@dyrected/core 2.7.0 → 2.8.0

package/dist/server.cjs

@@ -30,838 +30,885 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// src/utils/where-sanitizer.ts
-var where_sanitizer_exports = {};
-__export(where_sanitizer_exports, {
-  sanitizeWhereClause: () => sanitizeWhereClause
+// src/observability.ts
+var observability_exports = {};
+__export(observability_exports, {
+  attachRequestMetrics: () => attachRequestMetrics,
+  bindObservabilityRuntime: () => bindObservabilityRuntime,
+  buildRequestLogger: () => buildRequestLogger,
+  captureRequestBody: () => captureRequestBody,
+  createObservabilityRuntime: () => createObservabilityRuntime,
+  createRequestSpan: () => createRequestSpan,
+  endRequestSpan: () => endRequestSpan,
+  getConfigLogger: () => getConfigLogger,
+  getObservabilityRuntime: () => getObservabilityRuntime,
+  getRequestLogger: () => getRequestLogger,
+  redactBody: () => redactBody,
+  redactHeaders: () => redactHeaders,
+  renderPrometheusMetrics: () => renderPrometheusMetrics,
+  resolveObservabilityConfig: () => resolveObservabilityConfig,
+  shouldSampleRequest: () => shouldSampleRequest
 });
-function sanitizeWhereClause(where, fields) {
-  const fieldMap = /* @__PURE__ */ new Map();
-  function addFieldsToMap(fList, prefix = "") {
-    for (const f of fList) {
-      if ("name" in f && f.name) {
-        fieldMap.set(prefix + f.name, f);
-      }
-      if (f.type === "object" || f.type === "row" || f.type === "array") {
-        if ("fields" in f && Array.isArray(f.fields)) {
-          addFieldsToMap(f.fields, f.type === "object" || f.type === "array" ? `${prefix}${f.name}.` : prefix);
-        }
-      }
+function resolveObservabilityConfig(config) {
+  const requestLogging = config?.requestLogging;
+  const sampling = config?.sampling;
+  const tracing = config?.tracing;
+  const metrics = config?.metrics;
+  return {
+    requestLogging: {
+      enabled: requestLogging?.enabled ?? true,
+      logBodies: requestLogging?.logBodies ?? false,
+      maxBodyBytes: requestLogging?.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES,
+      redactPaths: uniqueValues([
+        ...DEFAULT_REDACT_PATHS,
+        ...requestLogging?.redactPaths ?? []
+      ]),
+      includeHeaders: normalizeHeaderNames(requestLogging?.includeHeaders ?? []),
+      redactHeaders: uniqueValues(
+        normalizeHeaderNames([
+          ...DEFAULT_REDACT_HEADERS,
+          ...requestLogging?.redactHeaders ?? []
+        ])
+      )
+    },
+    sampling: {
+      successRate: clampRate(sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE),
+      traceSuccessRate: clampRate(
+        sampling?.traceSuccessRate ?? sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE
+      ),
+      bodySuccessRate: clampRate(
+        sampling?.bodySuccessRate ?? Math.min(DEFAULT_BODY_SAMPLE_RATE, sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE)
+      ),
+      alwaysKeep4xx: sampling?.alwaysKeep4xx ?? true,
+      alwaysKeep5xx: sampling?.alwaysKeep5xx ?? true
+    },
+    tracing: {
+      enabled: tracing?.enabled ?? false,
+      serviceName: tracing?.serviceName ?? "dyrected",
+      exporter: tracing?.exporter ?? "none",
+      headers: tracing?.headers ?? {},
+      endpoint: tracing?.endpoint
+    },
+    metrics: {
+      enabled: metrics?.enabled ?? false,
+      exporter: metrics?.exporter ?? "none",
+      endpoint: metrics?.endpoint,
+      path: metrics?.path ?? "/metrics"
+    },
+    transports: {
+      targets: config?.transports?.targets && config.transports.targets.length > 0 ? config.transports.targets : [{ type: "stdout" }]
     }
+  };
+}
+function createObservabilityRuntime(config) {
+  const resolved = resolveObservabilityConfig(config.observability);
+  const logger = createRootLogger(config.logger, resolved);
+  const shutdownTasks = [];
+  const meterRuntime = resolved.metrics.enabled || resolved.metrics.exporter === "prometheus" ? createMeterProvider(resolved) : void 0;
+  const tracerProvider = resolved.tracing.enabled ? createTracerProvider(resolved) : void 0;
+  const tracer = tracerProvider?.getTracer("dyrected");
+  const meter = meterRuntime?.provider.getMeter("dyrected");
+  const metrics = meter ? {
+    requestCount: meter.createCounter("dyrected_http_requests_total", {
+      description: "Total HTTP requests served by Dyrected"
+    }),
+    authFailureCount: meter.createCounter("dyrected_auth_failures_total", {
+      description: "Authentication failures"
+    }),
+    uncaughtErrorCount: meter.createCounter("dyrected_uncaught_errors_total", {
+      description: "Uncaught application errors"
+    }),
+    auditWriteFailureCount: meter.createCounter("dyrected_audit_write_failures_total", {
+      description: "Audit log persistence failures"
+    }),
+    emailSendFailureCount: meter.createCounter("dyrected_email_send_failures_total", {
+      description: "Transactional email delivery failures"
+    }),
+    workflowHookFailureCount: meter.createCounter("dyrected_workflow_hook_failures_total", {
+      description: "Workflow hook failures isolated after successful writes"
+    }),
+    requestDuration: meter.createHistogram("dyrected_http_request_duration_ms", {
+      description: "HTTP request duration in milliseconds",
+      unit: "ms"
+    })
+  } : void 0;
+  if (meterRuntime) {
+    shutdownTasks.push(() => meterRuntime.provider.shutdown());
   }
-  addFieldsToMap(fields);
-  function walk(node) {
-    const result = {};
-    for (const [key, value] of Object.entries(node)) {
-      if (key === "AND" || key === "OR") {
-        if (Array.isArray(value)) {
-          const processed = value.map((v) => walk(v)).filter((v) => Object.keys(v).length > 0);
-          if (processed.length > 0) {
-            result[key] = processed;
-          }
-        }
-        continue;
+  if (tracerProvider) {
+    shutdownTasks.push(() => tracerProvider.shutdown());
+  }
+  return {
+    logger,
+    config: resolved,
+    tracer,
+    metrics,
+    prometheusExporter: meterRuntime?.prometheusExporter,
+    shutdown: async () => {
+      for (const task of shutdownTasks) {
+        await task();
       }
-      if (key === "id") {
-        result[key] = value;
-        continue;
+    },
+    recordAuthFailure: (attributes) => metrics?.authFailureCount.add(1, attributes),
+    recordUncaughtError: (attributes) => metrics?.uncaughtErrorCount.add(1, attributes),
+    recordAuditWriteFailure: (attributes) => metrics?.auditWriteFailureCount.add(1, attributes),
+    recordEmailSendFailure: (attributes) => metrics?.emailSendFailureCount.add(1, attributes),
+    recordWorkflowHookFailure: (attributes) => metrics?.workflowHookFailureCount.add(1, attributes)
+  };
+}
+function bindObservabilityRuntime(config, runtime) {
+  runtimeByConfig.set(config, runtime);
+}
+function getObservabilityRuntime(config) {
+  if (!config || typeof config !== "object") return void 0;
+  return runtimeByConfig.get(config);
+}
+function createRootLogger(loggerConfig, observability) {
+  if (loggerConfig && !("options" in loggerConfig)) {
+    return loggerConfig;
+  }
+  const options = loggerConfig?.options ?? {};
+  const enabled = options.enabled ?? process.env.DISABLE_LOGGING !== "true";
+  const name = options.name ?? "dyrected";
+  if (loggerConfig?.destination) {
+    return (0, import_pino.default)(
+      {
+        ...options,
+        enabled,
+        name,
+        timestamp: options.timestamp ?? import_pino.stdTimeFunctions.isoTime
+      },
+      loggerConfig.destination
+    );
+  }
+  const streams = buildTransportStreams(observability);
+  const destination = streams.length === 1 ? streams[0] : (0, import_pino.multistream)(streams.map((stream) => ({ stream })));
+  return (0, import_pino.default)(
+    {
+      ...options,
+      enabled,
+      name,
+      timestamp: options.timestamp ?? import_pino.stdTimeFunctions.isoTime
+    },
+    destination
+  );
+}
+function buildTransportStreams(observability) {
+  const targets = observability.transports.targets;
+  if (targets.length === 0) {
+    return [defaultLoggerDestination()];
+  }
+  return targets.map((target) => {
+    switch (target.type) {
+      case "stdout":
+        return defaultLoggerDestination();
+      case "stderr":
+        return (0, import_pino.destination)(2);
+      case "file":
+        return (0, import_pino.destination)(target.path);
+      case "otlp":
+        return new OtlpLogWritable(target.endpoint, target.headers);
+    }
+  });
+}
+function defaultLoggerDestination() {
+  if (process.env.NODE_ENV !== "production" && typeof window === "undefined") {
+    try {
+      const req = globalThis.require;
+      if (req) {
+        const pinoPretty = req("pino-pretty");
+        return pinoPretty({
+          colorize: true,
+          ignore: "pid,hostname",
+          translateTime: "SYS:HH:MM:ss",
+          destination: 1,
+          sync: true
+        });
       }
-      const fieldDef = fieldMap.get(key);
-      if (!fieldDef) continue;
-      if (fieldDef.admin?.filterable === false) continue;
-      if (NEVER_FILTERABLE_TYPES.includes(fieldDef.type)) continue;
-      result[key] = value;
+    } catch {
     }
-    return result;
   }
-  return walk(where);
+  return (0, import_pino.destination)(1);
 }
-var NEVER_FILTERABLE_TYPES;
-var init_where_sanitizer = __esm({
-  "src/utils/where-sanitizer.ts"() {
-    "use strict";
-    NEVER_FILTERABLE_TYPES = [
-      "password",
-      "richText",
-      "json",
-      "file",
-      "image",
-      "join",
-      "collapsible"
-    ];
+function createTracerProvider(observability) {
+  const exporter = createTraceExporter(observability);
+  const provider = new import_sdk_trace_base.BasicTracerProvider({
+    resource: (0, import_resources.resourceFromAttributes)({
+      "service.name": observability.tracing.serviceName
+    }),
+    spanProcessors: exporter ? [new import_sdk_trace_base.BatchSpanProcessor(exporter)] : []
+  });
+  import_api.trace.setGlobalTracerProvider(provider);
+  return provider;
+}
+function createTraceExporter(observability) {
+  switch (observability.tracing.exporter) {
+    case "console":
+      return new import_sdk_trace_base.ConsoleSpanExporter();
+    case "otlp":
+      return new import_exporter_trace_otlp_http.OTLPTraceExporter({
+        url: observability.tracing.endpoint,
+        headers: observability.tracing.headers
+      });
+    default:
+      return void 0;
   }
-});
-
-// src/server.ts
-var server_exports = {};
-__export(server_exports, {
-  AuthController: () => AuthController,
-  CollectionController: () => CollectionController,
-  GlobalController: () => GlobalController,
-  MediaController: () => MediaController,
-  PreviewController: () => PreviewController,
-  createDyrectedApp: () => createDyrectedApp,
-  registerRoutes: () => registerRoutes
-});
-module.exports = __toCommonJS(server_exports);
-
-// src/app.ts
-var import_hono = require("hono");
-var import_cors = require("hono/cors");
-var import_request_id = require("hono/request-id");
-
-// src/services/defaults.service.ts
-var DefaultsService = class {
-  /**
-   * Recursively apply default values to a data object based on field definitions.
-   */
-  static apply(fields, data = {}) {
-    const result = { ...data || {} };
-    fields.forEach((field) => {
-      if (field.type === "join") return;
-      if (field.type === "row" && field.fields) {
-        Object.assign(result, this.apply(field.fields, data));
-        return;
-      }
-      if (!field.name) return;
-      let value = result[field.name];
-      if ((value === void 0 || value === null) && field.renameTo) {
-        const legacyValue = result[field.renameTo];
-        if (legacyValue !== void 0 && legacyValue !== null) {
-          value = legacyValue;
-          result[field.name] = legacyValue;
-        }
-      }
-      if (value === void 0 || value === null) {
-        if (field.defaultValue !== void 0) {
-          result[field.name] = field.defaultValue;
-        } else {
-          if (field.type === "boolean") result[field.name] = false;
-          else if (field.type === "array") result[field.name] = [];
-          else if (field.type === "multiSelect") result[field.name] = [];
-          else if (field.type === "object") {
-            result[field.name] = this.apply(field.fields || [], {});
-          }
-        }
-      } else if (field.type === "object" && field.fields) {
-        result[field.name] = this.apply(field.fields, value);
-      } else if (field.type === "array" && field.fields && Array.isArray(value)) {
-        result[field.name] = value.map((item) => this.apply(field.fields, item));
-      }
-    });
-    return result;
+}
+function createMeterProvider(observability) {
+  const readers = [];
+  let prometheusExporter;
+  switch (observability.metrics.exporter) {
+    case "otlp":
+      readers.push(
+        new import_sdk_metrics.PeriodicExportingMetricReader({
+          exporter: new import_exporter_metrics_otlp_http.OTLPMetricExporter({
+            url: observability.metrics.endpoint
+          })
+        })
+      );
+      break;
+    case "prometheus":
+      prometheusExporter = new import_exporter_prometheus.PrometheusExporter({
+        endpoint: observability.metrics.path,
+        preventServerStart: true
+      });
+      readers.push(prometheusExporter);
+      break;
   }
-};
-
-// src/services/population.service.ts
-var import_jexl = __toESM(require("jexl"), 1);
-var PopulationService = class {
-  db;
-  collections;
-  constructor(db, collections) {
-    this.db = db;
-    this.collections = collections;
+  const provider = new import_sdk_metrics.MeterProvider({
+    resource: (0, import_resources.resourceFromAttributes)({
+      "service.name": observability.tracing.serviceName
+    }),
+    readers
+  });
+  return { provider, prometheusExporter };
+}
+function getConfigLogger(config, component) {
+  const base = config?.logger && !("options" in config.logger) ? config.logger : fallbackLogger;
+  return base.child({ component });
+}
+function getRequestLogger(c, component) {
+  const base = c.get("logger") ?? fallbackLogger;
+  return component ? base.child({ component }) : base;
+}
+function buildRequestLogger(runtime, vars, requestId2) {
+  const trace2 = vars.requestTrace;
+  return runtime.logger.child({
+    requestId: requestId2,
+    siteId: vars.siteId,
+    workspaceId: vars.workspaceId,
+    traceId: trace2?.traceId,
+    spanId: trace2?.spanId
+  });
+}
+function shouldSampleRequest(requestId2, statusCode, sampling, kind) {
+  if (statusCode >= 500 && sampling.alwaysKeep5xx) return true;
+  if (statusCode >= 400 && sampling.alwaysKeep4xx) return true;
+  const rate = kind === "trace" ? sampling.traceSuccessRate : kind === "body" ? sampling.bodySuccessRate : sampling.successRate;
+  return deterministicSample(requestId2 ?? "no-request-id", rate);
+}
+function redactHeaders(headers, observability) {
+  const includeHeaders = new Set(observability.requestLogging.includeHeaders);
+  const redactHeaders2 = new Set(observability.requestLogging.redactHeaders);
+  const output = {};
+  for (const [key, value] of Object.entries(headers)) {
+    const normalizedKey = key.toLowerCase();
+    if (includeHeaders.size > 0 && !includeHeaders.has(normalizedKey)) continue;
+    output[normalizedKey] = redactHeaders2.has(normalizedKey) ? REDACTED_VALUE : value;
   }
-  /**
-   * Recursively populate relationship fields in a document or array of documents.
-   */
-  async populate(args) {
-    const { data, fields, currentDepth = 0, maxDepth = 10 } = args;
-    if (currentDepth >= maxDepth || !data) {
-      return data;
+  return output;
+}
+async function captureRequestBody(request, observability) {
+  const contentType = request.headers.get("content-type") ?? void 0;
+  const contentLength = toNumber(request.headers.get("content-length"));
+  const jsonBody = contentType?.includes("application/json");
+  if (!jsonBody) {
+    return {
+      attempted: false,
+      contentType,
+      contentLength
+    };
+  }
+  try {
+    const text = await request.clone().text();
+    if (!text) {
+      return { attempted: true, contentType, contentLength };
     }
-    if (Array.isArray(data)) {
-      return Promise.all(
-        data.map((item) => this.populate({ ...args, data: item }))
-      );
+    const truncated = text.length > observability.requestLogging.maxBodyBytes;
+    const raw = truncated ? text.slice(0, observability.requestLogging.maxBodyBytes) : text;
+    try {
+      const parsed = JSON.parse(raw);
+      return {
+        attempted: true,
+        contentType,
+        contentLength: contentLength ?? text.length,
+        truncated,
+        body: redactBody(parsed, observability.requestLogging.redactPaths)
+      };
+    } catch {
+      return {
+        attempted: true,
+        contentType,
+        contentLength: contentLength ?? text.length,
+        truncated,
+        parseFailed: true
+      };
     }
-    const populatedDoc = { ...data };
-    for (const field of fields) {
-      if (field.type === "join" && field.collection && field.on && currentDepth < maxDepth) {
-        const targetCollection = this.collections.find(
-          (c) => c.slug === field.collection
-        );
-        if (targetCollection) {
-          const docId = populatedDoc.id;
-          if (docId) {
-            const where = { [field.on]: { equals: docId } };
-            const joinLimit = field.limit ?? 10;
-            const result = await this.db.find({
-              collection: field.collection,
-              where,
-              limit: joinLimit
-            });
-            const populatedDocs = await this.populate({
-              data: result.docs.map(
-                (doc) => DefaultsService.apply(targetCollection.fields, doc)
-              ),
-              fields: targetCollection.fields,
-              currentDepth: currentDepth + 1,
-              maxDepth
-            });
-            populatedDoc[field.name] = {
-              docs: populatedDocs,
-              hasNextPage: result.page * result.limit < result.total,
-              totalDocs: result.total
-            };
-          }
-        }
-        continue;
-      }
-      if (field.type === "row" && field.fields) {
-        const rowPopulated = await this.populate({
-          data,
-          fields: field.fields,
-          currentDepth,
-          maxDepth
-        });
-        Object.assign(populatedDoc, rowPopulated);
-        continue;
+  } catch {
+    return {
+      attempted: true,
+      contentType,
+      contentLength,
+      parseFailed: true
+    };
+  }
+}
+function redactBody(value, redactPaths) {
+  const cloned = deepClone(value);
+  for (const path of redactPaths) {
+    applyRedaction(cloned, path.split("."));
+  }
+  return cloned;
+}
+function applyRedaction(target, segments) {
+  if (!target || segments.length === 0) return;
+  const [segment, ...rest] = segments;
+  if (Array.isArray(target)) {
+    for (const item of target) {
+      if (segment === "*") {
+        applyRedaction(item, rest);
+      } else {
+        applyRedaction(item, segments);
       }
-      if (!field.name) continue;
-      const value = populatedDoc[field.name];
-      if (field.type === "relationship" && field.relationTo && value) {
-        const relatedCollection = this.collections.find(
-          (c) => c.slug === field.relationTo
-        );
-        if (!relatedCollection) continue;
-        if (Array.isArray(value)) {
-          populatedDoc[field.name] = await Promise.all(
-            value.map(async (id) => {
-              if (!id) return id;
-              let doc = id;
-              if (typeof id === "string") {
-                doc = await this.db.findOne({
-                  collection: field.relationTo,
-                  id
-                });
-              }
-              if (!doc || typeof doc !== "object") return id;
-              const docWithDefaults = DefaultsService.apply(
-                relatedCollection.fields,
-                doc
-              );
-              return this.populate({
-                data: docWithDefaults,
-                fields: relatedCollection.fields,
-                currentDepth: currentDepth + 1,
-                maxDepth
-              });
-            })
-          );
-        } else if (value) {
-          let doc = value;
-          if (typeof value === "string") {
-            doc = await this.db.findOne({
-              collection: field.relationTo,
-              id: value
-            });
-          }
-          if (doc && typeof doc === "object") {
-            const docWithDefaults = DefaultsService.apply(
-              relatedCollection.fields,
-              doc
-            );
-            populatedDoc[field.name] = await this.populate({
-              data: docWithDefaults,
-              fields: relatedCollection.fields,
-              currentDepth: currentDepth + 1,
-              maxDepth
-            });
-          }
-        }
-      }
-      if (field.type === "url" && value && typeof value === "object" && value.type === "internal" && value.relationTo && value.value) {
-        const relatedCollection = this.collections.find(
-          (c) => c.slug === value.relationTo
-        );
-        if (relatedCollection) {
-          const doc = await this.db.findOne({
-            collection: value.relationTo,
-            id: value.value
-          });
-          if (doc && typeof doc === "object") {
-            const docWithDefaults = DefaultsService.apply(
-              relatedCollection.fields,
-              doc
-            );
-            const populatedDocValue = await this.populate({
-              data: docWithDefaults,
-              fields: relatedCollection.fields,
-              currentDepth: currentDepth + 1,
-              maxDepth
-            });
-            const identifier = docWithDefaults.slug || docWithDefaults.id;
-            let resolvedUrl = `/collections/${value.relationTo}/${identifier}`;
-            const previewUrlPattern = relatedCollection.admin?.previewUrl || relatedCollection.admin?.urlPattern;
-            if (previewUrlPattern) {
-              if (typeof previewUrlPattern === "function") {
-                try {
-                  resolvedUrl = previewUrlPattern(docWithDefaults, { locale: "en" }) || resolvedUrl;
-                } catch {
-                }
-              } else if (typeof previewUrlPattern === "string") {
-                if (previewUrlPattern.includes("{{")) {
-                  resolvedUrl = previewUrlPattern.replace(
-                    /{{(.*?)}}/g,
-                    (_, key) => String(docWithDefaults[key.trim()] || "")
-                  );
-                } else if (previewUrlPattern.includes("+") || previewUrlPattern.includes("?") || previewUrlPattern.includes("==") || previewUrlPattern.includes("siteUrl")) {
-                  try {
-                    resolvedUrl = import_jexl.default.evalSync(
-                      previewUrlPattern,
-                      docWithDefaults
-                    );
-                  } catch (_err) {
-                    resolvedUrl = previewUrlPattern.replace(
-                      /:([a-zA-Z0-9_]+)/g,
-                      (_, key) => String(docWithDefaults[key] || "")
-                    );
-                  }
-                } else {
-                  resolvedUrl = previewUrlPattern.replace(
-                    /:([a-zA-Z0-9_]+)/g,
-                    (_, key) => String(docWithDefaults[key] || "")
-                  );
-                }
-              }
-            }
-            populatedDoc[field.name] = {
-              ...value,
-              url: resolvedUrl,
-              doc: populatedDocValue
-            };
-          }
-        }
+    }
+    return;
+  }
+  if (typeof target !== "object") return;
+  const record = target;
+  if (segment === "*") {
+    for (const value of Object.values(record)) {
+      applyRedaction(value, rest);
+    }
+    return;
+  }
+  if (!(segment in record)) return;
+  if (rest.length === 0) {
+    record[segment] = REDACTED_VALUE;
+    return;
+  }
+  applyRedaction(record[segment], rest);
+}
+function deepClone(value) {
+  if (typeof structuredClone === "function") {
+    return structuredClone(value);
+  }
+  return JSON.parse(JSON.stringify(value));
+}
+function createRequestSpan(runtime, name, attributes) {
+  if (!runtime.tracer) return void 0;
+  const span = runtime.tracer.startSpan(name, { attributes }, import_api.context.active());
+  const spanContext = span.spanContext();
+  return {
+    span,
+    traceId: spanContext.traceId,
+    spanId: spanContext.spanId,
+    sampled: spanContext.traceFlags === import_api.TraceFlags.SAMPLED
+  };
+}
+function endRequestSpan(requestTrace, statusCode, error) {
+  if (!requestTrace) return;
+  requestTrace.span.setAttribute("http.status_code", statusCode);
+  if (error) {
+    requestTrace.span.recordException(error instanceof Error ? error : new Error(String(error)));
+  }
+  requestTrace.span.end();
+}
+function attachRequestMetrics(runtime, args) {
+  runtime.metrics?.requestCount.add(1, {
+    method: args.method,
+    route: args.route,
+    status_class: `${Math.floor(args.statusCode / 100)}xx`
+  });
+  runtime.metrics?.requestDuration.record(args.durationMs, {
+    method: args.method,
+    route: args.route,
+    status_class: `${Math.floor(args.statusCode / 100)}xx`
+  });
+}
+async function renderPrometheusMetrics(exporter) {
+  let statusCode = 200;
+  const headers = {};
+  let body = "";
+  await new Promise((resolve) => {
+    const response = {
+      statusCode,
+      setHeader(name, value) {
+        headers[name.toLowerCase()] = value;
+      },
+      end(chunk) {
+        if (chunk) body += chunk;
+        statusCode = this.statusCode;
+        resolve();
       }
-      if ((field.type === "array" || field.type === "object") && field.fields && value) {
-        populatedDoc[field.name] = await this.populate({
-          data: value,
-          fields: field.fields,
-          currentDepth,
-          // Nested fields don't consume depth, only relationships do
-          maxDepth
-        });
+    };
+    exporter.getMetricsRequestHandler({}, response);
+  });
+  return { body, headers, statusCode };
+}
+function normalizeHeaderNames(headers) {
+  return headers.map((value) => value.toLowerCase());
+}
+function uniqueValues(values) {
+  return [...new Set(values)];
+}
+function clampRate(value) {
+  if (Number.isNaN(value)) return 0;
+  return Math.max(0, Math.min(1, value));
+}
+function deterministicSample(seed, rate) {
+  if (rate >= 1) return true;
+  if (rate <= 0) return false;
+  let hash = 0;
+  for (let index = 0; index < seed.length; index += 1) {
+    hash = hash * 31 + seed.charCodeAt(index) >>> 0;
+  }
+  return hash / 4294967295 <= rate;
+}
+function toNumber(value) {
+  if (!value) return void 0;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : void 0;
+}
+var import_api, import_exporter_metrics_otlp_http, import_exporter_prometheus, import_exporter_trace_otlp_http, import_resources, import_sdk_metrics, import_sdk_trace_base, import_pino, import_node_stream, DEFAULT_REDACT_HEADERS, DEFAULT_REDACT_PATHS, DEFAULT_MAX_BODY_BYTES, DEFAULT_SUCCESS_SAMPLE_RATE, DEFAULT_BODY_SAMPLE_RATE, REDACTED_VALUE, runtimeByConfig, fallbackLogger, OtlpLogWritable;
+var init_observability = __esm({
+  "src/observability.ts"() {
+    "use strict";
+    import_api = require("@opentelemetry/api");
+    import_exporter_metrics_otlp_http = require("@opentelemetry/exporter-metrics-otlp-http");
+    import_exporter_prometheus = require("@opentelemetry/exporter-prometheus");
+    import_exporter_trace_otlp_http = require("@opentelemetry/exporter-trace-otlp-http");
+    import_resources = require("@opentelemetry/resources");
+    import_sdk_metrics = require("@opentelemetry/sdk-metrics");
+    import_sdk_trace_base = require("@opentelemetry/sdk-trace-base");
+    import_pino = __toESM(require("pino"), 1);
+    import_node_stream = require("stream");
+    DEFAULT_REDACT_HEADERS = ["authorization", "cookie", "set-cookie", "x-api-key"];
+    DEFAULT_REDACT_PATHS = [
+      "password",
+      "currentPassword",
+      "newPassword",
+      "confirmPassword",
+      "token",
+      "refreshToken",
+      "accessToken",
+      "secret",
+      "apiKey",
+      "inviteToken",
+      "resetToken"
+    ];
+    DEFAULT_MAX_BODY_BYTES = 8192;
+    DEFAULT_SUCCESS_SAMPLE_RATE = 0.1;
+    DEFAULT_BODY_SAMPLE_RATE = 0.02;
+    REDACTED_VALUE = "[REDACTED]";
+    runtimeByConfig = /* @__PURE__ */ new WeakMap();
+    fallbackLogger = (0, import_pino.default)({
+      name: "dyrected",
+      enabled: process.env.DISABLE_LOGGING !== "true",
+      timestamp: import_pino.stdTimeFunctions.isoTime
+    });
+    OtlpLogWritable = class extends import_node_stream.Writable {
+      constructor(endpoint, headers = {}) {
+        super();
+        this.endpoint = endpoint;
+        this.headers = headers;
       }
-      if (field.type === "blocks" && field.blocks && Array.isArray(value)) {
-        populatedDoc[field.name] = await Promise.all(
-          value.map(async (blockData) => {
-            const blockConfig = field.blocks.find(
-              (b) => b.slug === blockData.blockType
-            );
-            if (!blockConfig) return blockData;
-            return this.populate({
-              data: blockData,
-              fields: blockConfig.fields,
-              currentDepth,
-              maxDepth
-            });
-          })
+      endpoint;
+      headers;
+      _write(chunk, _encoding, callback) {
+        const payload = chunk.toString();
+        void fetch(this.endpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            ...this.headers
+          },
+          body: JSON.stringify({ logs: payload.trim().split("\n").filter(Boolean) })
+        }).then(() => callback()).catch(
+          (error) => callback(error instanceof Error ? error : new Error(String(error)))
         );
       }
-    }
-    return populatedDoc;
-  }
-  /**
-   * Helper to populate a PaginatedResult
-   */
-  async populateResult(result, fields, maxDepth) {
-    if (maxDepth <= 0) return result;
-    const populatedDocs = await this.populate({
-      data: result.docs,
-      fields,
-      currentDepth: 0,
-      maxDepth
-    });
-    return {
-      ...result,
-      docs: populatedDocs
     };
   }
-};
+});
 
-// src/observability.ts
-var import_api = require("@opentelemetry/api");
-var import_exporter_metrics_otlp_http = require("@opentelemetry/exporter-metrics-otlp-http");
-var import_exporter_prometheus = require("@opentelemetry/exporter-prometheus");
-var import_exporter_trace_otlp_http = require("@opentelemetry/exporter-trace-otlp-http");
-var import_resources = require("@opentelemetry/resources");
-var import_sdk_metrics = require("@opentelemetry/sdk-metrics");
-var import_sdk_trace_base = require("@opentelemetry/sdk-trace-base");
-var import_pino = __toESM(require("pino"), 1);
-var import_pino_pretty = __toESM(require("pino-pretty"), 1);
-var import_node_stream = require("stream");
-var DEFAULT_REDACT_HEADERS = ["authorization", "cookie", "set-cookie", "x-api-key"];
-var DEFAULT_REDACT_PATHS = [
-  "password",
-  "currentPassword",
-  "newPassword",
-  "confirmPassword",
-  "token",
-  "refreshToken",
-  "accessToken",
-  "secret",
-  "apiKey",
-  "inviteToken",
-  "resetToken"
-];
-var DEFAULT_MAX_BODY_BYTES = 8192;
-var DEFAULT_SUCCESS_SAMPLE_RATE = 0.1;
-var DEFAULT_BODY_SAMPLE_RATE = 0.02;
-var REDACTED_VALUE = "[REDACTED]";
-var runtimeByConfig = /* @__PURE__ */ new WeakMap();
-var fallbackLogger = (0, import_pino.default)({
-  name: "dyrected",
-  enabled: process.env.DISABLE_LOGGING !== "true",
-  timestamp: import_pino.stdTimeFunctions.isoTime
+// src/utils/where-sanitizer.ts
+var where_sanitizer_exports = {};
+__export(where_sanitizer_exports, {
+  sanitizeWhereClause: () => sanitizeWhereClause
 });
-function resolveObservabilityConfig(config) {
-  const requestLogging = config?.requestLogging;
-  const sampling = config?.sampling;
-  const tracing = config?.tracing;
-  const metrics = config?.metrics;
-  return {
-    requestLogging: {
-      enabled: requestLogging?.enabled ?? true,
-      logBodies: requestLogging?.logBodies ?? false,
-      maxBodyBytes: requestLogging?.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES,
-      redactPaths: uniqueValues([
-        ...DEFAULT_REDACT_PATHS,
-        ...requestLogging?.redactPaths ?? []
-      ]),
-      includeHeaders: normalizeHeaderNames(requestLogging?.includeHeaders ?? []),
-      redactHeaders: uniqueValues(
-        normalizeHeaderNames([
-          ...DEFAULT_REDACT_HEADERS,
-          ...requestLogging?.redactHeaders ?? []
-        ])
-      )
-    },
-    sampling: {
-      successRate: clampRate(sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE),
-      traceSuccessRate: clampRate(
-        sampling?.traceSuccessRate ?? sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE
-      ),
-      bodySuccessRate: clampRate(
-        sampling?.bodySuccessRate ?? Math.min(DEFAULT_BODY_SAMPLE_RATE, sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE)
-      ),
-      alwaysKeep4xx: sampling?.alwaysKeep4xx ?? true,
-      alwaysKeep5xx: sampling?.alwaysKeep5xx ?? true
-    },
-    tracing: {
-      enabled: tracing?.enabled ?? false,
-      serviceName: tracing?.serviceName ?? "dyrected",
-      exporter: tracing?.exporter ?? "none",
-      headers: tracing?.headers ?? {},
-      endpoint: tracing?.endpoint
-    },
-    metrics: {
-      enabled: metrics?.enabled ?? false,
-      exporter: metrics?.exporter ?? "none",
-      endpoint: metrics?.endpoint,
-      path: metrics?.path ?? "/metrics"
-    },
-    transports: {
-      targets: config?.transports?.targets && config.transports.targets.length > 0 ? config.transports.targets : [{ type: "stdout" }]
+function sanitizeWhereClause(where, fields) {
+  const fieldMap = /* @__PURE__ */ new Map();
+  function addFieldsToMap(fList, prefix = "") {
+    for (const f of fList) {
+      if ("name" in f && f.name) {
+        fieldMap.set(prefix + f.name, f);
+      }
+      if (f.type === "object" || f.type === "row" || f.type === "array") {
+        if ("fields" in f && Array.isArray(f.fields)) {
+          addFieldsToMap(f.fields, f.type === "object" || f.type === "array" ? `${prefix}${f.name}.` : prefix);
+        }
+      }
     }
-  };
-}
-function createObservabilityRuntime(config) {
-  const resolved = resolveObservabilityConfig(config.observability);
-  const logger = createRootLogger(config.logger, resolved);
-  const shutdownTasks = [];
-  const meterRuntime = resolved.metrics.enabled || resolved.metrics.exporter === "prometheus" ? createMeterProvider(resolved) : void 0;
-  const tracerProvider = resolved.tracing.enabled ? createTracerProvider(resolved) : void 0;
-  const tracer = tracerProvider?.getTracer("dyrected");
-  const meter = meterRuntime?.provider.getMeter("dyrected");
-  const metrics = meter ? {
-    requestCount: meter.createCounter("dyrected_http_requests_total", {
-      description: "Total HTTP requests served by Dyrected"
-    }),
-    authFailureCount: meter.createCounter("dyrected_auth_failures_total", {
-      description: "Authentication failures"
-    }),
-    uncaughtErrorCount: meter.createCounter("dyrected_uncaught_errors_total", {
-      description: "Uncaught application errors"
-    }),
-    auditWriteFailureCount: meter.createCounter("dyrected_audit_write_failures_total", {
-      description: "Audit log persistence failures"
-    }),
-    emailSendFailureCount: meter.createCounter("dyrected_email_send_failures_total", {
-      description: "Transactional email delivery failures"
-    }),
-    workflowHookFailureCount: meter.createCounter("dyrected_workflow_hook_failures_total", {
-      description: "Workflow hook failures isolated after successful writes"
-    }),
-    requestDuration: meter.createHistogram("dyrected_http_request_duration_ms", {
-      description: "HTTP request duration in milliseconds",
-      unit: "ms"
-    })
-  } : void 0;
-  if (meterRuntime) {
-    shutdownTasks.push(() => meterRuntime.provider.shutdown());
-  }
-  if (tracerProvider) {
-    shutdownTasks.push(() => tracerProvider.shutdown());
   }
-  return {
-    logger,
-    config: resolved,
-    tracer,
-    metrics,
-    prometheusExporter: meterRuntime?.prometheusExporter,
-    shutdown: async () => {
-      for (const task of shutdownTasks) {
-        await task();
+  addFieldsToMap(fields);
+  function walk(node) {
+    const result = {};
+    for (const [key, value] of Object.entries(node)) {
+      if (key === "AND" || key === "OR") {
+        if (Array.isArray(value)) {
+          const processed = value.map((v) => walk(v)).filter((v) => Object.keys(v).length > 0);
+          if (processed.length > 0) {
+            result[key] = processed;
+          }
+        }
+        continue;
       }
-    },
-    recordAuthFailure: (attributes) => metrics?.authFailureCount.add(1, attributes),
-    recordUncaughtError: (attributes) => metrics?.uncaughtErrorCount.add(1, attributes),
-    recordAuditWriteFailure: (attributes) => metrics?.auditWriteFailureCount.add(1, attributes),
-    recordEmailSendFailure: (attributes) => metrics?.emailSendFailureCount.add(1, attributes),
-    recordWorkflowHookFailure: (attributes) => metrics?.workflowHookFailureCount.add(1, attributes)
-  };
-}
-function bindObservabilityRuntime(config, runtime) {
-  runtimeByConfig.set(config, runtime);
-}
-function getObservabilityRuntime(config) {
-  if (!config || typeof config !== "object") return void 0;
-  return runtimeByConfig.get(config);
-}
-function createRootLogger(loggerConfig, observability) {
-  if (loggerConfig && !("options" in loggerConfig)) {
-    return loggerConfig;
-  }
-  const options = loggerConfig?.options ?? {};
-  const enabled = options.enabled ?? process.env.DISABLE_LOGGING !== "true";
-  const name = options.name ?? "dyrected";
-  if (loggerConfig?.destination) {
-    return (0, import_pino.default)(
-      {
-        ...options,
-        enabled,
-        name,
-        timestamp: options.timestamp ?? import_pino.stdTimeFunctions.isoTime
-      },
-      loggerConfig.destination
-    );
+      if (key === "id") {
+        result[key] = value;
+        continue;
+      }
+      const fieldDef = fieldMap.get(key);
+      if (!fieldDef) continue;
+      if (fieldDef.admin?.filterable === false) continue;
+      if (NEVER_FILTERABLE_TYPES.includes(fieldDef.type)) continue;
+      result[key] = value;
+    }
+    return result;
   }
-  const streams = buildTransportStreams(observability);
-  const destination = streams.length === 1 ? streams[0] : (0, import_pino.multistream)(streams.map((stream) => ({ stream })));
-  return (0, import_pino.default)(
-    {
-      ...options,
-      enabled,
-      name,
-      timestamp: options.timestamp ?? import_pino.stdTimeFunctions.isoTime
-    },
-    destination
-  );
+  return walk(where);
 }
-function buildTransportStreams(observability) {
-  const targets = observability.transports.targets;
-  if (targets.length === 0) {
-    return [defaultLoggerDestination()];
+var NEVER_FILTERABLE_TYPES;
+var init_where_sanitizer = __esm({
+  "src/utils/where-sanitizer.ts"() {
+    "use strict";
+    NEVER_FILTERABLE_TYPES = [
+      "password",
+      "richText",
+      "json",
+      "file",
+      "image",
+      "join",
+      "collapsible"
+    ];
   }
-  return targets.map((target) => {
-    switch (target.type) {
-      case "stdout":
-        return defaultLoggerDestination();
-      case "stderr":
-        return (0, import_pino.destination)(2);
-      case "file":
-        return (0, import_pino.destination)(target.path);
-      case "otlp":
-        return new OtlpLogWritable(target.endpoint, target.headers);
-    }
-  });
-}
-function defaultLoggerDestination() {
-  if (process.env.NODE_ENV !== "production") {
-    return (0, import_pino_pretty.default)({
-      colorize: true,
-      ignore: "pid,hostname",
-      translateTime: "SYS:HH:MM:ss",
-      destination: 1,
-      sync: true
+});
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  AuthController: () => AuthController,
+  CollectionController: () => CollectionController,
+  GlobalController: () => GlobalController,
+  MediaController: () => MediaController,
+  PreviewController: () => PreviewController,
+  attachRequestMetrics: () => attachRequestMetrics,
+  bindObservabilityRuntime: () => bindObservabilityRuntime,
+  buildRequestLogger: () => buildRequestLogger,
+  captureRequestBody: () => captureRequestBody,
+  createDyrectedApp: () => createDyrectedApp,
+  createObservabilityRuntime: () => createObservabilityRuntime,
+  createRequestSpan: () => createRequestSpan,
+  endRequestSpan: () => endRequestSpan,
+  getConfigLogger: () => getConfigLogger,
+  getObservabilityRuntime: () => getObservabilityRuntime,
+  getRequestLogger: () => getRequestLogger,
+  redactBody: () => redactBody,
+  redactHeaders: () => redactHeaders,
+  registerRoutes: () => registerRoutes,
+  renderPrometheusMetrics: () => renderPrometheusMetrics,
+  resolveObservabilityConfig: () => resolveObservabilityConfig,
+  serializeDetailForApi: () => serializeDetailForApi,
+  shouldSampleRequest: () => shouldSampleRequest
+});
+module.exports = __toCommonJS(server_exports);
+
+// src/app.ts
+var import_hono = require("hono");
+var import_cors = require("hono/cors");
+var import_request_id = require("hono/request-id");
+
+// src/services/defaults.service.ts
+var DefaultsService = class {
+  /**
+   * Recursively apply default values to a data object based on field definitions.
+   */
+  static apply(fields, data = {}) {
+    const result = { ...data || {} };
+    fields.forEach((field) => {
+      if (field.type === "join") return;
+      if (field.type === "row" && field.fields) {
+        Object.assign(result, this.apply(field.fields, data));
+        return;
+      }
+      if (!field.name) return;
+      let value = result[field.name];
+      if ((value === void 0 || value === null) && field.renameTo) {
+        const legacyValue = result[field.renameTo];
+        if (legacyValue !== void 0 && legacyValue !== null) {
+          value = legacyValue;
+          result[field.name] = legacyValue;
+        }
+      }
+      if (value === void 0 || value === null) {
+        if (field.defaultValue !== void 0) {
+          result[field.name] = field.defaultValue;
+        } else {
+          if (field.type === "boolean") result[field.name] = false;
+          else if (field.type === "array") result[field.name] = [];
+          else if (field.type === "multiSelect") result[field.name] = [];
+          else if (field.type === "object") {
+            result[field.name] = this.apply(field.fields || [], {});
+          }
+        }
+      } else if (field.type === "object" && field.fields) {
+        result[field.name] = this.apply(field.fields, value);
+      } else if (field.type === "array" && field.fields && Array.isArray(value)) {
+        result[field.name] = value.map((item) => this.apply(field.fields, item));
+      }
     });
-  }
-  return (0, import_pino.destination)(1);
-}
-var OtlpLogWritable = class extends import_node_stream.Writable {
-  constructor(endpoint, headers = {}) {
-    super();
-    this.endpoint = endpoint;
-    this.headers = headers;
-  }
-  endpoint;
-  headers;
-  _write(chunk, _encoding, callback) {
-    const payload = chunk.toString();
-    void fetch(this.endpoint, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        ...this.headers
-      },
-      body: JSON.stringify({ logs: payload.trim().split("\n").filter(Boolean) })
-    }).then(() => callback()).catch(
-      (error) => callback(error instanceof Error ? error : new Error(String(error)))
-    );
+    return result;
   }
 };
-function createTracerProvider(observability) {
-  const exporter = createTraceExporter(observability);
-  const provider = new import_sdk_trace_base.BasicTracerProvider({
-    resource: (0, import_resources.resourceFromAttributes)({
-      "service.name": observability.tracing.serviceName
-    }),
-    spanProcessors: exporter ? [new import_sdk_trace_base.BatchSpanProcessor(exporter)] : []
-  });
-  import_api.trace.setGlobalTracerProvider(provider);
-  return provider;
-}
-function createTraceExporter(observability) {
-  switch (observability.tracing.exporter) {
-    case "console":
-      return new import_sdk_trace_base.ConsoleSpanExporter();
-    case "otlp":
-      return new import_exporter_trace_otlp_http.OTLPTraceExporter({
-        url: observability.tracing.endpoint,
-        headers: observability.tracing.headers
-      });
-    default:
-      return void 0;
-  }
-}
-function createMeterProvider(observability) {
-  const readers = [];
-  let prometheusExporter;
-  switch (observability.metrics.exporter) {
-    case "otlp":
-      readers.push(
-        new import_sdk_metrics.PeriodicExportingMetricReader({
-          exporter: new import_exporter_metrics_otlp_http.OTLPMetricExporter({
-            url: observability.metrics.endpoint
-          })
-        })
-      );
-      break;
-    case "prometheus":
-      prometheusExporter = new import_exporter_prometheus.PrometheusExporter({
-        endpoint: observability.metrics.path,
-        preventServerStart: true
-      });
-      readers.push(prometheusExporter);
-      break;
-  }
-  const provider = new import_sdk_metrics.MeterProvider({
-    resource: (0, import_resources.resourceFromAttributes)({
-      "service.name": observability.tracing.serviceName
-    }),
-    readers
-  });
-  return { provider, prometheusExporter };
-}
-function getConfigLogger(config, component) {
-  const base = config?.logger && !("options" in config.logger) ? config.logger : fallbackLogger;
-  return base.child({ component });
-}
-function getRequestLogger(c, component) {
-  const base = c.get("logger") ?? fallbackLogger;
-  return component ? base.child({ component }) : base;
-}
-function buildRequestLogger(runtime, vars, requestId2) {
-  const trace2 = vars.requestTrace;
-  return runtime.logger.child({
-    requestId: requestId2,
-    siteId: vars.siteId,
-    workspaceId: vars.workspaceId,
-    traceId: trace2?.traceId,
-    spanId: trace2?.spanId
-  });
-}
-function shouldSampleRequest(requestId2, statusCode, sampling, kind) {
-  if (statusCode >= 500 && sampling.alwaysKeep5xx) return true;
-  if (statusCode >= 400 && sampling.alwaysKeep4xx) return true;
-  const rate = kind === "trace" ? sampling.traceSuccessRate : kind === "body" ? sampling.bodySuccessRate : sampling.successRate;
-  return deterministicSample(requestId2 ?? "no-request-id", rate);
-}
-function redactHeaders(headers, observability) {
-  const includeHeaders = new Set(observability.requestLogging.includeHeaders);
-  const redactHeaders2 = new Set(observability.requestLogging.redactHeaders);
-  const output = {};
-  for (const [key, value] of Object.entries(headers)) {
-    const normalizedKey = key.toLowerCase();
-    if (includeHeaders.size > 0 && !includeHeaders.has(normalizedKey)) continue;
-    output[normalizedKey] = redactHeaders2.has(normalizedKey) ? REDACTED_VALUE : value;
-  }
-  return output;
-}
-async function captureRequestBody(request, observability) {
-  const contentType = request.headers.get("content-type") ?? void 0;
-  const contentLength = toNumber(request.headers.get("content-length"));
-  const jsonBody = contentType?.includes("application/json");
-  if (!jsonBody) {
-    return {
-      attempted: false,
-      contentType,
-      contentLength
-    };
+
+// src/services/population.service.ts
+var import_jexl = __toESM(require("jexl"), 1);
+var PopulationService = class {
+  db;
+  collections;
+  constructor(db, collections) {
+    this.db = db;
+    this.collections = collections;
   }
-  try {
-    const text = await request.clone().text();
-    if (!text) {
-      return { attempted: true, contentType, contentLength };
+  /**
+   * Recursively populate relationship fields in a document or array of documents.
+   */
+  async populate(args) {
+    const { data, fields, currentDepth = 0, maxDepth = 10 } = args;
+    if (currentDepth >= maxDepth || !data) {
+      return data;
     }
-    const truncated = text.length > observability.requestLogging.maxBodyBytes;
-    const raw = truncated ? text.slice(0, observability.requestLogging.maxBodyBytes) : text;
-    try {
-      const parsed = JSON.parse(raw);
-      return {
-        attempted: true,
-        contentType,
-        contentLength: contentLength ?? text.length,
-        truncated,
-        body: redactBody(parsed, observability.requestLogging.redactPaths)
-      };
-    } catch {
-      return {
-        attempted: true,
-        contentType,
-        contentLength: contentLength ?? text.length,
-        truncated,
-        parseFailed: true
-      };
+    if (Array.isArray(data)) {
+      return Promise.all(
+        data.map((item) => this.populate({ ...args, data: item }))
+      );
     }
-  } catch {
-    return {
-      attempted: true,
-      contentType,
-      contentLength,
-      parseFailed: true
-    };
-  }
-}
-function redactBody(value, redactPaths) {
-  const cloned = deepClone(value);
-  for (const path of redactPaths) {
-    applyRedaction(cloned, path.split("."));
-  }
-  return cloned;
-}
-function applyRedaction(target, segments) {
-  if (!target || segments.length === 0) return;
-  const [segment, ...rest] = segments;
-  if (Array.isArray(target)) {
-    for (const item of target) {
-      if (segment === "*") {
-        applyRedaction(item, rest);
-      } else {
-        applyRedaction(item, segments);
+    const populatedDoc = { ...data };
+    for (const field of fields) {
+      if (field.type === "join" && field.collection && field.on && currentDepth < maxDepth) {
+        const targetCollection = this.collections.find(
+          (c) => c.slug === field.collection
+        );
+        if (targetCollection) {
+          const docId = populatedDoc.id;
+          if (docId) {
+            const where = { [field.on]: { equals: docId } };
+            const joinLimit = field.limit ?? 10;
+            const result = await this.db.find({
+              collection: field.collection,
+              where,
+              limit: joinLimit
+            });
+            const populatedDocs = await this.populate({
+              data: result.docs.map(
+                (doc) => DefaultsService.apply(targetCollection.fields, doc)
+              ),
+              fields: targetCollection.fields,
+              currentDepth: currentDepth + 1,
+              maxDepth
+            });
+            populatedDoc[field.name] = {
+              docs: populatedDocs,
+              hasNextPage: result.page * result.limit < result.total,
+              totalDocs: result.total
+            };
+          }
+        }
+        continue;
       }
-    }
-    return;
-  }
-  if (typeof target !== "object") return;
-  const record = target;
-  if (segment === "*") {
-    for (const value of Object.values(record)) {
-      applyRedaction(value, rest);
-    }
-    return;
-  }
-  if (!(segment in record)) return;
-  if (rest.length === 0) {
-    record[segment] = REDACTED_VALUE;
-    return;
-  }
-  applyRedaction(record[segment], rest);
-}
-function deepClone(value) {
-  if (typeof structuredClone === "function") {
-    return structuredClone(value);
-  }
-  return JSON.parse(JSON.stringify(value));
-}
-function createRequestSpan(runtime, name, attributes) {
-  if (!runtime.tracer) return void 0;
-  const span = runtime.tracer.startSpan(name, { attributes }, import_api.context.active());
-  const spanContext = span.spanContext();
-  return {
-    span,
-    traceId: spanContext.traceId,
-    spanId: spanContext.spanId,
-    sampled: spanContext.traceFlags === import_api.TraceFlags.SAMPLED
-  };
-}
-function endRequestSpan(requestTrace, statusCode, error) {
-  if (!requestTrace) return;
-  requestTrace.span.setAttribute("http.status_code", statusCode);
-  if (error) {
-    requestTrace.span.recordException(error instanceof Error ? error : new Error(String(error)));
-  }
-  requestTrace.span.end();
-}
-function attachRequestMetrics(runtime, args) {
-  runtime.metrics?.requestCount.add(1, {
-    method: args.method,
-    route: args.route,
-    status_class: `${Math.floor(args.statusCode / 100)}xx`
-  });
-  runtime.metrics?.requestDuration.record(args.durationMs, {
-    method: args.method,
-    route: args.route,
-    status_class: `${Math.floor(args.statusCode / 100)}xx`
-  });
-}
-async function renderPrometheusMetrics(exporter) {
-  let statusCode = 200;
-  const headers = {};
-  let body = "";
-  await new Promise((resolve) => {
-    const response = {
-      statusCode,
-      setHeader(name, value) {
-        headers[name.toLowerCase()] = value;
-      },
-      end(chunk) {
-        if (chunk) body += chunk;
-        statusCode = this.statusCode;
-        resolve();
+      if (field.type === "row" && field.fields) {
+        const rowPopulated = await this.populate({
+          data,
+          fields: field.fields,
+          currentDepth,
+          maxDepth
+        });
+        Object.assign(populatedDoc, rowPopulated);
+        continue;
+      }
+      if (!field.name) continue;
+      const value = populatedDoc[field.name];
+      if (field.type === "relationship" && field.relationTo && value) {
+        const relatedCollection = this.collections.find(
+          (c) => c.slug === field.relationTo
+        );
+        if (!relatedCollection) continue;
+        if (Array.isArray(value)) {
+          populatedDoc[field.name] = await Promise.all(
+            value.map(async (id) => {
+              if (!id) return id;
+              let doc = id;
+              if (typeof id === "string") {
+                doc = await this.db.findOne({
+                  collection: field.relationTo,
+                  id
+                });
+              }
+              if (!doc || typeof doc !== "object") return id;
+              const docWithDefaults = DefaultsService.apply(
+                relatedCollection.fields,
+                doc
+              );
+              return this.populate({
+                data: docWithDefaults,
+                fields: relatedCollection.fields,
+                currentDepth: currentDepth + 1,
+                maxDepth
+              });
+            })
+          );
+        } else if (value) {
+          let doc = value;
+          if (typeof value === "string") {
+            doc = await this.db.findOne({
+              collection: field.relationTo,
+              id: value
+            });
+          }
+          if (doc && typeof doc === "object") {
+            const docWithDefaults = DefaultsService.apply(
+              relatedCollection.fields,
+              doc
+            );
+            populatedDoc[field.name] = await this.populate({
+              data: docWithDefaults,
+              fields: relatedCollection.fields,
+              currentDepth: currentDepth + 1,
+              maxDepth
+            });
+          }
+        }
+      }
+      if (field.type === "url" && value && typeof value === "object" && value.type === "internal" && value.relationTo && value.value) {
+        const relatedCollection = this.collections.find(
+          (c) => c.slug === value.relationTo
+        );
+        if (relatedCollection) {
+          const doc = await this.db.findOne({
+            collection: value.relationTo,
+            id: value.value
+          });
+          if (doc && typeof doc === "object") {
+            const docWithDefaults = DefaultsService.apply(
+              relatedCollection.fields,
+              doc
+            );
+            const populatedDocValue = await this.populate({
+              data: docWithDefaults,
+              fields: relatedCollection.fields,
+              currentDepth: currentDepth + 1,
+              maxDepth
+            });
+            const identifier = docWithDefaults.slug || docWithDefaults.id;
+            let resolvedUrl = `/collections/${value.relationTo}/${identifier}`;
+            const previewUrlPattern = relatedCollection.admin?.previewUrl || relatedCollection.admin?.urlPattern;
+            if (previewUrlPattern) {
+              if (typeof previewUrlPattern === "function") {
+                try {
+                  resolvedUrl = previewUrlPattern(docWithDefaults, { locale: "en" }) || resolvedUrl;
+                } catch {
+                }
+              } else if (typeof previewUrlPattern === "string") {
+                if (previewUrlPattern.includes("{{")) {
+                  resolvedUrl = previewUrlPattern.replace(
+                    /{{(.*?)}}/g,
+                    (_, key) => String(docWithDefaults[key.trim()] || "")
+                  );
+                } else if (previewUrlPattern.includes("+") || previewUrlPattern.includes("?") || previewUrlPattern.includes("==") || previewUrlPattern.includes("siteUrl")) {
+                  try {
+                    resolvedUrl = import_jexl.default.evalSync(
+                      previewUrlPattern,
+                      docWithDefaults
+                    );
+                  } catch (_err) {
+                    resolvedUrl = previewUrlPattern.replace(
+                      /:([a-zA-Z0-9_]+)/g,
+                      (_, key) => String(docWithDefaults[key] || "")
+                    );
+                  }
+                } else {
+                  resolvedUrl = previewUrlPattern.replace(
+                    /:([a-zA-Z0-9_]+)/g,
+                    (_, key) => String(docWithDefaults[key] || "")
+                  );
+                }
+              }
+            }
+            populatedDoc[field.name] = {
+              ...value,
+              url: resolvedUrl,
+              doc: populatedDocValue
+            };
+          }
+        }
+      }
+      if ((field.type === "array" || field.type === "object") && field.fields && value) {
+        populatedDoc[field.name] = await this.populate({
+          data: value,
+          fields: field.fields,
+          currentDepth,
+          // Nested fields don't consume depth, only relationships do
+          maxDepth
+        });
       }
+      if (field.type === "blocks" && field.blocks && Array.isArray(value)) {
+        populatedDoc[field.name] = await Promise.all(
+          value.map(async (blockData) => {
+            const blockConfig = field.blocks.find(
+              (b) => b.slug === blockData.blockType
+            );
+            if (!blockConfig) return blockData;
+            return this.populate({
+              data: blockData,
+              fields: blockConfig.fields,
+              currentDepth,
+              maxDepth
+            });
+          })
+        );
+      }
+    }
+    return populatedDoc;
+  }
+  /**
+   * Helper to populate a PaginatedResult
+   */
+  async populateResult(result, fields, maxDepth) {
+    if (maxDepth <= 0) return result;
+    const populatedDocs = await this.populate({
+      data: result.docs,
+      fields,
+      currentDepth: 0,
+      maxDepth
+    });
+    return {
+      ...result,
+      docs: populatedDocs
     };
-    exporter.getMetricsRequestHandler({}, response);
-  });
-  return { body, headers, statusCode };
-}
-function normalizeHeaderNames(headers) {
-  return headers.map((value) => value.toLowerCase());
-}
-function uniqueValues(values) {
-  return [...new Set(values)];
-}
-function clampRate(value) {
-  if (Number.isNaN(value)) return 0;
-  return Math.max(0, Math.min(1, value));
-}
-function deterministicSample(seed, rate) {
-  if (rate >= 1) return true;
-  if (rate <= 0) return false;
-  let hash = 0;
-  for (let index = 0; index < seed.length; index += 1) {
-    hash = hash * 31 + seed.charCodeAt(index) >>> 0;
   }
-  return hash / 4294967295 <= rate;
-}
-function toNumber(value) {
-  if (!value) return void 0;
-  const parsed = Number(value);
-  return Number.isFinite(parsed) ? parsed : void 0;
-}
+};
 
 // src/services/audit.service.ts
+init_observability();
 var AuditService = class {
   /**
    * Writes a single entry to the __audit collection.
@@ -921,7 +968,6 @@ async function verifyPassword(plain, stored) {
 
 // src/auth/token.ts
 var import_jose = require("jose");
-var import_node_util2 = require("util");
 function getSecret() {
   const secret = process.env.DYRECTED_JWT_SECRET;
   if (!secret) {
@@ -929,7 +975,7 @@ function getSecret() {
       "[dyrected/core] DYRECTED_JWT_SECRET is not set. Add it to your environment variables to enable auth collections."
     );
   }
-  return new import_node_util2.TextEncoder().encode(secret);
+  return new TextEncoder().encode(secret);
 }
 var DEFAULT_EXPIRY = "7d";
 async function signCollectionToken(payload, expiresIn = DEFAULT_EXPIRY) {
@@ -951,7 +997,7 @@ function decodeCollectionToken(token) {
 var AUTH_SESSIONS_COLLECTION = "__auth_sessions";
 async function issueAuthSessionToken(args) {
   const sessionId = createSessionId();
-  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const now2 = (/* @__PURE__ */ new Date()).toISOString();
   const db = args.config.db;
   if (db) {
     await db.create({
@@ -964,7 +1010,7 @@ async function issueAuthSessionToken(args) {
         authSource: args.authSource ?? "local",
         providerId: args.providerId,
         lastIp: args.ip,
-        lastSeenAt: now,
+        lastSeenAt: now2,
         revokedAt: null,
         expiresAt: null
       }
@@ -989,7 +1035,7 @@ async function issueAuthSessionToken(args) {
       id: sessionId,
       data: {
         expiresAt,
-        lastSeenAt: now,
+        lastSeenAt: now2,
         lastIp: args.ip
       }
     });
@@ -1065,28 +1111,358 @@ function createSessionId() {
 }
 
 // src/utils/hooks.ts
-var import_jexl3 = __toESM(require("jexl"), 1);
+var import_jexl4 = __toESM(require("jexl"), 1);
 
 // src/utils/declarative-hooks.ts
+var import_jexl3 = __toESM(require("jexl"), 1);
+
+// src/utils/jexl-helpers.ts
 var import_jexl2 = __toESM(require("jexl"), 1);
+function slugify(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase().trim().replace(/[^a-z0-9\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function lower(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).toLowerCase();
+}
+function upper(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).toUpperCase();
+}
+function trim(val) {
+  if (val === void 0 || val === null) return "";
+  return String(val).trim();
+}
+function capitalize(val) {
+  if (val === void 0 || val === null) return "";
+  const str = String(val).trim();
+  if (!str) return "";
+  return str.charAt(0).toUpperCase() + str.slice(1).toLowerCase();
+}
+function truncate(val, length2, ellipsis = "...") {
+  if (val === void 0 || val === null) return "";
+  const str = String(val);
+  const maxLen = typeof length2 === "number" && length2 > 0 ? length2 : 100;
+  if (str.length <= maxLen) return str;
+  return str.slice(0, maxLen).trim() + String(ellipsis ?? "...");
+}
+function readingTime(val, wpm = 200) {
+  if (val === void 0 || val === null) return 1;
+  const str = String(val).trim();
+  if (!str) return 1;
+  const words = str.split(/\s+/).filter(Boolean).length;
+  return Math.max(1, Math.ceil(words / (typeof wpm === "number" && wpm > 0 ? wpm : 200)));
+}
+function wordCount(val) {
+  if (val === void 0 || val === null) return 0;
+  const str = String(val).trim();
+  if (!str) return 0;
+  return str.split(/\s+/).filter(Boolean).length;
+}
+function replace(val, search, replacement) {
+  if (val === void 0 || val === null) return "";
+  return String(val).replace(new RegExp(String(search || ""), "g"), String(replacement ?? ""));
+}
+function startsWith(str, prefix) {
+  if (str === void 0 || str === null) return false;
+  return String(str).startsWith(String(prefix ?? ""));
+}
+function endsWith(str, suffix) {
+  if (str === void 0 || str === null) return false;
+  return String(str).endsWith(String(suffix ?? ""));
+}
+function now() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function today() {
+  return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+}
+function formatDate(val, style = "short") {
+  if (!val) return "";
+  const d = new Date(val);
+  if (Number.isNaN(d.getTime())) return "";
+  const styleStr = String(style).toLowerCase();
+  if (styleStr === "iso" || styleStr === "date") return d.toISOString().slice(0, 10);
+  if (styleStr === "datetime" || styleStr === "full") return d.toISOString();
+  return d.toLocaleDateString("en-US", {
+    year: "numeric",
+    month: "short",
+    day: "numeric"
+  });
+}
+function addDays(val, days) {
+  const d = val ? new Date(val) : /* @__PURE__ */ new Date();
+  if (Number.isNaN(d.getTime())) return "";
+  const daysNum = typeof days === "number" ? days : Number(days) || 0;
+  d.setDate(d.getDate() + daysNum);
+  return d.toISOString();
+}
+function diffDays(dateA, dateB) {
+  const dA = dateA ? new Date(dateA) : /* @__PURE__ */ new Date();
+  const dB = dateB ? new Date(dateB) : /* @__PURE__ */ new Date();
+  if (Number.isNaN(dA.getTime()) || Number.isNaN(dB.getTime())) return 0;
+  const diffMs = Math.abs(dA.getTime() - dB.getTime());
+  return Math.floor(diffMs / (1e3 * 60 * 60 * 24));
+}
+function isPast(val) {
+  if (!val) return false;
+  const d = new Date(val);
+  if (Number.isNaN(d.getTime())) return false;
+  return d.getTime() < Date.now();
+}
+function isFuture(val) {
+  if (!val) return false;
+  const d = new Date(val);
+  if (Number.isNaN(d.getTime())) return false;
+  return d.getTime() > Date.now();
+}
+function includes(arrOrStr, item) {
+  if (Array.isArray(arrOrStr)) {
+    return arrOrStr.includes(item);
+  }
+  if (typeof arrOrStr === "string") {
+    return arrOrStr.includes(String(item ?? ""));
+  }
+  return false;
+}
+function join(arr, separator = ", ") {
+  if (!Array.isArray(arr)) return "";
+  return arr.filter((item) => item !== void 0 && item !== null).join(String(separator));
+}
+function first(arr) {
+  if (Array.isArray(arr)) return arr[0] ?? null;
+  return null;
+}
+function last(arr) {
+  if (Array.isArray(arr)) return arr[arr.length - 1] ?? null;
+  return null;
+}
+function compact(arr) {
+  if (!Array.isArray(arr)) return [];
+  return arr.filter((item) => item !== void 0 && item !== null && item !== "");
+}
+function unique(arr) {
+  if (!Array.isArray(arr)) return [];
+  return Array.from(new Set(arr));
+}
+function length(val) {
+  if (Array.isArray(val) || typeof val === "string") return val.length;
+  if (val && typeof val === "object") return Object.keys(val).length;
+  return 0;
+}
+function round(val, decimals = 0) {
+  const num = Number(val);
+  if (Number.isNaN(num)) return 0;
+  const dec = typeof decimals === "number" ? decimals : Number(decimals) || 0;
+  const factor = Math.pow(10, dec);
+  return Math.round(num * factor) / factor;
+}
+function clamp(val, minVal, maxVal) {
+  const num = Number(val) || 0;
+  const min2 = Number(minVal) || 0;
+  const max2 = Number(maxVal) || 0;
+  return Math.min(Math.max(num, min2), max2);
+}
+function ceil(val) {
+  return Math.ceil(Number(val) || 0);
+}
+function floor(val) {
+  return Math.floor(Number(val) || 0);
+}
+function abs(val) {
+  return Math.abs(Number(val) || 0);
+}
+function min(...args) {
+  const nums = args.flat().map((n) => Number(n) || 0);
+  return nums.length ? Math.min(...nums) : 0;
+}
+function max(...args) {
+  const nums = args.flat().map((n) => Number(n) || 0);
+  return nums.length ? Math.max(...nums) : 0;
+}
+function pow(base, exp) {
+  return Math.pow(Number(base) || 0, Number(exp) || 0);
+}
+function sqrt(val) {
+  return Math.sqrt(Number(val) || 0);
+}
+function sum(arr) {
+  if (!Array.isArray(arr)) return Number(arr) || 0;
+  return arr.reduce((acc, val) => acc + (Number(val) || 0), 0);
+}
+function count(val) {
+  if (Array.isArray(val)) return val.length;
+  if (typeof val === "string") return val.length;
+  if (val !== void 0 && val !== null && val !== false) return 1;
+  return 0;
+}
+function defaultValue(val, fallback) {
+  if (val === void 0 || val === null || val === "") return fallback;
+  return val;
+}
+function coalesce(...args) {
+  for (const arg of args) {
+    if (arg !== void 0 && arg !== null && arg !== "") return arg;
+  }
+  return null;
+}
+function isEmpty(val) {
+  if (val === void 0 || val === null || val === "") return true;
+  if (Array.isArray(val)) return val.length === 0;
+  if (typeof val === "object") return Object.keys(val).length === 0;
+  return false;
+}
+function get(obj, path, fallback = null) {
+  if (obj === void 0 || obj === null || typeof obj !== "object") return fallback;
+  if (typeof path !== "string") return fallback;
+  const parts = path.split(".").filter(Boolean);
+  let curr = obj;
+  for (const part of parts) {
+    if (curr === void 0 || curr === null || typeof curr !== "object") return fallback;
+    curr = curr[part];
+  }
+  return curr === void 0 || curr === null ? fallback : curr;
+}
+function registerJexlHelpers(jexlInstance = import_jexl2.default) {
+  const helpers = {
+    // Strings
+    slugify,
+    lower,
+    upper,
+    trim,
+    capitalize,
+    truncate,
+    readingTime,
+    wordCount,
+    replace,
+    startsWith,
+    endsWith,
+    // Dates
+    now,
+    today,
+    formatDate,
+    addDays,
+    diffDays,
+    isPast,
+    isFuture,
+    // Arrays
+    includes,
+    join,
+    first,
+    last,
+    compact,
+    unique,
+    length,
+    // Math
+    round,
+    clamp,
+    ceil,
+    floor,
+    abs,
+    min,
+    max,
+    pow,
+    sqrt,
+    sum,
+    count,
+    // Objects & Logical
+    default: defaultValue,
+    coalesce,
+    isEmpty,
+    get
+  };
+  for (const [name, fn] of Object.entries(helpers)) {
+    try {
+      jexlInstance.addFunction(name, fn);
+    } catch {
+    }
+    try {
+      jexlInstance.addTransform(name, fn);
+    } catch {
+    }
+  }
+  try {
+    jexlInstance.addBinaryOp("and", 20, (left, right) => Boolean(left && right));
+    jexlInstance.addBinaryOp("or", 10, (left, right) => Boolean(left || right));
+  } catch {
+  }
+}
+registerJexlHelpers(import_jexl2.default);
+async function evaluateJexl(expression, context = {}) {
+  if (!expression || typeof expression !== "string") return void 0;
+  try {
+    const evalContext = {
+      null: null,
+      undefined: void 0,
+      ...context,
+      math: Math,
+      Math
+    };
+    return await import_jexl2.default.eval(expression, evalContext);
+  } catch (_err) {
+    return void 0;
+  }
+}
+var BUILTIN_JEXL_HELPERS = [
+  // Strings
+  "slugify",
+  "lower",
+  "upper",
+  "trim",
+  "capitalize",
+  "truncate",
+  "readingTime",
+  "wordCount",
+  "replace",
+  "startsWith",
+  "endsWith",
+  // Dates
+  "now",
+  "today",
+  "formatDate",
+  "addDays",
+  "diffDays",
+  "isPast",
+  "isFuture",
+  // Arrays
+  "includes",
+  "join",
+  "first",
+  "last",
+  "compact",
+  "unique",
+  "length",
+  // Math
+  "round",
+  "clamp",
+  // Objects & Logical
+  "default",
+  "coalesce",
+  "isEmpty",
+  "get"
+];
+
+// src/utils/declarative-hooks.ts
+registerJexlHelpers(import_jexl3.default);
 var SURFACE_ROOTS = {
-  "collection.beforeRead": ["req", "user", "query"],
-  "collection.afterRead": ["req", "user", "doc"],
-  "collection.beforeChange": ["req", "user", "data", "doc", "operation"],
-  "global.beforeRead": ["req", "user", "query"],
-  "global.afterRead": ["req", "user", "doc"],
-  "global.beforeChange": ["req", "user", "data", "doc", "operation"],
-  "field.beforeChange": ["value", "data", "originalDoc", "user"],
-  "field.admin.onChange": ["value", "siblingData", "data"]
+  "collection.beforeRead": ["req", "user", "query", ...BUILTIN_JEXL_HELPERS],
+  "collection.afterRead": ["req", "user", "doc", ...BUILTIN_JEXL_HELPERS],
+  "collection.beforeChange": ["req", "user", "data", "doc", "operation", ...BUILTIN_JEXL_HELPERS],
+  "global.beforeRead": ["req", "user", "query", ...BUILTIN_JEXL_HELPERS],
+  "global.afterRead": ["req", "user", "doc", ...BUILTIN_JEXL_HELPERS],
+  "global.beforeChange": ["req", "user", "data", "doc", "operation", ...BUILTIN_JEXL_HELPERS],
+  "field.beforeChange": ["value", "data", "originalDoc", "user", ...BUILTIN_JEXL_HELPERS],
+  "field.admin.onChange": ["value", "siblingData", "data", ...BUILTIN_JEXL_HELPERS]
 };
-var ACCESS_ROOTS = ["user", "req", "doc", "data", "id", "config"];
-var ADMIN_CONDITION_RESERVED_ROOTS = ["data", "siblingData", "user", "id"];
-var PREVIEW_URL_RESERVED_ROOTS = ["siteUrl", "id"];
+var ACCESS_ROOTS = ["user", "req", "doc", "data", "id", "config", ...BUILTIN_JEXL_HELPERS];
+var ADMIN_CONDITION_RESERVED_ROOTS = ["data", "siblingData", "user", "id", ...BUILTIN_JEXL_HELPERS];
+var PREVIEW_URL_RESERVED_ROOTS = ["siteUrl", "id", ...BUILTIN_JEXL_HELPERS];
 var COMPILE_CACHE = /* @__PURE__ */ new Map();
 function compileExpression(expression) {
   const cached = COMPILE_CACHE.get(expression);
   if (cached) return cached;
-  const compiled = import_jexl2.default.compile(expression);
+  const compiled = import_jexl3.default.compile(expression);
   const next = { ast: compiled._ast };
   COMPILE_CACHE.set(expression, next);
   return next;
@@ -1609,13 +1985,16 @@ function collectConfigDiagnostics(config) {
 function formatConfigDiagnostics(source, diagnostics, options = {}) {
   const color = options.color ?? false;
   const header = `${colorize("Config validation failed", 31, color)} in ${colorize(source, 36, color)}`;
+  const docLink = `${colorize("   Learn how to write declarative rules:", 90, color)} ${colorize("https://docs.dyrected.com/docs/editor-experience/form-and-field-hooks", 34, color)}`;
   const lines = diagnostics.flatMap((issue, index) => [
     `${colorize(`${index + 1}.`, 31, color)} ${colorize(issue.path, 1, color)}`,
     `   ${issue.message}`,
     `   ${colorize("surface:", 90, color)} ${issue.surface}`
   ]);
   return `${header}
-${lines.join("\n")}`;
+${lines.join("\n")}
+
+${docLink}`;
 }
 var ConfigValidationError = class extends Error {
   diagnostics;
@@ -1673,7 +2052,7 @@ async function runCollectionHooks(hooks, args, options = {}) {
             options.path ?? options.surface
           );
         }
-        return import_jexl3.default.eval(hook, hookArgs);
+        return import_jexl4.default.eval(hook, hookArgs);
       })() : await hook(hookArgs);
       if (result !== void 0) {
         if (typeof hook === "string" && options.surface) {
@@ -1690,10 +2069,7 @@ async function runCollectionHooks(hooks, args, options = {}) {
       }
     } catch (err) {
       if (options.isolated) {
-        getConfigLogger(void 0, "hooks").error({
-          err,
-          msg: "Side-effect hook failed after a successful write"
-        });
+        console.error("Side-effect hook failed after a successful write", err);
       } else {
         throw err;
       }
@@ -1725,7 +2101,7 @@ async function executeFieldBeforeChange(fields, data, originalDoc, user, db, pat
             "field.beforeChange",
             fieldPath
           );
-          return import_jexl3.default.eval(hook, hookArgs);
+          return import_jexl4.default.eval(hook, hookArgs);
         })() : await hook(hookArgs);
       }
       result[field.name] = updatedValue;
@@ -1903,22 +2279,18 @@ function validateUpload(file, config) {
 }
 
 // src/auth/jexl.ts
-var import_jexl4 = __toESM(require("jexl"), 1);
+var import_jexl5 = __toESM(require("jexl"), 1);
 async function evaluateAccess(expression, context) {
   if (expression === void 0 || expression === null) return false;
   if (typeof expression === "boolean") return expression;
   try {
-    const result = await import_jexl4.default.eval(expression, context);
+    const result = await import_jexl5.default.eval(expression, context);
     if (result && typeof result === "object" && !Array.isArray(result)) {
       return result;
     }
     return !!result;
   } catch (err) {
-    getConfigLogger(context.config, "access").error({
-      err,
-      msg: "Jexl evaluation failed",
-      expression
-    });
+    console.error("[dyrected:access] Failed to evaluate access expression:", err);
     return false;
   }
 }
@@ -1936,20 +2308,14 @@ async function resolveAccess(config, access, args) {
     try {
       return await access(args);
     } catch (err) {
-      getConfigLogger(config, "access").error({
-        err,
-        msg: "Functional access check failed"
-      });
+      console.error("[dyrected:access] Functional access check failed:", err);
       return false;
     }
   }
   if (isNamedAccessPolicy(access)) {
     const policy = config.accessPolicies?.[access.policy];
     if (policy === void 0) {
-      getConfigLogger(config, "access").error({
-        msg: "Unknown access policy",
-        policy: access.policy
-      });
+      console.error(`[dyrected:access] Unknown access policy "${access.policy}"`);
       return false;
     }
     if (typeof policy === "string" || typeof policy === "boolean") {
@@ -1959,11 +2325,7 @@ async function resolveAccess(config, access, args) {
       const resolver = policy;
       return await resolver({ ...args, params: access.params });
     } catch (err) {
-      getConfigLogger(config, "access").error({
-        err,
-        msg: "Access policy failed",
-        policy: access.policy
-      });
+      console.error(`[dyrected:access] Access policy "${access.policy}" failed:`, err);
       return false;
     }
   }
@@ -2383,7 +2745,7 @@ function simplePublishingWorkflow() {
       { name: "published", label: "Published", color: "success", published: true }
     ],
     transitions: [
-      { name: "publish", label: "Publish", from: "draft", to: "published" },
+      { name: "publish", label: "Publish", from: ["draft", "published"], to: "published" },
       { name: "unpublish", label: "Unpublish", from: "published", to: "draft", unpublish: true }
     ]
     // Intentionally no `roles`: this lightweight workflow (synthesized from
@@ -2490,7 +2852,11 @@ async function dispatchLifecycleEvent(config, event) {
   const retryDelayMs = config.events.retryDelayMs ?? 1e3;
   const attempts = event.attempts + 1;
   try {
-    await db.update({ collection: LIFECYCLE_EVENTS_COLLECTION, id: event.id, data: { status: "processing", attempts } });
+    await db.update({
+      collection: LIFECYCLE_EVENTS_COLLECTION,
+      id: event.id,
+      data: { status: "processing", attempts }
+    });
     for (const handler of config.events.handlers) await handler({ ...event, status: "processing", attempts });
     await db.update({
       collection: LIFECYCLE_EVENTS_COLLECTION,
@@ -2581,12 +2947,16 @@ async function transitionWorkflow(args) {
   const meta = original.__workflow;
   if (!meta) throw Object.assign(new Error("Entry has no workflow metadata"), { statusCode: 409 });
   if (expectedRevision !== void 0 && expectedRevision !== meta.revision) {
-    throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
+    throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), {
+      statusCode: 409
+    });
   }
   const transition = workflow.transitions.find((item) => item.name === transitionName);
   const fromStates = transition ? Array.isArray(transition.from) ? transition.from : [transition.from] : [];
   if (!transition || !fromStates.includes(meta.state)) {
-    throw Object.assign(new Error(`Transition "${transitionName}" is not valid from "${meta.state}".`), { statusCode: 409 });
+    throw Object.assign(new Error(`Transition "${transitionName}" is not valid from "${meta.state}".`), {
+      statusCode: 409
+    });
   }
   if (!availableWorkflowTransitions(workflow, meta.state, user).some((item) => item.name === transition.name)) {
     throw Object.assign(new Error(`You do not have permission to perform "${transition.label}".`), { statusCode: 403 });
@@ -2596,32 +2966,52 @@ async function transitionWorkflow(args) {
   }
   const hookContext = { transition, from: meta.state, to: transition.to, doc: original, user, comment, req, db };
   for (const hook of workflow.hooks?.beforeTransition ?? []) await hook(hookContext);
-  const events = [createLifecycleEvent({
-    name: "workflow.transitioned",
-    collection: collection.slug,
-    documentId: id,
-    actorId: user?.sub,
-    payload: { transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision, comment }
-  })];
+  const events = [
+    createLifecycleEvent({
+      name: "workflow.transitioned",
+      collection: collection.slug,
+      documentId: id,
+      actorId: user?.sub,
+      payload: { transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision, comment }
+    })
+  ];
   const targetState = workflow.states.find((state) => state.name === transition.to);
   if (targetState.published) {
-    events.push(createLifecycleEvent({ name: "entry.published", collection: collection.slug, documentId: id, actorId: user?.sub, payload: { revision: meta.revision } }));
+    events.push(
+      createLifecycleEvent({
+        name: "entry.published",
+        collection: collection.slug,
+        documentId: id,
+        actorId: user?.sub,
+        payload: { revision: meta.revision }
+      })
+    );
   } else if (transition.unpublish) {
-    events.push(createLifecycleEvent({ name: "entry.unpublished", collection: collection.slug, documentId: id, actorId: user?.sub, payload: { revision: meta.publishedRevision } }));
+    events.push(
+      createLifecycleEvent({
+        name: "entry.unpublished",
+        collection: collection.slug,
+        documentId: id,
+        actorId: user?.sub,
+        payload: { revision: meta.publishedRevision }
+      })
+    );
   }
   const updated = await db.transaction(async (tx) => {
     const locked = await tx.findOne({ collection: collection.slug, id });
     if (!locked) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
     const lockedMeta = locked.__workflow;
     if (lockedMeta.revision !== meta.revision || lockedMeta.state !== meta.state || expectedRevision !== void 0 && lockedMeta.revision !== expectedRevision) {
-      throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
+      throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), {
+        statusCode: 409
+      });
     }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const now2 = (/* @__PURE__ */ new Date()).toISOString();
     const { __published: _published, __workflow: _workflow, id: _id, ...working } = locked;
     const nextMeta = {
       ...lockedMeta,
       state: transition.to,
-      ...targetState.published ? { publishedRevision: lockedMeta.revision, publishedAt: now, publishedBy: user?.sub } : {},
+      ...targetState.published ? { publishedRevision: lockedMeta.revision, publishedAt: now2, publishedBy: user?.sub } : {},
       ...transition.unpublish ? { publishedRevision: void 0, publishedAt: void 0, publishedBy: void 0 } : {}
     };
     const data = { __workflow: nextMeta };
@@ -2630,11 +3020,36 @@ async function transitionWorkflow(args) {
     const next = await tx.update({ collection: collection.slug, id, data });
     await tx.create({
       collection: WORKFLOW_HISTORY_COLLECTION,
-      data: { collection: collection.slug, documentId: id, transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision, comment: comment ?? null, actorId: user?.sub ?? null, createdAt: now }
+      data: {
+        collection: collection.slug,
+        documentId: id,
+        transition: transition.name,
+        from: lockedMeta.state,
+        to: transition.to,
+        revision: lockedMeta.revision,
+        comment: comment ?? null,
+        actorId: user?.sub ?? null,
+        createdAt: now2
+      }
     });
     for (const event of events) await persistEvent(tx, event);
     if (collection.audit) {
-      await tx.create({ collection: "__audit", data: { collection: collection.slug, documentId: id, operation: "workflow.transition", user: user?.sub ?? null, timestamp: now, changes: JSON.stringify({ transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision }) } });
+      await tx.create({
+        collection: "__audit",
+        data: {
+          collection: collection.slug,
+          documentId: id,
+          operation: "workflow.transition",
+          user: user?.sub ?? null,
+          timestamp: now2,
+          changes: JSON.stringify({
+            transition: transition.name,
+            from: lockedMeta.state,
+            to: transition.to,
+            revision: lockedMeta.revision
+          })
+        }
+      });
     }
     return next;
   });
@@ -2643,22 +3058,93 @@ async function transitionWorkflow(args) {
     try {
       await hook({ ...hookContext, doc: updated, event: events[0] });
     } catch (error) {
-      getObservabilityRuntime(config)?.recordWorkflowHookFailure({
-        collection: collection.slug,
-        transition: transition.name
-      });
-      getConfigLogger(config, "workflow").error({
-        err: error,
-        msg: "afterTransition hook failed",
-        collection: collection.slug,
-        transition: transition.name,
-        documentId: id
-      });
+      try {
+        const { getConfigLogger: getConfigLogger2, getObservabilityRuntime: getObservabilityRuntime2 } = await Promise.resolve().then(() => (init_observability(), observability_exports));
+        getObservabilityRuntime2(config)?.recordWorkflowHookFailure({
+          collection: collection.slug,
+          transition: transition.name
+        });
+        getConfigLogger2(config, "workflow").error({
+          err: error,
+          msg: "afterTransition hook failed",
+          collection: collection.slug,
+          transition: transition.name,
+          documentId: id
+        });
+      } catch {
+        console.error("afterTransition hook failed:", error);
+      }
     }
   }
   return updated;
 }
 
+// src/controllers/collection.controller.ts
+init_observability();
+
+// src/detail.ts
+function normalizeDetailItem(item) {
+  if (typeof item === "string") {
+    return {
+      type: "field",
+      field: item
+    };
+  }
+  return item;
+}
+async function evaluateDetailComputed(detail, doc, user, db) {
+  if (!doc || !detail || !Array.isArray(detail)) {
+    return doc;
+  }
+  const computedItems = [];
+  const extractComputed = (items) => {
+    for (const rawItem of items) {
+      if (!rawItem) continue;
+      const item = normalizeDetailItem(rawItem);
+      if (item.type === "computed") {
+        const id = item.id || item.label?.toLowerCase().replace(/[^a-z0-9]+/g, "_");
+        if (id) {
+          computedItems.push({
+            id,
+            label: item.label,
+            expression: item.expression,
+            handler: item.handler
+          });
+        }
+      } else if (item.type === "section" || item.type === "grid" || item.type === "repeat") {
+        if (item.items && Array.isArray(item.items)) {
+          extractComputed(item.items);
+        }
+      } else if (item.type === "tabs" && item.tabs && Array.isArray(item.tabs)) {
+        for (const tab of item.tabs) {
+          if (tab.items) extractComputed(tab.items);
+        }
+      }
+    }
+  };
+  extractComputed(detail);
+  if (computedItems.length === 0) return doc;
+  const evaluated = {};
+  for (const item of computedItems) {
+    try {
+      if (typeof item.handler === "function") {
+        evaluated[item.id] = await item.handler({ doc, user, db });
+      } else if (item.expression) {
+        evaluated[item.id] = await evaluateJexl(item.expression, { doc, user });
+      }
+    } catch (_err) {
+      evaluated[item.id] = null;
+    }
+  }
+  return {
+    ...doc,
+    _meta: {
+      ...doc._meta || {},
+      computed: evaluated
+    }
+  };
+}
+
 // src/controllers/collection.controller.ts
 var CollectionController = class {
   collection;
@@ -2676,6 +3162,22 @@ var CollectionController = class {
   toHookRequestContext(c) {
     return toHookRequestContext(c.req);
   }
+  sanitizeDoc(doc) {
+    if (!doc || typeof doc !== "object") return doc;
+    if (this.collection.auth) {
+      const {
+        password: _p,
+        salt: _s,
+        resetPasswordToken: _rpt,
+        resetPasswordExpires: _rpe,
+        loginAttempts: _la,
+        lockUntil: _lu,
+        ...safeDoc
+      } = doc;
+      return safeDoc;
+    }
+    return doc;
+  }
   async evaluateAccess(c, action, options = {}) {
     const config = c.get("config");
     return resolveCollectionAccess(
@@ -2908,6 +3410,9 @@ var CollectionController = class {
         depth
       );
     }
+    if (this.collection.auth && result.docs && Array.isArray(result.docs)) {
+      result.docs = result.docs.map((d) => this.sanitizeDoc(d));
+    }
     return c.json(result);
   }
   async findOne(c) {
@@ -2924,32 +3429,51 @@ var CollectionController = class {
         id: id2
       });
       const externalSubject = localDoc?.externalSubject || id2;
-      let member = null;
       if (provider.members.get) {
-        member = await provider.members.get({ externalSubject, req: hookReq });
+        const member = await provider.members.get({
+          externalSubject,
+          req: hookReq
+        });
+        if (member) {
+          return c.json({
+            ...member,
+            id: localDoc ? localDoc.id : member.id,
+            externalSubject: member.id
+          });
+        }
       } else if (provider.members.list) {
         const listResult = await provider.members.list({ req: hookReq });
-        member = listResult.docs.find((m) => m.id === externalSubject) || null;
+        const matched = listResult.docs.find((m) => m.id === externalSubject || m.id === id2);
+        if (matched) {
+          return c.json({
+            ...matched,
+            id: localDoc ? localDoc.id : matched.id,
+            externalSubject: matched.id
+          });
+        }
       }
-      if (!member) return c.json({ message: "Not Found" }, 404);
-      return c.json({
-        ...member,
-        id: localDoc ? localDoc.id : member.id,
-        externalSubject: member.id
-      });
     }
-    const readonlyDb = createReadonlyDb(db);
     const id = c.req.param("id");
-    const depth = c.req.query("depth") !== void 0 ? Number(c.req.query("depth")) : 1;
-    const user = c.get("user");
     if (!id) return c.json({ message: "Missing ID" }, 400);
-    let doc = await db.findOne({ collection: this.collection.slug, id });
-    if (!doc) return c.json({ message: "Not Found" }, 404);
+    const depth = Number.parseInt(c.req.query("depth") || "0", 10);
+    const user = c.get("user");
+    const doc = await db.findOne({
+      collection: this.collection.slug,
+      id
+    });
+    if (!doc) {
+      return c.json({ message: "Document not found" }, 404);
+    }
+    let effectiveDoc = doc;
     if (this.collection.workflow) {
-      doc = materializeWorkflowDocument(doc, this.collection.workflow, user);
-      if (!doc) return c.json({ message: "Not Found" }, 404);
+      effectiveDoc = materializeWorkflowDocument(
+        doc,
+        this.collection.workflow,
+        user
+      );
+      if (!effectiveDoc) return c.json({ message: "Document not found" }, 404);
     }
-    const access = await this.evaluateAccess(c, "read", { id, doc });
+    const access = await this.evaluateAccess(c, "read", { id, doc: effectiveDoc });
     if (!access.allowed) {
       return c.json(
         {
@@ -2959,7 +3483,11 @@ var CollectionController = class {
         403
       );
     }
-    const docWithDefaults = DefaultsService.apply(this.collection.fields, doc);
+    const docWithDefaults = DefaultsService.apply(
+      this.collection.fields,
+      effectiveDoc
+    );
+    const readonlyDb = createReadonlyDb(db);
     const docWithCollectionHooks = await runCollectionHooks(
       this.collection.hooks?.afterRead,
       {
@@ -2985,17 +3513,20 @@ var CollectionController = class {
       },
       docWithFieldHooks
     );
+    let finalDoc = docWithFieldAccess;
     if (depth > 0 && docWithFieldAccess) {
       const populationService = new PopulationService(db, config.collections);
-      const populatedDoc = await populationService.populate({
+      finalDoc = await populationService.populate({
         data: docWithFieldAccess,
         fields: this.collection.fields,
         currentDepth: 0,
         maxDepth: depth
       });
-      return c.json(populatedDoc);
     }
-    return c.json(docWithFieldAccess);
+    if (finalDoc && this.collection.detail) {
+      finalDoc = await evaluateDetailComputed(this.collection.detail, finalDoc, user, readonlyDb);
+    }
+    return c.json(this.sanitizeDoc(finalDoc));
   }
   async create(c) {
     const config = c.get("config");
@@ -3029,11 +3560,11 @@ var CollectionController = class {
     }
     const body = await c.req.json();
     const user = c.get("user");
-    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const now2 = (/* @__PURE__ */ new Date()).toISOString();
     let data = {
       ...body,
-      createdAt: now,
-      updatedAt: now,
+      createdAt: now2,
+      updatedAt: now2,
       createdBy: user?.sub ?? null,
       updatedBy: user?.sub ?? null
     };
@@ -3171,12 +3702,12 @@ var CollectionController = class {
       }
     });
     const user = c.get("user");
-    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const now2 = (/* @__PURE__ */ new Date()).toISOString();
     let data = {
       ...otherData,
       ...fileData,
-      createdAt: now,
-      updatedAt: now,
+      createdAt: now2,
+      updatedAt: now2,
       createdBy: user?.sub ?? null,
       updatedBy: user?.sub ?? null
     };
@@ -3762,14 +4293,72 @@ var CollectionController = class {
       const doc = await db.create({ collection: this.collection.slug, data });
       createdDocs.push(doc);
     }
-    return c.json(
-      { message: "Seed successful", count: createdDocs.length },
-      201
-    );
+    return c.json(
+      { message: "Seed successful", count: createdDocs.length },
+      201
+    );
+  }
+  async aggregate(c) {
+    const config = c.get("config");
+    const db = config.db;
+    if (!db) return c.json({ message: "Database not configured" }, 500);
+    const access = await this.evaluateAccess(c, "read");
+    if (!access.allowed) {
+      return c.json(
+        {
+          error: true,
+          message: `Access denied: read on ${this.collection.slug}`
+        },
+        403
+      );
+    }
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json({ message: "Invalid JSON body" }, 400);
+    }
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      return c.json(
+        { message: "Aggregate request body must be a JSON object" },
+        400
+      );
+    }
+    const { sanitizeWhereClause: sanitizeWhereClause2 } = await Promise.resolve().then(() => (init_where_sanitizer(), where_sanitizer_exports));
+    const sanitizedAggregates = {};
+    for (const [key, op] of Object.entries(body)) {
+      if (!op || typeof op !== "object" || Array.isArray(op)) {
+        return c.json(
+          {
+            message: `Aggregate operation "${key}" must be an object`
+          },
+          400
+        );
+      }
+      const operation = op;
+      let opWhere = operation.where && typeof operation.where === "object" ? operation.where : void 0;
+      if (opWhere) {
+        opWhere = sanitizeWhereClause2(opWhere, this.collection.fields);
+        if (Object.keys(opWhere).length === 0) opWhere = void 0;
+      }
+      if (access.constraint) {
+        opWhere = opWhere ? mergeWhereConstraint(opWhere, access.constraint) : access.constraint;
+      }
+      sanitizedAggregates[key] = {
+        ...operation,
+        ...opWhere !== void 0 ? { where: opWhere } : { where: void 0 }
+      };
+    }
+    const result = await db.aggregate({
+      collection: this.collection.slug,
+      aggregates: sanitizedAggregates
+    });
+    return c.json(result);
   }
 };
 
 // src/controllers/global.controller.ts
+init_observability();
 var GlobalController = class {
   global;
   constructor(global) {
@@ -3792,8 +4381,8 @@ var GlobalController = class {
       path: `global:${this.global.slug}.hooks.beforeRead`
     });
     let data = await db.getGlobal({ slug: this.global.slug });
-    const isEmpty = !data || isFunctionallyEmpty(data);
-    if (isEmpty && this.global.initialData) {
+    const isEmpty2 = !data || isFunctionallyEmpty(data);
+    if (isEmpty2 && this.global.initialData) {
       getRequestLogger(c, "global").info({
         msg: "Auto-seeding global from config.initialData",
         global: this.global.slug
@@ -3849,17 +4438,25 @@ var GlobalController = class {
       },
       docWithFieldHooks
     );
+    let finalDoc = docWithFieldAccess;
     if (depth > 0 && docWithFieldAccess) {
       const populationService = new PopulationService(db, config.collections);
-      const populatedData = await populationService.populate({
+      finalDoc = await populationService.populate({
         data: docWithFieldAccess,
         fields: this.global.fields,
         currentDepth: 0,
         maxDepth: depth
       });
-      return c.json(populatedData);
     }
-    return c.json(docWithFieldAccess);
+    if (finalDoc && this.global.detail) {
+      finalDoc = await evaluateDetailComputed(
+        this.global.detail,
+        finalDoc,
+        user,
+        readonlyDb
+      );
+    }
+    return c.json(finalDoc);
   }
   async update(c) {
     const config = c.get("config");
@@ -4105,6 +4702,7 @@ function mergeDynamicConfig(baseConfig, dynamic) {
 }
 
 // src/controllers/media.controller.ts
+init_observability();
 var MediaController = class {
   collection;
   loggerComponent = "media";
@@ -4428,6 +5026,7 @@ function layout({ preheader, title, content, footer }) {
 }
 
 // src/services/email.service.ts
+init_observability();
 var _devSend = null;
 var _devSendPromise = null;
 async function getDevSend() {
@@ -4548,6 +5147,7 @@ function buildPasswordChangedEmail(config, args) {
 }
 
 // src/controllers/auth.controller.ts
+init_observability();
 var AuthController = class {
   collection;
   constructor(collection) {
@@ -4612,13 +5212,13 @@ var AuthController = class {
     if (!lockout.enabled) {
       return { justLocked: false, retryAfterSeconds: null };
     }
-    const now = Date.now();
+    const now2 = Date.now();
     const lockedUntilMs = getLockedUntilMs(user.lockedUntil);
-    const lockExpired = lockedUntilMs !== null && lockedUntilMs <= now;
+    const lockExpired = lockedUntilMs !== null && lockedUntilMs <= now2;
     const currentAttempts = !lockExpired && typeof user.loginAttempts === "number" && user.loginAttempts > 0 ? user.loginAttempts : 0;
     const loginAttempts = currentAttempts + 1;
     const justLocked = loginAttempts >= lockout.maxLoginAttempts;
-    const nextLockedUntil = justLocked ? new Date(now + lockout.lockTime).toISOString() : null;
+    const nextLockedUntil = justLocked ? new Date(now2 + lockout.lockTime).toISOString() : null;
     await db.update({
       collection: this.collection.slug,
       id: String(user.id),
@@ -5152,7 +5752,7 @@ var AuthController = class {
 
 // src/controllers/admin-auth.controller.ts
 var import_node_crypto3 = require("crypto");
-var import_node_util3 = require("util");
+var import_node_util2 = require("util");
 var import_jose2 = require("jose");
 var AdminAuthController = class {
   constructor(config) {
@@ -5309,6 +5909,7 @@ var AdminAuthController = class {
     });
   }
   getProvider(config, id) {
+    if (!id) return void 0;
     if (config.adminAuth?.mode !== "external") return void 0;
     return config.adminAuth.providers.find((provider) => provider.id === id);
   }
@@ -5507,17 +6108,16 @@ var AdminAuthController = class {
         throw new Error("OIDC nonce verification failed.");
       }
       claims = payload;
-    } else if (tokenBody.access_token && (provider.userInfoEndpoint || discovery.userinfo_endpoint)) {
-      const userInfo = await fetch(
-        provider.userInfoEndpoint || discovery.userinfo_endpoint,
-        {
-          headers: { Authorization: `Bearer ${tokenBody.access_token}` }
-        }
-      );
+    } else {
+      const userInfoEndpoint = provider.userInfoEndpoint ?? discovery.userinfo_endpoint;
+      if (!tokenBody.access_token || !userInfoEndpoint) {
+        throw new Error("OIDC provider did not return usable identity claims.");
+      }
+      const userInfo = await fetch(userInfoEndpoint, {
+        headers: { Authorization: `Bearer ${tokenBody.access_token}` }
+      });
       if (!userInfo.ok) throw new Error("OIDC userinfo request failed.");
       claims = await userInfo.json();
-    } else {
-      throw new Error("OIDC provider did not return usable identity claims.");
     }
     return {
       identity: this.mapClaims(claims, provider.claimMapping),
@@ -5533,7 +6133,7 @@ var AdminAuthController = class {
     }
     let claims;
     if (provider.secret) {
-      const secret = new import_node_util3.TextEncoder().encode(provider.secret);
+      const secret = new import_node_util2.TextEncoder().encode(provider.secret);
       const verified = await (0, import_jose2.jwtVerify)(token, secret, {
         issuer: provider.issuer,
         audience: provider.audience
@@ -5649,7 +6249,7 @@ var AdminAuthController = class {
     if (!secret) {
       throw new Error("[dyrected/core] DYRECTED_JWT_SECRET is not set.");
     }
-    return new import_node_util3.TextEncoder().encode(secret);
+    return new import_node_util2.TextEncoder().encode(secret);
   }
   normalizeReturnTo(returnTo, c) {
     if (returnTo) return returnTo;
@@ -5660,11 +6260,11 @@ var AdminAuthController = class {
 
 // src/controllers/preview.controller.ts
 var import_jose3 = require("jose");
-var import_node_util4 = require("util");
+var import_node_util3 = require("util");
 var PreviewController = class {
   getSecret() {
     const secret = process.env.DYRECTED_JWT_SECRET || "dyrected-preview-secret-change-me";
-    return new import_node_util4.TextEncoder().encode(secret);
+    return new import_node_util3.TextEncoder().encode(secret);
   }
   /**
    * POST /api/preview-token
@@ -5873,6 +6473,7 @@ var AuditController = class {
 };
 
 // src/middleware/auth.ts
+init_observability();
 function getBearerToken(c) {
   const authHeader = c.req.header("Authorization");
   return authHeader?.replace(/^Bearer\s+/i, "") || void 0;
@@ -6431,6 +7032,71 @@ function generateOpenApi(config) {
         responses: { 200: { description: "Deleted and failed document IDs" } }
       }
     };
+    spec.paths[`${path}/aggregate`] = {
+      post: {
+        tags: [collectionTag],
+        summary: `Aggregate ${labels.plural}`,
+        description: `Compute statistical aggregations (count, sum, avg, min, max) across ${labels.plural}.`,
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                additionalProperties: {
+                  type: "object",
+                  properties: {
+                    count: { type: "string", example: "*" },
+                    sum: { type: "string", description: "Field to sum" },
+                    avg: { type: "string", description: "Field to average" },
+                    min: { type: "string", description: "Field for minimum" },
+                    max: { type: "string", description: "Field for maximum" },
+                    cast: {
+                      type: "string",
+                      enum: [
+                        "number",
+                        "integer",
+                        "float",
+                        "boolean",
+                        "date",
+                        "string"
+                      ]
+                    },
+                    where: {
+                      type: "object",
+                      description: "Per-aggregate filter condition",
+                      additionalProperties: true
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        responses: {
+          200: {
+            description: "Success",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  additionalProperties: {
+                    type: "number",
+                    nullable: true
+                  }
+                }
+              }
+            }
+          },
+          400: {
+            description: "Bad Request - Invalid aggregate input"
+          },
+          403: {
+            description: "Forbidden - Access denied by read rule"
+          }
+        }
+      }
+    };
     if (collection.audit) {
       spec.paths[`${path}/__audit`] = {
         get: {
@@ -7013,6 +7679,7 @@ function getSwaggerHtml(specUrl) {
 }
 
 // src/router.ts
+init_observability();
 var SERIALIZED_ADMIN_HOOK_PREFIX = "__dyrected_fn__:";
 function accessGate(config, target, action) {
   return async (c, next) => {
@@ -7026,10 +7693,7 @@ function accessGate(config, target, action) {
       req: toHookRequestContext(c.req)
     });
     if (!allowed) {
-      return c.json(
-        { error: true, message: `Access denied: ${action} on ${target.slug}` },
-        403
-      );
+      return c.json({ error: true, message: `Access denied: ${action} on ${target.slug}` }, 403);
     }
     await next();
   };
@@ -7069,6 +7733,80 @@ function serializeBlockForApi(block) {
     fields: block.fields?.map(serializeFieldForApi)
   };
 }
+function serializeDetailItemForApi(item) {
+  if (!item) return item;
+  if (typeof item === "string") {
+    return { type: "field", field: item };
+  }
+  if (item.type === "section") {
+    return {
+      type: "section",
+      title: item.title,
+      items: (item.items || []).map(serializeDetailItemForApi),
+      options: item.options
+    };
+  }
+  if (item.type === "tab") {
+    return {
+      type: "tab",
+      label: item.label,
+      items: (item.items || []).map(serializeDetailItemForApi),
+      options: item.options
+    };
+  }
+  if (item.type === "tabs") {
+    return {
+      type: "tabs",
+      tabs: (item.tabs || []).map(serializeDetailItemForApi),
+      options: item.options
+    };
+  }
+  if (item.type === "grid") {
+    return {
+      type: "grid",
+      columns: item.columns,
+      items: (item.items || []).map(serializeDetailItemForApi),
+      options: item.options
+    };
+  }
+  if (item.type === "repeat") {
+    return {
+      type: "repeat",
+      field: item.field,
+      items: (item.items || []).map(serializeDetailItemForApi),
+      options: item.options
+    };
+  }
+  if (item.type === "computed") {
+    return {
+      type: "computed",
+      id: item.id || item.label?.toLowerCase().replace(/[^a-z0-9]+/g, "_"),
+      label: item.label,
+      expression: item.expression,
+      options: {
+        id: item.id,
+        span: item.options?.span,
+        format: item.options?.format,
+        currency: item.options?.currency,
+        visible: item.options?.visible
+      }
+    };
+  }
+  if (item.type === "field") {
+    return {
+      type: "field",
+      field: item.field,
+      options: item.options
+    };
+  }
+  return item;
+}
+function serializeDetailForApi(detail) {
+  if (detail === false) return false;
+  if (detail === true) return true;
+  if (!detail || !Array.isArray(detail)) return void 0;
+  return detail.map(serializeDetailItemForApi);
+}
 function registerRoutes(app, config) {
   const optionsCache = /* @__PURE__ */ new Map();
   app.get("/api/schemas", optionalAuth(config), async (c) => {
@@ -7087,15 +7825,12 @@ function registerRoutes(app, config) {
       if (typeof access === "boolean") return access;
       if (access && typeof access === "object" && typeof access.policy === "string") {
         const policy = requestConfig.accessPolicies?.[access.policy];
-        if (typeof policy === "string" || typeof policy === "boolean")
-          return policy;
+        if (typeof policy === "string" || typeof policy === "boolean") return policy;
       }
       return resolveBooleanAccess(requestConfig, access, accessArgs);
     };
     const filteredCollections = await Promise.all(
-      collections.filter(
-        (col) => !siteId || col.shared || !col.siteId || col.siteId === siteId
-      ).map(async (col) => ({
+      collections.filter((col) => !siteId || col.shared || !col.siteId || col.siteId === siteId).map(async (col) => ({
         slug: col.slug,
         labels: col.labels,
         access: {
@@ -7133,6 +7868,7 @@ function registerRoutes(app, config) {
         audit: !!col.audit,
         drafts: !!col.drafts,
         admin: col.admin,
+        detail: serializeDetailForApi(col.detail),
         workflow: col.workflow ? {
           initialState: col.workflow.initialState,
           draftState: col.workflow.draftState,
@@ -7151,9 +7887,7 @@ function registerRoutes(app, config) {
       }))
     );
     const filteredGlobals = await Promise.all(
-      globals.filter(
-        (glb) => !siteId || glb.shared || !glb.siteId || glb.siteId === siteId
-      ).map(async (glb) => ({
+      globals.filter((glb) => !siteId || glb.shared || !glb.siteId || glb.siteId === siteId).map(async (glb) => ({
         slug: glb.slug,
         label: glb.label,
         access: {
@@ -7183,7 +7917,8 @@ function registerRoutes(app, config) {
             }
           }))
         ),
-        admin: glb.admin
+        admin: glb.admin,
+        detail: serializeDetailForApi(glb.detail)
       }))
     );
     return c.json({
@@ -7197,148 +7932,137 @@ function registerRoutes(app, config) {
       adminHealth: {
         emailConfigured: !!requestConfig.email,
         secureAuthSecretConfigured: !!process.env.DYRECTED_JWT_SECRET,
-        authCollectionConfigured: requestConfig.collections.some(
-          (collection) => !!collection.auth
-        ),
-        uploadCollectionConfigured: requestConfig.collections.some(
-          (collection) => !!collection.upload
-        )
+        authCollectionConfigured: requestConfig.collections.some((collection) => !!collection.auth),
+        uploadCollectionConfigured: requestConfig.collections.some((collection) => !!collection.upload)
       }
     });
   });
-  app.get(
-    "/api/dyrected/options/:collection/:field",
-    optionalAuth(config),
-    async (c) => {
-      const { collection: colSlug, field: fieldName } = c.req.param();
-      const siteId = c.req.header("X-Site-Id");
-      const requestConfig = siteId && config.onSchemaFetch ? mergeDynamicConfig(config, await config.onSchemaFetch(siteId)) : config;
-      let collections = [...requestConfig.collections];
-      const user = c.get("user");
-      let collection = collections.find((col) => col.slug === colSlug);
-      let field;
-      if (collection) {
-        const accessExpr = collection.access?.read;
-        if (accessExpr !== void 0 && accessExpr !== null) {
-          const allowed = await resolveBooleanAccess(config, accessExpr, {
-            user,
-            req: toHookRequestContext(c.req)
-          });
-          if (!allowed) {
-            return c.json(
-              { error: true, message: `Access denied: read on ${colSlug}` },
-              403
-            );
-          }
-        }
-        field = collection.fields.find((f) => f.name === fieldName);
-      } else {
-        const globals = [...requestConfig.globals];
-        const glb = globals.find((g) => g.slug === colSlug);
-        if (!glb) {
-          return c.json(
-            {
-              error: true,
-              message: `${colSlug} not found as collection or global`
-            },
-            404
-          );
-        }
-        const accessExpr = glb.access?.read;
-        if (accessExpr !== void 0 && accessExpr !== null) {
-          const allowed = await resolveBooleanAccess(config, accessExpr, {
-            user,
-            req: toHookRequestContext(c.req)
-          });
-          if (!allowed) {
-            return c.json(
-              {
-                error: true,
-                message: `Access denied: read on global ${colSlug}`
-              },
-              403
-            );
-          }
+  app.get("/api/dyrected/options/:collection/:field", optionalAuth(config), async (c) => {
+    const { collection: colSlug, field: fieldName } = c.req.param();
+    const siteId = c.req.header("X-Site-Id");
+    const requestConfig = siteId && config.onSchemaFetch ? mergeDynamicConfig(config, await config.onSchemaFetch(siteId)) : config;
+    let collections = [...requestConfig.collections];
+    const user = c.get("user");
+    let collection = collections.find((col) => col.slug === colSlug);
+    let field;
+    if (collection) {
+      const accessExpr = collection.access?.read;
+      if (accessExpr !== void 0 && accessExpr !== null) {
+        const allowed = await resolveBooleanAccess(config, accessExpr, {
+          user,
+          req: toHookRequestContext(c.req)
+        });
+        if (!allowed) {
+          return c.json({ error: true, message: `Access denied: read on ${colSlug}` }, 403);
         }
-        field = glb.fields.find((f) => f.name === fieldName);
       }
-      if (!field) {
+      field = collection.fields.find((f) => f.name === fieldName);
+    } else {
+      const globals = [...requestConfig.globals];
+      const glb = globals.find((g) => g.slug === colSlug);
+      if (!glb) {
         return c.json(
           {
             error: true,
-            message: `Field ${fieldName} not found in ${colSlug}`
+            message: `${colSlug} not found as collection or global`
           },
           404
         );
       }
-      let resolver;
-      let cacheTTL;
-      if (typeof field.options === "function") {
-        resolver = field.options;
-      } else if (field.options && typeof field.options === "object" && "resolve" in field.options) {
-        resolver = field.options.resolve;
-        cacheTTL = field.options.cacheTTL;
-      }
-      if (!resolver) {
-        return c.json(
-          {
-            error: true,
-            message: `Field ${fieldName} in ${colSlug} is not dynamic`
-          },
-          400
-        );
-      }
-      try {
-        const db = c.get("db") || config.db;
-        const queryParams = c.req.query();
-        const reqContext = {
-          query: queryParams,
-          headers: c.req.header(),
-          raw: c.req.raw
-        };
-        const shouldCache = typeof cacheTTL === "number" && cacheTTL > 0;
-        let cacheKey = "";
-        if (shouldCache) {
-          cacheKey = JSON.stringify([
-            siteId ?? "",
-            colSlug,
-            fieldName,
-            user?.id ?? null,
-            queryParams
-          ]);
-          const hit = optionsCache.get(cacheKey);
-          if (hit && hit.expires > Date.now()) {
-            return c.json(hit.value);
-          }
-        }
-        const result = await resolver({
-          db,
+      const accessExpr = glb.access?.read;
+      if (accessExpr !== void 0 && accessExpr !== null) {
+        const allowed = await resolveBooleanAccess(config, accessExpr, {
           user,
-          req: reqContext
+          req: toHookRequestContext(c.req)
         });
-        if (shouldCache) {
-          optionsCache.set(cacheKey, {
-            expires: Date.now() + cacheTTL * 1e3,
-            value: result
-          });
+        if (!allowed) {
+          return c.json(
+            {
+              error: true,
+              message: `Access denied: read on global ${colSlug}`
+            },
+            403
+          );
         }
-        return c.json(result);
-      } catch (err) {
-        getRequestLogger(c, "router").error({
-          err,
-          msg: "Failed to resolve dynamic field options",
-          fieldName
+      }
+      field = glb.fields.find((f) => f.name === fieldName);
+    }
+    if (!field) {
+      return c.json(
+        {
+          error: true,
+          message: `Field ${fieldName} not found in ${colSlug}`
+        },
+        404
+      );
+    }
+    let resolver;
+    let cacheTTL;
+    if (typeof field.options === "function") {
+      resolver = field.options;
+    } else if (field.options && typeof field.options === "object" && "resolve" in field.options) {
+      resolver = field.options.resolve;
+      cacheTTL = field.options.cacheTTL;
+    }
+    if (!resolver) {
+      return c.json(
+        {
+          error: true,
+          message: `Field ${fieldName} in ${colSlug} is not dynamic`
+        },
+        400
+      );
+    }
+    try {
+      const db = c.get("db") || config.db;
+      const queryParams = c.req.query();
+      const reqContext = {
+        query: queryParams,
+        headers: c.req.header(),
+        raw: c.req.raw
+      };
+      const shouldCache = typeof cacheTTL === "number" && cacheTTL > 0;
+      let cacheKey = "";
+      if (shouldCache) {
+        cacheKey = JSON.stringify([
+          siteId ?? "",
+          colSlug,
+          fieldName,
+          user?.id ?? null,
+          queryParams
+        ]);
+        const hit = optionsCache.get(cacheKey);
+        if (hit && hit.expires > Date.now()) {
+          return c.json(hit.value);
+        }
+      }
+      const result = await resolver({
+        db,
+        user,
+        req: reqContext
+      });
+      if (shouldCache) {
+        optionsCache.set(cacheKey, {
+          expires: Date.now() + cacheTTL * 1e3,
+          value: result
         });
-        return c.json(
-          {
-            error: true,
-            message: err.message || "Failed to resolve dynamic options"
-          },
-          500
-        );
       }
+      return c.json(result);
+    } catch (err) {
+      getRequestLogger(c, "router").error({
+        err,
+        msg: "Failed to resolve dynamic field options",
+        fieldName
+      });
+      return c.json(
+        {
+          error: true,
+          message: err.message || "Failed to resolve dynamic options"
+        },
+        500
+      );
     }
-  );
+  });
   app.get("/api/openapi.json", (c) => {
     return c.json(generateOpenApi(config));
   });
@@ -7351,13 +8075,8 @@ function registerRoutes(app, config) {
     const key = c.req.param("key");
     const scope = c.req.query("scope");
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub)
-      return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key)
-      return c.json(
-        { error: true, message: "Preference key is required." },
-        400
-      );
+    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
     const getGlobalPreference = async () => {
       const globalDoc = await db.findOne({
         collection: "__global_preferences",
@@ -7384,13 +8103,8 @@ function registerRoutes(app, config) {
     const key = c.req.param("key");
     const scope = c.req.query("scope");
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub)
-      return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key)
-      return c.json(
-        { error: true, message: "Preference key is required." },
-        400
-      );
+    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
     const body = await c.req.json().catch(() => ({}));
     if (scope === "global") {
       const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
@@ -7438,13 +8152,8 @@ function registerRoutes(app, config) {
     const key = c.req.param("key");
     const scope = c.req.query("scope");
     if (!db) return c.json({ message: "Database not configured" }, 500);
-    if (!user?.collection || !user.sub)
-      return c.json({ error: true, message: "Authentication required." }, 401);
-    if (!key)
-      return c.json(
-        { error: true, message: "Preference key is required." },
-        400
-      );
+    if (!user?.collection || !user.sub) return c.json({ error: true, message: "Authentication required." }, 401);
+    if (!key) return c.json({ error: true, message: "Preference key is required." }, 400);
     if (scope === "global") {
       const isAdminUser = Array.isArray(user?.roles) && user.roles.includes("admin");
       if (!isAdminUser) {
@@ -7483,41 +8192,17 @@ function registerRoutes(app, config) {
     for (const col of uploadCollections) {
       const mediaController = new MediaController(col.slug);
       const prefix = `/api/collections/${col.slug}`;
-      app.get(
-        `${prefix}/media`,
-        accessGate(config, col, "read"),
-        (c) => mediaController.find(c)
-      );
-      app.get(
-        `${prefix}/media/:filename{.+$}`,
-        (c) => mediaController.serve(c)
-      );
-      app.post(
-        `${prefix}/media`,
-        accessGate(config, col, "create"),
-        (c) => mediaController.upload(c)
-      );
-      app.delete(
-        `${prefix}/media/:id`,
-        accessGate(config, col, "delete"),
-        (c) => mediaController.delete(c)
-      );
+      app.get(`${prefix}/media`, accessGate(config, col, "read"), (c) => mediaController.find(c));
+      app.get(`${prefix}/media/:filename{.+$}`, (c) => mediaController.serve(c));
+      app.post(`${prefix}/media`, accessGate(config, col, "create"), (c) => mediaController.upload(c));
+      app.delete(`${prefix}/media/:id`, accessGate(config, col, "delete"), (c) => mediaController.delete(c));
     }
   }
   const adminAuthController = new AdminAuthController(config);
   app.get("/api/admin/auth/providers", (c) => adminAuthController.providers(c));
-  app.get(
-    "/api/admin/auth/:provider/start",
-    (c) => adminAuthController.start(c)
-  );
-  app.get(
-    "/api/admin/auth/:provider/callback",
-    (c) => adminAuthController.callback(c)
-  );
-  app.post(
-    "/api/admin/auth/:provider/exchange",
-    (c) => adminAuthController.exchange(c)
-  );
+  app.get("/api/admin/auth/:provider/start", (c) => adminAuthController.start(c));
+  app.get("/api/admin/auth/:provider/callback", (c) => adminAuthController.callback(c));
+  app.post("/api/admin/auth/:provider/exchange", (c) => adminAuthController.exchange(c));
   app.post("/api/admin/logout", (c) => adminAuthController.logout(c));
   for (const collection of config.collections) {
     if (!collection.auth) continue;
@@ -7528,21 +8213,10 @@ function registerRoutes(app, config) {
     app.get(`${path}/init`, (c) => authController.init(c));
     app.post(`${path}/first-user`, (c) => authController.registerFirstUser(c));
     app.get(`${path}/me`, requireAuth(config), (c) => authController.me(c));
-    app.post(
-      `${path}/refresh-token`,
-      requireAuth(config),
-      (c) => authController.refreshToken(c)
-    );
-    app.post(
-      `${path}/forgot-password`,
-      (c) => authController.forgotPassword(c)
-    );
+    app.post(`${path}/refresh-token`, requireAuth(config), (c) => authController.refreshToken(c));
+    app.post(`${path}/forgot-password`, (c) => authController.forgotPassword(c));
     app.post(`${path}/reset-password`, (c) => authController.resetPassword(c));
-    app.post(
-      `${path}/invite`,
-      requireAuth(config),
-      (c) => authController.invite(c)
-    );
+    app.post(`${path}/invite`, requireAuth(config), (c) => authController.invite(c));
     app.post(`${path}/accept-invite`, (c) => authController.acceptInvite(c));
   }
   const auditController = new AuditController();
@@ -7553,33 +8227,19 @@ function registerRoutes(app, config) {
     app.post(path, (c) => controller.create(c));
     app.post(`${path}/media`, (c) => controller.create(c));
     app.delete(`${path}/delete-many`, (c) => controller.deleteMany(c));
+    app.post(`${path}/aggregate`, (c) => controller.aggregate(c));
     if (collection.audit) {
-      app.get(
-        `${path}/__audit`,
-        (c) => auditController.findForCollection(c, collection)
-      );
+      app.get(`${path}/__audit`, (c) => auditController.findForCollection(c, collection));
     }
     app.get(`${path}/:id`, (c) => controller.findOne(c));
     app.patch(`${path}/:id`, (c) => controller.update(c));
     app.delete(`${path}/:id`, (c) => controller.delete(c));
     if (collection.auth) {
-      app.post(
-        `${path}/:id/change-password`,
-        requireAuth(config),
-        (c) => controller.changePassword(c)
-      );
+      app.post(`${path}/:id/change-password`, requireAuth(config), (c) => controller.changePassword(c));
     }
     if (collection.workflow) {
-      app.post(
-        `${path}/:id/transitions/:transition`,
-        requireAuth(config),
-        (c) => controller.transition(c)
-      );
-      app.get(
-        `${path}/:id/workflow-history`,
-        requireAuth(config),
-        (c) => controller.workflowHistory(c)
-      );
+      app.post(`${path}/:id/transitions/:transition`, requireAuth(config), (c) => controller.transition(c));
+      app.get(`${path}/:id/workflow-history`, requireAuth(config), (c) => controller.workflowHistory(c));
     }
   }
   for (const global of config.globals) {
@@ -7594,11 +8254,7 @@ function registerRoutes(app, config) {
     });
   }
   const previewController = new PreviewController();
-  app.post(
-    "/api/preview-token",
-    requireAuth(config),
-    (c) => previewController.createToken(c)
-  );
+  app.post("/api/preview-token", requireAuth(config), (c) => previewController.createToken(c));
   app.get("/api/preview-data", (c) => previewController.getData(c));
   app.get("/api/audit", (c) => auditController.findAll(c));
   app.get("/api/collections/:slug/__audit", async (c) => {
@@ -7611,81 +8267,49 @@ function registerRoutes(app, config) {
     if (!config2.onSchemaFetch || !siteId) {
       return c.json({ message: `Collection "${slug}" not found` }, 404);
     }
-    const requestConfig = mergeDynamicConfig(
-      config2,
-      await config2.onSchemaFetch(siteId)
-    );
-    const collection = requestConfig.collections.find(
-      (col) => col.slug === slug
-    );
+    const requestConfig = mergeDynamicConfig(config2, await config2.onSchemaFetch(siteId));
+    const collection = requestConfig.collections.find((col) => col.slug === slug);
     if (!collection?.audit) {
-      return c.json(
-        { message: `Collection "${slug}" not found or has no audit log` },
-        404
-      );
+      return c.json({ message: `Collection "${slug}" not found or has no audit log` }, 404);
     }
     return auditController.findForCollection(c, collection);
   });
-  app.post(
-    "/api/collections/:slug/:id/transitions/:transition",
-    requireAuth(config),
-    async (c) => {
-      const slug = c.req.param("slug");
-      const siteId = c.req.header("X-Site-Id") || c.get("siteId");
-      const config2 = c.get("config");
-      if (config2.collections.some((col) => col.slug === slug)) {
-        return c.json({ message: "Not Found" }, 404);
-      }
-      if (!config2.onSchemaFetch || !siteId) {
-        return c.json({ message: `Collection "${slug}" not found` }, 404);
-      }
-      const requestConfig = mergeDynamicConfig(
-        config2,
-        await config2.onSchemaFetch(siteId)
-      );
-      const collection = requestConfig.collections.find(
-        (col) => col.slug === slug
-      );
-      if (!collection?.workflow) {
-        return c.json(
-          { message: `Collection "${slug}" not found or has no workflow` },
-          404
-        );
-      }
-      const controller = new CollectionController(collection);
-      return controller.transition(c);
+  app.post("/api/collections/:slug/:id/transitions/:transition", requireAuth(config), async (c) => {
+    const slug = c.req.param("slug");
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const config2 = c.get("config");
+    if (config2.collections.some((col) => col.slug === slug)) {
+      return c.json({ message: "Not Found" }, 404);
     }
-  );
-  app.get(
-    "/api/collections/:slug/:id/workflow-history",
-    requireAuth(config),
-    async (c) => {
-      const slug = c.req.param("slug");
-      const siteId = c.req.header("X-Site-Id") || c.get("siteId");
-      const config2 = c.get("config");
-      if (config2.collections.some((col) => col.slug === slug)) {
-        return c.json({ message: "Not Found" }, 404);
-      }
-      if (!config2.onSchemaFetch || !siteId) {
-        return c.json({ message: `Collection "${slug}" not found` }, 404);
-      }
-      const requestConfig = mergeDynamicConfig(
-        config2,
-        await config2.onSchemaFetch(siteId)
-      );
-      const collection = requestConfig.collections.find(
-        (col) => col.slug === slug
-      );
-      if (!collection?.workflow) {
-        return c.json(
-          { message: `Collection "${slug}" not found or has no workflow` },
-          404
-        );
-      }
-      const controller = new CollectionController(collection);
-      return controller.workflowHistory(c);
+    if (!config2.onSchemaFetch || !siteId) {
+      return c.json({ message: `Collection "${slug}" not found` }, 404);
     }
-  );
+    const requestConfig = mergeDynamicConfig(config2, await config2.onSchemaFetch(siteId));
+    const collection = requestConfig.collections.find((col) => col.slug === slug);
+    if (!collection?.workflow) {
+      return c.json({ message: `Collection "${slug}" not found or has no workflow` }, 404);
+    }
+    const controller = new CollectionController(collection);
+    return controller.transition(c);
+  });
+  app.get("/api/collections/:slug/:id/workflow-history", requireAuth(config), async (c) => {
+    const slug = c.req.param("slug");
+    const siteId = c.req.header("X-Site-Id") || c.get("siteId");
+    const config2 = c.get("config");
+    if (config2.collections.some((col) => col.slug === slug)) {
+      return c.json({ message: "Not Found" }, 404);
+    }
+    if (!config2.onSchemaFetch || !siteId) {
+      return c.json({ message: `Collection "${slug}" not found` }, 404);
+    }
+    const requestConfig = mergeDynamicConfig(config2, await config2.onSchemaFetch(siteId));
+    const collection = requestConfig.collections.find((col) => col.slug === slug);
+    if (!collection?.workflow) {
+      return c.json({ message: `Collection "${slug}" not found or has no workflow` }, 404);
+    }
+    const controller = new CollectionController(collection);
+    return controller.workflowHistory(c);
+  });
   app.all("/api/collections/:slug/:id?", async (c) => {
     const slug = c.req.param("slug");
     const id = c.req.param("id");
@@ -7695,13 +8319,8 @@ function registerRoutes(app, config) {
       return c.json({ message: "Method Not Allowed" }, 405);
     }
     if (config2.onSchemaFetch && siteId) {
-      const requestConfig = mergeDynamicConfig(
-        config2,
-        await config2.onSchemaFetch(siteId)
-      );
-      let collection = requestConfig.collections.find(
-        (col) => col.slug === slug
-      );
+      const requestConfig = mergeDynamicConfig(config2, await config2.onSchemaFetch(siteId));
+      let collection = requestConfig.collections.find((col) => col.slug === slug);
       if (!collection && slug === "media") {
         collection = {
           slug: "media",
@@ -7714,25 +8333,19 @@ function registerRoutes(app, config) {
         if (collection.auth && id) {
           const authController = new AuthController(collection);
           const method2 = c.req.method;
-          if (method2 === "POST" && id === "login")
-            return authController.login(c);
-          if (method2 === "POST" && id === "logout")
-            return authController.logout(c);
+          if (method2 === "POST" && id === "login") return authController.login(c);
+          if (method2 === "POST" && id === "logout") return authController.logout(c);
           if (method2 === "GET" && id === "me") return authController.me(c);
-          if (method2 === "POST" && id === "refresh-token")
-            return authController.refreshToken(c);
-          if (method2 === "POST" && id === "forgot-password")
-            return authController.forgotPassword(c);
-          if (method2 === "POST" && id === "reset-password")
-            return authController.resetPassword(c);
+          if (method2 === "POST" && id === "refresh-token") return authController.refreshToken(c);
+          if (method2 === "POST" && id === "forgot-password") return authController.forgotPassword(c);
+          if (method2 === "POST" && id === "reset-password") return authController.resetPassword(c);
         }
         const controller = new CollectionController(collection);
         const method = c.req.method;
         if (id) {
           if (method === "GET") return controller.findOne(c);
           if (method === "PATCH") return controller.update(c);
-          if (method === "DELETE" && id === "delete-many")
-            return controller.deleteMany(c);
+          if (method === "DELETE" && id === "delete-many") return controller.deleteMany(c);
           if (method === "DELETE") return controller.delete(c);
           if (method === "POST" && id === "media") return controller.create(c);
         } else {
@@ -7752,10 +8365,7 @@ function registerRoutes(app, config) {
       return c.json({ message: "Method Not Allowed" }, 405);
     }
     if (config2.onSchemaFetch && siteId) {
-      const requestConfig = mergeDynamicConfig(
-        config2,
-        await config2.onSchemaFetch(siteId)
-      );
+      const requestConfig = mergeDynamicConfig(config2, await config2.onSchemaFetch(siteId));
       const global = requestConfig.globals.find((glb) => glb.slug === slug);
       if (global) {
         const controller = new GlobalController(global);
@@ -8121,7 +8731,7 @@ function resolveClientIp(req, trustProxy = false) {
     const value = normalizeIp(req.headers[header]);
     if (value) return value;
   }
-  if (trustProxy) {
+  if (trustProxy === true || typeof trustProxy === "number") {
     const forwardedFor = pickForwardedFor(req.headers, trustProxy);
     if (forwardedFor) return forwardedFor;
   }
@@ -8133,6 +8743,7 @@ function pickForwardedFor(headers, trustProxy) {
     const chain2 = forwardedHeader.split(",").map((entry) => normalizeIp(entry)).filter((entry) => !!entry);
     if (chain2.length > 0) {
       if (trustProxy === true) return chain2[0];
+      if (trustProxy <= 0) return null;
       const trustedHops2 = Math.max(1, Math.floor(trustProxy));
       const candidateIndex2 = Math.max(0, chain2.length - trustedHops2);
       return chain2[candidateIndex2] ?? chain2[0];
@@ -8145,6 +8756,7 @@ function pickForwardedFor(headers, trustProxy) {
   const chain = matches.map((match) => normalizeIp(match[1])).filter((entry) => !!entry);
   if (chain.length === 0) return null;
   if (trustProxy === true) return chain[0];
+  if (trustProxy <= 0) return null;
   const trustedHops = Math.max(1, Math.floor(trustProxy));
   const candidateIndex = Math.max(0, chain.length - trustedHops);
   return chain[candidateIndex] ?? chain[0];
@@ -8182,15 +8794,15 @@ function createRateLimitMiddleware(config) {
     })) {
       return next();
     }
-    const now = Date.now();
+    const now2 = Date.now();
     const key = ip;
     const existing = buckets.get(key);
-    const bucket = existing && existing.resetAt > now ? existing : { count: 0, resetAt: now + settings.window };
+    const bucket = existing && existing.resetAt > now2 ? existing : { count: 0, resetAt: now2 + settings.window };
     bucket.count += 1;
     buckets.set(key, bucket);
-    pruneExpiredBuckets(buckets, now);
+    pruneExpiredBuckets(buckets, now2);
     const remaining = Math.max(0, settings.max - bucket.count);
-    const resetSeconds = Math.max(1, Math.ceil((bucket.resetAt - now) / 1e3));
+    const resetSeconds = Math.max(1, Math.ceil((bucket.resetAt - now2) / 1e3));
     c.res.headers.set("X-RateLimit-Limit", String(settings.max));
     c.res.headers.set("X-RateLimit-Remaining", String(remaining));
     c.res.headers.set("X-RateLimit-Reset", String(Math.ceil(bucket.resetAt / 1e3)));
@@ -8221,16 +8833,17 @@ function normalizeRateLimitConfig(config) {
 function matchesLimitedPath(path, prefixes) {
   return prefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
 }
-function pruneExpiredBuckets(buckets, now) {
+function pruneExpiredBuckets(buckets, now2) {
   if (buckets.size < 1e3) return;
   for (const [key, bucket] of buckets) {
-    if (bucket.resetAt <= now) {
+    if (bucket.resetAt <= now2) {
       buckets.delete(key);
     }
   }
 }
 
 // src/app.ts
+init_observability();
 async function createDyrectedApp(rawConfig) {
   const config = normalizeConfig(rawConfig);
   const observability = createObservabilityRuntime(config);
@@ -8348,7 +8961,7 @@ async function createDyrectedApp(rawConfig) {
   app.use("*", (0, import_cors.cors)(config.cors ? { origin: config.cors.origins } : {}));
   app.get("/health", (c) => c.json({ status: "ok", version: "0.0.1" }));
   if (observability.config.metrics.enabled && observability.config.metrics.exporter === "prometheus" && observability.prometheusExporter) {
-    app.get(observability.config.metrics.path, async (c) => {
+    app.get(observability.config.metrics.path, async (_c) => {
       const metrics = await renderPrometheusMetrics(
         observability.prometheusExporter
       );
@@ -8382,6 +8995,9 @@ async function createDyrectedApp(rawConfig) {
   registerRoutes(app, config);
   return app;
 }
+
+// src/server.ts
+init_observability();
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthController,
@@ -8389,6 +9005,22 @@ async function createDyrectedApp(rawConfig) {
   GlobalController,
   MediaController,
   PreviewController,
+  attachRequestMetrics,
+  bindObservabilityRuntime,
+  buildRequestLogger,
+  captureRequestBody,
   createDyrectedApp,
-  registerRoutes
+  createObservabilityRuntime,
+  createRequestSpan,
+  endRequestSpan,
+  getConfigLogger,
+  getObservabilityRuntime,
+  getRequestLogger,
+  redactBody,
+  redactHeaders,
+  registerRoutes,
+  renderPrometheusMetrics,
+  resolveObservabilityConfig,
+  serializeDetailForApi,
+  shouldSampleRequest
 });