@byline/core 4.1.0 → 4.3.0

package/dist/config/validate-admin-configs.js

@@ -5,6 +5,61 @@
  *
  * Copyright (c) Infonomic Company Limited
  */
+/**
+ * Resolve a dotted schema path (`faq.answer`, `files.filesGroup.publicationFile`)
+ * against a field set. Schema paths address field *declarations*: every
+ * segment names a field, intermediate segments must be `group` / `array`
+ * structure fields, and no segment carries an item index. Returns:
+ *
+ *  - `'ok'`         — the path resolves to a field declaration;
+ *  - `'blocks'`     — the path tries to traverse a `type: 'blocks'` field
+ *                     (blocks resolve their own admin config from the
+ *                     blockType-keyed registry, so this is always an error);
+ *  - `'unresolved'` — a segment doesn't name a field, or a value field
+ *                     appears mid-path.
+ */
+function resolveSchemaPath(fields, path) {
+    const segments = path.split('.');
+    let current = fields;
+    for (let i = 0; i < segments.length; i++) {
+        const name = segments[i];
+        const field = current.find((f) => 'name' in f && f.name === name);
+        if (field == null)
+            return 'unresolved';
+        if (i === segments.length - 1)
+            return 'ok';
+        if (field.type === 'group' || field.type === 'array') {
+            current = field.fields;
+        }
+        else if (field.type === 'blocks') {
+            return 'blocks';
+        }
+        else {
+            return 'unresolved';
+        }
+    }
+    return 'unresolved';
+}
+/**
+ * Shared validation for a `fields{}` override map (collection- or block-level):
+ * keys must be dotted, index-free schema paths that resolve to a field
+ * declaration without traversing a `blocks` field. `subject` names the config
+ * in error messages (`Collection "docs"` / `Block "faqBlock"`).
+ */
+function validateFieldAdminKeys(keys, resolve, fail) {
+    for (const key of keys) {
+        if (key.includes('[')) {
+            fail(`\`fields["${key}"]\` contains an item index. Field override keys are index-free schema paths addressing field declarations (e.g. "faq.answer"), not instance paths (e.g. "faq[0].answer").`);
+        }
+        const resolution = resolve(key);
+        if (resolution === 'blocks') {
+            fail(`\`fields["${key}"]\` traverses a \`type: 'blocks'\` field. Blocks resolve their own overrides from the blockType-keyed \`blockAdmin\` registry — register a block admin config for the inner block instead.`);
+        }
+        if (resolution === 'unresolved') {
+            fail(`\`fields["${key}"]\` does not resolve to a field declaration. Keys are dotted, index-free schema paths whose intermediate segments are \`group\` / \`array\` fields (e.g. "faq.answer").`);
+        }
+    }
+}
 /**
  * Validate every admin config in a configuration.
  *
@@ -21,8 +76,9 @@
  *     are unique within an admin config and don't shadow schema field names.
  *  5. Nesting — `tabSets` only appear in `layout.main`; rows contain only
  *     schema field names; groups exclude tabSets and nested groups.
- *  6. `fields` map sanity — every key in `admin.fields` matches a top-level
- *     schema field name.
+ *  6. `fields` map sanity — every key in `admin.fields` is a dotted,
+ *     index-free schema path resolving to a field declaration (top-level
+ *     name or a path through group/array fields; never through blocks).
  *  7. `defaultSort` sanity — `field` resolves to a top-level schema field
  *     or a document-level column (`createdAt` / `updatedAt` / `path`), the
  *     direction (when given) is `asc` | `desc`, and the option is rejected
@@ -44,6 +100,87 @@ export function validateAdminConfigs(admins, collections) {
         validateOne(admin, collectionsByPath);
     }
 }
+/**
+ * Validate every block admin config in a configuration.
+ *
+ * Enforced rules (per `ClientConfig.blockAdmin` entry):
+ *  1. Block pairing — `blockType` matches a block declared on at least one
+ *     `type: 'blocks'` field across the registered collections (blocks have
+ *     no global registry; the collections walk is the source of truth).
+ *  2. Uniqueness — no two entries share a `blockType`.
+ *  3. `fields` map sanity — every key is a dotted, index-free schema path
+ *     resolving to a field declaration of the block (top-level name or a
+ *     path through group/array fields; never through a nested blocks field).
+ *     When the same `blockType` appears in several collections, a key is
+ *     accepted if it resolves in any declaration site (union semantics).
+ *
+ * Throws a plain `Error` for the same reason `validateAdminConfigs` does —
+ * this runs at startup, before the logger is necessarily wired up.
+ */
+export function validateBlockAdminConfigs(blockAdmins, collections) {
+    if (blockAdmins == null || blockAdmins.length === 0)
+        return;
+    // Collect blockType → declaration sites across every registered collection
+    // (including blocks nested inside groups/arrays/blocks). Structural drift
+    // between same-blockType declarations is possible, so keys validate against
+    // the union of sites.
+    const blocksByType = new Map();
+    const walkBlock = (block) => {
+        let sites = blocksByType.get(block.blockType);
+        if (sites == null) {
+            sites = [];
+            blocksByType.set(block.blockType, sites);
+        }
+        sites.push(block);
+        walkFields(block.fields);
+    };
+    const walkFields = (fields) => {
+        for (const field of fields) {
+            if (field.type === 'blocks') {
+                for (const block of field.blocks)
+                    walkBlock(block);
+            }
+            else if ('fields' in field && Array.isArray(field.fields)) {
+                walkFields(field.fields);
+            }
+        }
+    };
+    for (const collection of collections) {
+        walkFields(collection.fields);
+    }
+    const seen = new Set();
+    for (const entry of blockAdmins) {
+        // Rule 2 — uniqueness.
+        if (seen.has(entry.blockType)) {
+            throw new Error(`Block admin config "${entry.blockType}" is registered more than once in \`blockAdmin\`.`);
+        }
+        seen.add(entry.blockType);
+        // Rule 1 — block pairing.
+        const sites = blocksByType.get(entry.blockType);
+        if (sites == null) {
+            throw new Error(`Block admin config "${entry.blockType}" has no matching block (no \`type: 'blocks'\` field of any registered collection declares a block with \`blockType: '${entry.blockType}'\`).`);
+        }
+        // Rule 3 — `fields` keys must be schema paths resolving within the block
+        // (union across declaration sites). 'blocks' beats 'unresolved' in the
+        // union so the traversal error surfaces when any site has the nested
+        // blocks field the key tried to walk through.
+        if (entry.fields != null) {
+            validateFieldAdminKeys(Object.keys(entry.fields), (key) => {
+                let best = 'unresolved';
+                for (const block of sites) {
+                    const resolution = resolveSchemaPath(block.fields, key);
+                    if (resolution === 'ok')
+                        return 'ok';
+                    if (resolution === 'blocks')
+                        best = 'blocks';
+                }
+                return best;
+            }, (msg) => {
+                throw new Error(`Block "${entry.blockType}": ${msg}`);
+            });
+        }
+    }
+}
 function validateOne(admin, collectionsByPath) {
     // Rule 1 — slug pairing.
     const collection = collectionsByPath.get(admin.slug);
@@ -62,26 +199,30 @@ function validateOne(admin, collectionsByPath) {
         if ('name' in field)
             topLevelFieldNames.add(field.name);
     }
-    // Rule 7 — defaultSort sanity. The list read applies this spec verbatim
-    // (host list server fn → parseSort), so a bad field name would silently
-    // fall back to `created_at desc` at request time — fail loudly at boot
-    // instead.
-    if (admin.defaultSort != null) {
-        const { field, direction } = admin.defaultSort;
+    // Rule 7 — defaultSort / itemViewSort sanity. The list read applies these
+    // specs verbatim (host list server fn → parseSort), so a bad field name
+    // would silently fall back to `created_at desc` at request time — fail
+    // loudly at boot instead. Both options share one rule set.
+    const validateSortSpec = (spec, optionName) => {
+        if (spec == null)
+            return;
+        const { field, direction } = spec;
         const documentColumns = new Set(['createdAt', 'updatedAt', 'path']);
         if (collection.orderable === true) {
-            fail(`defaultSort is not allowed on an orderable collection — manual ordering owns the default sort (order_key asc).`);
+            fail(`${optionName} is not allowed on an orderable collection — manual ordering owns the sort (order_key asc).`);
         }
         if (typeof field !== 'string' || field.length === 0) {
-            fail(`defaultSort.field must be a non-empty string.`);
+            fail(`${optionName}.field must be a non-empty string.`);
         }
         if (!topLevelFieldNames.has(field) && !documentColumns.has(field)) {
-            fail(`defaultSort.field "${String(field)}" is not a top-level schema field or a document column (createdAt, updatedAt, path).`);
+            fail(`${optionName}.field "${String(field)}" is not a top-level schema field or a document column (createdAt, updatedAt, path).`);
         }
         if (direction != null && direction !== 'asc' && direction !== 'desc') {
-            fail(`defaultSort.direction must be 'asc' or 'desc' (got "${String(direction)}").`);
+            fail(`${optionName}.direction must be 'asc' or 'desc' (got "${String(direction)}").`);
         }
-    }
+    };
+    validateSortSpec(admin.defaultSort, 'defaultSort');
+    validateSortSpec(admin.itemViewSort, 'itemViewSort');
     // Build primitive lookup tables.
     const tabSets = admin.tabSets ?? [];
     const rows = admin.rows ?? [];
@@ -199,13 +340,10 @@ function validateOne(admin, collectionsByPath) {
             }
         }
     }
-    // Rule 6 — `fields` map keys must match top-level schema field names.
+    // Rule 6 — `fields` map keys must be schema paths resolving to a field
+    // declaration of the collection.
     if (admin.fields != null) {
-        for (const key of Object.keys(admin.fields)) {
-            if (!topLevelFieldNames.has(key)) {
-                fail(`\`fields["${key}"]\` references a name that is not a top-level schema field. Per-field overrides apply only to top-level schema fields.`);
-            }
-        }
+        validateFieldAdminKeys(Object.keys(admin.fields), (key) => resolveSchemaPath(collection.fields, key), fail);
     }
     // Rule 2 + 3 — layout: name resolution + bookkeeping (every schema field
     // placed exactly once). Skipped when no `layout` is declared (the

package/dist/config/validate-admin-configs.test.node.js

@@ -6,7 +6,7 @@
  * Copyright (c) Infonomic Company Limited
  */
 import { describe, expect, it } from 'vitest';
-import { validateAdminConfigs } from './validate-admin-configs.js';
+import { validateAdminConfigs, validateBlockAdminConfigs } from './validate-admin-configs.js';
 const collection = {
     path: 'news',
     labels: { singular: 'News', plural: 'News' },
@@ -199,7 +199,63 @@ describe('validateAdminConfigs', () => {
             ...baseAdmin,
             fields: { nonexistent: {} },
         };
-        expect(() => validateAdminConfigs([admin], [collection])).toThrow(/not a top-level schema field/);
+        expect(() => validateAdminConfigs([admin], [collection])).toThrow(/does not resolve to a field declaration/);
+    });
+    // Rule 6 — dotted schema-path keys. A dedicated collection with nested
+    // structure: files (array) → filesGroup (group) → leaf fields, plus a
+    // blocks field to prove traversal through blocks is rejected.
+    const nestedCollection = {
+        path: 'library',
+        labels: { singular: 'Item', plural: 'Items' },
+        useAsPath: 'title',
+        fields: [
+            { name: 'title', label: 'Title', type: 'text' },
+            {
+                name: 'files',
+                label: 'Files',
+                type: 'array',
+                fields: [
+                    {
+                        name: 'filesGroup',
+                        type: 'group',
+                        fields: [
+                            { name: 'publicationFile', label: 'File', type: 'file' },
+                            { name: 'notes', label: 'Notes', type: 'richText' },
+                        ],
+                    },
+                ],
+            },
+            {
+                name: 'sections',
+                label: 'Sections',
+                type: 'blocks',
+                blocks: [
+                    {
+                        blockType: 'proseBlock',
+                        fields: [{ name: 'body', label: 'Body', type: 'richText' }],
+                    },
+                ],
+            },
+        ],
+    };
+    const nestedAdmin = (fields) => ({
+        slug: 'library',
+        fields: fields,
+    });
+    it('accepts a dotted fields key through array and group declarations', () => {
+        expect(() => validateAdminConfigs([nestedAdmin({ 'files.filesGroup.notes': {} })], [nestedCollection])).not.toThrow();
+    });
+    it('rejects a dotted fields key whose leaf does not exist', () => {
+        expect(() => validateAdminConfigs([nestedAdmin({ 'files.filesGroup.missing': {} })], [nestedCollection])).toThrow(/does not resolve to a field declaration/);
+    });
+    it('rejects a dotted fields key that walks through a value field', () => {
+        expect(() => validateAdminConfigs([nestedAdmin({ 'title.anything': {} })], [nestedCollection])).toThrow(/does not resolve to a field declaration/);
+    });
+    it('rejects a fields key carrying an item index', () => {
+        expect(() => validateAdminConfigs([nestedAdmin({ 'files[0].filesGroup.notes': {} })], [nestedCollection])).toThrow(/index-free schema paths/);
+    });
+    it('rejects a fields key that traverses a blocks field', () => {
+        expect(() => validateAdminConfigs([nestedAdmin({ 'sections.body': {} })], [nestedCollection])).toThrow(/blockAdmin/);
     });
     // Rule 7 — defaultSort sanity.
     it('accepts a defaultSort on a schema field', () => {
@@ -238,6 +294,44 @@ describe('validateAdminConfigs', () => {
         };
         expect(() => validateAdminConfigs([admin], [orderableCollection])).toThrow(/not allowed on an orderable collection/);
     });
+    // Rule 7 — itemViewSort shares the defaultSort rule set.
+    it('accepts an itemViewSort on a schema field', () => {
+        const admin = {
+            ...baseAdmin,
+            itemViewSort: { field: 'title' },
+        };
+        expect(() => validateAdminConfigs([admin], [collection])).not.toThrow();
+    });
+    it('accepts independent defaultSort and itemViewSort', () => {
+        const admin = {
+            ...baseAdmin,
+            defaultSort: { field: 'updatedAt', direction: 'desc' },
+            itemViewSort: { field: 'title' },
+        };
+        expect(() => validateAdminConfigs([admin], [collection])).not.toThrow();
+    });
+    it('rejects an itemViewSort field that resolves to nothing', () => {
+        const admin = {
+            ...baseAdmin,
+            itemViewSort: { field: 'nonexistent' },
+        };
+        expect(() => validateAdminConfigs([admin], [collection])).toThrow(/itemViewSort\.field "nonexistent"/);
+    });
+    it('rejects an itemViewSort direction outside asc/desc', () => {
+        const admin = {
+            ...baseAdmin,
+            itemViewSort: { field: 'title', direction: 'sideways' },
+        };
+        expect(() => validateAdminConfigs([admin], [collection])).toThrow(/itemViewSort\.direction must be 'asc' or 'desc'/);
+    });
+    it('rejects an itemViewSort on an orderable collection', () => {
+        const orderableCollection = { ...collection, orderable: true };
+        const admin = {
+            ...baseAdmin,
+            itemViewSort: { field: 'title' },
+        };
+        expect(() => validateAdminConfigs([admin], [orderableCollection])).toThrow(/not allowed on an orderable collection/);
+    });
     // Layout omitted — bookkeeping skipped, primitive declarations still checked.
     it('skips placement bookkeeping when layout is omitted', () => {
         const admin = {
@@ -258,3 +352,112 @@ describe('validateAdminConfigs', () => {
         expect(() => validateAdminConfigs([admin], [collection])).toThrow(/collides with a schema field/);
     });
 });
+describe('validateBlockAdminConfigs', () => {
+    const quoteBlock = {
+        blockType: 'quoteBlock',
+        fields: [
+            { name: 'quoteText', label: 'Quote', type: 'richText' },
+            { name: 'source', label: 'Source', type: 'text' },
+        ],
+    };
+    const heroBlock = {
+        blockType: 'heroBlock',
+        fields: [{ name: 'heading', label: 'Heading', type: 'text' }],
+    };
+    const blockCollection = {
+        path: 'pages',
+        labels: { singular: 'Page', plural: 'Pages' },
+        useAsPath: 'title',
+        fields: [
+            { name: 'title', label: 'Title', type: 'text' },
+            { name: 'content', label: 'Content', type: 'blocks', blocks: [quoteBlock] },
+            {
+                name: 'meta',
+                label: 'Meta',
+                type: 'group',
+                fields: [
+                    // Blocks fields nested inside structure fields are still collected.
+                    { name: 'panels', label: 'Panels', type: 'blocks', blocks: [heroBlock] },
+                ],
+            },
+        ],
+    };
+    it('accepts a valid block admin config (baseline)', () => {
+        expect(() => validateBlockAdminConfigs([{ blockType: 'quoteBlock', fields: { quoteText: {} } }], [blockCollection])).not.toThrow();
+    });
+    it('is a no-op when blockAdmins is undefined or empty', () => {
+        expect(() => validateBlockAdminConfigs(undefined, [blockCollection])).not.toThrow();
+        expect(() => validateBlockAdminConfigs([], [blockCollection])).not.toThrow();
+    });
+    // Rule 1 — block pairing.
+    it('rejects an entry whose blockType matches no declared block', () => {
+        expect(() => validateBlockAdminConfigs([{ blockType: 'missingBlock' }], [blockCollection])).toThrow(/no matching block/);
+    });
+    it('finds blocks declared inside nested structure fields', () => {
+        expect(() => validateBlockAdminConfigs([{ blockType: 'heroBlock', fields: { heading: {} } }], [blockCollection])).not.toThrow();
+    });
+    // Rule 2 — uniqueness.
+    it('rejects duplicate blockType entries', () => {
+        expect(() => validateBlockAdminConfigs([{ blockType: 'quoteBlock' }, { blockType: 'quoteBlock' }], [blockCollection])).toThrow(/registered more than once/);
+    });
+    // Rule 3 — fields map sanity.
+    it('rejects a fields key that is not a field of the block', () => {
+        expect(() => validateBlockAdminConfigs([{ blockType: 'quoteBlock', fields: { doesNotExist: {} } }], [blockCollection])).toThrow(/does not resolve to a field declaration/);
+    });
+    // Rule 3 — dotted schema-path keys inside a block (array-in-block, the
+    // FAQBlock shape).
+    const faqBlock = {
+        blockType: 'faqBlock',
+        fields: [
+            {
+                name: 'faq',
+                label: 'Questions',
+                type: 'array',
+                fields: [
+                    { name: 'question', label: 'Question', type: 'text' },
+                    { name: 'answer', label: 'Answer', type: 'richText' },
+                ],
+            },
+        ],
+    };
+    const faqCollection = {
+        path: 'docs',
+        labels: { singular: 'Doc', plural: 'Docs' },
+        useAsPath: 'title',
+        fields: [
+            { name: 'title', label: 'Title', type: 'text' },
+            { name: 'content', label: 'Content', type: 'blocks', blocks: [faqBlock] },
+        ],
+    };
+    it('accepts a dotted fields key addressing a field inside an array in the block', () => {
+        expect(() => validateBlockAdminConfigs([{ blockType: 'faqBlock', fields: { 'faq.answer': {} } }], [faqCollection])).not.toThrow();
+    });
+    it('rejects a dotted fields key whose leaf is not declared in the block', () => {
+        expect(() => validateBlockAdminConfigs([{ blockType: 'faqBlock', fields: { 'faq.missing': {} } }], [faqCollection])).toThrow(/does not resolve to a field declaration/);
+    });
+    it('rejects a block fields key carrying an item index', () => {
+        expect(() => validateBlockAdminConfigs([{ blockType: 'faqBlock', fields: { 'faq[0].answer': {} } }], [faqCollection])).toThrow(/index-free schema paths/);
+    });
+    it('accepts the union of field names when a blockType appears in several collections', () => {
+        const other = {
+            path: 'docs',
+            labels: { singular: 'Doc', plural: 'Docs' },
+            useAsPath: 'title',
+            fields: [
+                { name: 'title', label: 'Title', type: 'text' },
+                {
+                    name: 'content',
+                    label: 'Content',
+                    type: 'blocks',
+                    blocks: [
+                        {
+                            blockType: 'quoteBlock',
+                            fields: [{ name: 'attribution', label: 'Attribution', type: 'text' }],
+                        },
+                    ],
+                },
+            ],
+        };
+        expect(() => validateBlockAdminConfigs([{ blockType: 'quoteBlock', fields: { quoteText: {}, attribution: {} } }], [blockCollection, other])).not.toThrow();
+    });
+});

package/dist/config/validate-collections.js

@@ -237,5 +237,48 @@ export function validateCollections(collections) {
             throw new Error(`Collection "${collection.path}" sets both \`tree: true\` and \`orderable: true\`. A document-tree collection owns ordering on the tree edge (per-parent), so \`byline_documents.order_key\` is inert — set only \`tree: true\`.`);
         }
         validateVirtualFields(collection);
+        validateUploadLocations(collection);
     }
 }
+/**
+ * Enforce the `upload.location` shape for every upload-capable field. The
+ * value is a declarative storage-key scope handed to storage providers
+ * (`<location>/<uuid>-<filename>`), so it must be a clean POSIX-style
+ * segment path:
+ *
+ *   - non-empty string, forward slashes only;
+ *   - no leading / trailing / duplicate slashes;
+ *   - segments of `A–Z a–z 0–9 . _ -` only (no spaces, no backslashes);
+ *   - no `.` or `..` segments (path traversal).
+ */
+function validateUploadLocations(collection) {
+    walkFieldsWithPath(collection.fields, (field, fieldPath) => {
+        if (field.type !== 'file' && field.type !== 'image')
+            return;
+        const location = field.upload?.location;
+        if (location === undefined)
+            return;
+        const fail = (reason) => {
+            throw new Error(`Collection "${collection.path}" field "${fieldPath}" has invalid \`upload.location\` ` +
+                `${JSON.stringify(location)}: ${reason}`);
+        };
+        if (typeof location !== 'string' || location.length === 0) {
+            fail('must be a non-empty string.');
+        }
+        if (location.startsWith('/') || location.endsWith('/')) {
+            fail('must not start or end with a slash.');
+        }
+        const segments = location.split('/');
+        for (const segment of segments) {
+            if (segment.length === 0) {
+                fail('must not contain duplicate slashes.');
+            }
+            if (segment === '.' || segment === '..') {
+                fail('must not contain `.` or `..` segments.');
+            }
+            if (!/^[A-Za-z0-9._-]+$/.test(segment)) {
+                fail(`segment "${segment}" contains unsupported characters (allowed: A–Z a–z 0–9 . _ -).`);
+            }
+        }
+    });
+}

package/dist/config/validate-collections.test.node.js

@@ -452,4 +452,64 @@ describe('validateCollections', () => {
         };
         expect(() => validateCollections([collection])).toThrow(/listSearch.*virtual/s);
     });
+    // upload.location — declarative storage-key scope shape.
+    const withLocation = (location) => ({
+        ...baseCollection,
+        fields: [
+            { name: 'title', label: 'Title', type: 'text' },
+            { name: 'cover', label: 'Cover', type: 'image', optional: true, upload: { location } },
+        ],
+    });
+    it('accepts a single-segment upload.location', () => {
+        expect(() => validateCollections([withLocation('covers')])).not.toThrow();
+    });
+    it('accepts a nested upload.location', () => {
+        expect(() => validateCollections([withLocation('publications/covers')])).not.toThrow();
+    });
+    it('rejects an empty upload.location', () => {
+        expect(() => validateCollections([withLocation('')])).toThrow(/non-empty string/);
+    });
+    it('rejects a leading slash in upload.location', () => {
+        expect(() => validateCollections([withLocation('/covers')])).toThrow(/must not start or end with a slash/);
+    });
+    it('rejects a trailing slash in upload.location', () => {
+        expect(() => validateCollections([withLocation('covers/')])).toThrow(/must not start or end with a slash/);
+    });
+    it('rejects duplicate slashes in upload.location', () => {
+        expect(() => validateCollections([withLocation('a//b')])).toThrow(/must not contain duplicate slashes/);
+    });
+    it('rejects dot segments in upload.location', () => {
+        expect(() => validateCollections([withLocation('a/../b')])).toThrow(/must not contain `\.` or `\.\.` segments/);
+    });
+    it('rejects unsupported characters in upload.location', () => {
+        expect(() => validateCollections([withLocation('news attachments')])).toThrow(/unsupported characters/);
+    });
+    it('validates upload.location on fields nested inside blocks', () => {
+        const collection = {
+            ...baseCollection,
+            fields: [
+                { name: 'title', label: 'Title', type: 'text' },
+                {
+                    name: 'content',
+                    label: 'Content',
+                    type: 'blocks',
+                    blocks: [
+                        {
+                            blockType: 'attachmentsBlock',
+                            fields: [
+                                {
+                                    name: 'file',
+                                    label: 'File',
+                                    type: 'file',
+                                    optional: true,
+                                    upload: { location: 'bad//path' },
+                                },
+                            ],
+                        },
+                    ],
+                },
+            ],
+        };
+        expect(() => validateCollections([collection])).toThrow(/content\.file.*must not contain duplicate slashes/s);
+    });
 });

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export * from './@types/index.js';
 export { applyBeforeRead, assertActorCanPerform, bindReadContextAuthority, COLLECTION_ABILITY_VERBS, type CollectionAbilityVerb, collectionAbilityKey, compileBeforeReadFilters, registerCollectionAbilities, } from './auth/index.js';
 export { defineClientConfig, defineServerConfig, getClientConfig, getCollectionAdminConfig, getCollectionDefinition, getServerConfig, orderByContentLocale, resolveItemViewColumns, } from './config/config.js';
 export { resolveRoutes } from './config/routes.js';
-export { validateAdminConfigs } from './config/validate-admin-configs.js';
+export { validateAdminConfigs, validateBlockAdminConfigs, } from './config/validate-admin-configs.js';
 export { RESERVED_FIELD_NAMES } from './config/validate-collections.js';
 export { type BylineCore, getBylineCore, initBylineCore } from './core.js';
 export * from './defaults/default-values.js';
@@ -18,5 +18,6 @@ export * from './services/index.js';
 export * from './storage/index.js';
 export { normalizeRootRelativeRedirect } from './utils/root-relative-redirect.js';
 export { formatTextValue, looksLikeISODate, type SlugifierFn, type SlugifyContext, slugify, } from './utils/slugify.js';
+export { type FilenameSlugifierFn, type FilenameSlugifyContext, resolveUploadFilename, slugifyFilename, } from './utils/slugify-filename.js';
 export { getUploadFields, hasUploadField, isUploadField } from './utils/storage-utils.js';
 export * from './workflow/index.js';

package/dist/index.js

@@ -18,7 +18,7 @@ export * from './@types/index.js';
 export { applyBeforeRead, assertActorCanPerform, bindReadContextAuthority, COLLECTION_ABILITY_VERBS, collectionAbilityKey, compileBeforeReadFilters, registerCollectionAbilities, } from './auth/index.js';
 export { defineClientConfig, defineServerConfig, getClientConfig, getCollectionAdminConfig, getCollectionDefinition, getServerConfig, orderByContentLocale, resolveItemViewColumns, } from './config/config.js';
 export { resolveRoutes } from './config/routes.js';
-export { validateAdminConfigs } from './config/validate-admin-configs.js';
+export { validateAdminConfigs, validateBlockAdminConfigs, } from './config/validate-admin-configs.js';
 export { RESERVED_FIELD_NAMES } from './config/validate-collections.js';
 export { getBylineCore, initBylineCore } from './core.js';
 export * from './defaults/default-values.js';
@@ -34,5 +34,6 @@ export * from './services/index.js';
 export * from './storage/index.js';
 export { normalizeRootRelativeRedirect } from './utils/root-relative-redirect.js';
 export { formatTextValue, looksLikeISODate, slugify, } from './utils/slugify.js';
+export { resolveUploadFilename, slugifyFilename, } from './utils/slugify-filename.js';
 export { getUploadFields, hasUploadField, isUploadField } from './utils/storage-utils.js';
 export * from './workflow/index.js';

package/dist/schemas/zod/builder.js

@@ -48,9 +48,33 @@ const _applyDateTimeValidation = (schema, _field) => {
 export const fieldToZodSchema = (field, strict = true) => {
     let schema;
     switch (field.type) {
-        case 'array':
-            schema = z.any().array();
+        case 'array': {
+            // Homogeneous item objects built by recursing into the array's child
+            // fields — the item shape mirrors `createFieldsSchema` one level down,
+            // so requiredness and per-type validation apply inside items exactly
+            // as they do at the top level (threading `strict` keeps reads lenient
+            // for schema-evolved documents). `_id` is the synthetic item identity
+            // (assigned client-side on add, persisted via store_meta) — always
+            // accepted, never required. `.passthrough()` tolerates auxiliary keys
+            // (e.g. legacy seed-data `id` aliases) instead of stripping them.
+            // Group children stay `z.any()` via the `group` case below — the same
+            // depth boundary top-level groups have.
+            const itemShape = {
+                _id: z.string().optional(),
+            };
+            for (const child of field.fields ?? []) {
+                itemShape[child.name] = fieldToZodSchema(child, strict);
+            }
+            let arraySchema = z.array(z.object(itemShape).passthrough());
+            if (field.validation?.minLength != null) {
+                arraySchema = arraySchema.min(field.validation.minLength);
+            }
+            if (field.validation?.maxLength != null) {
+                arraySchema = arraySchema.max(field.validation.maxLength);
+            }
+            schema = arraySchema;
             break;
+        }
         case 'text': {
             let textSchema = z.string();
             textSchema = applyTextValidation(textSchema, field);
@@ -109,6 +133,17 @@ export const fieldToZodSchema = (field, strict = true) => {
             schema = textAreaSchema;
             break;
         }
+        case 'code': {
+            let codeSchema = z.string();
+            if (field.validation?.minLength) {
+                codeSchema = codeSchema.min(field.validation.minLength);
+            }
+            if (field.validation?.maxLength) {
+                codeSchema = codeSchema.max(field.validation.maxLength);
+            }
+            schema = codeSchema;
+            break;
+        }
         case 'integer':
             schema = z.number().int();
             break;