;
+  return Math.max(0, Math.min(1, value));
+}
+function deterministicSample(seed, rate) {
+  if (rate >= 1) return true;
+  if (rate <= 0) return false;
+  let hash = 0;
+  for (let index = 0; index < seed.length; index += 1) {
+    hash = hash * 31 + seed.charCodeAt(index) >>> 0;
+  }
+  return hash / 4294967295 <= rate;
+}
+function toNumber(value) {
+  if (!value) return void 0;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : void 0;
+}
+var import_api, import_exporter_metrics_otlp_http, import_exporter_prometheus, import_exporter_trace_otlp_http, import_resources, import_sdk_metrics, import_sdk_trace_base, import_pino, import_node_stream, DEFAULT_REDACT_HEADERS, DEFAULT_REDACT_PATHS, DEFAULT_MAX_BODY_BYTES, DEFAULT_SUCCESS_SAMPLE_RATE, DEFAULT_BODY_SAMPLE_RATE, REDACTED_VALUE, runtimeByConfig, fallbackLogger, OtlpLogWritable;
+var init_observability = __esm({
+  "src/observability.ts"() {
+    "use strict";
+    import_api = require("@opentelemetry/api");
+    import_exporter_metrics_otlp_http = require("@opentelemetry/exporter-metrics-otlp-http");
+    import_exporter_prometheus = require("@opentelemetry/exporter-prometheus");
+    import_exporter_trace_otlp_http = require("@opentelemetry/exporter-trace-otlp-http");
+    import_resources = require("@opentelemetry/resources");
+    import_sdk_metrics = require("@opentelemetry/sdk-metrics");
+    import_sdk_trace_base = require("@opentelemetry/sdk-trace-base");
+    import_pino = __toESM(require("pino"), 1);
+    import_node_stream = require("stream");
+    DEFAULT_REDACT_HEADERS = ["authorization", "cookie", "set-cookie", "x-api-key"];
+    DEFAULT_REDACT_PATHS = [
+      "password",
+      "currentPassword",
+      "newPassword",
+      "confirmPassword",
+      "token",
+      "refreshToken",
+      "accessToken",
+      "secret",
+      "apiKey",
+      "inviteToken",
+      "resetToken"
+    ];
+    DEFAULT_MAX_BODY_BYTES = 8192;
+    DEFAULT_SUCCESS_SAMPLE_RATE = 0.1;
+    DEFAULT_BODY_SAMPLE_RATE = 0.02;
+    REDACTED_VALUE = "[REDACTED]";
+    runtimeByConfig = /* @__PURE__ */ new WeakMap();
+    fallbackLogger = (0, import_pino.default)({
+      name: "dyrected",
+      enabled: process.env.DISABLE_LOGGING !== "true",
+      timestamp: import_pino.stdTimeFunctions.isoTime
+    });
+    OtlpLogWritable = class extends import_node_stream.Writable {
+      constructor(endpoint, headers = {}) {
+        super();
+        this.endpoint = endpoint;
+        this.headers = headers;
+      }
+      endpoint;
+      headers;
+      _write(chunk, _encoding, callback) {
+        const payload = chunk.toString();
+        void fetch(this.endpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            ...this.headers
+          },
+          body: JSON.stringify({ logs: payload.trim().split("\n").filter(Boolean) })
+        }).then(() => callback()).catch(
+          (error) => callback(error instanceof Error ? error : new Error(String(error)))
+        );
+      }
+    };
+  }
+});
+
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  BUILTIN_JEXL_HELPERS: () => BUILTIN_JEXL_HELPERS,
   ConfigValidationError: () => ConfigValidationError,
   LIFECYCLE_EVENTS_COLLECTION: () => LIFECYCLE_EVENTS_COLLECTION,
   LIFECYCLE_EVENT_NAMES: () => LIFECYCLE_EVENT_NAMES,
   WORKFLOW_HISTORY_COLLECTION: () => WORKFLOW_HISTORY_COLLECTION,
+  abs: () => abs,
+  addDays: () => addDays,
   assertValidAdminConditionsInConfig: () => assertValidAdminConditionsInConfig,
   assertValidDeclarativeAccessInConfig: () => assertValidDeclarativeAccessInConfig,
   assertValidDeclarativeHookExpression: () => assertValidDeclarativeHookExpression,
@@ -43,13 +560,20 @@ __export(index_exports, {
   availableWorkflowTransitions: () => availableWorkflowTransitions,
   buildSqlOrderBy: () => buildSqlOrderBy,
   canViewWorkflowDraft: () => canViewWorkflowDraft,
+  capitalize: () => capitalize,
+  ceil: () => ceil,
+  clamp: () => clamp,
+  coalesce: () => coalesce,
   collectAdminConditionValidationIssues: () => collectAdminConditionValidationIssues,
   collectConfigDiagnostics: () => collectConfigDiagnostics,
   collectDeclarativeAccessValidationIssues: () => collectDeclarativeAccessValidationIssues,
   collectDeclarativeHookValidationIssues: () => collectDeclarativeHookValidationIssues,
   collectPreviewUrlValidationIssues: () => collectPreviewUrlValidationIssues,
+  compact: () => compact,
+  count: () => count,
   createLifecycleEvent: () => createLifecycleEvent,
   createWorkflowDocument: () => createWorkflowDocument,
+  defaultValue: () => defaultValue,
   defineArrayField: () => defineArrayField,
   defineBlock: () => defineBlock,
   defineBlocksField: () => defineBlocksField,
@@ -79,33 +603,82 @@ __export(index_exports, {
   defineTextareaField: () => defineTextareaField,
   defineTimeField: () => defineTimeField,
   defineUrlField: () => defineUrlField,
+  diffDays: () => diffDays,
   dispatchLifecycleEvent: () => dispatchLifecycleEvent,
   dispatchPendingLifecycleEvents: () => dispatchPendingLifecycleEvents,
+  displayComputed: () => displayComputed,
+  displayCustom: () => displayCustom,
+  displayCustomComponent: () => displayCustomComponent,
+  displayDivider: () => displayDivider,
+  displayField: () => displayField,
+  displayGrid: () => displayGrid,
+  displayRepeat: () => displayRepeat,
+  displaySection: () => displaySection,
+  displayTab: () => displayTab,
+  displayTabs: () => displayTabs,
+  displayText: () => displayText,
+  endsWith: () => endsWith,
+  evaluateDetailComputed: () => evaluateDetailComputed,
+  evaluateJexl: () => evaluateJexl,
+  evaluateJexlSync: () => evaluateJexlSync,
   executeFieldAfterRead: () => executeFieldAfterRead,
   executeFieldBeforeChange: () => executeFieldBeforeChange,
+  first: () => first,
+  floor: () => floor,
   formatConfigDiagnostics: () => formatConfigDiagnostics,
+  formatDate: () => formatDate,
+  generateDefaultDetailSchema: () => generateDefaultDetailSchema,
   generateOpenApi: () => generateOpenApi,
+  get: () => get,
   getAdminAuthCollection: () => getAdminAuthCollection,
   getPublicAdminAuthConfig: () => getPublicAdminAuthConfig,
+  includes: () => includes,
   initializeWorkflowDocument: () => initializeWorkflowDocument,
   isConfigValidationError: () => isConfigValidationError,
+  isDetailItemVisible: () => isDetailItemVisible,
+  isEmpty: () => isEmpty,
+  isFuture: () => isFuture,
+  isPast: () => isPast,
+  join: () => join,
+  last: () => last,
+  length: () => length,
+  lower: () => lower,
   materializeWorkflowDocument: () => materializeWorkflowDocument,
+  max: () => max,
+  min: () => min,
   normalizeConfig: () => normalizeConfig,
+  normalizeDetailItem: () => normalizeDetailItem,
+  now: () => now,
   numericFieldNames: () => numericFieldNames,
   parseMongoWhere: () => parseMongoWhere,
   parseSort: () => parseSort,
   parseSqlWhere: () => parseSqlWhere,
+  pow: () => pow,
   publishedStateName: () => publishedStateName,
   publishingWorkflow: () => publishingWorkflow,
+  readingTime: () => readingTime,
+  registerJexlHelpers: () => registerJexlHelpers,
+  replace: () => replace,
   resolveAdminAuthCollection: () => resolveAdminAuthCollection,
+  round: () => round,
   runCollectionHooks: () => runCollectionHooks,
   saveWorkflowDraft: () => saveWorkflowDraft,
   simplePublishingWorkflow: () => simplePublishingWorkflow,
+  slugify: () => slugify,
+  sqrt: () => sqrt,
+  startsWith: () => startsWith,
+  sum: () => sum,
+  today: () => today,
   transitionWorkflow: () => transitionWorkflow,
+  trim: () => trim,
+  truncate: () => truncate,
+  unique: () => unique,
+  upper: () => upper,
   validateAdminConditionExpression: () => validateAdminConditionExpression,
   validateDeclarativeAccessExpression: () => validateDeclarativeAccessExpression,
   validateDeclarativeHookExpression: () => validateDeclarativeHookExpression,
   validatePreviewUrlExpression: () => validatePreviewUrlExpression,
+  wordCount: () => wordCount,
   workflowCapabilities: () => workflowCapabilities
 });
 module.exports = __toCommonJS(index_exports);
@@ -120,37 +693,10 @@ var LIFECYCLE_EVENT_NAMES = [
 
 // src/auth/token.ts
 var import_jose = require("jose");
-var import_node_util = require("util");
 
 // src/auth/sessions.ts
 var AUTH_SESSIONS_COLLECTION = "__auth_sessions";
 
-// src/observability.ts
-var import_api = require("@opentelemetry/api");
-var import_exporter_metrics_otlp_http = require("@opentelemetry/exporter-metrics-otlp-http");
-var import_exporter_prometheus = require("@opentelemetry/exporter-prometheus");
-var import_exporter_trace_otlp_http = require("@opentelemetry/exporter-trace-otlp-http");
-var import_resources = require("@opentelemetry/resources");
-var import_sdk_metrics = require("@opentelemetry/sdk-metrics");
-var import_sdk_trace_base = require("@opentelemetry/sdk-trace-base");
-var import_pino = __toESM(require("pino"), 1);
-var import_pino_pretty = __toESM(require("pino-pretty"), 1);
-var import_node_stream = require("stream");
-var runtimeByConfig = /* @__PURE__ */ new WeakMap();
-var fallbackLogger = (0, import_pino.default)({
-  name: "dyrected",
-  enabled: process.env.DISABLE_LOGGING !== "true",
-  timestamp: import_pino.stdTimeFunctions.isoTime
-});
-function getObservabilityRuntime(config) {
-  if (!config || typeof config !== "object") return void 0;
-  return runtimeByConfig.get(config);
-}
-function getConfigLogger(config, component) {
-  const base = config?.logger && !("options" in config.logger) ? config.logger : fallbackLogger;
-  return base.child({ component });
-}
-
 // src/workflows.ts
 var WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
 var LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
@@ -168,10 +714,36 @@ function definePublishingWorkflow(options = {}) {
       { name: "published", label: "Published", color: "success", published: true }
     ],
     transitions: [
-      { name: "submit", label: "Submit for review", from: "draft", to: "in_review", requiredCapabilities: ["entry.submit"] },
-      { name: "publish", label: "Publish", from: "in_review", to: "published", requiredCapabilities: ["entry.publish"] },
-      { name: "reject", label: "Request changes", from: "in_review", to: "draft", requiredCapabilities: ["entry.publish"], requireComment: true },
-      { name: "unpublish", label: "Unpublish", from: "published", to: "draft", requiredCapabilities: ["entry.unpublish"], unpublish: true }
+      {
+        name: "submit",
+        label: "Submit for review",
+        from: "draft",
+        to: "in_review",
+        requiredCapabilities: ["entry.submit"]
+      },
+      {
+        name: "publish",
+        label: "Publish",
+        from: "in_review",
+        to: "published",
+        requiredCapabilities: ["entry.publish"]
+      },
+      {
+        name: "reject",
+        label: "Request changes",
+        from: "in_review",
+        to: "draft",
+        requiredCapabilities: ["entry.publish"],
+        requireComment: true
+      },
+      {
+        name: "unpublish",
+        label: "Unpublish",
+        from: "published",
+        to: "draft",
+        requiredCapabilities: ["entry.unpublish"],
+        unpublish: true
+      }
     ],
     roles: [
       ...editors.map((role) => ({ role, capabilities: [...EDITOR_CAPABILITIES] })),
@@ -191,7 +763,7 @@ function simplePublishingWorkflow() {
       { name: "published", label: "Published", color: "success", published: true }
     ],
     transitions: [
-      { name: "publish", label: "Publish", from: "draft", to: "published" },
+      { name: "publish", label: "Publish", from: ["draft", "published"], to: "published" },
       { name: "unpublish", label: "Unpublish", from: "published", to: "draft", unpublish: true }
     ]
     // Intentionally no `roles`: this lightweight workflow (synthesized from
@@ -298,7 +870,11 @@ async function dispatchLifecycleEvent(config, event) {
   const retryDelayMs = config.events.retryDelayMs ?? 1e3;
   const attempts = event.attempts + 1;
   try {
-    await db.update({ collection: LIFECYCLE_EVENTS_COLLECTION, id: event.id, data: { status: "processing", attempts } });
+    await db.update({
+      collection: LIFECYCLE_EVENTS_COLLECTION,
+      id: event.id,
+      data: { status: "processing", attempts }
+    });
     for (const handler of config.events.handlers) await handler({ ...event, status: "processing", attempts });
     await db.update({
       collection: LIFECYCLE_EVENTS_COLLECTION,
@@ -328,9 +904,9 @@ async function dispatchPendingLifecycleEvents(config, limit = 50) {
     sort: "occurredAt",
     limit
   });
-  const now = Date.now();
+  const now2 = Date.now();
   const due = result.docs.filter(
-    (doc) => Number(doc.attempts ?? 0) < maxAttempts && (!doc.nextAttemptAt || new Date(doc.nextAttemptAt).getTime() <= now)
+    (doc) => Number(doc.attempts ?? 0) < maxAttempts && (!doc.nextAttemptAt || new Date(doc.nextAttemptAt).getTime() <= now2)
   );
   for (const event of due) await dispatchLifecycleEvent(config, event);
   return due.length;
@@ -405,12 +981,16 @@ async function transitionWorkflow(args) {
   const meta = original.__workflow;
   if (!meta) throw Object.assign(new Error("Entry has no workflow metadata"), { statusCode: 409 });
   if (expectedRevision !== void 0 && expectedRevision !== meta.revision) {
-    throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
+    throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), {
+      statusCode: 409
+    });
   }
   const transition = workflow.transitions.find((item) => item.name === transitionName);
   const fromStates = transition ? Array.isArray(transition.from) ? transition.from : [transition.from] : [];
   if (!transition || !fromStates.includes(meta.state)) {
-    throw Object.assign(new Error(`Transition "${transitionName}" is not valid from "${meta.state}".`), { statusCode: 409 });
+    throw Object.assign(new Error(`Transition "${transitionName}" is not valid from "${meta.state}".`), {
+      statusCode: 409
+    });
   }
   if (!availableWorkflowTransitions(workflow, meta.state, user).some((item) => item.name === transition.name)) {
     throw Object.assign(new Error(`You do not have permission to perform "${transition.label}".`), { statusCode: 403 });
@@ -420,32 +1000,52 @@ async function transitionWorkflow(args) {
   }
   const hookContext = { transition, from: meta.state, to: transition.to, doc: original, user, comment, req, db };
   for (const hook of workflow.hooks?.beforeTransition ?? []) await hook(hookContext);
-  const events = [createLifecycleEvent({
-    name: "workflow.transitioned",
-    collection: collection.slug,
-    documentId: id,
-    actorId: user?.sub,
-    payload: { transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision, comment }
-  })];
+  const events = [
+    createLifecycleEvent({
+      name: "workflow.transitioned",
+      collection: collection.slug,
+      documentId: id,
+      actorId: user?.sub,
+      payload: { transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision, comment }
+    })
+  ];
   const targetState = workflow.states.find((state) => state.name === transition.to);
   if (targetState.published) {
-    events.push(createLifecycleEvent({ name: "entry.published", collection: collection.slug, documentId: id, actorId: user?.sub, payload: { revision: meta.revision } }));
+    events.push(
+      createLifecycleEvent({
+        name: "entry.published",
+        collection: collection.slug,
+        documentId: id,
+        actorId: user?.sub,
+        payload: { revision: meta.revision }
+      })
+    );
   } else if (transition.unpublish) {
-    events.push(createLifecycleEvent({ name: "entry.unpublished", collection: collection.slug, documentId: id, actorId: user?.sub, payload: { revision: meta.publishedRevision } }));
+    events.push(
+      createLifecycleEvent({
+        name: "entry.unpublished",
+        collection: collection.slug,
+        documentId: id,
+        actorId: user?.sub,
+        payload: { revision: meta.publishedRevision }
+      })
+    );
   }
   const updated = await db.transaction(async (tx) => {
     const locked = await tx.findOne({ collection: collection.slug, id });
     if (!locked) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
     const lockedMeta = locked.__workflow;
     if (lockedMeta.revision !== meta.revision || lockedMeta.state !== meta.state || expectedRevision !== void 0 && lockedMeta.revision !== expectedRevision) {
-      throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
+      throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), {
+        statusCode: 409
+      });
     }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const now2 = (/* @__PURE__ */ new Date()).toISOString();
     const { __published: _published, __workflow: _workflow, id: _id, ...working } = locked;
     const nextMeta = {
       ...lockedMeta,
       state: transition.to,
-      ...targetState.published ? { publishedRevision: lockedMeta.revision, publishedAt: now, publishedBy: user?.sub } : {},
+      ...targetState.published ? { publishedRevision: lockedMeta.revision, publishedAt: now2, publishedBy: user?.sub } : {},
       ...transition.unpublish ? { publishedRevision: void 0, publishedAt: void 0, publishedBy: void 0 } : {}
     };
     const data = { __workflow: nextMeta };
@@ -454,11 +1054,36 @@ async function transitionWorkflow(args) {
     const next = await tx.update({ collection: collection.slug, id, data });
     await tx.create({
       collection: WORKFLOW_HISTORY_COLLECTION,
-      data: { collection: collection.slug, documentId: id, transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision, comment: comment ?? null, actorId: user?.sub ?? null, createdAt: now }
+      data: {
+        collection: collection.slug,
+        documentId: id,
+        transition: transition.name,
+        from: lockedMeta.state,
+        to: transition.to,
+        revision: lockedMeta.revision,
+        comment: comment ?? null,
+        actorId: user?.sub ?? null,
+        createdAt: now2
+      }
     });
     for (const event of events) await persistEvent(tx, event);
     if (collection.audit) {
-      await tx.create({ collection: "__audit", data: { collection: collection.slug, documentId: id, operation: "workflow.transition", user: user?.sub ?? null, timestamp: now, changes: JSON.stringify({ transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision }) } });
+      await tx.create({
+        collection: "__audit",
+        data: {
+          collection: collection.slug,
+          documentId: id,
+          operation: "workflow.transition",
+          user: user?.sub ?? null,
+          timestamp: now2,
+          changes: JSON.stringify({
+            transition: transition.name,
+            from: lockedMeta.state,
+            to: transition.to,
+            revision: lockedMeta.revision
+          })
+        }
+      });
     }
     return next;
   });
@@ -467,17 +1092,22 @@ async function transitionWorkflow(args) {
     try {
       await hook({ ...hookContext, doc: updated, event: events[0] });
     } catch (error) {
-      getObservabilityRuntime(config)?.recordWorkflowHookFailure({
-        collection: collection.slug,
-        transition: transition.name
-      });
-      getConfigLogger(config, "workflow").error({
-        err: error,
-        msg: "afterTransition hook failed",
-        collection: collection.slug,
-        transition: transition.name,
-        documentId: id
-      });
+      try {
+        const { getConfigLogger: getConfigLogger2, getObservabilityRuntime: getObservabilityRuntime2 } = await Promise.resolve().then(() => (init_observability(), observability_exports));
+        getObservabilityRuntime2(config)?.recordWorkflowHookFailure({
+          collection: collection.slug,
+          transition: transition.name
+        });
+        getConfigLogger2(config, "workflow").error({
+          err: error,
+          msg: "afterTransition hook failed",
+          collection: collection.slug,
+          transition: transition.name,
+          documentId: id
+        });
+      } catch {
+        console.error("afterTransition hook failed:", error);
+      }
     }
   }
   return updated;
@@ -611,25 +1241,370 @@ function normalizeSchemaFragment(fragment) {
 }
 
 // src/utils/declarative-hooks.ts
+var import_jexl2 = __toESM(require("jexl"), 1);
+
+// src/utils/jexl-helpers.ts
 var import_jexl = __toESM(require("jexl"), 1);
+function slugify(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase().trim().replace(/[^a-z0-9\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function lower(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).toLowerCase();
+}
+function upper(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).toUpperCase();
+}
+function trim(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).trim();
+}
+function capitalize(val) {
+  if (val === void 0 || val === null) return "";
+  const str = String(val).trim();
+  if (!str) return "";
+  return str.charAt(0).toUpperCase() + str.slice(1).toLowerCase();
+}
+function truncate(val, length2, ellipsis = "...") {
+  if (val === void 0 || val === null) return "";
+  const str = String(val);
+  const maxLen = typeof length2 === "number" && length2 > 0 ? length2 : 100;
+  if (str.length <= maxLen) return str;
+  return str.slice(0, maxLen).trim() + String(ellipsis ?? "...");
+}
+function readingTime(val, wpm = 200) {
+  if (val === void 0 || val === null) return 1;
+  const str = String(val).trim();
+  if (!str) return 1;
+  const words = str.split(/\s+/).filter(Boolean).length;
+  return Math.max(1, Math.ceil(words / (typeof wpm === "number" && wpm > 0 ? wpm : 200)));
+}
+function wordCount(val) {
+  if (val === void 0 || val === null) return 0;
+  const str = String(val).trim();
+  if (!str) return 0;
+  return str.split(/\s+/).filter(Boolean).length;
+}
+function replace(val, search, replacement) {
+  if (val === void 0 || val === null) return "";
+  return String(val).replace(new RegExp(String(search || ""), "g"), String(replacement ?? ""));
+}
+function startsWith(str, prefix) {
+  if (str === void 0 || str === null) return false;
+  return String(str).startsWith(String(prefix ?? ""));
+}
+function endsWith(str, suffix) {
+  if (str === void 0 || str === null) return false;
+  return String(str).endsWith(String(suffix ?? ""));
+}
+function now() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function today() {
+  return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+}
+function formatDate(val, style = "short") {
+  if (!val) return "";
+  const d = new Date(val);
+  if (Number.isNaN(d.getTime())) return "";
+  const styleStr = String(style).toLowerCase();
+  if (styleStr === "iso" || styleStr === "date") return d.toISOString().slice(0, 10);
+  if (styleStr === "datetime" || styleStr === "full") return d.toISOString();
+  return d.toLocaleDateString("en-US", {
+    year: "numeric",
+    month: "short",
+    day: "numeric"
+  });
+}
+function addDays(val, days) {
+  const d = val ? new Date(val) : /* @__PURE__ */ new Date();
+  if (Number.isNaN(d.getTime())) return "";
+  const daysNum = typeof days === "number" ? days : Number(days) || 0;
+  d.setDate(d.getDate() + daysNum);
+  return d.toISOString();
+}
+function diffDays(dateA, dateB) {
+  const dA = dateA ? new Date(dateA) : /* @__PURE__ */ new Date();
+  const dB = dateB ? new Date(dateB) : /* @__PURE__ */ new Date();
+  if (Number.isNaN(dA.getTime()) || Number.isNaN(dB.getTime())) return 0;
+  const diffMs = Math.abs(dA.getTime() - dB.getTime());
+  return Math.floor(diffMs / (1e3 * 60 * 60 * 24));
+}
+function isPast(val) {
+  if (!val) return false;
+  const d = new Date(val);
+  if (Number.isNaN(d.getTime())) return false;
+  return d.getTime() < Date.now();
+}
+function isFuture(val) {
+  if (!val) return false;
+  const d = new Date(val);
+  if (Number.isNaN(d.getTime())) return false;
+  return d.getTime() > Date.now();
+}
+function includes(arrOrStr, item) {
+  if (Array.isArray(arrOrStr)) {
+    return arrOrStr.includes(item);
+  }
+  if (typeof arrOrStr === "string") {
+    return arrOrStr.includes(String(item ?? ""));
+  }
+  return false;
+}
+function join(arr, separator = ", ") {
+  if (!Array.isArray(arr)) return "";
+  return arr.filter((item) => item !== void 0 && item !== null).join(String(separator));
+}
+function first(arr) {
+  if (Array.isArray(arr)) return arr[0] ?? null;
+  return null;
+}
+function last(arr) {
+  if (Array.isArray(arr)) return arr[arr.length - 1] ?? null;
+  return null;
+}
+function compact(arr) {
+  if (!Array.isArray(arr)) return [];
+  return arr.filter((item) => item !== void 0 && item !== null && item !== "");
+}
+function unique(arr) {
+  if (!Array.isArray(arr)) return [];
+  return Array.from(new Set(arr));
+}
+function length(val) {
+  if (Array.isArray(val) || typeof val === "string") return val.length;
+  if (val && typeof val === "object") return Object.keys(val).length;
+  return 0;
+}
+function round(val, decimals = 0) {
+  const num = Number(val);
+  if (Number.isNaN(num)) return 0;
+  const dec = typeof decimals === "number" ? decimals : Number(decimals) || 0;
+  const factor = Math.pow(10, dec);
+  return Math.round(num * factor) / factor;
+}
+function clamp(val, minVal, maxVal) {
+  const num = Number(val) || 0;
+  const min2 = Number(minVal) || 0;
+  const max2 = Number(maxVal) || 0;
+  return Math.min(Math.max(num, min2), max2);
+}
+function ceil(val) {
+  return Math.ceil(Number(val) || 0);
+}
+function floor(val) {
+  return Math.floor(Number(val) || 0);
+}
+function abs(val) {
+  return Math.abs(Number(val) || 0);
+}
+function min(...args) {
+  const nums = args.flat().map((n) => Number(n) || 0);
+  return nums.length ? Math.min(...nums) : 0;
+}
+function max(...args) {
+  const nums = args.flat().map((n) => Number(n) || 0);
+  return nums.length ? Math.max(...nums) : 0;
+}
+function pow(base, exp) {
+  return Math.pow(Number(base) || 0, Number(exp) || 0);
+}
+function sqrt(val) {
+  return Math.sqrt(Number(val) || 0);
+}
+function sum(arr) {
+  if (!Array.isArray(arr)) return Number(arr) || 0;
+  return arr.reduce((acc, val) => acc + (Number(val) || 0), 0);
+}
+function count(val) {
+  if (Array.isArray(val)) return val.length;
+  if (typeof val === "string") return val.length;
+  if (val !== void 0 && val !== null && val !== false) return 1;
+  return 0;
+}
+function defaultValue(val, fallback) {
+  if (val === void 0 || val === null || val === "") return fallback;
+  return val;
+}
+function coalesce(...args) {
+  for (const arg of args) {
+    if (arg !== void 0 && arg !== null && arg !== "") return arg;
+  }
+  return null;
+}
+function isEmpty(val) {
+  if (val === void 0 || val === null || val === "") return true;
+  if (Array.isArray(val)) return val.length === 0;
+  if (typeof val === "object") return Object.keys(val).length === 0;
+  return false;
+}
+function get(obj, path, fallback = null) {
+  if (obj === void 0 || obj === null || typeof obj !== "object") return fallback;
+  if (typeof path !== "string") return fallback;
+  const parts = path.split(".").filter(Boolean);
+  let curr = obj;
+  for (const part of parts) {
+    if (curr === void 0 || curr === null || typeof curr !== "object") return fallback;
+    curr = curr[part];
+  }
+  return curr === void 0 || curr === null ? fallback : curr;
+}
+function registerJexlHelpers(jexlInstance = import_jexl.default) {
+  const helpers = {
+    // Strings
+    slugify,
+    lower,
+    upper,
+    trim,
+    capitalize,
+    truncate,
+    readingTime,
+    wordCount,
+    replace,
+    startsWith,
+    endsWith,
+    // Dates
+    now,
+    today,
+    formatDate,
+    addDays,
+    diffDays,
+    isPast,
+    isFuture,
+    // Arrays
+    includes,
+    join,
+    first,
+    last,
+    compact,
+    unique,
+    length,
+    // Math
+    round,
+    clamp,
+    ceil,
+    floor,
+    abs,
+    min,
+    max,
+    pow,
+    sqrt,
+    sum,
+    count,
+    // Objects & Logical
+    default: defaultValue,
+    coalesce,
+    isEmpty,
+    get
+  };
+  for (const [name, fn] of Object.entries(helpers)) {
+    try {
+      jexlInstance.addFunction(name, fn);
+    } catch {
+    }
+    try {
+      jexlInstance.addTransform(name, fn);
+    } catch {
+    }
+  }
+  try {
+    jexlInstance.addBinaryOp("and", 20, (left, right) => Boolean(left && right));
+    jexlInstance.addBinaryOp("or", 10, (left, right) => Boolean(left || right));
+  } catch {
+  }
+}
+registerJexlHelpers(import_jexl.default);
+async function evaluateJexl(expression, context = {}) {
+  if (!expression || typeof expression !== "string") return void 0;
+  try {
+    const evalContext = {
+      null: null,
+      undefined: void 0,
+      ...context,
+      math: Math,
+      Math
+    };
+    return await import_jexl.default.eval(expression, evalContext);
+  } catch (_err) {
+    return void 0;
+  }
+}
+function evaluateJexlSync(expression, context = {}) {
+  if (!expression || typeof expression !== "string") return void 0;
+  try {
+    const evalContext = {
+      null: null,
+      undefined: void 0,
+      ...context,
+      math: Math,
+      Math
+    };
+    return import_jexl.default.evalSync(expression, evalContext);
+  } catch (_err) {
+    return void 0;
+  }
+}
+var BUILTIN_JEXL_HELPERS = [
+  // Strings
+  "slugify",
+  "lower",
+  "upper",
+  "trim",
+  "capitalize",
+  "truncate",
+  "readingTime",
+  "wordCount",
+  "replace",
+  "startsWith",
+  "endsWith",
+  // Dates
+  "now",
+  "today",
+  "formatDate",
+  "addDays",
+  "diffDays",
+  "isPast",
+  "isFuture",
+  // Arrays
+  "includes",
+  "join",
+  "first",
+  "last",
+  "compact",
+  "unique",
+  "length",
+  // Math
+  "round",
+  "clamp",
+  // Objects & Logical
+  "default",
+  "coalesce",
+  "isEmpty",
+  "get"
+];
+
+// src/utils/declarative-hooks.ts
+registerJexlHelpers(import_jexl2.default);
 var SURFACE_ROOTS = {
-  "collection.beforeRead": ["req", "user", "query"],
-  "collection.afterRead": ["req", "user", "doc"],
-  "collection.beforeChange": ["req", "user", "data", "doc", "operation"],
-  "global.beforeRead": ["req", "user", "query"],
-  "global.afterRead": ["req", "user", "doc"],
-  "global.beforeChange": ["req", "user", "data", "doc", "operation"],
-  "field.beforeChange": ["value", "data", "originalDoc", "user"],
-  "field.admin.onChange": ["value", "siblingData", "data"]
+  "collection.beforeRead": ["req", "user", "query", ...BUILTIN_JEXL_HELPERS],
+  "collection.afterRead": ["req", "user", "doc", ...BUILTIN_JEXL_HELPERS],
+  "collection.beforeChange": ["req", "user", "data", "doc", "operation", ...BUILTIN_JEXL_HELPERS],
+  "global.beforeRead": ["req", "user", "query", ...BUILTIN_JEXL_HELPERS],
+  "global.afterRead": ["req", "user", "doc", ...BUILTIN_JEXL_HELPERS],
+  "global.beforeChange": ["req", "user", "data", "doc", "operation", ...BUILTIN_JEXL_HELPERS],
+  "field.beforeChange": ["value", "data", "originalDoc", "user", ...BUILTIN_JEXL_HELPERS],
+  "field.admin.onChange": ["value", "siblingData", "data", ...BUILTIN_JEXL_HELPERS]
 };
-var ACCESS_ROOTS = ["user", "req", "doc", "data", "id", "config"];
-var ADMIN_CONDITION_RESERVED_ROOTS = ["data", "siblingData", "user", "id"];
-var PREVIEW_URL_RESERVED_ROOTS = ["siteUrl", "id"];
+var ACCESS_ROOTS = ["user", "req", "doc", "data", "id", "config", ...BUILTIN_JEXL_HELPERS];
+var ADMIN_CONDITION_RESERVED_ROOTS = ["data", "siblingData", "user", "id", ...BUILTIN_JEXL_HELPERS];
+var PREVIEW_URL_RESERVED_ROOTS = ["siteUrl", "id", ...BUILTIN_JEXL_HELPERS];
 var COMPILE_CACHE = /* @__PURE__ */ new Map();
 function compileExpression(expression) {
   const cached = COMPILE_CACHE.get(expression);
   if (cached) return cached;
-  const compiled = import_jexl.default.compile(expression);
+  const compiled = import_jexl2.default.compile(expression);
   const next = { ast: compiled._ast };
   COMPILE_CACHE.set(expression, next);
   return next;
@@ -1152,13 +2127,16 @@ function collectConfigDiagnostics(config) {
 function formatConfigDiagnostics(source, diagnostics, options = {}) {
   const color = options.color ?? false;
   const header = `${colorize("Config validation failed", 31, color)} in ${colorize(source, 36, color)}`;
+  const docLink = `${colorize("   Learn how to write declarative rules:", 90, color)} ${colorize("https://docs.dyrected.com/docs/editor-experience/form-and-field-hooks", 34, color)}`;
   const lines = diagnostics.flatMap((issue, index) => [
     `${colorize(`${index + 1}.`, 31, color)} ${colorize(issue.path, 1, color)}`,
     `   ${issue.message}`,
     `   ${colorize("surface:", 90, color)} ${issue.surface}`
   ]);
   return `${header}
-${lines.join("\n")}`;
+${lines.join("\n")}
+
+${docLink}`;
 }
 var ConfigValidationError = class extends Error {
   diagnostics;
@@ -1728,7 +2706,7 @@ function buildSqlOrderBy(sort, existingColumns, numericFields, dialect) {
 }
 
 // src/utils/hooks.ts
-var import_jexl2 = __toESM(require("jexl"), 1);
+var import_jexl3 = __toESM(require("jexl"), 1);
 async function runCollectionHooks(hooks, args, options = {}) {
   if (!hooks || hooks.length === 0) {
     return args.data ?? args.doc ?? args.query ?? void 0;
@@ -1749,7 +2727,7 @@ async function runCollectionHooks(hooks, args, options = {}) {
             options.path ?? options.surface
           );
         }
-        return import_jexl2.default.eval(hook, hookArgs);
+        return import_jexl3.default.eval(hook, hookArgs);
       })() : await hook(hookArgs);
       if (result !== void 0) {
         if (typeof hook === "string" && options.surface) {
@@ -1766,10 +2744,7 @@ async function runCollectionHooks(hooks, args, options = {}) {
       }
     } catch (err) {
       if (options.isolated) {
-        getConfigLogger(void 0, "hooks").error({
-          err,
-          msg: "Side-effect hook failed after a successful write"
-        });
+        console.error("Side-effect hook failed after a successful write", err);
       } else {
         throw err;
       }
@@ -1801,7 +2776,7 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db, pat
             "field.beforeChange",
             fieldPath
           );
-          return import_jexl2.default.eval(hook, hookArgs);
+          return import_jexl3.default.eval(hook, hookArgs);
         })() : await hook(hookArgs);
       }
       result[field.name] = updatedValue;
@@ -2367,6 +3342,71 @@ function generateOpenApi(config) {
         responses: { 200: { description: "Deleted and failed document IDs" } }
       }
     };
+    spec.paths[`${path}/aggregate`] = {
+      post: {
+        tags: [collectionTag],
+        summary: `Aggregate ${labels.plural}`,
+        description: `Compute statistical aggregations (count, sum, avg, min, max) across ${labels.plural}.`,
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                additionalProperties: {
+                  type: "object",
+                  properties: {
+                    count: { type: "string", example: "*" },
+                    sum: { type: "string", description: "Field to sum" },
+                    avg: { type: "string", description: "Field to average" },
+                    min: { type: "string", description: "Field for minimum" },
+                    max: { type: "string", description: "Field for maximum" },
+                    cast: {
+                      type: "string",
+                      enum: [
+                        "number",
+                        "integer",
+                        "float",
+                        "boolean",
+                        "date",
+                        "string"
+                      ]
+                    },
+                    where: {
+                      type: "object",
+                      description: "Per-aggregate filter condition",
+                      additionalProperties: true
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        responses: {
+          200: {
+            description: "Success",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  additionalProperties: {
+                    type: "number",
+                    nullable: true
+                  }
+                }
+              }
+            }
+          },
+          400: {
+            description: "Bad Request - Invalid aggregate input"
+          },
+          403: {
+            description: "Forbidden - Access denied by read rule"
+          }
+        }
+      }
+    };
     if (collection.audit) {
       spec.paths[`${path}/__audit`] = {
         get: {
@@ -2894,6 +3934,246 @@ function fieldToSchema(field) {
   return schema;
 }
 
+// src/detail.ts
+function normalizeDetailItem(item) {
+  if (typeof item === "string") {
+    return {
+      type: "field",
+      field: item
+    };
+  }
+  return item;
+}
+function displaySection(title, items, options) {
+  return {
+    type: "section",
+    title,
+    items,
+    options
+  };
+}
+function displayTab(label, items, options) {
+  return {
+    type: "tab",
+    label,
+    items,
+    options
+  };
+}
+function displayTabs(tabs, options) {
+  return {
+    type: "tabs",
+    tabs,
+    options
+  };
+}
+function displayGrid(columns, items, options) {
+  return {
+    type: "grid",
+    columns,
+    items,
+    options
+  };
+}
+function displayField(fieldName, options) {
+  return {
+    type: "field",
+    field: fieldName,
+    options
+  };
+}
+function displayRepeat(fieldName, items, options) {
+  return {
+    type: "repeat",
+    field: fieldName,
+    items,
+    options
+  };
+}
+function displayComputed(label, expressionOrOptionsOrHandler, options) {
+  let expression;
+  let handler;
+  let finalOptions = options;
+  if (typeof expressionOrOptionsOrHandler === "string") {
+    expression = expressionOrOptionsOrHandler;
+  } else if (typeof expressionOrOptionsOrHandler === "function") {
+    handler = expressionOrOptionsOrHandler;
+  } else if (expressionOrOptionsOrHandler && typeof expressionOrOptionsOrHandler === "object") {
+    expression = expressionOrOptionsOrHandler.expression;
+    handler = expressionOrOptionsOrHandler.handler;
+    finalOptions = {
+      ...expressionOrOptionsOrHandler,
+      ...options
+    };
+  }
+  const id = finalOptions?.id || label.toLowerCase().trim().replace(/[^a-z0-9]+/g, "_");
+  return {
+    type: "computed",
+    id,
+    label,
+    expression,
+    handler,
+    options: finalOptions
+  };
+}
+function displayDivider(options) {
+  return {
+    type: "divider",
+    options
+  };
+}
+function displayText(content, options) {
+  return {
+    type: "text",
+    content,
+    options
+  };
+}
+function displayCustom(name, options) {
+  return {
+    type: "custom",
+    name,
+    options
+  };
+}
+function displayCustomComponent(name, options) {
+  return displayCustom(name, options);
+}
+async function evaluateDetailComputed(detail, doc, user, db) {
+  if (!doc || !detail || !Array.isArray(detail)) {
+    return doc;
+  }
+  const computedItems = [];
+  const extractComputed = (items) => {
+    for (const rawItem of items) {
+      if (!rawItem) continue;
+      const item = normalizeDetailItem(rawItem);
+      if (item.type === "computed") {
+        const id = item.id || item.label?.toLowerCase().replace(/[^a-z0-9]+/g, "_");
+        if (id) {
+          computedItems.push({
+            id,
+            label: item.label,
+            expression: item.expression,
+            handler: item.handler
+          });
+        }
+      } else if (item.type === "section" || item.type === "grid" || item.type === "repeat") {
+        if (item.items && Array.isArray(item.items)) {
+          extractComputed(item.items);
+        }
+      } else if (item.type === "tabs" && item.tabs && Array.isArray(item.tabs)) {
+        for (const tab of item.tabs) {
+          if (tab.items) extractComputed(tab.items);
+        }
+      }
+    }
+  };
+  extractComputed(detail);
+  if (computedItems.length === 0) return doc;
+  const evaluated = {};
+  for (const item of computedItems) {
+    try {
+      if (typeof item.handler === "function") {
+        evaluated[item.id] = await item.handler({ doc, user, db });
+      } else if (item.expression) {
+        evaluated[item.id] = await evaluateJexl(item.expression, { doc, user });
+      }
+    } catch (_err) {
+      evaluated[item.id] = null;
+    }
+  }
+  return {
+    ...doc,
+    _meta: {
+      ...doc._meta || {},
+      computed: evaluated
+    }
+  };
+}
+var SENSITIVE_DETAIL_FIELDS = /* @__PURE__ */ new Set([
+  "password",
+  "salt",
+  "resetPasswordToken",
+  "resetPasswordExpires",
+  "loginAttempts",
+  "lockUntil",
+  "apiKey",
+  "secret"
+]);
+function generateDefaultDetailSchema(schema) {
+  const fields = schema.fields || [];
+  const sidebarFieldTypes = /* @__PURE__ */ new Set([
+    "select",
+    "radio",
+    "boolean",
+    "date",
+    "datetime",
+    "relationship"
+  ]);
+  const mainFields = [];
+  const sidebarFields = [];
+  for (const field of fields) {
+    if (!field.name) continue;
+    if (SENSITIVE_DETAIL_FIELDS.has(field.name)) continue;
+    if (field.hidden) continue;
+    if (field.admin?.hidden) continue;
+    const isSidebar = sidebarFieldTypes.has(field.type) && field.type !== "relationship" && !field.hasMany;
+    if (isSidebar && sidebarFields.length < 5) {
+      sidebarFields.push(
+        displayField(field.name, {
+          span: 12,
+          display: field.type === "select" || field.type === "radio" ? "badge" : void 0
+        })
+      );
+    } else {
+      const span = field.type === "richText" || field.type === "blocks" || field.type === "textarea" || field.type === "array" || field.type === "json" || field.type === "object" ? 12 : 6;
+      mainFields.push(
+        displayField(field.name, {
+          span
+        })
+      );
+    }
+  }
+  const sections = [];
+  const mainTitle = schema.labels?.singular || schema.label || "Details";
+  if (sidebarFields.length > 0) {
+    sections.push(
+      displaySection(mainTitle, mainFields, {
+        span: 8
+      })
+    );
+    sections.push(
+      displaySection("Overview", sidebarFields, {
+        span: 4
+      })
+    );
+  } else {
+    sections.push(
+      displaySection(mainTitle, mainFields, {
+        span: 12
+      })
+    );
+  }
+  return sections;
+}
+function isDetailItemVisible(item, doc, user) {
+  if (!item) return true;
+  const it = normalizeDetailItem(item);
+  const visible = it.options?.visible;
+  if (visible === void 0 || visible === null) return true;
+  if (typeof visible === "boolean") return visible;
+  if (typeof visible === "string") {
+    if (visible.trim().length === 0) return true;
+    try {
+      return Boolean(evaluateJexlSync(visible, { doc, user }));
+    } catch {
+      return true;
+    }
+  }
+  return true;
+}
+
 // src/index.ts
 function defineCollection(config) {
   return config;
@@ -2943,10 +4223,13 @@ function defineTab(args) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  BUILTIN_JEXL_HELPERS,
   ConfigValidationError,
   LIFECYCLE_EVENTS_COLLECTION,
   LIFECYCLE_EVENT_NAMES,
   WORKFLOW_HISTORY_COLLECTION,
+  abs,
+  addDays,
   assertValidAdminConditionsInConfig,
   assertValidDeclarativeAccessInConfig,
   assertValidDeclarativeHookExpression,
@@ -2956,13 +4239,20 @@ function defineTab(args) {
   availableWorkflowTransitions,
   buildSqlOrderBy,
   canViewWorkflowDraft,
+  capitalize,
+  ceil,
+  clamp,
+  coalesce,
   collectAdminConditionValidationIssues,
   collectConfigDiagnostics,
   collectDeclarativeAccessValidationIssues,
   collectDeclarativeHookValidationIssues,
   collectPreviewUrlValidationIssues,
+  compact,
+  count,
   createLifecycleEvent,
   createWorkflowDocument,
+  defaultValue,
   defineArrayField,
   defineBlock,
   defineBlocksField,
@@ -2992,32 +4282,81 @@ function defineTab(args) {
   defineTextareaField,
   defineTimeField,
   defineUrlField,
+  diffDays,
   dispatchLifecycleEvent,
   dispatchPendingLifecycleEvents,
+  displayComputed,
+  displayCustom,
+  displayCustomComponent,
+  displayDivider,
+  displayField,
+  displayGrid,
+  displayRepeat,
+  displaySection,
+  displayTab,
+  displayTabs,
+  displayText,
+  endsWith,
+  evaluateDetailComputed,
+  evaluateJexl,
+  evaluateJexlSync,
   executeFieldAfterRead,
   executeFieldBeforeChange,
+  first,
+  floor,
   formatConfigDiagnostics,
+  formatDate,
+  generateDefaultDetailSchema,
   generateOpenApi,
+  get,
   getAdminAuthCollection,
   getPublicAdminAuthConfig,
+  includes,
   initializeWorkflowDocument,
   isConfigValidationError,
+  isDetailItemVisible,
+  isEmpty,
+  isFuture,
+  isPast,
+  join,
+  last,
+  length,
+  lower,
   materializeWorkflowDocument,
+  max,
+  min,
   normalizeConfig,
+  normalizeDetailItem,
+  now,
   numericFieldNames,
   parseMongoWhere,
   parseSort,
   parseSqlWhere,
+  pow,
   publishedStateName,
   publishingWorkflow,
+  readingTime,
+  registerJexlHelpers,
+  replace,
   resolveAdminAuthCollection,
+  round,
   runCollectionHooks,
   saveWorkflowDraft,
   simplePublishingWorkflow,
+  slugify,
+  sqrt,
+  startsWith,
+  sum,
+  today,
   transitionWorkflow,
+  trim,
+  truncate,
+  unique,
+  upper,
   validateAdminConditionExpression,
   validateDeclarativeAccessExpression,
   validateDeclarativeHookExpression,
   validatePreviewUrlExpression,
+  wordCount,
   workflowCapabilities
 });