@dyrected/core 2.8.3 → 2.9.0

package/dist/chunk-YEBCT77K.js

@@ -1,3269 +0,0 @@
-// src/observability.ts
-import {
-  TraceFlags,
-  context as otelContext,
-  trace
-} from "@opentelemetry/api";
-import { OTLPMetricExporter } from "@opentelemetry/exporter-metrics-otlp-http";
-import { PrometheusExporter } from "@opentelemetry/exporter-prometheus";
-import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
-import { resourceFromAttributes } from "@opentelemetry/resources";
-import {
-  MeterProvider,
-  PeriodicExportingMetricReader
-} from "@opentelemetry/sdk-metrics";
-import {
-  BasicTracerProvider,
-  BatchSpanProcessor,
-  ConsoleSpanExporter
-} from "@opentelemetry/sdk-trace-base";
-import pino, {
-  destination as pinoDestination,
-  multistream,
-  stdTimeFunctions
-} from "pino";
-import pinoPretty from "pino-pretty";
-import { Writable } from "stream";
-var DEFAULT_REDACT_HEADERS = ["authorization", "cookie", "set-cookie", "x-api-key"];
-var DEFAULT_REDACT_PATHS = [
-  "password",
-  "currentPassword",
-  "newPassword",
-  "confirmPassword",
-  "token",
-  "refreshToken",
-  "accessToken",
-  "secret",
-  "apiKey",
-  "inviteToken",
-  "resetToken"
-];
-var DEFAULT_MAX_BODY_BYTES = 8192;
-var DEFAULT_SUCCESS_SAMPLE_RATE = 0.1;
-var DEFAULT_BODY_SAMPLE_RATE = 0.02;
-var REDACTED_VALUE = "[REDACTED]";
-var runtimeByConfig = /* @__PURE__ */ new WeakMap();
-var fallbackLogger = pino({
-  name: "dyrected",
-  enabled: process.env.DISABLE_LOGGING !== "true",
-  timestamp: stdTimeFunctions.isoTime
-});
-function resolveObservabilityConfig(config) {
-  const requestLogging = config?.requestLogging;
-  const sampling = config?.sampling;
-  const tracing = config?.tracing;
-  const metrics = config?.metrics;
-  return {
-    requestLogging: {
-      enabled: requestLogging?.enabled ?? true,
-      logBodies: requestLogging?.logBodies ?? false,
-      maxBodyBytes: requestLogging?.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES,
-      redactPaths: uniqueValues([
-        ...DEFAULT_REDACT_PATHS,
-        ...requestLogging?.redactPaths ?? []
-      ]),
-      includeHeaders: normalizeHeaderNames(requestLogging?.includeHeaders ?? []),
-      redactHeaders: uniqueValues(
-        normalizeHeaderNames([
-          ...DEFAULT_REDACT_HEADERS,
-          ...requestLogging?.redactHeaders ?? []
-        ])
-      )
-    },
-    sampling: {
-      successRate: clampRate(sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE),
-      traceSuccessRate: clampRate(
-        sampling?.traceSuccessRate ?? sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE
-      ),
-      bodySuccessRate: clampRate(
-        sampling?.bodySuccessRate ?? Math.min(DEFAULT_BODY_SAMPLE_RATE, sampling?.successRate ?? DEFAULT_SUCCESS_SAMPLE_RATE)
-      ),
-      alwaysKeep4xx: sampling?.alwaysKeep4xx ?? true,
-      alwaysKeep5xx: sampling?.alwaysKeep5xx ?? true
-    },
-    tracing: {
-      enabled: tracing?.enabled ?? false,
-      serviceName: tracing?.serviceName ?? "dyrected",
-      exporter: tracing?.exporter ?? "none",
-      headers: tracing?.headers ?? {},
-      endpoint: tracing?.endpoint
-    },
-    metrics: {
-      enabled: metrics?.enabled ?? false,
-      exporter: metrics?.exporter ?? "none",
-      endpoint: metrics?.endpoint,
-      path: metrics?.path ?? "/metrics"
-    },
-    transports: {
-      targets: config?.transports?.targets && config.transports.targets.length > 0 ? config.transports.targets : [{ type: "stdout" }]
-    }
-  };
-}
-function createObservabilityRuntime(config) {
-  const resolved = resolveObservabilityConfig(config.observability);
-  const logger = createRootLogger(config.logger, resolved);
-  const shutdownTasks = [];
-  const meterRuntime = resolved.metrics.enabled || resolved.metrics.exporter === "prometheus" ? createMeterProvider(resolved) : void 0;
-  const tracerProvider = resolved.tracing.enabled ? createTracerProvider(resolved) : void 0;
-  const tracer = tracerProvider?.getTracer("dyrected");
-  const meter = meterRuntime?.provider.getMeter("dyrected");
-  const metrics = meter ? {
-    requestCount: meter.createCounter("dyrected_http_requests_total", {
-      description: "Total HTTP requests served by Dyrected"
-    }),
-    authFailureCount: meter.createCounter("dyrected_auth_failures_total", {
-      description: "Authentication failures"
-    }),
-    uncaughtErrorCount: meter.createCounter("dyrected_uncaught_errors_total", {
-      description: "Uncaught application errors"
-    }),
-    auditWriteFailureCount: meter.createCounter("dyrected_audit_write_failures_total", {
-      description: "Audit log persistence failures"
-    }),
-    emailSendFailureCount: meter.createCounter("dyrected_email_send_failures_total", {
-      description: "Transactional email delivery failures"
-    }),
-    workflowHookFailureCount: meter.createCounter("dyrected_workflow_hook_failures_total", {
-      description: "Workflow hook failures isolated after successful writes"
-    }),
-    requestDuration: meter.createHistogram("dyrected_http_request_duration_ms", {
-      description: "HTTP request duration in milliseconds",
-      unit: "ms"
-    })
-  } : void 0;
-  if (meterRuntime) {
-    shutdownTasks.push(() => meterRuntime.provider.shutdown());
-  }
-  if (tracerProvider) {
-    shutdownTasks.push(() => tracerProvider.shutdown());
-  }
-  return {
-    logger,
-    config: resolved,
-    tracer,
-    metrics,
-    prometheusExporter: meterRuntime?.prometheusExporter,
-    shutdown: async () => {
-      for (const task of shutdownTasks) {
-        await task();
-      }
-    },
-    recordAuthFailure: (attributes) => metrics?.authFailureCount.add(1, attributes),
-    recordUncaughtError: (attributes) => metrics?.uncaughtErrorCount.add(1, attributes),
-    recordAuditWriteFailure: (attributes) => metrics?.auditWriteFailureCount.add(1, attributes),
-    recordEmailSendFailure: (attributes) => metrics?.emailSendFailureCount.add(1, attributes),
-    recordWorkflowHookFailure: (attributes) => metrics?.workflowHookFailureCount.add(1, attributes)
-  };
-}
-function bindObservabilityRuntime(config, runtime) {
-  runtimeByConfig.set(config, runtime);
-}
-function getObservabilityRuntime(config) {
-  if (!config || typeof config !== "object") return void 0;
-  return runtimeByConfig.get(config);
-}
-function createRootLogger(loggerConfig, observability) {
-  if (loggerConfig && !("options" in loggerConfig)) {
-    return loggerConfig;
-  }
-  const options = loggerConfig?.options ?? {};
-  const enabled = options.enabled ?? process.env.DISABLE_LOGGING !== "true";
-  const name = options.name ?? "dyrected";
-  if (loggerConfig?.destination) {
-    return pino(
-      {
-        ...options,
-        enabled,
-        name,
-        timestamp: options.timestamp ?? stdTimeFunctions.isoTime
-      },
-      loggerConfig.destination
-    );
-  }
-  const streams = buildTransportStreams(observability);
-  const destination = streams.length === 1 ? streams[0] : multistream(streams.map((stream) => ({ stream })));
-  return pino(
-    {
-      ...options,
-      enabled,
-      name,
-      timestamp: options.timestamp ?? stdTimeFunctions.isoTime
-    },
-    destination
-  );
-}
-function buildTransportStreams(observability) {
-  const targets = observability.transports.targets;
-  if (targets.length === 0) {
-    return [defaultLoggerDestination()];
-  }
-  return targets.map((target) => {
-    switch (target.type) {
-      case "stdout":
-        return defaultLoggerDestination();
-      case "stderr":
-        return pinoDestination(2);
-      case "file":
-        return pinoDestination(target.path);
-      case "otlp":
-        return new OtlpLogWritable(target.endpoint, target.headers);
-    }
-  });
-}
-function defaultLoggerDestination() {
-  if (process.env.NODE_ENV !== "production") {
-    return pinoPretty({
-      colorize: true,
-      ignore: "pid,hostname",
-      translateTime: "SYS:HH:MM:ss",
-      destination: 1,
-      sync: true
-    });
-  }
-  return pinoDestination(1);
-}
-var OtlpLogWritable = class extends Writable {
-  constructor(endpoint, headers = {}) {
-    super();
-    this.endpoint = endpoint;
-    this.headers = headers;
-  }
-  endpoint;
-  headers;
-  _write(chunk, _encoding, callback) {
-    const payload = chunk.toString();
-    void fetch(this.endpoint, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        ...this.headers
-      },
-      body: JSON.stringify({ logs: payload.trim().split("\n").filter(Boolean) })
-    }).then(() => callback()).catch(
-      (error) => callback(error instanceof Error ? error : new Error(String(error)))
-    );
-  }
-};
-function createTracerProvider(observability) {
-  const exporter = createTraceExporter(observability);
-  const provider = new BasicTracerProvider({
-    resource: resourceFromAttributes({
-      "service.name": observability.tracing.serviceName
-    }),
-    spanProcessors: exporter ? [new BatchSpanProcessor(exporter)] : []
-  });
-  trace.setGlobalTracerProvider(provider);
-  return provider;
-}
-function createTraceExporter(observability) {
-  switch (observability.tracing.exporter) {
-    case "console":
-      return new ConsoleSpanExporter();
-    case "otlp":
-      return new OTLPTraceExporter({
-        url: observability.tracing.endpoint,
-        headers: observability.tracing.headers
-      });
-    default:
-      return void 0;
-  }
-}
-function createMeterProvider(observability) {
-  const readers = [];
-  let prometheusExporter;
-  switch (observability.metrics.exporter) {
-    case "otlp":
-      readers.push(
-        new PeriodicExportingMetricReader({
-          exporter: new OTLPMetricExporter({
-            url: observability.metrics.endpoint
-          })
-        })
-      );
-      break;
-    case "prometheus":
-      prometheusExporter = new PrometheusExporter({
-        endpoint: observability.metrics.path,
-        preventServerStart: true
-      });
-      readers.push(prometheusExporter);
-      break;
-  }
-  const provider = new MeterProvider({
-    resource: resourceFromAttributes({
-      "service.name": observability.tracing.serviceName
-    }),
-    readers
-  });
-  return { provider, prometheusExporter };
-}
-function getConfigLogger(config, component) {
-  const base = config?.logger && !("options" in config.logger) ? config.logger : fallbackLogger;
-  return base.child({ component });
-}
-function getRequestLogger(c, component) {
-  const base = c.get("logger") ?? fallbackLogger;
-  return component ? base.child({ component }) : base;
-}
-function buildRequestLogger(runtime, vars, requestId) {
-  const trace2 = vars.requestTrace;
-  return runtime.logger.child({
-    requestId,
-    siteId: vars.siteId,
-    workspaceId: vars.workspaceId,
-    traceId: trace2?.traceId,
-    spanId: trace2?.spanId
-  });
-}
-function shouldSampleRequest(requestId, statusCode, sampling, kind) {
-  if (statusCode >= 500 && sampling.alwaysKeep5xx) return true;
-  if (statusCode >= 400 && sampling.alwaysKeep4xx) return true;
-  const rate = kind === "trace" ? sampling.traceSuccessRate : kind === "body" ? sampling.bodySuccessRate : sampling.successRate;
-  return deterministicSample(requestId ?? "no-request-id", rate);
-}
-function redactHeaders(headers, observability) {
-  const includeHeaders = new Set(observability.requestLogging.includeHeaders);
-  const redactHeaders2 = new Set(observability.requestLogging.redactHeaders);
-  const output = {};
-  for (const [key, value] of Object.entries(headers)) {
-    const normalizedKey = key.toLowerCase();
-    if (includeHeaders.size > 0 && !includeHeaders.has(normalizedKey)) continue;
-    output[normalizedKey] = redactHeaders2.has(normalizedKey) ? REDACTED_VALUE : value;
-  }
-  return output;
-}
-async function captureRequestBody(request, observability) {
-  const contentType = request.headers.get("content-type") ?? void 0;
-  const contentLength = toNumber(request.headers.get("content-length"));
-  const jsonBody = contentType?.includes("application/json");
-  if (!jsonBody) {
-    return {
-      attempted: false,
-      contentType,
-      contentLength
-    };
-  }
-  try {
-    const text = await request.clone().text();
-    if (!text) {
-      return { attempted: true, contentType, contentLength };
-    }
-    const truncated = text.length > observability.requestLogging.maxBodyBytes;
-    const raw = truncated ? text.slice(0, observability.requestLogging.maxBodyBytes) : text;
-    try {
-      const parsed = JSON.parse(raw);
-      return {
-        attempted: true,
-        contentType,
-        contentLength: contentLength ?? text.length,
-        truncated,
-        body: redactBody(parsed, observability.requestLogging.redactPaths)
-      };
-    } catch {
-      return {
-        attempted: true,
-        contentType,
-        contentLength: contentLength ?? text.length,
-        truncated,
-        parseFailed: true
-      };
-    }
-  } catch {
-    return {
-      attempted: true,
-      contentType,
-      contentLength,
-      parseFailed: true
-    };
-  }
-}
-function redactBody(value, redactPaths) {
-  const cloned = deepClone(value);
-  for (const path of redactPaths) {
-    applyRedaction(cloned, path.split("."));
-  }
-  return cloned;
-}
-function applyRedaction(target, segments) {
-  if (!target || segments.length === 0) return;
-  const [segment, ...rest] = segments;
-  if (Array.isArray(target)) {
-    for (const item of target) {
-      if (segment === "*") {
-        applyRedaction(item, rest);
-      } else {
-        applyRedaction(item, segments);
-      }
-    }
-    return;
-  }
-  if (typeof target !== "object") return;
-  const record = target;
-  if (segment === "*") {
-    for (const value of Object.values(record)) {
-      applyRedaction(value, rest);
-    }
-    return;
-  }
-  if (!(segment in record)) return;
-  if (rest.length === 0) {
-    record[segment] = REDACTED_VALUE;
-    return;
-  }
-  applyRedaction(record[segment], rest);
-}
-function deepClone(value) {
-  if (typeof structuredClone === "function") {
-    return structuredClone(value);
-  }
-  return JSON.parse(JSON.stringify(value));
-}
-function createRequestSpan(runtime, name, attributes) {
-  if (!runtime.tracer) return void 0;
-  const span = runtime.tracer.startSpan(name, { attributes }, otelContext.active());
-  const spanContext = span.spanContext();
-  return {
-    span,
-    traceId: spanContext.traceId,
-    spanId: spanContext.spanId,
-    sampled: spanContext.traceFlags === TraceFlags.SAMPLED
-  };
-}
-function endRequestSpan(requestTrace, statusCode, error) {
-  if (!requestTrace) return;
-  requestTrace.span.setAttribute("http.status_code", statusCode);
-  if (error) {
-    requestTrace.span.recordException(error instanceof Error ? error : new Error(String(error)));
-  }
-  requestTrace.span.end();
-}
-function attachRequestMetrics(runtime, args) {
-  runtime.metrics?.requestCount.add(1, {
-    method: args.method,
-    route: args.route,
-    status_class: `${Math.floor(args.statusCode / 100)}xx`
-  });
-  runtime.metrics?.requestDuration.record(args.durationMs, {
-    method: args.method,
-    route: args.route,
-    status_class: `${Math.floor(args.statusCode / 100)}xx`
-  });
-}
-async function renderPrometheusMetrics(exporter) {
-  let statusCode = 200;
-  const headers = {};
-  let body = "";
-  await new Promise((resolve) => {
-    const response = {
-      statusCode,
-      setHeader(name, value) {
-        headers[name.toLowerCase()] = value;
-      },
-      end(chunk) {
-        if (chunk) body += chunk;
-        statusCode = this.statusCode;
-        resolve();
-      }
-    };
-    exporter.getMetricsRequestHandler({}, response);
-  });
-  return { body, headers, statusCode };
-}
-function normalizeHeaderNames(headers) {
-  return headers.map((value) => value.toLowerCase());
-}
-function uniqueValues(values) {
-  return [...new Set(values)];
-}
-function clampRate(value) {
-  if (Number.isNaN(value)) return 0;
-  return Math.max(0, Math.min(1, value));
-}
-function deterministicSample(seed, rate) {
-  if (rate >= 1) return true;
-  if (rate <= 0) return false;
-  let hash = 0;
-  for (let index = 0; index < seed.length; index += 1) {
-    hash = hash * 31 + seed.charCodeAt(index) >>> 0;
-  }
-  return hash / 4294967295 <= rate;
-}
-function toNumber(value) {
-  if (!value) return void 0;
-  const parsed = Number(value);
-  return Number.isFinite(parsed) ? parsed : void 0;
-}
-
-// src/workflows.ts
-var WORKFLOW_HISTORY_COLLECTION = "__workflow_history";
-var LIFECYCLE_EVENTS_COLLECTION = "__lifecycle_events";
-var EDITOR_CAPABILITIES = ["entry.edit", "entry.submit"];
-var PUBLISHER_CAPABILITIES = ["entry.edit", "entry.submit", "entry.publish", "entry.unpublish"];
-function definePublishingWorkflow(options = {}) {
-  const editors = options.editors ?? ["editor"];
-  const publishers = options.publishers ?? ["publisher", "admin"];
-  return {
-    initialState: "draft",
-    draftState: "draft",
-    states: [
-      { name: "draft", label: "Draft", color: "neutral" },
-      { name: "in_review", label: "In review", color: "warning" },
-      { name: "published", label: "Published", color: "success", published: true }
-    ],
-    transitions: [
-      { name: "submit", label: "Submit for review", from: "draft", to: "in_review", requiredCapabilities: ["entry.submit"] },
-      { name: "publish", label: "Publish", from: "in_review", to: "published", requiredCapabilities: ["entry.publish"] },
-      { name: "reject", label: "Request changes", from: "in_review", to: "draft", requiredCapabilities: ["entry.publish"], requireComment: true },
-      { name: "unpublish", label: "Unpublish", from: "published", to: "draft", requiredCapabilities: ["entry.unpublish"], unpublish: true }
-    ],
-    roles: [
-      ...editors.map((role) => ({ role, capabilities: [...EDITOR_CAPABILITIES] })),
-      ...publishers.map((role) => ({ role, capabilities: [...PUBLISHER_CAPABILITIES] }))
-    ]
-  };
-}
-function publishingWorkflow() {
-  return definePublishingWorkflow();
-}
-function simplePublishingWorkflow() {
-  return {
-    initialState: "draft",
-    draftState: "draft",
-    states: [
-      { name: "draft", label: "Draft", color: "neutral" },
-      { name: "published", label: "Published", color: "success", published: true }
-    ],
-    transitions: [
-      { name: "publish", label: "Publish", from: "draft", to: "published" },
-      { name: "unpublish", label: "Unpublish", from: "published", to: "draft", unpublish: true }
-    ]
-    // Intentionally no `roles`: this lightweight workflow (synthesized from
-    // `drafts: true`) does no capability-based gating. Draft visibility for a
-    // no-roles workflow is handled in `canViewWorkflowDraft`.
-  };
-}
-function publicMetadata(meta) {
-  const { availableTransitions: _availableTransitions, ...safe } = meta;
-  return safe;
-}
-function workflowCapabilities(workflow, user) {
-  const capabilities = new Set(Array.isArray(user?.capabilities) ? user.capabilities : []);
-  const roles = Array.isArray(user?.roles) ? user.roles : [];
-  for (const mapping of workflow.roles ?? []) {
-    if (roles.includes(mapping.role)) mapping.capabilities.forEach((capability) => capabilities.add(capability));
-  }
-  return capabilities;
-}
-function canViewWorkflowDraft(workflow, user) {
-  if (!user) return false;
-  const capabilities = workflowCapabilities(workflow, user);
-  if (capabilities.has("entry.edit")) return true;
-  if (workflow.transitions.some(
-    (transition) => (transition.requiredCapabilities ?? []).some((capability) => capabilities.has(capability))
-  )) {
-    return true;
-  }
-  if (!workflow.roles || workflow.roles.length === 0) return true;
-  return false;
-}
-function availableWorkflowTransitions(workflow, state, user) {
-  const capabilities = workflowCapabilities(workflow, user);
-  return workflow.transitions.filter((transition) => {
-    const from = Array.isArray(transition.from) ? transition.from : [transition.from];
-    return from.includes(state) && (transition.requiredCapabilities ?? []).every((item) => capabilities.has(item));
-  });
-}
-function initializeWorkflowDocument(data, workflow) {
-  return {
-    ...data,
-    __workflow: { state: workflow.initialState, revision: 1 }
-  };
-}
-function publishedStateName(workflow) {
-  return workflow.states.find((state) => state.published)?.name ?? workflow.states[workflow.states.length - 1]?.name ?? workflow.initialState;
-}
-function materializeWorkflowDocument(doc, workflow, user) {
-  const meta = doc.__workflow;
-  const publishedState = publishedStateName(workflow);
-  if (!meta) {
-    const { __published: _legacyPublished, __workflow: _legacyWorkflow, ...working2 } = doc;
-    const state = publishedStateName(workflow);
-    return {
-      ...working2,
-      _workflow: {
-        state,
-        revision: 1,
-        availableTransitions: availableWorkflowTransitions(workflow, state, user).map((item) => item.name)
-      }
-    };
-  }
-  const { __published, __workflow, ...working } = doc;
-  if (!canViewWorkflowDraft(workflow, user)) {
-    if (!__published || typeof __published !== "object") {
-      if (meta.state === publishedState) {
-        return { ...working, _workflow: publicMetadata(meta) };
-      }
-      return null;
-    }
-    return { id: doc.id, ...__published, _workflow: publicMetadata(meta) };
-  }
-  return {
-    ...working,
-    _workflow: {
-      ...meta,
-      availableTransitions: availableWorkflowTransitions(workflow, meta.state, user).map((item) => item.name)
-    }
-  };
-}
-function eventId() {
-  return globalThis.crypto?.randomUUID?.() ?? `evt_${Date.now()}_${Math.random().toString(36).slice(2)}`;
-}
-function createLifecycleEvent(args) {
-  return {
-    id: eventId(),
-    name: args.name,
-    collection: args.collection,
-    documentId: args.documentId,
-    occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
-    actorId: args.actorId,
-    payload: args.payload,
-    attempts: 0,
-    status: "pending"
-  };
-}
-async function persistEvent(db, event) {
-  await db.create({ collection: LIFECYCLE_EVENTS_COLLECTION, data: event });
-}
-async function dispatchLifecycleEvent(config, event) {
-  const db = config.db;
-  if (!db || !config.events?.handlers.length) return;
-  const maxAttempts = config.events.maxAttempts ?? 8;
-  const retryDelayMs = config.events.retryDelayMs ?? 1e3;
-  const attempts = event.attempts + 1;
-  try {
-    await db.update({ collection: LIFECYCLE_EVENTS_COLLECTION, id: event.id, data: { status: "processing", attempts } });
-    for (const handler of config.events.handlers) await handler({ ...event, status: "processing", attempts });
-    await db.update({
-      collection: LIFECYCLE_EVENTS_COLLECTION,
-      id: event.id,
-      data: { status: "delivered", attempts, deliveredAt: (/* @__PURE__ */ new Date()).toISOString(), lastError: null }
-    });
-  } catch (error) {
-    const exhausted = attempts >= maxAttempts;
-    await db.update({
-      collection: LIFECYCLE_EVENTS_COLLECTION,
-      id: event.id,
-      data: {
-        status: "failed",
-        attempts,
-        lastError: error instanceof Error ? error.message : String(error),
-        nextAttemptAt: exhausted ? null : new Date(Date.now() + retryDelayMs * 2 ** (attempts - 1)).toISOString()
-      }
-    });
-  }
-}
-async function dispatchPendingLifecycleEvents(config, limit = 50) {
-  if (!config.db || !config.events?.handlers.length) return 0;
-  const maxAttempts = config.events.maxAttempts ?? 8;
-  const result = await config.db.find({
-    collection: LIFECYCLE_EVENTS_COLLECTION,
-    where: { status: { in: ["pending", "failed"] } },
-    sort: "occurredAt",
-    limit
-  });
-  const now = Date.now();
-  const due = result.docs.filter(
-    (doc) => Number(doc.attempts ?? 0) < maxAttempts && (!doc.nextAttemptAt || new Date(doc.nextAttemptAt).getTime() <= now)
-  );
-  for (const event of due) await dispatchLifecycleEvent(config, event);
-  return due.length;
-}
-async function saveWorkflowDraft(args) {
-  const { config, collection, id, originalDoc, data, user } = args;
-  const db = config.db;
-  const workflow = collection.workflow;
-  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
-  const previous = originalDoc.__workflow;
-  const isLegacyPublishedDoc = !previous;
-  const baselineRevision = previous?.revision ?? 1;
-  const event = createLifecycleEvent({
-    name: "revision.created",
-    collection: collection.slug,
-    documentId: id,
-    actorId: user?.sub,
-    payload: {
-      revision: baselineRevision + 1,
-      previousRevision: isLegacyPublishedDoc ? baselineRevision : previous?.revision ?? null
-    }
-  });
-  const doc = await db.transaction(async (tx) => {
-    const nextMeta = {
-      ...previous ?? {},
-      state: isLegacyPublishedDoc ? workflow.draftState ?? workflow.initialState : originalDoc.__published ? workflow.draftState ?? workflow.initialState : previous.state,
-      revision: baselineRevision + 1,
-      ...isLegacyPublishedDoc ? { publishedRevision: baselineRevision } : {}
-    };
-    const updateData = {
-      ...data,
-      __workflow: nextMeta
-    };
-    if (isLegacyPublishedDoc) {
-      const { __workflow: _legacyWorkflow, __published: _legacyPublished, ...publishedSnapshot } = originalDoc;
-      updateData.__published = publishedSnapshot;
-    }
-    const updated = await tx.update({ collection: collection.slug, id, data: updateData });
-    await persistEvent(tx, event);
-    return updated;
-  });
-  void dispatchLifecycleEvent(config, event);
-  return { doc, event };
-}
-async function createWorkflowDocument(args) {
-  const { config, collection, data, user } = args;
-  const db = config.db;
-  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
-  let event;
-  const doc = await db.transaction(async (tx) => {
-    const created = await tx.create({ collection: collection.slug, data });
-    event = createLifecycleEvent({
-      name: "revision.created",
-      collection: collection.slug,
-      documentId: created.id,
-      actorId: user?.sub,
-      payload: { revision: 1, previousRevision: null }
-    });
-    await persistEvent(tx, event);
-    return created;
-  });
-  void dispatchLifecycleEvent(config, event);
-  return { doc, event };
-}
-async function transitionWorkflow(args) {
-  const { config, collection, id, transitionName, expectedRevision, comment, user, req } = args;
-  const db = config.db;
-  const workflow = collection.workflow;
-  if (!db.transaction) throw new Error(`The configured database adapter does not support workflow transactions.`);
-  const original = await db.findOne({ collection: collection.slug, id });
-  if (!original) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
-  const meta = original.__workflow;
-  if (!meta) throw Object.assign(new Error("Entry has no workflow metadata"), { statusCode: 409 });
-  if (expectedRevision !== void 0 && expectedRevision !== meta.revision) {
-    throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
-  }
-  const transition = workflow.transitions.find((item) => item.name === transitionName);
-  const fromStates = transition ? Array.isArray(transition.from) ? transition.from : [transition.from] : [];
-  if (!transition || !fromStates.includes(meta.state)) {
-    throw Object.assign(new Error(`Transition "${transitionName}" is not valid from "${meta.state}".`), { statusCode: 409 });
-  }
-  if (!availableWorkflowTransitions(workflow, meta.state, user).some((item) => item.name === transition.name)) {
-    throw Object.assign(new Error(`You do not have permission to perform "${transition.label}".`), { statusCode: 403 });
-  }
-  if (transition.requireComment && !comment?.trim()) {
-    throw Object.assign(new Error(`A comment is required for "${transition.label}".`), { statusCode: 400 });
-  }
-  const hookContext = { transition, from: meta.state, to: transition.to, doc: original, user, comment, req, db };
-  for (const hook of workflow.hooks?.beforeTransition ?? []) await hook(hookContext);
-  const events = [createLifecycleEvent({
-    name: "workflow.transitioned",
-    collection: collection.slug,
-    documentId: id,
-    actorId: user?.sub,
-    payload: { transition: transition.name, from: meta.state, to: transition.to, revision: meta.revision, comment }
-  })];
-  const targetState = workflow.states.find((state) => state.name === transition.to);
-  if (targetState.published) {
-    events.push(createLifecycleEvent({ name: "entry.published", collection: collection.slug, documentId: id, actorId: user?.sub, payload: { revision: meta.revision } }));
-  } else if (transition.unpublish) {
-    events.push(createLifecycleEvent({ name: "entry.unpublished", collection: collection.slug, documentId: id, actorId: user?.sub, payload: { revision: meta.publishedRevision } }));
-  }
-  const updated = await db.transaction(async (tx) => {
-    const locked = await tx.findOne({ collection: collection.slug, id });
-    if (!locked) throw Object.assign(new Error("Not Found"), { statusCode: 404 });
-    const lockedMeta = locked.__workflow;
-    if (lockedMeta.revision !== meta.revision || lockedMeta.state !== meta.state || expectedRevision !== void 0 && lockedMeta.revision !== expectedRevision) {
-      throw Object.assign(new Error("This entry changed since it was loaded. Refresh before transitioning it."), { statusCode: 409 });
-    }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const { __published: _published, __workflow: _workflow, id: _id, ...working } = locked;
-    const nextMeta = {
-      ...lockedMeta,
-      state: transition.to,
-      ...targetState.published ? { publishedRevision: lockedMeta.revision, publishedAt: now, publishedBy: user?.sub } : {},
-      ...transition.unpublish ? { publishedRevision: void 0, publishedAt: void 0, publishedBy: void 0 } : {}
-    };
-    const data = { __workflow: nextMeta };
-    if (targetState.published) data.__published = working;
-    if (transition.unpublish) data.__published = null;
-    const next = await tx.update({ collection: collection.slug, id, data });
-    await tx.create({
-      collection: WORKFLOW_HISTORY_COLLECTION,
-      data: { collection: collection.slug, documentId: id, transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision, comment: comment ?? null, actorId: user?.sub ?? null, createdAt: now }
-    });
-    for (const event of events) await persistEvent(tx, event);
-    if (collection.audit) {
-      await tx.create({ collection: "__audit", data: { collection: collection.slug, documentId: id, operation: "workflow.transition", user: user?.sub ?? null, timestamp: now, changes: JSON.stringify({ transition: transition.name, from: lockedMeta.state, to: transition.to, revision: lockedMeta.revision }) } });
-    }
-    return next;
-  });
-  for (const event of events) void dispatchLifecycleEvent(config, event);
-  for (const hook of workflow.hooks?.afterTransition ?? []) {
-    try {
-      await hook({ ...hookContext, doc: updated, event: events[0] });
-    } catch (error) {
-      getObservabilityRuntime(config)?.recordWorkflowHookFailure({
-        collection: collection.slug,
-        transition: transition.name
-      });
-      getConfigLogger(config, "workflow").error({
-        err: error,
-        msg: "afterTransition hook failed",
-        collection: collection.slug,
-        transition: transition.name,
-        documentId: id
-      });
-    }
-  }
-  return updated;
-}
-
-// src/utils/admin-auth.ts
-function getAdminAuthCollection(config) {
-  const adminCollection = resolveAdminAuthCollection(config.collections, config.adminAuth?.collectionSlug);
-  return adminCollection ?? null;
-}
-function resolveAdminAuthCollection(collections, collectionSlug) {
-  const adminsCollection = collections.find((collection) => collection.slug === "__admins");
-  if (adminsCollection) return adminsCollection;
-  if (collectionSlug) {
-    const requestedCollection = collections.find((collection) => collection.slug === collectionSlug);
-    if (requestedCollection) return requestedCollection;
-  }
-  return collections.find((collection) => collection.auth);
-}
-function getPublicAdminAuthConfig(adminAuth, collections) {
-  const providers = (adminAuth?.providers ?? []).map((provider) => ({
-    id: provider.id,
-    type: provider.type,
-    displayName: provider.displayName || humanizeProviderName(provider.id, provider.type),
-    autoRedirect: provider.autoRedirect
-  }));
-  const resolvedCollectionSlug = collections ? resolveAdminAuthCollection(collections, adminAuth?.collectionSlug)?.slug : adminAuth?.collectionSlug;
-  return {
-    mode: adminAuth?.mode ?? "local",
-    collectionSlug: resolvedCollectionSlug,
-    provisioningMode: adminAuth?.provisioningMode,
-    providers
-  };
-}
-function humanizeProviderName(id, type) {
-  const cleaned = id.replace(/[-_]+/g, " ").trim();
-  if (!cleaned) return type.toUpperCase();
-  return cleaned.replace(/\b\w/g, (char) => char.toUpperCase());
-}
-
-// src/utils/declarative-hooks.ts
-import jexl from "jexl";
-var SURFACE_ROOTS = {
-  "collection.beforeRead": ["req", "user", "query"],
-  "collection.afterRead": ["req", "user", "doc"],
-  "collection.beforeChange": ["req", "user", "data", "doc", "operation"],
-  "global.beforeRead": ["req", "user", "query"],
-  "global.afterRead": ["req", "user", "doc"],
-  "global.beforeChange": ["req", "user", "data", "doc", "operation"],
-  "field.beforeChange": ["value", "data", "originalDoc", "user"],
-  "field.admin.onChange": ["value", "siblingData", "data"]
-};
-var ACCESS_ROOTS = ["user", "req", "doc", "data", "id", "config"];
-var ADMIN_CONDITION_RESERVED_ROOTS = ["data", "siblingData", "user", "id"];
-var PREVIEW_URL_RESERVED_ROOTS = ["siteUrl", "id"];
-var COMPILE_CACHE = /* @__PURE__ */ new Map();
-function compileExpression(expression) {
-  const cached = COMPILE_CACHE.get(expression);
-  if (cached) return cached;
-  const compiled = jexl.compile(expression);
-  const next = { ast: compiled._ast };
-  COMPILE_CACHE.set(expression, next);
-  return next;
-}
-function isPlainObject(value) {
-  return !!value && typeof value === "object" && !Array.isArray(value);
-}
-function quoteSegment(value) {
-  return `["${value.replace(/"/g, '\\"')}"]`;
-}
-function fieldSegment(field, index) {
-  return typeof field.name === "string" && field.name.length > 0 ? `fields${quoteSegment(field.name)}` : `fields[${index}]`;
-}
-function blockSegment(block, index) {
-  return typeof block.slug === "string" && block.slug.length > 0 ? `blocks${quoteSegment(block.slug)}` : `blocks[${index}]`;
-}
-function collectionSegment(collection, index) {
-  return typeof collection.slug === "string" && collection.slug.length > 0 ? `collections${quoteSegment(collection.slug)}` : `collections[${index}]`;
-}
-function globalSegment(global, index) {
-  return typeof global.slug === "string" && global.slug.length > 0 ? `globals${quoteSegment(global.slug)}` : `globals[${index}]`;
-}
-function colorize(value, code, enabled) {
-  return enabled ? `\x1B[${code}m${value}\x1B[0m` : value;
-}
-function collectRootIdentifiers(node, roots, seen) {
-  if (!node || typeof node !== "object" || seen.has(node)) return;
-  seen.add(node);
-  const candidate = node;
-  if (candidate.type === "Identifier") {
-    if (candidate.from) {
-      collectRootIdentifiers(candidate.from, roots, seen);
-      return;
-    }
-    if (typeof candidate.value === "string" && candidate.value !== "null") {
-      roots.add(candidate.value);
-    }
-    return;
-  }
-  if (Array.isArray(node)) {
-    for (const entry of node) collectRootIdentifiers(entry, roots, seen);
-    return;
-  }
-  for (const value of Object.values(node)) {
-    if (Array.isArray(value)) {
-      for (const entry of value) collectRootIdentifiers(entry, roots, seen);
-      continue;
-    }
-    if (value && typeof value === "object") {
-      collectRootIdentifiers(value, roots, seen);
-    }
-  }
-}
-function getInvalidRoots(expression, allowedRoots) {
-  const { ast } = compileExpression(expression);
-  const roots = /* @__PURE__ */ new Set();
-  collectRootIdentifiers(ast, roots, /* @__PURE__ */ new Set());
-  const allowed = new Set(allowedRoots);
-  return [...roots].filter((root) => !allowed.has(root));
-}
-function validateDeclarativeHookExpression(expression, surface, path) {
-  try {
-    const invalidRoots = getInvalidRoots(expression, SURFACE_ROOTS[surface]);
-    if (invalidRoots.length === 0) return [];
-    return [
-      {
-        path,
-        surface,
-        expression,
-        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${SURFACE_ROOTS[surface].map((root) => `"${root}"`).join(", ")}`
-      }
-    ];
-  } catch (error) {
-    return [
-      {
-        path,
-        surface,
-        expression,
-        message: `has invalid syntax: ${error.message}`
-      }
-    ];
-  }
-}
-function validateDeclarativeAccessExpression(expression, surface, path) {
-  try {
-    const invalidRoots = getInvalidRoots(expression, ACCESS_ROOTS);
-    if (invalidRoots.length === 0) return [];
-    return [
-      {
-        path,
-        surface,
-        expression,
-        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${ACCESS_ROOTS.map((root) => `"${root}"`).join(", ")}`
-      }
-    ];
-  } catch (error) {
-    return [
-      {
-        path,
-        surface,
-        expression,
-        message: `has invalid syntax: ${error.message}`
-      }
-    ];
-  }
-}
-function validateAdminConditionExpression(expression, path, allowedRoots) {
-  try {
-    const invalidRoots = getInvalidRoots(expression, allowedRoots);
-    if (invalidRoots.length === 0) return [];
-    return [
-      {
-        path,
-        surface: "field.admin.condition",
-        expression,
-        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${allowedRoots.map((root) => `"${root}"`).join(", ")}`
-      }
-    ];
-  } catch (error) {
-    return [
-      {
-        path,
-        surface: "field.admin.condition",
-        expression,
-        message: `has invalid syntax: ${error.message}`
-      }
-    ];
-  }
-}
-function validatePreviewUrlExpression(expression, path, allowedRoots) {
-  try {
-    const invalidRoots = getInvalidRoots(expression, allowedRoots);
-    if (invalidRoots.length === 0) return [];
-    return [
-      {
-        path,
-        surface: "collection.admin.previewUrl",
-        expression,
-        message: `uses unsupported context ${invalidRoots.map((root) => `"${root}"`).join(", ")}. Allowed context: ${allowedRoots.map((root) => `"${root}"`).join(", ")}`
-      }
-    ];
-  } catch (error) {
-    return [
-      {
-        path,
-        surface: "collection.admin.previewUrl",
-        expression,
-        message: `has invalid syntax: ${error.message}`
-      }
-    ];
-  }
-}
-function assertValidDeclarativeHookExpression(expression, surface, path) {
-  const issues = validateDeclarativeHookExpression(expression, surface, path);
-  if (issues.length === 0) return;
-  throw new Error(`Invalid declarative hook at ${path}: ${issues[0].message}`);
-}
-function assertValidDeclarativeHookResult(result, surface, path) {
-  if (isPlainObject(result)) return;
-  throw new Error(`Invalid declarative hook result at ${path}: ${surface} expressions must return an object`);
-}
-function collectFieldIssues(fields, path, issues) {
-  fields.forEach((field, index) => {
-    const fieldPath = `${path}.${fieldSegment(field, index)}`;
-    field.hooks?.beforeChange?.forEach((hook, hookIndex) => {
-      if (typeof hook !== "string") return;
-      issues.push(
-        ...validateDeclarativeHookExpression(
-          hook,
-          "field.beforeChange",
-          `${fieldPath}.hooks.beforeChange[${hookIndex}]`
-        )
-      );
-    });
-    field.hooks?.afterRead?.forEach((hook, hookIndex) => {
-      if (typeof hook !== "string") return;
-      issues.push({
-        path: `${fieldPath}.hooks.afterRead[${hookIndex}]`,
-        surface: "unsupported",
-        expression: hook,
-        message: "declarative strings are not supported on field hooks.afterRead"
-      });
-    });
-    if (typeof field.admin?.hooks?.onChange === "string") {
-      issues.push(
-        ...validateDeclarativeHookExpression(
-          field.admin.hooks.onChange,
-          "field.admin.onChange",
-          `${fieldPath}.admin.hooks.onChange`
-        )
-      );
-    }
-    if (typeof field.admin?.hooks?.options === "string") {
-      issues.push({
-        path: `${fieldPath}.admin.hooks.options`,
-        surface: "unsupported",
-        expression: field.admin.hooks.options,
-        message: "declarative strings are not supported on field admin.hooks.options"
-      });
-    }
-    if (Array.isArray(field.fields)) {
-      collectFieldIssues(field.fields, fieldPath, issues);
-    }
-    if (Array.isArray(field.blocks)) {
-      field.blocks.forEach((block, blockIndex) => {
-        if (!Array.isArray(block.fields)) return;
-        collectFieldIssues(block.fields, `${fieldPath}.${blockSegment(block, blockIndex)}`, issues);
-      });
-    }
-  });
-}
-function collectFieldNames(fields) {
-  return fields.flatMap(
-    (field) => typeof field.name === "string" && field.name.length > 0 ? [field.name] : []
-  );
-}
-function collectAdminConditionIssues(fields, path, rootFieldNames, issues) {
-  const scopeFieldNames = collectFieldNames(fields);
-  const allowedRoots = [.../* @__PURE__ */ new Set([...ADMIN_CONDITION_RESERVED_ROOTS, ...rootFieldNames, ...scopeFieldNames])];
-  fields.forEach((field, index) => {
-    const fieldPath = `${path}.${fieldSegment(field, index)}`;
-    if (typeof field.admin?.condition === "string") {
-      issues.push(
-        ...validateAdminConditionExpression(
-          field.admin.condition,
-          `${fieldPath}.admin.condition`,
-          allowedRoots
-        )
-      );
-    }
-    if (Array.isArray(field.fields)) {
-      collectAdminConditionIssues(field.fields, fieldPath, rootFieldNames, issues);
-    }
-    if (Array.isArray(field.blocks)) {
-      field.blocks.forEach((block, blockIndex) => {
-        if (!Array.isArray(block.fields)) return;
-        collectAdminConditionIssues(
-          block.fields,
-          `${fieldPath}.${blockSegment(block, blockIndex)}`,
-          rootFieldNames,
-          issues
-        );
-      });
-    }
-  });
-}
-function collectFieldAccessIssues(fields, path, issues) {
-  fields.forEach((field, index) => {
-    const fieldPath = `${path}.${fieldSegment(field, index)}`;
-    if (typeof field.access?.read === "string") {
-      issues.push(...validateDeclarativeAccessExpression(field.access.read, "field.access", `${fieldPath}.access.read`));
-    }
-    if (typeof field.access?.create === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(field.access.create, "field.access", `${fieldPath}.access.create`)
-      );
-    }
-    if (typeof field.access?.update === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(field.access.update, "field.access", `${fieldPath}.access.update`)
-      );
-    }
-    if (Array.isArray(field.fields)) {
-      collectFieldAccessIssues(field.fields, fieldPath, issues);
-    }
-    if (Array.isArray(field.blocks)) {
-      field.blocks.forEach((block, blockIndex) => {
-        if (!Array.isArray(block.fields)) return;
-        collectFieldAccessIssues(
-          block.fields,
-          `${fieldPath}.${blockSegment(block, blockIndex)}`,
-          issues
-        );
-      });
-    }
-  });
-}
-function collectHookIssues(hooks, scope, path, issues) {
-  if (!hooks) return;
-  const supported = {
-    beforeRead: `${scope}.beforeRead`,
-    afterRead: `${scope}.afterRead`,
-    beforeChange: `${scope}.beforeChange`
-  };
-  for (const [key, value] of Object.entries(hooks)) {
-    if (!Array.isArray(value)) continue;
-    value.forEach((hook, index) => {
-      if (typeof hook !== "string") return;
-      const surface = supported[key];
-      if (!surface) {
-        issues.push({
-          path: `${path}.${key}[${index}]`,
-          surface: "unsupported",
-          expression: hook,
-          message: `declarative strings are not supported on ${scope} hooks.${key}`
-        });
-        return;
-      }
-      issues.push(...validateDeclarativeHookExpression(hook, surface, `${path}.${key}[${index}]`));
-    });
-  }
-}
-function collectDeclarativeHookValidationIssues(config) {
-  const issues = [];
-  config.blocks?.forEach((block, blockIndex) => {
-    if (!Array.isArray(block.fields)) return;
-    collectFieldIssues(
-      block.fields,
-      blockSegment(block, blockIndex),
-      issues
-    );
-  });
-  config.collections.forEach((collection, collectionIndex) => {
-    const collectionPath = collectionSegment(collection, collectionIndex);
-    collectHookIssues(
-      collection.hooks,
-      "collection",
-      `${collectionPath}.hooks`,
-      issues
-    );
-    collectFieldIssues(collection.fields, collectionPath, issues);
-  });
-  config.globals?.forEach((global, globalIndex) => {
-    const globalPath = globalSegment(global, globalIndex);
-    collectHookIssues(
-      global.hooks,
-      "global",
-      `${globalPath}.hooks`,
-      issues
-    );
-    collectFieldIssues(global.fields, globalPath, issues);
-  });
-  return issues;
-}
-function collectDeclarativeAccessValidationIssues(config) {
-  const issues = [];
-  Object.entries(config.accessPolicies ?? {}).forEach(([name, value]) => {
-    if (typeof value !== "string") return;
-    issues.push(
-      ...validateDeclarativeAccessExpression(value, "config.accessPolicy", `accessPolicies.${name}`)
-    );
-  });
-  config.blocks?.forEach((block, blockIndex) => {
-    if (!Array.isArray(block.fields)) return;
-    collectFieldAccessIssues(
-      block.fields,
-      blockSegment(block, blockIndex),
-      issues
-    );
-  });
-  config.collections.forEach((collection, collectionIndex) => {
-    const collectionPath = collectionSegment(collection, collectionIndex);
-    if (typeof collection.access?.read === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(
-          collection.access.read,
-          "collection.access",
-          `${collectionPath}.access.read`
-        )
-      );
-    }
-    if (typeof collection.access?.create === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(
-          collection.access.create,
-          "collection.access",
-          `${collectionPath}.access.create`
-        )
-      );
-    }
-    if (typeof collection.access?.update === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(
-          collection.access.update,
-          "collection.access",
-          `${collectionPath}.access.update`
-        )
-      );
-    }
-    if (typeof collection.access?.delete === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(
-          collection.access.delete,
-          "collection.access",
-          `${collectionPath}.access.delete`
-        )
-      );
-    }
-    if (typeof collection.access?.readAudit === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(
-          collection.access.readAudit,
-          "collection.access",
-          `${collectionPath}.access.readAudit`
-        )
-      );
-    }
-    collectFieldAccessIssues(collection.fields, collectionPath, issues);
-  });
-  config.globals?.forEach((global, globalIndex) => {
-    const globalPath = globalSegment(global, globalIndex);
-    if (typeof global.access?.read === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(global.access.read, "global.access", `${globalPath}.access.read`)
-      );
-    }
-    if (typeof global.access?.update === "string") {
-      issues.push(
-        ...validateDeclarativeAccessExpression(
-          global.access.update,
-          "global.access",
-          `${globalPath}.access.update`
-        )
-      );
-    }
-    collectFieldAccessIssues(global.fields, globalPath, issues);
-  });
-  return issues;
-}
-function collectAdminConditionValidationIssues(config) {
-  const issues = [];
-  config.blocks?.forEach((block, blockIndex) => {
-    if (!Array.isArray(block.fields)) return;
-    collectAdminConditionIssues(
-      block.fields,
-      blockSegment(block, blockIndex),
-      collectFieldNames(block.fields),
-      issues
-    );
-  });
-  config.collections.forEach((collection, collectionIndex) => {
-    const collectionPath = collectionSegment(collection, collectionIndex);
-    const rootFieldNames = collectFieldNames(collection.fields);
-    collectAdminConditionIssues(collection.fields, collectionPath, rootFieldNames, issues);
-  });
-  config.globals?.forEach((global, globalIndex) => {
-    const globalPath = globalSegment(global, globalIndex);
-    const rootFieldNames = collectFieldNames(global.fields);
-    collectAdminConditionIssues(global.fields, globalPath, rootFieldNames, issues);
-  });
-  return issues;
-}
-function collectPreviewUrlValidationIssues(config) {
-  const issues = [];
-  config.collections.forEach((collection, collectionIndex) => {
-    if (typeof collection.admin?.previewUrl !== "string") return;
-    const collectionPath = collectionSegment(collection, collectionIndex);
-    const allowedRoots = [
-      .../* @__PURE__ */ new Set([...PREVIEW_URL_RESERVED_ROOTS, ...collectFieldNames(collection.fields)])
-    ];
-    issues.push(
-      ...validatePreviewUrlExpression(
-        collection.admin.previewUrl,
-        `${collectionPath}.admin.previewUrl`,
-        allowedRoots
-      )
-    );
-  });
-  return issues;
-}
-function assertValidAdminConditionsInConfig(config, source = "config") {
-  const diagnostics = collectAdminConditionValidationIssues(config).map((issue) => ({
-    severity: "error",
-    source: "adminCondition",
-    path: issue.path,
-    surface: issue.surface,
-    message: issue.message,
-    expression: issue.expression
-  }));
-  if (diagnostics.length === 0) return;
-  throw new ConfigValidationError(source, diagnostics);
-}
-function assertValidPreviewUrlsInConfig(config, source = "config") {
-  const diagnostics = collectPreviewUrlValidationIssues(config).map((issue) => ({
-    severity: "error",
-    source: "previewUrl",
-    path: issue.path,
-    surface: issue.surface,
-    message: issue.message,
-    expression: issue.expression
-  }));
-  if (diagnostics.length === 0) return;
-  throw new ConfigValidationError(source, diagnostics);
-}
-function collectConfigDiagnostics(config) {
-  const hookIssues = collectDeclarativeHookValidationIssues(config).map((issue) => ({
-    severity: "error",
-    source: "declarativeHook",
-    path: issue.path,
-    surface: issue.surface,
-    message: issue.message,
-    expression: issue.expression
-  }));
-  const accessIssues = collectDeclarativeAccessValidationIssues(config).map((issue) => ({
-    severity: "error",
-    source: "declarativeAccess",
-    path: issue.path,
-    surface: issue.surface,
-    message: issue.message,
-    expression: issue.expression
-  }));
-  const adminConditionIssues = collectAdminConditionValidationIssues(config).map((issue) => ({
-    severity: "error",
-    source: "adminCondition",
-    path: issue.path,
-    surface: issue.surface,
-    message: issue.message,
-    expression: issue.expression
-  }));
-  const previewUrlIssues = collectPreviewUrlValidationIssues(config).map((issue) => ({
-    severity: "error",
-    source: "previewUrl",
-    path: issue.path,
-    surface: issue.surface,
-    message: issue.message,
-    expression: issue.expression
-  }));
-  return [...hookIssues, ...accessIssues, ...adminConditionIssues, ...previewUrlIssues];
-}
-function formatConfigDiagnostics(source, diagnostics, options = {}) {
-  const color = options.color ?? false;
-  const header = `${colorize("Config validation failed", 31, color)} in ${colorize(source, 36, color)}`;
-  const lines = diagnostics.flatMap((issue, index) => [
-    `${colorize(`${index + 1}.`, 31, color)} ${colorize(issue.path, 1, color)}`,
-    `   ${issue.message}`,
-    `   ${colorize("surface:", 90, color)} ${issue.surface}`
-  ]);
-  return `${header}
-${lines.join("\n")}`;
-}
-var ConfigValidationError = class extends Error {
-  diagnostics;
-  source;
-  constructor(source, diagnostics) {
-    super(formatConfigDiagnostics(source, diagnostics));
-    this.name = "ConfigValidationError";
-    this.source = source;
-    this.diagnostics = diagnostics;
-  }
-};
-function isConfigValidationError(error) {
-  return error instanceof ConfigValidationError;
-}
-function assertValidDeclarativeHooksInConfig(config, source = "config") {
-  const diagnostics = collectDeclarativeHookValidationIssues(config).map((issue) => ({
-    severity: "error",
-    source: "declarativeHook",
-    path: issue.path,
-    surface: issue.surface,
-    message: issue.message,
-    expression: issue.expression
-  }));
-  if (diagnostics.length === 0) return;
-  throw new ConfigValidationError(source, diagnostics);
-}
-function assertValidDeclarativeAccessInConfig(config, source = "config") {
-  const diagnostics = collectDeclarativeAccessValidationIssues(config).map((issue) => ({
-    severity: "error",
-    source: "declarativeAccess",
-    path: issue.path,
-    surface: issue.surface,
-    message: issue.message,
-    expression: issue.expression
-  }));
-  if (diagnostics.length === 0) return;
-  throw new ConfigValidationError(source, diagnostics);
-}
-
-// src/auth/token.ts
-import { SignJWT, jwtVerify, decodeJwt } from "jose";
-import { TextEncoder } from "util";
-function getSecret() {
-  const secret = process.env.DYRECTED_JWT_SECRET;
-  if (!secret) {
-    throw new Error(
-      "[dyrected/core] DYRECTED_JWT_SECRET is not set. Add it to your environment variables to enable auth collections."
-    );
-  }
-  return new TextEncoder().encode(secret);
-}
-var DEFAULT_EXPIRY = "7d";
-async function signCollectionToken(payload, expiresIn = DEFAULT_EXPIRY) {
-  return new SignJWT({ ...payload }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(expiresIn).sign(getSecret());
-}
-async function verifyCollectionToken(token) {
-  const { payload } = await jwtVerify(token, getSecret());
-  return payload;
-}
-function decodeCollectionToken(token) {
-  try {
-    return decodeJwt(token);
-  } catch {
-    return null;
-  }
-}
-
-// src/auth/sessions.ts
-var AUTH_SESSIONS_COLLECTION = "__auth_sessions";
-async function issueAuthSessionToken(args) {
-  const sessionId = createSessionId();
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const db = args.config.db;
-  if (db) {
-    await db.create({
-      collection: AUTH_SESSIONS_COLLECTION,
-      data: {
-        id: sessionId,
-        userId: args.userId,
-        email: args.email,
-        collection: args.collection,
-        authSource: args.authSource ?? "local",
-        providerId: args.providerId,
-        lastIp: args.ip,
-        lastSeenAt: now,
-        revokedAt: null,
-        expiresAt: null
-      }
-    });
-  }
-  const token = await signCollectionToken(
-    {
-      sub: args.userId,
-      email: args.email,
-      collection: args.collection,
-      authSource: args.authSource,
-      providerId: args.providerId,
-      sid: sessionId
-    },
-    args.expiresIn
-  );
-  const payload = decodeCollectionToken(token);
-  const expiresAt = payload?.exp != null ? new Date(payload.exp * 1e3).toISOString() : null;
-  if (db && expiresAt) {
-    await db.update({
-      collection: AUTH_SESSIONS_COLLECTION,
-      id: sessionId,
-      data: {
-        expiresAt,
-        lastSeenAt: now,
-        lastIp: args.ip
-      }
-    });
-  }
-  return token;
-}
-async function getAuthSession(config, sessionId) {
-  const db = config.db;
-  if (!db) return null;
-  return await db.findOne({
-    collection: AUTH_SESSIONS_COLLECTION,
-    id: sessionId
-  });
-}
-function isAuthSessionActive(session) {
-  if (!session) return false;
-  if (session.revokedAt) return false;
-  if (session.expiresAt && new Date(session.expiresAt).getTime() <= Date.now()) {
-    return false;
-  }
-  return true;
-}
-async function touchAuthSession(config, sessionId, args) {
-  const db = config.db;
-  if (!db) return;
-  await db.update({
-    collection: AUTH_SESSIONS_COLLECTION,
-    id: sessionId,
-    data: {
-      lastSeenAt: (/* @__PURE__ */ new Date()).toISOString(),
-      ...args.ip ? { lastIp: args.ip } : {}
-    }
-  });
-}
-async function revokeAuthSession(config, sessionId) {
-  const db = config.db;
-  if (!db) return;
-  await db.update({
-    collection: AUTH_SESSIONS_COLLECTION,
-    id: sessionId,
-    data: {
-      revokedAt: (/* @__PURE__ */ new Date()).toISOString()
-    }
-  });
-}
-async function revokeAllAuthSessions(config, args) {
-  const db = config.db;
-  if (!db) return 0;
-  let page = 1;
-  let revoked = 0;
-  while (true) {
-    const result = await db.find({
-      collection: AUTH_SESSIONS_COLLECTION,
-      where: {
-        userId: { equals: args.userId },
-        collection: { equals: args.collection }
-      },
-      page,
-      limit: 100
-    });
-    for (const session of result.docs) {
-      if (session.revokedAt) continue;
-      await revokeAuthSession(config, session.id);
-      revoked += 1;
-    }
-    if (!result.hasNextPage) break;
-    page += 1;
-  }
-  return revoked;
-}
-function createSessionId() {
-  return globalThis.crypto?.randomUUID?.() ? globalThis.crypto.randomUUID() : `sess_${Date.now()}_${Math.random().toString(36).slice(2)}`;
-}
-
-// src/utils/block-references.ts
-function mergeUniqueBlocks(blocks) {
-  const seen = /* @__PURE__ */ new Map();
-  for (const block of blocks) {
-    const existing = seen.get(block.slug);
-    if (existing && existing !== block) {
-      throw new Error(
-        `Duplicate block slug "${block.slug}" found in the reusable block registry. Block slugs must be unique.`
-      );
-    }
-    if (!existing) seen.set(block.slug, block);
-  }
-  return Array.from(seen.values());
-}
-function buildRegistry(blocks) {
-  return new Map(blocks.map((block) => [block.slug, block]));
-}
-function resolveField(field, registry, blockCache) {
-  const next = { ...field };
-  if (next.fields) {
-    next.fields = next.fields.map(
-      (child) => resolveField(child, registry, blockCache)
-    );
-  }
-  if (next.type !== "blocks") return next;
-  const hasInlineBlocks = Array.isArray(next.blocks) && next.blocks.length > 0;
-  const hasReferences = Array.isArray(next.blockReferences) && next.blockReferences.length > 0;
-  if (hasInlineBlocks && hasReferences) {
-    throw new Error(
-      `Blocks field "${next.name ?? "(unnamed)"}" cannot define both "blocks" and "blockReferences". Use one or the other.`
-    );
-  }
-  if (hasReferences) {
-    next.blocks = next.blockReferences.map((slug) => {
-      const block = registry.get(slug);
-      if (!block) {
-        throw new Error(
-          `Unknown block reference "${slug}" on blocks field "${next.name ?? "(unnamed)"}". Add it to defineConfig({ blocks: [...] }).`
-        );
-      }
-      return resolveBlock(block, registry, blockCache);
-    });
-    return next;
-  }
-  if (hasInlineBlocks) {
-    next.blocks = next.blocks.map(
-      (block) => resolveBlock(block, registry, blockCache)
-    );
-  }
-  return next;
-}
-function resolveBlock(block, registry, blockCache) {
-  const cached = blockCache.get(block);
-  if (cached) return cached;
-  const resolved = {
-    ...block,
-    fields: []
-  };
-  blockCache.set(block, resolved);
-  resolved.fields = block.fields.map(
-    (field) => resolveField(field, registry, blockCache)
-  );
-  return resolved;
-}
-function resolveFields(fields, registry, blockCache) {
-  return fields.map((field) => resolveField(field, registry, blockCache));
-}
-function normalizeSchemaFragment(fragment) {
-  const reusableBlocks = mergeUniqueBlocks(fragment.blocks ?? []);
-  const registry = buildRegistry(reusableBlocks);
-  const blockCache = /* @__PURE__ */ new WeakMap();
-  const resolvedBlocks = reusableBlocks.map(
-    (block) => resolveBlock(block, registry, blockCache)
-  );
-  const resolvedCollections = (fragment.collections ?? []).map(
-    (collection) => ({
-      ...collection,
-      fields: resolveFields(collection.fields ?? [], registry, blockCache)
-    })
-  );
-  const resolvedGlobals = (fragment.globals ?? []).map((global) => ({
-    ...global,
-    fields: resolveFields(global.fields ?? [], registry, blockCache)
-  }));
-  return {
-    ...fragment,
-    ...fragment.blocks ? { blocks: resolvedBlocks } : {},
-    ...fragment.collections ? { collections: resolvedCollections } : {},
-    ...fragment.globals ? { globals: resolvedGlobals } : {}
-  };
-}
-function mergeDynamicConfig(baseConfig, dynamic) {
-  const normalizedDynamic = normalizeSchemaFragment({
-    ...dynamic,
-    blocks: [...baseConfig.blocks ?? [], ...dynamic.blocks ?? []]
-  });
-  return {
-    ...baseConfig,
-    ...normalizedDynamic.blocks ? { blocks: normalizedDynamic.blocks } : {},
-    ...dynamic.accessPolicies ? {
-      accessPolicies: {
-        ...baseConfig.accessPolicies ?? {},
-        ...dynamic.accessPolicies
-      }
-    } : {},
-    ...dynamic.admin ? { admin: { ...baseConfig.admin, ...dynamic.admin } } : {},
-    ...dynamic.adminAuth ? { adminAuth: { ...baseConfig.adminAuth, ...dynamic.adminAuth } } : {},
-    collections: normalizedDynamic.collections ? [...baseConfig.collections, ...normalizedDynamic.collections] : baseConfig.collections,
-    globals: normalizedDynamic.globals ? [...baseConfig.globals, ...normalizedDynamic.globals] : baseConfig.globals
-  };
-}
-
-// src/utils/config.ts
-var AUDIT_COLLECTION_SLUG = "__audit";
-var SYSTEM_FIELDS = [
-  {
-    name: "createdAt",
-    type: "date",
-    label: "Created At",
-    admin: { readOnly: true, hidden: true }
-  },
-  {
-    name: "updatedAt",
-    type: "date",
-    label: "Updated At",
-    admin: { readOnly: true, hidden: true }
-  },
-  {
-    name: "createdBy",
-    type: "text",
-    label: "Created By",
-    admin: { readOnly: true, hidden: true }
-  },
-  {
-    name: "updatedBy",
-    type: "text",
-    label: "Updated By",
-    admin: { readOnly: true, hidden: true }
-  }
-];
-var AUDIT_COLLECTION = {
-  slug: AUDIT_COLLECTION_SLUG,
-  labels: { singular: "Audit Log", plural: "Audit Logs" },
-  fields: [
-    { name: "collection", type: "text", label: "Collection", required: true },
-    { name: "documentId", type: "text", label: "Document ID" },
-    {
-      name: "operation",
-      type: "select",
-      label: "Operation",
-      options: ["create", "update", "delete"],
-      required: true
-    },
-    { name: "user", type: "text", label: "User ID" },
-    { name: "timestamp", type: "date", label: "Timestamp", required: true },
-    { name: "changes", type: "json", label: "Changes" }
-  ],
-  access: {
-    read: () => false,
-    create: () => false,
-    update: () => false,
-    delete: () => false
-  },
-  admin: { hidden: true }
-};
-var WORKFLOW_HISTORY_COLLECTION_CONFIG = {
-  slug: WORKFLOW_HISTORY_COLLECTION,
-  labels: { singular: "Workflow transition", plural: "Workflow transitions" },
-  fields: [
-    { name: "collection", type: "text", required: true },
-    { name: "documentId", type: "text", required: true },
-    { name: "transition", type: "text", required: true },
-    { name: "from", type: "text", required: true },
-    { name: "to", type: "text", required: true },
-    { name: "revision", type: "number", required: true },
-    { name: "comment", type: "textarea" },
-    { name: "actorId", type: "text" },
-    { name: "createdAt", type: "date", required: true }
-  ],
-  access: {
-    read: ({ user }) => !!user,
-    create: () => false,
-    update: () => false,
-    delete: () => false
-  },
-  admin: { hidden: true }
-};
-var LIFECYCLE_EVENTS_COLLECTION_CONFIG = {
-  slug: LIFECYCLE_EVENTS_COLLECTION,
-  labels: { singular: "Lifecycle event", plural: "Lifecycle events" },
-  fields: [
-    { name: "name", type: "text", required: true },
-    { name: "collection", type: "text", required: true },
-    { name: "documentId", type: "text", required: true },
-    { name: "occurredAt", type: "date", required: true },
-    { name: "actorId", type: "text" },
-    { name: "payload", type: "json", required: true },
-    { name: "attempts", type: "number", required: true },
-    {
-      name: "status",
-      type: "select",
-      options: ["pending", "processing", "delivered", "failed"],
-      required: true
-    },
-    { name: "nextAttemptAt", type: "date" },
-    { name: "deliveredAt", type: "date" },
-    { name: "lastError", type: "textarea" }
-  ],
-  access: {
-    read: ({ user }) => !!user?.roles?.includes("admin"),
-    create: () => false,
-    update: () => false,
-    delete: () => false
-  },
-  admin: { hidden: true }
-};
-var AUTH_SESSIONS_COLLECTION_CONFIG = {
-  slug: AUTH_SESSIONS_COLLECTION,
-  labels: { singular: "Auth session", plural: "Auth sessions" },
-  fields: [
-    { name: "userId", type: "text", required: true },
-    { name: "email", type: "email", required: true },
-    { name: "collection", type: "text", required: true },
-    { name: "authSource", type: "text" },
-    { name: "providerId", type: "text" },
-    { name: "lastIp", type: "text" },
-    { name: "lastSeenAt", type: "date" },
-    { name: "expiresAt", type: "date" },
-    { name: "revokedAt", type: "date" }
-  ],
-  access: {
-    read: () => false,
-    create: () => false,
-    update: () => false,
-    delete: () => false
-  },
-  admin: { hidden: true }
-};
-function normalizeConfig(config) {
-  const schemaAwareConfig = normalizeSchemaFragment(config);
-  assertValidDeclarativeHooksInConfig(schemaAwareConfig, "config");
-  assertValidDeclarativeAccessInConfig(schemaAwareConfig, "config");
-  assertValidAdminConditionsInConfig(schemaAwareConfig, "config");
-  assertValidPreviewUrlsInConfig(schemaAwareConfig, "config");
-  const collections = schemaAwareConfig?.collections || [];
-  const globals = schemaAwareConfig?.globals || [];
-  const needsAudit = collections.some((col) => col.audit);
-  const needsWorkflow = collections.some((col) => col.workflow || col.drafts);
-  const needsAuthSessions = collections.some((col) => !!col.auth);
-  const adminAuthCollectionSlug = getAdminAuthCollection({
-    collections,
-    adminAuth: schemaAwareConfig.adminAuth
-  })?.slug;
-  const normalizedCollections = collections.map((col) => {
-    let fields = col.fields || [];
-    const existingFieldNames = new Set(fields.map((f) => f.name));
-    if (col.auth) {
-      if (!existingFieldNames.has("email")) {
-        fields = [
-          ...fields,
-          {
-            name: "email",
-            type: "email",
-            label: "Email",
-            required: true,
-            unique: true,
-            promoted: true,
-            access: {
-              update: "!id"
-            }
-          }
-        ];
-      }
-      if (!existingFieldNames.has("password")) {
-        fields = [
-          ...fields,
-          {
-            name: "password",
-            type: "text",
-            label: "Password",
-            required: true,
-            access: {
-              update: "!id || user.id == id"
-            }
-          }
-        ];
-      }
-      if (!existingFieldNames.has("roles")) {
-        fields = [
-          ...fields,
-          {
-            name: "roles",
-            type: "select",
-            label: "Roles",
-            defaultValue: [],
-            options: [
-              { value: "admin", label: "Admin" },
-              { value: "editor", label: "Editor" },
-              { value: "viewer", label: "Viewer" }
-            ],
-            access: {
-              update: "user.roles && 'admin' in user.roles"
-            }
-          }
-        ];
-      }
-      if (!existingFieldNames.has("status")) {
-        fields = [
-          ...fields,
-          {
-            name: "status",
-            type: "select",
-            label: "Status",
-            defaultValue: "active",
-            options: [
-              { value: "active", label: "Active" },
-              { value: "pending", label: "Pending" }
-            ],
-            access: {
-              update: "user.roles && 'admin' in user.roles && user.id != id"
-            },
-            admin: {
-              condition: `!(data.roles && "admin" in data.roles)`
-            }
-          }
-        ];
-      }
-      fields = fields.map((field) => {
-        if (field.name === "email") {
-          return {
-            ...field,
-            // Email is the login identifier. Keep the integrity constraints
-            // auth relies on even when the field is explicitly redefined, so a
-            // custom `email` field can never silently drop uniqueness.
-            required: true,
-            unique: true,
-            promoted: true,
-            access: {
-              ...field.access || {},
-              update: "!id"
-            }
-          };
-        }
-        if (field.name === "password") {
-          return {
-            ...field,
-            // Password is required to authenticate; enforce it regardless of
-            // how the field was declared.
-            required: true,
-            admin: { ...field.admin || {} },
-            access: {
-              ...field.access || {},
-              update: "!id || user.id == id"
-            }
-          };
-        }
-        if (field.name === "roles") {
-          return {
-            ...field,
-            access: {
-              ...field.access || {},
-              // Must be an admin; cannot edit own roles (no self-elevation).
-              update: "user.roles && 'admin' in user.roles && user.id != id"
-            }
-          };
-        }
-        if (field.name === "status") {
-          return {
-            ...field,
-            access: {
-              ...field.access || {},
-              update: "user.roles && 'admin' in user.roles && user.id != id"
-            }
-          };
-        }
-        return field;
-      });
-    }
-    if (adminAuthCollectionSlug && col.slug === adminAuthCollectionSlug && schemaAwareConfig.adminAuth?.mode === "external") {
-      const externalAdminFields = [
-        {
-          name: "authProvider",
-          type: "text",
-          label: "Auth Provider",
-          admin: { readOnly: true, hidden: true }
-        },
-        {
-          name: "externalSubject",
-          type: "text",
-          label: "External Subject",
-          admin: { readOnly: true, hidden: true }
-        },
-        {
-          name: "authSource",
-          type: "text",
-          label: "Auth Source",
-          admin: { readOnly: true, hidden: true }
-        },
-        {
-          name: "lastLoginAt",
-          type: "date",
-          label: "Last Login At",
-          admin: { readOnly: true, hidden: true }
-        }
-      ];
-      for (const field of externalAdminFields) {
-        if (!existingFieldNames.has(field.name)) {
-          fields = [...fields, field];
-        }
-      }
-    }
-    const updatedFieldNames = new Set(fields.map((f) => f.name));
-    const fieldsToInject = SYSTEM_FIELDS.filter((f) => !updatedFieldNames.has(f.name));
-    const workflow = col.workflow || (col.drafts ? simplePublishingWorkflow() : void 0);
-    return {
-      ...col,
-      workflow,
-      fields: [...fields, ...fieldsToInject]
-    };
-  });
-  const hasAuditCollection = normalizedCollections.some((col) => col.slug === AUDIT_COLLECTION_SLUG);
-  const systemCollections = [];
-  if (needsAudit && !hasAuditCollection) systemCollections.push(AUDIT_COLLECTION);
-  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === WORKFLOW_HISTORY_COLLECTION)) {
-    systemCollections.push(WORKFLOW_HISTORY_COLLECTION_CONFIG);
-  }
-  if (needsWorkflow && !normalizedCollections.some((col) => col.slug === LIFECYCLE_EVENTS_COLLECTION)) {
-    systemCollections.push(LIFECYCLE_EVENTS_COLLECTION_CONFIG);
-  }
-  if (needsAuthSessions && !normalizedCollections.some((col) => col.slug === AUTH_SESSIONS_COLLECTION)) {
-    systemCollections.push(AUTH_SESSIONS_COLLECTION_CONFIG);
-  }
-  return {
-    ...schemaAwareConfig,
-    collections: [...normalizedCollections, ...systemCollections],
-    globals
-  };
-}
-
-// src/utils/hooks.ts
-import jexl2 from "jexl";
-async function runCollectionHooks(hooks, args, options = {}) {
-  if (!hooks || hooks.length === 0) {
-    return args.data ?? args.doc ?? args.query ?? void 0;
-  }
-  const payloadKey = args.data !== void 0 ? "data" : args.doc !== void 0 ? "doc" : "query" in args ? "query" : void 0;
-  let currentPayload = payloadKey === void 0 ? void 0 : args[payloadKey];
-  for (const hook of hooks) {
-    try {
-      const hookArgs = {
-        ...args,
-        ...payloadKey !== void 0 ? { [payloadKey]: currentPayload } : {}
-      };
-      const result = typeof hook === "string" ? await (() => {
-        if (options.surface) {
-          assertValidDeclarativeHookExpression(
-            hook,
-            options.surface,
-            options.path ?? options.surface
-          );
-        }
-        return jexl2.eval(hook, hookArgs);
-      })() : await hook(hookArgs);
-      if (result !== void 0) {
-        if (typeof hook === "string" && options.surface) {
-          assertValidDeclarativeHookResult(
-            result,
-            options.surface,
-            options.path ?? options.surface
-          );
-        }
-        currentPayload = typeof hook === "string" && currentPayload && typeof currentPayload === "object" && !Array.isArray(currentPayload) && result && typeof result === "object" && !Array.isArray(result) ? {
-          ...currentPayload,
-          ...result
-        } : result;
-      }
-    } catch (err) {
-      if (options.isolated) {
-        getConfigLogger(void 0, "hooks").error({
-          err,
-          msg: "Side-effect hook failed after a successful write"
-        });
-      } else {
-        throw err;
-      }
-    }
-  }
-  return currentPayload;
-}
-async function executeFieldBeforeChange(fields, data, originalDoc, user, db, pathPrefix = "") {
-  if (!data || typeof data !== "object") return data;
-  const result = { ...data };
-  for (const field of fields) {
-    if (!field.name) continue;
-    const fieldPath = pathPrefix ? `${pathPrefix}.${field.name}` : field.name;
-    const value = result[field.name];
-    const origValue = originalDoc?.[field.name];
-    let updatedValue = value;
-    if (field.hooks?.beforeChange) {
-      for (const hook of field.hooks.beforeChange) {
-        const hookArgs = {
-          value: updatedValue,
-          originalDoc: originalDoc ?? void 0,
-          data: result,
-          user,
-          db
-        };
-        updatedValue = typeof hook === "string" ? await (() => {
-          assertValidDeclarativeHookExpression(
-            hook,
-            "field.beforeChange",
-            fieldPath
-          );
-          return jexl2.eval(hook, hookArgs);
-        })() : await hook(hookArgs);
-      }
-      result[field.name] = updatedValue;
-    }
-    if (updatedValue !== void 0 && updatedValue !== null) {
-      if (field.type === "object" && field.fields) {
-        result[field.name] = await executeFieldBeforeChange(
-          field.fields,
-          updatedValue,
-          origValue,
-          user,
-          db,
-          fieldPath
-        );
-      } else if (field.type === "array" && field.fields && Array.isArray(updatedValue)) {
-        const arrayResult = [];
-        for (let i = 0; i < updatedValue.length; i++) {
-          const item = updatedValue[i];
-          const origItem = Array.isArray(origValue) ? origValue[i] : null;
-          arrayResult.push(
-            await executeFieldBeforeChange(
-              field.fields,
-              item,
-              origItem,
-              user,
-              db,
-              fieldPath
-            )
-          );
-        }
-        result[field.name] = arrayResult;
-      } else if (field.type === "blocks" && field.blocks && Array.isArray(updatedValue)) {
-        const blocksResult = [];
-        for (let i = 0; i < updatedValue.length; i++) {
-          const blockData = updatedValue[i];
-          const origBlock = Array.isArray(origValue) ? origValue[i] : null;
-          const blockConfig = field.blocks.find(
-            (b) => b.slug === blockData.blockType
-          );
-          if (blockConfig) {
-            blocksResult.push(
-              await executeFieldBeforeChange(
-                blockConfig.fields,
-                blockData,
-                origBlock,
-                user,
-                db,
-                fieldPath
-              )
-            );
-          } else {
-            blocksResult.push(blockData);
-          }
-        }
-        result[field.name] = blocksResult;
-      }
-    }
-  }
-  return result;
-}
-async function executeFieldAfterRead(fields, doc, user, db) {
-  if (!doc || typeof doc !== "object") return doc;
-  const result = { ...doc };
-  for (const field of fields) {
-    if (!field.name) continue;
-    const value = result[field.name];
-    let updatedValue = value;
-    if (field.hooks?.afterRead) {
-      for (const hook of field.hooks.afterRead) {
-        const typedHook = hook;
-        const hookArgs = {
-          value: updatedValue,
-          doc: result,
-          user,
-          db
-        };
-        updatedValue = await typedHook(hookArgs);
-      }
-      result[field.name] = updatedValue;
-    }
-    if (updatedValue !== void 0 && updatedValue !== null) {
-      if (field.type === "object" && field.fields) {
-        result[field.name] = await executeFieldAfterRead(
-          field.fields,
-          updatedValue,
-          user,
-          db
-        );
-      } else if (field.type === "array" && field.fields && Array.isArray(updatedValue)) {
-        const arrayResult = [];
-        for (const item of updatedValue) {
-          arrayResult.push(
-            await executeFieldAfterRead(
-              field.fields,
-              item,
-              user,
-              db
-            )
-          );
-        }
-        result[field.name] = arrayResult;
-      } else if (field.type === "blocks" && field.blocks && Array.isArray(updatedValue)) {
-        const blocksResult = [];
-        for (const blockData of updatedValue) {
-          const typedBlock = blockData;
-          const blockConfig = field.blocks.find(
-            (b) => b.slug === typedBlock.blockType
-          );
-          if (blockConfig) {
-            blocksResult.push(
-              await executeFieldAfterRead(
-                blockConfig.fields,
-                typedBlock,
-                user,
-                db
-              )
-            );
-          } else {
-            blocksResult.push(blockData);
-          }
-        }
-        result[field.name] = blocksResult;
-      }
-    }
-  }
-  return result;
-}
-
-// src/utils/openapi.ts
-function getCollectionLabels(collection) {
-  return collection.labels || { singular: collection.slug, plural: collection.slug };
-}
-function getCollectionTag(collection) {
-  return `Collection: ${getCollectionLabels(collection).plural}`;
-}
-function getGlobalTag(global) {
-  return `Global: ${global.label || global.slug}`;
-}
-function generateOpenApi(config) {
-  const spec = {
-    openapi: "3.0.0",
-    info: {
-      title: "Dyrected API",
-      version: "1.0.0",
-      description: "Automatically generated OpenAPI specification for the Dyrected project."
-    },
-    components: {
-      schemas: {
-        WorkflowMetadata: {
-          type: "object",
-          required: ["state", "revision"],
-          properties: {
-            state: { type: "string" },
-            revision: { type: "integer", minimum: 1 },
-            publishedRevision: { type: "integer", minimum: 1 },
-            publishedAt: { type: "string", format: "date-time" },
-            publishedBy: { type: "string" },
-            availableTransitions: { type: "array", items: { type: "string" } }
-          }
-        },
-        WorkflowTransitionRequest: {
-          type: "object",
-          properties: {
-            expectedRevision: { type: "integer", minimum: 1 },
-            comment: { type: "string" }
-          }
-        },
-        WorkflowHistoryEntry: {
-          type: "object",
-          required: [
-            "collection",
-            "documentId",
-            "transition",
-            "from",
-            "to",
-            "revision",
-            "createdAt"
-          ],
-          properties: {
-            id: { type: "string" },
-            collection: { type: "string" },
-            documentId: { type: "string" },
-            transition: { type: "string" },
-            from: { type: "string" },
-            to: { type: "string" },
-            revision: { type: "integer" },
-            comment: { type: "string", nullable: true },
-            actorId: { type: "string", nullable: true },
-            createdAt: { type: "string", format: "date-time" }
-          }
-        },
-        AuditEntry: {
-          type: "object",
-          required: ["collection", "operation", "timestamp"],
-          properties: {
-            id: { type: "string" },
-            collection: { type: "string" },
-            documentId: { type: "string", nullable: true },
-            operation: { type: "string" },
-            user: { type: "string", nullable: true },
-            timestamp: { type: "string", format: "date-time" },
-            changes: {
-              oneOf: [
-                { type: "string" },
-                { type: "object", additionalProperties: true },
-                { type: "null" }
-              ]
-            }
-          }
-        },
-        Error: {
-          type: "object",
-          properties: {
-            message: { type: "string" },
-            errors: {
-              type: "array",
-              items: { type: "object", additionalProperties: true }
-            }
-          }
-        },
-        AuthCredentials: {
-          type: "object",
-          required: ["email", "password"],
-          properties: {
-            email: { type: "string", format: "email" },
-            password: { type: "string" }
-          }
-        },
-        TokenResponse: {
-          type: "object",
-          properties: {
-            token: { type: "string" },
-            user: { type: "object", additionalProperties: true }
-          }
-        }
-      },
-      securitySchemes: {
-        ApiKeyAuth: {
-          type: "apiKey",
-          in: "header",
-          name: "x-api-key"
-        }
-      }
-    },
-    paths: {},
-    security: [{ ApiKeyAuth: [] }]
-  };
-  spec.paths["/api/schemas"] = {
-    get: {
-      tags: ["System"],
-      summary: "Get the serialized Dyrected schema",
-      security: [],
-      responses: {
-        200: { description: "Collection and global schema definitions" }
-      }
-    }
-  };
-  spec.paths["/api/openapi.json"] = {
-    get: {
-      tags: ["System"],
-      summary: "Get the OpenAPI specification",
-      security: [],
-      responses: { 200: { description: "OpenAPI 3.0 document" } }
-    }
-  };
-  spec.paths["/api/docs"] = {
-    get: {
-      tags: ["System"],
-      summary: "Open interactive API documentation",
-      security: [],
-      responses: { 200: { description: "Swagger UI HTML" } }
-    }
-  };
-  spec.paths["/api/dyrected/options/{collection}/{field}"] = {
-    get: {
-      tags: ["System"],
-      summary: "Resolve dynamic field options",
-      parameters: [
-        {
-          name: "collection",
-          in: "path",
-          required: true,
-          schema: { type: "string" }
-        },
-        {
-          name: "field",
-          in: "path",
-          required: true,
-          schema: { type: "string" }
-        }
-      ],
-      responses: { 200: { description: "Resolved option items" } }
-    }
-  };
-  spec.paths["/api/preferences/{key}"] = {
-    get: {
-      tags: ["Preferences"],
-      summary: "Get an authenticated user preference",
-      parameters: [
-        { name: "key", in: "path", required: true, schema: { type: "string" } }
-      ],
-      responses: { 200: { description: "Preference value" } }
-    },
-    put: {
-      tags: ["Preferences"],
-      summary: "Set an authenticated user preference",
-      parameters: [
-        { name: "key", in: "path", required: true, schema: { type: "string" } }
-      ],
-      requestBody: {
-        required: true,
-        content: { "application/json": { schema: { type: "object" } } }
-      },
-      responses: { 200: { description: "Updated preference" } }
-    }
-  };
-  spec.paths["/api/preview-token"] = {
-    post: {
-      tags: ["Preview"],
-      summary: "Create a preview token",
-      responses: { 200: { description: "Short-lived preview token" } }
-    }
-  };
-  spec.paths["/api/preview-data"] = {
-    get: {
-      tags: ["Preview"],
-      summary: "Resolve preview data from a token",
-      security: [],
-      parameters: [
-        {
-          name: "token",
-          in: "query",
-          required: true,
-          schema: { type: "string" }
-        }
-      ],
-      responses: { 200: { description: "Preview document data" } }
-    }
-  };
-  spec.paths["/api/audit"] = {
-    get: {
-      tags: ["Audit"],
-      summary: "Get audit entries across all readable audited collections",
-      parameters: [
-        {
-          name: "limit",
-          in: "query",
-          schema: { type: "integer", default: 50, maximum: 100 }
-        },
-        { name: "page", in: "query", schema: { type: "integer", default: 1 } },
-        {
-          name: "where",
-          in: "query",
-          schema: { type: "string" },
-          description: "JSON filter"
-        },
-        {
-          name: "sort",
-          in: "query",
-          schema: { type: "string", default: "-timestamp" }
-        }
-      ],
-      responses: {
-        200: {
-          description: "Audit entries",
-          content: {
-            "application/json": {
-              schema: {
-                type: "object",
-                properties: {
-                  docs: {
-                    type: "array",
-                    items: { $ref: "#/components/schemas/AuditEntry" }
-                  },
-                  total: { type: "integer" },
-                  limit: { type: "integer" },
-                  page: { type: "integer" }
-                }
-              }
-            }
-          }
-        }
-      }
-    }
-  };
-  for (const collection of config.collections) {
-    spec.components.schemas[collection.slug] = collectionToSchema(collection);
-  }
-  for (const global of config.globals) {
-    spec.components.schemas[global.slug] = globalToSchema(global);
-  }
-  for (const collection of config.collections) {
-    const slug = collection.slug;
-    const path = `/api/collections/${slug}`;
-    const labels = getCollectionLabels(collection);
-    const collectionTag = getCollectionTag(collection);
-    spec.paths[path] = {
-      get: {
-        tags: [collectionTag],
-        summary: `Find ${labels.plural}`,
-        parameters: [
-          {
-            name: "limit",
-            in: "query",
-            schema: { type: "integer", default: 10 }
-          },
-          {
-            name: "page",
-            in: "query",
-            schema: { type: "integer", default: 1 }
-          },
-          {
-            name: "where",
-            in: "query",
-            schema: { type: "string" },
-            description: "JSON filter"
-          },
-          {
-            name: "search",
-            in: "query",
-            schema: { type: "string" },
-            description: "Free-text search across configured searchable fields"
-          },
-          {
-            name: "sort",
-            in: "query",
-            schema: { type: "string" },
-            description: "Sort field (e.g. -createdAt)"
-          }
-        ],
-        responses: {
-          200: {
-            description: "Success",
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  properties: {
-                    docs: {
-                      type: "array",
-                      items: { $ref: `#/components/schemas/${slug}` }
-                    },
-                    total: { type: "integer" },
-                    limit: { type: "integer" },
-                    page: { type: "integer" }
-                  }
-                }
-              }
-            }
-          }
-        }
-      },
-      post: {
-        tags: [collectionTag],
-        summary: `Create ${labels.singular}`,
-        requestBody: {
-          required: true,
-          content: {
-            "application/json": {
-              schema: { $ref: `#/components/schemas/${slug}` }
-            }
-          }
-        },
-        responses: {
-          201: {
-            description: "Created",
-            content: {
-              "application/json": {
-                schema: { $ref: `#/components/schemas/${slug}` }
-              }
-            }
-          }
-        }
-      }
-    };
-    spec.paths[`${path}/{id}`] = {
-      get: {
-        tags: [collectionTag],
-        summary: `Get a single ${labels.singular}`,
-        parameters: [
-          {
-            name: "id",
-            in: "path",
-            required: true,
-            schema: { type: "string" }
-          }
-        ],
-        responses: {
-          200: {
-            description: "Success",
-            content: {
-              "application/json": {
-                schema: { $ref: `#/components/schemas/${slug}` }
-              }
-            }
-          }
-        }
-      },
-      patch: {
-        tags: [collectionTag],
-        summary: `Update ${labels.singular}`,
-        parameters: [
-          {
-            name: "id",
-            in: "path",
-            required: true,
-            schema: { type: "string" }
-          }
-        ],
-        requestBody: {
-          required: true,
-          content: {
-            "application/json": {
-              schema: { $ref: `#/components/schemas/${slug}` }
-            }
-          }
-        },
-        responses: {
-          200: {
-            description: "Updated",
-            content: {
-              "application/json": {
-                schema: { $ref: `#/components/schemas/${slug}` }
-              }
-            }
-          }
-        }
-      },
-      delete: {
-        tags: [collectionTag],
-        summary: `Delete ${labels.singular}`,
-        parameters: [
-          {
-            name: "id",
-            in: "path",
-            required: true,
-            schema: { type: "string" }
-          }
-        ],
-        responses: {
-          204: { description: "Deleted" }
-        }
-      }
-    };
-    spec.paths[`${path}/delete-many`] = {
-      delete: {
-        tags: [collectionTag],
-        summary: `Delete multiple ${labels.plural}`,
-        requestBody: {
-          required: true,
-          content: {
-            "application/json": {
-              schema: {
-                type: "object",
-                required: ["ids"],
-                properties: {
-                  ids: { type: "array", items: { type: "string" } }
-                }
-              }
-            }
-          }
-        },
-        responses: { 200: { description: "Deleted and failed document IDs" } }
-      }
-    };
-    if (collection.audit) {
-      spec.paths[`${path}/__audit`] = {
-        get: {
-          tags: [collectionTag],
-          summary: `Get ${labels.singular} audit entries`,
-          parameters: [
-            {
-              name: "limit",
-              in: "query",
-              schema: { type: "integer", default: 50, maximum: 100 }
-            },
-            {
-              name: "page",
-              in: "query",
-              schema: { type: "integer", default: 1 }
-            },
-            {
-              name: "where",
-              in: "query",
-              schema: { type: "string" },
-              description: "JSON filter"
-            },
-            {
-              name: "sort",
-              in: "query",
-              schema: { type: "string", default: "-timestamp" }
-            }
-          ],
-          responses: {
-            200: {
-              description: "Audit entries for this collection",
-              content: {
-                "application/json": {
-                  schema: {
-                    type: "object",
-                    properties: {
-                      docs: {
-                        type: "array",
-                        items: { $ref: "#/components/schemas/AuditEntry" }
-                      },
-                      total: { type: "integer" },
-                      limit: { type: "integer" },
-                      page: { type: "integer" }
-                    }
-                  }
-                }
-              }
-            },
-            403: { description: "Collection read access denied" },
-            404: { description: "Audit is not enabled for this collection" }
-          }
-        }
-      };
-    }
-    if (collection.upload) {
-      spec.paths[`${path}/media`] = {
-        get: {
-          tags: [collectionTag],
-          summary: `List ${labels.plural}`,
-          responses: { 200: { description: "Paginated media documents" } }
-        },
-        post: {
-          tags: [collectionTag],
-          summary: `Upload ${labels.singular}`,
-          requestBody: {
-            required: true,
-            content: {
-              "multipart/form-data": {
-                schema: {
-                  type: "object",
-                  required: ["file"],
-                  properties: { file: { type: "string", format: "binary" } }
-                }
-              }
-            }
-          },
-          responses: { 201: { description: "Uploaded media document" } }
-        }
-      };
-      spec.paths[`${path}/media/{filename}`] = {
-        get: {
-          tags: [collectionTag],
-          summary: `Serve ${labels.singular} bytes`,
-          parameters: [
-            {
-              name: "filename",
-              in: "path",
-              required: true,
-              schema: { type: "string" }
-            }
-          ],
-          security: [],
-          responses: {
-            200: { description: "Stored file" },
-            404: { description: "File not found" }
-          }
-        }
-      };
-    }
-    if (collection.auth) {
-      const publicAuthPost = (summary) => ({
-        tags: [collectionTag],
-        summary,
-        security: [],
-        requestBody: {
-          required: true,
-          content: {
-            "application/json": {
-              schema: { type: "object", additionalProperties: true }
-            }
-          }
-        },
-        responses: {
-          200: { description: "Success" },
-          400: { description: "Invalid request" }
-        }
-      });
-      spec.paths[`${path}/login`] = {
-        post: {
-          ...publicAuthPost(`Log in to ${labels.plural}`),
-          requestBody: {
-            required: true,
-            content: {
-              "application/json": {
-                schema: { $ref: "#/components/schemas/AuthCredentials" }
-              }
-            }
-          },
-          responses: {
-            200: {
-              description: "Authenticated",
-              content: {
-                "application/json": {
-                  schema: { $ref: "#/components/schemas/TokenResponse" }
-                }
-              }
-            },
-            401: { description: "Invalid credentials" }
-          }
-        }
-      };
-      spec.paths[`${path}/logout`] = {
-        post: {
-          tags: [collectionTag],
-          summary: `Log out of ${labels.plural}`,
-          parameters: [
-            {
-              name: "allSessions",
-              in: "query",
-              required: false,
-              schema: { type: "boolean" },
-              description: "Revoke every active session for this account instead of only the current one."
-            }
-          ],
-          responses: { 200: { description: "Logged out" } }
-        }
-      };
-      spec.paths[`${path}/init`] = {
-        get: {
-          tags: [collectionTag],
-          summary: `Get ${labels.plural} initialization state`,
-          security: [],
-          responses: { 200: { description: "Initialization state" } }
-        }
-      };
-      spec.paths[`${path}/first-user`] = {
-        post: publicAuthPost(`Register the first ${labels.singular}`)
-      };
-      spec.paths[`${path}/me`] = {
-        get: {
-          tags: [collectionTag],
-          summary: `Get the current ${labels.singular}`,
-          responses: { 200: { description: "Authenticated user" } }
-        }
-      };
-      spec.paths[`${path}/refresh-token`] = {
-        post: {
-          tags: [collectionTag],
-          summary: "Refresh an authentication token",
-          responses: {
-            200: {
-              description: "Refreshed token for the current active session"
-            }
-          }
-        }
-      };
-      spec.paths[`${path}/forgot-password`] = {
-        post: publicAuthPost("Request a password reset")
-      };
-      spec.paths[`${path}/reset-password`] = {
-        post: publicAuthPost("Reset a password")
-      };
-      spec.paths[`${path}/invite`] = {
-        post: {
-          tags: [collectionTag],
-          summary: `Invite a ${labels.singular}`,
-          responses: { 200: { description: "Invitation sent" } }
-        }
-      };
-      spec.paths[`${path}/accept-invite`] = {
-        post: publicAuthPost("Accept an invitation")
-      };
-      spec.paths[`${path}/{id}/change-password`] = {
-        post: {
-          tags: [collectionTag],
-          summary: `Change a ${labels.singular} password`,
-          parameters: [
-            {
-              name: "id",
-              in: "path",
-              required: true,
-              schema: { type: "string" }
-            }
-          ],
-          responses: {
-            200: {
-              description: "Password changed and active sessions revoked"
-            }
-          }
-        }
-      };
-    }
-    if (collection.workflow) {
-      spec.paths[`${path}/{id}/transitions/{transition}`] = {
-        post: {
-          tags: [collectionTag],
-          summary: `Transition ${labels.singular} workflow`,
-          parameters: [
-            {
-              name: "id",
-              in: "path",
-              required: true,
-              schema: { type: "string" }
-            },
-            {
-              name: "transition",
-              in: "path",
-              required: true,
-              schema: {
-                type: "string",
-                enum: collection.workflow.transitions.map((item) => item.name)
-              }
-            }
-          ],
-          requestBody: {
-            content: {
-              "application/json": {
-                schema: {
-                  $ref: "#/components/schemas/WorkflowTransitionRequest"
-                }
-              }
-            }
-          },
-          responses: {
-            200: {
-              description: "Transition applied",
-              content: {
-                "application/json": {
-                  schema: { $ref: `#/components/schemas/${slug}` }
-                }
-              }
-            },
-            400: { description: "Required transition input is missing" },
-            403: { description: "Transition capability denied" },
-            409: { description: "Invalid state or stale revision" }
-          }
-        }
-      };
-      spec.paths[`${path}/{id}/workflow-history`] = {
-        get: {
-          tags: [collectionTag],
-          summary: `Get ${labels.singular} workflow history`,
-          parameters: [
-            {
-              name: "id",
-              in: "path",
-              required: true,
-              schema: { type: "string" }
-            },
-            {
-              name: "limit",
-              in: "query",
-              schema: { type: "integer", default: 50, maximum: 100 }
-            }
-          ],
-          responses: {
-            200: {
-              description: "Workflow transition history",
-              content: {
-                "application/json": {
-                  schema: {
-                    type: "object",
-                    properties: {
-                      docs: {
-                        type: "array",
-                        items: {
-                          $ref: "#/components/schemas/WorkflowHistoryEntry"
-                        }
-                      },
-                      total: { type: "integer" },
-                      limit: { type: "integer" },
-                      page: { type: "integer" }
-                    }
-                  }
-                }
-              }
-            },
-            403: { description: "Collection read access denied" }
-          }
-        }
-      };
-    }
-  }
-  for (const global of config.globals) {
-    const slug = global.slug;
-    const path = `/api/globals/${slug}`;
-    const globalTag = getGlobalTag(global);
-    spec.paths[path] = {
-      get: {
-        tags: [globalTag],
-        summary: `Get ${global.label || slug}`,
-        responses: {
-          200: {
-            description: "Success",
-            content: {
-              "application/json": {
-                schema: { $ref: `#/components/schemas/${slug}` }
-              }
-            }
-          }
-        }
-      },
-      patch: {
-        tags: [globalTag],
-        summary: `Update ${global.label || slug}`,
-        requestBody: {
-          required: true,
-          content: {
-            "application/json": {
-              schema: { $ref: `#/components/schemas/${slug}` }
-            }
-          }
-        },
-        responses: {
-          200: {
-            description: "Updated",
-            content: {
-              "application/json": {
-                schema: { $ref: `#/components/schemas/${slug}` }
-              }
-            }
-          }
-        }
-      }
-    };
-  }
-  if (config.storage) {
-    spec.paths["/api/media/{filename}"] = {
-      get: {
-        tags: ["Media"],
-        summary: "Serve a stored file",
-        security: [],
-        parameters: [
-          {
-            name: "filename",
-            in: "path",
-            required: true,
-            schema: { type: "string" }
-          }
-        ],
-        responses: {
-          200: { description: "Stored file bytes" },
-          404: { description: "File not found" }
-        }
-      }
-    };
-  }
-  return spec;
-}
-function collectionToSchema(collection) {
-  const { properties, required } = fieldsToProperties(collection.fields);
-  return {
-    type: "object",
-    properties: {
-      id: { type: "string" },
-      createdAt: { type: "string", format: "date-time" },
-      updatedAt: { type: "string", format: "date-time" },
-      ...collection.workflow ? { _workflow: { $ref: "#/components/schemas/WorkflowMetadata" } } : {},
-      ...properties
-    },
-    required: ["id", ...required]
-  };
-}
-function globalToSchema(global) {
-  const { properties, required } = fieldsToProperties(global.fields);
-  return {
-    type: "object",
-    properties,
-    required
-  };
-}
-function fieldsToProperties(fields) {
-  const props = {};
-  const required = [];
-  for (const field of fields) {
-    if (field.type === "row") {
-      const nested = fieldsToProperties(field.fields || []);
-      Object.assign(props, nested.properties);
-      required.push(...nested.required);
-      continue;
-    }
-    if (!field.name) continue;
-    props[field.name] = fieldToSchema(field);
-    if (field.required) {
-      required.push(field.name);
-    }
-  }
-  return { properties: props, required };
-}
-function fieldToSchema(field) {
-  let schema;
-  switch (field.type) {
-    case "text":
-    case "textarea":
-    case "email":
-      schema = { type: "string" };
-      break;
-    case "url":
-      schema = {
-        oneOf: [
-          { type: "string" },
-          { type: "object", additionalProperties: true }
-        ]
-      };
-      break;
-    case "icon":
-      schema = { type: "string" };
-      break;
-    case "number":
-      schema = { type: "number" };
-      break;
-    case "boolean":
-      schema = { type: "boolean" };
-      break;
-    case "date":
-      schema = { type: "string", format: "date" };
-      break;
-    case "datetime":
-      schema = { type: "string", format: "date-time" };
-      break;
-    case "time":
-      schema = { type: "string", format: "time" };
-      break;
-    case "select":
-    case "radio":
-      schema = {
-        type: "string",
-        enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0
-      };
-      break;
-    case "multiSelect":
-      schema = {
-        type: "array",
-        items: {
-          type: "string",
-          enum: Array.isArray(field.options) ? field.options.map((o) => typeof o === "string" ? o : o.value) : void 0
-        }
-      };
-      break;
-    case "relationship":
-    case "image": {
-      const valueSchema = {
-        type: "string",
-        description: `ID of a ${field.relationTo} record`
-      };
-      schema = field.hasMany ? { type: "array", items: valueSchema } : valueSchema;
-      break;
-    }
-    case "join":
-      schema = {
-        type: "array",
-        readOnly: true,
-        items: { type: "object", additionalProperties: true }
-      };
-      break;
-    case "object": {
-      const { properties, required } = fieldsToProperties(field.fields || []);
-      schema = { type: "object", properties, required };
-      break;
-    }
-    case "array": {
-      const { properties, required } = fieldsToProperties(field.fields || []);
-      schema = {
-        type: "array",
-        items: { type: "object", properties, required }
-      };
-      break;
-    }
-    case "json":
-    case "richText":
-      schema = { type: "object", additionalProperties: true };
-      break;
-    case "blocks":
-      schema = {
-        type: "array",
-        items: {
-          oneOf: field.blocks?.map((block) => {
-            const { properties, required } = fieldsToProperties(block.fields);
-            return {
-              type: "object",
-              properties: {
-                blockType: { type: "string", enum: [block.slug] },
-                ...properties
-              },
-              required: ["blockType", ...required]
-            };
-          })
-        }
-      };
-      break;
-    default:
-      schema = { type: "string" };
-  }
-  if (field.label) schema.description = field.label;
-  return schema;
-}
-
-export {
-  signCollectionToken,
-  verifyCollectionToken,
-  issueAuthSessionToken,
-  getAuthSession,
-  isAuthSessionActive,
-  touchAuthSession,
-  revokeAuthSession,
-  revokeAllAuthSessions,
-  createObservabilityRuntime,
-  bindObservabilityRuntime,
-  getObservabilityRuntime,
-  getConfigLogger,
-  getRequestLogger,
-  buildRequestLogger,
-  shouldSampleRequest,
-  redactHeaders,
-  captureRequestBody,
-  createRequestSpan,
-  endRequestSpan,
-  attachRequestMetrics,
-  renderPrometheusMetrics,
-  WORKFLOW_HISTORY_COLLECTION,
-  LIFECYCLE_EVENTS_COLLECTION,
-  definePublishingWorkflow,
-  publishingWorkflow,
-  simplePublishingWorkflow,
-  workflowCapabilities,
-  canViewWorkflowDraft,
-  availableWorkflowTransitions,
-  initializeWorkflowDocument,
-  publishedStateName,
-  materializeWorkflowDocument,
-  createLifecycleEvent,
-  dispatchLifecycleEvent,
-  dispatchPendingLifecycleEvents,
-  saveWorkflowDraft,
-  createWorkflowDocument,
-  transitionWorkflow,
-  getAdminAuthCollection,
-  resolveAdminAuthCollection,
-  getPublicAdminAuthConfig,
-  mergeDynamicConfig,
-  validateDeclarativeHookExpression,
-  validateDeclarativeAccessExpression,
-  validateAdminConditionExpression,
-  validatePreviewUrlExpression,
-  assertValidDeclarativeHookExpression,
-  assertValidDeclarativeHookResult,
-  collectDeclarativeHookValidationIssues,
-  collectDeclarativeAccessValidationIssues,
-  collectAdminConditionValidationIssues,
-  collectPreviewUrlValidationIssues,
-  assertValidAdminConditionsInConfig,
-  assertValidPreviewUrlsInConfig,
-  collectConfigDiagnostics,
-  formatConfigDiagnostics,
-  ConfigValidationError,
-  isConfigValidationError,
-  assertValidDeclarativeHooksInConfig,
-  assertValidDeclarativeAccessInConfig,
-  normalizeConfig,
-  runCollectionHooks,
-  executeFieldBeforeChange,
-  executeFieldAfterRead,
-  generateOpenApi
-};