@azlib/cms 0.6.0 → 0.7.0

package/dist/index.mjs

@@ -1,3 +1,7 @@
+import { isEmail, isURL } from "@azlib/validator";
+import { promises } from "node:fs";
+import * as path from "node:path";
+import { and, column, createTable, eq, generateCreateTableDdl, inArray, like, or } from "@azlib/persistence";
 import ExcelJS from "exceljs";
 //#region src/content/schema.ts
 const fields = {
@@ -14,7 +18,10 @@ const fields = {
 			label: options.label ?? "Slug",
 			fromField: options.from ?? "title",
 			required: options.required ?? false,
-			unique: options.unique ?? true
+			unique: options.unique ?? true,
+			readRoles: options.readRoles,
+			writeRoles: options.writeRoles,
+			localized: options.localized
 		};
 	},
 	richText(options) {
@@ -77,6 +84,31 @@ const fields = {
 			type: "repeater",
 			...options
 		};
+	},
+	blocks(options) {
+		return {
+			type: "blocks",
+			...options
+		};
+	},
+	email(options) {
+		return {
+			type: "email",
+			...options
+		};
+	},
+	url(options) {
+		return {
+			type: "url",
+			...options
+		};
+	},
+	array(options) {
+		return {
+			type: "array",
+			defaultValue: [],
+			...options
+		};
 	}
 };
 /**
@@ -109,19 +141,121 @@ function validateAndNormalizeData(fieldsList, inputData) {
 	for (const field of fieldsList) {
 		let val = normalized[field.name];
 		if (val === void 0 && field.defaultValue !== void 0) {
-			val = field.defaultValue;
+			val = typeof field.defaultValue === "object" && field.defaultValue !== null ? JSON.parse(JSON.stringify(field.defaultValue)) : field.defaultValue;
 			normalized[field.name] = val;
 		}
-		if (field.required && (val === void 0 || val === null || val === "")) {
+		const isBlank = val === void 0 || val === null || val === "" || Array.isArray(val) && val.length === 0;
+		if (field.required && isBlank) {
 			errors[field.name] = `${field.label || field.name} is required.`;
 			continue;
 		}
-		if (val !== void 0 && val !== null) {
-			if (field.type === "number" && typeof val !== "number") {
-				const parsed = Number(val);
-				if (Number.isNaN(parsed)) errors[field.name] = `${field.label || field.name} must be a valid number.`;
-				else normalized[field.name] = parsed;
-			} else if (field.type === "boolean" && typeof val !== "boolean") normalized[field.name] = Boolean(val);
+		if (val !== void 0 && val !== null && val !== "") switch (field.type) {
+			case "number": {
+				let num = val;
+				if (typeof num !== "number") {
+					const parsed = Number(num);
+					if (Number.isNaN(parsed)) {
+						errors[field.name] = `${field.label || field.name} must be a valid number.`;
+						break;
+					}
+					num = parsed;
+					normalized[field.name] = num;
+				}
+				if (field.min !== void 0 && num < field.min) errors[field.name] = `${field.label || field.name} must be at least ${field.min}.`;
+				if (field.max !== void 0 && num > field.max) errors[field.name] = `${field.label || field.name} must be at most ${field.max}.`;
+				break;
+			}
+			case "boolean":
+				if (typeof val !== "boolean") normalized[field.name] = Boolean(val);
+				break;
+			case "text":
+			case "slug":
+			case "richText": {
+				const strVal = String(val);
+				if (field.min !== void 0 && strVal.length < field.min) errors[field.name] = `${field.label || field.name} must have at least ${field.min} characters.`;
+				if (field.max !== void 0 && strVal.length > field.max) errors[field.name] = `${field.label || field.name} must have at most ${field.max} characters.`;
+				if (field.pattern) try {
+					if (!new RegExp(field.pattern).test(strVal)) errors[field.name] = `${field.label || field.name} format is invalid.`;
+				} catch {}
+				break;
+			}
+			case "email": {
+				const emailStr = String(val).trim();
+				if (!isEmail(emailStr)) errors[field.name] = `${field.label || field.name} must be a valid email address.`;
+				else normalized[field.name] = emailStr.toLowerCase();
+				break;
+			}
+			case "url": {
+				const urlStr = String(val).trim();
+				if (!isURL(urlStr)) errors[field.name] = `${field.label || field.name} must be a valid URL.`;
+				else normalized[field.name] = urlStr;
+				break;
+			}
+			case "select":
+				if (field.options && field.options.length > 0) {
+					const validValues = field.options.map((opt) => typeof opt === "object" && opt !== null ? opt.value : opt);
+					if (!validValues.includes(val)) errors[field.name] = `${field.label || field.name} must be one of: ${validValues.join(", ")}.`;
+				}
+				break;
+			case "repeater":
+				if (!Array.isArray(val)) {
+					errors[field.name] = `${field.label || field.name} must be an array.`;
+					break;
+				}
+				if (field.min !== void 0 && val.length < field.min) errors[field.name] = `${field.label || field.name} must have at least ${field.min} items.`;
+				if (field.max !== void 0 && val.length > field.max) errors[field.name] = `${field.label || field.name} must have at most ${field.max} items.`;
+				if (field.fields && field.fields.length > 0) {
+					const normalizedItems = [];
+					for (let i = 0; i < val.length; i++) {
+						const item = val[i];
+						if (typeof item !== "object" || item === null) {
+							errors[`${field.name}[${i}]`] = `Item must be an object.`;
+							continue;
+						}
+						const { data: itemData, errors: itemErrors } = validateAndNormalizeData(field.fields, item);
+						for (const [errKey, errMsg] of Object.entries(itemErrors)) errors[`${field.name}[${i}].${errKey}`] = errMsg;
+						normalizedItems.push(itemData);
+					}
+					normalized[field.name] = normalizedItems;
+				}
+				break;
+			case "blocks": {
+				if (!Array.isArray(val)) {
+					errors[field.name] = `${field.label || field.name} must be an array of blocks.`;
+					break;
+				}
+				if (field.min !== void 0 && val.length < field.min) errors[field.name] = `${field.label || field.name} must have at least ${field.min} blocks.`;
+				if (field.max !== void 0 && val.length > field.max) errors[field.name] = `${field.label || field.name} must have at most ${field.max} blocks.`;
+				const normalizedBlocks = [];
+				for (let i = 0; i < val.length; i++) {
+					const block = val[i];
+					if (typeof block !== "object" || block === null) {
+						errors[`${field.name}[${i}]`] = `Block must be an object.`;
+						continue;
+					}
+					const blockType = block.blockType;
+					if (typeof blockType !== "string" || !blockType) {
+						errors[`${field.name}[${i}].blockType`] = `Block missing 'blockType' identifier.`;
+						continue;
+					}
+					const blockDef = field.blocks?.find((b) => b.slug === blockType);
+					if (!blockDef) {
+						errors[`${field.name}[${i}].blockType`] = `Unknown block type '${blockType}'.`;
+						continue;
+					}
+					const { data: blockData, errors: blockErrors } = validateAndNormalizeData(blockDef.fields, block);
+					for (const [errKey, errMsg] of Object.entries(blockErrors)) errors[`${field.name}[${i}].${errKey}`] = errMsg;
+					normalizedBlocks.push({
+						...blockData,
+						blockType
+					});
+				}
+				normalized[field.name] = normalizedBlocks;
+				break;
+			}
+			case "array":
+				if (!Array.isArray(val)) errors[field.name] = `${field.label || field.name} must be an array.`;
+				break;
 		}
 		if (field.validate && val !== void 0) {
 			const res = field.validate(val, normalized);
@@ -235,7 +369,11 @@ function normalizeConfig(config) {
 			route: config.admin?.route ?? "/admin",
 			enableRegistration: config.admin?.enableRegistration ?? false,
 			...config.admin
-		}
+		},
+		auth: config.auth,
+		webhooks: config.webhooks ?? [],
+		media: config.media,
+		i18n: config.i18n
 	};
 }
 //#endregion
@@ -778,17 +916,21 @@ var MediaManager = class {
 	storage;
 	hooks;
 	publicBaseUrl;
+	driver;
 	allowedMimePrefixes = [
 		"image/",
 		"video/",
 		"audio/",
 		"application/pdf",
-		"text/"
+		"text/",
+		"application/msword",
+		"application/vnd."
 	];
-	constructor(storage, hooks, publicBaseUrl = "/uploads") {
+	constructor(storage, hooks, publicBaseUrl = "/uploads", driver) {
 		this.storage = storage;
 		this.hooks = hooks;
 		this.publicBaseUrl = publicBaseUrl;
+		this.driver = driver;
 	}
 	/**
 	* Upload / register a new media item.
@@ -798,13 +940,26 @@ var MediaManager = class {
 		const extMatch = input.filename.match(/\.([a-zA-Z0-9]+)$/);
 		const ext = extMatch ? `.${extMatch[1].toLowerCase()}` : "";
 		const cleanFilename = `${slugify(input.filename.replace(/\.[^/.]+$/, ""))}${ext}`;
-		const url = input.url ?? `${this.publicBaseUrl}/${cleanFilename}`;
+		let url = input.url ?? `${this.publicBaseUrl}/${cleanFilename}`;
+		let path = input.path;
+		let sizeBytes = input.sizeBytes ?? (input.buffer ? input.buffer.byteLength : 0);
+		if (input.buffer && this.driver) {
+			const written = await this.driver.write({
+				filename: cleanFilename,
+				buffer: input.buffer,
+				mimeType: input.mimeType
+			});
+			url = written.url;
+			path = written.path;
+			sizeBytes = written.sizeBytes;
+		}
 		const media = await this.storage.createMedia({
 			filename: cleanFilename,
 			originalName: input.filename,
 			mimeType: input.mimeType,
-			sizeBytes: input.sizeBytes,
+			sizeBytes,
 			url,
+			path,
 			width: input.width,
 			height: input.height,
 			altText: input.altText,
@@ -842,7 +997,10 @@ var MediaManager = class {
 		const media = await this.storage.getMedia(id);
 		if (!media) return false;
 		const deleted = await this.storage.deleteMedia(id);
-		if (deleted && this.hooks) await this.hooks.doAction("cms.media_deleted", media);
+		if (deleted) {
+			if (media.path && this.driver) await this.driver.delete(media.path);
+			if (this.hooks) await this.hooks.doAction("cms.media_deleted", media);
+		}
 		return deleted;
 	}
 };
@@ -935,10 +1093,481 @@ var RBACManager = class {
 	}
 };
 //#endregion
+//#region src/auth/jwt.ts
+/**
+* @azlib/cms - Universal Web Crypto JWT & Password Hashing
+*/
+function base64UrlEncode(buffer) {
+	let binary = "";
+	for (let i = 0; i < buffer.byteLength; i++) binary += String.fromCharCode(buffer[i]);
+	return btoa(binary).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function base64UrlDecode(str) {
+	let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+	while (base64.length % 4) base64 += "=";
+	const binary = atob(base64);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+async function signJwt(payload, secret, expiresInSeconds = 86400) {
+	const header = {
+		alg: "HS256",
+		typ: "JWT"
+	};
+	const now = Math.floor(Date.now() / 1e3);
+	const fullPayload = {
+		...payload,
+		iat: now,
+		exp: now + expiresInSeconds
+	};
+	const enc = new TextEncoder();
+	const dataToSign = `${base64UrlEncode(enc.encode(JSON.stringify(header)))}.${base64UrlEncode(enc.encode(JSON.stringify(fullPayload)))}`;
+	const key = await crypto.subtle.importKey("raw", enc.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const signature = await crypto.subtle.sign("HMAC", key, enc.encode(dataToSign));
+	return `${dataToSign}.${base64UrlEncode(new Uint8Array(signature))}`;
+}
+async function verifyJwt(token, secret) {
+	if (!token || typeof token !== "string") return null;
+	const parts = token.split(".");
+	if (parts.length !== 3) return null;
+	const [headerEncoded, payloadEncoded, signatureEncoded] = parts;
+	const dataToVerify = `${headerEncoded}.${payloadEncoded}`;
+	try {
+		const enc = new TextEncoder();
+		const key = await crypto.subtle.importKey("raw", enc.encode(secret), {
+			name: "HMAC",
+			hash: "SHA-256"
+		}, false, ["verify"]);
+		const signature = base64UrlDecode(signatureEncoded);
+		if (!await crypto.subtle.verify("HMAC", key, signature, enc.encode(dataToVerify))) return null;
+		const payloadJson = new TextDecoder().decode(base64UrlDecode(payloadEncoded));
+		const payload = JSON.parse(payloadJson);
+		if (payload.exp && Math.floor(Date.now() / 1e3) > payload.exp) return null;
+		return payload;
+	} catch {
+		return null;
+	}
+}
+async function hashPassword(password) {
+	const enc = new TextEncoder();
+	const saltBytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	const saltHex = Array.from(saltBytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+	const keyMaterial = await crypto.subtle.importKey("raw", enc.encode(password), { name: "PBKDF2" }, false, ["deriveBits"]);
+	const derived = await crypto.subtle.deriveBits({
+		name: "PBKDF2",
+		salt: saltBytes,
+		iterations: 1e5,
+		hash: "SHA-256"
+	}, keyMaterial, 256);
+	return `pbkdf2$100000$${saltHex}$${Array.from(new Uint8Array(derived)).map((b) => b.toString(16).padStart(2, "0")).join("")}`;
+}
+async function verifyPassword(password, storedHash) {
+	const parts = storedHash.split("$");
+	if (parts.length !== 4 || parts[0] !== "pbkdf2") return false;
+	const iterations = Number(parts[1]);
+	const saltHex = parts[2];
+	const expectedHash = parts[3];
+	const saltBytes = new Uint8Array(saltHex.match(/.{1,2}/g)?.map((byte) => parseInt(byte, 16)) || []);
+	const enc = new TextEncoder();
+	const keyMaterial = await crypto.subtle.importKey("raw", enc.encode(password), { name: "PBKDF2" }, false, ["deriveBits"]);
+	const derived = await crypto.subtle.deriveBits({
+		name: "PBKDF2",
+		salt: saltBytes,
+		iterations,
+		hash: "SHA-256"
+	}, keyMaterial, 256);
+	return Array.from(new Uint8Array(derived)).map((b) => b.toString(16).padStart(2, "0")).join("") === expectedHash;
+}
+//#endregion
+//#region src/auth/auth-service.ts
+var AuthService = class {
+	config;
+	rbac;
+	users = /* @__PURE__ */ new Map();
+	defaultSecret;
+	constructor(config = {}, rbac) {
+		this.config = config;
+		this.rbac = rbac;
+		this.defaultSecret = config.jwtSecret || "azlib_cms_secret_key_change_in_production";
+	}
+	get enabled() {
+		return Boolean(this.config.enabled);
+	}
+	/**
+	* Register a new user account.
+	*/
+	async register(input) {
+		if (Array.from(this.users.values()).find((u) => u.username.toLowerCase() === input.username.toLowerCase())) throw new Error(`Username '${input.username}' is already taken.`);
+		if (Array.from(this.users.values()).find((u) => u.email.toLowerCase() === input.email.toLowerCase())) throw new Error(`Email '${input.email}' is already registered.`);
+		const id = `usr_${Date.now().toString(36)}_${Math.random().toString(36).substring(2, 8)}`;
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const passwordHash = await hashPassword(input.password);
+		const role = input.role || "subscriber";
+		const record = {
+			id,
+			username: input.username,
+			email: input.email.toLowerCase(),
+			displayName: input.displayName || input.username,
+			role,
+			passwordHash,
+			active: true,
+			createdAt: now,
+			updatedAt: now
+		};
+		this.users.set(id, record);
+		return this.sanitizeUser(record);
+	}
+	/**
+	* Authenticate with email/username and password.
+	*/
+	async login(identifier, password) {
+		const normalized = identifier.toLowerCase().trim();
+		const record = Array.from(this.users.values()).find((u) => u.username.toLowerCase() === normalized || u.email.toLowerCase() === normalized);
+		if (!record || record.active === false) throw new Error("Invalid username or password.");
+		if (!await verifyPassword(password, record.passwordHash)) throw new Error("Invalid username or password.");
+		const user = this.sanitizeUser(record);
+		return {
+			user,
+			token: await signJwt({
+				sub: user.id,
+				role: user.role,
+				username: user.username,
+				email: user.email
+			}, this.defaultSecret, typeof this.config.tokenExpiresIn === "number" ? this.config.tokenExpiresIn : 86400 * 7)
+		};
+	}
+	/**
+	* Extract and authenticate user from Request (Bearer JWT, ApiKey, or X-API-Key).
+	*/
+	async authenticateRequest(request) {
+		const authHeader = request.headers.get("authorization") || request.headers.get("Authorization");
+		const apiKeyHeader = request.headers.get("x-api-key") || request.headers.get("X-API-Key");
+		if (apiKeyHeader && this.config.apiKeys) {
+			const match = this.config.apiKeys.find((k) => k.key === apiKeyHeader);
+			if (match) return {
+				id: `api_key_${match.key.substring(0, 8)}`,
+				username: match.name || "API Key User",
+				email: `${match.role}@system.local`,
+				displayName: match.name || "API Key",
+				role: match.role,
+				capabilities: match.capabilities,
+				active: true
+			};
+		}
+		if (authHeader) {
+			const [type, token] = authHeader.trim().split(/\s+/);
+			if (type?.toLowerCase() === "apikey" && this.config.apiKeys) {
+				const match = this.config.apiKeys.find((k) => k.key === token);
+				if (match) return {
+					id: `api_key_${match.key.substring(0, 8)}`,
+					username: match.name || "API Key User",
+					email: `${match.role}@system.local`,
+					displayName: match.name || "API Key",
+					role: match.role,
+					capabilities: match.capabilities,
+					active: true
+				};
+			}
+			if (type?.toLowerCase() === "bearer" && token) {
+				const payload = await verifyJwt(token, this.defaultSecret);
+				if (payload) {
+					const registeredUser = this.users.get(payload.sub);
+					if (registeredUser) return this.sanitizeUser(registeredUser);
+					return {
+						id: payload.sub,
+						username: payload.username,
+						email: payload.email,
+						displayName: payload.username,
+						role: payload.role,
+						active: true
+					};
+				}
+			}
+		}
+		const cookieHeader = request.headers.get("cookie");
+		if (cookieHeader) {
+			const cookies = Object.fromEntries(cookieHeader.split(";").map((c) => {
+				const [k, v] = c.trim().split("=");
+				return [k, decodeURIComponent(v || "")];
+			}));
+			const token = cookies.access_token || cookies.at;
+			if (token) {
+				const payload = await verifyJwt(token, this.defaultSecret);
+				if (payload) {
+					const registeredUser = this.users.get(payload.sub);
+					if (registeredUser) return this.sanitizeUser(registeredUser);
+					return {
+						id: payload.sub,
+						username: payload.username,
+						email: payload.email,
+						displayName: payload.username,
+						role: payload.role,
+						active: true
+					};
+				}
+			}
+		}
+		return null;
+	}
+	/**
+	* Find a user by ID.
+	*/
+	getUserById(id) {
+		const u = this.users.get(id);
+		return u ? this.sanitizeUser(u) : null;
+	}
+	sanitizeUser(record) {
+		return {
+			id: record.id,
+			username: record.username,
+			email: record.email,
+			displayName: record.displayName,
+			role: record.role,
+			capabilities: record.capabilities,
+			active: record.active
+		};
+	}
+};
+//#endregion
+//#region src/core/webhooks.ts
+function bufferToHex(buffer) {
+	return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function computeHmacSignature(payload, secret) {
+	const enc = new TextEncoder();
+	const key = await crypto.subtle.importKey("raw", enc.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return `sha256=${bufferToHex(await crypto.subtle.sign("HMAC", key, enc.encode(payload)))}`;
+}
+var WebhookManager = class {
+	hooks;
+	webhooks = /* @__PURE__ */ new Map();
+	fetchFn;
+	constructor(initialWebhooks = [], hooks, fetchFn) {
+		this.hooks = hooks;
+		this.fetchFn = fetchFn ?? globalThis.fetch?.bind(globalThis);
+		for (const wh of initialWebhooks) this.registerWebhook(wh);
+	}
+	/**
+	* Register a new webhook endpoint.
+	*/
+	registerWebhook(webhook) {
+		const id = webhook.id || `wh_${Date.now().toString(36)}_${Math.random().toString(36).substring(2, 7)}`;
+		this.webhooks.set(id, {
+			...webhook,
+			id,
+			enabled: webhook.enabled ?? true
+		});
+		return id;
+	}
+	/**
+	* Get all registered webhooks.
+	*/
+	getWebhooks() {
+		return Array.from(this.webhooks.values());
+	}
+	/**
+	* Delete a webhook by ID.
+	*/
+	deleteWebhook(id) {
+		return this.webhooks.delete(id);
+	}
+	/**
+	* Dispatch an event to all matching webhooks asynchronously.
+	*/
+	async dispatch(event, data) {
+		const matching = Array.from(this.webhooks.values()).filter((wh) => wh.enabled !== false && (wh.events.includes(event) || wh.events.includes("*")));
+		if (matching.length === 0) return [];
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const payloadString = JSON.stringify({
+			event,
+			timestamp: now,
+			data
+		});
+		const deliveryPromises = matching.map(async (webhook) => {
+			try {
+				const headers = {
+					"Content-Type": "application/json",
+					"User-Agent": "azlib-cms-webhooks/1.0",
+					"X-CMS-Event": event,
+					"X-CMS-Delivery-Time": now,
+					...webhook.headers || {}
+				};
+				if (webhook.secret) headers["X-CMS-Signature"] = await computeHmacSignature(payloadString, webhook.secret);
+				const res = await this.fetchFn(webhook.url, {
+					method: "POST",
+					headers,
+					body: payloadString
+				});
+				if (this.hooks) await this.hooks.doAction("cms.webhook_delivered", {
+					webhook,
+					event,
+					status: res.status,
+					ok: res.ok
+				});
+				return {
+					url: webhook.url,
+					success: res.ok,
+					status: res.status
+				};
+			} catch (error) {
+				if (this.hooks) await this.hooks.doAction("cms.webhook_failed", {
+					webhook,
+					event,
+					error: error.message
+				});
+				return {
+					url: webhook.url,
+					success: false
+				};
+			}
+		});
+		return Promise.all(deliveryPromises);
+	}
+};
+//#endregion
+//#region src/core/preview.ts
+/**
+* @azlib/cms - Draft Preview Mode Engine
+*/
+var PreviewManager = class {
+	secret;
+	constructor(secret = "azlib_preview_secret_token_default") {
+		this.secret = secret;
+	}
+	/**
+	* Mint a signed draft preview token.
+	*/
+	async createPreviewToken(contentId, collection, expiresInSeconds = 3600) {
+		return signJwt({
+			contentId,
+			collection,
+			scope: "preview"
+		}, this.secret, expiresInSeconds);
+	}
+	/**
+	* Verify and unpack a draft preview token.
+	*/
+	async verifyPreviewToken(token) {
+		const payload = await verifyJwt(token, this.secret);
+		if (!payload || payload.scope !== "preview") return null;
+		return {
+			contentId: payload.contentId,
+			collection: payload.collection
+		};
+	}
+};
+//#endregion
+//#region src/content/i18n.ts
+/**
+* Resolve localized fields on a content record for a target locale.
+*/
+function resolveLocalizedData(data, fieldsList, targetLocale, fallbackLocale = "en") {
+	const resolved = { ...data };
+	for (const field of fieldsList) {
+		if (!field.localized) continue;
+		const val = data[field.name];
+		if (val && typeof val === "object" && !Array.isArray(val)) {
+			const locMap = val;
+			if (targetLocale in locMap && locMap[targetLocale] !== void 0) resolved[field.name] = locMap[targetLocale];
+			else if (fallbackLocale && fallbackLocale in locMap && locMap[fallbackLocale] !== void 0) resolved[field.name] = locMap[fallbackLocale];
+			else {
+				const firstAvailable = Object.values(locMap)[0];
+				resolved[field.name] = firstAvailable;
+			}
+		}
+	}
+	return resolved;
+}
+/**
+* Merge an incoming update for a specific locale into existing localized dictionaries.
+*/
+function mergeLocalizedInput(incomingData, existingData = {}, fieldsList, locale) {
+	const merged = {
+		...existingData,
+		...incomingData
+	};
+	for (const field of fieldsList) {
+		if (!field.localized) continue;
+		const incomingVal = incomingData[field.name];
+		if (incomingVal === void 0) continue;
+		if (incomingVal && typeof incomingVal === "object" && !Array.isArray(incomingVal) && Object.keys(incomingVal).some((k) => k.length === 2 || k.includes("-"))) {
+			const existingObj = typeof existingData[field.name] === "object" && existingData[field.name] !== null ? existingData[field.name] : {};
+			merged[field.name] = {
+				...existingObj,
+				...incomingVal
+			};
+			continue;
+		}
+		const existingMap = typeof existingData[field.name] === "object" && existingData[field.name] !== null ? { ...existingData[field.name] } : {};
+		existingMap[locale] = incomingVal;
+		merged[field.name] = existingMap;
+	}
+	return merged;
+}
+//#endregion
 //#region src/storage/memory-adapter.ts
-function generateId(prefix = "") {
+function generateId$1(prefix = "") {
 	return `${prefix}${Date.now().toString(36)}_${Math.random().toString(36).substring(2, 9)}`;
 }
+function matchesCondition(actualValue, expected) {
+	if (expected === null || expected === void 0 || typeof expected !== "object" || Array.isArray(expected)) return actualValue === expected;
+	const exp = expected;
+	if (!Object.keys(exp).some((k) => k.startsWith("$"))) return JSON.stringify(actualValue) === JSON.stringify(expected);
+	for (const [op, target] of Object.entries(exp)) switch (op) {
+		case "$eq":
+			if (actualValue !== target) return false;
+			break;
+		case "$ne":
+			if (actualValue === target) return false;
+			break;
+		case "$gt":
+			if (typeof actualValue !== "number" && typeof actualValue !== "string") return false;
+			if (actualValue <= target) return false;
+			break;
+		case "$gte":
+			if (typeof actualValue !== "number" && typeof actualValue !== "string") return false;
+			if (actualValue < target) return false;
+			break;
+		case "$lt":
+			if (typeof actualValue !== "number" && typeof actualValue !== "string") return false;
+			if (actualValue >= target) return false;
+			break;
+		case "$lte":
+			if (typeof actualValue !== "number" && typeof actualValue !== "string") return false;
+			if (actualValue > target) return false;
+			break;
+		case "$in":
+			if (!Array.isArray(target) || !target.includes(actualValue)) return false;
+			break;
+		case "$nin":
+			if (Array.isArray(target) && target.includes(actualValue)) return false;
+			break;
+		case "$contains":
+			if (typeof actualValue !== "string" || !actualValue.toLowerCase().includes(String(target).toLowerCase())) return false;
+			break;
+		case "$startsWith":
+			if (typeof actualValue !== "string" || !actualValue.startsWith(String(target))) return false;
+			break;
+		case "$endsWith":
+			if (typeof actualValue !== "string" || !actualValue.endsWith(String(target))) return false;
+			break;
+		case "$between":
+			if (!Array.isArray(target) || target.length !== 2) return false;
+			if (actualValue < target[0] || actualValue > target[1]) return false;
+			break;
+		case "$exists":
+			if (actualValue !== void 0 !== Boolean(target)) return false;
+			break;
+	}
+	return true;
+}
 var MemoryStorageAdapter = class {
 	content = /* @__PURE__ */ new Map();
 	revisions = /* @__PURE__ */ new Map();
@@ -949,7 +1578,7 @@ var MemoryStorageAdapter = class {
 	async init() {}
 	async close() {}
 	async createContent(item) {
-		const id = generateId("cnt_");
+		const id = generateId$1("cnt_");
 		const now = (/* @__PURE__ */ new Date()).toISOString();
 		const fullItem = {
 			...item,
@@ -992,7 +1621,7 @@ var MemoryStorageAdapter = class {
 			}
 			if (options.where) {
 				let match = true;
-				for (const [key, val] of Object.entries(options.where)) if (item.data[key] !== val && item[key] !== val) {
+				for (const [key, expected] of Object.entries(options.where)) if (!matchesCondition(item.data[key] !== void 0 ? item.data[key] : item[key], expected)) {
 					match = false;
 					break;
 				}
@@ -1013,14 +1642,49 @@ var MemoryStorageAdapter = class {
 		const offset = options.offset ?? 0;
 		const limit = options.limit ?? 20;
 		const paged = list.slice(offset, offset + limit);
+		let items = JSON.parse(JSON.stringify(paged));
+		if (options.populate && options.populate.length > 0) items = items.map((it) => this.populateItem(it, options.populate));
+		if (options.select && options.select.length > 0) items = items.map((it) => this.projectItem(it, options.select));
 		return {
-			items: JSON.parse(JSON.stringify(paged)),
+			items,
 			total,
 			limit,
 			offset,
 			hasMore: offset + limit < total
 		};
 	}
+	populateItem(item, populateFields) {
+		const populated = { ...item.populated || {} };
+		for (const field of populateFields) {
+			const rawVal = item.data[field];
+			if (!rawVal) continue;
+			if (Array.isArray(rawVal)) populated[field] = rawVal.map((id) => {
+				if (typeof id === "string") return this.content.get(id) || this.media.get(id) || id;
+				return id;
+			});
+			else if (typeof rawVal === "string") {
+				const target = this.content.get(rawVal) || this.media.get(rawVal) || null;
+				if (target) populated[field] = target;
+			}
+		}
+		return {
+			...item,
+			populated
+		};
+	}
+	projectItem(item, selectFields) {
+		const projected = {
+			id: item.id,
+			collection: item.collection
+		};
+		for (const key of selectFields) if (key in item) projected[key] = item[key];
+		else if (key in item.data) {
+			if (!projected.data) projected.data = {};
+			projected.data[key] = item.data[key];
+		}
+		if (item.populated) projected.populated = item.populated;
+		return projected;
+	}
 	async updateContent(collection, id, updates) {
 		const existing = this.content.get(id);
 		if (!existing || existing.collection !== collection) return null;
@@ -1052,7 +1716,7 @@ var MemoryStorageAdapter = class {
 		})).total;
 	}
 	async createRevision(contentId, collection, version, snapshot, authorId, note) {
-		const id = generateId("rev_");
+		const id = generateId$1("rev_");
 		const record = {
 			id,
 			contentId,
@@ -1085,7 +1749,7 @@ var MemoryStorageAdapter = class {
 		return count;
 	}
 	async createTerm(term) {
-		const id = generateId("trm_");
+		const id = generateId$1("trm_");
 		const now = (/* @__PURE__ */ new Date()).toISOString();
 		const item = {
 			...term,
@@ -1163,7 +1827,7 @@ var MemoryStorageAdapter = class {
 		for (const [id, term] of this.terms.entries()) term.count = counts.get(id) || 0;
 	}
 	async createMedia(item) {
-		const id = generateId("med_");
+		const id = generateId$1("med_");
 		const now = (/* @__PURE__ */ new Date()).toISOString();
 		const mediaItem = {
 			...item,
@@ -1244,6 +1908,9 @@ var CMSEngine = class {
 	taxonomies;
 	media;
 	rbac;
+	auth;
+	webhooks;
+	preview;
 	revisions;
 	lifecycle;
 	collections = /* @__PURE__ */ new Map();
@@ -1256,8 +1923,11 @@ var CMSEngine = class {
 		this.storage = storage ?? new MemoryStorageAdapter();
 		this.options = new OptionsManager(this.storage, this.hooks);
 		this.taxonomies = new TaxonomyManager(this.storage, this.hooks);
-		this.media = new MediaManager(this.storage, this.hooks);
 		this.rbac = new RBACManager();
+		this.auth = new AuthService(this.config.auth, this.rbac);
+		this.webhooks = new WebhookManager(this.config.webhooks || [], this.hooks);
+		this.preview = new PreviewManager(this.config.auth?.jwtSecret || "azlib_preview_secret_token_default");
+		this.media = new MediaManager(this.storage, this.hooks, this.config.media?.publicBaseUrl || "/uploads", this.config.media?.storageDriver);
 		this.revisions = new RevisionManager(this.storage, this.hooks);
 		this.lifecycle = new ContentLifecycle(this.storage, this.hooks);
 		for (const coll of this.config.collections) this.collections.set(coll.slug, coll);
@@ -1398,11 +2068,12 @@ var CMSEngine = class {
 				const filteredInput = await self.hooks.applyFilters("cms.before_create_input", input, { collection: slug });
 				const inputData = { ...filteredInput.data || {} };
 				if (filteredInput.title !== void 0 && inputData.title === void 0) inputData.title = filteredInput.title;
+				if (filteredInput.name !== void 0 && inputData.name === void 0) inputData.name = filteredInput.name;
 				if (filteredInput.slug !== void 0 && inputData.slug === void 0) inputData.slug = filteredInput.slug;
 				if (filteredInput.status !== void 0 && inputData.status === void 0) inputData.status = filteredInput.status;
 				const { data: normalizedData, errors } = validateAndNormalizeData(collConfig.fields, inputData);
 				if (Object.keys(errors).length > 0) throw new Error(`[CMSEngine] Validation failed for collection '${slug}': ${JSON.stringify(errors)}`);
-				const title = filteredInput.title ?? normalizedData.title ?? "";
+				const title = filteredInput.title ?? filteredInput.name ?? normalizedData.title ?? normalizedData.name ?? "";
 				const finalSlug = await resolveUniqueSlug(filteredInput.slug ? slugify(filteredInput.slug) : slugify(title) || "item", async (s) => {
 					return await self.storage.getContentBySlug(slug, s) !== null;
 				});
@@ -1427,17 +2098,48 @@ var CMSEngine = class {
 				if (collConfig.revisions) await self.revisions.createRevision(item, authorId, "Initial creation");
 				await self.hooks.doAction("cms.content_created", item);
 				await self.hooks.doAction(`cms.${slug}_created`, item);
+				self.webhooks.dispatch("content.created", item);
+				if (item.status === "published") self.webhooks.dispatch("content.published", item);
 				return self.hooks.applyFilters("cms.after_create_item", item, { collection: slug });
 			},
-			async findById(id) {
-				return self.storage.getContent(slug, id);
+			async findById(id, options) {
+				if (options?.populate || options?.select) {
+					const it = (await self.storage.findContent(slug, {
+						where: { id },
+						limit: 1,
+						populate: options.populate,
+						select: options.select
+					})).items[0] || null;
+					if (it && options.locale) it.data = resolveLocalizedData(it.data, collConfig.fields, options.locale, self.config.i18n?.defaultLocale);
+					return it;
+				}
+				const item = await self.storage.getContent(slug, id);
+				if (item && options?.locale) item.data = resolveLocalizedData(item.data, collConfig.fields, options.locale, self.config.i18n?.defaultLocale);
+				return item;
 			},
-			async findBySlug(contentSlug) {
-				return self.storage.getContentBySlug(slug, contentSlug);
+			async findBySlug(contentSlug, options) {
+				if (options?.populate || options?.select) {
+					const it = (await self.storage.findContent(slug, {
+						where: { slug: contentSlug },
+						limit: 1,
+						populate: options.populate,
+						select: options.select
+					})).items[0] || null;
+					if (it && options.locale) it.data = resolveLocalizedData(it.data, collConfig.fields, options.locale, self.config.i18n?.defaultLocale);
+					return it;
+				}
+				const item = await self.storage.getContentBySlug(slug, contentSlug);
+				if (item && options?.locale) item.data = resolveLocalizedData(item.data, collConfig.fields, options.locale, self.config.i18n?.defaultLocale);
+				return item;
 			},
 			async find(options = {}) {
 				const filteredOptions = await self.hooks.applyFilters("cms.find_options", options, { collection: slug });
-				return self.storage.findContent(slug, filteredOptions);
+				const res = await self.storage.findContent(slug, filteredOptions);
+				if (options.locale) res.items = res.items.map((it) => ({
+					...it,
+					data: resolveLocalizedData(it.data, collConfig.fields, options.locale, self.config.i18n?.defaultLocale)
+				}));
+				return res;
 			},
 			async update(id, input, authorId = null, revisionNote) {
 				const existing = await self.storage.getContent(slug, id);
@@ -1487,6 +2189,8 @@ var CMSEngine = class {
 					if (collConfig.revisions) await self.revisions.createRevision(updated, authorId, revisionNote ?? `Updated version ${updated.version}`);
 					await self.hooks.doAction("cms.content_updated", updated);
 					await self.hooks.doAction(`cms.${slug}_updated`, updated);
+					self.webhooks.dispatch("content.updated", updated);
+					if (updated.status === "published" && existing.status !== "published") self.webhooks.dispatch("content.published", updated);
 					return self.hooks.applyFilters("cms.after_update_item", updated, { collection: slug });
 				}
 				return updated;
@@ -1498,6 +2202,7 @@ var CMSEngine = class {
 				if (deleted) {
 					await self.hooks.doAction("cms.content_deleted", item);
 					await self.hooks.doAction(`cms.${slug}_deleted`, item);
+					self.webhooks.dispatch("content.deleted", item);
 				}
 				return deleted;
 			},
@@ -1552,6 +2257,700 @@ function definePlugin(factory) {
 	return factory;
 }
 //#endregion
+//#region src/media/drivers/disk-driver.ts
+/**
+* @azlib/cms - Local Disk Media Storage Driver
+*/
+var DiskMediaStorageDriver = class {
+	uploadDir;
+	publicBaseUrl;
+	constructor(options) {
+		this.uploadDir = options.uploadDir;
+		this.publicBaseUrl = options.publicBaseUrl?.replace(/\/+$/, "") || "/uploads";
+	}
+	async write(input) {
+		await promises.mkdir(this.uploadDir, { recursive: true });
+		const safeName = `${Date.now()}_${input.filename.replace(/[^a-zA-Z0-9._-]/g, "_")}`;
+		const filePath = path.join(this.uploadDir, safeName);
+		await promises.writeFile(filePath, input.buffer);
+		return {
+			url: `${this.publicBaseUrl}/${safeName}`,
+			path: filePath,
+			sizeBytes: input.buffer.byteLength
+		};
+	}
+	async read(pathOrUrl) {
+		try {
+			const filename = path.basename(pathOrUrl);
+			const filePath = path.join(this.uploadDir, filename);
+			const data = await promises.readFile(filePath);
+			return new Uint8Array(data);
+		} catch {
+			return null;
+		}
+	}
+	async delete(pathOrUrl) {
+		try {
+			const filename = path.basename(pathOrUrl);
+			const filePath = path.join(this.uploadDir, filename);
+			await promises.unlink(filePath);
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	getUrl(filePathOrName) {
+		const filename = path.basename(filePathOrName);
+		return `${this.publicBaseUrl}/${filename}`;
+	}
+};
+//#endregion
+//#region src/storage/persistence-adapter.ts
+/**
+* @azlib/cms - Persistence Storage Adapter (@azlib/persistence)
+*/
+function generateId(prefix = "") {
+	return `${prefix}${Date.now().toString(36)}_${Math.random().toString(36).substring(2, 9)}`;
+}
+const cmsContentTable = createTable("cms_content", {
+	id: column.varchar("id", { length: 64 }).notNull().primaryKey(),
+	collection: column.varchar("collection", { length: 64 }).notNull(),
+	slug: column.varchar("slug", { length: 255 }).notNull(),
+	status: column.varchar("status", { length: 32 }).notNull(),
+	title: column.text("title"),
+	parentId: column.varchar("parent_id", { length: 64 }),
+	authorId: column.varchar("author_id", { length: 64 }),
+	publishedAt: column.varchar("published_at", { length: 32 }),
+	scheduledAt: column.varchar("scheduled_at", { length: 32 }),
+	createdAt: column.varchar("created_at", { length: 32 }).notNull(),
+	updatedAt: column.varchar("updated_at", { length: 32 }).notNull(),
+	version: column.integer("version").notNull().default(1),
+	locale: column.varchar("locale", { length: 16 }),
+	data: column.text("data").notNull(),
+	terms: column.text("terms")
+});
+const cmsRevisionsTable = createTable("cms_revisions", {
+	id: column.varchar("id", { length: 64 }).notNull().primaryKey(),
+	contentId: column.varchar("content_id", { length: 64 }).notNull(),
+	collection: column.varchar("collection", { length: 64 }).notNull(),
+	version: column.integer("version").notNull(),
+	snapshot: column.text("snapshot").notNull(),
+	authorId: column.varchar("author_id", { length: 64 }),
+	note: column.text("note"),
+	createdAt: column.varchar("created_at", { length: 32 }).notNull()
+});
+const cmsTermsTable = createTable("cms_terms", {
+	id: column.varchar("id", { length: 64 }).notNull().primaryKey(),
+	taxonomy: column.varchar("taxonomy", { length: 64 }).notNull(),
+	name: column.varchar("name", { length: 255 }).notNull(),
+	slug: column.varchar("slug", { length: 255 }).notNull(),
+	description: column.text("description"),
+	parentId: column.varchar("parent_id", { length: 64 }),
+	count: column.integer("count").notNull().default(0),
+	meta: column.text("meta"),
+	createdAt: column.varchar("created_at", { length: 32 }).notNull(),
+	updatedAt: column.varchar("updated_at", { length: 32 }).notNull()
+});
+const cmsContentTermsTable = createTable("cms_content_terms", {
+	contentId: column.varchar("content_id", { length: 64 }).notNull(),
+	termId: column.varchar("term_id", { length: 64 }).notNull()
+});
+const cmsMediaTable = createTable("cms_media", {
+	id: column.varchar("id", { length: 64 }).notNull().primaryKey(),
+	filename: column.varchar("filename", { length: 255 }).notNull(),
+	originalName: column.varchar("original_name", { length: 255 }).notNull(),
+	mimeType: column.varchar("mime_type", { length: 128 }).notNull(),
+	sizeBytes: column.integer("size_bytes").notNull(),
+	url: column.text("url").notNull(),
+	path: column.text("path"),
+	width: column.integer("width"),
+	height: column.integer("height"),
+	altText: column.text("alt_text"),
+	caption: column.text("caption"),
+	authorId: column.varchar("author_id", { length: 64 }),
+	variants: column.text("variants"),
+	createdAt: column.varchar("created_at", { length: 32 }).notNull(),
+	updatedAt: column.varchar("updated_at", { length: 32 }).notNull()
+});
+const cmsOptionsTable = createTable("cms_options", {
+	key: column.varchar("key", { length: 128 }).notNull().primaryKey(),
+	value: column.text("value").notNull(),
+	autoload: column.boolean("autoload").notNull().default(false),
+	namespace: column.varchar("namespace", { length: 64 }),
+	updatedAt: column.varchar("updated_at", { length: 32 }).notNull()
+});
+var PersistenceStorageAdapter = class {
+	client;
+	config;
+	autoMigrate;
+	constructor(options) {
+		this.client = options.client;
+		this.config = options.config;
+		this.autoMigrate = options.autoMigrate ?? true;
+	}
+	async init() {
+		if (!this.autoMigrate) return;
+		const tables = [
+			cmsContentTable,
+			cmsRevisionsTable,
+			cmsTermsTable,
+			cmsContentTermsTable,
+			cmsMediaTable,
+			cmsOptionsTable
+		];
+		for (const table of tables) {
+			const ddl = generateCreateTableDdl(table, this.config.dialect);
+			try {
+				await this.client.raw(ddl);
+			} catch (err) {}
+		}
+	}
+	async close() {}
+	async createContent(item) {
+		const id = generateId("cnt_");
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const version = 1;
+		const record = {
+			id,
+			collection: item.collection,
+			slug: item.slug,
+			status: item.status,
+			title: item.title ?? null,
+			parentId: item.parentId ?? null,
+			authorId: item.authorId ?? null,
+			publishedAt: item.publishedAt ?? null,
+			scheduledAt: item.scheduledAt ?? null,
+			createdAt: now,
+			updatedAt: now,
+			version,
+			locale: item.locale ?? null,
+			data: JSON.stringify(item.data || {}),
+			terms: item.terms ? JSON.stringify(item.terms) : null
+		};
+		await this.client.insert(cmsContentTable).values(record).execute();
+		return {
+			id,
+			collection: item.collection,
+			slug: item.slug,
+			status: item.status,
+			title: item.title,
+			parentId: item.parentId ?? null,
+			authorId: item.authorId ?? null,
+			publishedAt: item.publishedAt ?? null,
+			scheduledAt: item.scheduledAt ?? null,
+			createdAt: now,
+			updatedAt: now,
+			version,
+			locale: item.locale,
+			data: item.data,
+			terms: item.terms
+		};
+	}
+	async getContent(collection, id) {
+		const rows = await this.client.select().from(cmsContentTable).where(and(eq(cmsContentTable.id, id), eq(cmsContentTable.collection, collection))).execute();
+		if (!rows || rows.length === 0) return null;
+		return this.deserializeContent(rows[0]);
+	}
+	async getContentBySlug(collection, slug) {
+		const rows = await this.client.select().from(cmsContentTable).where(and(eq(cmsContentTable.slug, slug), eq(cmsContentTable.collection, collection))).execute();
+		if (!rows || rows.length === 0) return null;
+		return this.deserializeContent(rows[0]);
+	}
+	async findContent(collection, options = {}) {
+		const conditions = [eq(cmsContentTable.collection, collection)];
+		if (options.status) if (Array.isArray(options.status)) conditions.push(inArray(cmsContentTable.status, options.status));
+		else conditions.push(eq(cmsContentTable.status, options.status));
+		if (options.authorId) conditions.push(eq(cmsContentTable.authorId, options.authorId));
+		if (options.parentId !== void 0) conditions.push(eq(cmsContentTable.parentId, options.parentId));
+		if (options.locale) conditions.push(eq(cmsContentTable.locale, options.locale));
+		if (options.search) {
+			const q = `%${options.search}%`;
+			conditions.push(or(like(cmsContentTable.title, q), like(cmsContentTable.slug, q), like(cmsContentTable.data, q)));
+		}
+		if (options.termIds && options.termIds.length > 0) {
+			const termRows = await this.client.select().from(cmsContentTermsTable).where(inArray(cmsContentTermsTable.termId, options.termIds)).execute();
+			const matchedContentIds = Array.from(new Set(termRows.map((r) => r.contentId || r.content_id)));
+			if (matchedContentIds.length === 0) return {
+				items: [],
+				total: 0,
+				limit: options.limit ?? 20,
+				offset: options.offset ?? 0,
+				hasMore: false
+			};
+			conditions.push(inArray(cmsContentTable.id, matchedContentIds));
+		}
+		const whereClause = conditions.length === 1 ? conditions[0] : and(...conditions);
+		let list = (await this.client.select().from(cmsContentTable).where(whereClause).execute()).map((r) => this.deserializeContent(r));
+		if (options.where) list = list.filter((item) => {
+			for (const [key, expected] of Object.entries(options.where)) {
+				const actual = item.data[key] !== void 0 ? item.data[key] : item[key];
+				if (!this.matchesCondition(actual, expected)) return false;
+			}
+			return true;
+		});
+		const total = list.length;
+		const orderBy = options.orderBy || "createdAt";
+		const dir = options.orderDirection === "asc" ? 1 : -1;
+		list.sort((a, b) => {
+			const valA = a[orderBy] ?? a.data[orderBy] ?? "";
+			const valB = b[orderBy] ?? b.data[orderBy] ?? "";
+			if (valA < valB) return -1 * dir;
+			if (valA > valB) return 1 * dir;
+			return 0;
+		});
+		const offset = options.offset ?? 0;
+		const limit = options.limit ?? 20;
+		let items = list.slice(offset, offset + limit);
+		if (options.populate && options.populate.length > 0) items = await Promise.all(items.map((it) => this.populateItem(it, options.populate)));
+		return {
+			items,
+			total,
+			limit,
+			offset,
+			hasMore: offset + limit < total
+		};
+	}
+	async updateContent(collection, id, updates) {
+		const existing = await this.getContent(collection, id);
+		if (!existing) return null;
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const nextVersion = existing.version + 1;
+		const mergedData = {
+			...existing.data,
+			...updates.data || {}
+		};
+		const updateRecord = {
+			updatedAt: now,
+			version: nextVersion,
+			data: JSON.stringify(mergedData)
+		};
+		if (updates.title !== void 0) updateRecord.title = updates.title;
+		if (updates.slug !== void 0) updateRecord.slug = updates.slug;
+		if (updates.status !== void 0) updateRecord.status = updates.status;
+		if (updates.parentId !== void 0) updateRecord.parentId = updates.parentId;
+		if (updates.authorId !== void 0) updateRecord.authorId = updates.authorId;
+		if (updates.publishedAt !== void 0) updateRecord.publishedAt = updates.publishedAt;
+		if (updates.scheduledAt !== void 0) updateRecord.scheduledAt = updates.scheduledAt;
+		if (updates.locale !== void 0) updateRecord.locale = updates.locale;
+		if (updates.terms !== void 0) updateRecord.terms = JSON.stringify(updates.terms);
+		await this.client.update(cmsContentTable).set(updateRecord).where(and(eq(cmsContentTable.id, id), eq(cmsContentTable.collection, collection))).execute();
+		return this.getContent(collection, id);
+	}
+	async deleteContent(collection, id) {
+		if (!await this.getContent(collection, id)) return false;
+		await this.client.delete(cmsContentTable).where(and(eq(cmsContentTable.id, id), eq(cmsContentTable.collection, collection))).execute();
+		await this.client.delete(cmsContentTermsTable).where(eq(cmsContentTermsTable.contentId, id)).execute();
+		await this.deleteRevisionsByContentId(id);
+		return true;
+	}
+	async countContent(collection, options = {}) {
+		return (await this.findContent(collection, {
+			...options,
+			limit: 1e6
+		})).total;
+	}
+	async createRevision(contentId, collection, version, snapshot, authorId, note) {
+		const id = generateId("rev_");
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const record = {
+			id,
+			contentId,
+			collection,
+			version,
+			snapshot: JSON.stringify(snapshot),
+			authorId: authorId ?? null,
+			note: note ?? null,
+			createdAt: now
+		};
+		await this.client.insert(cmsRevisionsTable).values(record).execute();
+		return {
+			id,
+			contentId,
+			collection,
+			version,
+			snapshot,
+			authorId,
+			note,
+			createdAt: now
+		};
+	}
+	async getRevisions(contentId) {
+		return (await this.client.select().from(cmsRevisionsTable).where(eq(cmsRevisionsTable.contentId, contentId)).execute()).map((r) => ({
+			id: r.id,
+			contentId: r.contentId || r.content_id,
+			collection: r.collection,
+			version: Number(r.version),
+			snapshot: typeof r.snapshot === "string" ? JSON.parse(r.snapshot) : r.snapshot,
+			authorId: r.authorId || r.author_id || null,
+			note: r.note || void 0,
+			createdAt: r.createdAt || r.created_at
+		}));
+	}
+	async getRevision(revisionId) {
+		const rows = await this.client.select().from(cmsRevisionsTable).where(eq(cmsRevisionsTable.id, revisionId)).execute();
+		if (!rows || rows.length === 0) return null;
+		const r = rows[0];
+		return {
+			id: r.id,
+			contentId: r.contentId || r.content_id,
+			collection: r.collection,
+			version: Number(r.version),
+			snapshot: typeof r.snapshot === "string" ? JSON.parse(r.snapshot) : r.snapshot,
+			authorId: r.authorId || r.author_id || null,
+			note: r.note || void 0,
+			createdAt: r.createdAt || r.created_at
+		};
+	}
+	async deleteRevisionsByContentId(contentId) {
+		const rows = await this.getRevisions(contentId);
+		await this.client.delete(cmsRevisionsTable).where(eq(cmsRevisionsTable.contentId, contentId)).execute();
+		return rows.length;
+	}
+	async createTerm(term) {
+		const id = generateId("trm_");
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const record = {
+			id,
+			taxonomy: term.taxonomy,
+			name: term.name,
+			slug: term.slug,
+			description: term.description ?? null,
+			parentId: term.parentId ?? null,
+			count: 0,
+			meta: term.meta ? JSON.stringify(term.meta) : null,
+			createdAt: now,
+			updatedAt: now
+		};
+		await this.client.insert(cmsTermsTable).values(record).execute();
+		return {
+			id,
+			taxonomy: term.taxonomy,
+			name: term.name,
+			slug: term.slug,
+			description: term.description,
+			parentId: term.parentId ?? null,
+			count: 0,
+			meta: term.meta,
+			createdAt: now,
+			updatedAt: now
+		};
+	}
+	async getTermById(id) {
+		const rows = await this.client.select().from(cmsTermsTable).where(eq(cmsTermsTable.id, id)).execute();
+		if (!rows || rows.length === 0) return null;
+		return this.deserializeTerm(rows[0]);
+	}
+	async getTermBySlug(taxonomy, slug) {
+		const rows = await this.client.select().from(cmsTermsTable).where(and(eq(cmsTermsTable.taxonomy, taxonomy), eq(cmsTermsTable.slug, slug))).execute();
+		if (!rows || rows.length === 0) return null;
+		return this.deserializeTerm(rows[0]);
+	}
+	async getTerms(taxonomy, options) {
+		const conditions = [eq(cmsTermsTable.taxonomy, taxonomy)];
+		if (options?.parentId !== void 0) conditions.push(eq(cmsTermsTable.parentId, options.parentId));
+		return (await this.client.select().from(cmsTermsTable).where(conditions.length === 1 ? conditions[0] : and(...conditions)).execute()).map((r) => this.deserializeTerm(r));
+	}
+	async updateTerm(id, updates) {
+		if (!await this.getTermById(id)) return null;
+		const updateRecord = { updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+		if (updates.name !== void 0) updateRecord.name = updates.name;
+		if (updates.slug !== void 0) updateRecord.slug = updates.slug;
+		if (updates.description !== void 0) updateRecord.description = updates.description;
+		if (updates.parentId !== void 0) updateRecord.parentId = updates.parentId;
+		if (updates.count !== void 0) updateRecord.count = updates.count;
+		if (updates.meta !== void 0) updateRecord.meta = JSON.stringify(updates.meta);
+		await this.client.update(cmsTermsTable).set(updateRecord).where(eq(cmsTermsTable.id, id)).execute();
+		return this.getTermById(id);
+	}
+	async deleteTerm(id) {
+		if (!await this.getTermById(id)) return false;
+		await this.client.delete(cmsTermsTable).where(eq(cmsTermsTable.id, id)).execute();
+		await this.client.delete(cmsContentTermsTable).where(eq(cmsContentTermsTable.termId, id)).execute();
+		return true;
+	}
+	async assignTermsToContent(contentId, termIds) {
+		for (const termId of termIds) try {
+			await this.client.insert(cmsContentTermsTable).values({
+				contentId,
+				termId
+			}).execute();
+			const term = await this.getTermById(termId);
+			if (term) await this.updateTerm(termId, { count: term.count + 1 });
+		} catch {}
+	}
+	async getContentTerms(contentId, taxonomy) {
+		const termIds = (await this.client.select().from(cmsContentTermsTable).where(eq(cmsContentTermsTable.contentId, contentId)).execute()).map((r) => r.termId || r.term_id);
+		if (termIds.length === 0) return [];
+		const terms = [];
+		for (const tId of termIds) {
+			const t = await this.getTermById(tId);
+			if (t && (!taxonomy || t.taxonomy === taxonomy)) terms.push(t);
+		}
+		return terms;
+	}
+	async removeTermsFromContent(contentId, termIds) {
+		for (const termId of termIds) {
+			await this.client.delete(cmsContentTermsTable).where(and(eq(cmsContentTermsTable.contentId, contentId), eq(cmsContentTermsTable.termId, termId))).execute();
+			const term = await this.getTermById(termId);
+			if (term && term.count > 0) await this.updateTerm(termId, { count: term.count - 1 });
+		}
+	}
+	async createMedia(item) {
+		const id = generateId("med_");
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const record = {
+			id,
+			filename: item.filename,
+			originalName: item.originalName,
+			mimeType: item.mimeType,
+			sizeBytes: item.sizeBytes,
+			url: item.url,
+			path: item.path ?? null,
+			width: item.width ?? null,
+			height: item.height ?? null,
+			altText: item.altText ?? null,
+			caption: item.caption ?? null,
+			authorId: item.authorId ?? null,
+			variants: item.variants ? JSON.stringify(item.variants) : null,
+			createdAt: now,
+			updatedAt: now
+		};
+		await this.client.insert(cmsMediaTable).values(record).execute();
+		return {
+			id,
+			filename: item.filename,
+			originalName: item.originalName,
+			mimeType: item.mimeType,
+			sizeBytes: item.sizeBytes,
+			url: item.url,
+			path: item.path,
+			width: item.width,
+			height: item.height,
+			altText: item.altText,
+			caption: item.caption,
+			authorId: item.authorId,
+			variants: item.variants,
+			createdAt: now,
+			updatedAt: now
+		};
+	}
+	async getMedia(id) {
+		const rows = await this.client.select().from(cmsMediaTable).where(eq(cmsMediaTable.id, id)).execute();
+		if (!rows || rows.length === 0) return null;
+		return this.deserializeMedia(rows[0]);
+	}
+	async findMedia(options) {
+		const conditions = [];
+		if (options?.mimeType) conditions.push(like(cmsMediaTable.mimeType, `${options.mimeType}%`));
+		if (options?.authorId) conditions.push(eq(cmsMediaTable.authorId, options.authorId));
+		if (options?.search) conditions.push(or(like(cmsMediaTable.filename, `%${options.search}%`), like(cmsMediaTable.originalName, `%${options.search}%`)));
+		const items = (await this.client.select().from(cmsMediaTable).where(conditions.length > 0 ? conditions.length === 1 ? conditions[0] : and(...conditions) : void 0).execute()).map((r) => this.deserializeMedia(r));
+		const total = items.length;
+		const offset = options?.offset ?? 0;
+		const limit = options?.limit ?? 20;
+		return {
+			items: items.slice(offset, offset + limit),
+			total,
+			limit,
+			offset,
+			hasMore: offset + limit < total
+		};
+	}
+	async updateMedia(id, updates) {
+		if (!await this.getMedia(id)) return null;
+		const updateRecord = { updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+		if (updates.filename !== void 0) updateRecord.filename = updates.filename;
+		if (updates.altText !== void 0) updateRecord.altText = updates.altText;
+		if (updates.caption !== void 0) updateRecord.caption = updates.caption;
+		if (updates.width !== void 0) updateRecord.width = updates.width;
+		if (updates.height !== void 0) updateRecord.height = updates.height;
+		if (updates.variants !== void 0) updateRecord.variants = JSON.stringify(updates.variants);
+		await this.client.update(cmsMediaTable).set(updateRecord).where(eq(cmsMediaTable.id, id)).execute();
+		return this.getMedia(id);
+	}
+	async deleteMedia(id) {
+		if (!await this.getMedia(id)) return false;
+		await this.client.delete(cmsMediaTable).where(eq(cmsMediaTable.id, id)).execute();
+		return true;
+	}
+	async getOption(key) {
+		const rows = await this.client.select().from(cmsOptionsTable).where(eq(cmsOptionsTable.key, key)).execute();
+		if (!rows || rows.length === 0) return null;
+		const r = rows[0];
+		return {
+			key: r.key,
+			value: typeof r.value === "string" ? JSON.parse(r.value) : r.value,
+			autoload: Boolean(r.autoload),
+			namespace: r.namespace || void 0,
+			updatedAt: r.updatedAt || r.updated_at
+		};
+	}
+	async setOption(item) {
+		const existing = await this.getOption(item.key);
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		if (existing) await this.client.update(cmsOptionsTable).set({
+			value: JSON.stringify(item.value),
+			autoload: item.autoload,
+			namespace: item.namespace ?? null,
+			updatedAt: now
+		}).where(eq(cmsOptionsTable.key, item.key)).execute();
+		else await this.client.insert(cmsOptionsTable).values({
+			key: item.key,
+			value: JSON.stringify(item.value),
+			autoload: item.autoload,
+			namespace: item.namespace ?? null,
+			updatedAt: now
+		}).execute();
+	}
+	async deleteOption(key) {
+		if (!await this.getOption(key)) return false;
+		await this.client.delete(cmsOptionsTable).where(eq(cmsOptionsTable.key, key)).execute();
+		return true;
+	}
+	async getOptions(namespace) {
+		const builder = this.client.select().from(cmsOptionsTable);
+		return (await (namespace ? builder.where(eq(cmsOptionsTable.namespace, namespace)).execute() : builder.execute())).map((r) => ({
+			key: r.key,
+			value: typeof r.value === "string" ? JSON.parse(r.value) : r.value,
+			autoload: Boolean(r.autoload),
+			namespace: r.namespace || void 0,
+			updatedAt: r.updatedAt || r.updated_at
+		}));
+	}
+	deserializeContent(row) {
+		return {
+			id: row.id,
+			collection: row.collection,
+			slug: row.slug,
+			status: row.status,
+			title: row.title || void 0,
+			parentId: row.parentId || row.parent_id || null,
+			authorId: row.authorId || row.author_id || null,
+			publishedAt: row.publishedAt || row.published_at || null,
+			scheduledAt: row.scheduledAt || row.scheduled_at || null,
+			createdAt: row.createdAt || row.created_at,
+			updatedAt: row.updatedAt || row.updated_at,
+			version: Number(row.version),
+			locale: row.locale || void 0,
+			data: typeof row.data === "string" ? JSON.parse(row.data) : row.data || {},
+			terms: row.terms ? typeof row.terms === "string" ? JSON.parse(row.terms) : row.terms : void 0
+		};
+	}
+	deserializeTerm(row) {
+		return {
+			id: row.id,
+			taxonomy: row.taxonomy,
+			name: row.name,
+			slug: row.slug,
+			description: row.description || void 0,
+			parentId: row.parentId || row.parent_id || null,
+			count: Number(row.count),
+			meta: row.meta ? typeof row.meta === "string" ? JSON.parse(row.meta) : row.meta : void 0,
+			createdAt: row.createdAt || row.created_at,
+			updatedAt: row.updatedAt || row.updated_at
+		};
+	}
+	deserializeMedia(row) {
+		return {
+			id: row.id,
+			filename: row.filename,
+			originalName: row.originalName || row.original_name,
+			mimeType: row.mimeType || row.mime_type,
+			sizeBytes: Number(row.sizeBytes || row.size_bytes),
+			url: row.url,
+			path: row.path || void 0,
+			width: row.width ? Number(row.width) : void 0,
+			height: row.height ? Number(row.height) : void 0,
+			altText: row.altText || row.alt_text || void 0,
+			caption: row.caption || void 0,
+			authorId: row.authorId || row.author_id || null,
+			variants: row.variants ? typeof row.variants === "string" ? JSON.parse(row.variants) : row.variants : void 0,
+			createdAt: row.createdAt || row.created_at,
+			updatedAt: row.updatedAt || row.updated_at
+		};
+	}
+	async populateItem(item, populateFields) {
+		const populated = { ...item.populated || {} };
+		for (const field of populateFields) {
+			const rawVal = item.data[field];
+			if (!rawVal) continue;
+			if (Array.isArray(rawVal)) populated[field] = await Promise.all(rawVal.map(async (id) => {
+				if (typeof id === "string") {
+					const rows = await this.client.select().from(cmsContentTable).where(eq(cmsContentTable.id, id)).execute();
+					if (rows.length > 0) return this.deserializeContent(rows[0]);
+					const m = await this.getMedia(id);
+					if (m) return m;
+				}
+				return id;
+			}));
+			else if (typeof rawVal === "string") {
+				const rows = await this.client.select().from(cmsContentTable).where(eq(cmsContentTable.id, rawVal)).execute();
+				if (rows.length > 0) populated[field] = this.deserializeContent(rows[0]);
+				else {
+					const m = await this.getMedia(rawVal);
+					if (m) populated[field] = m;
+				}
+			}
+		}
+		return {
+			...item,
+			populated
+		};
+	}
+	matchesCondition(actualValue, expected) {
+		if (expected === null || expected === void 0 || typeof expected !== "object" || Array.isArray(expected)) return actualValue === expected;
+		const exp = expected;
+		if (!Object.keys(exp).some((k) => k.startsWith("$"))) return JSON.stringify(actualValue) === JSON.stringify(expected);
+		for (const [op, target] of Object.entries(exp)) switch (op) {
+			case "$eq":
+				if (actualValue !== target) return false;
+				break;
+			case "$ne":
+				if (actualValue === target) return false;
+				break;
+			case "$gt":
+				if (typeof actualValue !== "number" && typeof actualValue !== "string") return false;
+				if (actualValue <= target) return false;
+				break;
+			case "$gte":
+				if (typeof actualValue !== "number" && typeof actualValue !== "string") return false;
+				if (actualValue < target) return false;
+				break;
+			case "$lt":
+				if (typeof actualValue !== "number" && typeof actualValue !== "string") return false;
+				if (actualValue >= target) return false;
+				break;
+			case "$lte":
+				if (typeof actualValue !== "number" && typeof actualValue !== "string") return false;
+				if (actualValue > target) return false;
+				break;
+			case "$in":
+				if (!Array.isArray(target) || !target.includes(actualValue)) return false;
+				break;
+			case "$nin":
+				if (Array.isArray(target) && target.includes(actualValue)) return false;
+				break;
+			case "$contains":
+				if (typeof actualValue !== "string" || !actualValue.toLowerCase().includes(String(target).toLowerCase())) return false;
+				break;
+			case "$startsWith":
+				if (typeof actualValue !== "string" || !actualValue.startsWith(String(target))) return false;
+				break;
+			case "$endsWith":
+				if (typeof actualValue !== "string" || !actualValue.endsWith(String(target))) return false;
+				break;
+			case "$between":
+				if (!Array.isArray(target) || target.length !== 2) return false;
+				if (actualValue < target[0] || actualValue > target[1]) return false;
+				break;
+			case "$exists":
+				if (actualValue !== void 0 !== Boolean(target)) return false;
+				break;
+		}
+		return true;
+	}
+};
+//#endregion
 //#region src/api/router.ts
 function compilePath(path) {
 	const keys = [];
@@ -1578,7 +2977,7 @@ function jsonResponse(data, status = 200, headers = {}) {
 			"Content-Type": "application/json",
 			"Access-Control-Allow-Origin": "*",
 			"Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-			"Access-Control-Allow-Headers": "Content-Type, Authorization",
+			"Access-Control-Allow-Headers": "Content-Type, Authorization, X-API-Key",
 			...headers
 		}
 	});
@@ -1615,10 +3014,11 @@ var CMSRouter = class {
 			headers: {
 				"Access-Control-Allow-Origin": "*",
 				"Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-				"Access-Control-Allow-Headers": "Content-Type, Authorization"
+				"Access-Control-Allow-Headers": "Content-Type, Authorization, X-API-Key"
 			}
 		});
 		try {
+			const user = await this.engine.auth.authenticateRequest(request);
 			if (pathname === "/api/cron/scheduled" && method === "POST") {
 				const published = await this.engine.processScheduledContent();
 				return jsonResponse({
@@ -1627,10 +3027,11 @@ var CMSRouter = class {
 					items: published
 				});
 			}
-			if (pathname.startsWith("/api/options")) return this.handleOptions(pathname, method, url, request);
-			if (pathname.startsWith("/api/taxonomies")) return this.handleTaxonomies(pathname, method, url, request);
-			if (pathname.startsWith("/api/media")) return this.handleMedia(pathname, method, url, request);
-			if (pathname.startsWith("/api/content")) return this.handleContent(pathname, method, url, request);
+			if (pathname.startsWith("/api/auth")) return this.handleAuth(pathname, method, request, user);
+			if (pathname.startsWith("/api/options")) return this.handleOptions(pathname, method, url, request, user);
+			if (pathname.startsWith("/api/taxonomies")) return this.handleTaxonomies(pathname, method, url, request, user);
+			if (pathname.startsWith("/api/media")) return this.handleMedia(pathname, method, url, request, user);
+			if (pathname.startsWith("/api/content")) return this.handleContent(pathname, method, url, request, user);
 			const customResponse = await this.handleCustomRoute(pathname, method, url, request);
 			if (customResponse) return customResponse;
 			return jsonResponse({
@@ -1664,55 +3065,126 @@ var CMSRouter = class {
 		}
 		return null;
 	}
-	async handleContent(pathname, method, url, request) {
+	async handleAuth(pathname, method, request, user) {
+		if (pathname === "/api/auth/register" && method === "POST") {
+			const body = await request.json();
+			try {
+				return jsonResponse(await this.engine.auth.register(body), 201);
+			} catch (err) {
+				return jsonResponse({ error: err.message }, 400);
+			}
+		}
+		if (pathname === "/api/auth/login" && method === "POST") {
+			const body = await request.json();
+			try {
+				return jsonResponse(await this.engine.auth.login(body.identifier || body.username || body.email, body.password), 200);
+			} catch (err) {
+				return jsonResponse({ error: err.message }, 401);
+			}
+		}
+		if (pathname === "/api/auth/me" && method === "GET") {
+			if (!user) return jsonResponse({ error: "Unauthorized: Authentication required" }, 401);
+			return jsonResponse(user, 200);
+		}
+		return jsonResponse({ error: "Endpoint not found" }, 404);
+	}
+	async handleContent(pathname, method, url, request, user) {
 		const parts = pathname.replace(/^\/api\/content\/?/, "").split("/").filter(Boolean);
-		const collectionSlug = parts[0];
-		if (!collectionSlug) return jsonResponse({ collections: this.engine.getCollections().map((c) => ({
+		if (parts.length === 0 && method === "GET") return jsonResponse({ collections: this.engine.getCollections().map((c) => ({
 			slug: c.slug,
 			label: c.label,
 			hierarchical: c.hierarchical
 		})) }, 200);
+		const collectionSlug = parts[0];
+		const collConfig = this.engine.getCollectionConfig(collectionSlug);
+		if (!collConfig) return jsonResponse({ error: `Collection '${collectionSlug}' not found` }, 404);
 		const coll = this.engine.collection(collectionSlug);
 		if (parts.length === 1 && method === "GET") {
 			const status = url.searchParams.get("status") || void 0;
 			const search = url.searchParams.get("search") || void 0;
+			const locale = url.searchParams.get("locale") || void 0;
 			const limit = url.searchParams.has("limit") ? Number(url.searchParams.get("limit")) : void 0;
 			const offset = url.searchParams.has("offset") ? Number(url.searchParams.get("offset")) : void 0;
 			const termIds = url.searchParams.has("termIds") ? url.searchParams.get("termIds").split(",") : void 0;
-			return jsonResponse(await coll.find({
+			const populate = url.searchParams.has("populate") ? url.searchParams.get("populate").split(",") : void 0;
+			const select = url.searchParams.has("select") ? url.searchParams.get("select").split(",") : void 0;
+			let where = void 0;
+			if (url.searchParams.has("where")) try {
+				where = JSON.parse(url.searchParams.get("where"));
+			} catch {}
+			const result = await coll.find({
 				status,
 				search,
 				limit,
 				offset,
-				termIds
-			}));
+				termIds,
+				populate,
+				select,
+				locale,
+				where
+			});
+			result.items = result.items.map((it) => this.filterRestrictedFields(it, collConfig, user));
+			return jsonResponse(result);
 		}
 		if (parts.length === 1 && method === "POST") {
+			if (this.engine.auth.enabled && !this.engine.rbac.can(user, "edit_posts")) return jsonResponse({ error: "Forbidden: You do not have permission to create content." }, user ? 403 : 401);
 			const body = await request.json();
-			return jsonResponse(await coll.create(body), 201);
+			const created = await coll.create(body, user?.id);
+			return jsonResponse(this.filterRestrictedFields(created, collConfig, user), 201);
 		}
 		const idOrSlug = parts[1];
+		if (parts.length === 3 && parts[2] === "preview" && method === "GET") {
+			const token = url.searchParams.get("token");
+			if (!token) return jsonResponse({ error: "Missing preview token" }, 401);
+			const verified = await this.engine.preview.verifyPreviewToken(token);
+			if (!verified || verified.contentId !== idOrSlug || verified.collection !== collectionSlug) return jsonResponse({ error: "Invalid or expired preview token" }, 403);
+			const item = await coll.findById(idOrSlug);
+			if (!item) return jsonResponse({ error: "Content item not found" }, 404);
+			return jsonResponse(this.filterRestrictedFields(item, collConfig, user));
+		}
 		if (parts.length === 3 && parts[2] === "revisions" && method === "GET") return jsonResponse(await coll.getRevisions(idOrSlug));
 		if (parts.length === 4 && parts[2] === "restore" && method === "POST") {
+			if (this.engine.auth.enabled && !this.engine.rbac.can(user, "edit_posts")) return jsonResponse({ error: "Forbidden" }, user ? 403 : 401);
 			const revisionId = parts[3];
-			const restored = await coll.restoreRevision(idOrSlug, revisionId);
+			const restored = await coll.restoreRevision(idOrSlug, revisionId, user?.id);
 			if (!restored) return jsonResponse({ error: "Revision or content item not found" }, 404);
-			return jsonResponse(restored);
+			return jsonResponse(this.filterRestrictedFields(restored, collConfig, user));
 		}
 		if (parts.length === 2 && method === "GET") {
 			const bySlug = url.searchParams.get("by") === "slug";
-			let item = bySlug ? await coll.findBySlug(idOrSlug) : await coll.findById(idOrSlug);
-			if (!item && !bySlug) item = await coll.findBySlug(idOrSlug);
+			const populate = url.searchParams.has("populate") ? url.searchParams.get("populate").split(",") : void 0;
+			const select = url.searchParams.has("select") ? url.searchParams.get("select").split(",") : void 0;
+			const locale = url.searchParams.get("locale") || void 0;
+			let item = bySlug ? await coll.findBySlug(idOrSlug, {
+				populate,
+				select,
+				locale
+			}) : await coll.findById(idOrSlug, {
+				populate,
+				select,
+				locale
+			});
+			if (!item && !bySlug) item = await coll.findBySlug(idOrSlug, {
+				populate,
+				select,
+				locale
+			});
 			if (!item) return jsonResponse({ error: "Content item not found" }, 404);
-			return jsonResponse(item);
+			return jsonResponse(this.filterRestrictedFields(item, collConfig, user));
 		}
 		if (parts.length === 2 && method === "PUT") {
+			const existing = await coll.findById(idOrSlug);
+			if (!existing) return jsonResponse({ error: "Content item not found" }, 404);
+			if (this.engine.auth.enabled && !this.engine.rbac.can(user, "edit_posts", { contentItem: existing })) return jsonResponse({ error: "Forbidden" }, user ? 403 : 401);
 			const body = await request.json();
-			const updated = await coll.update(idOrSlug, body);
+			const updated = await coll.update(idOrSlug, body, user?.id);
 			if (!updated) return jsonResponse({ error: "Content item not found" }, 404);
-			return jsonResponse(updated);
+			return jsonResponse(this.filterRestrictedFields(updated, collConfig, user));
 		}
 		if (parts.length === 2 && method === "DELETE") {
+			const existing = await coll.findById(idOrSlug);
+			if (!existing) return jsonResponse({ error: "Content item not found" }, 404);
+			if (this.engine.auth.enabled && !this.engine.rbac.can(user, "delete_posts", { contentItem: existing })) return jsonResponse({ error: "Forbidden" }, user ? 403 : 401);
 			if (!await coll.delete(idOrSlug)) return jsonResponse({ error: "Content item not found" }, 404);
 			return jsonResponse({
 				success: true,
@@ -1721,7 +3193,7 @@ var CMSRouter = class {
 		}
 		return jsonResponse({ error: "Method not allowed" }, 405);
 	}
-	async handleTaxonomies(pathname, method, url, request) {
+	async handleTaxonomies(pathname, method, url, request, user) {
 		const parts = pathname.replace(/^\/api\/taxonomies\/?/, "").split("/").filter(Boolean);
 		if (parts.length === 0 && method === "GET") return jsonResponse(this.engine.taxonomies.getTaxonomies());
 		const taxonomySlug = parts[0];
@@ -1730,6 +3202,7 @@ var CMSRouter = class {
 			return jsonResponse(await this.engine.taxonomies.getTerms(taxonomySlug));
 		}
 		if (parts.length === 2 && parts[1] === "terms" && method === "POST") {
+			if (this.engine.auth.enabled && !this.engine.rbac.can(user, "manage_taxonomies")) return jsonResponse({ error: "Forbidden" }, user ? 403 : 401);
 			const body = await request.json();
 			return jsonResponse(await this.engine.taxonomies.createTerm(taxonomySlug, body), 201);
 		}
@@ -1739,12 +3212,14 @@ var CMSRouter = class {
 			return jsonResponse(term);
 		}
 		if (parts.length === 3 && parts[1] === "terms" && method === "PUT") {
+			if (this.engine.auth.enabled && !this.engine.rbac.can(user, "manage_taxonomies")) return jsonResponse({ error: "Forbidden" }, user ? 403 : 401);
 			const body = await request.json();
 			const updated = await this.engine.taxonomies.updateTerm(parts[2], body);
 			if (!updated) return jsonResponse({ error: "Term not found" }, 404);
 			return jsonResponse(updated);
 		}
 		if (parts.length === 3 && parts[1] === "terms" && method === "DELETE") {
+			if (this.engine.auth.enabled && !this.engine.rbac.can(user, "manage_taxonomies")) return jsonResponse({ error: "Forbidden" }, user ? 403 : 401);
 			if (!await this.engine.taxonomies.deleteTerm(parts[2])) return jsonResponse({ error: "Term not found" }, 404);
 			return jsonResponse({
 				success: true,
@@ -1753,7 +3228,7 @@ var CMSRouter = class {
 		}
 		return jsonResponse({ error: "Endpoint not found" }, 404);
 	}
-	async handleMedia(pathname, method, url, request) {
+	async handleMedia(pathname, method, url, request, user) {
 		const parts = pathname.replace(/^\/api\/media\/?/, "").split("/").filter(Boolean);
 		if (parts.length === 0 && method === "GET") {
 			const search = url.searchParams.get("search") || void 0;
@@ -1768,8 +3243,25 @@ var CMSRouter = class {
 			}));
 		}
 		if (parts.length === 0 && method === "POST") {
+			if (this.engine.auth.enabled && !this.engine.rbac.can(user, "upload_files")) return jsonResponse({ error: "Forbidden" }, user ? 403 : 401);
+			if ((request.headers.get("content-type") || request.headers.get("Content-Type") || "").includes("multipart/form-data")) {
+				const formData = await request.formData();
+				const file = formData.get("file");
+				if (!file || typeof file.arrayBuffer !== "function") return jsonResponse({ error: "No file uploaded in 'file' field" }, 400);
+				const buffer = new Uint8Array(await file.arrayBuffer());
+				const altText = formData.get("altText") || void 0;
+				const caption = formData.get("caption") || void 0;
+				return jsonResponse(await this.engine.media.upload({
+					filename: file.name,
+					mimeType: file.type || "application/octet-stream",
+					buffer,
+					sizeBytes: file.size,
+					altText,
+					caption
+				}, user?.id), 201);
+			}
 			const body = await request.json();
-			return jsonResponse(await this.engine.media.upload(body), 201);
+			return jsonResponse(await this.engine.media.upload(body, user?.id), 201);
 		}
 		const id = parts[0];
 		if (parts.length === 1 && method === "GET") {
@@ -1778,12 +3270,14 @@ var CMSRouter = class {
 			return jsonResponse(media);
 		}
 		if (parts.length === 1 && method === "PUT") {
+			if (this.engine.auth.enabled && !this.engine.rbac.can(user, "upload_files")) return jsonResponse({ error: "Forbidden" }, user ? 403 : 401);
 			const body = await request.json();
 			const updated = await this.engine.media.updateMetadata(id, body);
 			if (!updated) return jsonResponse({ error: "Media not found" }, 404);
 			return jsonResponse(updated);
 		}
 		if (parts.length === 1 && method === "DELETE") {
+			if (this.engine.auth.enabled && !this.engine.rbac.can(user, "delete_files")) return jsonResponse({ error: "Forbidden" }, user ? 403 : 401);
 			if (!await this.engine.media.delete(id)) return jsonResponse({ error: "Media not found" }, 404);
 			return jsonResponse({
 				success: true,
@@ -1792,7 +3286,7 @@ var CMSRouter = class {
 		}
 		return jsonResponse({ error: "Method not allowed" }, 405);
 	}
-	async handleOptions(pathname, method, url, request) {
+	async handleOptions(pathname, method, url, request, user) {
 		const key = pathname.replace(/^\/api\/options\/?/, "");
 		if (!key && method === "GET") {
 			const namespace = url.searchParams.get("namespace") || void 0;
@@ -1807,6 +3301,7 @@ var CMSRouter = class {
 			});
 		}
 		if (key && method === "PUT") {
+			if (this.engine.auth.enabled && !this.engine.rbac.can(user, "manage_options")) return jsonResponse({ error: "Forbidden" }, user ? 403 : 401);
 			const body = await request.json();
 			return jsonResponse(await this.engine.options.set(key, body.value, {
 				autoload: body.autoload,
@@ -1814,6 +3309,7 @@ var CMSRouter = class {
 			}));
 		}
 		if (key && method === "DELETE") {
+			if (this.engine.auth.enabled && !this.engine.rbac.can(user, "manage_options")) return jsonResponse({ error: "Forbidden" }, user ? 403 : 401);
 			if (!await this.engine.options.delete(key)) return jsonResponse({ error: "Option not found" }, 404);
 			return jsonResponse({
 				success: true,
@@ -1822,6 +3318,17 @@ var CMSRouter = class {
 		}
 		return jsonResponse({ error: "Method not allowed" }, 405);
 	}
+	filterRestrictedFields(item, collConfig, user) {
+		if (!collConfig.fields || !item.data) return item;
+		const sanitizedData = { ...item.data };
+		for (const field of collConfig.fields) if (field.readRoles && field.readRoles.length > 0) {
+			if (!(user?.role === "admin" || user?.role && field.readRoles.includes(user.role))) delete sanitizedData[field.name];
+		}
+		return {
+			...item,
+			data: sanitizedData
+		};
+	}
 };
 function createCMSRouter(engine) {
 	return new CMSRouter(engine);
@@ -6630,6 +8137,6 @@ function getTransferService(engine, options) {
 	return service;
 }
 //#endregion
-export { CMSClient, CMSEngine, CMSRouter, ContentLifecycle, DEFAULT_COLLECTIONS, DEFAULT_ROLE_CAPABILITIES, EcommerceClient, EcommerceService, HRMSClient, HRMSService, HRMS_EMPLOYEE_TRANSFER_PRESET, HRMS_EMPLOYER_TRANSFER_PRESET, HooksManager, MediaManager, MemoryStorageAdapter, OptionsManager, RBACManager, RevisionManager, TaxonomyManager, TransferClient, TransferService, VALID_STATUS_TRANSITIONS, applyFieldTransform, collection, createAttendanceCollection, createCMSEngine, createCMSRouter, createCmsClient, createDiscountCollection, createEcommerceTaxonomies, createEmployeeCollection, createEmployerCollection, createHRMSTaxonomies, createLeaveRequestCollection, createLeaveTypeCollection, createOrderCollection, createProductCollection, defaultHooks, defineConfig, definePlugin, detectFormat, ecommercePlugin, fields, generateSuggestedMapping, getEcommerceClient, getEcommerceService, getHRMSClient, getHRMSService, getTransferClient, getTransferService, hrmsPlugin, inspectSource, mapCmsItemForExport, mapSourceRecord, normalizeConfig, parseCsvSource, parseExcelSource, parseJsonSource, parseSource, resolveUniqueSlug, serializeCsv, serializeExcel, serializeJson, serializeSource, slugify, summarizeCollection, transferPlugin, validateAndNormalizeData, validateTransferBatch };
+export { AuthService, CMSClient, CMSEngine, CMSRouter, ContentLifecycle, DEFAULT_COLLECTIONS, DEFAULT_ROLE_CAPABILITIES, DiskMediaStorageDriver, EcommerceClient, EcommerceService, HRMSClient, HRMSService, HRMS_EMPLOYEE_TRANSFER_PRESET, HRMS_EMPLOYER_TRANSFER_PRESET, HooksManager, MediaManager, MemoryStorageAdapter, OptionsManager, PersistenceStorageAdapter, PreviewManager, RBACManager, RevisionManager, TaxonomyManager, TransferClient, TransferService, VALID_STATUS_TRANSITIONS, WebhookManager, applyFieldTransform, collection, computeHmacSignature, createAttendanceCollection, createCMSEngine, createCMSRouter, createCmsClient, createDiscountCollection, createEcommerceTaxonomies, createEmployeeCollection, createEmployerCollection, createHRMSTaxonomies, createLeaveRequestCollection, createLeaveTypeCollection, createOrderCollection, createProductCollection, defaultHooks, defineConfig, definePlugin, detectFormat, ecommercePlugin, fields, generateSuggestedMapping, getEcommerceClient, getEcommerceService, getHRMSClient, getHRMSService, getTransferClient, getTransferService, hashPassword, hrmsPlugin, inspectSource, mapCmsItemForExport, mapSourceRecord, mergeLocalizedInput, normalizeConfig, parseCsvSource, parseExcelSource, parseJsonSource, parseSource, resolveLocalizedData, resolveUniqueSlug, serializeCsv, serializeExcel, serializeJson, serializeSource, signJwt, slugify, summarizeCollection, transferPlugin, validateAndNormalizeData, validateTransferBatch, verifyJwt, verifyPassword };
 
 //# sourceMappingURL=index.mjs.map