@easy-cms/core 0.31.0 → 0.33.0

package/dist/index.js

@@ -116,10 +116,10 @@ function cleanPermissions(value, known) {
   const pick = (group, slugs, operations) => {
     const out = {};
     if (typeof group !== "object" || group === null) return out;
-    for (const [slug, ops] of Object.entries(group)) {
-      if (!slugs.includes(slug) || API_KEY_EXCLUDED.has(slug) || !Array.isArray(ops)) continue;
+    for (const [slug2, ops] of Object.entries(group)) {
+      if (!slugs.includes(slug2) || API_KEY_EXCLUDED.has(slug2) || !Array.isArray(ops)) continue;
       const valid = operations.filter((op) => ops.includes(op));
-      if (valid.length) out[slug] = valid;
+      if (valid.length) out[slug2] = valid;
     }
     return out;
   };
@@ -293,22 +293,22 @@ async function stripFields(fields, doc, read2) {
   }
   return result;
 }
-async function filterInput(fields, data, update) {
+async function filterInput(fields, data, update2) {
   const result = { ...data };
   for (const field of fields) {
     if (!(field.name in result)) continue;
-    if (field.hidden || update && !await update.allows(field)) {
+    if (field.hidden || update2 && !await update2.allows(field)) {
       delete result[field.name];
       continue;
     }
     const value = result[field.name];
     if (field.type === "group" && value && typeof value === "object" && !Array.isArray(value)) {
-      result[field.name] = await filterInput(field.fields, value, update);
+      result[field.name] = await filterInput(field.fields, value, update2);
     } else if (hasRows(field) && Array.isArray(value)) {
       result[field.name] = await Promise.all(
         value.map((row) => {
           const fields2 = rowFields(field, row);
-          return fields2 && row && typeof row === "object" ? filterInput(fields2, row, update) : row;
+          return fields2 && row && typeof row === "object" ? filterInput(fields2, row, update2) : row;
         })
       );
     }
@@ -325,13 +325,17 @@ var VERSIONS = "document-versions";
 var SCHEDULED_JOBS = "scheduled-jobs";
 var WEBHOOK_DELIVERIES = "webhook-deliveries";
 var EMAIL_DELIVERIES = "email-deliveries";
+var DATABASE_BACKUPS = "database-backups";
+var ROLES = "user-roles";
 var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SESSIONS,
   LOGIN_ATTEMPTS,
   VERSIONS,
   SCHEDULED_JOBS,
   WEBHOOK_DELIVERIES,
-  EMAIL_DELIVERIES
+  EMAIL_DELIVERIES,
+  DATABASE_BACKUPS,
+  ROLES
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
 var adminOrSelf = ({ user }) => {
@@ -342,7 +346,8 @@ var adminOrSelf = ({ user }) => {
 var adminOnly = {
   update: ({ user }) => user?.role === "admin"
 };
-function userFields(roles) {
+function userFields(roles, rbac) {
+  const defaultRole = roles.includes("editor") ? "editor" : roles[roles.length - 1];
   return [
     {
       name: "email",
@@ -352,12 +357,20 @@ function userFields(roles) {
       label: { en: "Email", th: "\u0E2D\u0E35\u0E40\u0E21\u0E25" }
     },
     { name: "name", type: "text", label: { en: "Name", th: "\u0E0A\u0E37\u0E48\u0E2D" } },
-    {
+    // With roles from the admin (`auth.rbac`), any role in Settings → Roles: checked on save.
+    rbac ? {
+      name: "role",
+      type: "text",
+      required: true,
+      defaultValue: defaultRole,
+      access: adminOnly,
+      label: { en: "Role", th: "\u0E1A\u0E17\u0E1A\u0E32\u0E17" }
+    } : {
       name: "role",
       type: "select",
       options: roles,
       required: true,
-      defaultValue: roles.includes("editor") ? "editor" : roles[roles.length - 1],
+      defaultValue: defaultRole,
       access: adminOnly,
       label: { en: "Role", th: "\u0E1A\u0E17\u0E1A\u0E32\u0E17" }
     },
@@ -380,7 +393,7 @@ function withUsers(config) {
     useAsTitle: "email",
     icon: "users",
     ...custom,
-    fields: [...userFields(roles), ...custom?.fields ?? []],
+    fields: [...userFields(roles, config.auth?.rbac === true), ...custom?.fields ?? []],
     access: {
       read: isLoggedIn,
       create: isAdmin,
@@ -546,6 +559,25 @@ var webhookDeliveriesCollection = {
     { name: "error", type: "text" }
   ]
 };
+var databaseBackupsCollection = {
+  slug: DATABASE_BACKUPS,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    // pending | running | done | failed
+    { name: "state", type: "text", required: true, index: true },
+    // manual | scheduled
+    { name: "trigger", type: "text", required: true },
+    { name: "filename", type: "text" },
+    { name: "size", type: "number" },
+    { name: "startedAt", type: "text", index: true },
+    { name: "finishedAt", type: "text" },
+    { name: "error", type: "text" },
+    // Who started it (email), for manual ones.
+    { name: "author", type: "text" },
+    { name: "downloadedBy", type: "text" },
+    { name: "downloadedAt", type: "text" }
+  ]
+};
 var emailDeliveriesCollection = {
   slug: EMAIL_DELIVERIES,
   access: { read: nobody, create: nobody, update: nobody, delete: nobody },
@@ -1089,6 +1121,386 @@ var Auth = class {
   }
 };
 
+// src/backups.ts
+import { mkdtemp, readFile as readFile2, rm as rm2 } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join2 } from "path";
+import { promisify } from "util";
+import { gzip } from "zlib";
+
+// src/copy.ts
+var BATCH = 200;
+async function copyDatabase(source, target, options = {}) {
+  const from = source.transfer;
+  const to = target.transfer;
+  if (!from || !to) throw new EasyCMSError("This database adapter cannot copy databases", 400);
+  if (from.schemaHash !== to.schemaHash) {
+    throw new EasyCMSError(
+      "The two configs describe different collections or fields. Copy between configs with the same collections (import one config into the other and change only `db`).",
+      400
+    );
+  }
+  const tables = from.tables();
+  for (const table of tables) {
+    if (await to.count(table) > 0) {
+      throw new EasyCMSError(
+        `The target database is not empty ("${table}" has rows). Copy into a new, empty database.`,
+        400
+      );
+    }
+  }
+  let total = 0;
+  for (const table of tables) {
+    let copied = 0;
+    for (; ; ) {
+      const rows = await from.read(table, copied, BATCH);
+      if (rows.length === 0) break;
+      await to.write(table, rows);
+      copied += rows.length;
+      if (rows.length < BATCH) break;
+    }
+    total += copied;
+    options.onTable?.({ table, rows: copied });
+  }
+  await to.finish();
+  return { tables: tables.length, rows: total };
+}
+
+// src/storage.ts
+import { mkdir, readFile, rm, stat, writeFile } from "fs/promises";
+import { dirname, isAbsolute, join, normalize, resolve, sep } from "path";
+function localStorage(options = {}) {
+  let root = resolve(
+    /* turbopackIgnore: true */
+    options.dir ?? "uploads"
+  );
+  const pathOf = (key2) => {
+    const path = normalize(join(
+      /* turbopackIgnore: true */
+      root,
+      key2
+    ));
+    if (!path.startsWith(root + sep)) throw new Error(`Invalid storage key "${key2}"`);
+    return path;
+  };
+  return {
+    name: "local",
+    init({ cwd }) {
+      const dir = options.dir ?? "uploads";
+      root = isAbsolute(dir) ? dir : resolve(
+        /* turbopackIgnore: true */
+        cwd,
+        dir
+      );
+    },
+    async put(key2, data) {
+      const path = pathOf(key2);
+      await mkdir(dirname(path), { recursive: true });
+      await writeFile(path, data, { flag: "wx" });
+    },
+    async get(key2) {
+      const path = pathOf(key2);
+      const info = await stat(path).catch(() => void 0);
+      if (!info?.isFile()) return null;
+      return { body: new Uint8Array(await readFile(path)), size: info.size };
+    },
+    async delete(key2) {
+      await rm(pathOf(key2), { force: true });
+    }
+  };
+}
+
+// src/backups.ts
+var gzipAsync = promisify(gzip);
+var DEFAULT_BACKUP_TIME = "03:00";
+var DEFAULT_BACKUP_KEEP = 7;
+var DEFAULT_DIR = "backups";
+var STALE = 30 * 6e4;
+var PERIOD = { day: 864e5, week: 7 * 864e5 };
+var storages = /* @__PURE__ */ new WeakMap();
+function backupStorage(cms) {
+  let storage = storages.get(cms);
+  if (!storage) {
+    storage = (async () => {
+      const config = cms.config.backups;
+      const adapter = config?.storage ?? localStorage({ dir: config?.dir ?? DEFAULT_DIR });
+      await adapter.init?.({ cwd: cms.cwd });
+      return adapter;
+    })();
+    storages.set(cms, storage);
+  }
+  return storage;
+}
+function backupUnavailable(cms) {
+  if (cms.db.backup || cms.config.backups?.sqlite) return null;
+  return `The ${cms.config.db.name} database needs the SQLite adapter to write backups: backups: { sqlite } with sqlite from @easy-cms/db-sqlite`;
+}
+async function writeBackupFile(cms, file) {
+  if (cms.db.backup) return cms.db.backup(file);
+  const factory = cms.config.backups?.sqlite;
+  if (!factory) throw new EasyCMSError(backupUnavailable(cms), 400);
+  const prefix = cms.db.tablePrefix;
+  const scratch = `${file}.copy`;
+  const adapter = factory({ url: `file:${scratch}`, ...prefix ? { tablePrefix: prefix } : {} });
+  const target = await adapter.init({
+    config: { ...cms.config, db: adapter },
+    cwd: cms.cwd,
+    schema: "push",
+    logger: { ...cms.logger, info() {
+    } }
+  });
+  try {
+    await copyDatabase(cms.db, target);
+    if (!target.backup) throw new EasyCMSError("backups.sqlite must be the SQLite adapter", 400);
+    await target.backup(file);
+  } finally {
+    await target.destroy();
+    for (const suffix of ["", "-wal", "-shm"])
+      await rm2(`${scratch}${suffix}`, { force: true }).catch(() => {
+      });
+  }
+}
+var slug = (text) => text.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "easy-cms";
+function filenameFor(cms, date) {
+  const pad = (n) => String(n).padStart(2, "0");
+  const stamp = `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}-${pad(date.getHours())}${pad(date.getMinutes())}`;
+  return `${slug(cms.config.admin.brand.name || "easy-cms")}-${stamp}.db.gz`;
+}
+function toAdmin(row) {
+  const text = (value) => typeof value === "string" && value !== "" ? value : null;
+  return {
+    id: row.id,
+    state: ["pending", "running", "done", "failed"].includes(row.state) ? row.state : "failed",
+    trigger: row.trigger === "scheduled" ? "scheduled" : "manual",
+    filename: text(row.filename),
+    size: typeof row.size === "number" ? row.size : null,
+    startedAt: text(row.startedAt),
+    finishedAt: text(row.finishedAt),
+    error: text(row.error),
+    author: text(row.author),
+    downloadedBy: text(row.downloadedBy),
+    downloadedAt: text(row.downloadedAt)
+  };
+}
+async function update(cms, row, data) {
+  const { id, ...rest } = row;
+  const next = { ...rest, ...data, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  await cms.db.update({ collection: DATABASE_BACKUPS, id, data: next });
+  return { ...row, ...data };
+}
+async function listBackups(cms) {
+  const config = cms.config.backups;
+  const storage = await backupStorage(cms);
+  const { docs } = await cms.db.find({
+    collection: DATABASE_BACKUPS,
+    sort: ["-createdAt"],
+    limit: 0,
+    page: 1
+  });
+  return {
+    settings: {
+      every: config?.every ?? null,
+      at: config?.at ?? DEFAULT_BACKUP_TIME,
+      keep: config?.keep ?? DEFAULT_BACKUP_KEEP,
+      storage: storage.name,
+      dir: config?.storage ? null : config?.dir ?? DEFAULT_DIR,
+      database: cms.config.db.name,
+      unavailable: backupUnavailable(cms)
+    },
+    backups: docs.map(toAdmin)
+  };
+}
+async function inProgress(cms, now) {
+  const { docs } = await cms.db.find({
+    collection: DATABASE_BACKUPS,
+    where: { state: { in: ["pending", "running"] } },
+    sort: ["-createdAt"],
+    limit: 10,
+    page: 1
+  });
+  return docs.find((row) => now - Date.parse(String(row.createdAt)) < STALE);
+}
+async function startBackup(cms, trigger, author) {
+  const unavailable = backupUnavailable(cms);
+  if (unavailable) throw new EasyCMSError(unavailable, 400);
+  const now = /* @__PURE__ */ new Date();
+  if (await inProgress(cms, now.getTime()))
+    throw new EasyCMSError("A backup is already running", 409);
+  const stamp = now.toISOString();
+  const row = await cms.db.create({
+    collection: DATABASE_BACKUPS,
+    data: {
+      state: "pending",
+      trigger,
+      filename: null,
+      size: null,
+      startedAt: null,
+      finishedAt: null,
+      error: null,
+      author: author ?? null,
+      downloadedBy: null,
+      downloadedAt: null,
+      createdAt: stamp,
+      updatedAt: stamp
+    }
+  });
+  void runBackup(cms, row).catch(
+    (error) => cms.logger.error(`Backup failed: ${error.message}`)
+  );
+  return toAdmin(row);
+}
+async function runBackup(cms, record) {
+  const started = /* @__PURE__ */ new Date();
+  let row = await update(cms, record, { state: "running", startedAt: started.toISOString() });
+  const dir = await mkdtemp(join2(tmpdir(), "easy-cms-backup-"));
+  try {
+    const file = join2(dir, "backup.db");
+    await writeBackupFile(cms, file);
+    const data = new Uint8Array(await gzipAsync(await readFile2(file)));
+    const storage = await backupStorage(cms);
+    const filename = filenameFor(cms, started);
+    const key2 = await storage.get(filename) ? filename.replace(/\.db\.gz$/, `-${row.id}.db.gz`) : filename;
+    await storage.put(key2, data, { contentType: "application/gzip" });
+    row = await update(cms, row, {
+      state: "done",
+      filename: key2,
+      size: data.byteLength,
+      finishedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    cms.logger.info(`Backup ${key2} written (${data.byteLength} bytes)`);
+    await pruneBackups(cms);
+  } catch (error) {
+    await update(cms, row, {
+      state: "failed",
+      error: (error.message || String(error)).slice(0, 500),
+      finishedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    throw error;
+  } finally {
+    await rm2(dir, { recursive: true, force: true });
+  }
+}
+async function pruneBackups(cms) {
+  const keep = cms.config.backups?.keep ?? DEFAULT_BACKUP_KEEP;
+  const storage = await backupStorage(cms);
+  const { docs } = await cms.db.find({
+    collection: DATABASE_BACKUPS,
+    where: { state: { equals: "done" } },
+    sort: ["-createdAt"],
+    limit: 0,
+    page: 1
+  });
+  for (const row of docs.slice(keep)) {
+    if (typeof row.filename === "string") await storage.delete(row.filename).catch(() => {
+    });
+    await cms.db.delete({ collection: DATABASE_BACKUPS, id: row.id });
+  }
+  const old = new Date(Date.now() - 30 * 864e5).toISOString();
+  const failed = await cms.db.find({
+    collection: DATABASE_BACKUPS,
+    where: { and: [{ state: { equals: "failed" } }, { createdAt: { lt: old } }] },
+    sort: ["createdAt"],
+    limit: 100,
+    page: 1
+  });
+  for (const row of failed.docs) await cms.db.delete({ collection: DATABASE_BACKUPS, id: row.id });
+}
+function lastSlot(now, at) {
+  const [hours2, minutes] = at.split(":").map(Number);
+  const slot = new Date(now);
+  slot.setHours(hours2, minutes, 0, 0);
+  if (slot.getTime() > now.getTime()) slot.setDate(slot.getDate() - 1);
+  return slot;
+}
+async function runDueBackups(cms, now = /* @__PURE__ */ new Date()) {
+  if (backupUnavailable(cms)) return;
+  const { docs } = await cms.db.find({
+    collection: DATABASE_BACKUPS,
+    where: { state: { in: ["pending", "running"] } },
+    sort: ["createdAt"],
+    limit: 10,
+    page: 1
+  });
+  for (const row of docs) {
+    const age = now.getTime() - Date.parse(String(row.updatedAt ?? row.createdAt));
+    if (age < STALE) continue;
+    if (row.state === "pending") await runBackup(cms, row).catch(() => {
+    });
+    else
+      await update(cms, row, {
+        state: "failed",
+        error: "Interrupted: the server stopped during the backup",
+        finishedAt: now.toISOString()
+      });
+  }
+  const every = cms.config.backups?.every;
+  if (!every) return;
+  const slot = lastSlot(now, cms.config.backups?.at ?? DEFAULT_BACKUP_TIME);
+  const latest = await cms.db.find({
+    collection: DATABASE_BACKUPS,
+    where: { trigger: { equals: "scheduled" } },
+    sort: ["-createdAt"],
+    limit: 1,
+    page: 1
+  });
+  const last = latest.docs[0] ? Date.parse(String(latest.docs[0].createdAt)) : 0;
+  const due = every === "day" ? last < slot.getTime() : last < slot.getTime() - PERIOD.week + PERIOD.day;
+  if (!due) return;
+  if (await inProgress(cms, now.getTime())) return;
+  await startBackup(cms, "scheduled").catch(
+    (error) => cms.logger.error(`Scheduled backup could not start: ${error.message}`)
+  );
+}
+async function backupAttention(cms, now = Date.now()) {
+  const every = cms.config.backups?.every;
+  if (!every) return null;
+  const [scheduled, done] = await Promise.all([
+    cms.db.find({
+      collection: DATABASE_BACKUPS,
+      where: { trigger: { equals: "scheduled" } },
+      sort: ["-createdAt"],
+      limit: 1,
+      page: 1
+    }),
+    cms.db.find({
+      collection: DATABASE_BACKUPS,
+      where: { state: { equals: "done" } },
+      sort: ["-createdAt"],
+      limit: 1,
+      page: 1
+    })
+  ]);
+  const failed = scheduled.docs[0]?.state === "failed";
+  const lastDone = done.docs[0] ? String(done.docs[0].createdAt) : null;
+  let since = lastDone ? Date.parse(lastDone) : void 0;
+  if (since === void 0) {
+    const first = await cms.db.find({ collection: USERS, sort: ["createdAt"], limit: 1, page: 1 });
+    since = first.docs[0] ? Date.parse(String(first.docs[0].createdAt)) : now;
+  }
+  const overdue = now - since > 2 * PERIOD[every];
+  return failed || overdue ? { id: "backups", failed, lastDone } : null;
+}
+async function downloadBackup(cms, id, by) {
+  const row = await cms.db.findById({ collection: DATABASE_BACKUPS, id });
+  if (row?.state !== "done" || typeof row.filename !== "string")
+    throw new NotFoundError(DATABASE_BACKUPS, id);
+  const file = await (await backupStorage(cms)).get(row.filename);
+  if (!file)
+    throw new EasyCMSError(`The file ${row.filename} is no longer in the backup storage`, 404);
+  await update(cms, row, { downloadedBy: by, downloadedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  return { filename: row.filename, body: file.body };
+}
+async function deleteBackup(cms, id) {
+  const row = await cms.db.findById({ collection: DATABASE_BACKUPS, id });
+  if (!row) throw new NotFoundError(DATABASE_BACKUPS, id);
+  if (row.state === "running" || row.state === "pending")
+    throw new EasyCMSError("A backup in progress cannot be deleted", 409);
+  if (typeof row.filename === "string")
+    await (await backupStorage(cms)).delete(row.filename).catch(() => {
+    });
+  await cms.db.delete({ collection: DATABASE_BACKUPS, id });
+}
+
 // src/config.ts
 var ADMIN_ICONS = [
   "file-text",
@@ -1175,44 +1587,6 @@ function configSignature(config) {
 }
 var signatures = /* @__PURE__ */ new WeakMap();
 
-// src/copy.ts
-var BATCH = 200;
-async function copyDatabase(source, target, options = {}) {
-  const from = source.transfer;
-  const to = target.transfer;
-  if (!from || !to) throw new EasyCMSError("This database adapter cannot copy databases", 400);
-  if (from.schemaHash !== to.schemaHash) {
-    throw new EasyCMSError(
-      "The two configs describe different collections or fields. Copy between configs with the same collections (import one config into the other and change only `db`).",
-      400
-    );
-  }
-  const tables = from.tables();
-  for (const table of tables) {
-    if (await to.count(table) > 0) {
-      throw new EasyCMSError(
-        `The target database is not empty ("${table}" has rows). Copy into a new, empty database.`,
-        400
-      );
-    }
-  }
-  let total = 0;
-  for (const table of tables) {
-    let copied = 0;
-    for (; ; ) {
-      const rows = await from.read(table, copied, BATCH);
-      if (rows.length === 0) break;
-      await to.write(table, rows);
-      copied += rows.length;
-      if (rows.length < BATCH) break;
-    }
-    total += copied;
-    options.onTable?.({ table, rows: copied });
-  }
-  await to.finish();
-  return { tables: tables.length, rows: total };
-}
-
 // src/document.ts
 import { randomUUID } from "crypto";
 var EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
@@ -1327,7 +1701,7 @@ function parseId(value) {
 async function validateFields(fields, input, options, prefix = "") {
   const data = {};
   const errors = [];
-  const references = [];
+  const references2 = [];
   for (const field of fields) {
     const path = prefix + field.name;
     const raw = input[field.name];
@@ -1345,7 +1719,7 @@ async function validateFields(fields, input, options, prefix = "") {
       );
       data[field.name] = sub.data;
       errors.push(...sub.errors);
-      references.push(...sub.references);
+      references2.push(...sub.references);
       continue;
     }
     const localization = options.localization;
@@ -1375,7 +1749,7 @@ async function validateFields(fields, input, options, prefix = "") {
           options,
           failLocale,
           errors,
-          references
+          references2
         );
         if (normalized === void 0) continue;
         out[locale] = normalized;
@@ -1392,12 +1766,12 @@ async function validateFields(fields, input, options, prefix = "") {
       if (!field.required) await runCustom(field, null, options, fail);
       continue;
     }
-    const value = await normalizeValue(field, raw, path, options, fail, errors, references);
+    const value = await normalizeValue(field, raw, path, options, fail, errors, references2);
     if (value === void 0) continue;
     data[field.name] = value;
     await runCustom(field, value, options, fail);
   }
-  return { data, errors, references };
+  return { data, errors, references: references2 };
 }
 async function runCustom(field, value, options, fail) {
   if (!field.validate) return;
@@ -1405,7 +1779,7 @@ async function runCustom(field, value, options, fail) {
   const result = await validate(value, { data: options.root, operation: options.operation });
   if (result !== true) fail(typeof result === "string" ? result : "is invalid");
 }
-async function normalizeValue(field, raw, path, options, fail, errors, references) {
+async function normalizeValue(field, raw, path, options, fail, errors, references2) {
   switch (field.type) {
     case "text":
     case "textarea":
@@ -1467,7 +1841,7 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
         if (id === void 0)
           return fail(`must be ${many ? "ids" : "an id"} of "${target}" documents`);
         ids.push(id);
-        references.push({
+        references2.push({
           field: path,
           collection: target,
           id,
@@ -1491,19 +1865,19 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
         }
         const sub = await validateFields(field.fields, row, options, `${path}.${i}.`);
         errors.push(...sub.errors);
-        references.push(...sub.references);
+        references2.push(...sub.references);
         const id = typeof row.id === "string" && row.id !== "" ? row.id : randomUUID();
         rows.push({ id, ...sub.data });
       }
       return rows;
     }
     case "blocks":
-      return normalizeBlocks(field, raw, path, options, fail, errors, references);
+      return normalizeBlocks(field, raw, path, options, fail, errors, references2);
     case "group":
       return raw;
   }
 }
-async function normalizeBlocks(field, raw, path, options, fail, errors, references) {
+async function normalizeBlocks(field, raw, path, options, fail, errors, references2) {
   if (!Array.isArray(raw)) return fail("must be an array of blocks");
   if (field.minRows !== void 0 && raw.length < field.minRows)
     return fail(`must have at least ${field.minRows} blocks`);
@@ -1521,7 +1895,7 @@ async function normalizeBlocks(field, raw, path, options, fail, errors, referenc
     }
     const sub = await validateFields(fields, row, options, `${path}.${i}.`);
     errors.push(...sub.errors);
-    references.push(...sub.references);
+    references2.push(...sub.references);
     const id = typeof row.id === "string" && row.id !== "" ? row.id : randomUUID();
     rows.push({ id, blockType: row.blockType, ...sub.data });
   }
@@ -1779,32 +2153,513 @@ function applyFieldTypes(config) {
         }
       } : {}
     };
-  });
-  return {
-    config: {
-      ...config,
-      ...config.collections ? {
-        collections: config.collections.map((c, i) => ({
-          ...c,
-          fields: convert(c.fields, `collections[${i}].fields`)
-        }))
-      } : {},
-      ...config.globals ? {
-        globals: config.globals.map((g, i) => ({
-          ...g,
-          fields: convert(g.fields, `globals[${i}].fields`)
-        }))
-      } : {}
-    },
-    issues
-  };
+  });
+  return {
+    config: {
+      ...config,
+      ...config.collections ? {
+        collections: config.collections.map((c, i) => ({
+          ...c,
+          fields: convert(c.fields, `collections[${i}].fields`)
+        }))
+      } : {},
+      ...config.globals ? {
+        globals: config.globals.map((g, i) => ({
+          ...g,
+          fields: convert(g.fields, `globals[${i}].fields`)
+        }))
+      } : {}
+    },
+    issues
+  };
+}
+
+// src/load-config.ts
+import { existsSync } from "fs";
+import { resolve as resolve2 } from "path";
+import { createJiti } from "jiti";
+
+// src/versions.ts
+var DEFAULT_MAX_VERSIONS = 50;
+function versionLimit(config) {
+  const versions = config.versions;
+  if (!versions) return void 0;
+  return versions === true ? DEFAULT_MAX_VERSIONS : versions.max ?? DEFAULT_MAX_VERSIONS;
+}
+var collectionParent = (slug2) => slug2;
+var globalParent = (slug2) => `global:${slug2}`;
+function snapshotOf(fields, doc) {
+  const hidden = new Set(fields.filter((f) => f.hidden).map((f) => f.name));
+  const snapshot = {};
+  for (const [key2, value] of Object.entries(doc)) {
+    if (key2 === "id" || key2 === "createdAt" || key2 === "updatedAt" || hidden.has(key2)) continue;
+    snapshot[key2] = value;
+  }
+  return snapshot;
+}
+var toSummary = (row) => ({
+  id: row.id,
+  status: row.status ?? null,
+  latest: row.latest === true,
+  author: row.author ?? null,
+  createdAt: String(row.createdAt)
+});
+var VersionStore = class {
+  constructor(db) {
+    this.db = db;
+  }
+  db;
+  /** Saves a new latest version and deletes the oldest beyond `max`. */
+  async save(args) {
+    const { parent, doc } = args;
+    const previous = await this.db.find({
+      collection: VERSIONS,
+      where: { and: [...this.of(parent, doc), { latest: { equals: true } }] },
+      sort: [],
+      limit: 0,
+      page: 1
+    });
+    for (const row of previous.docs) {
+      await this.db.update({ collection: VERSIONS, id: row.id, data: { ...row, latest: false } });
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const created = await this.db.create({
+      collection: VERSIONS,
+      data: {
+        parent,
+        doc,
+        status: args.status,
+        latest: true,
+        author: args.author,
+        snapshot: args.snapshot,
+        createdAt: now,
+        updatedAt: now
+      }
+    });
+    await this.prune(parent, doc, args.max);
+    return toSummary(created);
+  }
+  /** The latest version of each document, keyed by document id. */
+  async latest(parent, docs) {
+    const result = /* @__PURE__ */ new Map();
+    if (docs.length === 0) return result;
+    const rows = await this.db.find({
+      collection: VERSIONS,
+      where: {
+        and: [
+          { parent: { equals: parent } },
+          { doc: { in: [...docs] } },
+          { latest: { equals: true } }
+        ]
+      },
+      sort: [],
+      limit: 0,
+      page: 1
+    });
+    for (const row of rows.docs) result.set(String(row.doc), this.toVersion(row));
+    return result;
+  }
+  async list(parent, doc, limit, page) {
+    const found = await this.db.find({
+      collection: VERSIONS,
+      where: { and: this.of(parent, doc) },
+      sort: ["-id"],
+      limit,
+      page
+    });
+    return { ...found, docs: found.docs.map(toSummary) };
+  }
+  async get(parent, doc, id) {
+    const found = await this.db.find({
+      collection: VERSIONS,
+      where: { and: [...this.of(parent, doc), { id: { equals: id } }] },
+      sort: [],
+      limit: 1,
+      page: 1
+    });
+    const row = found.docs[0];
+    return row ? this.toVersion(row) : null;
+  }
+  async deleteAll(parent, doc) {
+    const rows = await this.db.find({
+      collection: VERSIONS,
+      where: { and: this.of(parent, doc) },
+      sort: [],
+      limit: 0,
+      page: 1
+    });
+    for (const row of rows.docs) await this.db.delete({ collection: VERSIONS, id: row.id });
+  }
+  async prune(parent, doc, max) {
+    const rows = await this.db.find({
+      collection: VERSIONS,
+      where: { and: this.of(parent, doc) },
+      sort: ["-id"],
+      limit: 0,
+      page: 1
+    });
+    for (const row of rows.docs.slice(max)) {
+      await this.db.delete({ collection: VERSIONS, id: row.id });
+    }
+  }
+  of(parent, doc) {
+    return [{ parent: { equals: parent } }, { doc: { equals: doc } }];
+  }
+  toVersion(row) {
+    return { ...toSummary(row), data: row.snapshot ?? {} };
+  }
+};
+
+// src/roles.ts
+var ROLE_OPERATIONS = ["read", "create", "update", "delete", "publish"];
+var GLOBAL_OPERATIONS = ["read", "update", "publish"];
+var KEY = /^[a-z][a-z0-9-]{0,31}$/;
+var HISTORY = 50;
+var TTL = 3e4;
+var rolesCollection = {
+  slug: ROLES,
+  access: { read: () => false, create: () => false, update: () => false, delete: () => false },
+  fields: [
+    { name: "key", type: "text", required: true, unique: true },
+    { name: "name", type: "text" },
+    { name: "permissions", type: "json" }
+  ]
+};
+function governed(slug2) {
+  return !INTERNAL_COLLECTIONS.has(slug2) && slug2 !== API_KEYS;
+}
+function references(fields, out = /* @__PURE__ */ new Set()) {
+  for (const field of fields) {
+    if (field.type === "relationship") out.add(field.to);
+    else if (field.type === "upload") out.add("media");
+    else if (field.type === "group" || field.type === "array") references(field.fields, out);
+    else if (field.type === "blocks") for (const b of field.blocks) references(b.fields, out);
+  }
+  return out;
+}
+var viewId = {
+  page: (path) => `page:${path}`,
+  widget: (tag) => `widget:${tag}`
+};
+var tagOf = (component) => typeof component === "string" ? component : component.tag;
+var Roles = class {
+  constructor(config, db) {
+    this.config = config;
+    this.db = db;
+    this.enabled = config.auth.rbac;
+    this.versions = new VersionStore(db);
+  }
+  config;
+  db;
+  enabled;
+  versions;
+  cache;
+  synced;
+  /**
+   * Whether the user's role allows an operation: `true`, `false`, or for their own account
+   * (users without read or update on `users`) a constraint to it.
+   */
+  async allows(user, target, operation) {
+    if (!this.enabled || !user || user.role === "admin") return true;
+    if ("collection" in target && !governed(target.collection)) return true;
+    const permissions = await this.permissionsOf(user.role);
+    const ops = "collection" in target ? permissions.collections?.[target.collection] : permissions.globals?.[target.global];
+    if (ops?.includes(operation)) return true;
+    if ("collection" in target && target.collection === USERS) {
+      if (operation === "read" || operation === "update") return { id: { equals: user.id } };
+    }
+    return false;
+  }
+  /**
+   * Whether the user may open an admin page: admins always; with roles, those whose role has
+   * it; without roles, nobody else (`status`, `deliveries`) or everybody (plugin pages).
+   */
+  async canView(user, id) {
+    if (user.role === "admin" && !user.apiKey) return true;
+    if (user.apiKey) return false;
+    if (!this.enabled) return id.startsWith("page:") || id.startsWith("widget:");
+    return (await this.permissionsOf(user.role)).admin?.includes(id) ?? false;
+  }
+  /** Forgets cached permissions, after a role changed. */
+  invalidate() {
+    this.cache = void 0;
+  }
+  /**
+   * Adds the roles of `auth.roles` that are missing; on the first start, gives them everything.
+   * Runs once, on first use (not on startup: `easy-cms migrate` opens the CMS before the table exists).
+   */
+  sync() {
+    this.synced ??= this.addMissing().catch((error) => {
+      this.synced = void 0;
+      throw error;
+    });
+    return this.synced;
+  }
+  async addMissing() {
+    if (!this.enabled) return;
+    const rows = await this.rows();
+    const first = rows.length === 0;
+    const known = new Set(rows.map((r) => String(r.key)));
+    for (const key2 of this.config.auth.roles) {
+      if (known.has(key2)) continue;
+      try {
+        await this.insert(key2, "", first && key2 !== "admin" ? this.everything() : {}, null);
+      } catch (error) {
+        if (!(await this.rows()).some((r) => r.key === key2)) throw error;
+      }
+    }
+    this.invalidate();
+  }
+  /** Whether a role exists (users can only be given existing roles). */
+  async exists(key2) {
+    if (!this.enabled) return this.config.auth.roles.includes(key2);
+    return (await this.load()).has(key2);
+  }
+  /** Roles a user can be given, those of `auth.roles` first; `name` may be empty. */
+  async options() {
+    if (!this.enabled) return this.config.auth.roles.map((key2) => ({ key: key2, name: "" }));
+    await this.sync();
+    return (await this.rows()).map((row) => ({ key: String(row.key), name: typeof row.name === "string" ? row.name : "" })).sort((a, b) => rank(a, this.config) - rank(b, this.config) || a.key.localeCompare(b.key));
+  }
+  // --- Settings → Roles ----------------------------------------------------
+  async list() {
+    await this.sync();
+    const rows = await this.rows();
+    const counts = /* @__PURE__ */ new Map();
+    for (const row of rows) {
+      counts.set(
+        String(row.key),
+        await this.db.count({ collection: USERS, where: { role: { equals: row.key } } })
+      );
+    }
+    const roles = rows.map((row) => this.toRole(row, counts.get(String(row.key)) ?? 0)).sort((a, b) => rank(a, this.config) - rank(b, this.config) || a.key.localeCompare(b.key));
+    const decided = roles.filter((r) => r.key !== "admin").map((r) => r.permissions);
+    const seen = (group, slug2) => decided.some((p) => p[group]?.[slug2] !== void 0);
+    return {
+      roles,
+      collections: this.config.collections.filter((c) => governed(c.slug)).map((c) => ({
+        slug: c.slug,
+        ops: ROLE_OPERATIONS.filter((op) => op !== "publish" || c.drafts === true),
+        new: !seen("collections", c.slug),
+        references: [...references(c.fields)].filter((s) => s !== c.slug && governed(s))
+      })),
+      globals: this.config.globals.map((g) => ({
+        slug: g.slug,
+        ops: GLOBAL_OPERATIONS.filter((op) => op !== "publish" || g.drafts === true),
+        new: !seen("globals", g.slug)
+      })),
+      views: this.views()
+    };
+  }
+  async create(input, author) {
+    await this.sync();
+    const key2 = typeof input.key === "string" ? input.key.trim() : "";
+    if (!KEY.test(key2)) {
+      throw new ValidationError(ROLES, [
+        { field: "key", message: 'lowercase letters, digits and "-", starting with a letter' }
+      ]);
+    }
+    if ((await this.rows()).some((r) => r.key === key2))
+      throw new ValidationError(ROLES, [{ field: "key", message: "is already used" }]);
+    const row = await this.insert(
+      key2,
+      this.cleanName(input.name),
+      this.clean(input.permissions),
+      author.id
+    );
+    return this.toRole(row, 0);
+  }
+  async update(id, input, author) {
+    const row = await this.row(id);
+    const data = { ...row, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    if (input.name !== void 0) data.name = this.cleanName(input.name);
+    if (input.permissions !== void 0) {
+      if (row.key === "admin")
+        throw new EasyCMSError("Admins may always do everything; their role cannot be changed", 400);
+      data.permissions = this.clean(input.permissions);
+    }
+    const { id: _id, ...rest } = data;
+    const saved = await this.db.update({ collection: ROLES, id: row.id, data: rest });
+    await this.record(saved, author.id);
+    this.invalidate();
+    return this.toRole(saved, await this.users(String(row.key)));
+  }
+  async delete(id) {
+    const row = await this.row(id);
+    const key2 = String(row.key);
+    if (this.config.auth.roles.includes(key2))
+      throw new EasyCMSError(`"${key2}" is in auth.roles and cannot be deleted`, 400);
+    const users = await this.users(key2);
+    if (users > 0)
+      throw new EasyCMSError(`${users} user(s) have this role; give them another role first`, 409);
+    await this.db.delete({ collection: ROLES, id: row.id });
+    await this.versions.deleteAll(ROLES, row.id);
+    this.invalidate();
+  }
+  async history(id) {
+    const row = await this.row(id);
+    const list = await this.versions.list(ROLES, row.id, HISTORY, 1);
+    const emails = /* @__PURE__ */ new Map();
+    const out = [];
+    for (const summary of list.docs) {
+      const version = await this.versions.get(ROLES, row.id, summary.id);
+      if (!version) continue;
+      let author = null;
+      if (summary.author !== null) {
+        const k = String(summary.author);
+        if (!emails.has(k)) {
+          const user = await this.db.findById({ collection: USERS, id: summary.author });
+          emails.set(k, typeof user?.email === "string" ? user.email : null);
+        }
+        author = emails.get(k) ?? null;
+      }
+      out.push({
+        id: summary.id,
+        author,
+        createdAt: summary.createdAt,
+        name: String(version.data.name ?? ""),
+        permissions: version.data.permissions ?? {}
+      });
+    }
+    return out;
+  }
+  // -------------------------------------------------------------------------
+  /** Pages and panels roles can be given. */
+  views() {
+    return [
+      { id: "status" },
+      ...this.config.collections.some(
+        (c) => c.slug === WEBHOOK_DELIVERIES || c.slug === EMAIL_DELIVERIES
+      ) ? [{ id: "deliveries" }] : [],
+      ...this.config.admin.pages.map((page) => ({ id: viewId.page(page.path), label: page.label })),
+      ...this.config.admin.dashboard.map((widget) => ({
+        id: viewId.widget(tagOf(widget.component)),
+        ...widget.label !== void 0 ? { label: widget.label } : {}
+      }))
+    ];
+  }
+  /** Every collection and global, and the plugin pages and panels: what roles had before roles. */
+  everything() {
+    const collections = {};
+    for (const c of this.config.collections) {
+      if (governed(c.slug))
+        collections[c.slug] = ROLE_OPERATIONS.filter((op) => op !== "publish" || c.drafts === true);
+    }
+    const globals = {};
+    for (const g of this.config.globals)
+      globals[g.slug] = GLOBAL_OPERATIONS.filter((op) => op !== "publish" || g.drafts === true);
+    const admin = this.views().map((v) => v.id).filter((id) => id.startsWith("page:") || id.startsWith("widget:"));
+    return { collections, globals, admin };
+  }
+  /** Keeps only known collections, globals, operations and pages; `read` comes with the others. */
+  clean(value) {
+    const input = typeof value === "object" && value !== null ? value : {};
+    const pick = (group, allowed2) => {
+      const out = {};
+      if (typeof group !== "object" || group === null) return out;
+      for (const [slug2, ops] of Object.entries(group)) {
+        const valid = allowed2.get(slug2);
+        if (!valid || !Array.isArray(ops)) continue;
+        const picked = valid.filter((op) => ops.includes(op));
+        if (picked.length > 0 && !picked.includes("read")) picked.unshift("read");
+        out[slug2] = picked;
+      }
+      return out;
+    };
+    const collections = new Map(
+      this.config.collections.filter((c) => governed(c.slug)).map((c) => [
+        c.slug,
+        ROLE_OPERATIONS.filter((op) => op !== "publish" || c.drafts === true)
+      ])
+    );
+    const globals = new Map(
+      this.config.globals.map((g) => [
+        g.slug,
+        GLOBAL_OPERATIONS.filter((op) => op !== "publish" || g.drafts === true)
+      ])
+    );
+    const views = new Set(this.views().map((v) => v.id));
+    const admin = Array.isArray(input.admin) ? [
+      ...new Set(
+        input.admin.filter((id) => typeof id === "string" && views.has(id))
+      )
+    ] : [];
+    return {
+      collections: pick(input.collections, collections),
+      globals: pick(input.globals, globals),
+      admin
+    };
+  }
+  cleanName(value) {
+    if (value === void 0 || value === null) return "";
+    if (typeof value !== "string" || value.trim().length > 60)
+      throw new ValidationError(ROLES, [
+        { field: "name", message: "must be at most 60 characters" }
+      ]);
+    return value.trim();
+  }
+  async permissionsOf(key2) {
+    return (await this.load()).get(key2) ?? {};
+  }
+  async load() {
+    if (this.cache && Date.now() - this.cache.at < TTL) return this.cache.byKey;
+    await this.sync();
+    const byKey = /* @__PURE__ */ new Map();
+    for (const row of await this.rows())
+      byKey.set(String(row.key), row.permissions ?? {});
+    this.cache = { at: Date.now(), byKey };
+    return byKey;
+  }
+  async rows() {
+    return (await this.db.find({ collection: ROLES, sort: ["id"], limit: 0, page: 1 })).docs;
+  }
+  async row(id) {
+    const row = await this.db.findById({ collection: ROLES, id });
+    if (!row) throw new NotFoundError(ROLES, id);
+    return row;
+  }
+  users(key2) {
+    return this.db.count({ collection: USERS, where: { role: { equals: key2 } } });
+  }
+  async insert(key2, name, permissions, author) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const row = await this.db.create({
+      collection: ROLES,
+      data: { key: key2, name, permissions, createdAt: now, updatedAt: now }
+    });
+    await this.record(row, author);
+    this.invalidate();
+    return row;
+  }
+  /** Keeps the role as saved, for its history. */
+  async record(row, author) {
+    await this.versions.save({
+      parent: ROLES,
+      doc: row.id,
+      status: null,
+      snapshot: { name: row.name ?? "", permissions: row.permissions ?? {} },
+      author,
+      max: HISTORY
+    });
+  }
+  toRole(row, users) {
+    const key2 = String(row.key);
+    return {
+      id: row.id,
+      key: key2,
+      name: typeof row.name === "string" ? row.name : "",
+      system: this.config.auth.roles.includes(key2),
+      users,
+      permissions: row.permissions ?? {},
+      updatedAt: String(row.updatedAt)
+    };
+  }
+};
+function rank(role, config) {
+  const index = config.auth.roles.indexOf(role.key);
+  return index === -1 ? config.auth.roles.length : index;
 }
 
-// src/load-config.ts
-import { existsSync } from "fs";
-import { resolve } from "path";
-import { createJiti } from "jiti";
-
 // src/webhooks.ts
 import { createHmac as createHmac2, randomUUID as randomUUID2 } from "crypto";
 var WEBHOOK_EVENTS = [
@@ -1994,6 +2849,9 @@ var RESERVED_SLUGS = /* @__PURE__ */ new Set([
   "document-versions",
   "scheduled-jobs",
   "webhook-deliveries",
+  "email-deliveries",
+  "database-backups",
+  "user-roles",
   "api-keys",
   "jobs",
   "migrations",
@@ -2016,6 +2874,7 @@ function validateConfig(config) {
   validateAdmin(config, add);
   validateAdminViews(config, add);
   validateUpload(config, add);
+  validateBackups(config, add);
   validateAuth(config, add);
   validateCors(config.cors, add);
   validateLocalization(config, add);
@@ -2025,17 +2884,17 @@ function validateConfig(config) {
   const collectionSlugs = /* @__PURE__ */ new Set([...BUILTIN_COLLECTIONS]);
   const seenCollections = /* @__PURE__ */ new Set();
   collections.forEach((collection2, i) => {
-    const slug = checkSlug(collection2, `collections[${i}]`, seenCollections, add);
-    if (slug) collectionSlugs.add(slug);
+    const slug2 = checkSlug(collection2, `collections[${i}]`, seenCollections, add);
+    if (slug2) collectionSlugs.add(slug2);
   });
   const menu = config.admin?.menu;
   if (menu !== void 0) {
     if (!Array.isArray(menu)) {
       add("admin.menu", "must be an array of collection slugs", "e.g. menu: ['posts', 'media']");
     } else {
-      for (const [i, slug] of menu.entries()) {
-        if (typeof slug !== "string" || !collectionSlugs.has(slug))
-          add(`admin.menu[${i}]`, `unknown collection ${JSON.stringify(slug)}`);
+      for (const [i, slug2] of menu.entries()) {
+        if (typeof slug2 !== "string" || !collectionSlugs.has(slug2))
+          add(`admin.menu[${i}]`, `unknown collection ${JSON.stringify(slug2)}`);
       }
     }
   }
@@ -2197,6 +3056,7 @@ function validateAdminViews(config, add) {
         "e.g. dashboard: [{ component: 'ecms-stats-widget' }]"
       );
     } else {
+      const tags = /* @__PURE__ */ new Set();
       widgets2.forEach((widget, i) => {
         const path = `admin.dashboard[${i}]`;
         if (typeof widget !== "object" || widget === null) {
@@ -2207,6 +3067,19 @@ function validateAdminViews(config, add) {
         validateComponent(w.component, `${path}.component`, add);
         if (w.width !== void 0 && w.width !== "half" && w.width !== "full")
           add(`${path}.width`, 'must be "half" or "full"');
+        if (w.label !== void 0 && !(typeof w.label === "string" && w.label.trim() !== "") && !(typeof w.label === "object" && w.label !== null && !Array.isArray(w.label)))
+          add(`${path}.label`, "must be a string or { en, th }");
+        const component = w.component;
+        const tag = typeof component === "string" ? component : component?.tag;
+        if (config.auth?.rbac === true && typeof tag === "string") {
+          if (tags.has(tag))
+            add(
+              `${path}.component`,
+              `another panel uses "${tag}"`,
+              "with auth.rbac, roles are given panels by their tag: use one tag per panel"
+            );
+          tags.add(tag);
+        }
         access(w.access, path);
       });
     }
@@ -2220,6 +3093,8 @@ function validateIcon(container, path, add) {
 function validateAuth(config, add) {
   const auth = config.auth;
   if (auth === void 0) return;
+  if (auth.rbac !== void 0 && typeof auth.rbac !== "boolean")
+    add("auth.rbac", "must be true or false");
   if (auth.roles !== void 0) {
     const roles = auth.roles;
     if (!Array.isArray(roles) || roles.some((r) => typeof r !== "string" || r === "")) {
@@ -2376,10 +3251,10 @@ function validateWebhooks(config, add) {
       if (!WEBHOOK_EVENTS.includes(event))
         add(`${path}.events`, `unknown event "${event}"`, `use: ${WEBHOOK_EVENTS.join(", ")}`);
     }
-    for (const slug of hook?.collections ?? [])
-      if (!collections.has(slug)) add(`${path}.collections`, `unknown collection "${slug}"`);
-    for (const slug of hook?.globals ?? [])
-      if (!globals.has(slug)) add(`${path}.globals`, `unknown global "${slug}"`);
+    for (const slug2 of hook?.collections ?? [])
+      if (!collections.has(slug2)) add(`${path}.collections`, `unknown collection "${slug2}"`);
+    for (const slug2 of hook?.globals ?? [])
+      if (!globals.has(slug2)) add(`${path}.globals`, `unknown global "${slug2}"`);
   }
 }
 function validateCors(cors, add) {
@@ -2432,6 +3307,32 @@ function validateUpload(config, add) {
     add("upload.fromURL.allowPrivate", "must be true or false");
 }
 var HOST_PATTERN = /^(\*|(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*)$/i;
+function validateBackups(config, add) {
+  const backups = config.backups;
+  if (backups === void 0) return;
+  if (typeof backups !== "object" || backups === null) {
+    add("backups", "must be an object", "e.g. backups: { every: 'day', keep: 7 }");
+    return;
+  }
+  const { every, at, keep, dir, storage, sqlite } = backups;
+  if (every !== void 0 && every !== "day" && every !== "week")
+    add("backups.every", 'must be "day" or "week"');
+  if (at !== void 0 && (typeof at !== "string" || !/^([01]\d|2[0-3]):[0-5]\d$/.test(at)))
+    add("backups.at", 'must be a time like "03:00"');
+  if (keep !== void 0 && !(Number.isInteger(keep) && keep >= 1))
+    add("backups.keep", "must be a whole number, 1 or more");
+  if (dir !== void 0 && (typeof dir !== "string" || dir.trim() === ""))
+    add("backups.dir", "must be a folder name");
+  if (typeof dir === "string" && dir.replace(/^\.\//, "").replace(/\/+$/, "") === (config.upload?.dir ?? "uploads").replace(/^\.\//, "").replace(/\/+$/, ""))
+    add("backups.dir", "must not be the uploads folder: uploads are served publicly");
+  if (storage !== void 0 && (typeof storage !== "object" || storage === null || typeof storage.put !== "function"))
+    add("backups.storage", "must be a storage adapter, e.g. s3Storage()");
+  if (sqlite !== void 0 && typeof sqlite !== "function")
+    add(
+      "backups.sqlite",
+      "must be the sqlite adapter, e.g. import { sqlite } from '@easy-cms/db-sqlite'"
+    );
+}
 function asArray(value, path, add) {
   if (value === void 0) return [];
   if (!Array.isArray(value)) {
@@ -2441,24 +3342,24 @@ function asArray(value, path, add) {
   return value;
 }
 function checkSlug(container, path, seen, add) {
-  const slug = container.slug;
-  if (typeof slug !== "string" || !SLUG_PATTERN.test(slug)) {
+  const slug2 = container.slug;
+  if (typeof slug2 !== "string" || !SLUG_PATTERN.test(slug2)) {
     add(
       `${path}.slug`,
-      `must be lowercase letters, digits, "-" or "_", starting with a letter (got ${JSON.stringify(slug)})`
+      `must be lowercase letters, digits, "-" or "_", starting with a letter (got ${JSON.stringify(slug2)})`
     );
     return void 0;
   }
-  if (RESERVED_SLUGS.has(slug)) {
-    add(`${path}.slug`, `"${slug}" is reserved by Easy CMS`, "choose another slug");
+  if (RESERVED_SLUGS.has(slug2)) {
+    add(`${path}.slug`, `"${slug2}" is reserved by Easy CMS`, "choose another slug");
     return void 0;
   }
-  if (seen.has(slug)) {
-    add(`${path}.slug`, `duplicate slug "${slug}"`);
+  if (seen.has(slug2)) {
+    add(`${path}.slug`, `duplicate slug "${slug2}"`);
     return void 0;
   }
-  seen.add(slug);
-  return slug;
+  seen.add(slug2);
+  return slug2;
 }
 function validateContainer(container, path, collectionSlugs, add) {
   if (!Array.isArray(container.fields)) {
@@ -2888,6 +3789,7 @@ async function resolveConfig(input) {
     },
     auth: {
       roles: config.auth?.roles ?? DEFAULT_ROLES,
+      rbac: config.auth?.rbac === true,
       tokenExpiration: config.auth?.tokenExpiration ?? DEFAULT_TOKEN_EXPIRATION,
       maxLoginAttempts: config.auth?.maxLoginAttempts ?? 5,
       lockWindow: config.auth?.lockWindow ?? 15 * 60,
@@ -2899,11 +3801,14 @@ async function resolveConfig(input) {
     collections: [
       ...config.collections ?? [],
       ...internalCollections,
-      ...usesVersions(config) ? [versionsCollection] : [],
+      // Roles keep their history as versions.
+      ...usesVersions(config) || config.auth?.rbac ? [versionsCollection] : [],
       ...usesSchedule(config) ? [scheduledJobsCollection] : [],
       ...(config.webhooks?.length ?? 0) > 0 ? [webhookDeliveriesCollection] : [],
       ...config.apiKeys ? [apiKeysCollection] : [],
-      ...config.email ? [emailDeliveriesCollection] : []
+      ...config.email ? [emailDeliveriesCollection] : [],
+      databaseBackupsCollection,
+      ...config.auth?.rbac ? [rolesCollection] : []
     ],
     globals: config.globals ?? [],
     endpoints: config.endpoints ?? [],
@@ -2932,7 +3837,7 @@ var CONFIG_FILE_NAMES = [
 ];
 function findConfigFile(cwd = process.cwd()) {
   for (const name of CONFIG_FILE_NAMES) {
-    const path = resolve(
+    const path = resolve2(
       /* turbopackIgnore: true */
       cwd,
       name
@@ -2951,7 +3856,7 @@ async function importConfig(file) {
 }
 async function loadConfig(options = {}) {
   const cwd = options.cwd ?? process.cwd();
-  const file = options.configFile ? resolve(cwd, options.configFile) : findConfigFile(cwd);
+  const file = options.configFile ? resolve2(cwd, options.configFile) : findConfigFile(cwd);
   if (!file || !existsSync(file)) {
     const looked = options.configFile ?? CONFIG_FILE_NAMES.join(", ");
     throw new Error(
@@ -3190,12 +4095,12 @@ async function populate(load, collections, fields, docs, depth) {
   }
   const found = /* @__PURE__ */ new Map();
   await Promise.all(
-    [...wanted].map(async ([slug, ids]) => {
-      const collection2 = bySlug.get(slug);
+    [...wanted].map(async ([slug2, ids]) => {
+      const collection2 = bySlug.get(slug2);
       if (!collection2) return;
       const raw = await load(collection2, [...ids]);
       const populated = await populate(load, collections, collection2.fields, raw, depth - 1);
-      found.set(slug, new Map(populated.map((d) => [d.id, d])));
+      found.set(slug2, new Map(populated.map((d) => [d.id, d])));
     })
   );
   for (const slot of slots) slot.assign(found.get(slot.collection) ?? /* @__PURE__ */ new Map());
@@ -3448,181 +4353,6 @@ function read(response, maxBytes, deadline) {
   });
 }
 
-// src/storage.ts
-import { mkdir, readFile, rm, stat, writeFile } from "fs/promises";
-import { dirname, isAbsolute, join, normalize, resolve as resolve2, sep } from "path";
-function localStorage(options = {}) {
-  let root = resolve2(
-    /* turbopackIgnore: true */
-    options.dir ?? "uploads"
-  );
-  const pathOf = (key2) => {
-    const path = normalize(join(
-      /* turbopackIgnore: true */
-      root,
-      key2
-    ));
-    if (!path.startsWith(root + sep)) throw new Error(`Invalid storage key "${key2}"`);
-    return path;
-  };
-  return {
-    name: "local",
-    init({ cwd }) {
-      const dir = options.dir ?? "uploads";
-      root = isAbsolute(dir) ? dir : resolve2(
-        /* turbopackIgnore: true */
-        cwd,
-        dir
-      );
-    },
-    async put(key2, data) {
-      const path = pathOf(key2);
-      await mkdir(dirname(path), { recursive: true });
-      await writeFile(path, data, { flag: "wx" });
-    },
-    async get(key2) {
-      const path = pathOf(key2);
-      const info = await stat(path).catch(() => void 0);
-      if (!info?.isFile()) return null;
-      return { body: new Uint8Array(await readFile(path)), size: info.size };
-    },
-    async delete(key2) {
-      await rm(pathOf(key2), { force: true });
-    }
-  };
-}
-
-// src/versions.ts
-var DEFAULT_MAX_VERSIONS = 50;
-function versionLimit(config) {
-  const versions = config.versions;
-  if (!versions) return void 0;
-  return versions === true ? DEFAULT_MAX_VERSIONS : versions.max ?? DEFAULT_MAX_VERSIONS;
-}
-var collectionParent = (slug) => slug;
-var globalParent = (slug) => `global:${slug}`;
-function snapshotOf(fields, doc) {
-  const hidden = new Set(fields.filter((f) => f.hidden).map((f) => f.name));
-  const snapshot = {};
-  for (const [key2, value] of Object.entries(doc)) {
-    if (key2 === "id" || key2 === "createdAt" || key2 === "updatedAt" || hidden.has(key2)) continue;
-    snapshot[key2] = value;
-  }
-  return snapshot;
-}
-var toSummary = (row) => ({
-  id: row.id,
-  status: row.status ?? null,
-  latest: row.latest === true,
-  author: row.author ?? null,
-  createdAt: String(row.createdAt)
-});
-var VersionStore = class {
-  constructor(db) {
-    this.db = db;
-  }
-  db;
-  /** Saves a new latest version and deletes the oldest beyond `max`. */
-  async save(args) {
-    const { parent, doc } = args;
-    const previous = await this.db.find({
-      collection: VERSIONS,
-      where: { and: [...this.of(parent, doc), { latest: { equals: true } }] },
-      sort: [],
-      limit: 0,
-      page: 1
-    });
-    for (const row of previous.docs) {
-      await this.db.update({ collection: VERSIONS, id: row.id, data: { ...row, latest: false } });
-    }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const created = await this.db.create({
-      collection: VERSIONS,
-      data: {
-        parent,
-        doc,
-        status: args.status,
-        latest: true,
-        author: args.author,
-        snapshot: args.snapshot,
-        createdAt: now,
-        updatedAt: now
-      }
-    });
-    await this.prune(parent, doc, args.max);
-    return toSummary(created);
-  }
-  /** The latest version of each document, keyed by document id. */
-  async latest(parent, docs) {
-    const result = /* @__PURE__ */ new Map();
-    if (docs.length === 0) return result;
-    const rows = await this.db.find({
-      collection: VERSIONS,
-      where: {
-        and: [
-          { parent: { equals: parent } },
-          { doc: { in: [...docs] } },
-          { latest: { equals: true } }
-        ]
-      },
-      sort: [],
-      limit: 0,
-      page: 1
-    });
-    for (const row of rows.docs) result.set(String(row.doc), this.toVersion(row));
-    return result;
-  }
-  async list(parent, doc, limit, page) {
-    const found = await this.db.find({
-      collection: VERSIONS,
-      where: { and: this.of(parent, doc) },
-      sort: ["-id"],
-      limit,
-      page
-    });
-    return { ...found, docs: found.docs.map(toSummary) };
-  }
-  async get(parent, doc, id) {
-    const found = await this.db.find({
-      collection: VERSIONS,
-      where: { and: [...this.of(parent, doc), { id: { equals: id } }] },
-      sort: [],
-      limit: 1,
-      page: 1
-    });
-    const row = found.docs[0];
-    return row ? this.toVersion(row) : null;
-  }
-  async deleteAll(parent, doc) {
-    const rows = await this.db.find({
-      collection: VERSIONS,
-      where: { and: this.of(parent, doc) },
-      sort: [],
-      limit: 0,
-      page: 1
-    });
-    for (const row of rows.docs) await this.db.delete({ collection: VERSIONS, id: row.id });
-  }
-  async prune(parent, doc, max) {
-    const rows = await this.db.find({
-      collection: VERSIONS,
-      where: { and: this.of(parent, doc) },
-      sort: ["-id"],
-      limit: 0,
-      page: 1
-    });
-    for (const row of rows.docs.slice(max)) {
-      await this.db.delete({ collection: VERSIONS, id: row.id });
-    }
-  }
-  of(parent, doc) {
-    return [{ parent: { equals: parent } }, { doc: { equals: doc } }];
-  }
-  toVersion(row) {
-    return { ...toSummary(row), data: row.snapshot ?? {} };
-  }
-};
-
 // src/local-api.ts
 async function createEasyCMS(config, options = {}) {
   const resolved3 = await resolveConfig(config);
@@ -3660,6 +4390,8 @@ var EasyCMS = class {
   storage;
   /** Project root: relative paths in the config (e.g. `admin.modules`) start here. */
   cwd;
+  /** Roles and their permissions (`auth.rbac`, Settings → Roles). */
+  roles;
   versions;
   webhooks;
   mailer;
@@ -3670,6 +4402,7 @@ var EasyCMS = class {
     this.storage = storage;
     this.cwd = cwd;
     this.versions = new VersionStore(db);
+    this.roles = new Roles(config, db);
     this.webhooks = new Webhooks(
       config.webhooks ?? [],
       logger,
@@ -3760,7 +4493,7 @@ var EasyCMS = class {
     const config = this.collection(MEDIA);
     const guard = guardOf(options);
     if (guard.enforce) {
-      this.checkKey(guard, { collection: MEDIA }, "create");
+      await this.checkGrant(guard, { collection: MEDIA }, "create");
       const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data });
       if (allowed2 !== true) throw deny(guard.user);
     }
@@ -3820,7 +4553,7 @@ var EasyCMS = class {
     const guard = guardOf(options);
     const fromURL = this.config.upload.fromURL;
     if (guard.enforce) {
-      this.checkKey(guard, { collection: MEDIA }, "create");
+      await this.checkGrant(guard, { collection: MEDIA }, "create");
       const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data });
       if (allowed2 !== true) throw deny(guard.user);
       if (!fromURL)
@@ -3975,7 +4708,7 @@ var EasyCMS = class {
     let parsed;
     if (id === null) {
       if (guard.enforce) {
-        this.checkKey(guard, { collection: collection2 }, "create");
+        await this.checkGrant(guard, { collection: collection2 }, "create");
         const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data: raw });
         if (allowed2 !== true) throw deny(guard.user);
       }
@@ -4022,17 +4755,17 @@ var EasyCMS = class {
     return token ? verifyPreviewToken(this.config.secret, token) : null;
   }
   /** Live preview of a global. See `preview`. */
-  async previewGlobal(slug, data, options = {}) {
-    const config = this.global(slug);
+  async previewGlobal(slug2, data, options = {}) {
+    const config = this.global(slug2);
     const guard = guardOf(options);
     await this.checkGlobalAccess(config, "update", guard);
-    const raw = asObject(data, slug);
+    const raw = asObject(data, slug2);
     const input = await filterInput(
       config.fields,
       raw,
       this.fieldChecker("update", guard, void 0, raw)
     );
-    const saved = await this.db.findGlobal({ slug }) ?? {};
+    const saved = await this.db.findGlobal({ slug: slug2 }) ?? {};
     const current = await this.globalDraft(config, saved);
     const merged = generateSlugs(
       config.fields,
@@ -4095,7 +4828,7 @@ var EasyCMS = class {
     if (!existing || parsed === void 0) throw new NotFoundError(collection2, id);
     await this.checkDocumentAccess(config, "update", guard, parsed, raw);
     if (config.drafts && (mode === "unpublish" || raw.status === "published"))
-      this.checkKey(guard, { collection: collection2 }, "publish");
+      await this.checkGrant(guard, { collection: collection2 }, "publish");
     const [drafted] = await this.withDrafts(config, [existing]);
     const live = options.live === true && mode === "save";
     const current = live ? existing : drafted;
@@ -4202,11 +4935,11 @@ var EasyCMS = class {
     const [out] = await this.output(config, [existing], guard, { depth: 0, draft: true });
     return out;
   }
-  async findGlobal(slug, options = {}) {
-    const config = this.global(slug);
+  async findGlobal(slug2, options = {}) {
+    const config = this.global(slug2);
     const guard = guardOf(options);
     await this.checkGlobalAccess(config, "read", guard);
-    const saved = await this.db.findGlobal({ slug });
+    const saved = await this.db.findGlobal({ slug: slug2 });
     const stored = saved && options.draft ? await this.globalDraft(config, saved) : saved;
     const data = fillMissing(
       config.fields,
@@ -4220,33 +4953,33 @@ var EasyCMS = class {
     const { id: _id, ...doc } = out;
     return doc;
   }
-  async updateGlobal(slug, data, options = {}) {
-    return this.saveGlobal(slug, asObject(data, slug), options);
+  async updateGlobal(slug2, data, options = {}) {
+    return this.saveGlobal(slug2, asObject(data, slug2), options);
   }
   /** Takes a global off the site (`status: 'draft'`). See `unpublish`. */
-  async unpublishGlobal(slug, options = {}) {
-    if (!this.global(slug).drafts) throw new QueryError(`"${slug}" has no drafts`);
-    return this.saveGlobal(slug, { status: "draft" }, options, "unpublish");
+  async unpublishGlobal(slug2, options = {}) {
+    if (!this.global(slug2).drafts) throw new QueryError(`"${slug2}" has no drafts`);
+    return this.saveGlobal(slug2, { status: "draft" }, options, "unpublish");
   }
   /** Throws away the unpublished draft of a published global. */
-  async discardGlobalDraft(slug, options = {}) {
-    const config = this.global(slug);
+  async discardGlobalDraft(slug2, options = {}) {
+    const config = this.global(slug2);
     const guard = guardOf(options);
     await this.checkGlobalAccess(config, "update", guard);
-    const saved = await this.db.findGlobal({ slug });
+    const saved = await this.db.findGlobal({ slug: slug2 });
     if (saved && await this.globalDraft(config, saved) !== saved) {
-      await this.saveVersion(config, globalParent(slug), 0, saved, guard);
+      await this.saveVersion(config, globalParent(slug2), 0, saved, guard);
     }
-    return this.findGlobal(slug, { ...options, draft: true });
+    return this.findGlobal(slug2, { ...options, draft: true });
   }
   /** Saved versions of a global, newest first. Needs update access. */
-  async findGlobalVersions(slug, options = {}) {
-    await this.globalVersionTarget(slug, options);
-    return this.versions.list(globalParent(slug), 0, options.limit ?? 20, options.page ?? 1);
+  async findGlobalVersions(slug2, options = {}) {
+    await this.globalVersionTarget(slug2, options);
+    return this.versions.list(globalParent(slug2), 0, options.limit ?? 20, options.page ?? 1);
   }
-  async findGlobalVersion(slug, versionId, options = {}) {
-    const config = await this.globalVersionTarget(slug, options);
-    const version = await this.versions.get(globalParent(slug), 0, versionId);
+  async findGlobalVersion(slug2, versionId, options = {}) {
+    const config = await this.globalVersionTarget(slug2, options);
+    const version = await this.versions.get(globalParent(slug2), 0, versionId);
     if (!version) return null;
     const data = fillMissing(
       config.fields,
@@ -4260,21 +4993,21 @@ var EasyCMS = class {
     return { ...version, data: { ...doc, updatedAt: version.createdAt } };
   }
   /** Makes an old version of a global current (as a draft when the global has drafts). */
-  async restoreGlobalVersion(slug, versionId, options = {}) {
-    const config = await this.globalVersionTarget(slug, options);
-    const version = await this.versions.get(globalParent(slug), 0, versionId);
-    if (!version) throw new NotFoundError(`${slug} version`, versionId);
+  async restoreGlobalVersion(slug2, versionId, options = {}) {
+    const config = await this.globalVersionTarget(slug2, options);
+    const version = await this.versions.get(globalParent(slug2), 0, versionId);
+    if (!version) throw new NotFoundError(`${slug2} version`, versionId);
     const { status: _status, ...data } = version.data;
     return this.saveGlobal(
-      slug,
+      slug2,
       config.drafts ? { ...data, status: "draft" } : data,
       options,
       "restore"
     );
   }
-  async globalVersionTarget(slug, options) {
-    const config = this.global(slug);
-    if (!versionLimit(config)) throw new QueryError(`"${slug}" has no versions`);
+  async globalVersionTarget(slug2, options) {
+    const config = this.global(slug2);
+    if (!versionLimit(config)) throw new QueryError(`"${slug2}" has no versions`);
     await this.checkGlobalAccess(config, "update", guardOf(options));
     return config;
   }
@@ -4285,18 +5018,18 @@ var EasyCMS = class {
     if (version?.status !== "draft") return saved;
     return { ...version.data, updatedAt: version.createdAt, status: "draft" };
   }
-  async saveGlobal(slug, raw, options, mode = "save") {
-    const config = this.global(slug);
+  async saveGlobal(slug2, raw, options, mode = "save") {
+    const config = this.global(slug2);
     const guard = guardOf(options);
     await this.checkGlobalAccess(config, "update", guard);
     if (config.drafts && (mode === "unpublish" || raw.status === "published"))
-      this.checkKey(guard, { global: slug }, "publish");
+      await this.checkGrant(guard, { global: slug2 }, "publish");
     const input = await filterInput(
       config.fields,
       raw,
       this.fieldChecker("update", guard, void 0, raw)
     );
-    const existing = await this.db.findGlobal({ slug }) ?? {};
+    const existing = await this.db.findGlobal({ slug: slug2 }) ?? {};
     const current = await this.globalDraft(config, existing);
     const localized = mode === "restore" ? input : this.toMaps(config, input, current, options);
     const merged = generateSlugs(
@@ -4320,26 +5053,26 @@ var EasyCMS = class {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     if (mode !== "unpublish" && this.separateDrafts(config) && existing.status === "published" && prepared.status === "draft") {
       const draft = { ...prepared, updatedAt: now };
-      await this.saveVersion(config, globalParent(slug), 0, draft, guard);
-      await this.notify(config.hooks?.afterChange, "afterChange", slug, {
+      await this.saveVersion(config, globalParent(slug2), 0, draft, guard);
+      await this.notify(config.hooks?.afterChange, "afterChange", slug2, {
         ...base,
         doc: draft,
         previousDoc: current,
         operation: "update"
       });
       this.emit(config, "draft", draft);
-      return this.findGlobal(slug, { ...options, draft: true });
+      return this.findGlobal(slug2, { ...options, draft: true });
     }
-    const doc = await this.db.updateGlobal({ slug, data: { ...prepared, updatedAt: now } });
-    await this.saveVersion(config, globalParent(slug), 0, doc, guard);
-    await this.notify(config.hooks?.afterChange, "afterChange", slug, {
+    const doc = await this.db.updateGlobal({ slug: slug2, data: { ...prepared, updatedAt: now } });
+    await this.saveVersion(config, globalParent(slug2), 0, doc, guard);
+    await this.notify(config.hooks?.afterChange, "afterChange", slug2, {
       ...base,
       doc,
       previousDoc: current,
       operation: "update"
     });
     this.emit(config, "update", doc, existing.status);
-    return this.findGlobal(slug, { ...options, draft: true });
+    return this.findGlobal(slug2, { ...options, draft: true });
   }
   /**
    * What `user` may do with one document. Resolves `where`-style access
@@ -4442,6 +5175,9 @@ var EasyCMS = class {
   async runJobs(now = /* @__PURE__ */ new Date()) {
     const scheduled = await this.runScheduled(now);
     await this.pruneFailedDeliveries(now);
+    await runDueBackups(this, now).catch(
+      (error) => this.logger.error(`Backups: ${error.message}`)
+    );
     return {
       ...scheduled,
       webhooks: await this.retryWebhooks(now),
@@ -4511,9 +5247,9 @@ var EasyCMS = class {
       const action = row.action;
       try {
         if (parent.startsWith("global:")) {
-          const slug = parent.slice("global:".length);
-          if (action === "publish") await this.saveGlobal(slug, { status: "published" }, {});
-          else await this.saveGlobal(slug, { status: "draft" }, {}, "unpublish");
+          const slug2 = parent.slice("global:".length);
+          if (action === "publish") await this.saveGlobal(slug2, { status: "published" }, {});
+          else await this.saveGlobal(slug2, { status: "draft" }, {}, "unpublish");
         } else if (action === "publish") {
           await this.updateDocument(parent, row.doc, { status: "published" }, { depth: 0 });
         } else {
@@ -4557,17 +5293,17 @@ var EasyCMS = class {
     const { parsed } = await this.scheduleTarget(collection2, id, options);
     await this.removeJob(collection2, parsed, jobId);
   }
-  async scheduleGlobal(slug, job, options = {}) {
-    await this.globalScheduleTarget(slug, options);
-    return this.addJob(`global:${slug}`, 0, job, options);
+  async scheduleGlobal(slug2, job, options = {}) {
+    await this.globalScheduleTarget(slug2, options);
+    return this.addJob(`global:${slug2}`, 0, job, options);
   }
-  async scheduledGlobal(slug, options = {}) {
-    await this.globalScheduleTarget(slug, options);
-    return this.pendingJobs(`global:${slug}`, 0);
+  async scheduledGlobal(slug2, options = {}) {
+    await this.globalScheduleTarget(slug2, options);
+    return this.pendingJobs(`global:${slug2}`, 0);
   }
-  async cancelGlobalSchedule(slug, jobId, options = {}) {
-    await this.globalScheduleTarget(slug, options);
-    await this.removeJob(`global:${slug}`, 0, jobId);
+  async cancelGlobalSchedule(slug2, jobId, options = {}) {
+    await this.globalScheduleTarget(slug2, options);
+    await this.removeJob(`global:${slug2}`, 0, jobId);
   }
   async scheduleTarget(collection2, id, options) {
     const config = this.collection(collection2);
@@ -4576,14 +5312,14 @@ var EasyCMS = class {
     const existing = parsed === void 0 ? null : await this.db.findById({ collection: collection2, id: parsed });
     if (!existing || parsed === void 0) throw new NotFoundError(collection2, id);
     await this.checkDocumentAccess(config, "update", guardOf(options), parsed, void 0);
-    this.checkKey(guardOf(options), { collection: collection2 }, "publish");
+    await this.checkGrant(guardOf(options), { collection: collection2 }, "publish");
     return { config, parsed };
   }
-  async globalScheduleTarget(slug, options) {
-    const config = this.global(slug);
-    if (!config.schedule) throw new QueryError(`"${slug}" has no schedule`);
+  async globalScheduleTarget(slug2, options) {
+    const config = this.global(slug2);
+    if (!config.schedule) throw new QueryError(`"${slug2}" has no schedule`);
     await this.checkGlobalAccess(config, "update", guardOf(options));
-    this.checkKey(guardOf(options), { global: slug }, "publish");
+    await this.checkGrant(guardOf(options), { global: slug2 }, "publish");
   }
   async addJob(parent, doc, job, options) {
     const runAt = new Date(job.at);
@@ -4629,20 +5365,21 @@ var EasyCMS = class {
       page: 1
     });
     const allowed2 = /* @__PURE__ */ new Map();
-    const may = async (parent) => {
+    const may2 = async (parent) => {
       if (!guard.enforce) return true;
       const cached = allowed2.get(parent);
       if (cached !== void 0) return cached;
       const config = parent.startsWith("global:") ? this.config.globals.find((g) => g.slug === parent.slice("global:".length)) : this.config.collections.find((c) => c.slug === parent);
       const access = config ? await evaluateAccess(config.access?.update, { user: guard.user }) : false;
-      const result = access !== false;
+      const target = parent.startsWith("global:") ? { global: parent.slice("global:".length) } : { collection: parent };
+      const result = access !== false && await this.roles.allows(guard.user, target, "update") !== false;
       allowed2.set(parent, result);
       return result;
     };
     const jobs = [];
     for (const row of rows.docs) {
       const parent = String(row.parent);
-      if (!await may(parent)) continue;
+      if (!await may2(parent)) continue;
       const target = parent.startsWith("global:") ? { global: parent.slice("global:".length) } : { collection: parent };
       jobs.push({ ...toJob(row), ...target, doc: row.doc });
       if (jobs.length === limit) break;
@@ -4717,38 +5454,46 @@ var EasyCMS = class {
   }
   // -------------------------------------------------------------------------
   /** @internal */
-  collection(slug) {
-    const config = this.config.collections.find((c) => c.slug === slug);
-    if (!config) throw new QueryError(`Unknown collection "${slug}"`);
+  collection(slug2) {
+    const config = this.config.collections.find((c) => c.slug === slug2);
+    if (!config) throw new QueryError(`Unknown collection "${slug2}"`);
     return config;
   }
-  global(slug) {
-    const config = this.config.globals.find((g) => g.slug === slug);
-    if (!config) throw new QueryError(`Unknown global "${slug}"`);
+  global(slug2) {
+    const config = this.config.globals.find((g) => g.slug === slug2);
+    if (!config) throw new QueryError(`Unknown global "${slug2}"`);
     return config;
   }
-  /** Refuses what a request's API key does not allow (see `ApiKeyPermissions`). */
-  checkKey(guard, target, operation) {
-    if (!guard.enforce || keyAllows(guard.user, target, operation)) return;
+  /**
+   * Refuses what a request's API key (see `ApiKeyPermissions`) or the user's role (`auth.rbac`)
+   * does not allow. Returns a constraint when the role allows only the user's own account.
+   */
+  async checkGrant(guard, target, operation) {
+    if (!guard.enforce) return true;
     const name = "collection" in target ? target.collection : target.global;
-    throw new ForbiddenError(`This API key may not ${operation} "${name}"`);
+    if (!keyAllows(guard.user, target, operation))
+      throw new ForbiddenError(`This API key may not ${operation} "${name}"`);
+    const role = await this.roles.allows(guard.user, target, operation);
+    if (role === false) throw deny(guard.user);
+    return role;
   }
   /** The query constraint read access adds, or `undefined` when there is none. Throws when denied. */
   async readWhere(config, guard, where) {
     if (!guard.enforce) return where;
-    this.checkKey(guard, { collection: config.slug }, "read");
+    const own = await this.checkGrant(guard, { collection: config.slug }, "read");
     const access = await evaluateAccess(config.access?.read, { user: guard.user });
     if (access === false) throw deny(guard.user);
-    return andWhere(where, access);
+    return andWhere(andWhere(where, access), own);
   }
   async checkDocumentAccess(config, operation, guard, id, data) {
     if (!guard.enforce) return;
-    this.checkKey(guard, { collection: config.slug }, operation);
-    const access = await evaluateAccess(config.access?.[operation], {
+    const own = await this.checkGrant(guard, { collection: config.slug }, operation);
+    const allowed2 = await evaluateAccess(config.access?.[operation], {
       user: guard.user,
       id,
       ...data ? { data } : {}
     });
+    const access = allowed2 === false ? false : andWhere(own === true ? void 0 : own, allowed2) ?? true;
     if (access === true) return;
     if (access !== false) {
       const matches2 = await this.db.count({
@@ -4761,7 +5506,7 @@ var EasyCMS = class {
   }
   async checkGlobalAccess(config, operation, guard) {
     if (!guard.enforce) return;
-    this.checkKey(guard, { global: config.slug }, operation);
+    await this.checkGrant(guard, { global: config.slug }, operation);
     const access = await evaluateAccess(config.access?.[operation], { user: guard.user });
     if (typeof access === "object")
       throw new QueryError(`${operation} access of global "${config.slug}" must return a boolean`);
@@ -4815,9 +5560,9 @@ var EasyCMS = class {
     const guard = guardOf(options);
     const collection2 = config.slug;
     if (guard.enforce) {
-      this.checkKey(guard, { collection: collection2 }, "create");
+      await this.checkGrant(guard, { collection: collection2 }, "create");
       if (config.drafts && raw.status === "published")
-        this.checkKey(guard, { collection: collection2 }, "publish");
+        await this.checkGrant(guard, { collection: collection2 }, "publish");
       const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data: raw });
       if (typeof allowed2 === "object")
         throw new QueryError(`create access of "${collection2}" must return a boolean`);
@@ -4974,13 +5719,13 @@ var EasyCMS = class {
     return current;
   }
   /** Runs hooks after the change is saved: failures are logged, never undo the save (NFR-REL-03). */
-  async notify(hooks, name, slug, args) {
+  async notify(hooks, name, slug2, args) {
     for (const hook of hooks ?? []) {
       try {
         await hook(args);
       } catch (error) {
         this.logger.error(
-          `${name} hook of "${slug}" failed: ${error instanceof Error ? error.message : String(error)}`
+          `${name} hook of "${slug2}" failed: ${error instanceof Error ? error.message : String(error)}`
         );
       }
     }
@@ -5036,6 +5781,8 @@ var EasyCMS = class {
       }
       clean2.status = status;
     }
+    if (config.slug === USERS && this.roles.enabled && typeof clean2.role === "string" && !await this.roles.exists(clean2.role))
+      errors.push({ field: "role", message: `there is no role "${clean2.role}"` });
     const isCollection = this.config.collections.includes(config);
     if (isCollection && errors.length === 0) {
       await this.makeSlugsUnique(config, clean2, selfId);
@@ -5082,9 +5829,9 @@ var EasyCMS = class {
       const value = data[field.name];
       if (field.localized && value && typeof value === "object") {
         const map = { ...value };
-        for (const [locale, slug] of Object.entries(map)) {
-          if (typeof slug === "string" && slug !== "")
-            map[locale] = await unique(`${field.name}.${locale}`, slug);
+        for (const [locale, slug2] of Object.entries(map)) {
+          if (typeof slug2 === "string" && slug2 !== "")
+            map[locale] = await unique(`${field.name}.${locale}`, slug2);
         }
         data[field.name] = map;
       } else if (typeof value === "string" && value !== "") {
@@ -5122,11 +5869,11 @@ var EasyCMS = class {
     return await this.db.count({ collection: collection2, where }) > 0;
   }
   /** Each reference is one its relationship's `filterOptions` allow. */
-  async checkFilterOptions(references, selfId, user) {
+  async checkFilterOptions(references2, selfId, user) {
     const errors = [];
     const cms = this;
     const allowed2 = /* @__PURE__ */ new Map();
-    for (const ref of references) {
+    for (const ref of references2) {
       const filter = ref.filterOptions;
       if (!filter) continue;
       if (!allowed2.has(filter)) allowed2.set(filter, await filter({ id: selfId, user, cms }));
@@ -5144,9 +5891,9 @@ var EasyCMS = class {
     }
     return errors;
   }
-  async checkReferences(references) {
+  async checkReferences(references2) {
     const byCollection = /* @__PURE__ */ new Map();
-    for (const ref of references) {
+    for (const ref of references2) {
       if (!this.config.collections.some((c) => c.slug === ref.collection)) continue;
       byCollection.set(ref.collection, [...byCollection.get(ref.collection) ?? [], ref]);
     }
@@ -5223,11 +5970,11 @@ function asObject(data, name) {
 
 // src/rest/admin-modules.ts
 import { createHash as createHash3 } from "crypto";
-import { readFile as readFile2 } from "fs/promises";
+import { readFile as readFile3 } from "fs/promises";
 import { createRequire } from "module";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 function resolveAdminModule(specifier, cwd = process.cwd()) {
-  const bases = [join2(cwd, "package.json")];
+  const bases = [join3(cwd, "package.json")];
   const entry = process.argv[1];
   if (entry && !specifier.startsWith(".")) bases.push(entry);
   for (const base of bases) {
@@ -5261,7 +6008,7 @@ function adminModuleUrls(cms) {
 async function readAdminModule(cms, index) {
   const file = files(cms)[index];
   if (!file) return void 0;
-  const body = await readFile2(file, "utf8").catch(() => void 0);
+  const body = await readFile3(file, "utf8").catch(() => void 0);
   if (body === void 0) return void 0;
   return { body, etag: `"${createHash3("sha1").update(body).digest("base64url")}"` };
 }
@@ -5279,7 +6026,7 @@ function parse(text) {
     return {};
   }
 }
-function toAdmin(kind, row) {
+function toAdmin2(kind, row) {
   const base = {
     id: row.id,
     state: row.state === "failed" ? "failed" : "pending",
@@ -5327,7 +6074,7 @@ async function listDeliveries(cms, kind, state, page) {
     cms.db.count({ collection: collection2, where: { state: { equals: "pending" } } })
   ]);
   return {
-    docs: found.docs.map((row) => toAdmin(kind, row)),
+    docs: found.docs.map((row) => toAdmin2(kind, row)),
     totalDocs: found.totalDocs,
     page: found.page,
     totalPages: found.totalPages,
@@ -5468,7 +6215,7 @@ function componentRef(component) {
 async function allowed(access, user) {
   return await evaluateAccess(access, { user }) !== false;
 }
-async function serializeFields(fields, update, localized) {
+async function serializeFields(fields, update2, localized) {
   const out = [];
   for (const field of fields) {
     if (field.hidden) continue;
@@ -5477,7 +6224,7 @@ async function serializeFields(fields, update, localized) {
     if (field.required) f.required = true;
     if (field.unique) f.unique = true;
     if (field.defaultValue !== void 0) f.defaultValue = field.defaultValue;
-    if (!await update.allows(field)) f.readOnly = true;
+    if (!await update2.allows(field)) f.readOnly = true;
     if (field.localized && localized) f.localized = true;
     if (field.position === "sidebar") f.position = "sidebar";
     if (field.admin?.component || field.admin?.after?.length || field.admin?.cell) {
@@ -5524,7 +6271,7 @@ async function serializeFields(fields, update, localized) {
       case "array":
         if (field.minRows !== void 0) f.minRows = field.minRows;
         if (field.maxRows !== void 0) f.maxRows = field.maxRows;
-        f.fields = await serializeFields(field.fields, update, localized);
+        f.fields = await serializeFields(field.fields, update2, localized);
         break;
       case "blocks":
         if (field.minRows !== void 0) f.minRows = field.minRows;
@@ -5533,35 +6280,48 @@ async function serializeFields(fields, update, localized) {
           field.blocks.map(async (block) => ({
             slug: block.slug,
             ...block.labels ? { labels: block.labels } : {},
-            fields: await serializeFields(block.fields, update, localized)
+            fields: await serializeFields(block.fields, update2, localized)
           }))
         );
         break;
       case "group":
-        f.fields = await serializeFields(field.fields, update, localized);
+        f.fields = await serializeFields(field.fields, update2, localized);
         break;
     }
     out.push(f);
   }
   return out;
 }
-async function collection(config, user, localized) {
+async function may(cms, access, user, target, operation) {
+  return await allowed(access, user) && await cms.roles.allows(user, target, operation) !== false;
+}
+async function collection(cms, config, user, localized, roles) {
+  const target = { collection: config.slug };
+  const fields = await serializeFields(
+    config.fields,
+    new FieldAccessChecker("update", { user }),
+    localized
+  );
+  if (config.slug === USERS && cms.roles.enabled) {
+    const role = fields.find((f) => f.name === "role");
+    if (role) {
+      role.type = "select";
+      role.options = roles.map((r) => ({ label: r.name || r.key, value: r.key }));
+    }
+  }
   const result = {
     slug: config.slug,
     drafts: config.drafts === true,
     versions: Boolean(config.versions),
     preview: typeof config.preview === "function",
     schedule: config.schedule === true,
-    fields: await serializeFields(
-      config.fields,
-      new FieldAccessChecker("update", { user }),
-      localized
-    ),
+    fields,
     permissions: {
-      read: await allowed(config.access?.read, user),
-      create: await allowed(config.access?.create, user),
-      update: await allowed(config.access?.update, user),
-      delete: await allowed(config.access?.delete, user)
+      read: await may(cms, config.access?.read, user, target, "read"),
+      create: await may(cms, config.access?.create, user, target, "create"),
+      update: await may(cms, config.access?.update, user, target, "update"),
+      delete: await may(cms, config.access?.delete, user, target, "delete"),
+      publish: config.drafts === true && await may(cms, config.access?.update, user, target, "publish")
     }
   };
   if (config.labels) result.labels = config.labels;
@@ -5575,7 +6335,8 @@ async function collection(config, user, localized) {
     result.editIn = "drawer";
   return result;
 }
-async function global(config, user, localized) {
+async function global(cms, config, user, localized) {
+  const target = { global: config.slug };
   const result = {
     slug: config.slug,
     drafts: config.drafts === true,
@@ -5588,8 +6349,9 @@ async function global(config, user, localized) {
       localized
     ),
     permissions: {
-      read: await allowed(config.access?.read, user),
-      update: await allowed(config.access?.update, user)
+      read: await may(cms, config.access?.read, user, target, "read"),
+      update: await may(cms, config.access?.update, user, target, "update"),
+      publish: config.drafts === true && await may(cms, config.access?.update, user, target, "publish")
     }
   };
   if (config.label !== void 0) result.label = config.label;
@@ -5601,16 +6363,31 @@ async function adminSchema(cms, user, origin) {
   const collections = cms.config.collections.filter((c) => !INTERNAL_COLLECTIONS.has(c.slug));
   const localization = cms.config.localization;
   const localized = localization !== null;
+  const admin = user.role === "admin" && !user.apiKey;
+  const deliveries = cms.config.collections.some(
+    (c) => c.slug === WEBHOOK_DELIVERIES || c.slug === EMAIL_DELIVERIES
+  );
+  const views = {
+    status: await cms.roles.canView(user, "status"),
+    deliveries: deliveries && await cms.roles.canView(user, "deliveries"),
+    backups: admin,
+    email: admin,
+    roles: admin && cms.roles.enabled
+  };
+  const roles = await cms.roles.options();
   return {
     locale: cms.config.admin.locale,
     passwordLinks: cms.auth.canSendPasswordLinks(origin),
     menu: [...cms.config.admin.menu],
     localization: localization ? { locales: [...localization.locales], defaultLocale: localization.defaultLocale } : null,
-    collections: await Promise.all(collections.map((c) => collection(c, user, localized))),
-    globals: await Promise.all(cms.config.globals.map((g) => global(g, user, localized))),
+    collections: await Promise.all(
+      collections.map((c) => collection(cms, c, user, localized, roles))
+    ),
+    globals: await Promise.all(cms.config.globals.map((g) => global(cms, g, user, localized))),
     modules: adminModuleUrls(cms),
     uploadFromURL: cms.config.upload.fromURL !== void 0,
-    ...user.role === "admin" && !user.apiKey ? {
+    views,
+    ...views.deliveries ? {
       deliveries: {
         webhook: cms.config.collections.some((c) => c.slug === WEBHOOK_DELIVERIES),
         email: cms.config.collections.some((c) => c.slug === EMAIL_DELIVERIES)
@@ -5631,7 +6408,8 @@ async function shown(access, user) {
 async function pages(cms, user) {
   const out = [];
   for (const page of cms.config.admin.pages) {
-    if (!await shown(page.access, user)) continue;
+    if (!await shown(page.access, user) || !await cms.roles.canView(user, `page:${page.path}`))
+      continue;
     out.push({
       path: page.path,
       label: page.label,
@@ -5645,18 +6423,20 @@ async function pages(cms, user) {
 async function widgets(cms, user) {
   const out = [];
   for (const widget of cms.config.admin.dashboard) {
-    if (!await shown(widget.access, user)) continue;
+    const tag = typeof widget.component === "string" ? widget.component : widget.component.tag;
+    if (!await shown(widget.access, user) || !await cms.roles.canView(user, `widget:${tag}`))
+      continue;
     out.push({ component: componentRef(widget.component), width: widget.width ?? "half" });
   }
   return out;
 }
 
 // src/version.ts
-var VERSION = true ? "0.31.0" : "0.0.0-dev";
+var VERSION = true ? "0.33.0" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
 var DAY = 864e5;
-var has = (cms, slug) => cms.config.collections.some((c) => c.slug === slug);
+var has = (cms, slug2) => cms.config.collections.some((c) => c.slug === slug2);
 async function adminStatus(cms) {
   const config = cms.config;
   const attention = [];
@@ -5709,6 +6489,8 @@ async function adminStatus(cms) {
     });
     if (count > 0) attention.push({ id: "scheduled", count });
   }
+  const backups = await backupAttention(cms);
+  if (backups) attention.push(backups);
   if (!config.email) attention.push({ id: "no-email" });
   if (!config.serverURL && process.env.NODE_ENV === "production")
     attention.push({ id: "no-server-url" });
@@ -5743,8 +6525,8 @@ async function pickerFilter(cms, url, target, user) {
   const spec = forCollection ?? forGlobal;
   if (spec === null) return void 0;
   const dot = spec.indexOf(".");
-  const slug = dot > 0 ? spec.slice(0, dot) : "";
-  const owner = forCollection !== null ? cms.config.collections.find((c) => c.slug === slug) : cms.config.globals.find((g) => g.slug === slug);
+  const slug2 = dot > 0 ? spec.slice(0, dot) : "";
+  const owner = forCollection !== null ? cms.config.collections.find((c) => c.slug === slug2) : cms.config.globals.find((g) => g.slug === slug2);
   const field = owner ? fieldAt(owner.fields, spec.slice(dot + 1)) : void 0;
   if (field?.type !== "relationship" || field.to !== target)
     throw new QueryError(`filterFor: no relationship to "${target}" at "${spec}"`);
@@ -6092,6 +6874,38 @@ async function route(cms, ctx, method, segments, options) {
     }
     return { body: await cms.runJobs() };
   }
+  if (first === "admin" && second === "backups") {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+    const [, , id2, action, extra] = segments;
+    if (extra !== void 0) throw new HttpError("Not found", 404);
+    if (id2 === void 0) {
+      if (method === "GET") return { body: await listBackups(cms) };
+      if (method === "POST")
+        return { status: 202, body: await startBackup(cms, "manual", ctx.user.email) };
+      throw methodNotAllowed(ctx, "GET, POST");
+    }
+    const parsed = parseId(id2);
+    if (parsed === void 0) throw new HttpError("Not found", 404);
+    if (action === "download") {
+      if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+      const file = await downloadBackup(cms, parsed, ctx.user.email);
+      return {
+        body: new Response(file.body, {
+          headers: {
+            "content-type": "application/gzip",
+            "content-disposition": `attachment; filename="${file.filename}"`,
+            "cache-control": "no-store",
+            "x-content-type-options": "nosniff"
+          }
+        })
+      };
+    }
+    if (action !== void 0) throw new HttpError("Not found", 404);
+    if (method !== "DELETE") throw methodNotAllowed(ctx, "DELETE");
+    await deleteBackup(cms, parsed);
+    return { body: { deleted: 1 } };
+  }
   if (first === "admin" && second === "email") {
     if (!ctx.user) throw new UnauthorizedError();
     if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
@@ -6109,9 +6923,36 @@ async function route(cms, ctx, method, segments, options) {
     }
     throw new HttpError("Not found", 404);
   }
-  if (first === "admin" && second === "deliveries") {
+  if (first === "admin" && second === "roles") {
     if (!ctx.user) throw new UnauthorizedError();
     if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+    if (!cms.roles.enabled) throw new HttpError("Not found", 404);
+    const [, , id2, action, extra] = segments;
+    if (extra !== void 0) throw new HttpError("Not found", 404);
+    if (id2 === void 0) {
+      if (method === "GET") return { body: await cms.roles.list() };
+      if (method === "POST")
+        return { status: 201, body: await cms.roles.create(await readJson(ctx.request), ctx.user) };
+      throw methodNotAllowed(ctx, "GET, POST");
+    }
+    const parsed = parseId(id2);
+    if (parsed === void 0) throw new HttpError("Not found", 404);
+    if (action === "history") {
+      if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+      return { body: await cms.roles.history(parsed) };
+    }
+    if (action !== void 0) throw new HttpError("Not found", 404);
+    if (method === "PATCH")
+      return { body: await cms.roles.update(parsed, await readJson(ctx.request), ctx.user) };
+    if (method === "DELETE") {
+      await cms.roles.delete(parsed);
+      return { body: { deleted: 1 } };
+    }
+    throw methodNotAllowed(ctx, "PATCH, DELETE");
+  }
+  if (first === "admin" && second === "deliveries") {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (!await cms.roles.canView(ctx.user, "deliveries")) throw new ForbiddenError();
     const [, , kind, id2, action, extra] = segments;
     if (kind === void 0) {
       if (method !== "GET") throw methodNotAllowed(ctx, "GET");
@@ -6161,7 +7002,7 @@ async function route(cms, ctx, method, segments, options) {
       return { body: new Response(file.body, { headers }) };
     }
     if (second === "status" && third === void 0) {
-      if (ctx.user.role !== "admin" || ctx.user.apiKey) throw new ForbiddenError();
+      if (!await cms.roles.canView(ctx.user, "status")) throw new ForbiddenError();
       return { body: await adminStatus(cms) };
     }
     if (second === "scheduled" && third === void 0)
@@ -6348,47 +7189,47 @@ async function documentAction(cms, ctx, method, collection2, id, path) {
   }
   throw new HttpError("Not found", 404);
 }
-async function globalAction(cms, ctx, method, slug, path) {
+async function globalAction(cms, ctx, method, slug2, path) {
   const access = { overrideAccess: false, user: ctx.user, ...parseLocale(ctx.url) };
   const depth = parseDepth(ctx.url);
   const [action, versionId, extra] = path;
   if (action === "versions" && versionId === void 0) {
     if (method !== "GET") throw methodNotAllowed(ctx, "GET");
-    return { body: await cms.findGlobalVersions(slug, { ...access, ...parsePage(ctx.url) }) };
+    return { body: await cms.findGlobalVersions(slug2, { ...access, ...parsePage(ctx.url) }) };
   }
   if (action === "versions" && versionId !== void 0 && extra === void 0) {
     if (method !== "GET") throw methodNotAllowed(ctx, "GET");
-    const version = await cms.findGlobalVersion(slug, versionId, { ...access, ...depth });
-    if (!version) throw new NotFoundError(`${slug} version`, versionId);
+    const version = await cms.findGlobalVersion(slug2, versionId, { ...access, ...depth });
+    if (!version) throw new NotFoundError(`${slug2} version`, versionId);
     return { body: version };
   }
   if (action === "versions" && versionId !== void 0 && extra === "restore" && path.length === 3) {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
-    return { body: await cms.restoreGlobalVersion(slug, versionId, { ...access, ...depth }) };
+    return { body: await cms.restoreGlobalVersion(slug2, versionId, { ...access, ...depth }) };
   }
   if (action === "schedule" && path.length <= 2) {
     if (path.length === 2) {
       if (method !== "DELETE") throw methodNotAllowed(ctx, "DELETE");
-      await cms.cancelGlobalSchedule(slug, versionId, access);
+      await cms.cancelGlobalSchedule(slug2, versionId, access);
       return { body: { message: "Cancelled" } };
     }
-    if (method === "GET") return { body: await cms.scheduledGlobal(slug, access) };
+    if (method === "GET") return { body: await cms.scheduledGlobal(slug2, access) };
     if (method !== "POST") throw methodNotAllowed(ctx, "GET, POST");
     const body = await readJson(ctx.request);
-    return { status: 201, body: await cms.scheduleGlobal(slug, scheduleJob(body), access) };
+    return { status: 201, body: await cms.scheduleGlobal(slug2, scheduleJob(body), access) };
   }
   if (path.length === 1 && action === "preview") {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
     const body = await readJson(ctx.request);
-    const result = await cms.previewGlobal(slug, body, { ...access, ...depth });
-    const token = cms.createPreviewToken({ global: slug });
+    const result = await cms.previewGlobal(slug2, body, { ...access, ...depth });
+    const token = cms.createPreviewToken({ global: slug2 });
     return { body: { ...result, url: result.url && withPreviewToken(result.url, token) } };
   }
   if (path.length === 1 && (action === "unpublish" || action === "discard-draft")) {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
     const options = { ...access, ...depth };
     return {
-      body: action === "unpublish" ? await cms.unpublishGlobal(slug, options) : await cms.discardGlobalDraft(slug, options)
+      body: action === "unpublish" ? await cms.unpublishGlobal(slug2, options) : await cms.discardGlobalDraft(slug2, options)
     };
   }
   throw new HttpError("Not found", 404);
@@ -6721,7 +7562,7 @@ function generateTypes(config) {
   for (const global2 of config.globals) {
     parts.push("", globalInterface(global2, n.globals.get(global2.slug), n));
   }
-  const map = (entries) => [...entries].map(([slug, name]) => `  ${key(slug)}: ${name}`).join("\n");
+  const map = (entries) => [...entries].map(([slug2, name]) => `  ${key(slug2)}: ${name}`).join("\n");
   parts.push(
     "",
     "/** Document type by collection slug. */",
@@ -6771,6 +7612,8 @@ export {
   NotFoundError,
   PayloadTooLargeError,
   QueryError,
+  ROLE_OPERATIONS,
+  Roles,
   SESSION_COOKIE,
   SchemaError,
   TooManyRequestsError,
@@ -6820,5 +7663,6 @@ export {
   sniffMimeType,
   validateConfig,
   validateFields,
-  verifyPassword
+  verifyPassword,
+  writeBackupFile
 };