@easy-cms/core 0.33.0 → 0.35.0

package/dist/index.d.ts

@@ -65,6 +65,11 @@ interface PasswordEmailArgs {
     readonly locale: string;
     /** When the link stops working. */
     readonly expiresAt?: Date;
+    /**
+     * Invitations when passwords are off (`auth.password: false`): the providers to sign in with,
+     * e.g. `['Google']`; `url` is then the login page.
+     */
+    readonly sso?: readonly string[];
 }
 /** An email's content: a subject, and text and/or HTML. */
 interface PasswordEmail {
@@ -80,6 +85,50 @@ declare const DEFAULT_PASSWORD_EMAILS: {
     passwordChanged: PasswordEmailFn;
 };
 
+/**
+ * Signing in to the admin with an outside account (`auth.providers`): Google, Microsoft, GitHub
+ * or any OpenID Connect provider. `@easy-cms/auth-oauth` makes these; Easy CMS runs the rest
+ * (the redirect, matching users, sessions).
+ */
+/** Values bound to one sign-in, checked when the browser comes back. */
+interface AuthProviderRequest {
+    /** Where the provider sends the browser back: `<serverURL><api>/auth/<id>/callback`. */
+    readonly redirectUri: string;
+    readonly state: string;
+    /** For PKCE: the provider gets its S256 challenge. */
+    readonly codeVerifier: string;
+    /** For OpenID Connect: must come back in the ID token. */
+    readonly nonce: string;
+}
+/** Who signed in, as the provider says. */
+interface AuthProviderProfile {
+    /** The provider's stable id for the account (`sub`). */
+    readonly subject: string;
+    readonly email: string | null;
+    /** The provider vouches for the email. Only verified emails are matched to users. */
+    readonly emailVerified: boolean;
+    readonly name?: string | undefined;
+}
+interface AuthProvider {
+    /** In URLs and stored identities, e.g. `google`: lowercase letters, digits and `-`. */
+    readonly id: string;
+    /** On the sign-in button, e.g. `Google`. */
+    readonly name: string;
+    /** The button's icon in the admin. Default `key`. */
+    readonly icon?: 'google' | 'microsoft' | 'github' | 'key';
+    /** The provider's page to send the browser to. */
+    authorizationURL(request: AuthProviderRequest): Promise<URL>;
+    /**
+     * After the browser comes back to `redirectUri` (`url`, with its query): checks the response
+     * and exchanges the code. Throws when anything does not check out.
+     */
+    callback(request: AuthProviderRequest & {
+        readonly url: URL;
+    }): Promise<AuthProviderProfile>;
+    /** For Settings → SSO: what it connects to, never secrets. */
+    describe?(): Readonly<Record<string, string>>;
+}
+
 interface Logger {
     info(message: string): void;
     warn(message: string): void;
@@ -339,6 +388,103 @@ type PreviewTarget = {
 /** Why a password link was sent: a forgotten password, or an invitation to a new account. */
 type PasswordPurpose = 'reset' | 'invite';
 
+/** The cookie that carries a sign-in through the provider and back. */
+declare const SSO_COOKIE = "ecms-sso";
+/** A provider as the login page shows it (`GET <api>/users/init`). */
+interface SsoProviderRef {
+    id: string;
+    name: string;
+    icon: string;
+}
+/** Settings → SSO (`GET <api>/admin/sso`). */
+interface AdminSso {
+    providers: (SsoProviderRef & {
+        /** Give this to the provider as the redirect (callback) URL. */
+        callbackURL: string | null;
+        details: Record<string, string>;
+    })[];
+    /** Who may sign in with a password: everyone, or only admins. */
+    password: 'everyone' | 'admins';
+    /** Email domains whose people get an account when they first sign in. */
+    signUp: {
+        domains: string[];
+        role: string;
+    } | null;
+    /** Without `serverURL`, sign-in only works in development. */
+    serverURL: boolean;
+}
+/** An outside account a user signs in with (`GET <api>/auth/identities`). */
+interface UserIdentity {
+    id: ID;
+    provider: string;
+    /** The provider's name, e.g. `Google`. */
+    name: string;
+    email: string | null;
+    createdAt: string;
+    lastUsedAt: string | null;
+}
+/** Why a sign-in did not work, as `?sso=` on the page it ends on. */
+type SsoOutcome = 'linked' | 'cancelled' | 'expired' | 'failed' | 'no-account' | 'unverified' | 'inactive' | 'taken';
+/** Single sign-on with `auth.providers`. Available as `cms.auth.sso`. */
+declare class SingleSignOn {
+    private readonly cms;
+    constructor(cms: EasyCMS);
+    private get config();
+    get enabled(): boolean;
+    providers(): SsoProviderRef[];
+    /** Whether a user may sign in with a password (`auth.password: false` leaves only admins). */
+    passwordAllowed(user: {
+        readonly [key: string]: unknown;
+    }): boolean;
+    /** `<serverURL><api>/auth/<id>/callback`, or `null` without `serverURL` in production. */
+    callbackURL(provider: string, origin?: string): string | null;
+    /**
+     * Starts signing in (or, with `user`, linking an account): the provider's URL to send the
+     * browser to, and the sealed value of the cookie that must come back with it.
+     */
+    start(providerId: string, options: {
+        origin?: string;
+        redirect?: string | null;
+        user?: AuthUser;
+    }): Promise<{
+        url: string;
+        cookie: string;
+    }>;
+    /**
+     * Finishes at `<api>/auth/<id>/callback`: checks the response, finds (or makes) the user and
+     * starts a session. Returns where to send the browser; failures end on the login page (or the
+     * account page, when linking) with `?sso=<outcome>`.
+     */
+    finish(providerId: string, options: {
+        url: URL;
+        cookie: string | undefined;
+        origin?: string;
+        user: AuthUser | null;
+    }): Promise<{
+        redirect: string;
+        session?: Session;
+    }>;
+    /** A user's outside accounts. */
+    identities(userId: ID): Promise<UserIdentity[]>;
+    /**
+     * Unlinks an outside account: the user's own, or anyone's for admins. Refuses to unlink the
+     * last way a user has to sign in.
+     */
+    unlink(actor: AuthUser, identityId: ID): Promise<void>;
+    /** Forgets a deleted user's outside accounts. */
+    forget(userId: ID): Promise<void>;
+    settings(origin?: string): AdminSso;
+    private provider;
+    /** Only pages of the admin: anything else (another site) goes to the admin's home. */
+    private adminPage;
+    private identity;
+    private addIdentity;
+    private userByEmail;
+    /** A new account for people from `allowSignUp.domains`. */
+    private signUp;
+    private defaultRole;
+}
+
 interface LoginArgs {
     readonly email: string;
     readonly password: string;
@@ -363,6 +509,8 @@ interface PasswordLinkOptions {
 /** Login, logout and session verification. Available as `cms.auth`. */
 declare class Auth {
     private readonly cms;
+    /** Signing in with outside accounts (`auth.providers`). */
+    readonly sso: SingleSignOn;
     constructor(cms: EasyCMS);
     private get db();
     private get config();
@@ -744,6 +892,9 @@ type GlobalInput<C extends Config, S extends GlobalSlug<C>> = Partial<Simplify<F
 /** What a role may do with a collection or global, ticked in Settings → Roles. */
 declare const ROLE_OPERATIONS: readonly ["read", "create", "update", "delete", "publish"];
 type RoleOperation = (typeof ROLE_OPERATIONS)[number];
+/** A field a role may only read, or not see at all; fields not listed follow the collection. */
+type FieldRule = 'read' | 'hidden';
+type FieldRules = Readonly<Record<string, Readonly<Record<string, FieldRule>>>>;
 /**
  * Stored in a role's `permissions`. Anything not listed is not allowed. A slug listed with no
  * operations has been looked at and given nothing (it is not "new" in Settings → Roles).
@@ -753,6 +904,13 @@ interface RolePermissions {
     readonly globals?: Readonly<Record<string, readonly RoleOperation[]>>;
     /** Admin pages: `status`, `deliveries`, `page:<path>` (`admin.pages`), `widget:<tag>` (`admin.dashboard`). */
     readonly admin?: readonly string[];
+    /** Operations of `collections` allowed only on the role's own documents (see `admin.ownerField`). */
+    readonly own?: Readonly<Record<string, readonly RoleOperation[]>>;
+    /** Top-level fields the role may only read or not see, by collection or global slug. */
+    readonly fields?: {
+        readonly collections?: FieldRules;
+        readonly globals?: FieldRules;
+    };
 }
 /** One role as Settings → Roles shows it (`GET <api>/admin/roles`). */
 interface AdminRole {
@@ -767,6 +925,15 @@ interface AdminRole {
     permissions: RolePermissions;
     updatedAt: string;
 }
+/** A top-level field whose permission can be set per role. */
+interface AdminRoleField {
+    name: string;
+    label?: Label;
+    /** Required without a default value: roles that create documents must be able to fill it. */
+    required: boolean;
+    /** The collection's owner field (`admin.ownerField`). */
+    owner?: boolean;
+}
 /** A row of the permissions table. */
 interface AdminRoleTarget {
     slug: string;
@@ -774,6 +941,7 @@ interface AdminRoleTarget {
     ops: RoleOperation[];
     /** No role has been given anything here yet (added to the config since). */
     new: boolean;
+    fields: AdminRoleField[];
 }
 /** A page or dashboard panel that can be given to roles. */
 interface AdminRoleView {
@@ -787,6 +955,8 @@ interface AdminRoles {
     collections: (AdminRoleTarget & {
         /** Collections its relationship and upload fields point to. */
         references: string[];
+        /** Can be limited to own documents: the field that names the owner (`createdBy` by default). */
+        owner?: string;
     })[];
     globals: AdminRoleTarget[];
     views: AdminRoleView[];
@@ -808,11 +978,12 @@ interface AdminRoleChange {
 declare class Roles {
     private readonly config;
     private readonly db;
+    private readonly log?;
     readonly enabled: boolean;
     private readonly versions;
     private cache;
     private synced;
-    constructor(config: ResolvedConfig, db: Database);
+    constructor(config: ResolvedConfig, db: Database, log?: ((message: string) => void) | undefined);
     /**
      * Whether the user's role allows an operation: `true`, `false`, or for their own account
      * (users without read or update on `users`) a constraint to it.
@@ -827,6 +998,25 @@ declare class Roles {
      * it; without roles, nobody else (`status`, `deliveries`) or everybody (plugin pages).
      */
     canView(user: AuthUser, id: string): Promise<boolean>;
+    /**
+     * The field that names a collection's owner, for "own documents only": `admin.ownerField`, or
+     * `createdBy`. `undefined` without roles, and for users and collections roles don't cover.
+     */
+    ownerOf(slug: string): string | undefined;
+    /**
+     * The user's field rules (top-level fields their role may only read, or not see), for field
+     * access checks. Roles that may update only their own documents can't change the owner field.
+     */
+    fieldRules(user: AuthUser | null): Promise<ReadonlyMap<Field, FieldRule> | undefined>;
+    /** A new document is its creator's: sets `createdBy`, and an empty owner field. */
+    fillOwner(slug: string, data: Record<string, unknown>, user: AuthUser | null): void;
+    /** Documents a user owns, by collection (`createdBy` and owner fields), for deleting them. */
+    owned(userId: ID): Promise<{
+        collection: string;
+        count: number;
+    }[]>;
+    /** Gives a deleted user's documents to another user, or to nobody (`null`). */
+    transfer(from: ID, to: ID | null): Promise<void>;
     /** Forgets cached permissions, after a role changed. */
     invalidate(): void;
     /**
@@ -835,6 +1025,12 @@ declare class Roles {
      */
     sync(): Promise<void>;
     private addMissing;
+    /**
+     * Documents from before roles have no `createdBy`: it is filled from who saved their first
+     * version, for collections with versions. Only while no document of the collection has one,
+     * so it runs once (and finds nothing to do afterwards).
+     */
+    private backfillCreators;
     /** Whether a role exists (users can only be given existing roles). */
     exists(key: string): Promise<boolean>;
     /** Roles a user can be given, those of `auth.roles` first; `name` may be empty. */
@@ -860,6 +1056,15 @@ declare class Roles {
     private everything;
     /** Keeps only known collections, globals, operations and pages; `read` comes with the others. */
     private clean;
+    /**
+     * Keeps rules for known top-level fields. A field that must be filled in (required, without a
+     * default) can't be read-only or hidden for a role that creates documents.
+     */
+    private cleanRules;
+    /** Fields that name a collection's owner (`createdBy`, and `admin.ownerField`). */
+    private ownerColumns;
+    /** Sets one field of every matching document, keeping the rest as stored. */
+    private setWhere;
     private cleanName;
     private permissionsOf;
     private load;
@@ -1107,7 +1312,13 @@ declare class EasyCMS<C extends Config = Config> {
     private previewURL;
     private versionTarget;
     private updateDocument;
-    delete<S extends Slug<C>>(collection: S, id: ID, options?: AccessOptions): Promise<Doc<C, S>>;
+    /**
+     * Deletes a document. Deleting a user with roles from the admin (`auth.rbac`): `transferTo`
+     * gives the documents they own to another user; without it they have no owner.
+     */
+    delete<S extends Slug<C>>(collection: S, id: ID, options?: AccessOptions & {
+        transferTo?: ID | null;
+    }): Promise<Doc<C, S>>;
     findGlobal<S extends GSlug<C>>(slug: S, options?: ReadOptions): Promise<GDoc<C, S>>;
     updateGlobal<S extends GSlug<C>>(slug: S, data: GInput<C, S>, options?: DepthOptions): Promise<GDoc<C, S>>;
     /** Takes a global off the site (`status: 'draft'`). See `unpublish`. */
@@ -1244,6 +1455,13 @@ declare class EasyCMS<C extends Config = Config> {
     private checkDocumentAccess;
     private checkGlobalAccess;
     private fieldChecker;
+    /**
+     * Refuses filtering or sorting by fields the caller may not read: the results would tell
+     * their values. Checks each field along a dotted path, through groups, arrays and blocks.
+     */
+    private checkQueryFields;
+    /** `checkGrant` for one document: a role limited to its own documents must own it. */
+    private checkDocumentGrant;
     /** Runs afterRead hooks, populates relationships and removes what the caller may not see. */
     private output;
     /** Creates a document: access, input filtering, hooks, validation, then afterChange. */
@@ -1638,6 +1856,11 @@ interface CollectionAdmin extends ContainerAdmin {
      */
     readonly group?: 'settings';
     readonly list?: CollectionListAdmin;
+    /**
+     * With `auth.rbac`: the relationship field to `users` that names a document's owner, e.g.
+     * `author`, for roles given "own documents only". Default: who created it (`createdBy`).
+     */
+    readonly ownerField?: string;
 }
 interface CollectionListAdmin {
     /**
@@ -1845,6 +2068,24 @@ interface AuthConfig {
     readonly resetPasswordExpiration?: number;
     /** How long an invitation link works, in seconds. Default 7 days. */
     readonly inviteExpiration?: number;
+    /**
+     * Signing in to the admin with outside accounts, e.g. `[google({ clientId, clientSecret })]`
+     * from `@easy-cms/auth-oauth`. Users are matched by their verified email.
+     */
+    readonly providers?: readonly AuthProvider[];
+    /**
+     * With `providers`: people from these email domains who sign in for the first time get an
+     * account with `role` (default: as new users). Without it, only existing users can sign in.
+     */
+    readonly allowSignUp?: {
+        readonly domains: readonly string[];
+        readonly role?: string;
+    };
+    /**
+     * `false`: only admins may sign in with a password (a way in when the provider is down);
+     * everyone else signs in with `providers`. Default `true`.
+     */
+    readonly password?: boolean;
     /** Your own text for the password emails, e.g. in your brand's voice. Default: English or Thai. */
     readonly emails?: {
         readonly resetPassword?: PasswordEmailFn;
@@ -2427,6 +2668,8 @@ interface AdminCollection {
         delete: boolean;
         publish: boolean;
     };
+    /** With `auth.rbac`: the field naming a document's owner (`createdBy` or `admin.ownerField`). */
+    owner?: string;
 }
 interface AdminGlobal {
     slug: string;
@@ -2490,7 +2733,12 @@ interface AdminSchema {
         backups: boolean;
         email: boolean;
         roles: boolean;
+        sso: boolean;
     };
+    /** Roles from the admin are on (`auth.rbac`): documents have owners. */
+    rbac: boolean;
+    /** Outside accounts users can sign in with and link (`auth.providers`). */
+    providers: SsoProviderRef[];
     /** Pages this user may open (`admin.pages`). */
     pages: AdminPageRef[];
     /** Dashboard panels this user may see (`admin.dashboard`). */
@@ -2589,4 +2837,4 @@ declare function validateConfig(config: Config): ConfigIssue[];
 /** The version of `@easy-cms/core`, set when the package is built. */
 declare const VERSION: string;
 
-export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminAttention, type AdminBackup, type AdminBackups, type AdminBrand, type AdminCollection, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminDeliveries, type AdminDelivery, type AdminEmail, type AdminEmailDelivery, type AdminField, type AdminGlobal, type AdminIcon, type AdminLocale, type AdminPage, type AdminPageRef, type AdminRole, type AdminRoleChange, type AdminRoleTarget, type AdminRoleView, type AdminRoles, type AdminSchema, type AdminStatus, type AdminViewAccess, type AdminWebhookDelivery, type AdminWidgetRef, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, Auth, type AuthConfig, type AuthUser, BUILTIN_COLLECTIONS, type BackupState, type BackupsConfig, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, type CustomField, type CustomFieldTypes, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_PASSWORD_EMAILS, DEFAULT_TOKEN_EXPIRATION, type DashboardWidget, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DeliveryKind, type DeliveryState, type DepthOptions, type DocumentOf, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailCheck, type EmailField, type EmailMessage, type EmailSetting, type Endpoint, type EndpointRequest, FIELD_TYPES, FIELD_TYPE_BASES, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, type FieldError, type FieldType, type FieldTypeBase, type FieldTypeDefinition, type FieldTypeValidateContext, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type InferCollection, type InferGlobal, type JsonField, type Label, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, type MediaSize, type MigrationInfo, NotFoundError, type NumberField, type Operation, type PaginatedDocs, type PasswordEmail, type PasswordEmailArgs, type PasswordEmailFn, type PasswordLinkOptions, PayloadTooLargeError, type Plugin, type PluginInfo, type PluginTypes, type PreviewTarget, type PreviewURL, QueryError, ROLE_OPERATIONS, type RawDocument, type ReadOptions, type RelationshipField, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoleOperation, type RolePermissions, Roles, type RoutesConfig, SESSION_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SelectField, type SelectOption, type Session, type SlugField, type SlugOf, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, type TypedPlugin, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, type UploadFromURLConfig, VERSION, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, configSignature, consoleEmail, consoleLogger, copyDatabase, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, defineFieldType, definePlugin, fillMissing, findConfigFile, generateSlugs, generateTypes, hasRows, hashPassword, imageDimensions, importConfig, isAdmin, isHasMany, isLoggedIn, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, mimeAllowedBy, parseId, populate, readCookie, resolveAdminModule, resolveConfig, rowFields, silentLogger, singularize, slugify, sniffMimeType, validateConfig, validateFields, verifyPassword, writeBackupFile };
+export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminAttention, type AdminBackup, type AdminBackups, type AdminBrand, type AdminCollection, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminDeliveries, type AdminDelivery, type AdminEmail, type AdminEmailDelivery, type AdminField, type AdminGlobal, type AdminIcon, type AdminLocale, type AdminPage, type AdminPageRef, type AdminRole, type AdminRoleChange, type AdminRoleField, type AdminRoleTarget, type AdminRoleView, type AdminRoles, type AdminSchema, type AdminSso, type AdminStatus, type AdminViewAccess, type AdminWebhookDelivery, type AdminWidgetRef, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, Auth, type AuthConfig, type AuthProvider, type AuthProviderProfile, type AuthProviderRequest, type AuthUser, BUILTIN_COLLECTIONS, type BackupState, type BackupsConfig, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, type CustomField, type CustomFieldTypes, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_PASSWORD_EMAILS, DEFAULT_TOKEN_EXPIRATION, type DashboardWidget, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DeliveryKind, type DeliveryState, type DepthOptions, type DocumentOf, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailCheck, type EmailField, type EmailMessage, type EmailSetting, type Endpoint, type EndpointRequest, FIELD_TYPES, FIELD_TYPE_BASES, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, type FieldError, type FieldRule, type FieldType, type FieldTypeBase, type FieldTypeDefinition, type FieldTypeValidateContext, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type InferCollection, type InferGlobal, type JsonField, type Label, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, type MediaSize, type MigrationInfo, NotFoundError, type NumberField, type Operation, type PaginatedDocs, type PasswordEmail, type PasswordEmailArgs, type PasswordEmailFn, type PasswordLinkOptions, PayloadTooLargeError, type Plugin, type PluginInfo, type PluginTypes, type PreviewTarget, type PreviewURL, QueryError, ROLE_OPERATIONS, type RawDocument, type ReadOptions, type RelationshipField, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoleOperation, type RolePermissions, Roles, type RoutesConfig, SESSION_COOKIE, SSO_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SelectField, type SelectOption, type Session, type SlugField, type SlugOf, type SsoOutcome, type SsoProviderRef, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, type TypedPlugin, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, type UploadFromURLConfig, type UserIdentity, VERSION, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, configSignature, consoleEmail, consoleLogger, copyDatabase, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, defineFieldType, definePlugin, fillMissing, findConfigFile, generateSlugs, generateTypes, hasRows, hashPassword, imageDimensions, importConfig, isAdmin, isHasMany, isLoggedIn, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, mimeAllowedBy, parseId, populate, readCookie, resolveAdminModule, resolveConfig, rowFields, silentLogger, singularize, slugify, sniffMimeType, validateConfig, validateFields, verifyPassword, writeBackupFile };