@easy-cms/core 0.1.0

package/dist/index.js

@@ -0,0 +1,2710 @@
+// src/access.ts
+var anyone = () => true;
+var isLoggedIn = ({ user }) => user !== null;
+var isAdmin = ({ user }) => user?.role === "admin";
+
+// src/errors.ts
+var ConfigError = class _ConfigError extends Error {
+  issues;
+  constructor(issues) {
+    super(_ConfigError.format(issues));
+    this.name = "ConfigError";
+    this.issues = issues;
+  }
+  static format(issues) {
+    const lines = issues.map((issue) => {
+      const hint = issue.hint ? `
+    \u2192 ${issue.hint}` : "";
+      return `  \u2022 ${issue.path}: ${issue.message}${hint}`;
+    });
+    const noun = issues.length === 1 ? "problem" : "problems";
+    return `Invalid Easy CMS config (${issues.length} ${noun}):
+${lines.join("\n")}`;
+  }
+};
+var EasyCMSError = class extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.name = "EasyCMSError";
+    this.status = status;
+  }
+};
+var ValidationError = class extends EasyCMSError {
+  errors;
+  constructor(collection2, errors) {
+    const list = errors.map((e) => `${e.field}: ${e.message}`).join("; ");
+    super(`Invalid data for "${collection2}": ${list}`, 400);
+    this.name = "ValidationError";
+    this.errors = errors;
+  }
+};
+var NotFoundError = class extends EasyCMSError {
+  constructor(collection2, id) {
+    super(`No document with id ${JSON.stringify(id)} in "${collection2}"`, 404);
+    this.name = "NotFoundError";
+  }
+};
+var QueryError = class extends EasyCMSError {
+  constructor(message) {
+    super(message, 400);
+    this.name = "QueryError";
+  }
+};
+var SchemaError = class extends EasyCMSError {
+  constructor(message) {
+    super(message, 500);
+    this.name = "SchemaError";
+  }
+};
+var UnauthorizedError = class extends EasyCMSError {
+  constructor(message = "You must be logged in") {
+    super(message, 401);
+    this.name = "UnauthorizedError";
+  }
+};
+var ForbiddenError = class extends EasyCMSError {
+  constructor(message = "You are not allowed to do this") {
+    super(message, 403);
+    this.name = "ForbiddenError";
+  }
+};
+var TooManyRequestsError = class extends EasyCMSError {
+  constructor(message) {
+    super(message, 429);
+    this.name = "TooManyRequestsError";
+  }
+};
+var PayloadTooLargeError = class extends EasyCMSError {
+  constructor(message) {
+    super(message, 413);
+    this.name = "PayloadTooLargeError";
+  }
+};
+
+// src/access-control.ts
+async function evaluateAccess(access, args) {
+  const result = await (access ?? isLoggedIn)(args);
+  if (typeof result === "boolean") return result;
+  if (typeof result === "object" && result !== null) return result;
+  throw new QueryError("Access functions must return a boolean or a where query");
+}
+function andWhere(where, constraint) {
+  if (constraint === true) return where;
+  return where === void 0 ? constraint : { and: [where, constraint] };
+}
+var FieldAccessChecker = class {
+  constructor(kind, args) {
+    this.kind = kind;
+    this.args = args;
+  }
+  kind;
+  args;
+  cache = /* @__PURE__ */ new Map();
+  async allows(field) {
+    const fn = field.access?.[this.kind];
+    if (!fn) return true;
+    let allowed2 = this.cache.get(field);
+    if (allowed2 === void 0) {
+      allowed2 = await fn(this.args) === true;
+      this.cache.set(field, allowed2);
+    }
+    return allowed2;
+  }
+};
+async function stripFields(fields, doc, read) {
+  const result = { ...doc };
+  for (const field of fields) {
+    if (!(field.name in result)) continue;
+    if (field.hidden || read && !await read.allows(field)) {
+      delete result[field.name];
+      continue;
+    }
+    const value = result[field.name];
+    if (field.type === "group" && value && typeof value === "object") {
+      result[field.name] = await stripFields(field.fields, value, read);
+    } else if (field.type === "array" && Array.isArray(value)) {
+      result[field.name] = await Promise.all(
+        value.map(
+          (row) => row && typeof row === "object" ? stripFields(field.fields, row, read) : row
+        )
+      );
+    }
+  }
+  return result;
+}
+async function filterInput(fields, data, update) {
+  const result = { ...data };
+  for (const field of fields) {
+    if (!(field.name in result)) continue;
+    if (field.hidden || update && !await update.allows(field)) {
+      delete result[field.name];
+      continue;
+    }
+    const value = result[field.name];
+    if (field.type === "group" && value && typeof value === "object" && !Array.isArray(value)) {
+      result[field.name] = await filterInput(field.fields, value, update);
+    } else if (field.type === "array" && Array.isArray(value)) {
+      result[field.name] = await Promise.all(
+        value.map(
+          (row) => row && typeof row === "object" ? filterInput(field.fields, row, update) : row
+        )
+      );
+    }
+  }
+  return result;
+}
+
+// src/builtins.ts
+var USERS = "users";
+var MEDIA = "media";
+var SESSIONS = "sessions";
+var LOGIN_ATTEMPTS = "login-attempts";
+var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([SESSIONS, LOGIN_ATTEMPTS]);
+var DEFAULT_ROLES = ["admin", "editor"];
+var adminOrSelf = ({ user }) => {
+  if (!user) return false;
+  if (user.role === "admin") return true;
+  return { id: { equals: user.id } };
+};
+var adminOnly = {
+  update: ({ user }) => user?.role === "admin"
+};
+function userFields(roles) {
+  return [
+    {
+      name: "email",
+      type: "email",
+      required: true,
+      unique: true,
+      label: { en: "Email", th: "\u0E2D\u0E35\u0E40\u0E21\u0E25" }
+    },
+    { name: "name", type: "text", label: { en: "Name", th: "\u0E0A\u0E37\u0E48\u0E2D" } },
+    {
+      name: "role",
+      type: "select",
+      options: roles,
+      required: true,
+      defaultValue: roles.includes("editor") ? "editor" : roles[roles.length - 1],
+      access: adminOnly,
+      label: { en: "Role", th: "\u0E1A\u0E17\u0E1A\u0E32\u0E17" }
+    },
+    {
+      name: "active",
+      type: "boolean",
+      defaultValue: true,
+      access: adminOnly,
+      label: { en: "Active", th: "\u0E43\u0E0A\u0E49\u0E07\u0E32\u0E19" }
+    },
+    { name: "passwordHash", type: "text", hidden: true }
+  ];
+}
+function withUsers(config) {
+  const roles = config.auth?.roles ?? DEFAULT_ROLES;
+  const custom = config.collections?.find((c) => c.slug === USERS);
+  const users = {
+    slug: USERS,
+    labels: { singular: { en: "User", th: "\u0E1C\u0E39\u0E49\u0E43\u0E0A\u0E49" }, plural: { en: "Users", th: "\u0E1C\u0E39\u0E49\u0E43\u0E0A\u0E49" } },
+    useAsTitle: "email",
+    ...custom,
+    fields: [...userFields(roles), ...custom?.fields ?? []],
+    access: {
+      read: isLoggedIn,
+      create: isAdmin,
+      update: adminOrSelf,
+      delete: isAdmin,
+      ...custom?.access
+    }
+  };
+  const others = (config.collections ?? []).filter((c) => c.slug !== USERS);
+  return { ...config, collections: [users, ...others] };
+}
+var systemField = { update: () => false };
+function mediaFields() {
+  return [
+    {
+      name: "filename",
+      type: "text",
+      required: true,
+      unique: true,
+      access: systemField,
+      label: { en: "File name", th: "\u0E0A\u0E37\u0E48\u0E2D\u0E44\u0E1F\u0E25\u0E4C" }
+    },
+    {
+      name: "originalName",
+      type: "text",
+      access: systemField,
+      label: { en: "Original name", th: "\u0E0A\u0E37\u0E48\u0E2D\u0E40\u0E14\u0E34\u0E21" }
+    },
+    {
+      name: "mimeType",
+      type: "text",
+      required: true,
+      access: systemField,
+      label: { en: "Type", th: "\u0E0A\u0E19\u0E34\u0E14" }
+    },
+    {
+      name: "filesize",
+      type: "number",
+      required: true,
+      access: systemField,
+      label: { en: "Size (bytes)", th: "\u0E02\u0E19\u0E32\u0E14 (\u0E44\u0E1A\u0E15\u0E4C)" }
+    },
+    { name: "width", type: "number", access: systemField, label: { en: "Width", th: "\u0E01\u0E27\u0E49\u0E32\u0E07" } },
+    { name: "height", type: "number", access: systemField, label: { en: "Height", th: "\u0E2A\u0E39\u0E07" } },
+    {
+      name: "sizes",
+      type: "json",
+      access: systemField,
+      label: { en: "Resized copies", th: "\u0E02\u0E19\u0E32\u0E14\u0E22\u0E48\u0E2D" }
+    },
+    { name: "alt", type: "text", label: { en: "Alternative text", th: "\u0E02\u0E49\u0E2D\u0E04\u0E27\u0E32\u0E21\u0E41\u0E17\u0E19\u0E23\u0E39\u0E1B" } }
+  ];
+}
+function withMedia(config) {
+  const custom = config.collections?.find((c) => c.slug === MEDIA);
+  const media = {
+    slug: MEDIA,
+    labels: { singular: { en: "Media", th: "\u0E2A\u0E37\u0E48\u0E2D" }, plural: { en: "Media", th: "\u0E04\u0E25\u0E31\u0E07\u0E2A\u0E37\u0E48\u0E2D" } },
+    useAsTitle: "filename",
+    ...custom,
+    fields: [...mediaFields(), ...custom?.fields ?? []],
+    access: {
+      read: anyone,
+      create: isLoggedIn,
+      update: isLoggedIn,
+      delete: isLoggedIn,
+      ...custom?.access
+    },
+    hooks: {
+      ...custom?.hooks,
+      afterRead: [
+        ({ doc, cms }) => {
+          const sizes = doc.sizes ?? {};
+          return {
+            ...doc,
+            url: typeof doc.filename === "string" ? cms.mediaURL(doc.filename) : null,
+            sizes: Object.fromEntries(
+              Object.entries(sizes).map(([name, size]) => [
+                name,
+                { ...size, url: cms.mediaURL(size.filename) }
+              ])
+            )
+          };
+        },
+        ...custom?.hooks?.afterRead ?? []
+      ],
+      afterDelete: [
+        async ({ doc, cms }) => {
+          const sizes = Object.values(doc.sizes ?? {});
+          for (const key2 of [doc.filename, ...sizes.map((s) => s.filename)]) {
+            if (typeof key2 === "string") await cms.storage.delete(key2);
+          }
+        },
+        ...custom?.hooks?.afterDelete ?? []
+      ]
+    }
+  };
+  const others = (config.collections ?? []).filter((c) => c.slug !== MEDIA);
+  return { ...config, collections: [...others.slice(0, 1), media, ...others.slice(1)] };
+}
+var nobody = () => false;
+var internalCollections = [
+  {
+    slug: SESSIONS,
+    access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+    fields: [
+      { name: "tokenHash", type: "text", required: true, unique: true },
+      { name: "user", type: "relationship", to: USERS, required: true },
+      { name: "expiresAt", type: "date", required: true, index: true }
+    ]
+  },
+  {
+    slug: LOGIN_ATTEMPTS,
+    access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+    fields: [{ name: "key", type: "text", required: true, index: true }]
+  }
+];
+
+// src/auth/password.ts
+import { randomBytes, scrypt, timingSafeEqual } from "crypto";
+var MIN_PASSWORD_LENGTH = 8;
+var N = 2 ** 17;
+var R = 8;
+var P = 1;
+var KEY_LENGTH = 64;
+var MAX_MEM = 256 * 1024 * 1024;
+function derive(password, salt, n, r, p, length) {
+  return new Promise((resolve3, reject) => {
+    scrypt(
+      password.normalize("NFKC"),
+      salt,
+      length,
+      { N: n, r, p, maxmem: MAX_MEM },
+      (error, key2) => error ? reject(error) : resolve3(key2)
+    );
+  });
+}
+async function hashPassword(password) {
+  const salt = randomBytes(16);
+  const key2 = await derive(password, salt, N, R, P, KEY_LENGTH);
+  return ["scrypt", N, R, P, salt.toString("base64url"), key2.toString("base64url")].join("$");
+}
+async function verifyPassword(password, stored) {
+  const [scheme, n, r, p, saltText, keyText] = stored.split("$");
+  if (scheme !== "scrypt" || !saltText || !keyText) return false;
+  const expected = Buffer.from(keyText, "base64url");
+  const key2 = await derive(
+    password,
+    Buffer.from(saltText, "base64url"),
+    Number(n),
+    Number(r),
+    Number(p),
+    expected.length
+  );
+  return key2.length === expected.length && timingSafeEqual(key2, expected);
+}
+var dummyHash;
+async function fakeVerify(password) {
+  dummyHash ??= hashPassword("easy-cms-dummy-password");
+  await verifyPassword(password, await dummyHash);
+  return false;
+}
+
+// src/auth/tokens.ts
+import { createHash, createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+function newToken() {
+  return randomBytes2(32).toString("base64url");
+}
+function hashToken(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+function hmac(secret, value) {
+  return createHmac("sha256", secret).update(value).digest("base64url");
+}
+function signToken(secret, token) {
+  return `${token}.${hmac(secret, `session:${token}`)}`;
+}
+function unsignToken(secret, value) {
+  const dot = value.lastIndexOf(".");
+  if (dot <= 0) return void 0;
+  const token = value.slice(0, dot);
+  return safeEqual(value.slice(dot + 1), hmac(secret, `session:${token}`)) ? token : void 0;
+}
+function csrfToken(secret, token) {
+  return hmac(secret, `csrf:${token}`);
+}
+function safeEqual(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual2(left, right);
+}
+
+// src/auth/auth.ts
+var INVALID = "Invalid email or password";
+var Auth = class {
+  constructor(cms) {
+    this.cms = cms;
+  }
+  cms;
+  get db() {
+    return this.cms.db;
+  }
+  get config() {
+    return this.cms.config;
+  }
+  /** Checks credentials and starts a session. Throws `UnauthorizedError` or `TooManyRequestsError`. */
+  async login(args) {
+    const email = typeof args.email === "string" ? args.email.trim().toLowerCase() : "";
+    const password = typeof args.password === "string" ? args.password : "";
+    const key2 = `${email}|${args.ip ?? ""}`;
+    await this.checkRateLimit(key2);
+    const [user] = email ? (await this.db.find({
+      collection: USERS,
+      where: { email: { equals: email } },
+      sort: [],
+      limit: 1,
+      page: 1
+    })).docs : [];
+    const hash = typeof user?.passwordHash === "string" ? user.passwordHash : void 0;
+    const valid = user && hash && password ? await verifyPassword(password, hash) : await fakeVerify(password);
+    if (!user || !valid || user.active === false) {
+      await this.recordFailure(key2);
+      throw new UnauthorizedError(INVALID);
+    }
+    await this.clearFailures(key2);
+    await this.deleteExpiredSessions(user.id);
+    return this.startSession(user);
+  }
+  /** Creates the first admin. Only works while there are no users. */
+  async registerFirstUser(args) {
+    if (await this.hasUsers()) throw new ForbiddenError("An admin already exists");
+    const user = await this.cms.create(USERS, {
+      email: args.email,
+      password: args.password,
+      role: "admin",
+      active: true,
+      ...args.name ? { name: args.name } : {}
+    });
+    const raw = await this.db.findById({ collection: USERS, id: user.id });
+    return this.startSession(raw);
+  }
+  async hasUsers() {
+    return await this.db.count({ collection: USERS }) > 0;
+  }
+  /** Ends the session for a signed token. Unknown tokens are ignored. */
+  async logout(signedToken) {
+    const token = unsignToken(this.config.secret, signedToken);
+    if (!token) return;
+    const session = await this.findSession(token);
+    if (session) await this.db.delete({ collection: SESSIONS, id: session.id });
+  }
+  /** Returns the user for a signed session token, or `null` if it is invalid or expired. */
+  async verify(signedToken) {
+    if (!signedToken) return null;
+    const token = unsignToken(this.config.secret, signedToken);
+    if (!token) return null;
+    const session = await this.findSession(token);
+    if (!session) return null;
+    if (String(session.expiresAt) <= (/* @__PURE__ */ new Date()).toISOString()) {
+      await this.db.delete({ collection: SESSIONS, id: session.id });
+      return null;
+    }
+    const user = await this.db.findById({ collection: USERS, id: session.user });
+    if (!user || user.active === false) return null;
+    return this.toAuthUser(user);
+  }
+  /** The CSRF token clients must echo for a signed session token. */
+  csrfFor(signedToken) {
+    const token = unsignToken(this.config.secret, signedToken);
+    return token ? csrfToken(this.config.secret, token) : void 0;
+  }
+  /** Starts a new session for a user, e.g. after they changed their own password. */
+  async createSession(userId) {
+    const user = await this.db.findById({ collection: USERS, id: userId });
+    if (!user || user.active === false) throw new UnauthorizedError();
+    return this.startSession(user);
+  }
+  /** Signs a user out everywhere. */
+  async revokeSessions(userId) {
+    const sessions = await this.db.find({
+      collection: SESSIONS,
+      where: { user: { equals: userId } },
+      sort: [],
+      limit: 0,
+      page: 1
+    });
+    for (const session of sessions.docs)
+      await this.db.delete({ collection: SESSIONS, id: session.id });
+  }
+  // -------------------------------------------------------------------------
+  async startSession(user) {
+    const token = newToken();
+    const now = /* @__PURE__ */ new Date();
+    const expiresAt = new Date(
+      now.getTime() + this.config.auth.tokenExpiration * 1e3
+    ).toISOString();
+    await this.db.create({
+      collection: SESSIONS,
+      data: {
+        tokenHash: hashToken(token),
+        user: user.id,
+        expiresAt,
+        createdAt: now.toISOString(),
+        updatedAt: now.toISOString()
+      }
+    });
+    return {
+      user: await this.toAuthUser(user),
+      token: signToken(this.config.secret, token),
+      csrfToken: csrfToken(this.config.secret, token),
+      expiresAt
+    };
+  }
+  async findSession(token) {
+    const result = await this.db.find({
+      collection: SESSIONS,
+      where: { tokenHash: { equals: hashToken(token) } },
+      sort: [],
+      limit: 1,
+      page: 1
+    });
+    return result.docs[0];
+  }
+  async toAuthUser(user) {
+    const fields = this.cms.collection(USERS).fields;
+    return await stripFields(fields, user);
+  }
+  async deleteExpiredSessions(userId) {
+    const expired = await this.db.find({
+      collection: SESSIONS,
+      where: { user: { equals: userId }, expiresAt: { lte: (/* @__PURE__ */ new Date()).toISOString() } },
+      sort: [],
+      limit: 0,
+      page: 1
+    });
+    for (const session of expired.docs)
+      await this.db.delete({ collection: SESSIONS, id: session.id });
+  }
+  windowStart() {
+    return new Date(Date.now() - this.config.auth.lockWindow * 1e3).toISOString();
+  }
+  async checkRateLimit(key2) {
+    const recent = await this.db.count({
+      collection: LOGIN_ATTEMPTS,
+      where: { key: { equals: key2 }, createdAt: { gt: this.windowStart() } }
+    });
+    if (recent >= this.config.auth.maxLoginAttempts) {
+      throw new TooManyRequestsError("Too many failed login attempts. Try again later.");
+    }
+  }
+  async recordFailure(key2) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    await this.db.create({
+      collection: LOGIN_ATTEMPTS,
+      data: { key: key2, createdAt: now, updatedAt: now }
+    });
+    const old = await this.db.find({
+      collection: LOGIN_ATTEMPTS,
+      where: { key: { equals: key2 }, createdAt: { lte: this.windowStart() } },
+      sort: [],
+      limit: 0,
+      page: 1
+    });
+    for (const attempt of old.docs)
+      await this.db.delete({ collection: LOGIN_ATTEMPTS, id: attempt.id });
+  }
+  async clearFailures(key2) {
+    const attempts = await this.db.find({
+      collection: LOGIN_ATTEMPTS,
+      where: { key: { equals: key2 } },
+      sort: [],
+      limit: 0,
+      page: 1
+    });
+    for (const attempt of attempts.docs)
+      await this.db.delete({ collection: LOGIN_ATTEMPTS, id: attempt.id });
+  }
+};
+
+// src/config.ts
+function defineConfig(config) {
+  return config;
+}
+
+// src/document.ts
+import { randomUUID } from "crypto";
+var EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+var isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isEmpty = (value) => value === void 0 || value === null || value === "";
+function slugify(text) {
+  return text.normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{M}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "");
+}
+function applyDefaults(fields, data) {
+  const result = { ...data };
+  for (const field of fields) {
+    const value = result[field.name];
+    if (field.type === "group") {
+      result[field.name] = applyDefaults(field.fields, isPlainObject(value) ? value : {});
+    } else if (field.type === "array") {
+      if (Array.isArray(value)) {
+        result[field.name] = value.map(
+          (row) => isPlainObject(row) ? applyDefaults(field.fields, row) : row
+        );
+      }
+    } else if (value === void 0 && field.defaultValue !== void 0) {
+      result[field.name] = structuredClone(field.defaultValue);
+    }
+  }
+  return result;
+}
+function fillMissing(fields, data) {
+  const result = { ...data };
+  for (const field of fields) {
+    const value = result[field.name];
+    if (field.type === "group") {
+      result[field.name] = fillMissing(field.fields, isPlainObject(value) ? value : {});
+    } else if (value === void 0) {
+      result[field.name] = field.type === "array" || isHasMany(field) ? [] : null;
+    }
+  }
+  return result;
+}
+function generateSlugs(fields, data) {
+  const result = { ...data };
+  for (const field of fields) {
+    if (field.type === "slug") {
+      const current = result[field.name];
+      if (typeof current === "string" && current !== "") {
+        result[field.name] = slugify(current);
+      } else if (field.from) {
+        const source = result[field.from];
+        if (typeof source === "string" && source.trim() !== "") result[field.name] = slugify(source);
+      }
+    } else if (field.type === "group" && isPlainObject(result[field.name])) {
+      result[field.name] = generateSlugs(field.fields, result[field.name]);
+    } else if (field.type === "array" && Array.isArray(result[field.name])) {
+      result[field.name] = result[field.name].map(
+        (row) => isPlainObject(row) ? generateSlugs(field.fields, row) : row
+      );
+    }
+  }
+  return result;
+}
+function mergeForUpdate(fields, existing, patch) {
+  const result = {};
+  for (const field of fields) {
+    const has = Object.hasOwn(patch, field.name);
+    const next = patch[field.name];
+    const prev = existing[field.name];
+    if (field.type === "group" && has && isPlainObject(next)) {
+      result[field.name] = mergeForUpdate(field.fields, isPlainObject(prev) ? prev : {}, next);
+    } else {
+      result[field.name] = has ? next : prev;
+    }
+  }
+  return result;
+}
+function parseId(value) {
+  if (typeof value === "number") return Number.isSafeInteger(value) && value > 0 ? value : void 0;
+  if (typeof value === "string" && /^[1-9]\d*$/.test(value)) {
+    const n = Number(value);
+    return Number.isSafeInteger(n) ? n : void 0;
+  }
+  return void 0;
+}
+async function validateFields(fields, input, options, prefix = "") {
+  const data = {};
+  const errors = [];
+  const references = [];
+  for (const field of fields) {
+    const path = prefix + field.name;
+    const raw = input[field.name];
+    const fail = (message) => errors.push({ field: path, message });
+    if (field.type === "group") {
+      if (!isEmpty(raw) && !isPlainObject(raw)) {
+        fail("must be an object");
+        continue;
+      }
+      const sub = await validateFields(
+        field.fields,
+        isPlainObject(raw) ? raw : {},
+        options,
+        `${path}.`
+      );
+      data[field.name] = sub.data;
+      errors.push(...sub.errors);
+      references.push(...sub.references);
+      continue;
+    }
+    if (isEmpty(raw) || Array.isArray(raw) && raw.length === 0) {
+      if (field.required && !options.skipRequired) fail("is required");
+      data[field.name] = field.type === "array" || isHasMany(field) ? [] : null;
+      if (!field.required) await runCustom(field, null, options, fail);
+      continue;
+    }
+    const value = await normalizeValue(field, raw, path, options, fail, errors, references);
+    if (value === void 0) continue;
+    data[field.name] = value;
+    await runCustom(field, value, options, fail);
+  }
+  return { data, errors, references };
+}
+function isHasMany(field) {
+  return (field.type === "select" || field.type === "relationship") && field.hasMany === true;
+}
+async function runCustom(field, value, options, fail) {
+  if (!field.validate) return;
+  const validate = field.validate;
+  const result = await validate(value, { data: options.root, operation: options.operation });
+  if (result !== true) fail(typeof result === "string" ? result : "is invalid");
+}
+async function normalizeValue(field, raw, path, options, fail, errors, references) {
+  switch (field.type) {
+    case "text":
+    case "textarea":
+    case "slug": {
+      if (typeof raw !== "string") return fail("must be a string");
+      if (field.type !== "slug") {
+        if (field.minLength !== void 0 && raw.length < field.minLength)
+          return fail(`must be at least ${field.minLength} characters`);
+        if (field.maxLength !== void 0 && raw.length > field.maxLength)
+          return fail(`must be at most ${field.maxLength} characters`);
+      }
+      return raw;
+    }
+    case "email": {
+      if (typeof raw !== "string" || !EMAIL_PATTERN.test(raw))
+        return fail("must be a valid email address");
+      return raw.trim().toLowerCase();
+    }
+    case "number": {
+      const n = typeof raw === "string" && raw.trim() !== "" ? Number(raw) : raw;
+      if (typeof n !== "number" || !Number.isFinite(n)) return fail("must be a number");
+      if (field.min !== void 0 && n < field.min) return fail(`must be at least ${field.min}`);
+      if (field.max !== void 0 && n > field.max) return fail(`must be at most ${field.max}`);
+      return n;
+    }
+    case "boolean":
+      if (typeof raw !== "boolean") return fail("must be true or false");
+      return raw;
+    case "date": {
+      const date = raw instanceof Date ? raw : typeof raw === "string" ? new Date(raw) : void 0;
+      if (!date || Number.isNaN(date.getTime())) return fail("must be a valid date");
+      return date.toISOString();
+    }
+    case "select":
+      return normalizeSelect(field, raw, fail);
+    case "json":
+      try {
+        return JSON.parse(JSON.stringify(raw));
+      } catch {
+        return fail("must be JSON-serializable");
+      }
+    case "richText":
+      if (!isPlainObject(raw) || raw.type !== "doc")
+        return fail('must be a rich text document ({ type: "doc" })');
+      return raw;
+    case "upload":
+    case "relationship": {
+      const target = field.type === "upload" ? "media" : field.to;
+      const many = field.type === "relationship" && field.hasMany === true;
+      const values = many ? raw : [raw];
+      if (!Array.isArray(values)) return fail("must be an array of ids");
+      const ids = [];
+      for (const item of values) {
+        const id = parseId(isPlainObject(item) ? item.id : item);
+        if (id === void 0)
+          return fail(`must be ${many ? "ids" : "an id"} of "${target}" documents`);
+        ids.push(id);
+        references.push({ field: path, collection: target, id });
+      }
+      return many ? ids : ids[0];
+    }
+    case "array": {
+      if (!Array.isArray(raw)) return fail("must be an array");
+      if (field.minRows !== void 0 && raw.length < field.minRows)
+        return fail(`must have at least ${field.minRows} rows`);
+      if (field.maxRows !== void 0 && raw.length > field.maxRows)
+        return fail(`must have at most ${field.maxRows} rows`);
+      const rows = [];
+      for (const [i, row] of raw.entries()) {
+        if (!isPlainObject(row)) {
+          errors.push({ field: `${path}.${i}`, message: "must be an object" });
+          continue;
+        }
+        const sub = await validateFields(field.fields, row, options, `${path}.${i}.`);
+        errors.push(...sub.errors);
+        references.push(...sub.references);
+        const id = typeof row.id === "string" && row.id !== "" ? row.id : randomUUID();
+        rows.push({ id, ...sub.data });
+      }
+      return rows;
+    }
+    case "group":
+      return raw;
+  }
+}
+function normalizeSelect(field, raw, fail) {
+  const allowed2 = field.options.map((o) => typeof o === "string" ? o : o.value);
+  const values = field.hasMany ? raw : [raw];
+  if (!Array.isArray(values)) return fail("must be an array");
+  for (const v of values) {
+    if (typeof v !== "string" || !allowed2.includes(v))
+      return fail(`must be one of: ${allowed2.join(", ")}`);
+  }
+  return field.hasMany ? [...new Set(values)] : values[0];
+}
+
+// src/fields.ts
+var FIELD_TYPES = [
+  "text",
+  "textarea",
+  "number",
+  "boolean",
+  "date",
+  "email",
+  "json",
+  "select",
+  "slug",
+  "richText",
+  "upload",
+  "relationship",
+  "array",
+  "group"
+];
+
+// src/load-config.ts
+import { existsSync } from "fs";
+import { resolve } from "path";
+import { createJiti } from "jiti";
+
+// src/validate-config.ts
+var MIN_SECRET_LENGTH = 32;
+var BUILTIN_COLLECTIONS = ["users", "media"];
+var RESERVED_SLUGS = /* @__PURE__ */ new Set([
+  "admin",
+  "globals",
+  "sessions",
+  "login-attempts",
+  "migrations",
+  "access"
+]);
+var SYSTEM_FIELD_NAMES = /* @__PURE__ */ new Set(["id", "createdAt", "updatedAt"]);
+var SLUG_PATTERN = /^[a-z][a-z0-9_-]*$/;
+var FIELD_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function validateConfig(config) {
+  const issues = [];
+  const add = (path, message, hint) => issues.push(hint ? { path, message, hint } : { path, message });
+  if (typeof config !== "object" || config === null) {
+    add("config", "must be an object", "export default defineConfig({ ... })");
+    return issues;
+  }
+  validateSecret(config.secret, add);
+  if (!config.db || typeof config.db.name !== "string" || typeof config.db.init !== "function") {
+    add("db", "is required", "pass a database adapter, e.g. db: sqlite({ url: 'file:./cms.db' })");
+  }
+  validateAdmin(config, add);
+  validateUpload(config, add);
+  validateAuth(config, add);
+  const collections = asArray(config.collections, "collections", add);
+  const globals = asArray(config.globals, "globals", add);
+  const collectionSlugs = /* @__PURE__ */ new Set([...BUILTIN_COLLECTIONS]);
+  const seenCollections = /* @__PURE__ */ new Set();
+  collections.forEach((collection2, i) => {
+    const slug = checkSlug(collection2, `collections[${i}]`, seenCollections, add);
+    if (slug) collectionSlugs.add(slug);
+  });
+  const seenGlobals = /* @__PURE__ */ new Set();
+  globals.forEach((global2, i) => {
+    checkSlug(global2, `globals[${i}]`, seenGlobals, add);
+  });
+  collections.forEach((collection2, i) => {
+    const path = `collections.${collection2.slug ?? `[${i}]`}`;
+    validateContainer(collection2, path, collectionSlugs, add);
+    validateUseAsTitle(collection2, path, add);
+  });
+  globals.forEach((global2, i) => {
+    validateContainer(global2, `globals.${global2.slug ?? `[${i}]`}`, collectionSlugs, add);
+  });
+  const plugins = config.plugins;
+  if (plugins !== void 0 && (!Array.isArray(plugins) || plugins.some((p) => typeof p !== "function"))) {
+    add("plugins", "must be an array of functions", "a plugin is (config) => config");
+  }
+  return issues;
+}
+function validateSecret(secret, add) {
+  const hint = `set EASY_CMS_SECRET to a random string of at least ${MIN_SECRET_LENGTH} characters, e.g. \`openssl rand -hex 32\``;
+  if (typeof secret !== "string" || secret.length === 0) {
+    add("secret", "is required", hint);
+  } else if (secret.length < MIN_SECRET_LENGTH) {
+    add("secret", `must be at least ${MIN_SECRET_LENGTH} characters (got ${secret.length})`, hint);
+  }
+}
+function validateAdmin(config, add) {
+  const admin = config.admin;
+  if (admin === void 0) return;
+  if (admin.path !== void 0 && (typeof admin.path !== "string" || !admin.path.startsWith("/"))) {
+    add("admin.path", 'must start with "/"', "e.g. path: '/admin'");
+  }
+  if (admin.locale !== void 0 && admin.locale !== "en" && admin.locale !== "th") {
+    add("admin.locale", `must be "en" or "th" (got ${JSON.stringify(admin.locale)})`);
+  }
+}
+function validateAuth(config, add) {
+  const auth = config.auth;
+  if (auth === void 0) return;
+  if (auth.roles !== void 0) {
+    const roles = auth.roles;
+    if (!Array.isArray(roles) || roles.some((r) => typeof r !== "string" || r === "")) {
+      add("auth.roles", "must be an array of non-empty strings");
+    } else if (!roles.includes("admin")) {
+      add("auth.roles", 'must include "admin"', "e.g. roles: ['admin', 'editor']");
+    }
+  }
+  for (const key2 of ["tokenExpiration", "maxLoginAttempts", "lockWindow"]) {
+    const value = auth[key2];
+    if (value !== void 0 && !(Number.isInteger(value) && value > 0)) {
+      add(`auth.${key2}`, "must be a positive integer");
+    }
+  }
+  if (auth.trustedOrigins !== void 0) {
+    for (const [i, origin] of auth.trustedOrigins.entries()) {
+      if (typeof origin !== "string" || !/^https?:\/\/[^/]+$/.test(origin)) {
+        add(
+          `auth.trustedOrigins[${i}]`,
+          `must be an origin like "https://example.com" (got ${JSON.stringify(origin)})`
+        );
+      }
+    }
+  }
+}
+function validateUpload(config, add) {
+  const upload = config.upload;
+  if (upload === void 0) return;
+  if (upload.maxFileSize !== void 0 && !(Number.isInteger(upload.maxFileSize) && upload.maxFileSize > 0)) {
+    add("upload.maxFileSize", "must be a positive integer (bytes)");
+  }
+  if (upload.dir !== void 0 && (typeof upload.dir !== "string" || upload.dir.length === 0)) {
+    add("upload.dir", "must be a non-empty string");
+  }
+}
+function asArray(value, path, add) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) {
+    add(path, "must be an array");
+    return [];
+  }
+  return value;
+}
+function checkSlug(container, path, seen, add) {
+  const slug = container.slug;
+  if (typeof slug !== "string" || !SLUG_PATTERN.test(slug)) {
+    add(
+      `${path}.slug`,
+      `must be lowercase letters, digits, "-" or "_", starting with a letter (got ${JSON.stringify(slug)})`
+    );
+    return void 0;
+  }
+  if (RESERVED_SLUGS.has(slug)) {
+    add(`${path}.slug`, `"${slug}" is reserved by Easy CMS`, "choose another slug");
+    return void 0;
+  }
+  if (seen.has(slug)) {
+    add(`${path}.slug`, `duplicate slug "${slug}"`);
+    return void 0;
+  }
+  seen.add(slug);
+  return slug;
+}
+function validateContainer(container, path, collectionSlugs, add) {
+  if (!Array.isArray(container.fields)) {
+    add(`${path}.fields`, "must be an array");
+    return;
+  }
+  const reserved = new Set(SYSTEM_FIELD_NAMES);
+  if (container.drafts) reserved.add("status");
+  validateFields2(container.fields, `${path}.fields`, reserved, collectionSlugs, add);
+}
+function validateFields2(fields, path, reserved, collectionSlugs, add) {
+  const names2 = /* @__PURE__ */ new Set();
+  const byName = /* @__PURE__ */ new Map();
+  fields.forEach((field, i) => {
+    const name = field?.name;
+    if (typeof name !== "string" || !FIELD_NAME_PATTERN.test(name)) {
+      add(`${path}[${i}].name`, `must be a valid identifier (got ${JSON.stringify(name)})`);
+      return;
+    }
+    if (reserved.has(name)) {
+      add(`${path}.${name}`, `"${name}" is reserved`, "Easy CMS adds this field automatically");
+    }
+    if (names2.has(name)) add(`${path}.${name}`, `duplicate field name "${name}"`);
+    names2.add(name);
+    byName.set(name, field);
+  });
+  for (const field of fields) {
+    if (typeof field?.name !== "string") continue;
+    const fieldPath = `${path}.${field.name}`;
+    const type = field.type;
+    if (!FIELD_TYPES.includes(type)) {
+      add(
+        `${fieldPath}.type`,
+        `unknown field type ${JSON.stringify(type)}`,
+        `use one of: ${FIELD_TYPES.join(", ")}`
+      );
+      continue;
+    }
+    validateField(field, fieldPath, byName, collectionSlugs, add);
+  }
+}
+function validateField(field, path, siblings, collectionSlugs, add) {
+  switch (field.type) {
+    case "text":
+    case "textarea":
+      checkRange(field.minLength, field.maxLength, "minLength", "maxLength", path, add);
+      break;
+    case "number":
+      checkRange(field.min, field.max, "min", "max", path, add);
+      break;
+    case "select":
+      validateSelect(field.options, field.defaultValue, field.hasMany, path, add);
+      break;
+    case "slug":
+      if (field.from !== void 0) {
+        const source = siblings.get(field.from);
+        if (!source) {
+          add(`${path}.from`, `no sibling field named "${field.from}"`);
+        } else if (source.type !== "text") {
+          add(`${path}.from`, `"${field.from}" must be a text field (got ${source.type})`);
+        }
+      }
+      break;
+    case "relationship":
+      if (typeof field.to !== "string" || !collectionSlugs.has(field.to)) {
+        add(
+          `${path}.to`,
+          `unknown collection ${JSON.stringify(field.to)}`,
+          `use one of: ${[...collectionSlugs].join(", ")}`
+        );
+      }
+      break;
+    case "array":
+    case "group":
+      if (!Array.isArray(field.fields) || field.fields.length === 0) {
+        add(`${path}.fields`, "must contain at least one field");
+        break;
+      }
+      if (field.type === "array")
+        checkRange(field.minRows, field.maxRows, "minRows", "maxRows", path, add);
+      validateFields2(field.fields, `${path}.fields`, /* @__PURE__ */ new Set(["id"]), collectionSlugs, add);
+      break;
+  }
+}
+function checkRange(min, max, minName, maxName, path, add) {
+  if (min !== void 0 && max !== void 0 && min > max) {
+    add(path, `${minName} (${min}) is greater than ${maxName} (${max})`);
+  }
+}
+function validateSelect(options, defaultValue, hasMany, path, add) {
+  if (!Array.isArray(options) || options.length === 0) {
+    add(`${path}.options`, "must contain at least one option");
+    return;
+  }
+  const values = options.map((o) => typeof o === "string" ? o : o.value);
+  const duplicates = values.filter((v, i) => values.indexOf(v) !== i);
+  if (duplicates.length > 0) {
+    add(`${path}.options`, `duplicate option values: ${[...new Set(duplicates)].join(", ")}`);
+  }
+  if (defaultValue === void 0) return;
+  const defaults = typeof defaultValue === "string" ? [defaultValue] : defaultValue;
+  if (typeof defaultValue !== "string" && !hasMany) {
+    add(`${path}.defaultValue`, "must be a single value unless hasMany is true");
+  }
+  for (const value of defaults) {
+    if (!values.includes(value)) {
+      add(`${path}.defaultValue`, `"${value}" is not one of the options`);
+    }
+  }
+}
+function validateUseAsTitle(collection2, path, add) {
+  if (collection2.useAsTitle === void 0 || !Array.isArray(collection2.fields)) return;
+  const field = collection2.fields.find((f) => f.name === collection2.useAsTitle);
+  if (!field) {
+    add(`${path}.useAsTitle`, `no top-level field named "${collection2.useAsTitle}"`);
+  } else if (!["text", "textarea", "email", "slug", "number", "date"].includes(field.type)) {
+    add(
+      `${path}.useAsTitle`,
+      `"${field.name}" is a ${field.type} field and cannot be shown as a title`
+    );
+  }
+}
+
+// src/resolve-config.ts
+var DEFAULT_ADMIN_PATH = "/admin";
+var DEFAULT_API_PATH = "/api/cms";
+var DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
+var DEFAULT_TOKEN_EXPIRATION = 7 * 24 * 60 * 60;
+var resolved = /* @__PURE__ */ new WeakSet();
+async function resolveConfig(input) {
+  if (resolved.has(input)) return input;
+  let config = input;
+  const plugins = Array.isArray(config?.plugins) ? config.plugins : [];
+  for (const plugin of plugins) {
+    if (typeof plugin !== "function") break;
+    config = await plugin(config);
+  }
+  if (typeof config === "object" && config !== null && Array.isArray(config.collections ?? [])) {
+    config = withMedia(withUsers(config));
+  }
+  const issues = validateConfig(config);
+  if (issues.length > 0) throw new ConfigError(issues);
+  const { plugins: _plugins, ...rest } = config;
+  const result = {
+    ...rest,
+    routes: { api: `/${(config.routes?.api ?? DEFAULT_API_PATH).replace(/^\/+|\/+$/g, "")}` },
+    admin: {
+      path: config.admin?.path ?? DEFAULT_ADMIN_PATH,
+      locale: config.admin?.locale ?? "en"
+    },
+    upload: {
+      dir: config.upload?.dir ?? "uploads",
+      maxFileSize: config.upload?.maxFileSize ?? DEFAULT_MAX_FILE_SIZE,
+      mimeTypes: config.upload?.mimeTypes ?? ["image/*", "application/pdf"],
+      imageSizes: config.upload?.imageSizes ?? [],
+      ...config.upload?.storage ? { storage: config.upload.storage } : {}
+    },
+    auth: {
+      roles: config.auth?.roles ?? DEFAULT_ROLES,
+      tokenExpiration: config.auth?.tokenExpiration ?? DEFAULT_TOKEN_EXPIRATION,
+      maxLoginAttempts: config.auth?.maxLoginAttempts ?? 5,
+      lockWindow: config.auth?.lockWindow ?? 15 * 60,
+      trustedOrigins: config.auth?.trustedOrigins ?? []
+    },
+    collections: [...config.collections ?? [], ...internalCollections],
+    globals: config.globals ?? []
+  };
+  resolved.add(result);
+  return result;
+}
+
+// src/load-config.ts
+var CONFIG_FILE_NAMES = [
+  "easy-cms.config.ts",
+  "easy-cms.config.mts",
+  "easy-cms.config.js",
+  "easy-cms.config.mjs"
+];
+function findConfigFile(cwd = process.cwd()) {
+  for (const name of CONFIG_FILE_NAMES) {
+    const path = resolve(cwd, name);
+    if (existsSync(path)) return path;
+  }
+  return void 0;
+}
+async function importConfig(file) {
+  const jiti = createJiti(import.meta.url, { moduleCache: false, interopDefault: false });
+  const mod = await jiti.import(file);
+  return mod.default;
+}
+async function loadConfig(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const file = options.configFile ? resolve(cwd, options.configFile) : findConfigFile(cwd);
+  if (!file || !existsSync(file)) {
+    const looked = options.configFile ?? CONFIG_FILE_NAMES.join(", ");
+    throw new Error(
+      `Easy CMS config not found in ${cwd} (looked for ${looked}).
+    \u2192 run \`npx create-easy-cms\` to create one`
+    );
+  }
+  const jiti = createJiti(import.meta.url, { moduleCache: false, interopDefault: false });
+  const mod = await jiti.import(file);
+  if (!mod.default) {
+    throw new Error(`${file} has no default export.
+    \u2192 export default defineConfig({ ... })`);
+  }
+  return resolveConfig(mod.default);
+}
+
+// src/local-api.ts
+import { randomBytes as randomBytes3 } from "crypto";
+
+// src/logger.ts
+var consoleLogger = {
+  info: (message) => console.info(`[easy-cms] ${message}`),
+  warn: (message) => console.warn(`[easy-cms] ${message}`),
+  error: (message) => console.error(`[easy-cms] ${message}`)
+};
+var silentLogger = { info() {
+}, warn() {
+}, error() {
+} };
+
+// src/media.ts
+var EXTENSIONS = {
+  "image/png": "png",
+  "image/jpeg": "jpg",
+  "image/gif": "gif",
+  "image/webp": "webp",
+  "image/avif": "avif",
+  "image/svg+xml": "svg",
+  "application/pdf": "pdf",
+  "video/mp4": "mp4",
+  "text/plain": "txt"
+};
+var startsWith = (data, bytes, offset = 0) => bytes.every((b, i) => data[offset + i] === b);
+var ascii = (data, start, end) => String.fromCharCode(...data.subarray(start, end));
+function sniffMimeType(data) {
+  if (startsWith(data, [137, 80, 78, 71, 13, 10, 26, 10])) return "image/png";
+  if (startsWith(data, [255, 216, 255])) return "image/jpeg";
+  if (ascii(data, 0, 6) === "GIF87a" || ascii(data, 0, 6) === "GIF89a") return "image/gif";
+  if (ascii(data, 0, 4) === "RIFF" && ascii(data, 8, 12) === "WEBP") return "image/webp";
+  if (ascii(data, 4, 8) === "ftyp") {
+    const brand = ascii(data, 8, 12);
+    if (brand === "avif" || brand === "avis") return "image/avif";
+    if (["isom", "iso2", "mp41", "mp42", "avc1", "M4V "].includes(brand)) return "video/mp4";
+  }
+  if (ascii(data, 0, 5) === "%PDF-") return "application/pdf";
+  const head = data.subarray(0, 4096);
+  if (head.includes(0)) return void 0;
+  let text;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true }).decode(head);
+  } catch {
+    return void 0;
+  }
+  const trimmed = text.replace(/^/, "").trimStart();
+  if (/^(<\?xml[^>]*>\s*)?(<!--[\s\S]*?-->\s*)*(<!DOCTYPE svg[^>]*>\s*)?<svg[\s>]/i.test(trimmed))
+    return "image/svg+xml";
+  return "text/plain";
+}
+function mimeAllowed(type, allowed2) {
+  return allowed2.some(
+    (pattern) => pattern.endsWith("/*") ? type.startsWith(pattern.slice(0, -1)) : pattern === type
+  );
+}
+function imageDimensions(data, type) {
+  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  try {
+    switch (type) {
+      case "image/png":
+        return { width: view.getUint32(16), height: view.getUint32(20) };
+      case "image/gif":
+        return { width: view.getUint16(6, true), height: view.getUint16(8, true) };
+      case "image/webp": {
+        const chunk = ascii(data, 12, 16);
+        if (chunk === "VP8 ")
+          return {
+            width: view.getUint16(26, true) & 16383,
+            height: view.getUint16(28, true) & 16383
+          };
+        if (chunk === "VP8L") {
+          const bits = view.getUint32(21, true);
+          return { width: (bits & 16383) + 1, height: (bits >> 14 & 16383) + 1 };
+        }
+        if (chunk === "VP8X") {
+          const w = view.getUint16(24, true) | view.getUint8(26) << 16;
+          const h = view.getUint16(27, true) | view.getUint8(29) << 16;
+          return { width: w + 1, height: h + 1 };
+        }
+        return void 0;
+      }
+      case "image/jpeg": {
+        let offset = 2;
+        while (offset + 9 < data.length) {
+          if (data[offset] !== 255) return void 0;
+          const marker = data[offset + 1];
+          const length = view.getUint16(offset + 2);
+          if (marker >= 192 && marker <= 207 && ![196, 200, 204].includes(marker)) {
+            return { width: view.getUint16(offset + 7), height: view.getUint16(offset + 5) };
+          }
+          offset += 2 + length;
+        }
+        return void 0;
+      }
+    }
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
+function storageKey(originalName, type, random) {
+  const name = originalName.split(/[\\/]/).pop() ?? "";
+  const base = name.replace(/(?<=.)\.[^.]*$/, "").normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{M}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "file";
+  return `${base}-${random}.${EXTENSIONS[type] ?? "bin"}`;
+}
+
+// src/populate.ts
+var DEFAULT_DEPTH = 1;
+var MAX_DEPTH = 3;
+async function populate(load, collections, fields, docs, depth) {
+  if (depth <= 0 || docs.length === 0) return docs;
+  const bySlug = new Map(collections.map((c) => [c.slug, c]));
+  const copies = docs.map((doc) => structuredClone(doc));
+  const slots = [];
+  for (const doc of copies) collectSlots(fields, doc, bySlug, slots);
+  if (slots.length === 0) return copies;
+  const wanted = /* @__PURE__ */ new Map();
+  for (const slot of slots) {
+    const set = wanted.get(slot.collection) ?? /* @__PURE__ */ new Set();
+    for (const id of slot.ids) set.add(id);
+    wanted.set(slot.collection, set);
+  }
+  const found = /* @__PURE__ */ new Map();
+  await Promise.all(
+    [...wanted].map(async ([slug, ids]) => {
+      const collection2 = bySlug.get(slug);
+      if (!collection2) return;
+      const raw = await load(collection2, [...ids]);
+      const populated = await populate(load, collections, collection2.fields, raw, depth - 1);
+      found.set(slug, new Map(populated.map((d) => [d.id, d])));
+    })
+  );
+  for (const slot of slots) slot.assign(found.get(slot.collection) ?? /* @__PURE__ */ new Map());
+  return copies;
+}
+function collectSlots(fields, data, bySlug, slots) {
+  for (const field of fields) {
+    const value = data[field.name];
+    if (value === null || value === void 0) continue;
+    if (field.type === "group") {
+      if (typeof value === "object") collectSlots(field.fields, value, bySlug, slots);
+    } else if (field.type === "array") {
+      if (Array.isArray(value))
+        for (const row of value) collectSlots(field.fields, row, bySlug, slots);
+    } else if (field.type === "relationship" || field.type === "upload") {
+      const collection2 = field.type === "upload" ? "media" : field.to;
+      if (!bySlug.has(collection2)) continue;
+      if (Array.isArray(value)) {
+        const ids = value;
+        slots.push({
+          collection: collection2,
+          ids,
+          assign: (byId) => {
+            data[field.name] = ids.map((id) => byId.get(id)).filter((d) => d !== void 0);
+          }
+        });
+      } else {
+        const id = value;
+        slots.push({
+          collection: collection2,
+          ids: [id],
+          assign: (byId) => {
+            data[field.name] = byId.get(id) ?? null;
+          }
+        });
+      }
+    }
+  }
+}
+
+// src/storage.ts
+import { mkdir, readFile, rm, stat, writeFile } from "fs/promises";
+import { dirname, isAbsolute, join, normalize, resolve as resolve2, sep } from "path";
+function localStorage(options = {}) {
+  let root = resolve2(options.dir ?? "uploads");
+  const pathOf = (key2) => {
+    const path = normalize(join(root, key2));
+    if (!path.startsWith(root + sep)) throw new Error(`Invalid storage key "${key2}"`);
+    return path;
+  };
+  return {
+    name: "local",
+    init({ cwd }) {
+      const dir = options.dir ?? "uploads";
+      root = isAbsolute(dir) ? dir : resolve2(cwd, dir);
+    },
+    async put(key2, data) {
+      const path = pathOf(key2);
+      await mkdir(dirname(path), { recursive: true });
+      await writeFile(path, data, { flag: "wx" });
+    },
+    async get(key2) {
+      const path = pathOf(key2);
+      const info = await stat(path).catch(() => void 0);
+      if (!info?.isFile()) return null;
+      return { body: new Uint8Array(await readFile(path)), size: info.size };
+    },
+    async delete(key2) {
+      await rm(pathOf(key2), { force: true });
+    }
+  };
+}
+
+// src/local-api.ts
+async function createEasyCMS(config, options = {}) {
+  const resolved2 = await resolveConfig(config);
+  const logger = options.logger ?? consoleLogger;
+  const cwd = options.cwd ?? process.cwd();
+  const storage = resolved2.upload.storage ?? localStorage({ dir: resolved2.upload.dir });
+  await storage.init?.({ cwd });
+  const db = await resolved2.db.init({
+    config: resolved2,
+    cwd,
+    schema: options.schema ?? (process.env.NODE_ENV === "production" ? "verify" : "push"),
+    logger,
+    interactive: options.interactive ?? false
+  });
+  return new EasyCMS(resolved2, db, logger, storage);
+}
+var EasyCMS = class {
+  config;
+  db;
+  logger;
+  /** Login, logout and session checks. */
+  auth;
+  /** Where uploaded files are stored. */
+  storage;
+  constructor(config, db, logger = consoleLogger, storage = localStorage({ dir: config.upload.dir })) {
+    this.config = config;
+    this.db = db;
+    this.logger = logger;
+    this.storage = storage;
+    this.auth = new Auth(this);
+  }
+  async find(collection2, options = {}) {
+    const config = this.collection(collection2);
+    const guard = guardOf(options);
+    const limit = options.limit ?? 10;
+    const page = options.page ?? 1;
+    if (!Number.isInteger(limit) || limit < 0)
+      throw new QueryError("limit must be a non-negative integer");
+    if (!Number.isInteger(page) || page < 1) throw new QueryError("page must be a positive integer");
+    const where = draftWhere(
+      config,
+      options.draft,
+      await this.readWhere(config, guard, options.where)
+    );
+    const sort = options.sort === void 0 ? ["-createdAt"] : [options.sort].flat();
+    const result = await this.db.find({ collection: collection2, where, sort, limit, page });
+    const docs = await this.output(config, result.docs, guard, options);
+    return { ...result, docs };
+  }
+  async findById(collection2, id, options = {}) {
+    const config = this.collection(collection2);
+    const guard = guardOf(options);
+    const parsed = parseId(id);
+    if (parsed === void 0) return null;
+    const where = draftWhere(config, options.draft, await this.readWhere(config, guard, void 0));
+    const doc = where ? (await this.db.find({
+      collection: collection2,
+      where: andWhere(where, { id: { equals: parsed } }),
+      sort: [],
+      limit: 1,
+      page: 1
+    })).docs[0] : await this.db.findById({ collection: collection2, id: parsed });
+    if (!doc) return null;
+    const [out] = await this.output(config, [doc], guard, options);
+    return out ?? null;
+  }
+  async count(collection2, options = {}) {
+    const config = this.collection(collection2);
+    const where = draftWhere(
+      config,
+      options.draft,
+      await this.readWhere(config, guardOf(options), options.where)
+    );
+    return this.db.count({ collection: collection2, where });
+  }
+  async create(collection2, data, options = {}) {
+    const config = this.collection(collection2);
+    if (config.slug === MEDIA) {
+      throw new ValidationError(MEDIA, [
+        { field: "file", message: "upload files with cms.upload() or POST multipart" }
+      ]);
+    }
+    return await this.createDocument(config, asObject(data, collection2), options);
+  }
+  /**
+   * Stores a file and creates its `media` document (FR-UPL). The type is detected from
+   * the contents; images get width/height, and resized copies when `sharp` is installed.
+   */
+  async upload(file, data = {}, options = {}) {
+    const config = this.collection(MEDIA);
+    const guard = guardOf(options);
+    if (guard.enforce) {
+      const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data });
+      if (allowed2 !== true) throw deny(guard.user);
+    }
+    const { maxFileSize, mimeTypes, imageSizes } = this.config.upload;
+    if (file.data.byteLength > maxFileSize) {
+      throw new PayloadTooLargeError(`File is larger than ${maxFileSize} bytes`);
+    }
+    if (file.data.byteLength === 0)
+      throw new ValidationError(MEDIA, [{ field: "file", message: "is empty" }]);
+    const mimeType = sniffMimeType(file.data);
+    if (!mimeType || !mimeAllowed(mimeType, mimeTypes)) {
+      throw new ValidationError(MEDIA, [
+        {
+          field: "file",
+          message: `file type ${mimeType ?? "unknown"} is not allowed (allowed: ${mimeTypes.join(", ")})`
+        }
+      ]);
+    }
+    const random = randomBytes3(4).toString("hex");
+    const filename = storageKey(file.name, mimeType, random);
+    const stored = [];
+    try {
+      await this.storage.put(filename, file.data, { contentType: mimeType });
+      stored.push(filename);
+      const dimensions = imageDimensions(file.data, mimeType);
+      const sizes = await this.resizeImage(file.data, mimeType, filename, imageSizes, stored);
+      const doc = await this.createDocument(
+        config,
+        {
+          ...data,
+          filename,
+          originalName: file.name.slice(0, 255),
+          mimeType,
+          filesize: file.data.byteLength,
+          width: dimensions?.width ?? null,
+          height: dimensions?.height ?? null,
+          sizes
+        },
+        // System fields are set here, not by the caller: skip field-level update access for them.
+        { ...options, overrideAccess: true },
+        guard
+      );
+      return doc;
+    } catch (error) {
+      for (const key2 of stored) await this.storage.delete(key2).catch(() => {
+      });
+      throw error;
+    }
+  }
+  /** Public URL of a stored file. */
+  mediaURL(key2) {
+    const custom = this.storage.url?.(key2);
+    if (custom) return custom;
+    return `${this.config.serverURL?.replace(/\/+$/, "") ?? ""}${this.config.routes.api}/media/file/${encodeURIComponent(key2)}`;
+  }
+  async update(collection2, id, data, options = {}) {
+    const config = this.collection(collection2);
+    const guard = guardOf(options);
+    const raw = asObject(data, collection2);
+    const parsed = parseId(id);
+    const existing = parsed === void 0 ? null : await this.db.findById({ collection: collection2, id: parsed });
+    if (!existing || parsed === void 0) throw new NotFoundError(collection2, id);
+    await this.checkDocumentAccess(config, "update", guard, parsed, raw);
+    const { input, password } = splitPassword(config, raw);
+    const filtered = await filterInput(
+      config.fields,
+      input,
+      this.fieldChecker("update", guard, parsed, input)
+    );
+    let merged = mergeForUpdate(config.fields, existing, filtered);
+    if (config.drafts)
+      merged.status = Object.hasOwn(filtered, "status") ? filtered.status : existing.status;
+    const base = this.hookArgs(config, guard);
+    merged = await this.transform(
+      config.hooks?.beforeValidate,
+      "data",
+      { ...base, operation: "update", originalDoc: existing },
+      merged
+    );
+    let prepared = await this.prepare(
+      config,
+      generateSlugs(config.fields, merged),
+      "update",
+      parsed
+    );
+    prepared = await this.transform(
+      config.hooks?.beforeChange,
+      "data",
+      { ...base, operation: "update", originalDoc: existing },
+      prepared
+    );
+    if (config.slug === USERS) await this.guardLastAdmin(parsed, existing, prepared);
+    if (password !== void 0) prepared.passwordHash = await hashPassword(password);
+    const doc = await this.db.update({
+      collection: collection2,
+      id: parsed,
+      data: { ...prepared, createdAt: existing.createdAt, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }
+    });
+    if (password !== void 0) await this.auth.revokeSessions(parsed);
+    await this.notify(config.hooks?.afterChange, "afterChange", config.slug, {
+      ...base,
+      doc,
+      previousDoc: existing,
+      operation: "update"
+    });
+    const [out] = await this.output(config, [doc], guard, { ...options, draft: true });
+    return out;
+  }
+  async delete(collection2, id, options = {}) {
+    const config = this.collection(collection2);
+    const guard = guardOf(options);
+    const parsed = parseId(id);
+    const existing = parsed === void 0 ? null : await this.db.findById({ collection: collection2, id: parsed });
+    if (!existing || parsed === void 0) throw new NotFoundError(collection2, id);
+    await this.checkDocumentAccess(config, "delete", guard, parsed, void 0);
+    if (config.slug === USERS)
+      await this.guardLastAdmin(parsed, existing, { ...existing, active: false });
+    const base = this.hookArgs(config, guard);
+    for (const hook of config.hooks?.beforeDelete ?? []) await hook({ ...base, id: parsed });
+    if (config.slug === USERS) await this.auth.revokeSessions(parsed);
+    await this.db.delete({ collection: collection2, id: parsed });
+    await this.notify(config.hooks?.afterDelete, "afterDelete", config.slug, {
+      ...base,
+      id: parsed,
+      doc: existing
+    });
+    const [out] = await this.output(config, [existing], guard, { depth: 0, draft: true });
+    return out;
+  }
+  async findGlobal(slug, options = {}) {
+    const config = this.global(slug);
+    const guard = guardOf(options);
+    await this.checkGlobalAccess(config, "read", guard);
+    const stored = await this.db.findGlobal({ slug });
+    const data = fillMissing(config.fields, applyDefaults(config.fields, stored ?? {}));
+    if (!stored) {
+      data.updatedAt = null;
+      if (config.drafts) data.status = "draft";
+    }
+    const [out] = await this.output(config, [{ ...data, id: 0 }], guard, options);
+    const { id: _id, ...doc } = out;
+    return doc;
+  }
+  async updateGlobal(slug, data, options = {}) {
+    const config = this.global(slug);
+    const guard = guardOf(options);
+    await this.checkGlobalAccess(config, "update", guard);
+    const raw = asObject(data, slug);
+    const input = await filterInput(
+      config.fields,
+      raw,
+      this.fieldChecker("update", guard, void 0, raw)
+    );
+    const existing = await this.db.findGlobal({ slug }) ?? {};
+    const merged = generateSlugs(
+      config.fields,
+      applyDefaults(config.fields, mergeForUpdate(config.fields, existing, input))
+    );
+    if (config.drafts) merged.status = input.status ?? existing.status ?? "draft";
+    const base = this.hookArgs(config, guard);
+    let prepared = await this.prepare(config, merged, "update", void 0);
+    prepared = await this.transform(
+      config.hooks?.beforeChange,
+      "data",
+      { ...base, operation: "update", originalDoc: existing },
+      prepared
+    );
+    const doc = await this.db.updateGlobal({
+      slug,
+      data: { ...prepared, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }
+    });
+    await this.notify(config.hooks?.afterChange, "afterChange", slug, {
+      ...base,
+      doc,
+      previousDoc: existing,
+      operation: "update"
+    });
+    return this.findGlobal(slug, { ...options, draft: true });
+  }
+  /**
+   * What `user` may do with one document. Resolves `where`-style access
+   * against the document, so the admin UI can hide actions precisely.
+   */
+  async documentPermissions(collection2, id, user) {
+    const config = this.collection(collection2);
+    const parsed = parseId(id);
+    if (parsed === void 0) return { update: false, delete: false };
+    const guard = { enforce: true, user };
+    const check = (operation) => this.checkDocumentAccess(config, operation, guard, parsed, void 0).then(
+      () => true,
+      (error) => {
+        if (error instanceof ForbiddenError || error instanceof UnauthorizedError) return false;
+        throw error;
+      }
+    );
+    return { update: await check("update"), delete: await check("delete") };
+  }
+  /** Closes the database connection. */
+  async destroy() {
+    await this.db.destroy();
+  }
+  // -------------------------------------------------------------------------
+  /** @internal */
+  collection(slug) {
+    const config = this.config.collections.find((c) => c.slug === slug);
+    if (!config) throw new QueryError(`Unknown collection "${slug}"`);
+    return config;
+  }
+  global(slug) {
+    const config = this.config.globals.find((g) => g.slug === slug);
+    if (!config) throw new QueryError(`Unknown global "${slug}"`);
+    return config;
+  }
+  /** The query constraint read access adds, or `undefined` when there is none. Throws when denied. */
+  async readWhere(config, guard, where) {
+    if (!guard.enforce) return where;
+    const access = await evaluateAccess(config.access?.read, { user: guard.user });
+    if (access === false) throw deny(guard.user);
+    return andWhere(where, access);
+  }
+  async checkDocumentAccess(config, operation, guard, id, data) {
+    if (!guard.enforce) return;
+    const access = await evaluateAccess(config.access?.[operation], {
+      user: guard.user,
+      id,
+      ...data ? { data } : {}
+    });
+    if (access === true) return;
+    if (access !== false) {
+      const matches = await this.db.count({
+        collection: config.slug,
+        where: andWhere(access, { id: { equals: id } })
+      });
+      if (matches > 0) return;
+    }
+    throw deny(guard.user);
+  }
+  async checkGlobalAccess(config, operation, guard) {
+    if (!guard.enforce) return;
+    const access = await evaluateAccess(config.access?.[operation], { user: guard.user });
+    if (typeof access === "object")
+      throw new QueryError(`${operation} access of global "${config.slug}" must return a boolean`);
+    if (!access) throw deny(guard.user);
+  }
+  fieldChecker(kind, guard, id, data) {
+    if (!guard.enforce) return void 0;
+    return new FieldAccessChecker(kind, {
+      user: guard.user,
+      ...id !== void 0 ? { id } : {},
+      ...data ? { data } : {}
+    });
+  }
+  /** Runs afterRead hooks, populates relationships and removes what the caller may not see. */
+  async output(config, docs, guard, options) {
+    const read = this.fieldChecker("read", guard, void 0, void 0);
+    const finish = async (target, doc) => {
+      const hooked = await this.transform(
+        target.hooks?.afterRead,
+        "doc",
+        this.hookArgs(target, guard),
+        doc
+      );
+      return await stripFields(target.fields, hooked, read);
+    };
+    const load = async (target, ids) => {
+      const where = await this.readWhere(target, guard, { id: { in: [...ids] } }).catch((error) => {
+        if (error instanceof ForbiddenError || error instanceof UnauthorizedError) return null;
+        throw error;
+      });
+      if (where === null) return [];
+      const found = await this.db.find({
+        collection: target.slug,
+        where: draftWhere(target, options.draft, where),
+        sort: [],
+        limit: 0,
+        page: 1
+      });
+      return Promise.all(found.docs.map((d) => finish(target, d)));
+    };
+    const depth = Math.max(0, Math.min(MAX_DEPTH, Math.trunc(options.depth ?? DEFAULT_DEPTH)));
+    const populated = await populate(load, this.config.collections, config.fields, docs, depth);
+    return Promise.all(populated.map((d) => finish(config, d)));
+  }
+  /** Creates a document: access, input filtering, hooks, validation, then afterChange. */
+  async createDocument(config, raw, options, hookGuard) {
+    const guard = guardOf(options);
+    const collection2 = config.slug;
+    if (guard.enforce) {
+      const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data: raw });
+      if (typeof allowed2 === "object")
+        throw new QueryError(`create access of "${collection2}" must return a boolean`);
+      if (!allowed2) throw deny(guard.user);
+    }
+    const { input, password } = splitPassword(config, raw);
+    if (config.slug === USERS && password === void 0) {
+      throw new ValidationError(collection2, [{ field: "password", message: "is required" }]);
+    }
+    const filtered = await filterInput(
+      config.fields,
+      input,
+      this.fieldChecker("update", guard, void 0, input)
+    );
+    const base = this.hookArgs(config, hookGuard ?? guard);
+    let data = applyDefaults(config.fields, filtered);
+    data = await this.transform(
+      config.hooks?.beforeValidate,
+      "data",
+      { ...base, operation: "create" },
+      data
+    );
+    let prepared = await this.prepare(
+      config,
+      generateSlugs(config.fields, data),
+      "create",
+      void 0
+    );
+    prepared = await this.transform(
+      config.hooks?.beforeChange,
+      "data",
+      { ...base, operation: "create" },
+      prepared
+    );
+    if (password !== void 0) prepared.passwordHash = await hashPassword(password);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const doc = await this.db.create({
+      collection: collection2,
+      data: { ...prepared, createdAt: now, updatedAt: now }
+    });
+    await this.notify(config.hooks?.afterChange, "afterChange", collection2, {
+      ...base,
+      doc,
+      operation: "create"
+    });
+    const [out] = await this.output(config, [doc], hookGuard ?? guard, { ...options, draft: true });
+    return out;
+  }
+  hookArgs(config, guard) {
+    return { user: guard.user, cms: this, slug: config.slug };
+  }
+  /**
+   * Runs hooks that may replace a value, passed as `data` (before hooks) or `doc` (afterRead).
+   * Returning `undefined` keeps the value; a throw cancels the operation.
+   */
+  async transform(hooks, key2, args, value) {
+    let current = value;
+    for (const hook of hooks ?? []) {
+      const result = await hook({
+        ...args,
+        [key2]: current
+      });
+      if (result !== void 0 && result !== null && typeof result === "object")
+        current = result;
+    }
+    return current;
+  }
+  /** Runs hooks after the change is saved: failures are logged, never undo the save (NFR-REL-03). */
+  async notify(hooks, name, slug, args) {
+    for (const hook of hooks ?? []) {
+      try {
+        await hook(args);
+      } catch (error) {
+        this.logger.error(
+          `${name} hook of "${slug}" failed: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  }
+  /** Writes resized copies with sharp, when installed and configured. */
+  async resizeImage(data, mimeType, filename, sizes, stored) {
+    if (sizes.length === 0 || !["image/png", "image/jpeg", "image/webp", "image/avif"].includes(mimeType))
+      return {};
+    const sharp = await loadSharp();
+    if (!sharp) {
+      this.logger.warn(
+        "upload.imageSizes is set but sharp is not installed; skipping resized copies"
+      );
+      return {};
+    }
+    const result = {};
+    for (const size of sizes) {
+      const { data: out, info } = await sharp(data).rotate().resize({
+        width: size.width,
+        ...size.height ? { height: size.height } : {},
+        fit: size.fit ?? "cover",
+        withoutEnlargement: true
+      }).toBuffer({ resolveWithObject: true });
+      const key2 = filename.replace(/\.([^.]+)$/, `-${size.name}.$1`);
+      await this.storage.put(key2, new Uint8Array(out), { contentType: mimeType });
+      stored.push(key2);
+      result[size.name] = {
+        filename: key2,
+        width: info.width,
+        height: info.height,
+        filesize: out.byteLength
+      };
+    }
+    return result;
+  }
+  /** Validates, checks uniqueness and references. Returns clean data or throws `ValidationError`. */
+  async prepare(config, data, operation, selfId) {
+    const isDraft = config.drafts === true && (data.status ?? "draft") === "draft";
+    const result = await validateFields(config.fields, data, {
+      operation,
+      root: data,
+      skipRequired: isDraft
+    });
+    const errors = [...result.errors];
+    const clean = { ...result.data };
+    if (config.drafts) {
+      const status = data.status ?? "draft";
+      if (status !== "draft" && status !== "published") {
+        errors.push({ field: "status", message: 'must be "draft" or "published"' });
+      }
+      clean.status = status;
+    }
+    const isCollection = this.config.collections.includes(config);
+    if (isCollection && errors.length === 0) {
+      await this.makeSlugsUnique(config, clean, selfId);
+      errors.push(...await this.checkUnique(config, clean, selfId));
+    }
+    errors.push(...await this.checkReferences(result.references));
+    if (errors.length > 0) throw new ValidationError(config.slug, errors);
+    return clean;
+  }
+  /** Refuses changes that would leave no active admin (and lock everyone out). */
+  async guardLastAdmin(id, before, after) {
+    const wasAdmin = before.role === "admin" && before.active !== false;
+    const staysAdmin = after.role === "admin" && after.active !== false;
+    if (!wasAdmin || staysAdmin) return;
+    const others = await this.db.count({
+      collection: USERS,
+      where: {
+        and: [
+          { role: { equals: "admin" } },
+          { active: { not_equals: false } },
+          { id: { not_equals: id } }
+        ]
+      }
+    });
+    if (others === 0) {
+      throw new ValidationError(USERS, [
+        { field: "role", message: "cannot remove the last active admin" }
+      ]);
+    }
+  }
+  async makeSlugsUnique(config, data, selfId) {
+    for (const field of config.fields) {
+      const base = data[field.name];
+      if (field.type !== "slug" || typeof base !== "string" || base === "") continue;
+      let candidate = base;
+      for (let n = 2; await this.isTaken(config.slug, field.name, candidate, selfId); n++) {
+        candidate = `${base}-${n}`;
+      }
+      data[field.name] = candidate;
+    }
+  }
+  async checkUnique(config, data, selfId) {
+    const errors = [];
+    for (const field of config.fields) {
+      const value = data[field.name];
+      if (!field.unique || field.type === "slug" || value === null || value === void 0) continue;
+      if (await this.isTaken(config.slug, field.name, value, selfId)) {
+        errors.push({ field: field.name, message: "must be unique" });
+      }
+    }
+    return errors;
+  }
+  async isTaken(collection2, field, value, selfId) {
+    const where = selfId === void 0 ? { [field]: { equals: value } } : { and: [{ [field]: { equals: value } }, { id: { not_equals: selfId } }] };
+    return await this.db.count({ collection: collection2, where }) > 0;
+  }
+  async checkReferences(references) {
+    const byCollection = /* @__PURE__ */ new Map();
+    for (const ref of references) {
+      if (!this.config.collections.some((c) => c.slug === ref.collection)) continue;
+      byCollection.set(ref.collection, [...byCollection.get(ref.collection) ?? [], ref]);
+    }
+    const errors = [];
+    for (const [collection2, refs] of byCollection) {
+      const found = await this.db.findByIds({
+        collection: collection2,
+        ids: [...new Set(refs.map((r) => r.id))]
+      });
+      const ids = new Set(found.map((d) => d.id));
+      for (const ref of refs) {
+        if (!ids.has(ref.id)) {
+          errors.push({ field: ref.field, message: `${collection2} ${ref.id} does not exist` });
+        }
+      }
+    }
+    return errors;
+  }
+};
+function draftWhere(config, draft, where) {
+  if (!config.drafts || draft) return where;
+  return andWhere(where, { status: { equals: "published" } });
+}
+var sharpModule;
+function loadSharp() {
+  sharpModule ??= import("sharp").then(
+    (mod) => mod.default,
+    () => void 0
+  );
+  return sharpModule;
+}
+function guardOf(options) {
+  return { enforce: options.overrideAccess === false, user: options.user ?? null };
+}
+function deny(user) {
+  return user ? new ForbiddenError() : new UnauthorizedError();
+}
+function splitPassword(config, raw) {
+  if (config.slug !== USERS || !Object.hasOwn(raw, "password")) return { input: raw };
+  const { password, ...input } = raw;
+  if (password === void 0 || password === null || password === "") return { input };
+  if (typeof password !== "string" || password.length < MIN_PASSWORD_LENGTH) {
+    throw new ValidationError(USERS, [
+      { field: "password", message: `must be at least ${MIN_PASSWORD_LENGTH} characters` }
+    ]);
+  }
+  return { input, password };
+}
+function asObject(data, name) {
+  if (typeof data !== "object" || data === null || Array.isArray(data)) {
+    throw new ValidationError(name, [{ field: "", message: "data must be an object" }]);
+  }
+  return data;
+}
+
+// src/rest/admin-schema.ts
+async function allowed(access, user) {
+  return await evaluateAccess(access, { user }) !== false;
+}
+async function serializeFields(fields, update) {
+  const out = [];
+  for (const field of fields) {
+    if (field.hidden) continue;
+    const f = { name: field.name, type: field.type };
+    if (field.label !== void 0) f.label = field.label;
+    if (field.required) f.required = true;
+    if (field.unique) f.unique = true;
+    if (field.defaultValue !== void 0) f.defaultValue = field.defaultValue;
+    if (!await update.allows(field)) f.readOnly = true;
+    switch (field.type) {
+      case "text":
+      case "textarea":
+        if (field.minLength !== void 0) f.minLength = field.minLength;
+        if (field.maxLength !== void 0) f.maxLength = field.maxLength;
+        break;
+      case "number":
+        if (field.min !== void 0) f.min = field.min;
+        if (field.max !== void 0) f.max = field.max;
+        break;
+      case "select":
+        f.options = field.options.map(
+          (o) => typeof o === "string" ? { label: o, value: o } : { label: o.label, value: o.value }
+        );
+        if (field.hasMany) f.hasMany = true;
+        break;
+      case "slug":
+        if (field.from) f.from = field.from;
+        break;
+      case "relationship":
+        f.to = field.to;
+        if (field.hasMany) f.hasMany = true;
+        break;
+      case "upload":
+        f.to = "media";
+        break;
+      case "array":
+        if (field.minRows !== void 0) f.minRows = field.minRows;
+        if (field.maxRows !== void 0) f.maxRows = field.maxRows;
+        f.fields = await serializeFields(field.fields, update);
+        break;
+      case "group":
+        f.fields = await serializeFields(field.fields, update);
+        break;
+    }
+    out.push(f);
+  }
+  return out;
+}
+async function collection(config, user) {
+  const result = {
+    slug: config.slug,
+    drafts: config.drafts === true,
+    fields: await serializeFields(config.fields, new FieldAccessChecker("update", { user })),
+    permissions: {
+      read: await allowed(config.access?.read, user),
+      create: await allowed(config.access?.create, user),
+      update: await allowed(config.access?.update, user),
+      delete: await allowed(config.access?.delete, user)
+    }
+  };
+  if (config.labels) result.labels = config.labels;
+  if (config.useAsTitle) result.useAsTitle = config.useAsTitle;
+  return result;
+}
+async function global(config, user) {
+  const result = {
+    slug: config.slug,
+    drafts: config.drafts === true,
+    fields: await serializeFields(config.fields, new FieldAccessChecker("update", { user })),
+    permissions: {
+      read: await allowed(config.access?.read, user),
+      update: await allowed(config.access?.update, user)
+    }
+  };
+  if (config.label !== void 0) result.label = config.label;
+  return result;
+}
+async function adminSchema(cms, user) {
+  const collections = cms.config.collections.filter((c) => !INTERNAL_COLLECTIONS.has(c.slug));
+  return {
+    locale: cms.config.admin.locale,
+    collections: await Promise.all(collections.map((c) => collection(c, user))),
+    globals: await Promise.all(cms.config.globals.map((g) => global(g, user)))
+  };
+}
+
+// src/rest/query.ts
+var MAX_DEPTH2 = 10;
+var MAX_INDEX = 100;
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function tokens(key2) {
+  const match = /^([^[\]]+)((?:\[[^[\]]*\])*)$/.exec(key2);
+  if (!match) throw new QueryError(`Malformed query parameter "${key2}"`);
+  const rest = [...(match[2] ?? "").matchAll(/\[([^[\]]*)\]/g)].map((m) => m[1]);
+  return [match[1], ...rest];
+}
+function arrays(node) {
+  if (typeof node === "string") return node;
+  const keys = Object.keys(node);
+  const out = {};
+  for (const key2 of keys) out[key2] = arrays(node[key2]);
+  if (keys.length > 0 && keys.every((k, i) => k === String(i))) return keys.map((k) => out[k]);
+  return out;
+}
+function parseNested(params) {
+  const root = {};
+  for (const [key2, value] of params) {
+    const path = tokens(key2);
+    if (path.length > MAX_DEPTH2)
+      throw new QueryError(`Query parameter "${key2}" is nested too deeply`);
+    let node = root;
+    path.forEach((token, i) => {
+      if (FORBIDDEN_KEYS.has(token)) throw new QueryError(`Query parameter "${key2}" is not allowed`);
+      if (/^\d+$/.test(token) && Number(token) > MAX_INDEX)
+        throw new QueryError(`Index too large in "${key2}"`);
+      if (i === path.length - 1) {
+        node[token] = value;
+      } else {
+        const next = node[token];
+        if (typeof next === "string") throw new QueryError(`Conflicting query parameter "${key2}"`);
+        node[token] = next ?? {};
+        node = node[token];
+      }
+    });
+  }
+  return arrays(root);
+}
+function normalizeWhere(value) {
+  if (Array.isArray(value)) return value.map(normalizeWhere);
+  if (typeof value !== "object" || value === null) return value;
+  const out = {};
+  for (const [key2, inner] of Object.entries(value)) {
+    if (key2 === "exists" && typeof inner === "string") out[key2] = inner !== "false";
+    else if ((key2 === "in" || key2 === "not_in") && typeof inner === "string")
+      out[key2] = inner === "" ? [] : inner.split(",");
+    else if ((key2 === "equals" || key2 === "not_equals") && inner === "null") out[key2] = null;
+    else out[key2] = normalizeWhere(inner);
+  }
+  return out;
+}
+var MAX_REST_LIMIT = 100;
+function integer(name, raw, min, max) {
+  if (raw === void 0) return void 0;
+  const n = Number(raw);
+  if (typeof raw !== "string" || !Number.isInteger(n) || n < min || n > max) {
+    throw new QueryError(`${name} must be an integer from ${min} to ${max}`);
+  }
+  return n;
+}
+function parseListQuery(url) {
+  const params = parseNested(url.searchParams);
+  let where = params.where;
+  if (typeof where === "string") {
+    try {
+      where = JSON.parse(where);
+    } catch {
+      throw new QueryError("where must be JSON or bracket parameters");
+    }
+  }
+  if (where !== void 0 && (typeof where !== "object" || where === null || Array.isArray(where))) {
+    throw new QueryError("where must be an object");
+  }
+  const sort = typeof params.sort === "string" ? params.sort.split(",").filter(Boolean) : void 0;
+  const query = {
+    limit: integer("limit", params.limit, 1, MAX_REST_LIMIT) ?? 10,
+    page: integer("page", params.page, 1, Number.MAX_SAFE_INTEGER) ?? 1
+  };
+  if (where !== void 0) query.where = normalizeWhere(where);
+  if (sort) query.sort = sort;
+  const depth = integer("depth", params.depth, 0, 3);
+  if (depth !== void 0) query.depth = depth;
+  return query;
+}
+function parseDepth(url) {
+  const depth = integer("depth", url.searchParams.get("depth") ?? void 0, 0, 3);
+  return depth === void 0 ? {} : { depth };
+}
+
+// src/rest/handler.ts
+var SESSION_COOKIE = "ecms-session";
+var CSRF_COOKIE = "ecms-csrf";
+var CSRF_HEADER = "x-csrf-token";
+var MAX_BODY_BYTES = 1024 * 1024;
+var HttpError = class extends EasyCMSError {
+};
+function createRestHandler(instance, options = {}) {
+  const cms = instance;
+  const basePath = (options.basePath ?? cms.config.routes.api).replace(/\/+$/, "");
+  const production = process.env.NODE_ENV === "production";
+  return async (request) => {
+    const headers = new Headers({
+      "content-type": "application/json; charset=utf-8",
+      "cache-control": "no-store",
+      "x-content-type-options": "nosniff"
+    });
+    try {
+      const url = new URL(request.url);
+      if (url.pathname !== basePath && !url.pathname.startsWith(`${basePath}/`)) {
+        throw new HttpError("Not found", 404);
+      }
+      const segments = url.pathname.slice(basePath.length).split("/").filter(Boolean).map((s) => decodeURIComponent(s));
+      const { token, via } = readToken(request);
+      const user = token ? await cms.auth.verify(token) : null;
+      const ctx = { request, url, user, via: user ? via : null, token, headers };
+      const method = request.method.toUpperCase();
+      if (method !== "GET" && method !== "HEAD" && method !== "OPTIONS") checkCsrf(cms, ctx);
+      const result = await route(cms, ctx, method, segments, options);
+      if (result.body instanceof Response) return result.body;
+      return new Response(JSON.stringify(result.body), { status: result.status ?? 200, headers });
+    } catch (error) {
+      return errorResponse(cms, error, headers, production);
+    }
+  };
+}
+async function route(cms, ctx, method, segments, options) {
+  const [first, second, third] = segments;
+  const access = { overrideAccess: false, user: ctx.user };
+  const draft = ctx.user !== null && ctx.url.searchParams.get("draft") === "true";
+  if (segments.length === 0) throw new HttpError("Not found", 404);
+  if (first === USERS && second !== void 0 && third === void 0 && !/^\d+$/.test(second)) {
+    switch (`${method} ${second}`) {
+      case "POST login": {
+        const body = await readJson(ctx.request);
+        const session = await cms.auth.login({
+          email: String(body.email ?? ""),
+          password: String(body.password ?? ""),
+          ip: options.getClientIp?.(ctx.request)
+        });
+        setSessionCookies(cms, ctx, session);
+        return {
+          body: { user: session.user, exp: session.expiresAt, csrfToken: session.csrfToken }
+        };
+      }
+      case "POST logout": {
+        if (ctx.token) await cms.auth.logout(ctx.token);
+        clearSessionCookies(ctx);
+        return { body: { message: "Logged out" } };
+      }
+      case "GET me": {
+        const csrfToken2 = ctx.via === "cookie" && ctx.token ? cms.auth.csrfFor(ctx.token) : void 0;
+        if (csrfToken2)
+          ctx.headers.append("set-cookie", cookie(ctx, CSRF_COOKIE, csrfToken2, { httpOnly: false }));
+        return { body: { user: ctx.user, ...csrfToken2 ? { csrfToken: csrfToken2 } : {} } };
+      }
+      case "GET init":
+        return { body: { hasUsers: await cms.auth.hasUsers() } };
+      case "POST first-register": {
+        const body = await readJson(ctx.request);
+        const session = await cms.auth.registerFirstUser({
+          email: String(body.email ?? ""),
+          password: String(body.password ?? ""),
+          ...typeof body.name === "string" ? { name: body.name } : {}
+        });
+        setSessionCookies(cms, ctx, session);
+        return {
+          status: 201,
+          body: { user: session.user, exp: session.expiresAt, csrfToken: session.csrfToken }
+        };
+      }
+    }
+    throw new HttpError("Not found", 404);
+  }
+  if (first === "admin") {
+    if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+    if (!ctx.user) throw new UnauthorizedError();
+    if (second === "schema" && third === void 0)
+      return { body: await adminSchema(cms, ctx.user) };
+    const [, , collection3, id2, extra] = segments;
+    if (second === "access" && collection3 && id2 && extra === void 0) {
+      if (INTERNAL_COLLECTIONS.has(collection3) || !cms.config.collections.some((c) => c.slug === collection3)) {
+        throw new HttpError(`Unknown collection "${collection3}"`, 404);
+      }
+      return { body: await cms.documentPermissions(collection3, id2, ctx.user) };
+    }
+    throw new HttpError("Not found", 404);
+  }
+  if (first === "globals") {
+    if (!second || third !== void 0) throw new HttpError("Not found", 404);
+    if (!cms.config.globals.some((g) => g.slug === second))
+      throw new HttpError(`Unknown global "${second}"`, 404);
+    if (method === "GET")
+      return { body: await cms.findGlobal(second, { ...access, ...parseDepth(ctx.url), draft }) };
+    if (method === "POST") {
+      const body = await readJson(ctx.request);
+      return { body: await cms.updateGlobal(second, body, { ...access, ...parseDepth(ctx.url) }) };
+    }
+    throw methodNotAllowed(ctx, "GET, POST");
+  }
+  if (first === MEDIA && second === "file" && third !== void 0 && segments.length === 3) {
+    if (method !== "GET" && method !== "HEAD") throw methodNotAllowed(ctx, "GET, HEAD");
+    return { body: await serveFile(cms, third, method === "HEAD") };
+  }
+  if (first === MEDIA && second === void 0 && method === "POST") {
+    const { file, data } = await readUpload(ctx.request, cms.config.upload.maxFileSize);
+    return {
+      status: 201,
+      body: await cms.upload(file, data, { ...access, ...parseDepth(ctx.url) })
+    };
+  }
+  const collection2 = first;
+  if (INTERNAL_COLLECTIONS.has(collection2) || !cms.config.collections.some((c) => c.slug === collection2)) {
+    throw new HttpError(`Unknown collection "${collection2}"`, 404);
+  }
+  if (third !== void 0) throw new HttpError("Not found", 404);
+  if (second === void 0) {
+    if (method === "GET") {
+      const query = parseListQuery(ctx.url);
+      return { body: await cms.find(collection2, { ...access, ...query, draft }) };
+    }
+    if (method === "POST") {
+      const body = await readJson(ctx.request);
+      return {
+        status: 201,
+        body: await cms.create(collection2, body, { ...access, ...parseDepth(ctx.url) })
+      };
+    }
+    throw methodNotAllowed(ctx, "GET, POST");
+  }
+  const id = second;
+  if (method === "GET") {
+    const doc = await cms.findById(collection2, id, { ...access, ...parseDepth(ctx.url), draft });
+    if (!doc) throw new NotFoundError(collection2, id);
+    return { body: doc };
+  }
+  if (method === "PATCH") {
+    const body = await readJson(ctx.request);
+    const doc = await cms.update(collection2, id, body, { ...access, ...parseDepth(ctx.url) });
+    if (collection2 === USERS && body.password && ctx.user && String(ctx.user.id) === String(doc.id) && ctx.via === "cookie") {
+      setSessionCookies(cms, ctx, await cms.auth.createSession(doc.id));
+    }
+    return { body: doc };
+  }
+  if (method === "DELETE") {
+    return { body: await cms.delete(collection2, id, access) };
+  }
+  throw methodNotAllowed(ctx, "GET, PATCH, DELETE");
+}
+function methodNotAllowed(ctx, allow) {
+  ctx.headers.set("allow", allow);
+  return new HttpError("Method not allowed", 405);
+}
+function readToken(request) {
+  const authorization = request.headers.get("authorization");
+  if (authorization?.startsWith("Bearer "))
+    return { token: authorization.slice(7).trim(), via: "bearer" };
+  const token = readCookie(request, SESSION_COOKIE);
+  return { token, via: token ? "cookie" : null };
+}
+function readCookie(request, name) {
+  const header = request.headers.get("cookie");
+  if (!header) return void 0;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq > 0 && part.slice(0, eq).trim() === name)
+      return decodeURIComponent(part.slice(eq + 1).trim());
+  }
+  return void 0;
+}
+function checkCsrf(cms, ctx) {
+  const origin = ctx.request.headers.get("origin");
+  const fetchSite = ctx.request.headers.get("sec-fetch-site");
+  const trusted = origin !== null && (origin === ctx.url.origin || cms.config.auth.trustedOrigins.includes(origin));
+  if (origin !== null && !trusted) throw new ForbiddenError("CSRF check failed: untrusted origin");
+  if (origin === null && fetchSite === "cross-site")
+    throw new ForbiddenError("CSRF check failed: cross-site request");
+  if (ctx.via === "cookie" && ctx.token) {
+    const expected = cms.auth.csrfFor(ctx.token);
+    const given = ctx.request.headers.get(CSRF_HEADER);
+    if (!expected || !given || !safeEqual(given, expected)) {
+      throw new ForbiddenError(
+        `CSRF check failed: send the ${CSRF_HEADER} header from GET /users/me`
+      );
+    }
+  }
+}
+var TYPE_BY_EXTENSION = Object.fromEntries(
+  Object.entries(EXTENSIONS).map(([type, ext]) => [ext, type])
+);
+async function serveFile(cms, key2, head) {
+  if (!/^[\p{L}\p{M}\p{N}-]+\.[a-z0-9]+$/u.test(key2)) throw new HttpError("Not found", 404);
+  const file = await cms.storage.get(key2);
+  if (!file) throw new HttpError("Not found", 404);
+  const extension = key2.slice(key2.lastIndexOf(".") + 1);
+  return new Response(
+    head ? null : file.body,
+    {
+      status: 200,
+      headers: {
+        "content-type": TYPE_BY_EXTENSION[extension] ?? "application/octet-stream",
+        "content-length": String(file.size),
+        "cache-control": "public, max-age=31536000, immutable",
+        "x-content-type-options": "nosniff",
+        "content-security-policy": "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'; sandbox",
+        "cross-origin-resource-policy": "cross-origin"
+      }
+    }
+  );
+}
+async function readUpload(request, maxFileSize) {
+  const type = request.headers.get("content-type") ?? "";
+  if (!type.toLowerCase().startsWith("multipart/form-data")) {
+    throw new HttpError('Uploads must be multipart/form-data with a "file" field', 415);
+  }
+  const declared = Number(request.headers.get("content-length") ?? 0);
+  if (declared > maxFileSize + 64 * 1024)
+    throw new PayloadTooLargeError(`File is larger than ${maxFileSize} bytes`);
+  let form;
+  try {
+    form = await request.formData();
+  } catch {
+    throw new HttpError("Malformed multipart body", 400);
+  }
+  const file = form.get("file");
+  if (!file || typeof file === "string")
+    throw new ValidationError(MEDIA, [{ field: "file", message: "is required" }]);
+  const data = {};
+  for (const [key2, value] of form) {
+    if (key2 !== "file" && typeof value === "string") data[key2] = value;
+  }
+  return {
+    file: { data: new Uint8Array(await file.arrayBuffer()), name: file.name || "file" },
+    data
+  };
+}
+async function readJson(request) {
+  const type = request.headers.get("content-type") ?? "";
+  if (!type.toLowerCase().startsWith("application/json")) {
+    throw new HttpError("Content-Type must be application/json", 415);
+  }
+  const declared = Number(request.headers.get("content-length") ?? 0);
+  if (declared > MAX_BODY_BYTES) throw new HttpError("Request body too large", 413);
+  const text = await request.text();
+  if (Buffer.byteLength(text) > MAX_BODY_BYTES) throw new HttpError("Request body too large", 413);
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    throw new HttpError("Request body is not valid JSON", 400);
+  }
+  if (typeof body !== "object" || body === null || Array.isArray(body)) {
+    throw new HttpError("Request body must be a JSON object", 400);
+  }
+  return body;
+}
+function isSecure(ctx) {
+  return ctx.url.protocol === "https:" || process.env.NODE_ENV === "production";
+}
+function cookie(ctx, name, value, opts) {
+  const parts = [`${name}=${encodeURIComponent(value)}`, "Path=/", "SameSite=Lax"];
+  if (opts.httpOnly) parts.push("HttpOnly");
+  if (isSecure(ctx)) parts.push("Secure");
+  if (opts.maxAge !== void 0) parts.push(`Max-Age=${opts.maxAge}`);
+  return parts.join("; ");
+}
+function setSessionCookies(cms, ctx, session) {
+  const maxAge = cms.config.auth.tokenExpiration;
+  ctx.headers.append(
+    "set-cookie",
+    cookie(ctx, SESSION_COOKIE, session.token, { httpOnly: true, maxAge })
+  );
+  ctx.headers.append(
+    "set-cookie",
+    cookie(ctx, CSRF_COOKIE, session.csrfToken, { httpOnly: false, maxAge })
+  );
+}
+function clearSessionCookies(ctx) {
+  ctx.headers.append("set-cookie", cookie(ctx, SESSION_COOKIE, "", { httpOnly: true, maxAge: 0 }));
+  ctx.headers.append("set-cookie", cookie(ctx, CSRF_COOKIE, "", { httpOnly: false, maxAge: 0 }));
+}
+function errorResponse(cms, error, headers, production) {
+  if (error instanceof EasyCMSError) {
+    const errors = error instanceof ValidationError ? error.errors.map((e) => ({ message: e.message, field: e.field })) : [{ message: error.message }];
+    if (error instanceof UnauthorizedError) headers.set("www-authenticate", "Bearer");
+    return new Response(JSON.stringify({ errors }), { status: error.status, headers });
+  }
+  const message = error instanceof Error ? error.message : String(error);
+  cms.logger.error(
+    `REST request failed: ${error instanceof Error ? error.stack ?? message : message}`
+  );
+  const body = { errors: [{ message: production ? "Internal Server Error" : message }] };
+  return new Response(JSON.stringify(body), { status: 500, headers });
+}
+
+// src/typegen.ts
+var pascal = (name) => name.split(/[^A-Za-z0-9]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
+function singularize(word) {
+  if (/ies$/i.test(word)) return word.replace(/ies$/i, "y");
+  if (/(ss|us|ia)$/i.test(word)) return word;
+  if (/(x|ch|sh)es$/i.test(word)) return word.replace(/es$/i, "");
+  return word.replace(/s$/i, "");
+}
+var quote = (value) => JSON.stringify(value);
+var key = (name) => /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name) ? name : quote(name);
+function names(config) {
+  const taken = /* @__PURE__ */ new Set(["ID", "RichTextDocument", "MediaSize", "Collections", "Globals"]);
+  const claim = (base, suffix) => {
+    let name = base || suffix;
+    if (taken.has(name)) name = `${base}${suffix}`;
+    for (let n = 2; taken.has(name); n++) name = `${base}${suffix}${n}`;
+    taken.add(name);
+    return name;
+  };
+  const collections = /* @__PURE__ */ new Map();
+  for (const c of config.collections) {
+    if (!INTERNAL_COLLECTIONS.has(c.slug))
+      collections.set(c.slug, claim(pascal(singularize(c.slug)), "Document"));
+  }
+  const globals = /* @__PURE__ */ new Map();
+  for (const g of config.globals) globals.set(g.slug, claim(pascal(g.slug), "Global"));
+  return { collections, globals };
+}
+function fieldType(field, n, indent) {
+  switch (field.type) {
+    case "text":
+    case "textarea":
+    case "email":
+    case "slug":
+    case "date":
+      return "string";
+    case "number":
+      return "number";
+    case "boolean":
+      return "boolean";
+    case "json":
+      return "unknown";
+    case "richText":
+      return "RichTextDocument";
+    case "select": {
+      const union = field.options.map((o) => quote(typeof o === "string" ? o : o.value)).join(" | ") || "string";
+      return field.hasMany ? `(${union})[]` : union;
+    }
+    case "upload":
+      return `ID | ${n.collections.get(MEDIA) ?? "Record<string, unknown>"}`;
+    case "relationship": {
+      const target = n.collections.get(field.to);
+      const one = target ? `ID | ${target}` : "ID";
+      return field.hasMany ? `(${one})[]` : one;
+    }
+    case "group":
+      return `{
+${fieldLines(field.fields, n, `${indent}  `).join("\n")}
+${indent}}`;
+    case "array":
+      return `{
+${indent}  id: string
+${fieldLines(field.fields, n, `${indent}  `).join("\n")}
+${indent}}[]`;
+  }
+}
+function fieldLines(fields, n, indent) {
+  const lines = [];
+  for (const field of fields) {
+    if (field.hidden) continue;
+    const type = fieldType(field, n, indent);
+    const alwaysPresent = field.type === "array" || field.type === "group" || (field.type === "select" || field.type === "relationship") && field.hasMany;
+    if (field.required || alwaysPresent) lines.push(`${indent}${key(field.name)}: ${type}`);
+    else lines.push(`${indent}${key(field.name)}?: ${type} | null`);
+  }
+  return lines;
+}
+function collectionInterface(collection2, name, n) {
+  const lines = ["  id: ID"];
+  if (collection2.slug === MEDIA) {
+    lines.push("  url: string", "  sizes: Record<string, MediaSize>");
+  }
+  const fields = collection2.slug === MEDIA ? collection2.fields.filter((f) => f.name !== "sizes") : collection2.fields;
+  lines.push(...fieldLines(fields, n, "  "));
+  if (collection2.drafts) lines.push(`  status: 'draft' | 'published'`);
+  lines.push("  createdAt: string", "  updatedAt: string");
+  return `export interface ${name} {
+${lines.join("\n")}
+}`;
+}
+function globalInterface(global2, name, n) {
+  const lines = [...fieldLines(global2.fields, n, "  ")];
+  if (global2.drafts) lines.push(`  status: 'draft' | 'published'`);
+  lines.push(
+    "  /** `null` until the global is saved for the first time. */",
+    "  updatedAt: string | null"
+  );
+  return `export interface ${name} {
+${lines.join("\n")}
+}`;
+}
+function generateTypes(config) {
+  const n = names(config);
+  const parts = [
+    "// Generated by `easy-cms generate:types`. Do not edit; run the command again after changing the config.",
+    "",
+    "/** Document ids are integers. */",
+    "export type ID = number",
+    "",
+    "/** Rich text as stored: a Tiptap / ProseMirror JSON document. */",
+    "export interface RichTextDocument {",
+    `  type: 'doc'`,
+    "  content?: unknown[]",
+    "}",
+    "",
+    "export interface MediaSize {",
+    "  filename: string",
+    "  width: number",
+    "  height: number",
+    "  filesize: number",
+    "  url: string",
+    "}"
+  ];
+  for (const collection2 of config.collections) {
+    const name = n.collections.get(collection2.slug);
+    if (name) parts.push("", collectionInterface(collection2, name, n));
+  }
+  for (const global2 of config.globals) {
+    parts.push("", globalInterface(global2, n.globals.get(global2.slug), n));
+  }
+  const map = (entries) => [...entries].map(([slug, name]) => `  ${key(slug)}: ${name}`).join("\n");
+  parts.push(
+    "",
+    "/** Document type by collection slug. */",
+    `export interface Collections {
+${map(n.collections)}
+}`
+  );
+  parts.push(
+    "",
+    "/** Data type by global slug. */",
+    `export interface Globals {
+${map(n.globals)}
+}`,
+    ""
+  );
+  return parts.join("\n");
+}
+export {
+  Auth,
+  BUILTIN_COLLECTIONS,
+  CONFIG_FILE_NAMES,
+  CSRF_COOKIE,
+  CSRF_HEADER,
+  ConfigError,
+  DEFAULT_ADMIN_PATH,
+  DEFAULT_API_PATH,
+  DEFAULT_DEPTH,
+  DEFAULT_MAX_FILE_SIZE,
+  DEFAULT_TOKEN_EXPIRATION,
+  EXTENSIONS,
+  EasyCMS,
+  EasyCMSError,
+  FIELD_TYPES,
+  ForbiddenError,
+  INTERNAL_COLLECTIONS,
+  MAX_DEPTH,
+  MEDIA,
+  MIN_PASSWORD_LENGTH,
+  MIN_SECRET_LENGTH,
+  NotFoundError,
+  PayloadTooLargeError,
+  QueryError,
+  SESSION_COOKIE,
+  SchemaError,
+  TooManyRequestsError,
+  UnauthorizedError,
+  ValidationError,
+  anyone,
+  applyDefaults,
+  consoleLogger,
+  createEasyCMS,
+  createRestHandler,
+  defineConfig,
+  fillMissing,
+  findConfigFile,
+  generateSlugs,
+  generateTypes,
+  hashPassword,
+  imageDimensions,
+  importConfig,
+  isAdmin,
+  isLoggedIn,
+  loadConfig,
+  localStorage,
+  mergeForUpdate,
+  mimeAllowed,
+  parseId,
+  populate,
+  readCookie,
+  resolveConfig,
+  silentLogger,
+  singularize,
+  slugify,
+  sniffMimeType,
+  validateConfig,
+  validateFields,
+  verifyPassword
+};