@easy-cms/core 0.45.0 → 0.47.0

package/dist/index.js

@@ -1,7 +1,13 @@
+import {
+  conditionIssues,
+  matchesCondition
+} from "./chunk-C4KJ5TFK.js";
+
 // src/access.ts
 var isSystemAdmin = (user) => user?.role === "admin" && !user.apiKey && user.scoped !== true;
 var anyone = () => true;
-var isLoggedIn = ({ user }) => user !== null;
+var isLoggedIn = ({ user }) => user !== null && user.member !== true;
+var isSignedIn = ({ user }) => user !== null;
 var isAdmin = ({ user }) => user?.role === "admin";
 
 // src/api-keys.ts
@@ -192,7 +198,12 @@ var adminOrSelf = ({ user }) => {
 var adminOnly = {
   update: ({ user }) => isSystemAdmin(user)
 };
-function userFields(roles, rbac) {
+var staffOrSelf = ({ user }) => {
+  if (!user) return false;
+  if (user.member !== true) return true;
+  return { id: { equals: user.id } };
+};
+function userFields(roles, rbac, members) {
   const defaultRole = roles.includes("editor") ? "editor" : roles[roles.length - 1];
   return [
     {
@@ -227,6 +238,16 @@ function userFields(roles, rbac) {
       access: adminOnly,
       label: { en: "Active", th: "\u0E43\u0E0A\u0E49\u0E07\u0E32\u0E19" }
     },
+    // Accounts made by signing up (`auth.members.signup`) are `false` until the email is confirmed.
+    ...members ? [
+      {
+        name: "emailVerified",
+        type: "boolean",
+        access: adminOnly,
+        position: "sidebar",
+        label: { en: "Email confirmed", th: "\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E41\u0E25\u0E49\u0E27" }
+      }
+    ] : [],
     { name: "passwordHash", type: "text", hidden: true }
   ];
 }
@@ -239,9 +260,12 @@ function withUsers(config) {
     useAsTitle: "email",
     icon: "users",
     ...custom,
-    fields: [...userFields(roles, config.auth?.rbac === true), ...custom?.fields ?? []],
+    fields: [
+      ...userFields(roles, config.auth?.rbac === true, config.auth?.members?.signup !== void 0),
+      ...custom?.fields ?? []
+    ],
     access: {
-      read: isLoggedIn,
+      read: staffOrSelf,
       create: ({ user }) => isSystemAdmin(user),
       update: adminOrSelf,
       delete: ({ user }) => isSystemAdmin(user),
@@ -1273,6 +1297,48 @@ async function filterInput(fields, data, update2) {
   return result;
 }
 
+// src/spam.ts
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var MAX_AGE = 24 * 36e5;
+var sign = (secret, value) => createHmac2("sha256", secret).update(value).digest("base64url");
+function formToken(secret, purpose, now = Date.now()) {
+  return `${now}.${sign(secret, `${purpose}:${now}`)}`;
+}
+function checkFormToken(secret, purpose, token, minTime, now = Date.now()) {
+  if (typeof token !== "string") return "invalid";
+  const [time, signature] = token.split(".");
+  const issued = Number(time);
+  if (!Number.isFinite(issued) || !signature) return "invalid";
+  const expected = Buffer.from(sign(secret, `${purpose}:${issued}`));
+  const given = Buffer.from(signature);
+  if (expected.length !== given.length || !timingSafeEqual2(expected, given)) return "invalid";
+  if (now - issued < minTime) return "too-fast";
+  if (now - issued > MAX_AGE) return "expired";
+  return "ok";
+}
+function rateKeys(secret, subject, window, now = Date.now()) {
+  const bucket = Math.floor(now / (window * 1e3));
+  const key2 = (b) => sign(secret, `${subject}:${b}`).slice(0, 32);
+  return { current: key2(bucket), previous: key2(bucket - 1) };
+}
+function honeypotName(names2) {
+  return ["website", "homepage", "url_address"].find((n) => !names2.includes(n)) ?? "hp_field";
+}
+async function verifyTurnstile(secretKey, response, ip, fetcher = fetch) {
+  if (typeof response !== "string" || !response) return false;
+  const body = new URLSearchParams({ secret: secretKey, response, ...ip ? { remoteip: ip } : {} });
+  try {
+    const result = await fetcher("https://challenges.cloudflare.com/turnstile/v0/siteverify", {
+      method: "POST",
+      body,
+      signal: AbortSignal.timeout(1e4)
+    });
+    return (await result.json()).success === true;
+  } catch {
+    return false;
+  }
+}
+
 // src/auth/cookie.ts
 var SESSION_COOKIE = "ecms-session";
 
@@ -1289,6 +1355,21 @@ function email(subject, lines, button) {
 var hours = (expiresAt) => Math.max(1, Math.round(((expiresAt?.getTime() ?? Date.now()) - Date.now()) / 36e5));
 var days = (expiresAt) => Math.max(1, Math.round(hours(expiresAt) / 24));
 var DEFAULT_PASSWORD_EMAILS = {
+  verifyEmail: ({ url = "", locale, expiresAt }) => locale === "th" ? email(
+    "\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E02\u0E2D\u0E07\u0E04\u0E38\u0E13",
+    [
+      "\u0E02\u0E2D\u0E1A\u0E04\u0E38\u0E13\u0E17\u0E35\u0E48\u0E2A\u0E21\u0E31\u0E04\u0E23\u0E2A\u0E21\u0E32\u0E0A\u0E34\u0E01 \u0E01\u0E14\u0E1B\u0E38\u0E48\u0E21\u0E14\u0E49\u0E32\u0E19\u0E25\u0E48\u0E32\u0E07\u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E41\u0E25\u0E30\u0E40\u0E02\u0E49\u0E32\u0E2A\u0E39\u0E48\u0E23\u0E30\u0E1A\u0E1A",
+      `\u0E25\u0E34\u0E07\u0E01\u0E4C\u0E19\u0E35\u0E49\u0E43\u0E0A\u0E49\u0E44\u0E14\u0E49\u0E20\u0E32\u0E22\u0E43\u0E19 ${days(expiresAt)} \u0E27\u0E31\u0E19 \u0E16\u0E49\u0E32\u0E04\u0E38\u0E13\u0E44\u0E21\u0E48\u0E44\u0E14\u0E49\u0E2A\u0E21\u0E31\u0E04\u0E23 \u0E44\u0E21\u0E48\u0E15\u0E49\u0E2D\u0E07\u0E17\u0E33\u0E2D\u0E30\u0E44\u0E23`
+    ],
+    { label: "\u0E22\u0E37\u0E19\u0E22\u0E31\u0E19\u0E2D\u0E35\u0E40\u0E21\u0E25", url }
+  ) : email(
+    "Confirm your email",
+    [
+      "Thanks for signing up. Confirm your email to sign in.",
+      `The link works within ${days(expiresAt)} day(s). If you didn't sign up, ignore this email.`
+    ],
+    { label: "Confirm email", url }
+  ),
   resetPassword: ({ url = "", locale, expiresAt }) => locale === "th" ? email(
     "\u0E15\u0E31\u0E49\u0E07\u0E23\u0E2B\u0E31\u0E2A\u0E1C\u0E48\u0E32\u0E19\u0E43\u0E2B\u0E21\u0E48",
     [
@@ -1339,7 +1420,7 @@ var DEFAULT_PASSWORD_EMAILS = {
 };
 
 // src/auth/password.ts
-import { randomBytes as randomBytes2, scrypt, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { randomBytes as randomBytes2, scrypt, timingSafeEqual as timingSafeEqual3 } from "crypto";
 var MIN_PASSWORD_LENGTH = 8;
 var N = 2 ** 17;
 var R = 8;
@@ -1374,7 +1455,7 @@ async function verifyPassword(password, stored) {
     Number(p),
     expected.length
   );
-  return key2.length === expected.length && timingSafeEqual2(key2, expected);
+  return key2.length === expected.length && timingSafeEqual3(key2, expected);
 }
 var dummyHash;
 async function fakeVerify(password) {
@@ -1384,10 +1465,10 @@ async function fakeVerify(password) {
 }
 
 // src/auth/sso.ts
-import { createHmac as createHmac3, randomBytes as randomBytes4 } from "crypto";
+import { createHmac as createHmac4, randomBytes as randomBytes4 } from "crypto";
 
 // src/auth/tokens.ts
-import { createHash as createHash2, createHmac as createHmac2, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHash as createHash2, createHmac as createHmac3, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual4 } from "crypto";
 function newToken() {
   return randomBytes3(32).toString("base64url");
 }
@@ -1395,7 +1476,7 @@ function hashToken(token) {
   return createHash2("sha256").update(token).digest("hex");
 }
 function hmac(secret, value) {
-  return createHmac2("sha256", secret).update(value).digest("base64url");
+  return createHmac3("sha256", secret).update(value).digest("base64url");
 }
 function signToken(secret, token) {
   return `${token}.${hmac(secret, `session:${token}`)}`;
@@ -1412,7 +1493,7 @@ function csrfToken(secret, token) {
 function safeEqual(a, b) {
   const left = Buffer.from(a);
   const right = Buffer.from(b);
-  return left.length === right.length && timingSafeEqual3(left, right);
+  return left.length === right.length && timingSafeEqual4(left, right);
 }
 function signPreviewToken(secret, target, expiresAt) {
   const payload = Buffer.from(
@@ -1454,7 +1535,7 @@ function readPasswordToken(token) {
   try {
     const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
     if (typeof data.u !== "string" || typeof data.e !== "number") return null;
-    if (data.p !== "reset" && data.p !== "invite") return null;
+    if (data.p !== "reset" && data.p !== "invite" && data.p !== "verify") return null;
     return { userId: data.u, purpose: data.p, expiresAt: data.e, payload };
   } catch {
     return null;
@@ -1471,19 +1552,19 @@ function passwordTokenMatches(secret, token, fingerprint) {
 var SSO_COOKIE = "ecms-sso";
 var PENDING_TTL = 10 * 6e4;
 var random = () => randomBytes4(32).toString("base64url");
-function sign(secret, payload) {
-  return createHmac3("sha256", secret).update(`sso:${payload}`).digest("base64url");
+function sign2(secret, payload) {
+  return createHmac4("sha256", secret).update(`sso:${payload}`).digest("base64url");
 }
 function seal(secret, pending) {
   const payload = Buffer.from(JSON.stringify(pending)).toString("base64url");
-  return `${payload}.${sign(secret, payload)}`;
+  return `${payload}.${sign2(secret, payload)}`;
 }
 function unseal(secret, value) {
   if (!value) return null;
   const dot = value.lastIndexOf(".");
   if (dot <= 0) return null;
   const payload = value.slice(0, dot);
-  if (!safeEqual(value.slice(dot + 1), sign(secret, payload))) return null;
+  if (!safeEqual(value.slice(dot + 1), sign2(secret, payload))) return null;
   try {
     const pending = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
     return typeof pending.e === "number" && pending.e > Date.now() ? pending : null;
@@ -1761,6 +1842,16 @@ var SingleSignOn = class {
 
 // src/auth/auth.ts
 var INVALID = "Invalid email or password";
+var SIGNUP_FORM = "easy-cms-signup";
+var SIGNUP_MIN_TIME = 2e3;
+var SIGNUP_HONEYPOT = "website";
+function asMember(user, memberRoles) {
+  const member = memberRoles.includes(String(user.role));
+  if (member === (user.member === true)) return user;
+  if (member) return { ...user, member: true };
+  const { member: _member, ...rest } = user;
+  return rest;
+}
 var RESET_REQUESTS = 3;
 var Auth = class {
   constructor(cms) {
@@ -1810,6 +1901,16 @@ var Auth = class {
       throw new UnauthorizedError(INVALID);
     }
     await this.clearFailures(key2);
+    if (user.emailVerified === false) {
+      await this.cms.audit.record({
+        action: "login.failed",
+        target: "auth",
+        user: null,
+        email: email2,
+        detail: { reason: "email not confirmed" }
+      });
+      throw new UnauthorizedError("Confirm your email first: follow the link we sent you");
+    }
     if (!this.sso.passwordAllowed(user)) {
       await this.cms.audit.record({
         action: "login.failed",
@@ -1852,6 +1953,136 @@ var Auth = class {
     const raw = await this.db.findById({ collection: USERS, id: user.id });
     return this.startSession(raw);
   }
+  // --- Members signing up (`auth.members.signup`) ---------------------------------------------
+  /** What a sign-up form needs: a token proving when it was loaded, and Turnstile's site key. */
+  signupForm() {
+    const signup = this.config.auth.members.signup;
+    if (!signup) throw new NotFoundError(USERS, "signup");
+    return {
+      token: formToken(this.config.secret, SIGNUP_FORM),
+      turnstile: signup.turnstile?.siteKey ?? null,
+      verifyEmail: signup.verifyEmail !== false
+    };
+  }
+  /**
+   * Creates a member's account (`auth.members.signup`). With `verifyEmail` (the default), emails
+   * a link to confirm the address and answers the same whether or not the email has an account;
+   * otherwise starts a session. Throws `ValidationError` for spam checks and bad input.
+   */
+  async signup(args) {
+    const signup = this.config.auth.members.signup;
+    if (!signup) throw new NotFoundError(USERS, "signup");
+    const key2 = `signup|${args.ip ?? ""}`;
+    await this.checkRateLimit(key2);
+    const refuse = (field, message2) => new ValidationError(USERS, [{ field, message: message2 }]);
+    if (typeof args.honeypot === "string" && args.honeypot !== "") {
+      await this.recordFailure(key2);
+      throw refuse("form", "could not be sent");
+    }
+    const checked = checkFormToken(this.config.secret, SIGNUP_FORM, args.token, SIGNUP_MIN_TIME);
+    if (checked !== "ok")
+      throw refuse(
+        "form",
+        checked === "expired" ? "was open too long: reload the page" : "could not be sent"
+      );
+    if (signup.turnstile && !await verifyTurnstile(signup.turnstile.secretKey, args.turnstile, args.ip))
+      throw refuse("turnstile", "is not complete");
+    await this.recordFailure(key2);
+    const email2 = typeof args.email === "string" ? args.email.trim().toLowerCase() : "";
+    const verify = signup.verifyEmail !== false;
+    if (verify && !this.canSendPasswordLinks(args.origin))
+      throw new QueryError("Signing up needs `email` in the config, and a site URL in production");
+    const existing = email2 ? await this.findByEmail(email2) : void 0;
+    if (existing && verify) {
+      if (existing.emailVerified === false && existing.active !== false)
+        await this.mailVerifyLink(existing, args);
+      return { verify: true };
+    }
+    const created = await this.cms.create(
+      USERS,
+      {
+        email: email2,
+        password: args.password,
+        role: signup.role,
+        active: true,
+        emailVerified: !verify,
+        ...typeof args.name === "string" && args.name.trim() ? { name: args.name.trim() } : {}
+      },
+      { context: args.context ?? {} }
+    );
+    const user = await this.db.findById({ collection: USERS, id: created.id });
+    await this.cms.audit.record({
+      action: "signup",
+      target: "auth",
+      user: await this.toAuthUser(user)
+    });
+    if (verify) {
+      await this.mailVerifyLink(user, args);
+      return { verify: true };
+    }
+    return { ...await this.startSession(user), verify: false };
+  }
+  /** Confirms a member's email from the link, and signs them in. */
+  async verifyEmail(args) {
+    const key2 = `verify-token|${args.ip ?? ""}`;
+    await this.checkRateLimit(key2);
+    const token = String(args.token ?? "");
+    const claims = readPasswordToken(token);
+    const id = claims && (/^\d+$/.test(claims.userId) ? Number(claims.userId) : claims.userId);
+    const user = claims && claims.purpose === "verify" && claims.expiresAt > Date.now() && id !== null ? await this.db.findById({ collection: USERS, id }) : null;
+    if (!user || user.active === false || !passwordTokenMatches(this.config.secret, token, passwordFingerprint(user.passwordHash))) {
+      await this.recordFailure(key2);
+      throw new ValidationError(USERS, [
+        { field: "token", message: "This link has expired or is not valid" }
+      ]);
+    }
+    await this.clearFailures(key2);
+    if (user.emailVerified === false) {
+      const { id: _id, ...rest } = user;
+      await this.db.update({
+        collection: USERS,
+        id: user.id,
+        data: { ...rest, emailVerified: true }
+      });
+    }
+    const session = await this.startSession(
+      await this.db.findById({ collection: USERS, id: user.id })
+    );
+    await this.cms.audit.record({ action: "email.verified", target: "auth", user: session.user });
+    return session;
+  }
+  async mailVerifyLink(user, options) {
+    const expiresAt = Date.now() + this.config.auth.inviteExpiration * 1e3;
+    const token = signPasswordToken(this.config.secret, {
+      userId: String(user.id),
+      purpose: "verify",
+      expiresAt,
+      fingerprint: passwordFingerprint(user.passwordHash)
+    });
+    const url = this.memberLink("verifyEmail", token, options.origin);
+    const write = this.config.auth.members.emails?.verifyEmail ?? DEFAULT_PASSWORD_EMAILS.verifyEmail;
+    const content = await write({
+      user: await this.toAuthUser(user),
+      url,
+      locale: this.localeOf(options.locale),
+      expiresAt: new Date(expiresAt)
+    });
+    await this.cms.sendEmail({ to: String(user.email), ...content });
+  }
+  /**
+   * A link to one of the site's pages for members (`auth.members.pages`), else to the admin's
+   * page of the same purpose.
+   */
+  memberLink(page, token, origin) {
+    const target = this.config.auth.members.pages?.[page];
+    const query = `token=${encodeURIComponent(token)}`;
+    if (target && /^https?:\/\//.test(target))
+      return `${target}${target.includes("?") ? "&" : "?"}${query}`;
+    const site = (this.config.admin.siteUrl || "").replace(/\/+$/, "");
+    const base = site || this.passwordLinkBase(origin);
+    const path = target ?? `${this.config.admin.path}/${page === "verifyEmail" ? "verify-email" : "reset-password"}`;
+    return `${base}${path.startsWith("/") ? "" : "/"}${path}${path.includes("?") ? "&" : "?"}${query}`;
+  }
   async hasUsers() {
     return await this.db.count({ collection: USERS }) > 0;
   }
@@ -2024,7 +2255,7 @@ var Auth = class {
   }
   async passwordTokenUser(token) {
     const claims = readPasswordToken(token);
-    if (!claims || claims.expiresAt <= Date.now()) return null;
+    if (!claims || claims.purpose === "verify" || claims.expiresAt <= Date.now()) return null;
     const id = /^\d+$/.test(claims.userId) ? Number(claims.userId) : claims.userId;
     const user = await this.db.findById({ collection: USERS, id });
     if (!user || user.active === false || !this.sso.passwordAllowed(user)) return null;
@@ -2043,7 +2274,8 @@ var Auth = class {
       fingerprint: passwordFingerprint(user.passwordHash)
     });
     const sso = this.sso.passwordAllowed(user) ? void 0 : this.config.auth.providers.map((p) => p.name);
-    const url = sso ? `${base}${this.config.admin.path}/login` : `${base}${this.config.admin.path}/reset-password?token=${encodeURIComponent(token)}`;
+    const member = this.config.auth.members.roles.includes(String(user.role));
+    const url = sso ? `${base}${this.config.admin.path}/login` : member ? this.memberLink("resetPassword", token, options.origin) : `${base}${this.config.admin.path}/reset-password?token=${encodeURIComponent(token)}`;
     const write = purpose === "invite" ? this.config.auth.emails.invite ?? DEFAULT_PASSWORD_EMAILS.invite : this.config.auth.emails.resetPassword ?? DEFAULT_PASSWORD_EMAILS.resetPassword;
     const content = await write({
       user: await this.toAuthUser(user),
@@ -2136,7 +2368,8 @@ var Auth = class {
   }
   async toAuthUser(user) {
     const fields = this.cms.collection(USERS).fields;
-    return await stripFields(fields, user);
+    const stripped = await stripFields(fields, user);
+    return asMember(stripped, this.config.auth.members.roles);
   }
   async deleteExpiredSessions(userId) {
     const expired = await this.db.find({
@@ -2775,6 +3008,9 @@ async function validateFields(fields, input, options, prefix = "") {
     const path = prefix + field.name;
     const raw = input[field.name];
     const fail = (message2) => errors.push({ field: path, message: message2 });
+    const condition = field.admin?.condition;
+    const skipRequired = options.skipRequired === true || condition !== void 0 && !matchesCondition(condition, input);
+    const fieldOptions = skipRequired === (options.skipRequired === true) ? options : { ...options, skipRequired };
     if (field.type === "group") {
       if (!isEmpty(raw) && !isPlainObject(raw)) {
         fail("must be an object");
@@ -2783,7 +3019,7 @@ async function validateFields(fields, input, options, prefix = "") {
       const sub = await validateFields(
         field.fields,
         isPlainObject(raw) ? raw : {},
-        options,
+        fieldOptions,
         `${path}.`
       );
       data[field.name] = sub.data;
@@ -2806,7 +3042,7 @@ async function validateFields(fields, input, options, prefix = "") {
         const failLocale = (message2) => errors.push({ field: localePath, message: message2 });
         const value2 = map[locale];
         if (isEmpty(value2) || Array.isArray(value2) && value2.length === 0) {
-          if (own && field.required && !options.skipRequired) failLocale("is required");
+          if (own && field.required && !skipRequired) failLocale("is required");
           out[locale] = hasRows(field) || isHasMany(field) ? [] : null;
           if (own && !field.required) await runCustom(field, null, options, failLocale);
           continue;
@@ -2815,7 +3051,7 @@ async function validateFields(fields, input, options, prefix = "") {
           field,
           value2,
           localePath,
-          options,
+          fieldOptions,
           failLocale,
           errors,
           references2
@@ -2828,14 +3064,14 @@ async function validateFields(fields, input, options, prefix = "") {
       continue;
     }
     if (isEmpty(raw) || Array.isArray(raw) && raw.length === 0) {
-      if (field.required && !options.skipRequired) fail("is required");
-      else if (!options.skipRequired && "minRows" in field && field.minRows)
+      if (field.required && !skipRequired) fail("is required");
+      else if (!skipRequired && "minRows" in field && field.minRows)
         fail(`must have at least ${itemsOf(field, field.minRows)}`);
       data[field.name] = hasRows(field) || isHasMany(field) ? [] : null;
       if (!field.required) await runCustom(field, null, options, fail);
       continue;
     }
-    const value = await normalizeValue(field, raw, path, options, fail, errors, references2);
+    const value = await normalizeValue(field, raw, path, fieldOptions, fail, errors, references2);
     if (value === void 0) continue;
     data[field.name] = value;
     await runCustom(field, value, options, fail);
@@ -3245,7 +3481,7 @@ function applyFieldTypes(config) {
 }
 
 // src/local-api.ts
-import { createHmac as createHmac5, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual4 } from "crypto";
+import { createHmac as createHmac6, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual5 } from "crypto";
 
 // src/localization.ts
 var ALL_LOCALES = "all";
@@ -4609,8 +4845,72 @@ function rank(role, config) {
   return index === -1 ? config.auth.roles.length : index;
 }
 
+// src/nav.ts
+var BUILTIN_NAV = [
+  { id: "content", label: { en: "Content", th: "\u0E40\u0E19\u0E37\u0E49\u0E2D\u0E2B\u0E32" }, icon: "file-text", order: 0 },
+  {
+    id: "settings",
+    label: { en: "Settings", th: "\u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32" },
+    icon: "settings",
+    order: 1e3,
+    children: [
+      { id: "site", label: { en: "Site", th: "\u0E40\u0E27\u0E47\u0E1A\u0E44\u0E0B\u0E15\u0E4C" }, icon: "globe" },
+      { id: "people", label: { en: "Users & access", th: "\u0E1C\u0E39\u0E49\u0E43\u0E0A\u0E49\u0E41\u0E25\u0E30\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C" }, icon: "users" },
+      { id: "system", label: { en: "System", th: "\u0E23\u0E30\u0E1A\u0E1A" }, icon: "sliders-horizontal" }
+    ]
+  }
+];
+var MEDIA_ORDER = 10;
+var LABEL_ORDER = 500;
+var NAV_ID = /^[a-z][a-z0-9-]*$/;
+function mergeGroups(lists, parent = "") {
+  const byId = /* @__PURE__ */ new Map();
+  let index = 0;
+  for (const list of lists)
+    for (const group of list) {
+      const found = byId.get(group.id);
+      if (found) {
+        found.group = { ...group, ...stripUndefined(found.group) };
+        if (group.children) found.children.push([...group.children]);
+      } else {
+        byId.set(group.id, {
+          group,
+          children: group.children ? [[...group.children]] : [],
+          index: index++
+        });
+      }
+    }
+  return [...byId.values()].map(({ group, children, index: index2 }) => ({
+    id: parent ? `${parent}.${group.id}` : group.id,
+    label: group.label,
+    ...group.icon ? { icon: group.icon } : {},
+    order: group.order ?? 100 + index2,
+    children: mergeGroups(children, parent ? `${parent}.${group.id}` : group.id)
+  })).sort((a, b) => a.order - b.order);
+}
+function stripUndefined(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
+}
+function navGroups(declared) {
+  return mergeGroups([declared, BUILTIN_NAV]);
+}
+function navIds(groups) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const g of groups) {
+    ids.add(g.id);
+    for (const c of g.children) ids.add(c.id);
+  }
+  return ids;
+}
+function groupOf(group, ids, fallback) {
+  if (group === void 0 || group === null) return { id: fallback };
+  if (group === "settings") return { id: "settings.site" };
+  if (typeof group === "string" && ids.has(group)) return { id: group };
+  return { id: `label:${JSON.stringify(group)}`, label: group };
+}
+
 // src/webhooks.ts
-import { createHmac as createHmac4, randomUUID as randomUUID2 } from "crypto";
+import { createHmac as createHmac5, randomUUID as randomUUID2 } from "crypto";
 var WEBHOOK_EVENTS = [
   "create",
   "update",
@@ -4754,7 +5054,7 @@ var Webhooks = class {
       ...hook.headers
     };
     if (hook.secret) {
-      headers["x-easy-cms-signature"] = `sha256=${createHmac4("sha256", hook.secret).update(body).digest("hex")}`;
+      headers["x-easy-cms-signature"] = `sha256=${createHmac5("sha256", hook.secret).update(body).digest("hex")}`;
     }
     try {
       const response = await this.fetcher(hook.url, {
@@ -4780,7 +5080,9 @@ var Webhooks = class {
   }
 };
 var later2 = (from, ms) => new Date(from.getTime() + ms).toISOString();
+var isContentEvent = (event) => WEBHOOK_EVENTS.includes(event);
 function matches(hook, payload) {
+  if (!isContentEvent(payload.event)) return hook.events?.includes(payload.event) === true;
   if (hook.events && !hook.events.includes(payload.event)) return false;
   if (payload.collection !== void 0)
     return !hook.collections || hook.collections.includes(payload.collection);
@@ -4857,13 +5159,17 @@ function validateConfig(config) {
   });
   validateEndpoints(config, collectionSlugs, add);
   validateCommands(config, add);
+  validateJobs(config, add);
+  validateEvents(config, add);
   const apiKeys = config.apiKeys;
   if (apiKeys !== void 0 && typeof apiKeys !== "boolean") add("apiKeys", "must be true or false");
+  const nav = validateNav(config, add);
   collections.forEach((collection2, i) => {
     const path = `collections.${collection2.slug ?? `[${i}]`}`;
     validateContainer(collection2, path, collectionSlugs, add, {
       collection: true,
-      rbac: config.auth?.rbac === true
+      rbac: config.auth?.rbac === true,
+      nav
     });
     validateUseAsTitle(collection2, path, add);
     validateIcon(collection2, path, add);
@@ -4875,7 +5181,8 @@ function validateConfig(config) {
     const path = `globals.${global2.slug ?? `[${i}]`}`;
     validateContainer(global2, path, collectionSlugs, add, {
       collection: false,
-      rbac: config.auth?.rbac === true
+      rbac: config.auth?.rbac === true,
+      nav
     });
     validateIcon(global2, path, add);
   });
@@ -5008,8 +5315,8 @@ function validateAdminViews(config, add) {
             "e.g. label: { en: 'Stats', th: '\u0E2A\u0E16\u0E34\u0E15\u0E34' }"
           );
         validateIcon(p, path, add);
-        if (p.group !== void 0 && p.group !== "content" && p.group !== "settings" && p.group !== false)
-          add(`${path}.group`, 'must be "content", "settings" or false');
+        if (p.group !== "content" && p.group !== false)
+          validateGroup(p.group, navIds(navGroups(config.admin?.nav ?? [])), `${path}.group`, add);
         access(p.access, path);
       });
     }
@@ -5118,6 +5425,7 @@ function validateAuth(config, add) {
       add("auth.roles", 'must include "admin"', "e.g. roles: ['admin', 'editor']");
     }
   }
+  validateMembers(auth.members, auth.roles ?? ["admin", "editor"], add);
   for (const key2 of [
     "tokenExpiration",
     "maxLoginAttempts",
@@ -5176,6 +5484,31 @@ var LOCALIZABLE = /* @__PURE__ */ new Set([
   "blocks",
   "array"
 ]);
+function validateMembers(members, roles, add) {
+  if (members === void 0) return;
+  const { roles: memberRoles, signup, pages: pages2 } = members ?? {};
+  if (!Array.isArray(memberRoles) || memberRoles.some((r) => typeof r !== "string")) {
+    add("auth.members.roles", "must be an array of roles", "e.g. roles: ['customer']");
+    return;
+  }
+  for (const role of memberRoles) {
+    if (role === "admin") add("auth.members.roles", `can't include "admin"`);
+    else if (!roles.includes(role))
+      add("auth.members.roles", `"${role}" must be one of auth.roles too`);
+  }
+  if (signup !== void 0) {
+    const { role, verifyEmail: verifyEmail2, turnstile } = signup ?? {};
+    if (typeof role !== "string" || !memberRoles.includes(role))
+      add("auth.members.signup.role", "must be one of auth.members.roles");
+    if (verifyEmail2 !== void 0 && typeof verifyEmail2 !== "boolean")
+      add("auth.members.signup.verifyEmail", "must be true or false");
+    if (turnstile !== void 0 && (typeof turnstile?.siteKey !== "string" || typeof turnstile?.secretKey !== "string"))
+      add("auth.members.signup.turnstile", "needs siteKey and secretKey");
+  }
+  for (const [key2, value] of Object.entries(pages2 ?? {}))
+    if (value !== void 0 && typeof value !== "string")
+      add(`auth.members.pages.${key2}`, "must be a path or URL", "e.g. '/account/verify'");
+}
 function validateLocalization(config, add) {
   const localization = config.localization;
   if (localization !== void 0 && localization !== null) {
@@ -5257,14 +5590,19 @@ function validateWebhooks(config, add) {
     ...(config.collections ?? []).map((c) => c?.slug)
   ]);
   const globals = new Set((config.globals ?? []).map((g) => g?.slug));
+  const custom = new Set(config.events ?? []);
   for (const [i, hook] of hooks.entries()) {
     const path = `webhooks[${i}]`;
     if (typeof hook?.url !== "string" || !/^https?:\/\/\S+$/.test(hook.url)) {
       add(`${path}.url`, "must be an http(s) URL");
     }
     for (const event of hook?.events ?? []) {
-      if (!WEBHOOK_EVENTS.includes(event))
-        add(`${path}.events`, `unknown event "${event}"`, `use: ${WEBHOOK_EVENTS.join(", ")}`);
+      if (!WEBHOOK_EVENTS.includes(event) && !custom.has(event))
+        add(
+          `${path}.events`,
+          `unknown event "${event}"`,
+          `use: ${[...WEBHOOK_EVENTS, ...custom].join(", ")}`
+        );
     }
     for (const slug2 of hook?.collections ?? [])
       if (!collections.has(slug2)) add(`${path}.collections`, `unknown collection "${slug2}"`);
@@ -5425,7 +5763,142 @@ function checkSlug(container, path, seen, add) {
   seen.add(slug2);
   return slug2;
 }
-function validateContainer(container, path, collectionSlugs, add, { collection: collection2, rbac }) {
+var isLabel = (value) => typeof value === "string" && value.trim() !== "" || typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).length > 0 && Object.values(value).every((v) => typeof v === "string");
+function validateNav(config, add) {
+  const nav = config.admin?.nav;
+  if (nav !== void 0) {
+    if (!Array.isArray(nav))
+      add("admin.nav", "must be a list of groups", "e.g. nav: [{ id: 'shop', label: 'Shop' }]");
+    else
+      nav.forEach((group, i) => {
+        const check2 = (g, path, child) => {
+          const { id, label, children, order } = g ?? {};
+          if (typeof id !== "string" || !NAV_ID.test(id))
+            add(`${path}.id`, "must be lowercase letters, digits and -", "e.g. 'shop'");
+          if (!isLabel(label)) add(`${path}.label`, "must be a string or { en, th }");
+          if (order !== void 0 && typeof order !== "number")
+            add(`${path}.order`, "must be a number");
+          validateIcon(g, path, add);
+          if (children !== void 0) {
+            if (child) add(`${path}.children`, "groups go one level deep");
+            else if (!Array.isArray(children)) add(`${path}.children`, "must be a list of groups");
+            else
+              children.forEach((c, j) => {
+                check2(c, `${path}.children[${j}]`, true);
+              });
+          }
+        };
+        check2(group, `admin.nav[${i}]`, false);
+      });
+  }
+  const commands = config.admin?.commands;
+  if (commands !== void 0) {
+    if (!Array.isArray(commands)) add("admin.commands", "must be a list");
+    else
+      commands.forEach((c, i) => {
+        const { label, to } = c ?? {};
+        if (!isLabel(label)) add(`admin.commands[${i}].label`, "must be a string or { en, th }");
+        if (typeof to !== "string" || !to.startsWith("/") || to.startsWith("//"))
+          add(
+            `admin.commands[${i}].to`,
+            "must be a path in the admin",
+            "e.g. '/collections/orders'"
+          );
+      });
+  }
+  return navIds(navGroups(Array.isArray(nav) ? nav : []));
+}
+function validateGroup(group, ids, path, add) {
+  if (group === void 0 || group === "settings") return;
+  if (typeof group === "string" && group.includes(".") && !ids.has(group)) {
+    add(
+      path,
+      `no menu group "${group}" in admin.nav`,
+      "declare it: nav: [{ id: 'shop', label: 'Shop', children: [{ id: 'catalog', label: 'Catalog' }] }]"
+    );
+    return;
+  }
+  if (!isLabel(group))
+    add(
+      path,
+      `must be a group's id, 'settings' or a label (got ${JSON.stringify(group)})`,
+      "e.g. group: 'shop' or { en: 'Shop', th: '\u0E23\u0E49\u0E32\u0E19\u0E04\u0E49\u0E32' }"
+    );
+}
+function validateLayout(layout, container, path, add) {
+  if (!Array.isArray(layout)) {
+    add(path, "must be a list", "e.g. layout: [{ tab: 'Content', fields: ['title'] }]");
+    return;
+  }
+  const fields = new Map((container.fields ?? []).map((f) => [f.name, f]));
+  const seen = /* @__PURE__ */ new Set();
+  const name = (value, at) => {
+    if (typeof value !== "string" || !fields.has(value)) {
+      add(at, `no top-level field ${JSON.stringify(value)}`);
+      return;
+    }
+    if (fields.get(value)?.position === "sidebar")
+      add(at, `"${value}" is in the sidebar (position: 'sidebar')`);
+    if (seen.has(value)) add(at, `"${value}" is placed twice`);
+    seen.add(value);
+  };
+  const nodes = (list, at, top) => {
+    if (!Array.isArray(list)) {
+      add(at, "must be a list");
+      return;
+    }
+    const tabs = list.filter((n) => typeof n === "object" && n !== null && "tab" in n).length;
+    if (top && tabs > 0 && tabs !== list.length)
+      add(at, "with tabs, every entry at the top is a tab");
+    list.forEach((node, i) => {
+      const p = `${at}[${i}]`;
+      if (typeof node === "string") {
+        name(node, p);
+        return;
+      }
+      const n = node ?? {};
+      if ("tab" in n) {
+        if (!top) add(p, "tabs go at the top of the layout only");
+        if (!isLabel(n.tab)) add(`${p}.tab`, "must be a string or { en, th }");
+        nodes(n.fields, `${p}.fields`, false);
+      } else if ("collapsible" in n) {
+        if (!isLabel(n.collapsible)) add(`${p}.collapsible`, "must be a string or { en, th }");
+        nodes(n.fields, `${p}.fields`, false);
+      } else if ("row" in n) {
+        if (!Array.isArray(n.row) || n.row.length === 0)
+          add(`${p}.row`, "must be a list of field names");
+        else
+          n.row.forEach((f, j) => {
+            name(f, `${p}.row[${j}]`);
+          });
+      } else add(p, "must be a field name, { tab }, { collapsible } or { row }");
+    });
+  };
+  nodes(layout, path, true);
+}
+function validateCollectionAdmin(admin, path, add) {
+  const { badge, count, empty } = admin;
+  if (badge !== void 0) {
+    const b = badge ?? {};
+    if (typeof b.where !== "object" || b.where === null || Array.isArray(b.where))
+      add(`${path}.badge.where`, "must be a where query", "e.g. { status: { equals: 'paid' } }");
+    if (b.tone !== void 0 && !["accent", "warning", "danger"].includes(b.tone))
+      add(`${path}.badge.tone`, "must be 'accent', 'warning' or 'danger'");
+  }
+  if (count !== void 0 && typeof count !== "boolean")
+    add(`${path}.count`, "must be true or false");
+  if (empty !== void 0) {
+    const e = empty ?? {};
+    if (e.description !== void 0 && !isLabel(e.description))
+      add(`${path}.empty.description`, "must be a string or { en, th }");
+    if (e.link !== void 0) {
+      const l = e.link ?? {};
+      if (!isLabel(l.label) || typeof l.href !== "string")
+        add(`${path}.empty.link`, "needs label and href");
+    }
+  }
+}
+function validateContainer(container, path, collectionSlugs, add, { collection: collection2, rbac, nav }) {
   if (!Array.isArray(container.fields)) {
     add(`${path}.fields`, "must be an array");
     return;
@@ -5457,9 +5930,11 @@ function validateContainer(container, path, collectionSlugs, add, { collection:
     } else {
       const sidebar = admin.sidebar;
       if (sidebar !== void 0) validateComponents(sidebar, `${path}.admin.sidebar`, add);
-      const group = admin.group;
-      if (group !== void 0 && group !== "settings")
-        add(`${path}.admin.group`, `must be 'settings' (got ${JSON.stringify(group)})`);
+      validateGroup(admin.group, nav, `${path}.admin.group`, add);
+      const layout = admin.layout;
+      if (layout !== void 0) validateLayout(layout, container, `${path}.admin.layout`, add);
+      if (collection2)
+        validateCollectionAdmin(admin, `${path}.admin`, add);
       const list = admin.list;
       if (list !== void 0) validateList(list, container, `${path}.admin.list`, add);
       const owner = admin.ownerField;
@@ -5551,7 +6026,14 @@ function validateField(field, path, siblings, collectionSlugs, add) {
     if (typeof admin !== "object" || admin === null) {
       add(`${path}.admin`, "must be an object", "e.g. admin: { component: 'ecms-color-picker' }");
     } else {
-      const { component, after, cell } = admin;
+      const { component, after, cell, width, condition, description } = admin;
+      if (width !== void 0 && !["1/4", "1/3", "1/2", "2/3", "3/4", "full"].includes(width))
+        add(`${path}.admin.width`, "must be '1/4', '1/3', '1/2', '2/3', '3/4' or 'full'");
+      if (description !== void 0 && !isLabel(description))
+        add(`${path}.admin.description`, "must be a string or { en, th }");
+      if (condition !== void 0)
+        for (const issue of conditionIssues(condition, [...siblings.keys()]))
+          add(`${path}.admin.condition`, issue);
       if (component !== void 0) validateComponent(component, `${path}.admin.component`, add);
       if (after !== void 0) validateComponents(after, `${path}.admin.after`, add);
       if (cell !== void 0) validateComponent(cell, `${path}.admin.cell`, add);
@@ -5730,6 +6212,38 @@ function validateCommands(config, add) {
     if (typeof run !== "function") add(`${path}.run`, "must be a function");
   });
 }
+function validateJobs(config, add) {
+  const jobs = config.jobs;
+  if (jobs === void 0) return;
+  if (!Array.isArray(jobs)) {
+    add("jobs", "must be an array", "e.g. jobs: [{ name: 'shop:clean-up', every: 3600, run }]");
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  jobs.forEach((job, i) => {
+    const path = `jobs[${i}]`;
+    const { name, every, run } = job ?? {};
+    if (typeof name !== "string" || !/^[a-z][a-z0-9-]*(:[a-z0-9-]+)*$/.test(name))
+      add(`${path}.name`, "must be lowercase letters, digits, - and :", "e.g. 'shop:clean-up'");
+    else if (seen.has(name)) add(`${path}.name`, `"${name}" is already used by another job`);
+    else seen.add(name);
+    if (every !== void 0 && (typeof every !== "number" || !(every > 0)))
+      add(`${path}.every`, "must be a number of seconds above 0");
+    if (typeof run !== "function") add(`${path}.run`, "must be a function");
+  });
+}
+function validateEvents(config, add) {
+  const events = config.events;
+  if (events === void 0) return;
+  if (!Array.isArray(events)) {
+    add("events", "must be an array", "e.g. events: ['order.paid']");
+    return;
+  }
+  events.forEach((event, i) => {
+    if (typeof event !== "string" || !/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/.test(event))
+      add(`events[${i}]`, "must be named <area>.<what> in lowercase", "e.g. 'order.paid'");
+  });
+}
 function validateEndpoints(config, collectionSlugs, add) {
   const endpoints = config.endpoints;
   if (endpoints === void 0) return;
@@ -5884,7 +6398,9 @@ async function resolveConfig(input) {
       modules: config.admin?.modules ?? [],
       pages: config.admin?.pages ?? [],
       dashboard: config.admin?.dashboard ?? [],
-      switcher: config.admin?.switcher ?? null
+      switcher: config.admin?.switcher ?? null,
+      nav: config.admin?.nav ?? [],
+      commands: config.admin?.commands ?? []
     },
     upload: {
       dir: config.upload?.dir ?? "uploads",
@@ -5909,7 +6425,8 @@ async function resolveConfig(input) {
       trustedOrigins: config.auth?.trustedOrigins ?? [],
       resetPasswordExpiration: config.auth?.resetPasswordExpiration ?? 60 * 60,
       inviteExpiration: config.auth?.inviteExpiration ?? 7 * 24 * 60 * 60,
-      emails: config.auth?.emails ?? {}
+      emails: config.auth?.emails ?? {},
+      members: config.auth?.members ?? { roles: [] }
     },
     audit: config.audit ? resolveAudit(config.audit === true ? {} : config.audit) : false,
     collections: [
@@ -5929,6 +6446,8 @@ async function resolveConfig(input) {
     globals: config.globals ?? [],
     endpoints: config.endpoints ?? [],
     commands: config.commands ?? [],
+    events: config.events ?? [],
+    jobs: config.jobs ?? [],
     installedPlugins: (plugins ?? []).map(
       (plugin) => typeof plugin === "function" && plugin.info ? { ...plugin.info } : {}
     ),
@@ -5968,7 +6487,7 @@ async function createEasyCMS(config, options = {}) {
     interactive: options.interactive ?? false
   });
   const cms = new EasyCMS(resolved3, db, logger, storage, cwd);
-  const scheduling = [...resolved3.collections, ...resolved3.globals].some((c) => c.schedule) || (resolved3.webhooks?.length ?? 0) > 0 || resolved3.email !== void 0;
+  const scheduling = [...resolved3.collections, ...resolved3.globals].some((c) => c.schedule) || (resolved3.webhooks?.length ?? 0) > 0 || resolved3.email !== void 0 || resolved3.jobs.length > 0;
   if (scheduling && options.scheduler !== false) cms.startScheduler();
   return cms;
 }
@@ -6050,8 +6569,10 @@ var EasyCMS = class {
       user,
       cms: this
     });
+    const changed = result?.user !== void 0 ? result.user : user;
     return {
-      user: result?.user !== void 0 ? result.user : user,
+      // `onRequest` may change the role (e.g. per tenant): membership follows it.
+      user: changed && asMember(changed, this.config.auth.members.roles),
       context: result?.context ?? NO_CONTEXT
     };
   }
@@ -6317,7 +6838,7 @@ var EasyCMS = class {
   /** A value with its HMAC (`secret`), for `purpose` only: `<base64url JSON>.<signature>`. */
   sign(purpose, value) {
     const payload = Buffer.from(JSON.stringify(value)).toString("base64url");
-    const mac = createHmac5("sha256", this.config.secret).update(`${purpose}:${payload}`);
+    const mac = createHmac6("sha256", this.config.secret).update(`${purpose}:${payload}`);
     return `${payload}.${mac.digest("base64url")}`;
   }
   /** The value of a token made by `sign`, or `undefined` when it isn't genuine. */
@@ -6325,10 +6846,10 @@ var EasyCMS = class {
     const [payload, signature] = String(token).split(".");
     if (!payload || !signature) return void 0;
     const expected = Buffer.from(
-      createHmac5("sha256", this.config.secret).update(`${purpose}:${payload}`).digest("base64url")
+      createHmac6("sha256", this.config.secret).update(`${purpose}:${payload}`).digest("base64url")
     );
     const given = Buffer.from(signature);
-    if (expected.length !== given.length || !timingSafeEqual4(expected, given)) return void 0;
+    if (expected.length !== given.length || !timingSafeEqual5(expected, given)) return void 0;
     try {
       return JSON.parse(Buffer.from(payload, "base64url").toString());
     } catch {
@@ -6447,10 +6968,10 @@ var EasyCMS = class {
     if (!signature || !Number.isInteger(at) || at < Date.now() / 1e3) return false;
     const expected = Buffer.from(this.mediaSignature(key2, at));
     const given = Buffer.from(signature);
-    return expected.length === given.length && timingSafeEqual4(expected, given);
+    return expected.length === given.length && timingSafeEqual5(expected, given);
   }
   mediaSignature(key2, expires) {
-    return createHmac5("sha256", this.config.secret).update(`media:${key2}:${expires}`).digest("base64url");
+    return createHmac6("sha256", this.config.secret).update(`media:${key2}:${expires}`).digest("base64url");
   }
   /**
    * How many documents use any of these files in a top-level upload field (rich text and fields
@@ -6574,6 +7095,17 @@ var EasyCMS = class {
   async update(collection2, id, data, options = {}) {
     return await this.updateDocument(collection2, id, asObject(data, collection2), options);
   }
+  /**
+   * Adds `by` (negative to take away) to a top-level number field in one database statement, so
+   * concurrent calls never lose a change, e.g. stock or a counter. Skips hooks, validation, access
+   * and versions. Returns the new value, or `null` when `min` / `max` would be passed.
+   */
+  async increment(collection2, id, field, by, options = {}) {
+    this.collection(collection2);
+    const parsed = parseId(id);
+    if (parsed === void 0) throw new NotFoundError(collection2, id);
+    return this.db.increment({ collection: collection2, id: parsed, field, by, ...options });
+  }
   /**
    * Takes a document off the site: its status becomes `draft`. With versions and drafts, a plain
    * `update` with `status: 'draft'` only saves a draft and leaves the published document live;
@@ -6846,7 +7378,7 @@ var EasyCMS = class {
         previousDoc: current,
         operation: "update"
       });
-      this.emit(config, "draft", draft);
+      this.emitChange(config, "draft", draft);
       await this.audited(config, "draft", draft, current, guard, mode);
       const [out2] = await this.output(config, [draft], guard, {
         ...options,
@@ -6874,11 +7406,9 @@ var EasyCMS = class {
         Object.assign(prepared, moved.patch);
       }
     }
-    const doc = await this.db.update({
-      collection: collection2,
-      id: parsed,
-      data: { ...prepared, createdAt: existing.createdAt, updatedAt: now }
-    });
+    const data = { ...prepared, createdAt: existing.createdAt, updatedAt: now };
+    const doc = options.where ? await this.db.update({ collection: collection2, id: parsed, data, where: options.where }) : await this.db.update({ collection: collection2, id: parsed, data });
+    if (!doc) return null;
     if (moved) await moved.cleanUp();
     if (collection2 === MEDIA_FOLDERS) {
       this.folders.invalidate();
@@ -6893,7 +7423,7 @@ var EasyCMS = class {
       previousDoc: current,
       operation: "update"
     });
-    this.emit(config, "update", doc, existing.status);
+    this.emitChange(config, "update", doc, existing.status);
     await this.audited(config, "update", doc, current, guard, mode);
     const [out] = await this.output(config, [doc], guard, { ...options, draft: true });
     return out;
@@ -6948,7 +7478,7 @@ var EasyCMS = class {
       id: parsed,
       doc: existing
     });
-    this.emit(config, "delete", existing);
+    this.emitChange(config, "delete", existing);
     await this.audited(config, "delete", existing, existing, guard);
     const [out] = await this.output(config, [existing], guard, { depth: 0, draft: true });
     return out;
@@ -7106,7 +7636,7 @@ var EasyCMS = class {
         previousDoc: current,
         operation: "update"
       });
-      this.emit(config, "draft", draft);
+      this.emitChange(config, "draft", draft);
       await this.audited(config, "draft", draft, current, guard, mode);
       return this.readGlobal(config, key2, guard, { ...options, draft: true });
     }
@@ -7118,7 +7648,7 @@ var EasyCMS = class {
       previousDoc: current,
       operation: "update"
     });
-    this.emit(config, "update", doc, existing.status);
+    this.emitChange(config, "update", doc, existing.status);
     await this.audited(config, "update", doc, current, guard, mode);
     return this.readGlobal(config, key2, guard, { ...options, draft: true });
   }
@@ -7231,10 +7761,45 @@ var EasyCMS = class {
       return {
         ...scheduled,
         webhooks: await this.retryWebhooks(now),
-        emails: await this.mailer.retry(now)
+        emails: await this.mailer.retry(now),
+        jobs: await this.runConfigJobs(now)
       };
     });
   }
+  /** `jobs` of the config that are due; when each last ran is kept in the database. */
+  async runConfigJobs(now) {
+    const { jobs } = this.config;
+    if (jobs.length === 0) return { ran: 0, failed: 0 };
+    const last = await this.db.findGlobal({ slug: JOB_RUNS }) ?? {};
+    const runs = {};
+    for (const [name, at] of Object.entries(last)) if (typeof at === "string") runs[name] = at;
+    let ran = 0;
+    let failed = 0;
+    for (const job of jobs) {
+      const previous = runs[job.name];
+      if (job.every !== void 0 && previous !== void 0 && now.getTime() - Date.parse(previous) < job.every * 1e3)
+        continue;
+      runs[job.name] = now.toISOString();
+      try {
+        await job.run({ cms: this, now });
+        ran++;
+      } catch (error) {
+        failed++;
+        this.logger.error(`Job ${job.name} failed: ${error.message}`);
+      }
+    }
+    await this.db.updateGlobal({ slug: JOB_RUNS, data: { ...runs, updatedAt: now.toISOString() } });
+    return { ran, failed };
+  }
+  /**
+   * Sends an event of the app or a plugin (`events` in the config, e.g. `order.paid`) to the
+   * webhooks that list it. Returns at once; deliveries are queued and retried like content changes.
+   */
+  emit(event, data, about) {
+    if (!this.config.events.includes(event))
+      throw new QueryError(`Unknown event "${event}": add it to \`events\` in the config`);
+    this.webhooks.emit(event, about ?? {}, data);
+  }
   /**
    * Tries webhook deliveries that are due for another attempt. Deliveries are kept in the
    * database until they succeed, so they survive restarts.
@@ -7744,7 +8309,7 @@ var EasyCMS = class {
       doc,
       operation: "create"
     });
-    this.emit(config, "create", doc);
+    this.emitChange(config, "create", doc);
     await this.audited(config, "create", doc, void 0, hookGuard ?? guard);
     const [out] = await this.output(config, [doc], hookGuard ?? guard, { ...options, draft: true });
     return out;
@@ -7802,7 +8367,7 @@ var EasyCMS = class {
     });
   }
   /** Sends webhook events for a change; `before` is the stored status before it, if any. */
-  emit(config, event, doc, before) {
+  emitChange(config, event, doc, before) {
     const isGlobal = !this.config.collections.includes(config);
     if (!isGlobal && INTERNAL_COLLECTIONS.has(config.slug)) return;
     const body = isGlobal ? { ...snapshotOf(config.fields, doc), updatedAt: doc.updatedAt } : {
@@ -8228,6 +8793,7 @@ var UPLOAD_URL_SECONDS = 15 * 60;
 var UPLOAD_TICKET_SECONDS = 24 * 60 * 60;
 var SNIFF_BYTES = 64 * 1024;
 var MAX_FILES_TO_MOVE = 200;
+var JOB_RUNS = "easy-cms:jobs";
 function durationSeconds(value) {
   const match = typeof value === "string" ? /^(\d+)\s*([smhd])$/.exec(value.trim()) : null;
   const seconds = typeof value === "number" ? value : match ? Number(match[1]) * { s: 1, m: 60, h: 3600, d: 86400 }[match[2]] : Number.NaN;
@@ -8476,7 +9042,7 @@ async function readAdminModule(cms, index) {
 }
 
 // src/rest/admin-schema.ts
-var SETTINGS = /* @__PURE__ */ new Set([USERS, API_KEYS]);
+var PEOPLE = /* @__PURE__ */ new Set([USERS, API_KEYS]);
 function componentRef(component) {
   if (typeof component === "string") return { tag: component };
   return component.props ? { tag: component.tag, props: JSON.parse(JSON.stringify(component.props)) } : { tag: component.tag };
@@ -8512,6 +9078,9 @@ async function serializeFields(fields, checks, localized, folderId, who) {
       };
     }
     if (field.customType) f.customType = field.customType;
+    if (field.admin?.description !== void 0) f.description = field.admin.description;
+    if (field.admin?.width) f.width = field.admin.width;
+    if (field.admin?.condition) f.condition = JSON.parse(JSON.stringify(field.admin.condition));
     switch (field.type) {
       case "text":
       case "textarea":
@@ -8618,8 +9187,13 @@ async function collection(cms, config, user, localized, roles, context) {
   if (config.labels) result.labels = config.labels;
   if (config.useAsTitle) result.useAsTitle = config.useAsTitle;
   if (config.icon) result.icon = config.icon;
-  if (config.admin?.sidebar?.length) result.sidebar = config.admin.sidebar.map(componentRef);
-  if (config.admin?.group === "settings" || SETTINGS.has(config.slug)) result.group = "settings";
+  if (config.admin?.sidebar?.length) result.sidebar = config.admin.sidebar.map(panelRef);
+  if (config.admin?.layout?.length) result.layout = layoutOf(config.admin.layout, fields);
+  const badge = config.admin?.badge;
+  if (badge)
+    result.badge = { tone: badge.tone ?? "accent", ...badge.label ? { label: badge.label } : {} };
+  if (config.admin?.count === false) result.noCount = true;
+  if (config.admin?.empty) result.empty = JSON.parse(JSON.stringify(config.admin.empty));
   if (config.admin?.list?.tree) result.tree = config.admin.list.tree;
   if (config.admin?.list?.sort) result.defaultSort = config.admin.list.sort;
   if (config.admin?.confirmDelete) result.confirmDelete = { ...config.admin.confirmDelete };
@@ -8650,7 +9224,8 @@ async function global(cms, config, user, localized, context) {
   };
   if (config.label !== void 0) result.label = config.label;
   if (config.icon) result.icon = config.icon;
-  if (config.admin?.sidebar?.length) result.sidebar = config.admin.sidebar.map(componentRef);
+  if (config.admin?.sidebar?.length) result.sidebar = config.admin.sidebar.map(panelRef);
+  if (config.admin?.layout?.length) result.layout = layoutOf(config.admin.layout, result.fields);
   return result;
 }
 async function adminSchema(cms, user, origin, context = {}) {
@@ -8671,18 +9246,23 @@ async function adminSchema(cms, user, origin, context = {}) {
     audit: cms.audit.enabled && await cms.roles.canView(user, "audit")
   };
   const roles = await cms.roles.options();
+  const adminCollections = await Promise.all(
+    collections.map((c) => collection(cms, c, user, localized, roles, context))
+  );
+  const adminGlobals = await Promise.all(
+    cms.config.globals.map((g) => global(cms, g, user, localized, context))
+  );
+  const adminPages = await pages(cms, user);
   return {
     locale: cms.config.admin.locale,
     switcher: cms.config.admin.switcher,
     passwordLinks: cms.auth.canSendPasswordLinks(origin),
     menu: [...cms.config.admin.menu],
+    nav: buildNav(cms, adminCollections, adminGlobals, adminPages, views),
+    commands: cms.config.admin.commands.map((c) => JSON.parse(JSON.stringify(c))),
     localization: localization ? { locales: [...localization.locales], defaultLocale: localization.defaultLocale } : null,
-    collections: await Promise.all(
-      collections.map((c) => collection(cms, c, user, localized, roles, context))
-    ),
-    globals: await Promise.all(
-      cms.config.globals.map((g) => global(cms, g, user, localized, context))
-    ),
+    collections: adminCollections,
+    globals: adminGlobals,
     modules: adminModuleUrls(cms),
     uploadFromURL: cms.config.upload.fromURL !== void 0,
     upload: {
@@ -8705,7 +9285,7 @@ async function adminSchema(cms, user, origin, context = {}) {
         email: cms.config.collections.some((c) => c.slug === EMAIL_DELIVERIES)
       }
     } : {},
-    pages: await pages(cms, user),
+    pages: adminPages,
     dashboard: await widgets(cms, user)
   };
 }
@@ -8726,7 +9306,6 @@ async function pages(cms, user) {
       path: page.path,
       label: page.label,
       ...page.icon ? { icon: page.icon } : {},
-      group: page.group ?? "content",
       component: componentRef(page.component)
     });
   }
@@ -8745,9 +9324,200 @@ async function widgets(cms, user) {
 function folderIds(cms, user, context) {
   return cms.folders.enabled ? (key2) => cms.keyedFolder(key2, { user, context }) : void 0;
 }
+function panelRef(panel) {
+  const ref = componentRef(panel);
+  if (typeof panel === "object" && "position" in panel && panel.position === "top")
+    ref.position = "top";
+  return ref;
+}
+function layoutOf(layout, fields) {
+  const shown2 = new Set(fields.filter((f) => f.position !== "sidebar").map((f) => f.name));
+  const placed = /* @__PURE__ */ new Set();
+  const convert = (nodes) => nodes.flatMap((node) => {
+    if (typeof node === "string") {
+      if (!shown2.has(node)) return [];
+      placed.add(node);
+      return [{ type: "field", name: node }];
+    }
+    if ("row" in node) {
+      const names2 = node.row.filter((n) => shown2.has(n));
+      for (const n of names2) placed.add(n);
+      return names2.length ? [{ type: "row", fields: names2 }] : [];
+    }
+    if ("collapsible" in node) {
+      const inner2 = convert(node.fields);
+      return inner2.length ? [
+        {
+          type: "collapsible",
+          label: node.collapsible,
+          ...node.collapsed ? { collapsed: true } : {},
+          ...node.description !== void 0 ? { description: node.description } : {},
+          nodes: inner2
+        }
+      ] : [];
+    }
+    const inner = convert(node.fields);
+    return [
+      {
+        type: "tab",
+        label: node.tab,
+        ...node.description !== void 0 ? { description: node.description } : {},
+        nodes: inner
+      }
+    ];
+  });
+  const out = convert(layout);
+  const rest = [...shown2].filter((n) => !placed.has(n)).map((name) => ({ type: "field", name }));
+  const first = out[0];
+  if (first?.type === "tab") first.nodes.push(...rest);
+  else out.push(...rest);
+  return out.filter((n) => n.type !== "tab" || n.nodes.length > 0);
+}
+var VIEW_GROUPS = [
+  ["roles", "settings.people"],
+  ["sso", "settings.people"],
+  ["backups", "settings.system"],
+  ["email", "settings.system"],
+  ["deliveries", "settings.system"],
+  ["audit", "settings.system"]
+];
+function buildNav(cms, collections, globals, pageRefs, views) {
+  const groups = navGroups(cms.config.admin.nav);
+  const ids = navIds(groups);
+  const items = /* @__PURE__ */ new Map();
+  const labelGroups = /* @__PURE__ */ new Map();
+  const put = (group, item) => {
+    if (group.label !== void 0 && !labelGroups.has(group.id))
+      labelGroups.set(group.id, group.label);
+    const list = items.get(group.id) ?? [];
+    list.push(item);
+    items.set(group.id, list);
+  };
+  const configOf = (slug2) => cms.config.collections.find((c) => c.slug === slug2);
+  const menu = cms.config.admin.menu;
+  const rank2 = (slug2, index) => {
+    const at = menu.indexOf(slug2);
+    return at === -1 ? menu.length + index : at;
+  };
+  const ordered = collections.map((c, index) => ({ c, key: rank2(c.slug, index) })).sort((a, b) => a.key - b.key).map(({ c }) => c);
+  let media = false;
+  for (const c of ordered) {
+    if (!c.permissions.read || c.slug === MEDIA_FOLDERS) continue;
+    if (c.slug === MEDIA) {
+      media = true;
+      continue;
+    }
+    const group = PEOPLE.has(c.slug) ? { id: "settings.people" } : groupOf(configOf(c.slug)?.admin?.group, ids, "content");
+    put(group, { kind: "collection", slug: c.slug });
+  }
+  for (const g of globals) {
+    if (!g.permissions.read) continue;
+    const config = cms.config.globals.find((x) => x.slug === g.slug);
+    put(groupOf(config?.admin?.group, ids, "settings.site"), { kind: "global", slug: g.slug });
+  }
+  for (const p of pageRefs) {
+    const config = cms.config.admin.pages.find((x) => x.path === p.path);
+    const group = config?.group ?? "content";
+    if (group === false) continue;
+    put(groupOf(group, ids, "content"), { kind: "page", path: p.path });
+  }
+  for (const [view, group] of VIEW_GROUPS)
+    if (views[view]) put({ id: group }, { kind: "view", view });
+  const toGroup = (g) => {
+    const children = g.children.map(toGroup).filter((c) => c !== null);
+    const own = items.get(g.id) ?? [];
+    if (own.length === 0 && children.length === 0) return null;
+    return {
+      kind: "group",
+      id: g.id,
+      label: g.label,
+      ...g.icon ? { icon: g.icon } : {},
+      items: [...own, ...children]
+    };
+  };
+  const root = [];
+  for (const g of groups) {
+    const node = toGroup(g);
+    if (node) root.push({ order: g.order, node });
+  }
+  let i = 0;
+  for (const [id, label] of labelGroups) {
+    const own = items.get(id) ?? [];
+    if (own.length)
+      root.push({ order: LABEL_ORDER + i++, node: { kind: "group", id, label, items: own } });
+  }
+  if (media) root.push({ order: MEDIA_ORDER, node: { kind: "collection", slug: MEDIA } });
+  return root.sort((a, b) => a.order - b.order).map((r) => r.node);
+}
+
+// src/rest/admin-search.ts
+var listed = (cms) => cms.config.collections.filter(
+  (c) => !INTERNAL_COLLECTIONS.has(c.slug) && c.slug !== MEDIA_FOLDERS
+);
+async function readable(cms, c, who) {
+  try {
+    await cms.count(c.slug, { ...who, overrideAccess: false, where: { id: { exists: false } } });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function adminCounts(cms, who) {
+  const counts = {};
+  const badges = {};
+  await Promise.all(
+    listed(cms).map(async (c) => {
+      const read2 = { ...who, overrideAccess: false, draft: true };
+      try {
+        if (c.admin?.count !== false) counts[c.slug] = await cms.count(c.slug, read2);
+        if (c.admin?.badge)
+          badges[c.slug] = await cms.count(c.slug, { ...read2, where: c.admin.badge.where });
+      } catch {
+      }
+    })
+  );
+  return { counts, badges };
+}
+async function adminSearch(cms, who, q, perCollection = 5) {
+  const query = q.trim().slice(0, 100);
+  if (query.length < 1) return [];
+  const results = await Promise.all(
+    listed(cms).map(async (c) => {
+      const title = c.useAsTitle ?? (c.fields.some((f) => f.name === "title") ? "title" : void 0);
+      const conditions = [];
+      if (title) conditions.push({ [title]: { like: query } });
+      if (/^\d+$/.test(query)) conditions.push({ id: { equals: Number(query) } });
+      if (conditions.length === 0 || !await readable(cms, c, who)) return [];
+      try {
+        const found = await cms.find(c.slug, {
+          ...who,
+          overrideAccess: false,
+          draft: true,
+          depth: 0,
+          limit: perCollection,
+          where: conditions.length === 1 ? conditions[0] : { or: conditions },
+          sort: "-updatedAt"
+        });
+        return found.docs.map((doc) => {
+          const d = doc;
+          const value = title ? d[title] : void 0;
+          return {
+            collection: c.slug,
+            id: d.id,
+            title: typeof value === "string" && value ? value : `#${String(d.id)}`,
+            ...typeof d.status === "string" ? { status: d.status } : {}
+          };
+        });
+      } catch {
+        return [];
+      }
+    })
+  );
+  return results.flat();
+}
 
 // src/version.ts
-var VERSION = true ? "0.45.0" : "0.0.0-dev";
+var VERSION = true ? "0.47.0" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
 var DAY2 = 864e5;
@@ -9120,8 +9890,9 @@ async function route(cms, ctx, method, segments, options) {
     context: ctx.context,
     ...parseLocale(ctx.url)
   };
-  const draft = ctx.user !== null && ctx.url.searchParams.get("draft") === "true";
+  const draft = ctx.user !== null && ctx.user.member !== true && ctx.url.searchParams.get("draft") === "true";
   if (segments.length === 0) throw new HttpError("Not found", 404);
+  if (first === "admin" && ctx.user?.member === true) throw new ForbiddenError();
   if (first === "auth") return ssoRoute(cms, ctx, method, segments);
   if (first === USERS && second !== void 0 && third === void 0 && !/^\d+$/.test(second)) {
     switch (`${method} ${second}`) {
@@ -9194,6 +9965,45 @@ async function route(cms, ctx, method, segments, options) {
           body: { user: session.user, exp: session.expiresAt, csrfToken: session.csrfToken }
         };
       }
+      // Members signing up (`auth.members.signup`): the form's token, then the account.
+      case "GET signup":
+        return { body: cms.auth.signupForm() };
+      case "POST signup": {
+        const body = await readJson(ctx.request);
+        const result = await cms.auth.signup({
+          email: String(body.email ?? ""),
+          password: String(body.password ?? ""),
+          name: typeof body.name === "string" ? body.name : void 0,
+          token: body.token,
+          honeypot: body[SIGNUP_HONEYPOT],
+          turnstile: body.turnstile,
+          ip: options.getClientIp?.(ctx.request),
+          origin: ctx.url.origin,
+          locale: typeof body.locale === "string" ? body.locale : void 0,
+          context: ctx.context
+        });
+        if (result.verify)
+          return {
+            status: 202,
+            body: { verify: true, message: "Check your email for a link to confirm it." }
+          };
+        setSessionCookies(cms, ctx, result);
+        return {
+          status: 201,
+          body: { user: result.user, exp: result.expiresAt, csrfToken: result.csrfToken }
+        };
+      }
+      case "POST verify-email": {
+        const body = await readJson(ctx.request);
+        const session = await cms.auth.verifyEmail({
+          token: String(body.token ?? ""),
+          ip: options.getClientIp?.(ctx.request)
+        });
+        setSessionCookies(cms, ctx, session);
+        return {
+          body: { user: session.user, exp: session.expiresAt, csrfToken: session.csrfToken }
+        };
+      }
       case "POST first-register": {
         const body = await readJson(ctx.request);
         const session = await cms.auth.registerFirstUser({
@@ -9430,6 +10240,18 @@ async function route(cms, ctx, method, segments, options) {
     if (!ctx.user) throw new UnauthorizedError();
     if (second === "schema" && third === void 0)
       return { body: await adminSchema(cms, ctx.user, ctx.url.origin, ctx.context) };
+    if (second === "counts" && third === void 0)
+      return { body: await adminCounts(cms, { user: ctx.user, context: ctx.context }) };
+    if (second === "search" && third === void 0)
+      return {
+        body: {
+          docs: await adminSearch(
+            cms,
+            { user: ctx.user, context: ctx.context },
+            ctx.url.searchParams.get("q") ?? ""
+          )
+        }
+      };
     if (second === "modules" && third !== void 0 && segments.length === 3) {
       const index = /^(\d+)\.js$/.exec(third)?.[1];
       const file = index === void 0 ? void 0 : await readAdminModule(cms, Number(index));
@@ -10276,6 +11098,7 @@ export {
   AuditLog,
   Auth,
   BUILTIN_COLLECTIONS,
+  BUILTIN_NAV,
   CONFIG_FILE_NAMES,
   CSRF_COOKIE,
   CSRF_HEADER,
@@ -10318,6 +11141,8 @@ export {
   anyone,
   applyDefaults,
   applyPlugins,
+  checkFormToken,
+  conditionIssues,
   configSignature,
   consoleEmail,
   consoleLogger,
@@ -10332,24 +11157,29 @@ export {
   expandMimeTypes,
   fillMissing,
   findConfigFile,
+  formToken,
   generateSlugs,
   generateTypes,
   hasRows,
   hashPassword,
+  honeypotName,
   imageDimensions,
   importConfig,
   isAdmin,
   isHasMany,
   isLoggedIn,
+  isSignedIn,
   isSystemAdmin,
   keyAllows,
   loadConfig,
   localStorage,
+  matchesCondition,
   mergeForUpdate,
   mimeAllowed,
   mimeAllowedBy,
   parseId,
   populate,
+  rateKeys,
   readCookie,
   resolveAdminModule,
   resolveConfig,
@@ -10363,5 +11193,6 @@ export {
   validateConfig,
   validateFields,
   verifyPassword,
+  verifyTurnstile,
   writeBackupFile
 };