@easy-cms/core 0.4.0 → 0.6.0

package/dist/index.js

@@ -82,6 +82,31 @@ var PayloadTooLargeError = class extends EasyCMSError {
   }
 };
 
+// src/fields.ts
+var hasRows = (field) => field.type === "array" || field.type === "blocks";
+function rowFields(field, row) {
+  if (field.type === "array") return field.fields;
+  const type = row && typeof row === "object" ? row.blockType : void 0;
+  return field.blocks.find((block) => block.slug === type)?.fields;
+}
+var FIELD_TYPES = [
+  "text",
+  "textarea",
+  "number",
+  "boolean",
+  "date",
+  "email",
+  "json",
+  "select",
+  "slug",
+  "richText",
+  "upload",
+  "relationship",
+  "array",
+  "group",
+  "blocks"
+];
+
 // src/access-control.ts
 async function evaluateAccess(access, args) {
   const result = await (access ?? isLoggedIn)(args);
@@ -123,11 +148,12 @@ async function stripFields(fields, doc, read) {
     const value = result[field.name];
     if (field.type === "group" && value && typeof value === "object") {
       result[field.name] = await stripFields(field.fields, value, read);
-    } else if (field.type === "array" && Array.isArray(value)) {
+    } else if (hasRows(field) && Array.isArray(value)) {
       result[field.name] = await Promise.all(
-        value.map(
-          (row) => row && typeof row === "object" ? stripFields(field.fields, row, read) : row
-        )
+        value.map((row) => {
+          const fields2 = rowFields(field, row);
+          return fields2 && row && typeof row === "object" ? stripFields(fields2, row, read) : row;
+        })
       );
     }
   }
@@ -144,11 +170,12 @@ async function filterInput(fields, data, update) {
     const value = result[field.name];
     if (field.type === "group" && value && typeof value === "object" && !Array.isArray(value)) {
       result[field.name] = await filterInput(field.fields, value, update);
-    } else if (field.type === "array" && Array.isArray(value)) {
+    } else if (hasRows(field) && Array.isArray(value)) {
       result[field.name] = await Promise.all(
-        value.map(
-          (row) => row && typeof row === "object" ? filterInput(field.fields, row, update) : row
-        )
+        value.map((row) => {
+          const fields2 = rowFields(field, row);
+          return fields2 && row && typeof row === "object" ? filterInput(fields2, row, update) : row;
+        })
       );
     }
   }
@@ -161,10 +188,12 @@ var MEDIA = "media";
 var SESSIONS = "sessions";
 var LOGIN_ATTEMPTS = "login-attempts";
 var VERSIONS = "document-versions";
+var SCHEDULED_JOBS = "scheduled-jobs";
 var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SESSIONS,
   LOGIN_ATTEMPTS,
-  VERSIONS
+  VERSIONS,
+  SCHEDULED_JOBS
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
 var adminOrSelf = ({ user }) => {
@@ -345,6 +374,22 @@ var versionsCollection = {
     { name: "snapshot", type: "json", required: true }
   ]
 };
+var scheduledJobsCollection = {
+  slug: SCHEDULED_JOBS,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    // Collection slug, or `global:<slug>`.
+    { name: "parent", type: "text", required: true, index: true },
+    // Document id; 0 for globals.
+    { name: "doc", type: "number", required: true, index: true },
+    { name: "action", type: "text", required: true },
+    { name: "runAt", type: "text", required: true, index: true },
+    // pending | done | failed
+    { name: "state", type: "text", required: true, index: true },
+    { name: "error", type: "text" },
+    { name: "author", type: "number" }
+  ]
+};
 
 // src/auth/password.ts
 import { randomBytes, scrypt, timingSafeEqual } from "crypto";
@@ -419,6 +464,30 @@ function safeEqual(a, b) {
   const right = Buffer.from(b);
   return left.length === right.length && timingSafeEqual2(left, right);
 }
+function signPreviewToken(secret, target, expiresAt) {
+  const payload = Buffer.from(
+    JSON.stringify(
+      "global" in target ? { g: target.global, e: expiresAt } : { c: target.collection, i: target.id, e: expiresAt }
+    )
+  ).toString("base64url");
+  return `${payload}.${hmac(secret, `preview:${payload}`)}`;
+}
+function verifyPreviewToken(secret, token, now = Date.now()) {
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0) return null;
+  const payload = token.slice(0, dot);
+  if (!safeEqual(token.slice(dot + 1), hmac(secret, `preview:${payload}`))) return null;
+  try {
+    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (typeof data.e !== "number" || data.e <= now) return null;
+    if (typeof data.g === "string") return { global: data.g, expiresAt: data.e };
+    if (typeof data.c === "string" && typeof data.i === "string")
+      return { collection: data.c, id: data.i, expiresAt: data.e };
+    return null;
+  } catch {
+    return null;
+  }
+}
 
 // src/auth/auth.ts
 var INVALID = "Invalid email or password";
@@ -620,17 +689,30 @@ var isEmpty = (value) => value === void 0 || value === null || value === "";
 function slugify(text) {
   return text.normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{M}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "");
 }
-function applyDefaults(fields, data) {
+function applyDefaults(fields, data, localization = null) {
   const result = { ...data };
   for (const field of fields) {
     const value = result[field.name];
     if (field.type === "group") {
-      result[field.name] = applyDefaults(field.fields, isPlainObject(value) ? value : {});
-    } else if (field.type === "array") {
+      result[field.name] = applyDefaults(
+        field.fields,
+        isPlainObject(value) ? value : {},
+        localization
+      );
+    } else if (hasRows(field) && !field.localized) {
       if (Array.isArray(value)) {
-        result[field.name] = value.map(
-          (row) => isPlainObject(row) ? applyDefaults(field.fields, row) : row
-        );
+        result[field.name] = value.map((row) => {
+          const fields2 = rowFields(field, row);
+          return fields2 && isPlainObject(row) ? applyDefaults(fields2, row, localization) : row;
+        });
+      }
+    } else if (field.localized && localization && field.defaultValue !== void 0) {
+      const map = isPlainObject(value) ? value : {};
+      if (map[localization.defaultLocale] === void 0) {
+        result[field.name] = {
+          ...map,
+          [localization.defaultLocale]: structuredClone(field.defaultValue)
+        };
       }
     } else if (value === void 0 && field.defaultValue !== void 0) {
       result[field.name] = structuredClone(field.defaultValue);
@@ -645,28 +727,41 @@ function fillMissing(fields, data) {
     if (field.type === "group") {
       result[field.name] = fillMissing(field.fields, isPlainObject(value) ? value : {});
     } else if (value === void 0) {
-      result[field.name] = field.type === "array" || isHasMany(field) ? [] : null;
+      result[field.name] = hasRows(field) || isHasMany(field) ? [] : null;
     }
   }
   return result;
 }
-function generateSlugs(fields, data) {
+function generateSlugs(fields, data, localization = null) {
   const result = { ...data };
   for (const field of fields) {
-    if (field.type === "slug") {
+    if (field.type === "slug" && field.localized && localization) {
+      const map = isPlainObject(result[field.name]) ? result[field.name] : {};
+      const source = field.from ? result[field.from] : void 0;
+      const next = { ...map };
+      for (const locale of localization.locales) {
+        const current = map[locale];
+        const from = isPlainObject(source) ? source[locale] : source;
+        if (typeof current === "string" && current !== "") next[locale] = slugify(current);
+        else if (typeof from === "string" && from.trim() !== "") next[locale] = slugify(from);
+      }
+      result[field.name] = next;
+    } else if (field.type === "slug") {
       const current = result[field.name];
       if (typeof current === "string" && current !== "") {
         result[field.name] = slugify(current);
       } else if (field.from) {
-        const source = result[field.from];
+        const raw = result[field.from];
+        const source = isPlainObject(raw) && localization ? raw[localization.defaultLocale] : raw;
         if (typeof source === "string" && source.trim() !== "") result[field.name] = slugify(source);
       }
     } else if (field.type === "group" && isPlainObject(result[field.name])) {
-      result[field.name] = generateSlugs(field.fields, result[field.name]);
-    } else if (field.type === "array" && Array.isArray(result[field.name])) {
-      result[field.name] = result[field.name].map(
-        (row) => isPlainObject(row) ? generateSlugs(field.fields, row) : row
-      );
+      result[field.name] = generateSlugs(field.fields, result[field.name], localization);
+    } else if (hasRows(field) && Array.isArray(result[field.name])) {
+      result[field.name] = result[field.name].map((row) => {
+        const fields2 = rowFields(field, row);
+        return fields2 && isPlainObject(row) ? generateSlugs(fields2, row, localization) : row;
+      });
     }
   }
   return result;
@@ -717,9 +812,45 @@ async function validateFields(fields, input, options, prefix = "") {
       references.push(...sub.references);
       continue;
     }
+    const localization = options.localization;
+    if (field.localized && localization) {
+      if (!isEmpty(raw) && !isPlainObject(raw)) {
+        fail("must be an object with one value per locale");
+        continue;
+      }
+      const map = isPlainObject(raw) ? raw : {};
+      const written = options.locale ?? localization.defaultLocale;
+      const out = {};
+      for (const locale of localization.locales) {
+        const own = locale === written;
+        const localePath = own ? path : `${path}.${locale}`;
+        const failLocale = (message) => errors.push({ field: localePath, message });
+        const value2 = map[locale];
+        if (isEmpty(value2) || Array.isArray(value2) && value2.length === 0) {
+          if (own && field.required && !options.skipRequired) failLocale("is required");
+          out[locale] = hasRows(field) || isHasMany(field) ? [] : null;
+          if (own && !field.required) await runCustom(field, null, options, failLocale);
+          continue;
+        }
+        const normalized = await normalizeValue(
+          field,
+          value2,
+          localePath,
+          options,
+          failLocale,
+          errors,
+          references
+        );
+        if (normalized === void 0) continue;
+        out[locale] = normalized;
+        if (own) await runCustom(field, normalized, options, failLocale);
+      }
+      data[field.name] = out;
+      continue;
+    }
     if (isEmpty(raw) || Array.isArray(raw) && raw.length === 0) {
       if (field.required && !options.skipRequired) fail("is required");
-      data[field.name] = field.type === "array" || isHasMany(field) ? [] : null;
+      data[field.name] = hasRows(field) || isHasMany(field) ? [] : null;
       if (!field.required) await runCustom(field, null, options, fail);
       continue;
     }
@@ -821,10 +952,36 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
       }
       return rows;
     }
+    case "blocks":
+      return normalizeBlocks(field, raw, path, options, fail, errors, references);
     case "group":
       return raw;
   }
 }
+async function normalizeBlocks(field, raw, path, options, fail, errors, references) {
+  if (!Array.isArray(raw)) return fail("must be an array of blocks");
+  if (field.minRows !== void 0 && raw.length < field.minRows)
+    return fail(`must have at least ${field.minRows} blocks`);
+  if (field.maxRows !== void 0 && raw.length > field.maxRows)
+    return fail(`must have at most ${field.maxRows} blocks`);
+  const rows = [];
+  for (const [i, row] of raw.entries()) {
+    const fields = rowFields(field, row);
+    if (!isPlainObject(row) || !fields) {
+      errors.push({
+        field: `${path}.${i}.blockType`,
+        message: `must be one of: ${field.blocks.map((b) => b.slug).join(", ")}`
+      });
+      continue;
+    }
+    const sub = await validateFields(fields, row, options, `${path}.${i}.`);
+    errors.push(...sub.errors);
+    references.push(...sub.references);
+    const id = typeof row.id === "string" && row.id !== "" ? row.id : randomUUID();
+    rows.push({ id, blockType: row.blockType, ...sub.data });
+  }
+  return rows;
+}
 function normalizeSelect(field, raw, fail) {
   const allowed2 = field.options.map((o) => typeof o === "string" ? o : o.value);
   const values = field.hasMany ? raw : [raw];
@@ -836,29 +993,94 @@ function normalizeSelect(field, raw, fail) {
   return field.hasMany ? [...new Set(values)] : values[0];
 }
 
-// src/fields.ts
-var FIELD_TYPES = [
-  "text",
-  "textarea",
-  "number",
-  "boolean",
-  "date",
-  "email",
-  "json",
-  "select",
-  "slug",
-  "richText",
-  "upload",
-  "relationship",
-  "array",
-  "group"
-];
-
 // src/load-config.ts
 import { existsSync } from "fs";
 import { resolve } from "path";
 import { createJiti } from "jiti";
 
+// src/webhooks.ts
+import { createHmac as createHmac2, randomUUID as randomUUID2 } from "crypto";
+var WEBHOOK_EVENTS = [
+  "create",
+  "update",
+  "delete",
+  "publish",
+  "unpublish",
+  "draft"
+];
+var RETRY_DELAYS = [1e3, 5e3];
+var TIMEOUT = 1e4;
+var Webhooks = class {
+  constructor(hooks, logger, fetcher = (...args) => fetch(...args), retryDelays = RETRY_DELAYS) {
+    this.hooks = hooks;
+    this.logger = logger;
+    this.fetcher = fetcher;
+    this.retryDelays = retryDelays;
+  }
+  hooks;
+  logger;
+  fetcher;
+  retryDelays;
+  pending = /* @__PURE__ */ new Set();
+  emit(event, target, doc) {
+    if (this.hooks.length === 0) return;
+    const payload = { event, ...target, doc, timestamp: (/* @__PURE__ */ new Date()).toISOString() };
+    for (const hook of this.hooks) {
+      if (!matches(hook, payload)) continue;
+      const delivery = this.deliver(hook, payload).finally(() => this.pending.delete(delivery));
+      this.pending.add(delivery);
+    }
+  }
+  /** Waits for deliveries in progress, e.g. before a serverless function returns. */
+  async flush() {
+    while (this.pending.size > 0) await Promise.allSettled([...this.pending]);
+  }
+  async deliver(hook, payload) {
+    const body = JSON.stringify(payload);
+    const headers = {
+      "content-type": "application/json",
+      "user-agent": "easy-cms-webhooks",
+      "x-easy-cms-event": payload.event,
+      "x-easy-cms-delivery": randomUUID2(),
+      ...hook.headers
+    };
+    if (hook.secret) {
+      headers["x-easy-cms-signature"] = `sha256=${createHmac2("sha256", hook.secret).update(body).digest("hex")}`;
+    }
+    for (let attempt = 0; ; attempt++) {
+      try {
+        const response = await this.fetcher(hook.url, {
+          method: "POST",
+          headers,
+          body,
+          signal: AbortSignal.timeout(TIMEOUT)
+        });
+        if (response.ok || response.status < 500 && response.status !== 429) {
+          if (!response.ok)
+            this.logger.warn(`Webhook ${hook.url} answered ${response.status} to ${payload.event}`);
+          return;
+        }
+        throw new Error(`status ${response.status}`);
+      } catch (error) {
+        const delay = this.retryDelays[attempt];
+        if (delay === void 0) {
+          this.logger.error(
+            `Webhook ${hook.url} failed for ${payload.event}: ${error.message}`
+          );
+          return;
+        }
+        await new Promise((resolve3) => setTimeout(resolve3, delay));
+      }
+    }
+  }
+};
+function matches(hook, payload) {
+  if (hook.events && !hook.events.includes(payload.event)) return false;
+  if (payload.collection !== void 0)
+    return !hook.collections || hook.collections.includes(payload.collection);
+  return !hook.globals || hook.globals.includes(payload.global);
+}
+
 // src/validate-config.ts
 var MIN_SECRET_LENGTH = 32;
 var BUILTIN_COLLECTIONS = ["users", "media"];
@@ -868,6 +1090,8 @@ var RESERVED_SLUGS = /* @__PURE__ */ new Set([
   "sessions",
   "login-attempts",
   "document-versions",
+  "scheduled-jobs",
+  "jobs",
   "migrations",
   "access"
 ]);
@@ -889,6 +1113,8 @@ function validateConfig(config) {
   validateUpload(config, add);
   validateAuth(config, add);
   validateCors(config.cors, add);
+  validateLocalization(config, add);
+  validateWebhooks(config, add);
   const collections = asArray(config.collections, "collections", add);
   const globals = asArray(config.globals, "globals", add);
   const collectionSlugs = /* @__PURE__ */ new Set([...BUILTIN_COLLECTIONS]);
@@ -965,6 +1191,112 @@ function validateAuth(config, add) {
     }
   }
 }
+var LOCALE_PATTERN = /^[a-z]{2,3}(-[A-Za-z0-9]{2,8})*$/;
+var LOCALIZABLE = /* @__PURE__ */ new Set([
+  "text",
+  "textarea",
+  "email",
+  "slug",
+  "richText",
+  "number",
+  "boolean",
+  "date",
+  "json",
+  "select",
+  "upload",
+  "relationship",
+  "blocks",
+  "array"
+]);
+function validateLocalization(config, add) {
+  const localization = config.localization;
+  if (localization !== void 0 && localization !== null) {
+    const locales = localization?.locales;
+    if (!Array.isArray(locales) || locales.length === 0) {
+      add("localization.locales", "must be a non-empty list of locales", "locales: ['th', 'en']");
+    } else {
+      const seen = /* @__PURE__ */ new Set();
+      for (const [i, locale] of locales.entries()) {
+        if (typeof locale !== "string" || !LOCALE_PATTERN.test(locale)) {
+          add(
+            `localization.locales[${i}]`,
+            `must be a locale code like "th" or "en-US" (got ${JSON.stringify(locale)})`
+          );
+        } else if (seen.has(locale)) {
+          add(`localization.locales[${i}]`, `duplicate locale "${locale}"`);
+        }
+        seen.add(locale);
+      }
+      const fallbackDefault = localization.defaultLocale;
+      if (fallbackDefault !== void 0 && !locales.includes(fallbackDefault)) {
+        add("localization.defaultLocale", `must be one of the locales (got "${fallbackDefault}")`);
+      }
+    }
+  }
+  const walk = (fields, path, insideLocalized = false) => {
+    if (!Array.isArray(fields)) return;
+    for (const field of fields) {
+      if (typeof field?.name !== "string") continue;
+      const fieldPath = `${path}.${field.name}`;
+      if (field.localized) {
+        if (!localization) {
+          add(
+            `${fieldPath}.localized`,
+            "needs `localization` in the config",
+            "localization: { locales: ['th', 'en'] }"
+          );
+        } else if (!LOCALIZABLE.has(field.type)) {
+          add(
+            `${fieldPath}.localized`,
+            `${field.type} fields cannot be localized`,
+            "localize the fields inside it instead"
+          );
+        } else if (insideLocalized) {
+          add(
+            `${fieldPath}.localized`,
+            "is inside a localized field, which already holds one value per locale"
+          );
+        }
+      }
+      const inside = insideLocalized || field.localized === true;
+      if (field.type === "group" || field.type === "array")
+        walk(field.fields, `${fieldPath}.fields`, inside);
+      if (field.type === "blocks")
+        for (const block of field.blocks ?? [])
+          walk(block?.fields, `${fieldPath}.blocks.${block?.slug}`, inside);
+    }
+  };
+  for (const [i, c] of (config.collections ?? []).entries())
+    walk(c?.fields, `collections[${i}].fields`);
+  for (const [i, g] of (config.globals ?? []).entries()) walk(g?.fields, `globals[${i}].fields`);
+}
+function validateWebhooks(config, add) {
+  const hooks = config.webhooks;
+  if (hooks === void 0) return;
+  if (!Array.isArray(hooks)) {
+    add("webhooks", "must be a list", "webhooks: [{ url: 'https://example.com/hook' }]");
+    return;
+  }
+  const collections = /* @__PURE__ */ new Set([
+    ...BUILTIN_COLLECTIONS,
+    ...(config.collections ?? []).map((c) => c?.slug)
+  ]);
+  const globals = new Set((config.globals ?? []).map((g) => g?.slug));
+  for (const [i, hook] of hooks.entries()) {
+    const path = `webhooks[${i}]`;
+    if (typeof hook?.url !== "string" || !/^https?:\/\/\S+$/.test(hook.url)) {
+      add(`${path}.url`, "must be an http(s) URL");
+    }
+    for (const event of hook?.events ?? []) {
+      if (!WEBHOOK_EVENTS.includes(event))
+        add(`${path}.events`, `unknown event "${event}"`, `use: ${WEBHOOK_EVENTS.join(", ")}`);
+    }
+    for (const slug of hook?.collections ?? [])
+      if (!collections.has(slug)) add(`${path}.collections`, `unknown collection "${slug}"`);
+    for (const slug of hook?.globals ?? [])
+      if (!globals.has(slug)) add(`${path}.globals`, `unknown global "${slug}"`);
+  }
+}
 function validateCors(cors, add) {
   if (cors === void 0 || cors === "*") return;
   if (!Array.isArray(cors)) {
@@ -1032,10 +1364,14 @@ function validateContainer(container, path, collectionSlugs, add) {
       add(`${path}.versions.max`, "must be a positive integer");
     }
   }
+  if (container.schedule && !container.drafts) {
+    add(`${path}.schedule`, "needs `drafts: true`", "scheduling publishes and unpublishes drafts");
+  }
   if (container.preview !== void 0 && typeof container.preview !== "function") {
     add(
       `${path}.preview`,
       "must be a function ({ doc }) => url",
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: an example shown to the user
       "preview: ({ doc }) => `/posts/${doc.slug}`"
     );
   }
@@ -1115,6 +1451,43 @@ function validateField(field, path, siblings, collectionSlugs, add) {
         checkRange(field.minRows, field.maxRows, "minRows", "maxRows", path, add);
       validateFields2(field.fields, `${path}.fields`, /* @__PURE__ */ new Set(["id"]), collectionSlugs, add);
       break;
+    case "blocks": {
+      if (!Array.isArray(field.blocks) || field.blocks.length === 0) {
+        add(
+          `${path}.blocks`,
+          "must contain at least one block",
+          "blocks: [{ slug: 'hero', fields: [...] }]"
+        );
+        break;
+      }
+      checkRange(field.minRows, field.maxRows, "minRows", "maxRows", path, add);
+      const seen = /* @__PURE__ */ new Set();
+      for (const [i, block] of field.blocks.entries()) {
+        const blockPath = `${path}.blocks[${i}]`;
+        if (typeof block?.slug !== "string" || !SLUG_PATTERN.test(block.slug)) {
+          add(
+            `${blockPath}.slug`,
+            'must be lowercase letters, digits, "-" or "_", starting with a letter'
+          );
+        } else if (seen.has(block.slug)) {
+          add(`${blockPath}.slug`, `duplicate block "${block.slug}"`);
+        } else {
+          seen.add(block.slug);
+        }
+        if (!Array.isArray(block?.fields)) {
+          add(`${blockPath}.fields`, "must be an array");
+          continue;
+        }
+        validateFields2(
+          block.fields,
+          `${blockPath}.fields`,
+          /* @__PURE__ */ new Set(["id", "blockType"]),
+          collectionSlugs,
+          add
+        );
+      }
+      break;
+    }
   }
 }
 function checkRange(min, max, minName, maxName, path, add) {
@@ -1179,6 +1552,11 @@ async function resolveConfig(input) {
   const result = {
     ...rest,
     cors: config.cors ?? [],
+    localization: config.localization ? {
+      locales: config.localization.locales,
+      defaultLocale: config.localization.defaultLocale ?? config.localization.locales[0] ?? "",
+      fallback: config.localization.fallback ?? true
+    } : null,
     routes: { api: `/${(config.routes?.api ?? DEFAULT_API_PATH).replace(/^\/+|\/+$/g, "")}` },
     admin: {
       path: config.admin?.path ?? DEFAULT_ADMIN_PATH,
@@ -1201,7 +1579,8 @@ async function resolveConfig(input) {
     collections: [
       ...config.collections ?? [],
       ...internalCollections,
-      ...usesVersions(config) ? [versionsCollection] : []
+      ...usesVersions(config) ? [versionsCollection] : [],
+      ...usesSchedule(config) ? [scheduledJobsCollection] : []
     ],
     globals: config.globals ?? []
   };
@@ -1211,6 +1590,9 @@ async function resolveConfig(input) {
 function usesVersions(config) {
   return [...config.collections ?? [], ...config.globals ?? []].some((c) => c.versions);
 }
+function usesSchedule(config) {
+  return [...config.collections ?? [], ...config.globals ?? []].some((c) => c.schedule);
+}
 
 // src/load-config.ts
 var CONFIG_FILE_NAMES = [
@@ -1260,6 +1642,98 @@ async function loadConfig(options = {}) {
 // src/local-api.ts
 import { randomBytes as randomBytes3 } from "crypto";
 
+// src/localization.ts
+var ALL_LOCALES = "all";
+var isPlainObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isEmpty2 = (value) => value === void 0 || value === null || value === "";
+function pickLocale(fields, data, locale, localization, fallback) {
+  if (locale === ALL_LOCALES) return data;
+  const result = { ...data };
+  for (const field of fields) {
+    const value = result[field.name];
+    if (field.localized) {
+      const map = isPlainObject2(value) ? value : {};
+      const own = map[locale];
+      const blank = isEmpty2(own) || Array.isArray(own) && own.length === 0;
+      const picked = blank && fallback ? map[localization.defaultLocale] ?? null : own ?? null;
+      const list = hasRows(field) || "hasMany" in field && field.hasMany === true;
+      result[field.name] = picked === null && list ? [] : picked;
+    } else if (field.type === "group" && isPlainObject2(value)) {
+      result[field.name] = pickLocale(field.fields, value, locale, localization, fallback);
+    } else if (hasRows(field) && Array.isArray(value)) {
+      result[field.name] = value.map((row) => {
+        const fields2 = rowFields(field, row);
+        return fields2 && isPlainObject2(row) ? pickLocale(fields2, row, locale, localization, fallback) : row;
+      });
+    }
+  }
+  return result;
+}
+function toLocaleMaps(fields, input, current, locale) {
+  const result = { ...input };
+  for (const field of fields) {
+    if (!Object.hasOwn(input, field.name)) continue;
+    const value = input[field.name];
+    const previous = current[field.name];
+    if (field.localized) {
+      const map = isPlainObject2(previous) ? previous : {};
+      result[field.name] = { ...map, [locale]: value };
+    } else if (field.type === "group" && isPlainObject2(value)) {
+      result[field.name] = toLocaleMaps(
+        field.fields,
+        value,
+        isPlainObject2(previous) ? previous : {},
+        locale
+      );
+    } else if (hasRows(field) && Array.isArray(value)) {
+      const rows = new Map(
+        (Array.isArray(previous) ? previous : []).filter(isPlainObject2).map((row) => [String(row.id), row])
+      );
+      result[field.name] = value.map((row) => {
+        const fields2 = rowFields(field, row);
+        return fields2 && isPlainObject2(row) ? toLocaleMaps(fields2, row, rows.get(String(row.id)) ?? {}, locale) : row;
+      });
+    }
+  }
+  return result;
+}
+function localizePath(fields, path, locale, locales = []) {
+  const segments = path.split(".");
+  let list = fields;
+  for (let i = 0; i < segments.length; i++) {
+    const field = list.find((f) => f.name === segments[i]);
+    if (!field) return path;
+    if (field.localized) {
+      const next = segments[i + 1];
+      if (next !== void 0 && locales.includes(next)) return path;
+      return [...segments.slice(0, i + 1), locale, ...segments.slice(i + 1)].join(".");
+    }
+    if (field.type === "group" || field.type === "array") {
+      list = field.fields;
+      continue;
+    }
+    return path;
+  }
+  return path;
+}
+function localizeWhere(fields, where, locale, locales = []) {
+  if (!where) return where;
+  const out = {};
+  for (const [key2, value] of Object.entries(where)) {
+    if ((key2 === "and" || key2 === "or") && Array.isArray(value)) {
+      out[key2] = value.map((w) => localizeWhere(fields, w, locale, locales));
+    } else {
+      out[localizePath(fields, key2, locale, locales)] = value;
+    }
+  }
+  return out;
+}
+function localizeSort(fields, sort, locale, locales = []) {
+  return sort.map(
+    (entry) => entry.startsWith("-") ? `-${localizePath(fields, entry.slice(1), locale, locales)}` : localizePath(fields, entry, locale, locales)
+  );
+}
+
 // src/logger.ts
 var consoleLogger = {
   info: (message) => console.info(`[easy-cms] ${message}`),
@@ -1400,10 +1874,16 @@ function collectSlots(fields, data, bySlug, slots) {
     if (value === null || value === void 0) continue;
     if (field.type === "group") {
       if (typeof value === "object") collectSlots(field.fields, value, bySlug, slots);
-    } else if (field.type === "array") {
-      if (Array.isArray(value))
-        for (const row of value) collectSlots(field.fields, row, bySlug, slots);
+    } else if (hasRows(field)) {
+      if (Array.isArray(value)) {
+        for (const row of value) {
+          const fields2 = rowFields(field, row);
+          if (fields2 && row && typeof row === "object")
+            collectSlots(fields2, row, bySlug, slots);
+        }
+      }
     } else if (field.type === "relationship" || field.type === "upload") {
+      if (typeof value === "object" && !Array.isArray(value)) continue;
       const collection2 = field.type === "upload" ? "media" : field.to;
       if (!bySlug.has(collection2)) continue;
       if (Array.isArray(value)) {
@@ -1618,8 +2098,19 @@ async function createEasyCMS(config, options = {}) {
     logger,
     interactive: options.interactive ?? false
   });
-  return new EasyCMS(resolved2, db, logger, storage);
+  const cms = new EasyCMS(resolved2, db, logger, storage);
+  const scheduling = [...resolved2.collections, ...resolved2.globals].some((c) => c.schedule);
+  if (scheduling && options.scheduler !== false) cms.startScheduler();
+  return cms;
 }
+var toJob = (row) => ({
+  id: row.id,
+  action: row.action,
+  runAt: String(row.runAt),
+  state: row.state,
+  error: row.error ?? null,
+  author: row.author ?? null
+});
 var EasyCMS = class {
   config;
   db;
@@ -1629,12 +2120,14 @@ var EasyCMS = class {
   /** Where uploaded files are stored. */
   storage;
   versions;
+  webhooks;
   constructor(config, db, logger = consoleLogger, storage = localStorage({ dir: config.upload.dir })) {
     this.config = config;
     this.db = db;
     this.logger = logger;
     this.storage = storage;
     this.versions = new VersionStore(db);
+    this.webhooks = new Webhooks(config.webhooks ?? [], logger);
     this.auth = new Auth(this);
   }
   async find(collection2, options = {}) {
@@ -1645,12 +2138,19 @@ var EasyCMS = class {
     if (!Number.isInteger(limit) || limit < 0)
       throw new QueryError("limit must be a non-negative integer");
     if (!Number.isInteger(page) || page < 1) throw new QueryError("page must be a positive integer");
-    const where = draftWhere(
+    const where = this.whereFor(
       config,
-      options.draft,
-      await this.readWhere(config, guard, options.where)
+      draftWhere(config, options.draft, await this.readWhere(config, guard, options.where)),
+      options
+    );
+    const requested = options.sort === void 0 ? ["-createdAt"] : [options.sort].flat();
+    const locale = this.localeOf(options);
+    const sort = locale === void 0 ? requested : localizeSort(
+      config.fields,
+      requested,
+      locale === ALL_LOCALES ? this.config.localization?.defaultLocale ?? locale : locale,
+      this.config.localization?.locales ?? []
     );
-    const sort = options.sort === void 0 ? ["-createdAt"] : [options.sort].flat();
     const result = await this.db.find({ collection: collection2, where, sort, limit, page });
     const found = options.draft ? await this.withDrafts(config, result.docs) : result.docs;
     const docs = await this.output(config, found, guard, options);
@@ -1661,7 +2161,11 @@ var EasyCMS = class {
     const guard = guardOf(options);
     const parsed = parseId(id);
     if (parsed === void 0) return null;
-    const where = draftWhere(config, options.draft, await this.readWhere(config, guard, void 0));
+    const where = this.whereFor(
+      config,
+      draftWhere(config, options.draft, await this.readWhere(config, guard, void 0)),
+      options
+    );
     const doc = where ? (await this.db.find({
       collection: collection2,
       where: andWhere(where, { id: { equals: parsed } }),
@@ -1676,10 +2180,14 @@ var EasyCMS = class {
   }
   async count(collection2, options = {}) {
     const config = this.collection(collection2);
-    const where = draftWhere(
+    const where = this.whereFor(
       config,
-      options.draft,
-      await this.readWhere(config, guardOf(options), options.where)
+      draftWhere(
+        config,
+        options.draft,
+        await this.readWhere(config, guardOf(options), options.where)
+      ),
+      options
     );
     return this.db.count({ collection: collection2, where });
   }
@@ -1829,7 +2337,8 @@ var EasyCMS = class {
       collection2,
       parsed,
       config.drafts ? { ...data, status: "draft" } : data,
-      options
+      options,
+      "restore"
     );
   }
   /**
@@ -1861,14 +2370,34 @@ var EasyCMS = class {
       input,
       this.fieldChecker("update", guard, parsed, input)
     );
-    const merged = base ? mergeForUpdate(config.fields, base, filtered) : applyDefaults(config.fields, filtered);
+    const localized = this.toMaps(config, filtered, base ?? {}, options);
+    const merged = base ? mergeForUpdate(config.fields, base, localized) : applyDefaults(config.fields, localized, this.config.localization);
     if (config.drafts) merged.status = filtered.status ?? base?.status ?? "draft";
-    const doc = await this.previewDoc(config, generateSlugs(config.fields, merged), {
-      id: parsed ?? 0,
-      createdAt: base?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
-    });
+    const doc = await this.previewDoc(
+      config,
+      generateSlugs(config.fields, merged, this.config.localization),
+      {
+        id: parsed ?? 0,
+        createdAt: base?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
+      },
+      options
+    );
     const [out] = await this.output(config, [doc], guard, { ...options, draft: true });
-    return { doc: out, url: this.previewURL(config, out) };
+    return { doc: out, url: this.previewURL(config, out, options) };
+  }
+  /**
+   * A token that lets a page read one document's current draft for a while (default one hour),
+   * without a login: `GET /api/cms/:collection/:id?preview=<token>`. The admin adds one to the
+   * preview URL as `easy-cms-preview`, for sites on another origin.
+   */
+  createPreviewToken(target, options = {}) {
+    const seconds = options.expiresIn ?? 60 * 60;
+    const normalized = "global" in target ? target : { collection: target.collection, id: String(target.id) };
+    return signPreviewToken(this.config.secret, normalized, Date.now() + seconds * 1e3);
+  }
+  /** What a preview token opens, or `null` when it is invalid or expired. */
+  verifyPreviewToken(token) {
+    return token ? verifyPreviewToken(this.config.secret, token) : null;
   }
   /** Live preview of a global. See `preview`. */
   async previewGlobal(slug, data, options = {}) {
@@ -1885,20 +2414,28 @@ var EasyCMS = class {
     const current = await this.globalDraft(config, saved);
     const merged = generateSlugs(
       config.fields,
-      applyDefaults(config.fields, mergeForUpdate(config.fields, current, input))
+      applyDefaults(
+        config.fields,
+        mergeForUpdate(config.fields, current, this.toMaps(config, input, current, options)),
+        this.config.localization
+      ),
+      this.config.localization
     );
     if (config.drafts) merged.status = input.status ?? current.status ?? "draft";
-    const doc = await this.previewDoc(config, merged, { id: 0 });
+    const doc = await this.previewDoc(config, merged, { id: 0 }, options);
     const [out] = await this.output(config, [doc], guard, { ...options, draft: true });
     const { id: _id, ...global2 } = out;
-    return { doc: global2, url: this.previewURL(config, global2) };
+    return { doc: global2, url: this.previewURL(config, global2, options) };
   }
   /** Coerces preview input like a save would, keeping values that would fail validation. */
-  async previewDoc(config, data, system) {
+  async previewDoc(config, data, system, options = {}) {
+    const locale = this.localeOf(options);
     const { data: clean } = await validateFields(config.fields, data, {
       operation: "update",
       root: data,
-      skipRequired: true
+      skipRequired: true,
+      localization: this.config.localization,
+      ...locale !== void 0 && locale !== ALL_LOCALES ? { locale } : {}
     });
     return {
       ...data,
@@ -1908,10 +2445,12 @@ var EasyCMS = class {
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
   }
-  previewURL(config, doc) {
+  previewURL(config, doc, options) {
     if (!config.preview) return null;
+    const content = this.localeOf(options);
+    const locale = content && content !== ALL_LOCALES ? content : this.config.admin.locale;
     try {
-      return config.preview({ doc, locale: this.config.admin.locale }) ?? null;
+      return config.preview({ doc, locale }) ?? null;
     } catch (error) {
       this.logger.error(`preview URL of "${config.slug}" failed: ${error.message}`);
       return null;
@@ -1940,7 +2479,8 @@ var EasyCMS = class {
       input,
       this.fieldChecker("update", guard, parsed, input)
     );
-    let merged = mergeForUpdate(config.fields, current, filtered);
+    const localized = mode === "restore" ? filtered : this.toMaps(config, filtered, current, options);
+    let merged = mergeForUpdate(config.fields, current, localized);
     if (config.drafts)
       merged.status = Object.hasOwn(filtered, "status") ? filtered.status : current.status;
     const base = this.hookArgs(config, guard);
@@ -1952,9 +2492,10 @@ var EasyCMS = class {
     );
     let prepared = await this.prepare(
       config,
-      generateSlugs(config.fields, merged),
+      generateSlugs(config.fields, merged, this.config.localization),
       "update",
-      parsed
+      parsed,
+      options
     );
     prepared = await this.transform(
       config.hooks?.beforeChange,
@@ -1963,7 +2504,7 @@ var EasyCMS = class {
       prepared
     );
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    if (mode === "save" && this.separateDrafts(config) && existing.status === "published" && prepared.status === "draft") {
+    if (mode !== "unpublish" && this.separateDrafts(config) && existing.status === "published" && prepared.status === "draft") {
       if (password !== void 0) {
         throw new ValidationError(collection2, [
           { field: "password", message: "cannot be changed in a draft; publish instead" }
@@ -1977,6 +2518,7 @@ var EasyCMS = class {
         previousDoc: current,
         operation: "update"
       });
+      this.emit(config, "draft", draft);
       const [out2] = await this.output(config, [draft], guard, {
         ...options,
         draft: true
@@ -1998,6 +2540,7 @@ var EasyCMS = class {
       previousDoc: current,
       operation: "update"
     });
+    this.emit(config, "update", doc, existing.status);
     const [out] = await this.output(config, [doc], guard, { ...options, draft: true });
     return out;
   }
@@ -2015,11 +2558,16 @@ var EasyCMS = class {
     if (config.slug === USERS) await this.auth.revokeSessions(parsed);
     await this.db.delete({ collection: collection2, id: parsed });
     if (versionLimit(config)) await this.versions.deleteAll(collectionParent(collection2), parsed);
+    if (config.schedule) {
+      for (const job of await this.pendingJobs(collection2, parsed))
+        await this.db.delete({ collection: SCHEDULED_JOBS, id: job.id });
+    }
     await this.notify(config.hooks?.afterDelete, "afterDelete", config.slug, {
       ...base,
       id: parsed,
       doc: existing
     });
+    this.emit(config, "delete", existing);
     const [out] = await this.output(config, [existing], guard, { depth: 0, draft: true });
     return out;
   }
@@ -2029,7 +2577,10 @@ var EasyCMS = class {
     await this.checkGlobalAccess(config, "read", guard);
     const saved = await this.db.findGlobal({ slug });
     const stored = saved && options.draft ? await this.globalDraft(config, saved) : saved;
-    const data = fillMissing(config.fields, applyDefaults(config.fields, stored ?? {}));
+    const data = fillMissing(
+      config.fields,
+      applyDefaults(config.fields, stored ?? {}, this.config.localization)
+    );
     if (!stored) {
       data.updatedAt = null;
       if (config.drafts) data.status = "draft";
@@ -2066,7 +2617,10 @@ var EasyCMS = class {
     const config = await this.globalVersionTarget(slug, options);
     const version = await this.versions.get(globalParent(slug), 0, versionId);
     if (!version) return null;
-    const data = fillMissing(config.fields, applyDefaults(config.fields, version.data));
+    const data = fillMissing(
+      config.fields,
+      applyDefaults(config.fields, version.data, this.config.localization)
+    );
     const [out] = await this.output(config, [{ ...data, id: 0 }], guardOf(options), {
       ...options,
       draft: true
@@ -2083,7 +2637,8 @@ var EasyCMS = class {
     return this.saveGlobal(
       slug,
       config.drafts ? { ...data, status: "draft" } : data,
-      options
+      options,
+      "restore"
     );
   }
   async globalVersionTarget(slug, options) {
@@ -2110,13 +2665,19 @@ var EasyCMS = class {
     );
     const existing = await this.db.findGlobal({ slug }) ?? {};
     const current = await this.globalDraft(config, existing);
+    const localized = mode === "restore" ? input : this.toMaps(config, input, current, options);
     const merged = generateSlugs(
       config.fields,
-      applyDefaults(config.fields, mergeForUpdate(config.fields, current, input))
+      applyDefaults(
+        config.fields,
+        mergeForUpdate(config.fields, current, localized),
+        this.config.localization
+      ),
+      this.config.localization
     );
     if (config.drafts) merged.status = input.status ?? current.status ?? "draft";
     const base = this.hookArgs(config, guard);
-    let prepared = await this.prepare(config, merged, "update", void 0);
+    let prepared = await this.prepare(config, merged, "update", void 0, options);
     prepared = await this.transform(
       config.hooks?.beforeChange,
       "data",
@@ -2124,7 +2685,7 @@ var EasyCMS = class {
       prepared
     );
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    if (mode === "save" && this.separateDrafts(config) && existing.status === "published" && prepared.status === "draft") {
+    if (mode !== "unpublish" && this.separateDrafts(config) && existing.status === "published" && prepared.status === "draft") {
       const draft = { ...prepared, updatedAt: now };
       await this.saveVersion(config, globalParent(slug), 0, draft, guard);
       await this.notify(config.hooks?.afterChange, "afterChange", slug, {
@@ -2133,6 +2694,7 @@ var EasyCMS = class {
         previousDoc: current,
         operation: "update"
       });
+      this.emit(config, "draft", draft);
       return this.findGlobal(slug, { ...options, draft: true });
     }
     const doc = await this.db.updateGlobal({ slug, data: { ...prepared, updatedAt: now } });
@@ -2143,6 +2705,7 @@ var EasyCMS = class {
       previousDoc: current,
       operation: "update"
     });
+    this.emit(config, "update", doc, existing.status);
     return this.findGlobal(slug, { ...options, draft: true });
   }
   /**
@@ -2164,9 +2727,177 @@ var EasyCMS = class {
     return { update: await check("update"), delete: await check("delete") };
   }
   /** Closes the database connection. */
+  /**
+   * Waits until webhook deliveries in progress are done. Call it before a serverless function
+   * returns, which may otherwise stop them.
+   */
+  flushWebhooks() {
+    return this.webhooks.flush();
+  }
   async destroy() {
+    if (this.schedulerTimer) clearInterval(this.schedulerTimer);
+    await this.running;
+    await this.webhooks.flush();
     await this.db.destroy();
   }
+  // --- Scheduled publishing --------------------------------------------------
+  schedulerTimer;
+  running = Promise.resolve();
+  /** Runs due jobs every `interval` ms in this process (`createEasyCMS` does this by default). */
+  startScheduler(interval = 6e4) {
+    if (this.schedulerTimer) return;
+    this.schedulerTimer = setInterval(() => {
+      this.running = this.running.then(
+        () => this.runScheduled().catch(
+          (error) => this.logger.error(`Scheduled jobs failed: ${error.message}`)
+        )
+      );
+    }, interval);
+    this.schedulerTimer.unref?.();
+  }
+  /**
+   * Publishes or unpublishes documents whose scheduled time has come. Safe to call often, e.g.
+   * from a cron job (`GET <api>/jobs/run`) where no process keeps running.
+   */
+  async runScheduled(now = /* @__PURE__ */ new Date()) {
+    if (!this.config.collections.some((c) => c.slug === SCHEDULED_JOBS))
+      return { ran: 0, failed: 0 };
+    const due = await this.db.find({
+      collection: SCHEDULED_JOBS,
+      where: {
+        and: [{ state: { equals: "pending" } }, { runAt: { lte: now.toISOString() } }]
+      },
+      sort: ["runAt"],
+      limit: 100,
+      page: 1
+    });
+    let failed = 0;
+    for (const row of due.docs) {
+      const parent = String(row.parent);
+      const action = row.action;
+      try {
+        if (parent.startsWith("global:")) {
+          const slug = parent.slice("global:".length);
+          if (action === "publish") await this.saveGlobal(slug, { status: "published" }, {});
+          else await this.saveGlobal(slug, { status: "draft" }, {}, "unpublish");
+        } else if (action === "publish") {
+          await this.updateDocument(parent, row.doc, { status: "published" }, { depth: 0 });
+        } else {
+          await this.updateDocument(
+            parent,
+            row.doc,
+            { status: "draft" },
+            { depth: 0 },
+            "unpublish"
+          );
+        }
+        await this.db.update({
+          collection: SCHEDULED_JOBS,
+          id: row.id,
+          data: { ...row, state: "done" }
+        });
+      } catch (error) {
+        failed++;
+        const message = error.message;
+        this.logger.error(`Scheduled ${action} of ${parent} ${row.doc} failed: ${message}`);
+        await this.db.update({
+          collection: SCHEDULED_JOBS,
+          id: row.id,
+          data: { ...row, state: "failed", error: message.slice(0, 500) }
+        });
+      }
+    }
+    return { ran: due.docs.length - failed, failed };
+  }
+  /** Schedules a publish or unpublish, replacing a pending job with the same action. */
+  async schedule(collection2, id, job, options = {}) {
+    const { parsed } = await this.scheduleTarget(collection2, id, options);
+    return this.addJob(collection2, parsed, job, options);
+  }
+  /** Pending jobs of a document, soonest first. */
+  async scheduled(collection2, id, options = {}) {
+    const { parsed } = await this.scheduleTarget(collection2, id, options);
+    return this.pendingJobs(collection2, parsed);
+  }
+  async cancelSchedule(collection2, id, jobId, options = {}) {
+    const { parsed } = await this.scheduleTarget(collection2, id, options);
+    await this.removeJob(collection2, parsed, jobId);
+  }
+  async scheduleGlobal(slug, job, options = {}) {
+    await this.globalScheduleTarget(slug, options);
+    return this.addJob(`global:${slug}`, 0, job, options);
+  }
+  async scheduledGlobal(slug, options = {}) {
+    await this.globalScheduleTarget(slug, options);
+    return this.pendingJobs(`global:${slug}`, 0);
+  }
+  async cancelGlobalSchedule(slug, jobId, options = {}) {
+    await this.globalScheduleTarget(slug, options);
+    await this.removeJob(`global:${slug}`, 0, jobId);
+  }
+  async scheduleTarget(collection2, id, options) {
+    const config = this.collection(collection2);
+    if (!config.schedule) throw new QueryError(`"${collection2}" has no schedule`);
+    const parsed = parseId(id);
+    const existing = parsed === void 0 ? null : await this.db.findById({ collection: collection2, id: parsed });
+    if (!existing || parsed === void 0) throw new NotFoundError(collection2, id);
+    await this.checkDocumentAccess(config, "update", guardOf(options), parsed, void 0);
+    return { config, parsed };
+  }
+  async globalScheduleTarget(slug, options) {
+    const config = this.global(slug);
+    if (!config.schedule) throw new QueryError(`"${slug}" has no schedule`);
+    await this.checkGlobalAccess(config, "update", guardOf(options));
+  }
+  async addJob(parent, doc, job, options) {
+    const runAt = new Date(job.at);
+    const errors = [];
+    if (job.action !== "publish" && job.action !== "unpublish")
+      errors.push({ field: "action", message: 'must be "publish" or "unpublish"' });
+    if (Number.isNaN(runAt.getTime())) errors.push({ field: "at", message: "must be a valid date" });
+    if (errors.length > 0) throw new ValidationError(SCHEDULED_JOBS, errors);
+    for (const pending of await this.pendingJobs(parent, doc)) {
+      if (pending.action === job.action)
+        await this.db.delete({ collection: SCHEDULED_JOBS, id: pending.id });
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const row = await this.db.create({
+      collection: SCHEDULED_JOBS,
+      data: {
+        parent,
+        doc,
+        action: job.action,
+        runAt: runAt.toISOString(),
+        state: "pending",
+        error: null,
+        author: guardOf(options).user?.id ?? null,
+        createdAt: now,
+        updatedAt: now
+      }
+    });
+    return toJob(row);
+  }
+  async pendingJobs(parent, doc) {
+    const rows = await this.db.find({
+      collection: SCHEDULED_JOBS,
+      where: {
+        and: [
+          { parent: { equals: parent } },
+          { doc: { equals: doc } },
+          { state: { equals: "pending" } }
+        ]
+      },
+      sort: ["runAt"],
+      limit: 0,
+      page: 1
+    });
+    return rows.docs.map(toJob);
+  }
+  async removeJob(parent, doc, jobId) {
+    const job = (await this.pendingJobs(parent, doc)).find((j) => String(j.id) === String(jobId));
+    if (!job) throw new NotFoundError("scheduled job", jobId);
+    await this.db.delete({ collection: SCHEDULED_JOBS, id: job.id });
+  }
   // -------------------------------------------------------------------------
   /** @internal */
   collection(slug) {
@@ -2195,11 +2926,11 @@ var EasyCMS = class {
     });
     if (access === true) return;
     if (access !== false) {
-      const matches = await this.db.count({
+      const matches2 = await this.db.count({
         collection: config.slug,
         where: andWhere(access, { id: { equals: id } })
       });
-      if (matches > 0) return;
+      if (matches2 > 0) return;
     }
     throw deny(guard.user);
   }
@@ -2238,16 +2969,19 @@ var EasyCMS = class {
       if (where === null) return [];
       const found = await this.db.find({
         collection: target.slug,
-        where: draftWhere(target, options.draft, where),
+        where: this.whereFor(target, draftWhere(target, options.draft, where), options),
         sort: [],
         limit: 0,
         page: 1
       });
       const docs2 = options.draft ? await this.withDrafts(target, found.docs) : found.docs;
-      return Promise.all(docs2.map((d) => finish(target, d)));
+      return Promise.all(
+        docs2.map((d) => finish(target, this.pick(target, d, options)))
+      );
     };
     const depth = Math.max(0, Math.min(MAX_DEPTH, Math.trunc(options.depth ?? DEFAULT_DEPTH)));
-    const populated = await populate(load, this.config.collections, config.fields, docs, depth);
+    const localized = docs.map((d) => this.pick(config, d, options));
+    const populated = await populate(load, this.config.collections, config.fields, localized, depth);
     return Promise.all(populated.map((d) => finish(config, d)));
   }
   /** Creates a document: access, input filtering, hooks, validation, then afterChange. */
@@ -2270,7 +3004,11 @@ var EasyCMS = class {
       this.fieldChecker("update", guard, void 0, input)
     );
     const base = this.hookArgs(config, hookGuard ?? guard);
-    let data = applyDefaults(config.fields, filtered);
+    let data = applyDefaults(
+      config.fields,
+      this.toMaps(config, filtered, {}, options),
+      this.config.localization
+    );
     data = await this.transform(
       config.hooks?.beforeValidate,
       "data",
@@ -2279,9 +3017,10 @@ var EasyCMS = class {
     );
     let prepared = await this.prepare(
       config,
-      generateSlugs(config.fields, data),
+      generateSlugs(config.fields, data, this.config.localization),
       "create",
-      void 0
+      void 0,
+      options
     );
     prepared = await this.transform(
       config.hooks?.beforeChange,
@@ -2301,9 +3040,48 @@ var EasyCMS = class {
       doc,
       operation: "create"
     });
+    this.emit(config, "create", doc);
     const [out] = await this.output(config, [doc], hookGuard ?? guard, { ...options, draft: true });
     return out;
   }
+  /** The locale for an operation; `undefined` without localization. Throws on unknown locales. */
+  localeOf(options) {
+    const localization = this.config.localization;
+    if (!localization) return void 0;
+    const locale = options.locale ?? localization.defaultLocale;
+    if (locale !== ALL_LOCALES && !localization.locales.includes(locale)) {
+      throw new QueryError(
+        `Unknown locale "${locale}" (use one of: ${localization.locales.join(", ")}, ${ALL_LOCALES})`
+      );
+    }
+    return locale;
+  }
+  /** Stored localized maps → the values of the requested locale. */
+  pick(config, doc, options) {
+    const localization = this.config.localization;
+    const locale = this.localeOf(options);
+    if (!localization || locale === void 0) return doc;
+    const fallback = options.fallbackLocale ?? localization.fallback;
+    return pickLocale(config.fields, doc, locale, localization, fallback);
+  }
+  /** Input for one locale → stored localized maps, keeping the other locales from `current`. */
+  toMaps(config, input, current, options) {
+    const locale = this.localeOf(options);
+    if (locale === void 0 || locale === ALL_LOCALES) return input;
+    return toLocaleMaps(config.fields, input, current, locale);
+  }
+  /** Makes `where` match localized fields in the operation's locale. */
+  whereFor(config, where, options) {
+    const locale = this.localeOf(options);
+    const localization = this.config.localization;
+    if (locale === void 0 || !localization) return where;
+    return localizeWhere(
+      config.fields,
+      where,
+      locale === ALL_LOCALES ? localization.defaultLocale : locale,
+      localization.locales
+    );
+  }
   /** Drafts are kept as versions (instead of unpublishing) when both are enabled. */
   separateDrafts(config) {
     return config.drafts === true && versionLimit(config) !== void 0;
@@ -2318,6 +3096,24 @@ var EasyCMS = class {
       return version && doc.status === "published" && version.status === "draft" ? draftOf(doc, version) : doc;
     });
   }
+  /** Sends webhook events for a change; `before` is the stored status before it, if any. */
+  emit(config, event, doc, before) {
+    const isGlobal = !this.config.collections.includes(config);
+    if (!isGlobal && INTERNAL_COLLECTIONS.has(config.slug)) return;
+    const body = isGlobal ? { ...snapshotOf(config.fields, doc), updatedAt: doc.updatedAt } : {
+      id: doc.id,
+      ...snapshotOf(config.fields, doc),
+      createdAt: doc.createdAt,
+      updatedAt: doc.updatedAt
+    };
+    const target = isGlobal ? { global: config.slug } : { collection: config.slug, id: doc.id };
+    this.webhooks.emit(event, target, body);
+    if (event === "draft" || event === "delete" || !config.drafts) return;
+    const after = doc.status;
+    if (after === "published" && before !== "published") this.webhooks.emit("publish", target, body);
+    if (after !== "published" && before === "published")
+      this.webhooks.emit("unpublish", target, body);
+  }
   /** Records a version after a save, when the collection or global keeps versions. */
   async saveVersion(config, parent, id, doc, guard) {
     const max = versionLimit(config);
@@ -2394,12 +3190,15 @@ var EasyCMS = class {
     return result;
   }
   /** Validates, checks uniqueness and references. Returns clean data or throws `ValidationError`. */
-  async prepare(config, data, operation, selfId) {
+  async prepare(config, data, operation, selfId, options = {}) {
     const isDraft = config.drafts === true && (data.status ?? "draft") === "draft";
+    const locale = this.localeOf(options);
     const result = await validateFields(config.fields, data, {
       operation,
       root: data,
-      skipRequired: isDraft
+      skipRequired: isDraft,
+      localization: this.config.localization,
+      ...locale !== void 0 && locale !== ALL_LOCALES ? { locale } : {}
     });
     const errors = [...result.errors];
     const clean = { ...result.data };
@@ -2441,14 +3240,26 @@ var EasyCMS = class {
     }
   }
   async makeSlugsUnique(config, data, selfId) {
-    for (const field of config.fields) {
-      const base = data[field.name];
-      if (field.type !== "slug" || typeof base !== "string" || base === "") continue;
+    const unique = async (path, base) => {
       let candidate = base;
-      for (let n = 2; await this.isTaken(config.slug, field.name, candidate, selfId); n++) {
+      for (let n = 2; await this.isTaken(config.slug, path, candidate, selfId); n++) {
         candidate = `${base}-${n}`;
       }
-      data[field.name] = candidate;
+      return candidate;
+    };
+    for (const field of config.fields) {
+      if (field.type !== "slug") continue;
+      const value = data[field.name];
+      if (field.localized && value && typeof value === "object") {
+        const map = { ...value };
+        for (const [locale, slug] of Object.entries(map)) {
+          if (typeof slug === "string" && slug !== "")
+            map[locale] = await unique(`${field.name}.${locale}`, slug);
+        }
+        data[field.name] = map;
+      } else if (typeof value === "string" && value !== "") {
+        data[field.name] = await unique(field.name, value);
+      }
     }
   }
   async checkUnique(config, data, selfId) {
@@ -2456,8 +3267,16 @@ var EasyCMS = class {
     for (const field of config.fields) {
       const value = data[field.name];
       if (!field.unique || field.type === "slug" || value === null || value === void 0) continue;
-      if (await this.isTaken(config.slug, field.name, value, selfId)) {
-        errors.push({ field: field.name, message: "must be unique" });
+      const checks = field.localized && typeof value === "object" ? Object.entries(value).map(([locale, v]) => [
+        `${field.name}.${locale}`,
+        locale === this.config.localization?.defaultLocale ? field.name : `${field.name}.${locale}`,
+        v
+      ]) : [[field.name, field.name, value]];
+      for (const [path, errorField, v] of checks) {
+        if (v === null || v === void 0) continue;
+        if (await this.isTaken(config.slug, path, v, selfId)) {
+          errors.push({ field: errorField, message: "must be unique" });
+        }
       }
     }
     return errors;
@@ -2537,7 +3356,7 @@ function asObject(data, name) {
 async function allowed(access, user) {
   return await evaluateAccess(access, { user }) !== false;
 }
-async function serializeFields(fields, update) {
+async function serializeFields(fields, update, localized) {
   const out = [];
   for (const field of fields) {
     if (field.hidden) continue;
@@ -2547,6 +3366,7 @@ async function serializeFields(fields, update) {
     if (field.unique) f.unique = true;
     if (field.defaultValue !== void 0) f.defaultValue = field.defaultValue;
     if (!await update.allows(field)) f.readOnly = true;
+    if (field.localized && localized) f.localized = true;
     switch (field.type) {
       case "text":
       case "textarea":
@@ -2576,23 +3396,39 @@ async function serializeFields(fields, update) {
       case "array":
         if (field.minRows !== void 0) f.minRows = field.minRows;
         if (field.maxRows !== void 0) f.maxRows = field.maxRows;
-        f.fields = await serializeFields(field.fields, update);
+        f.fields = await serializeFields(field.fields, update, localized);
+        break;
+      case "blocks":
+        if (field.minRows !== void 0) f.minRows = field.minRows;
+        if (field.maxRows !== void 0) f.maxRows = field.maxRows;
+        f.blocks = await Promise.all(
+          field.blocks.map(async (block) => ({
+            slug: block.slug,
+            ...block.labels ? { labels: block.labels } : {},
+            fields: await serializeFields(block.fields, update, localized)
+          }))
+        );
         break;
       case "group":
-        f.fields = await serializeFields(field.fields, update);
+        f.fields = await serializeFields(field.fields, update, localized);
         break;
     }
     out.push(f);
   }
   return out;
 }
-async function collection(config, user) {
+async function collection(config, user, localized) {
   const result = {
     slug: config.slug,
     drafts: config.drafts === true,
     versions: Boolean(config.versions),
     preview: typeof config.preview === "function",
-    fields: await serializeFields(config.fields, new FieldAccessChecker("update", { user })),
+    schedule: config.schedule === true,
+    fields: await serializeFields(
+      config.fields,
+      new FieldAccessChecker("update", { user }),
+      localized
+    ),
     permissions: {
       read: await allowed(config.access?.read, user),
       create: await allowed(config.access?.create, user),
@@ -2604,13 +3440,18 @@ async function collection(config, user) {
   if (config.useAsTitle) result.useAsTitle = config.useAsTitle;
   return result;
 }
-async function global(config, user) {
+async function global(config, user, localized) {
   const result = {
     slug: config.slug,
     drafts: config.drafts === true,
     versions: Boolean(config.versions),
     preview: typeof config.preview === "function",
-    fields: await serializeFields(config.fields, new FieldAccessChecker("update", { user })),
+    schedule: config.schedule === true,
+    fields: await serializeFields(
+      config.fields,
+      new FieldAccessChecker("update", { user }),
+      localized
+    ),
     permissions: {
       read: await allowed(config.access?.read, user),
       update: await allowed(config.access?.update, user)
@@ -2621,10 +3462,13 @@ async function global(config, user) {
 }
 async function adminSchema(cms, user) {
   const collections = cms.config.collections.filter((c) => !INTERNAL_COLLECTIONS.has(c.slug));
+  const localization = cms.config.localization;
+  const localized = localization !== null;
   return {
     locale: cms.config.admin.locale,
-    collections: await Promise.all(collections.map((c) => collection(c, user))),
-    globals: await Promise.all(cms.config.globals.map((g) => global(g, user)))
+    localization: localization ? { locales: [...localization.locales], defaultLocale: localization.defaultLocale } : null,
+    collections: await Promise.all(collections.map((c) => collection(c, user, localized))),
+    globals: await Promise.all(cms.config.globals.map((g) => global(g, user, localized)))
   };
 }
 
@@ -2795,7 +3639,7 @@ function withHeaders(response, extra) {
 }
 async function route(cms, ctx, method, segments, options) {
   const [first, second, third] = segments;
-  const access = { overrideAccess: false, user: ctx.user };
+  const access = { overrideAccess: false, user: ctx.user, ...parseLocale(ctx.url) };
   const draft = ctx.user !== null && ctx.url.searchParams.get("draft") === "true";
   if (segments.length === 0) throw new HttpError("Not found", 404);
   if (first === USERS && second !== void 0 && third === void 0 && !/^\d+$/.test(second)) {
@@ -2841,6 +3685,16 @@ async function route(cms, ctx, method, segments, options) {
     }
     throw new HttpError("Not found", 404);
   }
+  if (first === "jobs" && second === "run" && third === void 0) {
+    if (method !== "GET" && method !== "POST") throw methodNotAllowed(ctx, "GET, POST");
+    const secret = cms.config.cronSecret ?? process.env.CRON_SECRET;
+    const header = ctx.request.headers.get("authorization") ?? "";
+    const byCron = !!secret && safeEqual(header, `Bearer ${secret}`);
+    if (!byCron && ctx.user?.role !== "admin") {
+      throw ctx.user ? new HttpError("Forbidden", 403) : new UnauthorizedError();
+    }
+    return { body: await cms.runScheduled() };
+  }
   if (first === "admin") {
     if (method !== "GET") throw methodNotAllowed(ctx, "GET");
     if (!ctx.user) throw new UnauthorizedError();
@@ -2860,8 +3714,19 @@ async function route(cms, ctx, method, segments, options) {
     if (!cms.config.globals.some((g) => g.slug === second))
       throw new HttpError(`Unknown global "${second}"`, 404);
     if (third !== void 0) return globalAction(cms, ctx, method, second, segments.slice(2));
-    if (method === "GET")
+    if (method === "GET") {
+      if (ctx.url.searchParams.has("preview")) {
+        requirePreview(cms, ctx, { global: second });
+        return {
+          body: await cms.findGlobal(second, {
+            ...parseDepth(ctx.url),
+            ...parseLocale(ctx.url),
+            draft: true
+          })
+        };
+      }
       return { body: await cms.findGlobal(second, { ...access, ...parseDepth(ctx.url), draft }) };
+    }
     if (method === "POST") {
       const body = await readJson(ctx.request);
       return { body: await cms.updateGlobal(second, body, { ...access, ...parseDepth(ctx.url) }) };
@@ -2908,6 +3773,16 @@ async function route(cms, ctx, method, segments, options) {
     throw methodNotAllowed(ctx, "GET, POST");
   }
   const id = second;
+  if (method === "GET" && ctx.url.searchParams.has("preview")) {
+    requirePreview(cms, ctx, { collection: collection2, id });
+    const doc = await cms.findById(collection2, id, {
+      ...parseDepth(ctx.url),
+      ...parseLocale(ctx.url),
+      draft: true
+    });
+    if (!doc) throw new NotFoundError(collection2, id);
+    return { body: doc };
+  }
   if (method === "GET") {
     const doc = await cms.findById(collection2, id, { ...access, ...parseDepth(ctx.url), draft });
     if (!doc) throw new NotFoundError(collection2, id);
@@ -2927,7 +3802,7 @@ async function route(cms, ctx, method, segments, options) {
   throw methodNotAllowed(ctx, "GET, PATCH, DELETE");
 }
 async function documentAction(cms, ctx, method, collection2, id, path) {
-  const access = { overrideAccess: false, user: ctx.user };
+  const access = { overrideAccess: false, user: ctx.user, ...parseLocale(ctx.url) };
   const depth = parseDepth(ctx.url);
   const [action, versionId, extra] = path;
   if (action === "versions" && versionId === void 0) {
@@ -2944,10 +3819,26 @@ async function documentAction(cms, ctx, method, collection2, id, path) {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
     return { body: await cms.restoreVersion(collection2, id, versionId, { ...access, ...depth }) };
   }
+  if (action === "schedule" && path.length <= 2) {
+    if (path.length === 2) {
+      if (method !== "DELETE") throw methodNotAllowed(ctx, "DELETE");
+      await cms.cancelSchedule(collection2, id, versionId, access);
+      return { body: { message: "Cancelled" } };
+    }
+    if (method === "GET") return { body: await cms.scheduled(collection2, id, access) };
+    if (method !== "POST") throw methodNotAllowed(ctx, "GET, POST");
+    const body = await readJson(ctx.request);
+    return {
+      status: 201,
+      body: await cms.schedule(collection2, id, scheduleJob(body), access)
+    };
+  }
   if (path.length === 1 && action === "preview") {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
     const body = await readJson(ctx.request);
-    return { body: await cms.preview(collection2, id, body, { ...access, ...depth }) };
+    const result = await cms.preview(collection2, id, body, { ...access, ...depth });
+    const token = cms.createPreviewToken({ collection: collection2, id });
+    return { body: { ...result, url: result.url && withPreviewToken(result.url, token) } };
   }
   if (path.length === 1 && (action === "unpublish" || action === "discard-draft")) {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
@@ -2959,7 +3850,7 @@ async function documentAction(cms, ctx, method, collection2, id, path) {
   throw new HttpError("Not found", 404);
 }
 async function globalAction(cms, ctx, method, slug, path) {
-  const access = { overrideAccess: false, user: ctx.user };
+  const access = { overrideAccess: false, user: ctx.user, ...parseLocale(ctx.url) };
   const depth = parseDepth(ctx.url);
   const [action, versionId, extra] = path;
   if (action === "versions" && versionId === void 0) {
@@ -2976,10 +3867,23 @@ async function globalAction(cms, ctx, method, slug, path) {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
     return { body: await cms.restoreGlobalVersion(slug, versionId, { ...access, ...depth }) };
   }
+  if (action === "schedule" && path.length <= 2) {
+    if (path.length === 2) {
+      if (method !== "DELETE") throw methodNotAllowed(ctx, "DELETE");
+      await cms.cancelGlobalSchedule(slug, versionId, access);
+      return { body: { message: "Cancelled" } };
+    }
+    if (method === "GET") return { body: await cms.scheduledGlobal(slug, access) };
+    if (method !== "POST") throw methodNotAllowed(ctx, "GET, POST");
+    const body = await readJson(ctx.request);
+    return { status: 201, body: await cms.scheduleGlobal(slug, scheduleJob(body), access) };
+  }
   if (path.length === 1 && action === "preview") {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
     const body = await readJson(ctx.request);
-    return { body: await cms.previewGlobal(slug, body, { ...access, ...depth }) };
+    const result = await cms.previewGlobal(slug, body, { ...access, ...depth });
+    const token = cms.createPreviewToken({ global: slug });
+    return { body: { ...result, url: result.url && withPreviewToken(result.url, token) } };
   }
   if (path.length === 1 && (action === "unpublish" || action === "discard-draft")) {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
@@ -2990,6 +3894,32 @@ async function globalAction(cms, ctx, method, slug, path) {
   }
   throw new HttpError("Not found", 404);
 }
+function scheduleJob(body) {
+  return {
+    action: body.action,
+    at: typeof body.at === "string" ? body.at : ""
+  };
+}
+function parseLocale(url) {
+  const locale = url.searchParams.get("locale");
+  const fallback = url.searchParams.get("fallback-locale");
+  return {
+    ...locale ? { locale } : {},
+    ...fallback === "false" || fallback === "true" ? { fallbackLocale: fallback === "true" } : {}
+  };
+}
+var PREVIEW_PARAM = "easy-cms-preview";
+function withPreviewToken(url, token) {
+  const hash = url.indexOf("#");
+  const [base, fragment] = hash === -1 ? [url, ""] : [url.slice(0, hash), url.slice(hash)];
+  const separator = base.includes("?") ? "&" : "?";
+  return `${base}${separator}${PREVIEW_PARAM}=${encodeURIComponent(token)}${fragment}`;
+}
+function requirePreview(cms, ctx, target) {
+  const opened = cms.verifyPreviewToken(ctx.url.searchParams.get("preview"));
+  const matches2 = opened !== null && ("global" in target ? "global" in opened && opened.global === target.global : "collection" in opened && opened.collection === target.collection && opened.id === target.id);
+  if (!matches2) throw new UnauthorizedError("Invalid or expired preview token");
+}
 function parsePage(url) {
   const { page, limit } = parseListQuery(url);
   return { page, limit };
@@ -3204,6 +4134,16 @@ ${indent}}`;
 ${indent}  id: string
 ${fieldLines(field.fields, n, `${indent}  `).join("\n")}
 ${indent}}[]`;
+    case "blocks": {
+      const kinds = field.blocks.map(
+        (block) => `{
+${indent}  id: string
+${indent}  blockType: ${quote(block.slug)}
+${fieldLines(block.fields, n, `${indent}  `).join("\n")}
+${indent}}`
+      );
+      return `(${kinds.join(" | ")})[]`;
+    }
   }
 }
 function fieldLines(fields, n, indent) {
@@ -3211,7 +4151,7 @@ function fieldLines(fields, n, indent) {
   for (const field of fields) {
     if (field.hidden) continue;
     const type = fieldType(field, n, indent);
-    const alwaysPresent = field.type === "array" || field.type === "group" || (field.type === "select" || field.type === "relationship") && field.hasMany;
+    const alwaysPresent = field.type === "array" || field.type === "blocks" || field.type === "group" || (field.type === "select" || field.type === "relationship") && field.hasMany;
     if (field.required || alwaysPresent) lines.push(`${indent}${key(field.name)}: ${type}`);
     else lines.push(`${indent}${key(field.name)}?: ${type} | null`);
   }
@@ -3319,6 +4259,7 @@ export {
   TooManyRequestsError,
   UnauthorizedError,
   ValidationError,
+  WEBHOOK_EVENTS,
   anyone,
   applyDefaults,
   consoleLogger,
@@ -3329,6 +4270,7 @@ export {
   findConfigFile,
   generateSlugs,
   generateTypes,
+  hasRows,
   hashPassword,
   imageDimensions,
   importConfig,
@@ -3342,6 +4284,7 @@ export {
   populate,
   readCookie,
   resolveConfig,
+  rowFields,
   silentLogger,
   singularize,
   slugify,