@easy-cms/core 0.47.4 → 0.49.0

package/dist/config-jzFGsNL6.d.ts

@@ -0,0 +1,3209 @@
+import { FieldCondition } from './conditions.js';
+
+/** A document id. SQLite uses integers, Postgres may use either. */
+type ID = string | number;
+type Role = 'admin' | 'editor' | (string & {});
+/** The logged-in admin user, as seen by access functions and hooks. */
+interface AuthUser {
+    readonly id: ID;
+    readonly email: string;
+    readonly role: Role;
+    /**
+     * Set by `onRequest` (e.g. a multi-tenant plugin) when `role` holds only in part of the site,
+     * such as one tenant: an `admin` there administers that part, not the whole system (Settings,
+     * backups, roles, other users' API keys).
+     */
+    readonly scoped?: boolean;
+    /**
+     * A member of the site, e.g. a customer (`auth.members.roles`): signs in on the site, never to
+     * the admin, and `isStaff` doesn't count them.
+     */
+    readonly member?: boolean;
+    readonly [field: string]: unknown;
+}
+/**
+ * An admin of the whole system: role `admin`, signed in (not an API key), and not an admin of a
+ * part only (`scoped`).
+ */
+declare const isSystemAdmin: (user: AuthUser | null | undefined) => boolean;
+interface WhereOperators {
+    readonly equals?: unknown;
+    readonly not_equals?: unknown;
+    readonly in?: readonly unknown[];
+    readonly not_in?: readonly unknown[];
+    readonly gt?: number | string;
+    readonly gte?: number | string;
+    readonly lt?: number | string;
+    readonly lte?: number | string;
+    readonly like?: string;
+    readonly exists?: boolean;
+}
+type Where = {
+    readonly and?: readonly Where[];
+    readonly or?: readonly Where[];
+} & {
+    readonly [field: string]: WhereOperators | readonly Where[] | undefined;
+};
+/**
+ * What a request is about besides its user, e.g. the site or tenant it works in: set by
+ * `onRequest` in the config (usually a plugin's), or passed to the Local API as `context`.
+ */
+type RequestContext = Readonly<Record<string, unknown>>;
+interface AccessArgs {
+    /** `null` when the request is not logged in. */
+    readonly user: AuthUser | null;
+    /** The request's context (`onRequest`), `{}` when there is none. */
+    readonly context?: RequestContext;
+    readonly id?: ID;
+    readonly data?: Readonly<Record<string, unknown>>;
+}
+/**
+ * Decides whether an operation is allowed.
+ * Return a `Where` to allow it only for the documents that match.
+ */
+type Access = (args: AccessArgs) => boolean | Where | Promise<boolean | Where>;
+interface CollectionAccess {
+    readonly read?: Access;
+    readonly create?: Access;
+    readonly update?: Access;
+    readonly delete?: Access;
+}
+interface GlobalAccess {
+    readonly read?: Access;
+    readonly update?: Access;
+}
+type FieldAccessFn = (args: AccessArgs) => boolean | Promise<boolean>;
+interface FieldAccess {
+    readonly read?: FieldAccessFn;
+    /** Who may set it when creating a document. Default: `update`. */
+    readonly create?: FieldAccessFn;
+    readonly update?: FieldAccessFn;
+}
+declare const anyone: Access;
+/**
+ * A signed-in user of the admin: not a site member (`auth.members`). What collections allow by
+ * default.
+ */
+declare const isStaff: Access;
+/** Anyone signed in, site members (e.g. customers) included. */
+declare const isSignedIn: Access;
+/**
+ * Admins of the whole site, and their API keys (which can do only what they list): not admins of
+ * a part of it (e.g. a tenant).
+ */
+declare const isAdmin: Access;
+
+interface Logger {
+    info(message: string): void;
+    warn(message: string): void;
+    error(message: string): void;
+}
+declare const consoleLogger: Logger;
+declare const silentLogger: Logger;
+
+/** A document as stored: relationships and uploads are ids, never populated. */
+type RawDocument = Record<string, unknown> & {
+    id: ID;
+};
+interface PaginatedDocs<T> {
+    docs: T[];
+    totalDocs: number;
+    limit: number;
+    page: number;
+    totalPages: number;
+    hasNextPage: boolean;
+    hasPrevPage: boolean;
+}
+/**
+ * How the adapter treats the database schema on startup.
+ * - `push`: apply schema changes directly (development).
+ * - `verify`: fail if migrations are pending or the config changed without a migration (production).
+ * - `skip`: do nothing (used by the migration CLI).
+ */
+type SchemaMode = 'push' | 'verify' | 'skip';
+interface DatabaseInitArgs {
+    readonly config: ResolvedConfig;
+    /** Project root; relative paths (database file, migrations) resolve from here. */
+    readonly cwd: string;
+    readonly schema: SchemaMode;
+    readonly logger: Logger;
+    /** Whether the process can prompt the user (the CLI in a terminal). */
+    readonly interactive?: boolean;
+}
+interface FindArgs {
+    readonly collection: string;
+    readonly where?: Where | undefined;
+    /** Field paths; prefix with `-` for descending. */
+    readonly sort: readonly string[];
+    /** `0` returns every matching document. */
+    readonly limit: number;
+    readonly page: number;
+}
+interface MigrationInfo {
+    readonly name: string;
+    readonly applied: boolean;
+}
+interface CreateMigrationResult {
+    readonly name: string;
+    readonly file: string;
+    readonly statements: readonly string[];
+}
+/** A connected database bound to one config. Returned by `DatabaseAdapter.init`. */
+interface Database {
+    find(args: FindArgs): Promise<PaginatedDocs<RawDocument>>;
+    findById(args: {
+        collection: string;
+        id: ID;
+    }): Promise<RawDocument | null>;
+    /** Documents of one collection by id, in any order. Used to populate relationships. */
+    findByIds(args: {
+        collection: string;
+        ids: readonly ID[];
+    }): Promise<RawDocument[]>;
+    count(args: {
+        collection: string;
+        where?: Where | undefined;
+    }): Promise<number>;
+    /** `data` holds every field, `createdAt` and `updatedAt`. Runs in one transaction. */
+    create(args: {
+        collection: string;
+        data: Record<string, unknown>;
+    }): Promise<RawDocument>;
+    /**
+     * `data` holds the whole document after merging. Runs in one transaction. With `where`, only
+     * when the stored document matches it at the moment of writing (compare and set): `null` when
+     * it doesn't, and nothing is written.
+     */
+    update(args: {
+        collection: string;
+        id: ID;
+        data: Record<string, unknown>;
+    }): Promise<RawDocument>;
+    update(args: {
+        collection: string;
+        id: ID;
+        data: Record<string, unknown>;
+        where: Where;
+    }): Promise<RawDocument | null>;
+    /**
+     * Adds `by` to a top-level number field in one statement, safe against concurrent calls; an
+     * empty value counts as 0. With `min` / `max`, only when the result stays within them. Returns
+     * the new value, or `null` when it would leave the bounds or the document is gone.
+     */
+    increment(args: {
+        collection: string;
+        id: ID;
+        field: string;
+        by: number;
+        min?: number | undefined;
+        max?: number | undefined;
+    }): Promise<number | null>;
+    delete(args: {
+        collection: string;
+        id: ID;
+    }): Promise<void>;
+    findGlobal(args: {
+        slug: string;
+    }): Promise<Record<string, unknown> | null>;
+    updateGlobal(args: {
+        slug: string;
+        data: Record<string, unknown>;
+    }): Promise<Record<string, unknown>>;
+    /** Writes a migration file for the difference between the config and the latest migration. `null` when nothing changed. */
+    createMigration(args: {
+        name: string;
+    }): Promise<CreateMigrationResult | null>;
+    /** Applies pending migrations in order. Returns the names applied. */
+    migrate(): Promise<string[]>;
+    migrationStatus(): Promise<MigrationInfo[]>;
+    /**
+     * Copies the database to `file` (an absolute path) while it is in use, when the database can
+     * do that itself (SQLite). Others (Postgres) leave it out; use their own tools.
+     */
+    readonly backup?: ((file: string) => Promise<void>) | undefined;
+    /** Raw table access for copying a whole database to another (`easy-cms copy`). */
+    readonly transfer?: DatabaseTransfer | undefined;
+    /** The prefix of its tables (`tablePrefix`), so a copy (a backup) can use the same. */
+    readonly tablePrefix?: string | undefined;
+    destroy(): Promise<void>;
+}
+/**
+ * Reads and writes stored rows as they are, ids and hidden fields included, bypassing validation
+ * and hooks. Only for moving a database: `copyDatabase()`.
+ */
+interface DatabaseTransfer {
+    /**
+     * Identifies the tables and columns the config produces, the same for every database kind.
+     * Two databases can be copied into each other when their hashes match.
+     */
+    readonly schemaHash: string;
+    /** Every table, in an order that is safe to write. */
+    tables(): string[];
+    count(table: string): Promise<number>;
+    /** Rows in a stable order (by primary key), `offset` and `limit` for batches. */
+    read(table: string, offset: number, limit: number): Promise<Record<string, unknown>[]>;
+    write(table: string, rows: readonly Record<string, unknown>[]): Promise<void>;
+    /** After all writes, e.g. moves id sequences past the copied ids so new documents fit. */
+    finish(): Promise<void>;
+}
+/** What `sqlite()` / `postgres()` return and what `config.db` holds. */
+/** The version of the adapter interfaces (database, storage, email, sign-in providers). */
+declare const ADAPTER_API_VERSION = 1;
+interface DatabaseAdapter {
+    readonly name: string;
+    /**
+     * The adapter interface it is written for (`ADAPTER_API_VERSION`); Easy CMS refuses another.
+     * Leave it out to skip the check.
+     */
+    readonly apiVersion?: number;
+    init(args: DatabaseInitArgs): Promise<Database>;
+    /** Hints for bundlers (Nitro, Next.js output tracing) about files static analysis cannot find. */
+    readonly bundle?: BundleHints;
+}
+interface BundleHints {
+    /** Absolute paths of files to ship with the server build, e.g. native binaries loaded dynamically. */
+    readonly traceInclude: readonly string[];
+}
+
+/** What a preview token opens: one document of a collection, or one global. */
+type PreviewTarget = {
+    readonly collection: string;
+    readonly id: string;
+} | {
+    readonly global: string;
+};
+/**
+ * Why a link was sent: a forgotten password, an invitation to a new account, or (`verify`) to
+ * confirm the email of an account made by signing up.
+ */
+type PasswordPurpose = 'reset' | 'invite' | 'verify';
+
+declare const API_KEYS = "api-keys";
+/** What a key may do with a collection. `create` on `media` means uploading. */
+declare const API_KEY_OPERATIONS: readonly ["read", "create", "update", "delete", "publish"];
+type ApiKeyOperation = (typeof API_KEY_OPERATIONS)[number];
+/** What a key may do with a global. */
+declare const API_KEY_GLOBAL_OPERATIONS: readonly ["read", "update", "publish"];
+type ApiKeyGlobalOperation = (typeof API_KEY_GLOBAL_OPERATIONS)[number];
+/** Stored in the key's `permissions` field. Anything not listed is not allowed. */
+interface ApiKeyPermissions {
+    readonly collections?: Readonly<Record<string, readonly ApiKeyOperation[]>>;
+    readonly globals?: Readonly<Record<string, readonly ApiKeyGlobalOperation[]>>;
+    /**
+     * With `upload.folders`: the media folders (ids) the key may use, with their subfolders. Empty
+     * or missing: every folder.
+     */
+    readonly folders?: readonly (string | number)[];
+    /**
+     * The context the key was created in (`onRequest`, e.g. its tenant), kept for good: requests
+     * with the key get it as `user.apiKey.permissions.context`. Set by Easy CMS, not by input.
+     */
+    readonly context?: RequestContext;
+}
+/** Set on `AuthUser.apiKey` when a request authenticated with an API key. */
+interface ApiKeyContext {
+    readonly id: number | string;
+    readonly name: string;
+    readonly permissions: ApiKeyPermissions;
+}
+/**
+ * Whether a request's API key allows an operation. Always true without a key (sessions are
+ * governed by access rules alone); a key only narrows what its user may do.
+ */
+declare function keyAllows(user: AuthUser | null, target: {
+    collection: string;
+} | {
+    global: string;
+}, operation: ApiKeyOperation): boolean;
+
+/** The cookie that carries a sign-in through the provider and back. */
+declare const SSO_COOKIE = "ecms-sso";
+/** A provider as the login page shows it (`GET <api>/auth/init`). */
+interface SsoProviderRef {
+    id: string;
+    name: string;
+    icon: string;
+}
+/** Settings → SSO (`GET <api>/admin/ui/sso`). */
+interface AdminSso {
+    providers: (SsoProviderRef & {
+        /** Give this to the provider as the redirect (callback) URL. */
+        callbackURL: string | null;
+        details: Record<string, string>;
+    })[];
+    /** Who may sign in with a password: everyone, or only admins. */
+    password: 'everyone' | 'admins';
+    /** Email domains whose people get an account when they first sign in. */
+    signUp: {
+        domains: string[];
+        role: string;
+    } | null;
+    /** Without `serverURL`, sign-in only works in development. */
+    serverURL: boolean;
+}
+/** An outside account a user signs in with (`GET <api>/auth/identities`). */
+interface UserIdentity {
+    id: ID;
+    provider: string;
+    /** The provider's name, e.g. `Google`. */
+    name: string;
+    email: string | null;
+    createdAt: string;
+    lastUsedAt: string | null;
+}
+/** Why a sign-in did not work, as `?sso=` on the page it ends on. */
+type SsoOutcome = 'linked' | 'cancelled' | 'expired' | 'failed' | 'no-account' | 'link-first' | 'unverified' | 'inactive' | 'taken';
+/** Single sign-on with `auth.providers`. Available as `cms.auth.sso`. */
+declare class SingleSignOn {
+    private readonly cms;
+    constructor(cms: EasyCMS);
+    private get config();
+    get enabled(): boolean;
+    providers(): SsoProviderRef[];
+    /** Whether a user may sign in with a password (`auth.password: false` leaves only admins). */
+    passwordAllowed(user: {
+        readonly [key: string]: unknown;
+    }): boolean;
+    /** `<serverURL><api>/auth/<id>/callback`, or `null` without `serverURL` in production. */
+    callbackURL(provider: string, origin?: string): string | null;
+    /**
+     * Starts signing in (or, with `user`, linking an account): the provider's URL to send the
+     * browser to, and the sealed value of the cookie that must come back with it.
+     */
+    start(providerId: string, options: {
+        origin?: string;
+        redirect?: string | null;
+        user?: AuthUser;
+    }): Promise<{
+        url: string;
+        cookie: string;
+    }>;
+    /**
+     * Finishes at `<api>/auth/<id>/callback`: checks the response, finds (or makes) the user and
+     * starts a session. Returns where to send the browser; failures end on the login page (or the
+     * account page, when linking) with `?sso=<outcome>`.
+     */
+    finish(providerId: string, options: {
+        url: URL;
+        cookie: string | undefined;
+        origin?: string;
+        user: AuthUser | null;
+    }): Promise<{
+        redirect: string;
+        session?: Session;
+    }>;
+    /** A user's outside accounts. */
+    identities(userId: ID): Promise<UserIdentity[]>;
+    /**
+     * Unlinks an outside account: the user's own, or anyone's for admins. Refuses to unlink the
+     * last way a user has to sign in.
+     */
+    unlink(actor: AuthUser, identityId: ID): Promise<void>;
+    settings(origin?: string): AdminSso;
+    private provider;
+    /** Only pages of the admin: anything else (another site) goes to the admin's home. */
+    private adminPage;
+    private identity;
+    private addIdentity;
+    private userByEmail;
+    /** A new account for people from `providerSignUp.domains`. */
+    private signUp;
+    /** A site member (`auth.members`): matched by email, like any shop or site account. */
+    private isMember;
+    private defaultRole;
+}
+
+interface LoginArgs {
+    readonly email: string;
+    readonly password: string;
+    /** Client IP, used together with the email for rate limiting. */
+    readonly ip?: string | undefined;
+}
+interface Session {
+    readonly user: AuthUser;
+    /** Signed session token, the value of the session cookie. */
+    readonly token: string;
+    /** Send back in the `X-CSRF-Token` header on cookie-authenticated writes. */
+    readonly csrfToken: string;
+    readonly expiresAt: string;
+}
+interface SignupArgs {
+    readonly email: string;
+    readonly password: string;
+    readonly name?: string | undefined;
+    /** From `GET <api>/auth/signup`: the form was loaded a moment ago. */
+    readonly token?: unknown;
+    /** The hidden field; bots fill it in. */
+    readonly honeypot?: unknown;
+    /** The Cloudflare Turnstile response, with `signup.turnstile`. */
+    readonly turnstile?: unknown;
+    readonly ip?: string | undefined;
+    /** The request's origin: used for the link only in development, without a site URL. */
+    readonly origin?: string | undefined;
+    readonly locale?: string | undefined;
+    /** The request's context (`onRequest`), e.g. the tenant: given to the users' hooks. */
+    readonly context?: RequestContext;
+}
+/** What signing up did: a link was emailed to confirm, or (without `verifyEmail`) a session. */
+type SignupResult = {
+    readonly verify: true;
+} | (Session & {
+    readonly verify: false;
+});
+/** Where a password link is opened from, and the language of its email. */
+interface PasswordLinkOptions {
+    /** The request's origin: used for the link only in development, when `serverURL` is not set. */
+    readonly origin?: string | undefined;
+    /** `en` or `th`. Default: `admin.locale`. */
+    readonly locale?: string | undefined;
+}
+/** Login, logout and session verification. Available as `cms.auth`. */
+declare class Auth {
+    private readonly cms;
+    /** Signing in with outside accounts (`auth.providers`). */
+    readonly sso: SingleSignOn;
+    constructor(cms: EasyCMS);
+    private get db();
+    private get config();
+    /** Checks credentials and starts a session. Throws `UnauthorizedError` or `TooManyRequestsError`. */
+    login(args: LoginArgs): Promise<Session>;
+    /**
+     * Creates the first admin. Only works while there are no users, and with `auth.setupCode`
+     * (`EASY_CMS_SETUP_CODE`) only with that code.
+     */
+    registerFirstUser(args: {
+        email: string;
+        password: string;
+        name?: string;
+        setupCode?: string;
+        ip?: string | undefined;
+    }): Promise<Session>;
+    /** What a sign-up form needs: a token proving when it was loaded, and Turnstile's site key. */
+    signupForm(): {
+        token: string;
+        turnstile: string | null;
+        verifyEmail: boolean;
+    };
+    /**
+     * Creates a member's account (`auth.members.signUp`). With `verifyEmail` (the default), emails
+     * a link to confirm the address and answers the same whether or not the email has an account;
+     * otherwise starts a session. Throws `ValidationError` for spam checks and bad input.
+     */
+    signup(args: SignupArgs): Promise<SignupResult>;
+    /** Confirms a member's email from the link, and signs them in. */
+    verifyEmail(args: {
+        token: string;
+        ip?: string | undefined;
+    }): Promise<Session>;
+    private mailVerifyLink;
+    /**
+     * A link to one of the site's pages for members (`auth.members.pages`), else to the admin's
+     * page of the same purpose.
+     */
+    private memberLink;
+    hasUsers(): Promise<boolean>;
+    private warnedNoClientIp;
+    /**
+     * Without the client's address, failed logins count per email only, so anyone can lock an
+     * account for a while. Said once, in production.
+     */
+    private warnNoClientIp;
+    /** Ends the session for a signed token. Unknown tokens are ignored. */
+    logout(signedToken: string): Promise<void>;
+    /**
+     * The user a request's headers carry: a Bearer token (session or API key) or the session
+     * cookie; `null` when there is none or it is not valid. For frameworks' pages and handlers.
+     */
+    userFromHeaders(headers: {
+        get(name: string): string | null | undefined;
+    }): Promise<AuthUser | null>;
+    /**
+     * Returns the user for a signed session token, or for an API key (`ecms_…`, with `apiKey` set
+     * on the user), or `null` if it is invalid or expired.
+     */
+    verify(signedToken: string | undefined | null): Promise<AuthUser | null>;
+    /** Starts a new session for a user, e.g. after they changed their own password. */
+    createSession(userId: ID): Promise<Session>;
+    /** Signs a user out everywhere. */
+    revokeSessions(userId: ID): Promise<void>;
+    /** Whether "forgot password" and invitations work: `email` is set and links have an origin. */
+    canSendPasswordLinks(origin?: string): boolean;
+    /**
+     * Emails a link to set a new password, if an active account has this email. Always resolves the
+     * same way, so callers can't tell whether the email has an account; extra requests within
+     * `lockWindow` are ignored.
+     */
+    requestPasswordReset(args: PasswordLinkOptions & {
+        email: string;
+        ip?: string | undefined;
+    }): Promise<void>;
+    /**
+     * Emails a user a link to set their password: an invitation if they have none yet, else a
+     * reset link. For admins (the REST API checks the role). Returns which one was sent.
+     */
+    sendPasswordLink(userId: ID, options?: PasswordLinkOptions): Promise<PasswordPurpose>;
+    /** The user and purpose of a valid, unused password link, or `null`. */
+    checkPasswordToken(token: string): Promise<{
+        user: AuthUser;
+        purpose: PasswordPurpose;
+    } | null>;
+    /**
+     * Sets the password from a link, ends every session of the account and starts one here.
+     * Throws `ValidationError` when the link expired or was used, or the password is too short.
+     */
+    resetPassword(args: {
+        token: string;
+        password: string;
+        ip?: string | undefined;
+        locale?: string | undefined;
+    }): Promise<Session & {
+        purpose: PasswordPurpose;
+    }>;
+    private passwordTokenUser;
+    private mailPasswordLink;
+    private localeOf;
+    private findByEmail;
+    /** The owner of an API key, limited by the key; `null` when unknown, expired or disabled. */
+    private verifyApiKey;
+    private startSession;
+    private findSession;
+    private toAuthUser;
+    private deleteExpiredSessions;
+    private windowStart;
+    private checkRateLimit;
+    private recordFailure;
+    private clearFailures;
+}
+
+/** An email to send. Addresses may be `name <address>`. */
+interface EmailMessage {
+    readonly to: string | readonly string[];
+    readonly cc?: string | readonly string[];
+    readonly bcc?: string | readonly string[];
+    /** Default: the adapter's `from`. */
+    readonly from?: string;
+    readonly replyTo?: string;
+    readonly subject: string;
+    readonly html?: string;
+    readonly text?: string;
+}
+/**
+ * Sends email for Easy CMS and its plugins (form notifications, and more later). Set one in
+ * the config as `email`, e.g. `smtp()` from `@easy-cms/email-smtp`, or `consoleEmail()` in
+ * development. Throw to report a failure: the message is retried later.
+ */
+interface EmailAdapter {
+    /** What sends the email, e.g. `smtp`; shown to admins on the dashboard (System). */
+    readonly name?: string;
+    /**
+     * The adapter interface it is written for (`ADAPTER_API_VERSION`); Easy CMS refuses another.
+     * Leave it out to skip the check.
+     */
+    readonly apiVersion?: number;
+    /** The sender when a message has none, e.g. `Easy CMS <no-reply@example.com>`. */
+    readonly from?: string | undefined;
+    send(message: EmailMessage & {
+        readonly from: string;
+    }): Promise<void>;
+    /**
+     * The settings in use, shown to admins on Settings → Email. Never return secrets: say whether
+     * a password is set, not what it is.
+     */
+    describe?(): readonly EmailSetting[];
+    /** Checks the connection without sending (Settings → Email); throws with the reason. */
+    verify?(): Promise<void>;
+}
+/** One setting an email adapter shows to admins (`describe()`). */
+interface EmailSetting {
+    /**
+     * `host`, `port`, `secure`, `user`, `password`, `from` and `delivery` (`log`: printed, not sent)
+     * are translated in the admin; others are shown as they are.
+     */
+    readonly key: string;
+    /** `null`: not set. */
+    readonly value: string | null;
+    /** Where it comes from, e.g. `SMTP_HOST` or `smtp({ host })`. */
+    readonly source?: string;
+}
+/** Prints emails to the log instead of sending them: for development and tests. */
+declare function consoleEmail(options?: {
+    from?: string;
+    log?: (text: string) => void;
+}): EmailAdapter & {
+    readonly sent: (EmailMessage & {
+        from: string;
+    })[];
+};
+
+/** A label shown in the admin UI. Either one string or one string per admin locale. */
+type Label = string | {
+    readonly [locale: string]: string;
+};
+interface FieldValidateContext {
+    /** The whole document being validated, including sibling fields. */
+    readonly data: Readonly<Record<string, unknown>>;
+    readonly operation: 'create' | 'update';
+}
+/** Return `true` when valid, or an error message to show on the field. */
+type FieldValidate<TValue> = (value: TValue | null | undefined, ctx: FieldValidateContext) => true | string | Promise<true | string>;
+/**
+ * A Web Component from an admin module (`admin.modules`), by its tag name, which must start
+ * with `ecms-`. `props` (plain JSON) reach the element as its `options` property.
+ */
+type AdminComponent = string | {
+    readonly tag: string;
+    readonly props?: Readonly<Record<string, unknown>>;
+};
+/** How the admin shows a field, with components from admin modules. */
+interface FieldAdmin {
+    /** Help below the field's label. */
+    readonly description?: Label;
+    /** Its share of a row (`admin.layout`'s `row`). Default: an equal share. */
+    readonly width?: '1/4' | '1/3' | '1/2' | '2/3' | '3/4' | 'full';
+    /**
+     * Shown only when its sibling fields match, e.g. `{ field: 'linkType', equals: 'external' }`.
+     * A hidden field isn't required. See `FieldCondition`.
+     */
+    readonly condition?: FieldCondition;
+    /** Shown instead of the field's input; the admin keeps the label and error messages. */
+    readonly component?: AdminComponent;
+    /** Shown below the field, e.g. a length meter or a preview. */
+    readonly after?: readonly AdminComponent[];
+    /** Shows the value in the admin's lists (e.g. a color swatch). Default: the plain value. */
+    readonly cell?: AdminComponent;
+    /**
+     * A column of the list at first (each user can change it): `true`, or per request, e.g.
+     * only when the admin shows every tenant.
+     */
+    readonly column?: boolean | ((args: AdminFieldArgs) => boolean | Promise<boolean>);
+    /** Relationships: offer to create the related document in place. Default true. */
+    readonly allowCreate?: boolean;
+    /**
+     * The value a new document's form starts with, worked out for each user, e.g. from the
+     * request's context. The server's own default (`defaultValue`, hooks) still applies.
+     */
+    readonly initialValue?: (args: AdminFieldArgs) => unknown;
+    /** `sidebar`: shown in the edit page's side panel instead of the main form (top-level fields). */
+    readonly position?: 'sidebar';
+}
+/** What per-request admin options of a field receive. */
+interface AdminFieldArgs {
+    readonly user: AuthUser;
+    readonly context: RequestContext;
+}
+/**
+ * Field types that packages add (`fieldTypes` in the config), for the types inferred from the
+ * config. A package declares its own by augmenting this interface:
+ *
+ * ```ts
+ * declare module '@easy-cms/core' {
+ *   interface CustomFieldTypes {
+ *     color: { value: string; options: { readonly presets?: readonly string[] } }
+ *   }
+ * }
+ * ```
+ */
+interface CustomFieldTypes {
+}
+/** A field of a type from `CustomFieldTypes`: the common options, plus the type's own. */
+type CustomField = {
+    [K in keyof CustomFieldTypes]: BaseField<K & string, CustomFieldTypes[K] extends {
+        value: infer V;
+    } ? V : unknown> & (CustomFieldTypes[K] extends {
+        options: infer O;
+    } ? O : unknown);
+}[keyof CustomFieldTypes];
+interface BaseField<TType extends string, TValue> {
+    readonly type: TType;
+    readonly name: string;
+    readonly label?: Label;
+    readonly required?: boolean;
+    readonly unique?: boolean;
+    /**
+     * With `unique` (or on a slug field): a sibling field (e.g. `parent` or `tenant`), or several,
+     * whose documents only need to differ among themselves, so `/about/team` and `/careers/team`
+     * can both be `team`. Single, unlocalized relationship, select, text or number fields.
+     */
+    readonly uniqueWithin?: string | readonly string[];
+    readonly index?: boolean;
+    readonly defaultValue?: TValue;
+    readonly validate?: FieldValidate<TValue>;
+    readonly access?: FieldAccess;
+    /** Stored but never returned by the API nor accepted as input (e.g. a password hash). */
+    readonly hidden?: boolean;
+    /**
+     * One value per locale (needs `localization` in the config). Not for groups, arrays or
+     * hasMany fields: localize the fields inside a group or array instead.
+     */
+    readonly localized?: boolean;
+    /** How the field looks in the admin: components, position, width, conditions. */
+    readonly admin?: FieldAdmin;
+    /** Set by Easy CMS on fields of an added type (`fieldTypes`): the type's name, e.g. `color`. */
+    readonly customType?: string;
+}
+interface TextField extends BaseField<'text', string> {
+    readonly minLength?: number;
+    readonly maxLength?: number;
+}
+interface TextareaField extends BaseField<'textarea', string> {
+    readonly minLength?: number;
+    readonly maxLength?: number;
+}
+interface NumberField extends BaseField<'number', number> {
+    readonly min?: number;
+    readonly max?: number;
+}
+interface BooleanField extends BaseField<'boolean', boolean> {
+}
+/** Stored and returned as an ISO 8601 string. */
+interface DateField extends BaseField<'date', string> {
+}
+interface EmailField extends BaseField<'email', string> {
+}
+interface JsonField extends BaseField<'json', unknown> {
+}
+type SelectOption = string | {
+    readonly label: Label;
+    readonly value: string;
+};
+interface SelectField extends BaseField<'select', string | readonly string[]> {
+    readonly options: readonly SelectOption[];
+    readonly hasMany?: boolean;
+}
+interface SlugField extends BaseField<'slug', string> {
+    /** Name of a sibling `text` field to generate the slug from. */
+    readonly from?: string;
+}
+/** Tiptap / ProseMirror JSON document. */
+interface RichTextDocument {
+    readonly type: 'doc';
+    readonly content?: readonly unknown[];
+}
+interface RichTextField extends BaseField<'richText', RichTextDocument> {
+}
+/** References a document in the built-in `media` collection: a file or an image. */
+interface UploadField extends BaseField<'upload', never> {
+    /** Several files, e.g. a gallery: the value is a list, in the order editors arrange. */
+    readonly hasMany?: boolean;
+    /** With `hasMany`: the fewest files. */
+    readonly minRows?: number;
+    /** With `hasMany`: the most files. */
+    readonly maxRows?: number;
+    /**
+     * The file types allowed, e.g. `['image/*']` or `['image/*', 'application/pdf']`. The admin
+     * offers only these, and saving refuses others.
+     */
+    readonly mimeTypes?: readonly string[];
+    /**
+     * With `upload.folders`: the `key` of the media folder this field's files go in, e.g.
+     * `'banners'`. Its picker opens there and its uploads land there; the folder is made when it
+     * is first needed.
+     */
+    readonly folder?: string;
+    /** With `folder`: only files in that folder (and its subfolders) may be chosen. */
+    readonly folderOnly?: boolean;
+    /** Which media documents may be chosen, as for relationships: offered and checked on save. */
+    readonly filterOptions?: FilterOptions;
+}
+interface FilterOptionsArgs {
+    /** The document being edited; `undefined` while it is being created. */
+    readonly id: ID | undefined;
+    readonly user: AuthUser | null;
+    readonly cms: EasyCMS;
+    /** The request's context (`onRequest`), `{}` when there is none. */
+    readonly context: RequestContext;
+}
+/**
+ * Which documents a relationship may point to: a `where` on the target collection, or `true`
+ * for any. Runs on the server: the admin's picker offers only these, and saving checks them.
+ */
+type FilterOptions = (args: FilterOptionsArgs) => Where | true | Promise<Where | true>;
+interface RelationshipField extends BaseField<'relationship', never> {
+    /** Slug of the target collection. */
+    readonly to: string;
+    readonly hasMany?: boolean;
+    /** With `hasMany`: the fewest documents. */
+    readonly minRows?: number;
+    /** With `hasMany`: the most documents. */
+    readonly maxRows?: number;
+    readonly filterOptions?: FilterOptions;
+}
+interface ArrayField extends BaseField<'array', never> {
+    readonly fields: readonly Field[];
+    readonly minRows?: number;
+    readonly maxRows?: number;
+}
+interface GroupField extends BaseField<'group', never> {
+    readonly fields: readonly Field[];
+}
+/** One kind of block in a `blocks` field. */
+interface Block {
+    /** Stored in each row as `blockType`. */
+    readonly slug: string;
+    readonly labels?: {
+        readonly singular?: Label;
+        readonly plural?: Label;
+    };
+    readonly fields: readonly Field[];
+}
+/**
+ * A list of rows, each one of several block kinds (e.g. hero, text, gallery), for pages that
+ * editors lay out themselves. Rows are `{ id, blockType, ...fields }`, stored as JSON.
+ */
+interface BlocksField extends BaseField<'blocks', never> {
+    readonly blocks: readonly Block[];
+    readonly minRows?: number;
+    readonly maxRows?: number;
+}
+/** The fields `uniqueWithin` names, as a list. */
+declare const uniqueWithinOf: (field: Field) => readonly string[];
+/** Fields with `hasMany`: their value is a list of options, documents or files. */
+declare const isHasMany: (field: Field) => boolean;
+/**
+ * Whether a MIME type is one of `patterns` (`image/*` matches every image but SVG, which can
+ * carry scripts and is allowed only when listed by name: `image/svg+xml`).
+ */
+declare function mimeAllowedBy(mimeType: string, patterns: readonly string[]): boolean;
+/** Fields whose value is a list of rows: `array` and `blocks`. */
+declare const hasRows: (field: Field) => field is ArrayField | BlocksField;
+/** The fields of one row of an `array` or `blocks` field (`undefined` for an unknown block). */
+declare function rowFields(field: ArrayField | BlocksField, row: unknown): readonly Field[] | undefined;
+type Field = CustomField | TextField | TextareaField | NumberField | BooleanField | DateField | EmailField | JsonField | SelectField | SlugField | RichTextField | UploadField | RelationshipField | ArrayField | GroupField | BlocksField;
+type FieldType = Field['type'];
+declare const FIELD_TYPES: readonly ["text", "textarea", "number", "boolean", "date", "email", "json", "select", "slug", "richText", "upload", "relationship", "array", "group", "blocks"];
+
+type Simplify<T> = {
+    [K in keyof T]: T[K];
+} & {};
+type OptionValue<O> = O extends string ? O : O extends {
+    readonly value: infer V;
+} ? V : never;
+type SelectValue<F> = F extends {
+    readonly options: readonly (infer O extends SelectOption)[];
+} ? F extends {
+    readonly hasMany: true;
+} ? OptionValue<O>[] : OptionValue<O> : never;
+/** The built-in users collection as seen by the type system (hidden fields left out). */
+interface BuiltinUsersCollection {
+    readonly slug: 'users';
+    readonly fields: readonly [
+        {
+            readonly name: 'email';
+            readonly type: 'email';
+            readonly required: true;
+        },
+        {
+            readonly name: 'name';
+            readonly type: 'text';
+        },
+        {
+            readonly name: 'role';
+            readonly type: 'select';
+            readonly options: readonly string[];
+            readonly required: true;
+        },
+        {
+            readonly name: 'active';
+            readonly type: 'boolean';
+        }
+    ];
+}
+/** The built-in API keys collection (`apiKeys: true`); the key's hash is left out. */
+interface BuiltinApiKeysCollection {
+    readonly slug: 'api-keys';
+    readonly fields: readonly [
+        {
+            readonly name: 'name';
+            readonly type: 'text';
+            readonly required: true;
+        },
+        {
+            readonly name: 'permissions';
+            readonly type: 'json';
+        },
+        {
+            readonly name: 'expiresAt';
+            readonly type: 'date';
+        },
+        {
+            readonly name: 'prefix';
+            readonly type: 'text';
+        },
+        {
+            readonly name: 'user';
+            readonly type: 'relationship';
+            readonly to: 'users';
+        },
+        {
+            readonly name: 'lastUsedAt';
+            readonly type: 'date';
+        }
+    ];
+}
+/** The built-in media folders (`upload.folders: true`). */
+interface BuiltinMediaFoldersCollection {
+    readonly slug: 'media-folders';
+    readonly fields: readonly [
+        {
+            readonly name: 'name';
+            readonly type: 'text';
+            readonly required: true;
+        },
+        {
+            readonly name: 'parent';
+            readonly type: 'relationship';
+            readonly to: 'media-folders';
+        },
+        {
+            readonly name: 'key';
+            readonly type: 'text';
+        },
+        {
+            readonly name: 'private';
+            readonly type: 'boolean';
+        },
+        {
+            readonly name: 'permissions';
+            readonly type: 'json';
+        }
+    ];
+}
+/** `media-folders` when the config turns folders on. */
+type FoldersOf<C extends Config> = C extends {
+    readonly upload: {
+        readonly folders: true;
+    };
+} ? BuiltinMediaFoldersCollection : never;
+/** `api-keys` when the config turns API keys on. */
+type ApiKeysOf<C extends Config> = C extends {
+    readonly apiKeys: true;
+} ? BuiltinApiKeysCollection : never;
+/** The `PluginTypes` of each plugin in the config (a union). */
+type PluginTypesOf<C extends Config> = C extends {
+    readonly plugins: readonly (infer P)[];
+} ? P extends TypedPlugin<infer T extends PluginTypes> ? T : never : never;
+/** Fields that plugins add to the collection (or global) `S`, as a union. */
+type AddedFields<T, S> = T extends {
+    readonly [K in 'fields' | 'globalFields']?: infer M;
+} ? M extends {
+    readonly [slug: string]: readonly Field[];
+} ? string extends keyof M ? never : S extends keyof M ? M[S][number] : never : never : never;
+type PluginFields<C extends Config, S, Key extends 'fields' | 'globalFields'> = AddedFields<PluginTypesOf<C> extends infer T ? T extends PluginTypes ? Pick<T, Key & keyof T> : never : never, S>;
+/** Collections that plugins add. */
+type PluginCollections<C extends Config> = PluginTypesOf<C> extends infer T ? T extends {
+    readonly collections: readonly (infer K extends CollectionConfig)[];
+} ? K : never : never;
+/** A collection or global with the fields plugins add to it. */
+type WithPluginFields<C extends Config, T extends {
+    readonly slug: string;
+    readonly fields: readonly Field[];
+}, Key extends 'fields' | 'globalFields'> = [PluginFields<C, T['slug'], Key>] extends [never] ? T : Omit<T, 'fields'> & {
+    readonly fields: readonly (T['fields'][number] | PluginFields<C, T['slug'], Key>)[];
+};
+/**
+ * The config's own collections. A literal config without `collections` has none (only plugins
+ * add some); a loosely typed `Config` has any.
+ */
+type OwnCollections<C extends Config> = 'collections' extends keyof C ? NonNullable<C['collections']>[number] : never;
+/** Every collection of a config, including the built-in ones and those plugins add. */
+type AllCollections<C extends Config> = OwnCollections<C> | BuiltinUsersCollection | BuiltinMediaCollection | ApiKeysOf<C> | FoldersOf<C> | PluginCollections<C>;
+/** The built-in media collection; its documents are typed as `MediaDocument`. */
+interface BuiltinMediaCollection {
+    readonly slug: 'media';
+    readonly fields: readonly [];
+}
+type CollectionBySlug<C extends Config, S> = WithPluginFields<C, Extract<AllCollections<C>, {
+    readonly slug: S;
+}>, 'fields'>;
+type GlobalBySlug<C extends Config, S> = WithPluginFields<C, Extract<NonNullable<C['globals']>[number], {
+    readonly slug: S;
+}>, 'globalFields'>;
+/** Relationships are ids at depth 0 and documents when populated. */
+type RelationValue<C extends Config, S> = [CollectionBySlug<C, S>] extends [never] ? ID | Record<string, unknown> : ID | CollectionDocument<C, S & string>;
+interface MediaSize {
+    filename: string;
+    width: number;
+    height: number;
+    filesize: number;
+    url: string;
+}
+/** A document of the built-in `media` collection, as returned by the API. */
+interface MediaDocument {
+    id: ID;
+    filename: string;
+    originalName?: string | null;
+    mimeType: string;
+    filesize: number;
+    width?: number | null;
+    height?: number | null;
+    alt?: string | null;
+    /** Its media folder (`upload.folders`), when it is in one. */
+    folder?: ID | null;
+    /** In a private folder: `url` needs a signed-in user who may see it, or `cms.signedMediaURL()`. */
+    private?: boolean | null;
+    /** URL of the file: public, or for private files the API's, which checks who asks. */
+    url: string;
+    /** Resized copies, when `upload.imageSizes` is set and sharp is installed. */
+    sizes: Record<string, MediaSize>;
+    createdAt: string;
+    updatedAt: string;
+    [field: string]: unknown;
+}
+type FieldValue<F extends Field, C extends Config = Config> = F extends {
+    readonly type: 'text' | 'textarea' | 'email' | 'slug' | 'date';
+} ? string : F extends {
+    readonly type: 'number';
+} ? number : F extends {
+    readonly type: 'boolean';
+} ? boolean : F extends {
+    readonly type: 'json';
+} ? unknown : F extends {
+    readonly type: 'select';
+} ? SelectValue<F> : F extends {
+    readonly type: 'richText';
+} ? RichTextDocument : F extends {
+    readonly type: 'upload';
+} ? F extends {
+    readonly hasMany: true;
+} ? (ID | MediaDocument)[] : ID | MediaDocument : F extends {
+    readonly type: 'relationship';
+    readonly to: infer S;
+} ? F extends {
+    readonly hasMany: true;
+} ? RelationValue<C, S>[] : RelationValue<C, S> : F extends {
+    readonly type: 'array';
+    readonly fields: infer Sub extends readonly Field[];
+} ? Simplify<FieldsValue<Sub, C> & {
+    id: string;
+}>[] : F extends {
+    readonly type: 'group';
+    readonly fields: infer Sub extends readonly Field[];
+} ? FieldsValue<Sub, C> : F extends {
+    readonly type: 'blocks';
+    readonly blocks: infer B extends readonly Block[];
+} ? BlockValue<B[number], C>[] : CustomValue<F>;
+/** The value of a field of an added type (`CustomFieldTypes`). */
+type CustomValue<F> = F extends {
+    readonly type: infer T extends keyof CustomFieldTypes;
+} ? CustomFieldTypes[T] extends {
+    value: infer V;
+} ? V : unknown : never;
+/** One row of a `blocks` field: the block's fields plus `id` and `blockType` (distributes over kinds). */
+type BlockValue<B, C extends Config> = B extends {
+    readonly slug: infer S;
+    readonly fields: infer Sub extends readonly Field[];
+} ? Simplify<FieldsValue<Sub, C> & {
+    id: string;
+    blockType: S;
+}> : never;
+type BlockInput<B> = B extends {
+    readonly slug: infer S;
+    readonly fields: infer Sub extends readonly Field[];
+} ? Simplify<FieldsInput<Sub> & {
+    id?: string;
+    blockType: S;
+}> : never;
+type Visible<Fs extends readonly Field[]> = Exclude<Fs[number], {
+    readonly hidden: true;
+}>;
+/** Always set when read: required fields, and lists and groups (empty `[]` / `{}` otherwise). */
+type Present = {
+    readonly required: true;
+} | {
+    readonly type: 'array' | 'blocks' | 'group';
+} | {
+    readonly hasMany: true;
+};
+type RequiredFields<Fs extends readonly Field[]> = Extract<Visible<Fs>, Present>;
+type OptionalFields<Fs extends readonly Field[]> = Exclude<Visible<Fs>, Present>;
+/** The shape of the data described by a list of fields. */
+type FieldsValue<Fs extends readonly Field[], C extends Config = Config> = Simplify<{
+    -readonly [F in RequiredFields<Fs> as F['name']]: FieldValue<F, C>;
+} & {
+    -readonly [F in OptionalFields<Fs> as F['name']]?: FieldValue<F, C> | null;
+}>;
+type SystemFields<T extends {
+    readonly drafts?: unknown;
+}> = {
+    id: ID;
+    createdAt: string;
+    updatedAt: string;
+} & (T extends {
+    readonly drafts: true;
+} ? {
+    status: 'draft' | 'published';
+} : unknown);
+/** What document types are inferred from: a collection's or global's fields and drafts. */
+type FieldsOwner = {
+    readonly fields: readonly Field[];
+    readonly drafts?: unknown;
+};
+type InferCollection<T extends FieldsOwner, C extends Config = Config> = Simplify<SystemFields<T> & FieldsValue<T['fields'], C>>;
+type InferGlobal<T extends FieldsOwner, C extends Config = Config> = Simplify<
+/** `null` until the global is saved for the first time. */
+{
+    updatedAt: string | null;
+} & (T extends {
+    readonly drafts: true;
+} ? {
+    status: 'draft' | 'published';
+} : unknown) & FieldsValue<T['fields'], C>>;
+type CollectionSlug<C extends Config> = OwnCollections<C>['slug'] | 'users' | 'media' | ApiKeysOf<C>['slug'] | FoldersOf<C>['slug'] | PluginCollections<C>['slug'];
+type GlobalSlug<C extends Config> = NonNullable<C['globals']>[number]['slug'];
+/** Document type of a collection, e.g. `CollectionDocument<typeof config, 'posts'>`. */
+type CollectionDocument<C extends Config, S extends CollectionSlug<C>> = S extends 'media' ? MediaDocument : InferCollection<CollectionBySlug<C, S>, C>;
+/** Data type of a global, e.g. `GlobalDocument<typeof config, 'site'>`. */
+type GlobalDocument<C extends Config, S extends GlobalSlug<C>> = InferGlobal<GlobalBySlug<C, S>, C>;
+type InputValue<F extends Field> = F extends {
+    readonly type: 'relationship';
+} ? F extends {
+    readonly hasMany: true;
+} ? readonly ID[] : ID : F extends {
+    readonly type: 'select';
+    readonly hasMany: true;
+} ? Readonly<SelectValue<F>> : F extends {
+    readonly type: 'upload';
+} ? F extends {
+    readonly hasMany: true;
+} ? readonly ID[] : ID : F extends {
+    readonly type: 'date';
+} ? string | Date : F extends {
+    readonly type: 'array';
+    readonly fields: infer Sub extends readonly Field[];
+} ? readonly Simplify<FieldsInput<Sub> & {
+    id?: string;
+}>[] : F extends {
+    readonly type: 'group';
+    readonly fields: infer Sub extends readonly Field[];
+} ? FieldsInput<Sub> : F extends {
+    readonly type: 'blocks';
+    readonly blocks: infer B extends readonly Block[];
+} ? readonly BlockInput<B[number]>[] : FieldValue<F>;
+/**
+ * Required fields must be given, unless Easy CMS can fill them (default value, slug from another
+ * field) or a condition may hide them (`admin.condition`).
+ */
+type NeedsInput<F extends Field> = F extends {
+    readonly required: true;
+} ? F extends {
+    readonly defaultValue: unknown;
+} ? never : F extends {
+    readonly type: 'slug';
+    readonly from: string;
+} ? never : F extends {
+    readonly admin: {
+        readonly condition: object;
+    };
+} ? never : F : never;
+type FieldsInput<Fs extends readonly Field[]> = Simplify<{
+    -readonly [F in NeedsInput<Visible<Fs>> as F['name']]: InputValue<F>;
+} & {
+    -readonly [F in Exclude<Visible<Fs>, NeedsInput<Visible<Fs>>> as F['name']]?: InputValue<F> | null;
+}>;
+type StatusInput<T> = T extends {
+    readonly drafts: true;
+} ? {
+    status?: 'draft' | 'published';
+} : unknown;
+/**
+ * A user's password, hashed and never returned. Optional when creating: a user without one sets
+ * it from an invitation link.
+ */
+type PasswordInput<S, Required extends boolean> = S extends 'users' ? Required extends true ? {
+    password: string;
+} : {
+    password?: string;
+} : unknown;
+/** Data accepted by `create`, e.g. `CreateInput<typeof config, 'posts'>`. */
+type CreateInput<C extends Config, S extends CollectionSlug<C>> = Simplify<FieldsInput<CollectionBySlug<C, S>['fields']> & StatusInput<CollectionBySlug<C, S>> & PasswordInput<S, false>>;
+/** Data accepted by `update`: any subset of `CreateInput`. */
+type UpdateInput<C extends Config, S extends CollectionSlug<C>> = Partial<CreateInput<C, S>>;
+/** Data accepted by `updateGlobal`. */
+type GlobalInput<C extends Config, S extends GlobalSlug<C>> = Partial<Simplify<FieldsInput<GlobalBySlug<C, S>['fields']> & StatusInput<GlobalBySlug<C, S>>>>;
+
+/** What a role may do with a collection or global, ticked in Settings → Roles. */
+declare const ROLE_OPERATIONS: readonly ["read", "create", "update", "delete", "publish"];
+type RoleOperation = (typeof ROLE_OPERATIONS)[number];
+/** A field a role may only read, or not see at all; fields not listed follow the collection. */
+type FieldRule = 'read' | 'hidden';
+type FieldRules = Readonly<Record<string, Readonly<Record<string, FieldRule>>>>;
+/**
+ * Stored in a role's `permissions`. Anything not listed is not allowed. A slug listed with no
+ * operations has been looked at and given nothing (it is not "new" in Settings → Roles).
+ */
+interface RolePermissions {
+    readonly collections?: Readonly<Record<string, readonly RoleOperation[]>>;
+    readonly globals?: Readonly<Record<string, readonly RoleOperation[]>>;
+    /** Admin pages: `status`, `deliveries`, `page:<path>` (`admin.pages`), `widget:<id>` (`admin.dashboard`, default the tag). */
+    readonly admin?: readonly string[];
+    /** Operations of `collections` allowed only on the role's own documents (see `admin.ownerField`). */
+    readonly own?: Readonly<Record<string, readonly RoleOperation[]>>;
+    /** Top-level fields the role may only read or not see, by collection or global slug. */
+    readonly fields?: {
+        readonly collections?: FieldRules;
+        readonly globals?: FieldRules;
+    };
+}
+/** One role as Settings → Roles shows it (`GET <api>/admin/roles`). */
+interface AdminRole {
+    id: ID;
+    key: string;
+    /** The name shown in the admin; empty for roles from the config that were not renamed. */
+    name: string;
+    /** From `auth.roles`: can't be deleted. */
+    system: boolean;
+    /** Users with this role. */
+    users: number;
+    permissions: RolePermissions;
+    updatedAt: string;
+}
+/** A top-level field whose permission can be set per role. */
+interface AdminRoleField {
+    name: string;
+    label?: Label;
+    /** Required without a default value: roles that create documents must be able to fill it. */
+    required: boolean;
+    /** The collection's owner field (`admin.ownerField`). */
+    owner?: boolean;
+}
+/** A row of the permissions table. */
+interface AdminRoleTarget {
+    slug: string;
+    /** Operations that make sense here (`publish` with drafts). */
+    ops: RoleOperation[];
+    /** No role has been given anything here yet (added to the config since). */
+    new: boolean;
+    fields: AdminRoleField[];
+}
+/** A page or dashboard panel that can be given to roles. */
+interface AdminRoleView {
+    id: string;
+    /** For plugin pages and panels; the admin names `status` and `deliveries` itself. */
+    label?: Label;
+}
+/** Settings → Roles (`GET <api>/admin/roles`). */
+interface AdminRoles {
+    roles: AdminRole[];
+    collections: (AdminRoleTarget & {
+        /** Collections its relationship and upload fields point to. */
+        references: string[];
+        /** Can be limited to own documents: the field that names the owner (`createdBy` by default). */
+        owner?: string;
+    })[];
+    globals: AdminRoleTarget[];
+    views: AdminRoleView[];
+}
+/** One change to a role (`GET <api>/admin/roles/:id/history`). */
+interface AdminRoleChange {
+    id: ID;
+    /** Email of who saved it, or `null` when it was the system (first start). */
+    author: string | null;
+    createdAt: string;
+    name: string;
+    permissions: RolePermissions;
+}
+/**
+ * Roles and their permissions (`auth.rbac`), on top of access rules: an operation is allowed
+ * when both allow it. Admins may do everything; requests that are not logged in are left to
+ * access rules alone.
+ */
+declare class Roles {
+    private readonly config;
+    private readonly db;
+    private readonly log?;
+    /** Writes to the audit log (`audit`). */
+    private readonly audit?;
+    readonly enabled: boolean;
+    private readonly versions;
+    private cache;
+    private synced;
+    constructor(config: ResolvedConfig, db: Database, log?: ((message: string) => void) | undefined, 
+    /** Writes to the audit log (`audit`). */
+    audit?: ((entry: {
+        action: string;
+        target: string;
+        doc: ID;
+        title: string;
+        changes?: {
+            field: string;
+            before?: unknown;
+            after?: unknown;
+        }[];
+    }) => Promise<void>) | undefined);
+    /**
+     * Whether the user's role allows an operation: `true`, `false`, or for their own account
+     * (users without read or update on `users`) a constraint to it.
+     */
+    allows(user: AuthUser | null, target: {
+        collection: string;
+    } | {
+        global: string;
+    }, operation: RoleOperation): Promise<boolean | Where>;
+    /**
+     * Whether the user may open an admin page: admins always; with roles, those whose role has
+     * it; without roles, nobody else (`status`, `deliveries`) or everybody (plugin pages).
+     */
+    canView(user: AuthUser, id: string): Promise<boolean>;
+    /** Documents a user owns, by collection (`createdBy` and owner fields), for deleting them. */
+    owned(userId: ID): Promise<{
+        collection: string;
+        count: number;
+    }[]>;
+    private addMissing;
+    /**
+     * Documents from before roles have no `createdBy`: it is filled from who saved their first
+     * version, for collections with versions. Only while no document of the collection has one,
+     * so it runs once (and finds nothing to do afterwards).
+     */
+    private backfillCreators;
+    /** Whether a role exists (users can only be given existing roles). */
+    exists(key: string): Promise<boolean>;
+    /** Roles a user can be given, those of `auth.roles` first; `name` may be empty. */
+    options(): Promise<{
+        key: string;
+        name: string;
+    }[]>;
+    list(): Promise<AdminRoles>;
+    create(input: {
+        key?: unknown;
+        name?: unknown;
+        permissions?: unknown;
+    }, author: AuthUser): Promise<AdminRole>;
+    update(id: ID, input: {
+        name?: unknown;
+        permissions?: unknown;
+    }, author: AuthUser): Promise<AdminRole>;
+    delete(id: ID): Promise<void>;
+    history(id: ID): Promise<AdminRoleChange[]>;
+    /** Pages and panels roles can be given. */
+    private views;
+    /** Every collection and global, and the plugin pages and panels: what roles had before roles. */
+    private everything;
+    /** Keeps only known collections, globals, operations and pages; `read` comes with the others. */
+    private clean;
+    /**
+     * Keeps rules for known top-level fields. A field that must be filled in (required, without a
+     * default) can't be read-only or hidden for a role that creates documents.
+     */
+    private cleanRules;
+    /** Fields that name a collection's owner (`createdBy`, and `admin.ownerField`). */
+    private ownerColumns;
+    /** Sets one field of every matching document, keeping the rest as stored. */
+    private setWhere;
+    private cleanName;
+    private permissionsOf;
+    private load;
+    private rows;
+    private row;
+    private users;
+    private insert;
+    /** Keeps the role as saved, for its history. */
+    private record;
+    private toRole;
+}
+
+/** What a role may do in a folder (`upload.folders` with `auth.rbac`), each including the last. */
+declare const FOLDER_LEVELS: readonly ["view", "edit", "manage"];
+/**
+ * `view`: see its files and use them in documents. `edit`: also upload, rename, move and delete
+ * files. `manage`: also create, rename, move and delete subfolders.
+ */
+type FolderLevel = (typeof FOLDER_LEVELS)[number];
+/** A folder's `permissions`: each role's level; roles not listed get nothing. */
+type FolderPermissions = Readonly<Record<string, FolderLevel>>;
+/**
+ * Folders of the media library and their permissions. A folder without its own permissions
+ * follows its parent; the top level is open to every role that may use `media`. Folder
+ * permissions only narrow what roles may do with `media`, for signed-in users (not API keys).
+ */
+declare class MediaFolders {
+    private readonly db;
+    private readonly roles;
+    readonly enabled: boolean;
+    private cache;
+    constructor(config: ResolvedConfig, db: Database, roles: Roles);
+    /** Whether folder permissions apply to this user. */
+    applies(user: AuthUser | null): user is AuthUser;
+    private rows;
+    /** A role's level in a folder (`null`: the top level): the nearest permissions up the tree. */
+    private levelIn;
+    /** Whether files in a folder (`null`: the top level) are private: it or a folder above is. */
+    private privateIn;
+    /** Whether files put in this folder are private. */
+    isPrivate(id: ID | null): Promise<boolean>;
+    /** The folder and every folder inside it. */
+    private within;
+    /**
+     * The folder with this key (`folder: 'banners'` on upload fields), made at the top level when
+     * there is none yet.
+     */
+    /**
+     * The folder with this key, made when first needed. `scope`: the values the key is unique
+     * within (`uniqueWithin` of the `key` field, e.g. the tenant), given to a new folder too.
+     * `null` when there is none and `create` is false.
+     */
+    keyed(key: string, scope?: Readonly<Record<string, unknown>>): Promise<ID>;
+    keyed(key: string, scope: Readonly<Record<string, unknown>>, create: boolean): Promise<ID | null>;
+    /** The user's level in a folder (`null`: the top level). */
+    level(user: AuthUser | null, id: ID | null): Promise<FolderLevel | 'none'>;
+    /**
+     * The constraint folder permissions add to an operation on files or folders, or `true` when
+     * they add none (no folder limits this user).
+     */
+    where(user: AuthUser | null, collection: string, operation: string): Promise<true | Where>;
+    private fresh;
+}
+
+interface StoredFile {
+    readonly body: Uint8Array;
+    readonly size: number;
+    /** The type the storage serves the file with, when it says (checked after direct uploads). */
+    readonly contentType?: string;
+}
+/** Where uploaded files live. Keys are generated by Easy CMS: `<name>-<random>.<ext>`. */
+interface StorageAdapter {
+    readonly name: string;
+    /**
+     * The adapter interface it is written for (`ADAPTER_API_VERSION`); Easy CMS refuses another.
+     * Leave it out to skip the check.
+     */
+    readonly apiVersion?: number;
+    /** Called once with the project root, before any other method. */
+    init?(args: {
+        cwd: string;
+    }): void | Promise<void>;
+    put(key: string, data: Uint8Array, options: {
+        contentType: string;
+    }): Promise<void>;
+    get(key: string): Promise<StoredFile | null>;
+    delete(key: string): Promise<void>;
+    /**
+     * Public URL of a file, or `undefined` to serve it through the REST API
+     * (`<api>/media/file/<key>`), as the local adapter does.
+     */
+    url?(key: string): string | undefined;
+    /**
+     * Lets a browser send a file straight to the storage (large files, past a host's request
+     * limit): where to send it and how. The URL must work for `expiresIn` seconds and accept at
+     * most `size` bytes. Without it, files are uploaded through the server.
+     */
+    uploadURL?(key: string, options: {
+        contentType: string;
+        size: number;
+        expiresIn: number;
+    }): Promise<DirectUpload>;
+    /**
+     * The first `bytes` of a file and its whole size, without reading it all (to check a file
+     * uploaded straight to the storage); `null` when there is no such file. Default: `get`.
+     */
+    getStart?(key: string, bytes: number): Promise<StoredFile | null>;
+}
+/** Where and how a browser sends a file straight to the storage (`StorageAdapter.uploadURL`). */
+interface DirectUpload {
+    readonly url: string;
+    readonly method: 'PUT' | 'POST';
+    /** Headers to send with the file. */
+    readonly headers: Readonly<Record<string, string>>;
+}
+interface DiskStorageOptions {
+    /** Directory, relative to the project root. Default `uploads`. */
+    readonly dir?: string;
+}
+/** Stores files on the local disk. Suitable for servers with a persistent filesystem. */
+declare function diskStorage(options?: DiskStorageOptions): StorageAdapter;
+
+declare const DEFAULT_MAX_VERSIONS = 50;
+/** One saved state of a document or global. */
+interface VersionSummary {
+    readonly id: ID;
+    /** `draft` or `published` with drafts enabled, otherwise `null`. */
+    readonly status: 'draft' | 'published' | null;
+    /** The newest version: the document's current editable state. */
+    readonly latest: boolean;
+    /** Who saved it (user id), or `null` for saves without a user (scripts, seeds). */
+    readonly author: ID | null;
+    readonly createdAt: string;
+}
+interface Version<T = Record<string, unknown>> extends VersionSummary {
+    /** The document as it was saved (hidden fields such as password hashes are never kept). */
+    readonly data: T;
+}
+
+type Data$1 = Record<string, unknown>;
+type Slug<C extends Config> = string extends CollectionSlug<C> ? string : CollectionSlug<C>;
+type GSlug<C extends Config> = string extends GlobalSlug<C> ? string : GlobalSlug<C>;
+type Doc<C extends Config, S> = string extends CollectionSlug<C> ? RawDocument : CollectionDocument<C, S & CollectionSlug<C>>;
+type Create<C extends Config, S> = string extends CollectionSlug<C> ? Data$1 : CreateInput<C, S & CollectionSlug<C>>;
+type Update<C extends Config, S> = string extends CollectionSlug<C> ? Data$1 : UpdateInput<C, S & CollectionSlug<C>>;
+type GDoc<C extends Config, S> = string extends GlobalSlug<C> ? Data$1 : GlobalDocument<C, S & GlobalSlug<C>>;
+type GInput<C extends Config, S> = string extends GlobalSlug<C> ? Data$1 : GlobalInput<C, S & GlobalSlug<C>>;
+/** A collection slug of the config `C` (any string when the config isn't a literal). */
+type SlugOf<C extends Config> = Slug<C>;
+/**
+ * A document of collection `S` as the Local API returns it, e.g. for helpers that take an
+ * `EasyCMS<C>`: inferred from a literal config, loose otherwise.
+ */
+type DocumentOf<C extends Config, S> = Doc<C, S>;
+interface AccessOptions {
+    /**
+     * The Local API trusts its caller and skips access rules by default.
+     * Pass `false` (with `user`) to apply them, as the REST API does.
+     */
+    readonly overrideAccess?: boolean;
+    /** The user to check access for. `null` = not logged in. */
+    readonly user?: AuthUser | null;
+    /**
+     * What the call is about besides its user, e.g. the tenant (see `onRequest`): given to access
+     * functions, hooks and `filterOptions`.
+     */
+    readonly context?: RequestContext;
+}
+interface DepthOptions extends AccessOptions {
+    /** How many levels of relationships to populate. Default 1, maximum 3. */
+    readonly depth?: number;
+    /**
+     * With `localization`: the locale to read, and for writes the locale the data is in. Default:
+     * the default locale. `'all'` reads (and writes) localized fields as `{ [locale]: value }`.
+     */
+    readonly locale?: string;
+}
+interface UpdateOptions extends DepthOptions {
+    /**
+     * Upkeep of the live document, e.g. values a plugin keeps up to date (a page's path): with
+     * drafts and versions a pending draft stays as it is (edits go to it by default), the status
+     * stays, and no version is added to the history.
+     */
+    readonly live?: boolean;
+    /**
+     * Saves only when the stored document still matches this at the moment of writing (compare and
+     * set), e.g. `{ status: { equals: 'pending' } }` so that one of two concurrent calls wins.
+     * `update()` then returns `null` when it doesn't match, after its `before*` hooks ran.
+     */
+    readonly where?: Where;
+}
+interface IncrementOptions {
+    /** Only when the result stays at or above this, e.g. `0` for stock. */
+    readonly min?: number;
+    /** Only when the result stays at or below this. */
+    readonly max?: number;
+}
+interface ReadOptions extends DepthOptions {
+    /**
+     * Include drafts. By default only published documents of collections with
+     * `drafts: true` are returned, including when populating relationships (FR-DRF-04).
+     */
+    readonly draft?: boolean;
+    /** Use the default locale's value when a localized value is empty. Default: `localization.fallback`. */
+    readonly fallbackLocale?: boolean;
+}
+interface FindOptions extends ReadOptions {
+    readonly where?: Where;
+    /** Field path, `-` prefix for descending. Default `-createdAt`. */
+    readonly sort?: string | readonly string[];
+    /** Default 10. `0` returns every document. */
+    readonly limit?: number;
+    /** 1-based. Default 1. */
+    readonly page?: number;
+}
+interface CreateEasyCMSOptions {
+    /** Project root. Default `process.cwd()`. */
+    readonly cwd?: string;
+    /**
+     * Run due scheduled jobs and webhook retries every minute in this process. Default: on when
+     * a collection or global has `schedule`, or `webhooks`, `email` or `jobs` is set. Turn it off
+     * where a cron calls `runJobs` (or `GET <api>/jobs/run`) instead.
+     */
+    readonly scheduler?: boolean;
+    /** Default `verify` when `NODE_ENV=production`, otherwise `push`. */
+    readonly schema?: SchemaMode;
+    readonly logger?: Logger;
+    readonly interactive?: boolean;
+}
+/** Connects to the database and returns the Local API. */
+declare function createEasyCMS<const C extends Config>(config: C | ResolvedConfig, options?: CreateEasyCMSOptions): Promise<EasyCMS<C>>;
+/** A scheduled publish or unpublish. */
+interface ScheduledPublish {
+    readonly id: ID;
+    readonly action: 'publish' | 'unpublish';
+    /** ISO time the job runs at (or after). */
+    readonly runAt: string;
+    readonly state: 'pending' | 'done' | 'failed';
+    readonly error: string | null;
+    readonly author: ID | null;
+}
+declare class EasyCMS<C extends Config = Config> {
+    readonly config: ResolvedConfig;
+    readonly db: Database;
+    readonly logger: Logger;
+    /** Login, logout and session checks. */
+    readonly auth: Auth;
+    /** Where uploaded files are stored. */
+    readonly storage: StorageAdapter;
+    /**
+     * Where files in private folders are stored (`upload.privateStorage`, else `storage` when it has
+     * no public URLs); `null` when private folders can't be used.
+     */
+    readonly privateStorage: StorageAdapter | null;
+    /** Project root: relative paths in the config (e.g. `admin.modules`) start here. */
+    readonly cwd: string;
+    /** Roles and their permissions (`auth.rbac`, Settings → Roles). */
+    readonly roles: Roles;
+    /** Who did what (`audit`, Settings → Audit log). */
+    readonly audit: AuditLog;
+    /** Folders of the media library and their permissions (`upload.folders`). */
+    readonly folders: MediaFolders;
+    private readonly versions;
+    private readonly webhooks;
+    private readonly mailer;
+    /**
+     * The user and context of a request, as the REST API works them out: its session cookie or
+     * Bearer token, then `onRequest`. For framework routes and server code that act for a visitor;
+     * pass both to the Local API with `overrideAccess: false`.
+     */
+    forRequest(request: Request | Headers): Promise<{
+        user: AuthUser | null;
+        context: RequestContext;
+    }>;
+    find<S extends Slug<C>>(collection: S, options?: FindOptions): Promise<PaginatedDocs<Doc<C, S>>>;
+    findById<S extends Slug<C>>(collection: S, id: ID, options?: ReadOptions): Promise<Doc<C, S> | null>;
+    count<S extends Slug<C>>(collection: S, options?: {
+        where?: Where;
+        draft?: boolean;
+        locale?: string;
+    } & AccessOptions): Promise<number>;
+    create<S extends Slug<C>>(collection: S, data: Create<C, S>, options?: DepthOptions): Promise<Doc<C, S>>;
+    /**
+     * Stores a file and creates its `media` document (FR-UPL). The type is detected from
+     * the contents; images get width/height, and resized copies when `sharp` is installed.
+     */
+    upload(file: {
+        data: Uint8Array;
+        name: string;
+    }, data?: Record<string, unknown>, options?: DepthOptions): Promise<MediaDocument>;
+    /**
+     * Starts an upload straight to the storage, for files too large to send through the server
+     * (`POST <api>/media/uploads`): checks who uploads what where, as `upload()` does, and returns
+     * a signed ticket and where to send the file. `upload` is `null` when the storage can't take
+     * files directly: send it to `upload()` instead. Then `completeUpload(ticket)`.
+     */
+    createUpload(file: {
+        name: string;
+        size: number;
+        type?: string;
+    }, data?: Record<string, unknown>, options?: AccessOptions): Promise<{
+        ticket: string;
+        upload: DirectUpload | null;
+    }>;
+    /**
+     * Finishes an upload made with `createUpload()` (`POST <api>/media/uploads/complete`): checks
+     * the file in the storage like any upload (its size, and its type from its contents), then
+     * makes its media document. A file that fails is deleted.
+     */
+    completeUpload(ticket: string, options?: DepthOptions): Promise<MediaDocument>;
+    /** Who may upload, and into which folder: `upload()` and direct uploads. */
+    private checkUpload;
+    /** A value with its HMAC (`secret`), for `purpose` only: `<base64url JSON>.<signature>`. */
+    private sign;
+    /** The value of a token made by `sign`, or `undefined` when it isn't genuine. */
+    private verify;
+    /**
+     * Downloads a file from an `http(s)` link and uploads it like `upload()`. Private network
+     * addresses are refused unless `upload.fromURL.allowPrivate`. Calls on behalf of a user (the
+     * REST API, `overrideAccess: false`) also need `upload.fromURL` and a host in its `allowedHosts`.
+     */
+    uploadFromURL(url: string, data?: Record<string, unknown>, options?: DepthOptions): Promise<MediaDocument>;
+    /**
+     * Creates an API key (needs `apiKeys: true`) and returns it once: only a hash is stored.
+     * With access enforced the key belongs to `user`; trusted calls name the owner in `data.user`.
+     */
+    createApiKey(data: {
+        name: string;
+        permissions?: ApiKeyPermissions;
+        expiresAt?: string | Date | null;
+        user?: ID;
+    }, options?: AccessOptions): Promise<{
+        key: string;
+        doc: Record<string, unknown>;
+    }>;
+    /** Public URL of a stored file. */
+    mediaURL(key: string): string;
+    /**
+     * A link to a private file that works without signing in until it expires: `expiresIn` in
+     * seconds or as `'30m'`, `'1h'` (the default), `'7d'` (the most). Public files get their usual
+     * URL. `size`: one of the file's resized copies. Links stop working when `secret` changes or
+     * the file stops being private.
+     */
+    signedMediaURL(doc: {
+        filename?: unknown;
+        private?: unknown;
+        sizes?: unknown;
+    }, options?: {
+        expiresIn?: number | string;
+        size?: string;
+    }): string;
+    /** Whether a signed link to a private file is genuine and not expired. */
+    verifyMediaSignature(key: string, expires: string | null, signature: string | null): boolean;
+    private mediaSignature;
+    /**
+     * How many documents use any of these files in a top-level upload field (rich text and fields
+     * inside groups, arrays and blocks are not counted). Drafts count too.
+     */
+    mediaUsage(ids: readonly ID[]): Promise<number>;
+    /** The storage for public files, or for private ones. */
+    storageFor(isPrivate: boolean): StorageAdapter;
+    /**
+     * Copies a file and its resized copies to the other storage under their new names (`.private`
+     * added or removed). Returns the fields to save, and `cleanUp` to delete the old copies once
+     * the document points to the new ones.
+     */
+    private relocate;
+    /** A folder's name, parent and permissions; private only with somewhere private to keep files. */
+    private validateFolder;
+    /**
+     * Refuses a change that would move more than 200 files between storages in one request: they
+     * are copied one by one, which could outlast a serverless function.
+     */
+    private checkMoveLimit;
+    /** After a folder became private or public (or moved): its files follow, in every subfolder. */
+    private settlePrivacy;
+    /** Files at the top level are public. */
+    private settleTopLevel;
+    private settleFiles;
+    update<S extends Slug<C>>(collection: S, id: ID, data: Update<C, S>, options: UpdateOptions & {
+        where: Where;
+    }): Promise<Doc<C, S> | null>;
+    update<S extends Slug<C>>(collection: S, id: ID, data: Update<C, S>, options?: UpdateOptions & {
+        where?: undefined;
+    }): Promise<Doc<C, S>>;
+    /**
+     * Adds `by` (negative to take away) to a top-level number field in one database statement, so
+     * concurrent calls never lose a change, e.g. stock or a counter. Skips hooks, validation, access
+     * and versions. Returns the new value, or `null` when `min` / `max` would be passed; throws
+     * `NotFoundError` when there is no such document.
+     */
+    increment<S extends Slug<C>>(collection: S, id: ID, field: string, by: number, options?: IncrementOptions): Promise<number | null>;
+    /**
+     * Takes a document off the site: its status becomes `draft`. With versions and drafts, a plain
+     * `update` with `status: 'draft'` only saves a draft and leaves the published document live;
+     * this is how to unpublish it.
+     */
+    unpublish<S extends Slug<C>>(collection: S, id: ID, options?: DepthOptions): Promise<Doc<C, S>>;
+    /** Throws away the unpublished draft of a published document, going back to what is live. */
+    discardDraft<S extends Slug<C>>(collection: S, id: ID, options?: DepthOptions): Promise<Doc<C, S>>;
+    /** Saved versions of a document, newest first. Needs update access to the document. */
+    findVersions<S extends Slug<C>>(collection: S, id: ID, options?: AccessOptions & {
+        limit?: number;
+        page?: number;
+    }): Promise<PaginatedDocs<VersionSummary>>;
+    /** One saved version with the document as it was then. */
+    findVersion<S extends Slug<C>>(collection: S, id: ID, versionId: ID, options?: DepthOptions): Promise<Version<Doc<C, S>> | null>;
+    /**
+     * Makes an old version the current content, as a new version. With drafts it is restored as
+     * a draft (publish it to put it live); access, hooks and validation run as for `update`.
+     */
+    restoreVersion<S extends Slug<C>>(collection: S, id: ID, versionId: ID, options?: DepthOptions): Promise<Doc<C, S>>;
+    /**
+     * Live preview: the document as it would be read if `data` were saved on top of its current
+     * state (or as a new document when `id` is `null`), with relationships populated and
+     * `afterRead` hooks applied. Nothing is written. Also returns the page URL from `preview`.
+     */
+    preview<S extends Slug<C>>(collection: S, id: ID | null, data: Record<string, unknown>, options?: DepthOptions): Promise<LivePreview<Doc<C, S>>>;
+    /**
+     * A token that lets a page read one document's current draft for a while (default one hour),
+     * without a login: `GET /api/cms/:collection/:id?preview=<token>`. The admin adds one to the
+     * preview URL as `easy-cms-preview`, for sites on another origin.
+     */
+    createPreviewToken(target: {
+        collection: string;
+        id: ID;
+    } | {
+        global: string;
+    }, options?: {
+        expiresIn?: number;
+    }): string;
+    /** What a preview token opens, or `null` when it is invalid or expired. */
+    verifyPreviewToken(token: string | null | undefined): (PreviewTarget & {
+        expiresAt: number;
+    }) | null;
+    /** Live preview of a global. See `preview`. */
+    previewGlobal<S extends GSlug<C>>(slug: S, data: Record<string, unknown>, options?: DepthOptions): Promise<LivePreview<GDoc<C, S>>>;
+    /** Coerces preview input like a save would, keeping values that would fail validation. */
+    private previewDoc;
+    private previewURL;
+    private versionTarget;
+    private updateDocument;
+    /**
+     * Deletes a document. Deleting a user with roles from the admin (`auth.rbac`): `transferTo`
+     * gives the documents they own to another user; without it they have no owner.
+     */
+    delete<S extends Slug<C>>(collection: S, id: ID, options?: AccessOptions & {
+        transferTo?: ID | null;
+    }): Promise<Doc<C, S>>;
+    findGlobal<S extends GSlug<C>>(slug: S, options?: ReadOptions): Promise<GDoc<C, S>>;
+    /** A global as stored under `key` (see `globalKey`); empty when there is no key. */
+    private readGlobal;
+    /**
+     * Where a global is kept: its slug, or `<slug>@<scope>` for globals with `scope` (e.g. one per
+     * tenant). `null` when the call has no scope: reads give the global empty. `scope` is given by
+     * scheduled jobs, which have no request.
+     */
+    private globalKey;
+    /** `globalKey` for changes, which need a scope. */
+    private writeKey;
+    updateGlobal<S extends GSlug<C>>(slug: S, data: GInput<C, S>, options?: DepthOptions): Promise<GDoc<C, S>>;
+    /** Takes a global off the site (`status: 'draft'`). See `unpublish`. */
+    unpublishGlobal<S extends GSlug<C>>(slug: S, options?: DepthOptions): Promise<GDoc<C, S>>;
+    /** Throws away the unpublished draft of a published global. */
+    discardGlobalDraft<S extends GSlug<C>>(slug: S, options?: DepthOptions): Promise<GDoc<C, S>>;
+    /** Saved versions of a global, newest first. Needs update access. */
+    findGlobalVersions<S extends GSlug<C>>(slug: S, options?: AccessOptions & {
+        limit?: number;
+        page?: number;
+    }): Promise<PaginatedDocs<VersionSummary>>;
+    findGlobalVersion<S extends GSlug<C>>(slug: S, versionId: ID, options?: DepthOptions): Promise<Version<GDoc<C, S>> | null>;
+    /** Makes an old version of a global current (as a draft when the global has drafts). */
+    restoreGlobalVersion<S extends GSlug<C>>(slug: S, versionId: ID, options?: DepthOptions): Promise<GDoc<C, S>>;
+    private globalVersionTarget;
+    /** The global's pending draft when it has one (see `withDrafts`), otherwise `saved`. */
+    private globalDraft;
+    private saveGlobal;
+    /**
+     * Users changing their own password or email say their current password first, so a session
+     * someone else got hold of can't lock them out. Admins changing other users don't.
+     */
+    private checkOwnCredentials;
+    /**
+     * What `user` may do with one document. Resolves `where`-style access
+     * against the document, so the admin UI can hide actions precisely.
+     */
+    documentPermissions(collection: Slug<C>, id: ID, user: AuthUser | null, context?: RequestContext): Promise<{
+        update: boolean;
+        delete: boolean;
+    }>;
+    /** Closes the database connection. */
+    /**
+     * Waits until webhook deliveries in progress are done. Call it before a serverless function
+     * returns, which may otherwise stop them.
+     */
+    flushWebhooks(): Promise<void>;
+    /**
+     * Sends an email with the config's `email` adapter, e.g. from a hook or plugin. Resolves once
+     * the email is queued; it is sent in the background and retried from the queue if sending
+     * fails. Without `email` in the config, the email is skipped with a warning.
+     */
+    sendEmail(message: EmailMessage): Promise<void>;
+    /** Waits for emails being sent, e.g. before a serverless function returns. */
+    flushEmails(): Promise<void>;
+    /** Emails queued until sent, stored in `email-deliveries`. */
+    private emailQueue;
+    destroy(): Promise<void>;
+    private schedulerTimer;
+    private running;
+    /** Runs `runJobs` every `interval` ms in this process (`createEasyCMS` does this by default). */
+    startScheduler(interval?: number): void;
+    /**
+     * Runs due scheduled publishes and unpublishes, and retries failed webhook deliveries. What the
+     * scheduler and the cron endpoint (`GET <api>/jobs/run`) call.
+     */
+    runJobs(now?: Date): Promise<{
+        /** Scheduled publishes and unpublishes. */
+        scheduled: {
+            ran: number;
+            failed: number;
+        };
+        webhooks: {
+            sent: number;
+            failed: number;
+        };
+        emails: {
+            sent: number;
+            failed: number;
+        };
+        jobs: {
+            ran: number;
+            failed: number;
+        };
+    }>;
+    /** `jobs` of the config that are due; when each last ran is kept in the database. */
+    private runConfigJobs;
+    /**
+     * Sends an event of the app or a plugin (`events` in the config, e.g. `order.paid`) to the
+     * webhooks that list it. Returns at once; deliveries are queued and retried like content changes.
+     */
+    emit(event: string, data: Record<string, unknown>, about?: {
+        collection: string;
+        id: ID;
+    }): void;
+    /**
+     * Tries webhook deliveries that are due for another attempt. Deliveries are kept in the
+     * database until they succeed, so they survive restarts.
+     */
+    retryWebhooks(now?: Date): Promise<{
+        sent: number;
+        failed: number;
+    }>;
+    /** Webhook deliveries until they succeed, stored in `webhook-deliveries`. */
+    private webhookQueue;
+    /**
+     * Publishes or unpublishes documents whose scheduled time has come. Safe to call often, e.g.
+     * from a cron job (`GET <api>/jobs/run`) where no process keeps running.
+     */
+    runScheduled(now?: Date): Promise<{
+        ran: number;
+        failed: number;
+    }>;
+    /** Schedules a publish or unpublish, replacing a pending job with the same action. */
+    schedule<S extends Slug<C>>(collection: S, id: ID, job: {
+        action: 'publish' | 'unpublish';
+        at: Date | string;
+    }, options?: AccessOptions): Promise<ScheduledPublish>;
+    /** Pending jobs of a document, soonest first. */
+    findSchedule<S extends Slug<C>>(collection: S, id: ID, options?: AccessOptions): Promise<ScheduledPublish[]>;
+    cancelSchedule<S extends Slug<C>>(collection: S, id: ID, jobId: ID, options?: AccessOptions): Promise<void>;
+    scheduleGlobal<S extends GSlug<C>>(slug: S, job: {
+        action: 'publish' | 'unpublish';
+        at: Date | string;
+    }, options?: AccessOptions): Promise<ScheduledPublish>;
+    findGlobalSchedule<S extends GSlug<C>>(slug: S, options?: AccessOptions): Promise<ScheduledPublish[]>;
+    cancelGlobalSchedule<S extends GSlug<C>>(slug: S, jobId: ID, options?: AccessOptions): Promise<void>;
+    private scheduleTarget;
+    private globalScheduleTarget;
+    private addJob;
+    /**
+     * The next pending jobs across all collections and globals, soonest first; with access
+     * enforced, only those the user may update.
+     */
+    upcomingSchedules(options?: AccessOptions & {
+        limit?: number;
+    }): Promise<(ScheduledPublish & {
+        collection?: string;
+        global?: string;
+        doc: ID;
+    })[]>;
+    private pendingJobs;
+    private removeJob;
+    /** Removes webhook deliveries and emails that failed more than 30 days ago. */
+    private pruneFailedDeliveries;
+    private global;
+    /**
+     * Refuses what a request's API key (see `ApiKeyPermissions`) or the user's role (`auth.rbac`)
+     * does not allow. Returns a constraint when the role allows only the user's own account.
+     */
+    private checkGrant;
+    /** The query constraint read access adds, or `undefined` when there is none. Throws when denied. */
+    private readWhere;
+    private checkDocumentAccess;
+    private checkGlobalAccess;
+    private fieldChecker;
+    /**
+     * Refuses filtering or sorting by fields the caller may not read: the results would tell
+     * their values. Checks each field along a dotted path, through groups, arrays and blocks.
+     */
+    private checkQueryFields;
+    /** `checkGrant` for one document: a role limited to its own documents must own it. */
+    private checkDocumentGrant;
+    /** Runs afterRead hooks, populates relationships and removes what the caller may not see. */
+    private output;
+    /** Creates a document: access, input filtering, hooks, validation, then afterChange. */
+    private createDocument;
+    /** The locale for an operation; `undefined` without localization. Throws on unknown locales. */
+    private localeOf;
+    /** Stored localized maps → the values of the requested locale. */
+    private pick;
+    /** Input for one locale → stored localized maps, keeping the other locales from `current`. */
+    private toMaps;
+    /** Makes `where` match localized fields in the operation's locale. */
+    private whereFor;
+    /** Drafts are kept as versions (instead of unpublishing) when both are enabled. */
+    private separateDrafts;
+    /** Replaces published documents that have a newer draft with that draft. */
+    private withDrafts;
+    /** Sends webhook events for a change; `before` is the stored status before it, if any. */
+    private emitChange;
+    /**
+     * Writes the audit log entry for a change (`audit`): publishing, unpublishing and restoring
+     * are told apart from other saves.
+     */
+    private audited;
+    /** Records a version after a save, when the collection or global keeps versions. */
+    private saveVersion;
+    private hookArgs;
+    /**
+     * Runs hooks that may replace a value, passed as `data` (before hooks) or `doc` (afterRead).
+     * Returning `undefined` keeps the value; a throw cancels the operation.
+     */
+    private transform;
+    /** Runs hooks after the change is saved: failures are logged, never undo the save (NFR-REL-03). */
+    private notify;
+    /** Writes resized copies with sharp, when installed and configured. */
+    private resizeImage;
+    /** Validates, checks uniqueness and references. Returns clean data or throws `ValidationError`. */
+    private prepare;
+    /** Refuses changes that would leave no active admin (and lock everyone out). */
+    private guardLastAdmin;
+    private makeSlugsUnique;
+    private checkUnique;
+    private isTaken;
+    /**
+     * What folder keys are unique within for a call (`uniqueWithin` of the `key` field of media
+     * folders, e.g. the tenant): the value a folder made by this call would get from its hooks.
+     */
+    private folderScope;
+    /**
+     * Where a unique field's values must differ for a call (`uniqueWithin`, e.g. the tenant): the
+     * value a document created by this call would get there from its hooks, as `{ [field]: value }`;
+     * `{}` when the field is unique everywhere. For finding documents by such a field, e.g. a page
+     * by its path in the current tenant.
+     */
+    uniqueScope(collection: string, field: string, options?: Pick<AccessOptions, 'user' | 'context'>): Promise<Record<string, unknown>>;
+    /** Each reference is one its relationship's `filterOptions` allow. */
+    private checkFilterOptions;
+    private checkReferences;
+}
+/** A document as live preview shows it, and the page to show it on. */
+interface LivePreview<T> {
+    readonly doc: T;
+    /** From the collection's `preview` function; `null` without one. */
+    readonly url: string | null;
+}
+
+/** Audit log settings (`audit`). */
+interface AuditConfig {
+    /** Days to keep entries; older ones are deleted. `0`: keep them all. Default 365. */
+    readonly keepDays?: number;
+    /** Keep the values before and after a change, not only which fields changed. Default `true`. */
+    readonly values?: boolean;
+    /** Failed logins within an hour that the dashboard warns about. Default 20. */
+    readonly failedLogins?: number;
+    /**
+     * The part of the site an entry belongs to, from the request's context, e.g. its tenant
+     * (usually set by a plugin). Users whose role holds in a part only (`scoped`) see that part's
+     * entries; others see the chosen part's, or all.
+     */
+    readonly scope?: ((args: {
+        readonly context: RequestContext;
+        readonly user: AuthUser | null;
+    }) => string | null | undefined) | false;
+}
+/** A field that changed: values before and after, unless they are not kept. */
+interface AuditChange {
+    field: string;
+    before?: unknown;
+    after?: unknown;
+}
+/** One entry (`GET <api>/admin/audit`). */
+interface AuditEntry {
+    id: ID;
+    /** When, as an ISO date. */
+    at: string;
+    /** E.g. `create`, `update`, `publish`, `delete`, `login`, `login.failed`, `role.update`. */
+    action: string;
+    /** A collection slug, `global:<slug>`, or an area such as `auth`, `roles`, `backups`. */
+    target: string | null;
+    /** The document's id. */
+    doc: string | null;
+    /** The document's title then (kept after it is deleted). */
+    title: string | null;
+    actor: {
+        id: string | null;
+        email: string | null;
+        /** `user` (admin or REST), `api-key`, `system` (code), `scheduler`. */
+        via: string;
+        ip: string | null;
+        userAgent: string | null;
+    };
+    changes: AuditChange[] | null;
+    detail: Record<string, unknown> | null;
+}
+/** `GET <api>/admin/audit`: a page of entries, newest first. */
+/** A page of the audit log: the list shape of the rest of the API. */
+type AuditPage = PaginatedDocs<AuditEntry>;
+interface AuditFilter {
+    action?: string | null;
+    target?: string | null;
+    doc?: string | null;
+    /** An email, or part of one. */
+    actor?: string | null;
+    /** ISO dates. */
+    from?: string | null;
+    to?: string | null;
+    /** Only entries of this part of the site (`scope`). */
+    scope?: string | null;
+}
+/** `POST <api>/admin/audit/verify`. */
+interface AuditVerification {
+    checked: number;
+    /** Entries whose signature does not match: changed after they were written. */
+    invalid: ID[];
+    /** Missing ids between entries: deleted entries, or (rarely) inserts that failed. */
+    gaps: number;
+    at: string;
+}
+/**
+ * The audit log (`audit` in the config): who did what, when, from where. Entries can't be
+ * changed through Easy CMS; each is signed with the secret, so changes in the database show.
+ * Available as `cms.audit`.
+ */
+declare class AuditLog {
+    private readonly cms;
+    /** Entries that could not be written since the server started. */
+    failures: number;
+    constructor(cms: EasyCMS);
+    get enabled(): boolean;
+    private get settings();
+    /**
+     * Writes an entry. The user defaults to the request's. Never throws: a failure is logged and
+     * counted, and the dashboard says so.
+     */
+    record(entry: {
+        action: string;
+        target?: string | null;
+        doc?: ID | null;
+        title?: string | null;
+        user?: AuthUser | null;
+        /** Who it was when there is no user, e.g. the email of a failed login. */
+        email?: string | null;
+        changes?: AuditChange[] | null;
+        detail?: Record<string, unknown> | null;
+        /** The call's context, when it is not the request's. */
+        context?: RequestContext;
+    }): Promise<void>;
+    /** Entries, newest first: `page` (from 1) of `limit` (default 50, at most 100). */
+    list(options?: AuditFilter & {
+        page?: number;
+        limit?: number;
+    }): Promise<AuditPage>;
+    /** The filtered entries as CSV (the newest 10,000). */
+    csv(filter: AuditFilter): Promise<string>;
+    /** Checks every entry's signature, and that no ids are missing. */
+    verify(): Promise<AuditVerification>;
+    /** What the dashboard warns about: many failed logins, entries not written, a failed check. */
+    attention(now?: Date): Promise<({
+        id: 'failed-logins';
+        count: number;
+    } | {
+        id: 'audit-failures';
+        count: number;
+    } | {
+        id: 'audit-tampered';
+        invalid: number;
+        at: string;
+    })[]>;
+    private sign;
+    private lastVerification;
+    private where;
+}
+
+/** What the email functions in `auth.emails` receive. */
+interface PasswordEmailArgs {
+    readonly user: AuthUser;
+    /** The page that sets the password; absent for `passwordChanged`. */
+    readonly url?: string;
+    /** The admin language for the text: `en` or `th`. */
+    readonly locale: string;
+    /** When the link stops working. */
+    readonly expiresAt?: Date;
+    /**
+     * Invitations when passwords are off (`auth.password: false`): the providers to sign in with,
+     * e.g. `['Google']`; `url` is then the login page.
+     */
+    readonly sso?: readonly string[];
+}
+/** An email's content: a subject, and text and/or HTML. */
+interface PasswordEmail {
+    readonly subject: string;
+    readonly text: string;
+    readonly html?: string;
+}
+type PasswordEmailFn = (args: PasswordEmailArgs) => PasswordEmail | Promise<PasswordEmail>;
+/** The default emails, in English and Thai. */
+declare const DEFAULT_PASSWORD_EMAILS: {
+    resetPassword: PasswordEmailFn;
+    invite: PasswordEmailFn;
+    passwordChanged: PasswordEmailFn;
+    verifyEmail: PasswordEmailFn;
+};
+
+/**
+ * Signing in to the admin with an outside account (`auth.providers`): Google, Microsoft, GitHub
+ * or any OpenID Connect provider. `@easy-cms/auth-oauth` makes these; Easy CMS runs the rest
+ * (the redirect, matching users, sessions).
+ */
+/** Values bound to one sign-in, checked when the browser comes back. */
+interface AuthProviderRequest {
+    /** Where the provider sends the browser back: `<serverURL><api>/auth/<id>/callback`. */
+    readonly redirectUri: string;
+    readonly state: string;
+    /** For PKCE: the provider gets its S256 challenge. */
+    readonly codeVerifier: string;
+    /** For OpenID Connect: must come back in the ID token. */
+    readonly nonce: string;
+}
+/** Who signed in, as the provider says. */
+interface AuthProviderProfile {
+    /** The provider's stable id for the account (`sub`). */
+    readonly subject: string;
+    readonly email: string | null;
+    /** The provider vouches for the email. Only verified emails are matched to users. */
+    readonly emailVerified: boolean;
+    readonly name?: string | undefined;
+}
+interface AuthProvider {
+    /** In URLs and stored identities, e.g. `google`: lowercase letters, digits and `-`. */
+    readonly id: string;
+    /**
+     * The adapter interface it is written for (`ADAPTER_API_VERSION`); Easy CMS refuses another.
+     * Leave it out to skip the check.
+     */
+    readonly apiVersion?: number;
+    /** On the sign-in button, e.g. `Google`. */
+    readonly name: string;
+    /** The button's icon in the admin. Default `key`. */
+    readonly icon?: 'google' | 'microsoft' | 'github' | 'key';
+    /** The provider's page to send the browser to. */
+    authorizationURL(request: AuthProviderRequest): Promise<URL>;
+    /**
+     * After the browser comes back to `redirectUri` (`url`, with its query): checks the response
+     * and exchanges the code. Throws when anything does not check out.
+     */
+    callback(request: AuthProviderRequest & {
+        readonly url: URL;
+    }): Promise<AuthProviderProfile>;
+    /** For Settings → SSO: what it connects to, never secrets. */
+    describe?(): Readonly<Record<string, string>>;
+    /**
+     * Signs staff who have an account in by their verified email the first time, without linking
+     * the provider from their account page. Only for a provider whose emails your organization
+     * controls (e.g. its Google Workspace). Default `false`; site members are always matched.
+     */
+    readonly linkByEmail?: boolean;
+}
+
+interface ConfigIssue {
+    /** Where the problem is, e.g. `collections.posts.fields.slug.from`. */
+    readonly path: string;
+    readonly message: string;
+    /** How to fix it. */
+    readonly hint?: string;
+    /** `warning`: reported, but the config is used (e.g. an option Easy CMS doesn't know). */
+    readonly severity?: 'warning';
+}
+/**
+ * What went wrong, for programs: in REST errors (`errors[].code`), GraphQL errors
+ * (`extensions.code`) and on every `EasyCMSError` (`code`). New codes may be added; these keep
+ * their meaning.
+ */
+type ErrorCode = 'VALIDATION_ERROR' | 'BAD_USER_INPUT' | 'UNAUTHORIZED' | 'FORBIDDEN' | 'NOT_FOUND' | 'METHOD_NOT_ALLOWED' | 'PAYLOAD_TOO_LARGE' | 'UNSUPPORTED_MEDIA_TYPE' | 'TOO_MANY_REQUESTS' | 'CONFIG_ERROR' | 'INTERNAL_SERVER_ERROR';
+/** The code of an HTTP status, for errors that only have a status. */
+declare function codeOfStatus(status: number): ErrorCode;
+/** Base class for Easy CMS's errors: an HTTP status for the REST API, and a code for programs. */
+declare class EasyCMSError extends Error {
+    readonly status: number;
+    readonly code: ErrorCode;
+    constructor(message: string, status: number, code?: ErrorCode);
+}
+declare class ConfigError extends EasyCMSError {
+    readonly issues: readonly ConfigIssue[];
+    constructor(issues: readonly ConfigIssue[]);
+    static format(issues: readonly ConfigIssue[]): string;
+}
+interface FieldError {
+    /** Dotted path, e.g. `links.0.url`. */
+    readonly field: string;
+    readonly message: string;
+}
+declare class ValidationError extends EasyCMSError {
+    readonly errors: readonly FieldError[];
+    constructor(collection: string, errors: readonly FieldError[]);
+}
+declare class NotFoundError extends EasyCMSError {
+    constructor(collection: string, id: unknown);
+}
+/** A bad `where`, `sort` or unknown collection/global. */
+declare class QueryError extends EasyCMSError {
+    constructor(message: string);
+}
+/** The database schema does not match the config (pending or missing migrations). */
+declare class SchemaError extends EasyCMSError {
+    constructor(message: string);
+}
+/** Not logged in, or the session is invalid. */
+declare class UnauthorizedError extends EasyCMSError {
+    constructor(message?: string);
+}
+/** Logged in, but not allowed to do this. */
+declare class ForbiddenError extends EasyCMSError {
+    constructor(message?: string);
+}
+declare class TooManyRequestsError extends EasyCMSError {
+    /** When to try again, in seconds (the REST API sends it as `Retry-After`). */
+    readonly retryAfter: number | undefined;
+    constructor(message: string, retryAfter?: number);
+}
+declare class PayloadTooLargeError extends EasyCMSError {
+    constructor(message: string);
+}
+
+/** Built-in types a field type can be stored as. */
+declare const FIELD_TYPE_BASES: readonly ["text", "textarea", "email", "number", "boolean", "date", "json"];
+type FieldTypeBase = (typeof FIELD_TYPE_BASES)[number];
+/** What a field type's `validate` gets besides the value: the field, with its own options. */
+interface FieldTypeValidateContext extends FieldValidateContext {
+    readonly field: Readonly<Record<string, unknown>> & {
+        readonly name: string;
+    };
+}
+/**
+ * A field type a package adds, e.g. `color`: stored, queried and translated like its `base`
+ * type, with its own checks and admin components. List it in the config's `fieldTypes`.
+ */
+interface FieldTypeDefinition {
+    /** The `type` fields use, e.g. `color`. Lowercase; not one of the built-in types. */
+    readonly name: string;
+    /** How values are stored and queried: one of the built-in scalar types. */
+    readonly base: FieldTypeBase;
+    /** Checks a value (not empty ones; `required` covers those). Return `true` or a message. */
+    readonly validate?: (value: unknown, ctx: FieldTypeValidateContext) => true | string | Promise<true | string>;
+    /** Checks a field's own options when the config loads; return a message for a mistake. */
+    readonly checkOptions?: (field: Readonly<Record<string, unknown>>) => string | undefined;
+    readonly admin?: {
+        /** The input: a Web Component from `module`, with fixed `props` of its own if it needs them. */
+        readonly component?: AdminComponent;
+        /** Shown in the admin's lists. */
+        readonly cell?: AdminComponent;
+        /** The admin module (package export or file) that defines the components. */
+        readonly module?: string;
+        /** The field options its components get (as their `options`), e.g. `['presets']`. */
+        readonly props?: readonly string[];
+    };
+    /** The value's TypeScript type for `generate:types`. Default: the base type's. */
+    readonly typescript?: string;
+}
+/** Declares a field type; returns it unchanged. */
+declare function defineFieldType(definition: FieldTypeDefinition): FieldTypeDefinition;
+
+declare const WEBHOOK_EVENTS: readonly ["create", "update", "delete", "publish", "unpublish", "draft"];
+/**
+ * `create`, `update`, `delete`: the stored document changed. `publish` / `unpublish`: its status
+ * changed (sent with `create` or `update`). `draft`: only a draft was saved; what is live did not
+ * change (collections with versions and drafts).
+ */
+type WebhookEvent = (typeof WEBHOOK_EVENTS)[number];
+interface WebhookConfig {
+    /** Where to POST events. */
+    readonly url: string;
+    /**
+     * Events to send. Default: every content change. Events of the app or its plugins (`events`
+     * in the config, e.g. `order.paid`) are sent only when listed here.
+     */
+    readonly events?: readonly (WebhookEvent | (string & {}))[];
+    /** Collections to send events for. Default: all but `users` (list it to get accounts); `[]` for none. */
+    readonly collections?: readonly string[];
+    /** Globals to send events for. Default: all; `[]` for none. */
+    readonly globals?: readonly string[];
+    /** Signs each body: `x-easy-cms-signature: sha256=<hex HMAC-SHA256 of the body>`. */
+    readonly secret?: string;
+    /** Extra request headers, e.g. a token the receiver checks. */
+    readonly headers?: Readonly<Record<string, string>>;
+}
+/** What a webhook receives as JSON. */
+interface WebhookPayload {
+    /** A content change (`WebhookEvent`), or an event of the app or a plugin, e.g. `order.paid`. */
+    readonly event: string;
+    readonly collection?: string;
+    readonly global?: string;
+    readonly id?: ID;
+    /**
+     * The stored document (every locale, no hidden fields); for `delete`, as it was. For an event of
+     * the app or a plugin: what `cms.emit()` was given.
+     */
+    readonly doc: Record<string, unknown>;
+    /** ISO time of the change. */
+    readonly timestamp: string;
+}
+
+type Data = Record<string, unknown>;
+type MaybePromise<T> = T | Promise<T>;
+type Operation = 'create' | 'update';
+interface HookBase {
+    /** The user the operation runs for; `null` for anonymous or trusted Local API calls. */
+    readonly user: AuthUser | null;
+    /** The Local API, e.g. to query other collections or trigger a revalidation. */
+    readonly cms: EasyCMS;
+    /** Slug of the collection or global. */
+    readonly slug: string;
+    /** The request's context (`onRequest`, or `context` of a Local API call); `{}` when there is none. */
+    readonly context: RequestContext;
+}
+type BeforeValidateHook = (args: HookBase & {
+    data: Data;
+    operation: Operation;
+    previousDoc?: Data;
+}) => MaybePromise<Data | undefined>;
+type BeforeChangeHook = (args: HookBase & {
+    data: Data;
+    operation: Operation;
+    previousDoc?: Data;
+}) => MaybePromise<Data | undefined>;
+type AfterChangeHook = (args: HookBase & {
+    doc: Data;
+    operation: Operation;
+    previousDoc?: Data;
+}) => MaybePromise<void>;
+type BeforeDeleteHook = (args: HookBase & {
+    id: ID;
+}) => MaybePromise<void>;
+type AfterDeleteHook = (args: HookBase & {
+    id: ID;
+    doc: Data;
+}) => MaybePromise<void>;
+type AfterReadHook = (args: HookBase & {
+    doc: Data;
+}) => MaybePromise<Data | undefined>;
+interface CollectionHooks {
+    readonly beforeValidate?: readonly BeforeValidateHook[];
+    readonly beforeChange?: readonly BeforeChangeHook[];
+    readonly afterChange?: readonly AfterChangeHook[];
+    readonly beforeDelete?: readonly BeforeDeleteHook[];
+    readonly afterDelete?: readonly AfterDeleteHook[];
+    readonly afterRead?: readonly AfterReadHook[];
+}
+interface GlobalHooks {
+    readonly beforeValidate?: readonly BeforeValidateHook[];
+    readonly beforeChange?: readonly BeforeChangeHook[];
+    readonly afterChange?: readonly AfterChangeHook[];
+    readonly afterRead?: readonly AfterReadHook[];
+}
+interface LocalizationConfig {
+    /** Content locales, e.g. `['th', 'en']`. */
+    readonly locales: readonly string[];
+    /** The locale used when none is given; its values also fill empty ones. Default: the first. */
+    readonly defaultLocale?: string;
+    /** Reads return the default locale's value when a locale's value is empty. Default true. */
+    readonly fallback?: boolean;
+}
+/**
+ * Where a document is shown on the site, for live preview in the admin: an absolute URL or a
+ * path on the site's origin. Return `null` when the document has no page.
+ */
+type PreviewURL = (args: {
+    readonly doc: Record<string, unknown>;
+    /** The content locale being edited (with `localization`), otherwise the admin locale. */
+    readonly locale: string;
+}) => string | null | undefined;
+interface VersionsConfig {
+    /** Versions kept per document; older ones are deleted. Default 50. */
+    readonly keep?: number;
+}
+/** A panel of an edit page's side column: a component, at the top or (default) below the rest. */
+type SidebarPanel = AdminComponent | {
+    readonly tag: string;
+    readonly props?: Readonly<Record<string, unknown>>;
+    /** `top`: right below publishing, above the side fields. Default: below them. */
+    readonly position?: 'top';
+};
+/**
+ * Where the edit page puts its fields: tabs, collapsible sections and rows, by field name. Only
+ * how they look: the data stays as the fields say. Fields not placed follow at the end (in the
+ * first tab). Top-level fields; sidebar fields stay in the side column.
+ *
+ * ```ts
+ * layout: [
+ *   { tab: 'Content', fields: ['title', { row: ['author', 'category'] }, 'body'] },
+ *   { tab: 'SEO', fields: ['meta'] },
+ * ]
+ * ```
+ */
+type LayoutNode = string | {
+    readonly row: readonly string[];
+} | {
+    readonly collapsible: Label;
+    /** Starts folded. */
+    readonly collapsed?: boolean;
+    readonly description?: Label;
+    readonly fields: readonly LayoutNode[];
+} | {
+    readonly tab: Label;
+    readonly description?: Label;
+    readonly fields: readonly LayoutNode[];
+};
+/** Custom admin components for a collection's or global's edit page. */
+interface ContainerAdmin {
+    /** Icon in the admin menu. Default `file-text` for collections, `settings` for globals. */
+    readonly icon?: AdminIcon;
+    /** Its place in its menu group: lower first. Default: after those with one, in config order. */
+    readonly order?: number;
+    /** Panels in the edit page's side column (components from admin modules). */
+    readonly sidebar?: readonly SidebarPanel[];
+    /** Tabs, collapsible sections and rows of the edit page. See `LayoutNode`. */
+    readonly layout?: readonly LayoutNode[];
+    /**
+     * Its menu group: a group's id (`admin.nav`), e.g. `shop` or `shop.catalog`; `settings` for
+     * Settings; or a label, which makes a group of that name. Default: Content for collections,
+     * Settings › Site for globals. `false`: not in the menu, reached by links.
+     */
+    readonly group?: 'settings' | false | Label;
+}
+interface CollectionAdmin extends ContainerAdmin {
+    /**
+     * How the admin opens documents from the list: `drawer` slides a panel over the list, handy
+     * for small collections (categories, tags). Default `page`. Collections with drafts, versions
+     * or live preview always use the page.
+     */
+    readonly editIn?: 'page' | 'drawer';
+    /**
+     * A number that needs attention, next to its menu item: the documents matching `where` (that
+     * the user may read), e.g. orders to send. `tone`: `accent` (default), `warning` or `danger`.
+     */
+    readonly badge?: {
+        readonly where: Where;
+        readonly tone?: 'accent' | 'warning' | 'danger';
+        /** What the number counts, for screen readers, e.g. `{ en: 'to send', th: 'รอจัดส่ง' }`. */
+        readonly label?: Label;
+    };
+    /** The number of documents beside its menu item. Default `true`. */
+    readonly count?: boolean;
+    /** The list with no documents yet: what to say, and a link, e.g. to a guide. */
+    readonly empty?: {
+        readonly description?: Label;
+        readonly link?: {
+            readonly label: Label;
+            readonly href: string;
+        };
+    };
+    readonly list?: CollectionListAdmin;
+    /**
+     * With `auth.rbac`: the relationship field to `users` that names a document's owner, e.g.
+     * `author`, for roles given "own documents only". Default: who created it (`createdBy`).
+     */
+    readonly ownerField?: string;
+    /**
+     * Deleting asks more than "Are you sure?", for documents that take much with them (e.g. a
+     * tenant): `typeTitle` has the user type the document's title; `impact` is a path under the
+     * API, called with `?id=`, that returns `{ message }` (a label) saying what will be lost.
+     * Documents are then deleted one at a time, not from a selection.
+     */
+    readonly confirmDelete?: {
+        readonly typeTitle?: boolean;
+        readonly impact?: string;
+    };
+}
+interface CollectionListAdmin {
+    /**
+     * Show the list as a tree: the name of a relationship field to this same collection (e.g.
+     * `parent`). Top-level documents come first; their children open below them.
+     */
+    readonly tree?: string;
+    /** The list's default order, e.g. `title` or `-updatedAt` (the default). */
+    readonly sort?: string;
+}
+interface CollectionConfig {
+    /** URL and table name. Lowercase letters, digits, `-` and `_`. */
+    readonly slug: string;
+    readonly labels?: {
+        readonly singular?: Label;
+        readonly plural?: Label;
+    };
+    readonly fields: readonly Field[];
+    /** Top-level field shown as the document title in the admin UI. */
+    readonly useAsTitle?: string;
+    /** Adds a `status` field (`draft` | `published`). */
+    readonly drafts?: boolean;
+    /**
+     * Keep a snapshot of every save, to view history and restore. With `drafts`, a draft saved
+     * on a published document is kept as a version and the published document stays live until
+     * it is published again.
+     */
+    readonly versions?: boolean | VersionsConfig;
+    /** Allow scheduling publish/unpublish for a later time (needs `drafts`). */
+    readonly schedule?: boolean;
+    /** Live preview: the page that shows a document, e.g. `({ doc }) => \`/posts/${doc.slug}\``. */
+    readonly preview?: PreviewURL;
+    readonly access?: CollectionAccess;
+    readonly hooks?: CollectionHooks;
+    /** How the collection looks in the admin: its menu item, list, edit page and components. */
+    readonly admin?: CollectionAdmin;
+}
+interface GlobalConfig {
+    readonly slug: string;
+    readonly label?: Label;
+    readonly fields: readonly Field[];
+    readonly drafts?: boolean;
+    /** Keep a snapshot of every save. See `CollectionConfig.versions`. */
+    readonly versions?: boolean | VersionsConfig;
+    /** Allow scheduling publish/unpublish for a later time (needs `drafts`). */
+    readonly schedule?: boolean;
+    /** Live preview: the page that shows the global. See `CollectionConfig.preview`. */
+    readonly preview?: PreviewURL;
+    readonly access?: GlobalAccess;
+    readonly hooks?: GlobalHooks;
+    /**
+     * One value per scope, e.g. per tenant (usually set by a plugin): the scope of a call, from its
+     * context (`onRequest`). A string keeps a value of its own; `undefined` the shared value; `null`
+     * means the call has none, so reads give the global empty and changes are refused.
+     */
+    readonly scope?: (args: {
+        readonly context: RequestContext;
+        readonly user: AuthUser | null;
+    }) => string | null | undefined;
+    /** How the global looks in the admin: its menu item, edit page and components. */
+    readonly admin?: ContainerAdmin;
+}
+type AdminLocale = 'en' | 'th';
+/** Icons a collection or global can show in the admin menu ([Lucide](https://lucide.dev) names). */
+declare const ADMIN_ICONS: readonly ["file-text", "newspaper", "book-open", "notebook", "folder", "tag", "tags", "image", "images", "video", "music", "file", "users", "user", "building", "store", "shopping-bag", "shopping-cart", "package", "box", "calendar", "calendar-days", "map-pin", "globe", "house", "layout-grid", "layers", "star", "heart", "message-square", "mail", "phone", "briefcase", "graduation-cap", "utensils", "car", "settings", "sliders-horizontal", "palette", "megaphone", "bell", "link", "quote", "circle-help", "award", "ticket", "camera", "key", "chart-column", "chart-line"];
+type AdminIcon = (typeof ADMIN_ICONS)[number];
+/** Your or your client's brand in the admin UI. */
+interface AdminBrand {
+    /** Shown in the menu, on the login page and in the browser tab. Default "Easy CMS". */
+    readonly name?: string;
+    /** Logo URL: a path on your site (`/logo.svg`) or an `https://` address. */
+    readonly logo?: string;
+    /** Main color as `#rrggbb`; lighter and darker shades are derived from it. */
+    readonly color?: string;
+}
+/** A group of the admin menu (`admin.nav`). */
+interface NavGroup {
+    /** Lowercase letters, digits and `-`; children are named `<parent>.<child>`, e.g. `shop.catalog`. */
+    readonly id: string;
+    readonly label: Label;
+    readonly icon?: AdminIcon;
+    /** Its place among the groups: lower first. Content is 0, the media library 10, Settings 1000. */
+    readonly order?: number;
+    /** Groups inside it, one level. */
+    readonly children?: readonly Omit<NavGroup, 'children'>[];
+}
+/** An entry of the command palette (⌘K) that opens a page of the admin. */
+interface AdminCommand {
+    readonly label: Label;
+    /** A path in the admin, e.g. `/collections/orders?f_status=paid`. */
+    readonly href: string;
+    readonly icon?: AdminIcon;
+    /** Words that find it besides its label. */
+    readonly keywords?: readonly string[];
+}
+/** Who may see an admin page or dashboard widget. Default: every logged-in user. */
+type AdminViewAccess = (args: {
+    readonly user: AuthUser;
+}) => boolean | Promise<boolean>;
+/** A page of its own in the admin, e.g. a plugin's report, at `<admin>/p/<path>`. */
+interface AdminPage {
+    /** Its address under `<admin>/p/`: lowercase letters, digits and `-`, e.g. `forms-overview`. */
+    readonly path: string;
+    /** The page's body: a Web Component from an admin module. The admin draws the header. */
+    readonly component: AdminComponent;
+    /** Its title in the header and the menu. */
+    readonly label: Label;
+    /** Icon in the admin menu. Default `file-text`. */
+    readonly icon?: AdminIcon;
+    /**
+     * Its menu group: `content` (default), `settings`, a group's id (`admin.nav`) or a label; `false`:
+     * not listed, reached by links.
+     */
+    readonly group?: 'content' | 'settings' | false | Label;
+    /** Its place in its menu group: lower first. Default: after those with one, in config order. */
+    readonly order?: number;
+    /** Who may open it. Pages a user may not open are left out of their admin. */
+    readonly access?: AdminViewAccess;
+}
+/** A panel on the admin's dashboard, after the built-in ones. */
+interface DashboardWidget {
+    /**
+     * What roles are given in Settings → Roles (`widget:<id>`): keep it when the component's tag
+     * changes. Default: the component's tag.
+     */
+    readonly id?: string;
+    /** A Web Component from an admin module. */
+    readonly component: AdminComponent;
+    /** `half` (default): the side column, beside drafts and recent edits; `full`: below both. */
+    readonly width?: 'half' | 'full';
+    /** Its name in Settings → Roles (`auth.rbac`). Default: the component's tag. */
+    readonly label?: Label;
+    /** Who sees it. */
+    readonly access?: AdminViewAccess;
+}
+interface AdminConfig {
+    /** Where the admin UI is served. Default `/admin`. */
+    readonly path?: string;
+    /** Default admin UI language. Default `en`. */
+    readonly locale?: AdminLocale;
+    /** Name, logo and color of the admin UI. */
+    readonly brand?: AdminBrand;
+    /**
+     * The public site, for the admin's "View site" link: a path (`/`) or an `https://` URL.
+     * Default `/` with Nuxt and Next.js; none with the standalone server.
+     */
+    readonly siteURL?: string;
+    /**
+     * The admin menu's groups, which collections, globals and pages name in `admin.group`, e.g.
+     * `{ id: 'shop', label: 'Shop', icon: 'store', children: [{ id: 'catalog', label: 'Catalog' }] }`.
+     * Built in: `content` and `settings` (with `site`, `people` and `system`); declaring one of
+     * their ids changes its label, icon or order. Plugins declare their own.
+     */
+    readonly nav?: readonly NavGroup[];
+    /** More entries of the command palette (⌘K), e.g. a plugin's page with a filter. */
+    readonly commands?: readonly AdminCommand[];
+    /**
+     * JavaScript modules the admin loads after login, which define Web Components used by
+     * fields (`admin.component`, `admin.after`) and edit pages (`admin.sidebar`). Each entry is a
+     * package export (`'@easy-cms/plugin-seo/admin'`) or a file path relative to the project root
+     * (`'./admin/color-picker.js'`), resolved on the server. A module must be one self-contained ES
+     * module file. Remote URLs are not allowed.
+     */
+    readonly modules?: readonly string[];
+    /** Pages of their own, e.g. from plugins, at `<admin>/p/<path>`. */
+    readonly pages?: readonly AdminPage[];
+    /** Panels on the dashboard, after the built-in ones. */
+    readonly dashboard?: readonly DashboardWidget[];
+    /**
+     * A choice at the top of the menu that applies to everything in the admin, e.g. the tenant
+     * (usually set by a plugin). The choice is kept in a cookie, which every request of the admin
+     * sends; `onRequest` reads it.
+     */
+    readonly switcher?: AdminSwitcher | false;
+}
+/** See `AdminConfig.switcher`. */
+interface AdminSwitcher {
+    /** Cookie that keeps the choice, e.g. `ecms-tenant`. */
+    readonly cookie: string;
+    readonly label: Label;
+    /**
+     * Path under the API that lists the choices for the logged-in user:
+     * `{ options: [{ value, label }], all?: Label }`, with `all` to offer "all of them" (value `*`).
+     */
+    readonly options: string;
+}
+interface ImageSize {
+    /** Key in `media.sizes`, e.g. `thumbnail`. */
+    readonly name: string;
+    readonly width: number;
+    readonly height?: number;
+    /** How to fit when both width and height are set. Default `cover`. */
+    readonly fit?: 'cover' | 'contain' | 'inside';
+}
+/**
+ * Uploads from a link: the server downloads the file (`cms.uploadFromURL`, `POST <api>/media`
+ * with `{ url }`, "From a link" in the admin).
+ */
+interface UploadFromURLConfig {
+    /**
+     * Hosts files may come from: `images.example.com`, `*.example.com` (its subdomains, not
+     * `example.com` itself) or `*` for any public host. Checked at every redirect too.
+     */
+    readonly allowedHosts: readonly string[];
+    /**
+     * Also download from private network addresses (`10.x`, `192.168.x`, `localhost`…), e.g. an
+     * intranet. Off by default: links could then reach services that are not meant to be public.
+     */
+    readonly allowPrivate?: boolean;
+}
+interface UploadConfig {
+    /** Directory for uploaded files with the default local storage, relative to the project root. Default `uploads`. */
+    readonly dir?: string;
+    /** Maximum file size in bytes. Default 10 MB. */
+    readonly maxFileSize?: number;
+    /** Allowed MIME types, detected from file contents. `image/*` style wildcards are allowed. */
+    readonly mimeTypes?: readonly string[];
+    /** Where files are stored. Default: local disk in `dir`. */
+    readonly storage?: StorageAdapter;
+    /** Resized copies generated for images when `sharp` is installed. */
+    readonly imageSizes?: readonly ImageSize[];
+    /** Lets users upload from a link. Off by default. */
+    readonly fromURL?: UploadFromURLConfig;
+    /**
+     * Folders in the media library (`media-folders`; a file is in one folder at most). With
+     * `auth.rbac`, admins can also choose which roles see and change each folder. Off by default.
+     */
+    readonly folders?: boolean;
+    /**
+     * Where files in private folders are kept: never served publicly, only through the API to
+     * users who may see them or with `cms.signedMediaURL()`. Default: `storage`, when it has no
+     * public URL (the local disk, Netlify Blobs); a storage with public URLs (S3 with `publicURL`,
+     * a public Vercel Blob store) needs one, e.g. `vercelBlobStorage({ access: 'private' })`.
+     */
+    readonly privateStorage?: StorageAdapter;
+}
+interface RoutesConfig {
+    /** Where the REST API is served. Default `/api/cms`. */
+    readonly api?: string;
+}
+/**
+ * People who sign in on the site rather than to the admin, e.g. customers of a shop.
+ */
+interface MembersConfig {
+    /**
+     * Their roles, also listed in `roles`. Members never get into the admin, and access that
+     * defaults to logged-in users (`isStaff`) doesn't count them: give them access in the
+     * collections they use, e.g. with `isSignedIn`.
+     */
+    readonly roles: readonly string[];
+    /** Visitors create their own account: `POST <api>/auth/signup`. */
+    readonly signUp?: MembersSignup;
+    /**
+     * The site's pages that open the links of members' emails, given `?token=`: paths on
+     * `admin.siteURL` (else `serverURL`), or full URLs. Without them, links go to the admin's pages.
+     */
+    readonly pages?: {
+        /** Confirms the email of a new account: `POST <api>/auth/verify-email` with the token. */
+        readonly verifyEmail?: string;
+        /** Sets a forgotten password: `POST <api>/auth/reset-password` with the token. */
+        readonly resetPassword?: string;
+    };
+    /** Your own text for the email that confirms an address. Default: English or Thai. */
+    readonly emails?: {
+        readonly verifyEmail?: PasswordEmailFn;
+    };
+}
+interface MembersSignup {
+    /** The role new accounts get: one of `members.roles`. */
+    readonly role: string;
+    /** New accounts confirm their email with a link before signing in. Default `true`. */
+    readonly verifyEmail?: boolean;
+    /** Cloudflare Turnstile, checked on every sign-up when set. */
+    readonly turnstile?: {
+        readonly siteKey: string;
+        readonly secretKey: string;
+    };
+}
+interface AuthConfig {
+    /**
+     * Roles a user can have. Must include `admin`. Default `['admin', 'editor']`. With `rbac`, these
+     * are the roles that always exist; admins can add more in Settings → Roles.
+     */
+    readonly roles?: readonly string[];
+    /**
+     * Roles and their permissions from the admin (Settings → Roles): admins tick what each role
+     * may do with each collection, global and admin page, on top of access rules. Default `false`.
+     */
+    readonly rbac?: boolean;
+    /** Session lifetime in seconds. Default 7 days. */
+    readonly tokenExpiration?: number;
+    /** Failed logins allowed per email (and IP) within `lockWindow`. Default 5. */
+    readonly maxLoginAttempts?: number;
+    /** Window for `maxLoginAttempts`, in seconds. Default 15 minutes. */
+    readonly lockWindow?: number;
+    /**
+     * Origins allowed to send cookie-authenticated requests, besides the API's own origin.
+     * Needed when the admin or frontend is served from another origin, or behind a proxy that rewrites the host.
+     */
+    readonly trustedOrigins?: readonly string[];
+    /**
+     * How long a "forgot password" link works, in seconds. Default 1 hour. Links work once: setting
+     * the password ends them. Needs `email` and, in production, `serverURL` for the link.
+     */
+    readonly resetPasswordExpiration?: number;
+    /** How long an invitation link works, in seconds. Default 7 days. */
+    readonly inviteExpiration?: number;
+    /**
+     * Signing in to the admin with outside accounts, e.g. `[google({ clientId, clientSecret })]`
+     * from `@easy-cms/auth-oauth`. Users are matched by their verified email.
+     */
+    readonly providers?: readonly AuthProvider[];
+    /**
+     * With `providers`: people from these email domains who sign in for the first time get an
+     * account with `role` (default: as new users). Without it, only existing users can sign in.
+     */
+    readonly providerSignUp?: {
+        readonly domains: readonly string[];
+        readonly role?: string;
+    };
+    /**
+     * `false`: only admins may sign in with a password (a way in when the provider is down);
+     * everyone else signs in with `providers`. Default `true`.
+     */
+    readonly password?: boolean;
+    /**
+     * A code the first admin must enter to create their account, so nobody else can claim a
+     * freshly deployed site. Default: the `EASY_CMS_SETUP_CODE` environment variable; without it,
+     * no code is asked.
+     */
+    readonly setupCode?: string;
+    /**
+     * People who sign in on the site, not to the admin, e.g. customers: their roles, signing up,
+     * and the pages their email links open.
+     */
+    readonly members?: MembersConfig;
+    /** Your own text for the password emails, e.g. in your brand's voice. Default: English or Thai. */
+    readonly emails?: {
+        readonly resetPassword?: PasswordEmailFn;
+        readonly invite?: PasswordEmailFn;
+        readonly passwordChanged?: PasswordEmailFn;
+    };
+}
+/** What `onRequest` receives. */
+interface OnRequestArgs {
+    readonly headers: Headers;
+    /** The request's URL; `undefined` when only headers are known (`cms.forRequest(headers)`). */
+    readonly url: URL | undefined;
+    /** The user of the session or API key, before `onRequest` changes it; `null` when anonymous. */
+    readonly user: AuthUser | null;
+    readonly cms: EasyCMS;
+}
+/**
+ * Runs on each API request (REST, plugin endpoints, `cms.forRequest`) after the user is known:
+ * returns the request's `context` (e.g. the tenant it works in, from a header) and may change the
+ * user (e.g. their role in that tenant, `scoped`). Plugins that set it call the one before.
+ */
+type OnRequest = (args: OnRequestArgs) => MaybePromise<{
+    readonly user?: AuthUser | null;
+    readonly context?: RequestContext;
+} | undefined>;
+/** What an endpoint's handler receives. */
+interface EndpointRequest {
+    readonly request: Request;
+    readonly url: URL;
+    /** Values of `:name` segments in the endpoint's path. */
+    readonly params: Readonly<Record<string, string>>;
+    /** The logged-in user (session cookie or Bearer token), or `null`. */
+    readonly user: AuthUser | null;
+    /** The request's context (`onRequest`): pass it to the Local API with `user`. */
+    readonly context: RequestContext;
+    /** The client's IP address, when the adapter knows it (e.g. to rate-limit a public form). */
+    readonly ip: string | undefined;
+    /** The Local API. Pass `{ user, overrideAccess: false }` to apply the user's access rules. */
+    readonly cms: EasyCMS;
+    /** The request's JSON body, which must be an object (at most 1 MB). */
+    json(): Promise<Record<string, unknown>>;
+    /** The request's body as text, as sent (at most 1 MB), e.g. to check a webhook's signature. */
+    text(): Promise<string>;
+}
+/**
+ * Work that runs with the scheduled jobs: every minute in a server, or each time a cron calls
+ * `GET <api>/jobs/run`. E.g. a plugin's clean-up.
+ */
+interface JobConfig {
+    /** Unique, e.g. `ecommerce:carts`. */
+    readonly name: string;
+    /**
+     * At most this often, in seconds. Default: every run. The last run is kept in the database, so
+     * it holds across processes and serverless invocations.
+     */
+    readonly every?: number;
+    readonly run: (args: {
+        readonly cms: EasyCMS;
+        readonly now: Date;
+    }) => MaybePromise<unknown>;
+}
+/** An `easy-cms <name> [args…]` command. Built-in commands keep their names. */
+interface CliCommand {
+    /** Lowercase, e.g. `nested:rebuild`. */
+    readonly name: string;
+    /** One line for `easy-cms --help`. */
+    readonly description: string;
+    /** Shown by `easy-cms <name> --help`. */
+    readonly help?: string;
+    /** Runs with the CMS open (no schema push); return a non-zero exit code on failure. */
+    readonly run: (args: {
+        readonly cms: EasyCMS;
+        /** Positional arguments after the command name. */
+        readonly args: readonly string[];
+        /** `--name value` and `--name` (true) after the command name, e.g. `{ dryRun: true }`. */
+        readonly flags: Readonly<Record<string, string | boolean>>;
+        readonly log: (line: string) => void;
+    }) => MaybePromise<number | undefined>;
+}
+/**
+ * A custom REST endpoint, served under `routes.api`. Writes from the browser pass the same
+ * CSRF check as the built-in endpoints.
+ */
+interface Endpoint {
+    /**
+     * Path under the API, e.g. `/seo/generate` or `/stats/:collection`. The first segment must
+     * not be a collection slug or one of `users`, `globals`, `admin`, `jobs`. With `root`, the
+     * path from the site's root, outside the API and the admin.
+     */
+    readonly path: string;
+    readonly method: 'get' | 'post' | 'put' | 'patch' | 'delete';
+    /**
+     * Serve the path from the site's root instead of under `routes.api`, e.g. `/robots.txt`.
+     * Only the standalone server (`easy-cms serve`) serves these; a Nuxt or Next.js app owns its
+     * root, so plugins also offer a helper to use in the app's own route. Default false.
+     */
+    readonly root?: boolean;
+    /**
+     * Returns a `Response`, or a value that is sent as JSON. Throw an Easy CMS error
+     * (`UnauthorizedError`, `ForbiddenError`, `ValidationError`, `NotFoundError`) for error responses.
+     */
+    readonly handler: (request: EndpointRequest) => MaybePromise<unknown>;
+}
+/** A plugin's package and version, listed for admins on the dashboard (System). */
+/** The version of what plugins are written against (`definePlugin`, `Config`, hooks, endpoints). */
+declare const PLUGIN_API_VERSION = 1;
+interface PluginInfo {
+    /** Usually the package name, e.g. `@acme/easy-cms-plugin-stats`. */
+    readonly name: string;
+    readonly version?: string;
+    /**
+     * The plugin API the plugin is written for (`PLUGIN_API_VERSION`). Easy CMS refuses to start
+     * with a plugin of another one, saying what to upgrade. Leave it out to skip the check.
+     */
+    readonly apiVersion?: number;
+}
+/** Receives the config and returns a modified copy. Runs before validation. */
+type Plugin = ((config: Config) => MaybePromise<Config>) & {
+    /** Set by `definePlugin(plugin, info)`. */
+    readonly info?: PluginInfo;
+};
+/** Holds a plugin's `PluginTypes` at the type level only: nothing is stored at runtime. */
+declare const PLUGIN_TYPES: unique symbol;
+/**
+ * What a plugin adds, for the document types inferred from the config: fields on collections
+ * and globals (by slug), and whole collections. Field types are written like config fields,
+ * e.g. `{ fields: { posts: readonly [{ readonly name: 'meta'; readonly type: 'group'; … }] } }`.
+ */
+interface PluginTypes {
+    readonly fields?: {
+        readonly [collection: string]: readonly Field[];
+    };
+    readonly globalFields?: {
+        readonly [global: string]: readonly Field[];
+    };
+    readonly collections?: readonly CollectionConfig[];
+}
+/** A plugin that tells the type system what it adds (see `definePlugin`). */
+type TypedPlugin<T extends PluginTypes> = Plugin & {
+    readonly [PLUGIN_TYPES]?: T;
+};
+/**
+ * Returns the plugin with what it adds as types, so `cms.find()` and `CollectionDocument` know
+ * the plugin's fields; `info` (its name and version) is listed for admins on the dashboard:
+ *
+ * ```ts
+ * export const colorPlugin = (options: { collections: readonly string[] }) =>
+ *   definePlugin<{ fields: { posts: readonly [{ readonly name: 'color'; readonly type: 'text' }] } }>(
+ *     (config) => ({ ...config, collections: … }),
+ *     { name: '@acme/easy-cms-plugin-color', version: '1.2.0' },
+ *   )
+ * ```
+ */
+declare function definePlugin<const T extends PluginTypes = Record<never, never>>(plugin: Plugin, info?: PluginInfo): TypedPlugin<T>;
+/** Database backups (Settings → Backups): one compressed SQLite file each. */
+interface BackupsConfig {
+    /** Back up automatically every day or week. Default: only by hand. */
+    readonly frequency?: 'daily' | 'weekly';
+    /** When, as `HH:MM` in the server's time zone. Default `03:00`. */
+    readonly at?: string;
+    /** How many finished backups to keep; older ones are deleted. Default 7. */
+    readonly keep?: number;
+    /** Folder for the default local storage, from the project root. Default `backups`. Never served publicly. */
+    readonly dir?: string;
+    /** Where backups are stored instead, e.g. `s3Storage()` with a private bucket. */
+    readonly storage?: StorageAdapter;
+    /**
+     * For Postgres: the SQLite adapter that writes the backup file, `sqlite` from
+     * `@easy-cms/db-sqlite`. SQLite databases back themselves up and don't need it.
+     */
+    readonly sqlite?: (options: {
+        url: string;
+        tablePrefix?: string;
+    }) => DatabaseAdapter;
+}
+interface Config {
+    /** Signs sessions. At least 32 characters; read it from `process.env.EASY_CMS_SECRET`. */
+    readonly secret: string;
+    readonly db: DatabaseAdapter;
+    /**
+     * Public origin of the app, e.g. `https://example.com`. When set, media URLs are absolute
+     * so frontends on other origins can use them. Default: relative URLs.
+     */
+    readonly serverURL?: string;
+    /**
+     * Origins whose browser code may call the REST API (CORS), e.g. a Vite or React app on
+     * another origin. `'*'` allows any origin for anonymous requests. Origins in
+     * `auth.trustedOrigins` are always allowed, with cookies. Default: none.
+     */
+    readonly cors?: readonly string[] | '*';
+    /**
+     * Lets a cron service run due scheduled jobs: `GET <api>/jobs/run` with
+     * `Authorization: Bearer <cronSecret>`. Default: the `CRON_SECRET` environment variable (the
+     * convention of Vercel Cron). Logged-in admins can always run jobs.
+     */
+    readonly cronSecret?: string;
+    /** Endpoints notified when content changes, e.g. to rebuild a static site. */
+    readonly webhooks?: readonly WebhookConfig[];
+    /**
+     * Events of the app or its plugins besides content changes, e.g. `order.paid`: sent with
+     * `cms.emit()` to the webhooks that list them in `events`. Named `<area>.<what>`.
+     */
+    readonly events?: readonly string[];
+    /** Work run with the scheduled jobs, e.g. a plugin's clean-up. */
+    readonly jobs?: readonly JobConfig[];
+    /** Content in several languages: fields with `localized: true` hold one value per locale. */
+    readonly localization?: LocalizationConfig | false;
+    readonly routes?: RoutesConfig;
+    readonly admin?: AdminConfig;
+    readonly upload?: UploadConfig;
+    readonly auth?: AuthConfig;
+    /**
+     * Collections. A collection with slug `users` adds fields, access or hooks
+     * to the built-in users collection.
+     */
+    readonly collections?: readonly CollectionConfig[];
+    readonly globals?: readonly GlobalConfig[];
+    /** Custom REST endpoints, e.g. from plugins. */
+    readonly endpoints?: readonly Endpoint[];
+    /** Extra `easy-cms <name>` CLI commands, e.g. from plugins. */
+    readonly cliCommands?: readonly CliCommand[];
+    /**
+     * The request's context and user, worked out on each API request (usually by a plugin). Several
+     * run in order: each gets the user the one before set, and their contexts are merged.
+     */
+    readonly onRequest?: OnRequest | readonly OnRequest[];
+    /**
+     * Field types from packages, e.g. `color` from `@easy-cms/fields`: fields then use
+     * `type: 'color'`. See `defineFieldType`.
+     */
+    readonly fieldTypes?: readonly FieldTypeDefinition[];
+    /**
+     * API keys for scripts and other apps (`Authorization: Bearer ecms_…`), managed in the admin
+     * under Settings. A key acts as its owner, limited to the collections and operations it lists.
+     */
+    readonly apiKeys?: boolean;
+    /**
+     * Sends email for plugins such as the form builder, e.g. `smtp()` from
+     * `@easy-cms/email-smtp`, or `consoleEmail()` in development. Emails are queued in the
+     * database and retried until sent.
+     */
+    readonly email?: EmailAdapter;
+    /**
+     * Database backups, made on a schedule and from the admin (Settings → Backups). Without
+     * `every`, admins can still back up by hand.
+     */
+    readonly backups?: BackupsConfig;
+    /**
+     * The audit log (Settings → Audit log): who changed what and when, sign-ins, and admin
+     * actions, kept for `keep` days. `true` for the defaults.
+     */
+    readonly audit?: boolean | AuditConfig;
+    readonly plugins?: readonly Plugin[];
+}
+/** The config after plugins ran, validation passed and defaults were applied. */
+interface ResolvedConfig extends Omit<Config, 'cors' | 'localization' | 'routes' | 'admin' | 'upload' | 'auth' | 'collections' | 'globals' | 'endpoints' | 'plugins' | 'audit'> {
+    readonly cors: readonly string[] | '*';
+    /** `null` without localization. */
+    readonly localization: Required<LocalizationConfig> | null;
+    readonly routes: Required<RoutesConfig>;
+    readonly admin: Required<AdminConfig>;
+    readonly upload: Required<Omit<UploadConfig, 'storage' | 'fromURL' | 'privateStorage'>> & Pick<UploadConfig, 'storage' | 'fromURL' | 'privateStorage'>;
+    readonly auth: Required<AuthConfig>;
+    /** `false` without an audit log. */
+    readonly audit: Required<AuditConfig> | false;
+    readonly collections: readonly CollectionConfig[];
+    readonly globals: readonly GlobalConfig[];
+    readonly endpoints: readonly Endpoint[];
+    readonly cliCommands: readonly CliCommand[];
+    readonly events: readonly string[];
+    readonly jobs: readonly JobConfig[];
+    readonly fieldTypes: readonly FieldTypeDefinition[];
+    /** The config's plugins in order, with their `info` where they give one. */
+    readonly installedPlugins: readonly Partial<PluginInfo>[];
+    /** What the config's checks warn about (e.g. options Easy CMS doesn't know); logged at start. */
+    readonly warnings: readonly ConfigIssue[];
+}
+/**
+ * Declares the Easy CMS config. Returns it unchanged, keeping literal types
+ * so document types can be inferred from it.
+ */
+declare function defineConfig<const TConfig extends Config>(config: TConfig): TConfig;
+
+export { type BuiltinMediaCollection as $, ADAPTER_API_VERSION as A, type ApiKeyOperation as B, type ApiKeyPermissions as C, type ArrayField as D, type EmailSetting as E, type AuditChange as F, type AuditConfig as G, type AuditEntry as H, type ID as I, AuditLog as J, type AuditPage as K, type AuditVerification as L, Auth as M, type AuthConfig as N, type AuthProvider as O, type PaginatedDocs as P, type AuthProviderProfile as Q, type AuthProviderRequest as R, type AuthUser as S, type BackupsConfig as T, type BeforeChangeHook as U, type BeforeDeleteHook as V, type BeforeValidateHook as W, type Block as X, type BlocksField as Y, type BooleanField as Z, type BuiltinApiKeysCollection as _, ADMIN_ICONS as a, type GlobalDocument as a$, type BuiltinMediaFoldersCollection as a0, type BuiltinUsersCollection as a1, type BundleHints as a2, type CliCommand as a3, type CollectionAccess as a4, type CollectionAdmin as a5, type CollectionConfig as a6, type CollectionDocument as a7, type CollectionHooks as a8, type CollectionListAdmin as a9, type EndpointRequest as aA, type ErrorCode as aB, FIELD_TYPES as aC, type Field as aD, type FieldAccess as aE, type FieldAccessFn as aF, type FieldAdmin as aG, type FieldError as aH, type FieldRule as aI, type FieldType as aJ, type FieldTypeBase as aK, type FieldTypeDefinition as aL, type FieldTypeValidateContext as aM, type FieldValidate as aN, type FieldValidateContext as aO, type FieldValue as aP, type FieldsInput as aQ, type FieldsValue as aR, type FilterOptions as aS, type FilterOptionsArgs as aT, type FindArgs as aU, type FindOptions as aV, type FolderLevel as aW, type FolderPermissions as aX, ForbiddenError as aY, type GlobalAccess as aZ, type GlobalConfig as a_, type CollectionSlug as aa, type Config as ab, ConfigError as ac, type ConfigIssue as ad, type ContainerAdmin as ae, type CreateEasyCMSOptions as af, type CreateInput as ag, type CreateMigrationResult as ah, type CustomField as ai, type CustomFieldTypes as aj, type DashboardWidget as ak, type Database as al, type DatabaseAdapter as am, type DatabaseInitArgs as an, type DatabaseTransfer as ao, type DateField as ap, type DepthOptions as aq, type DirectUpload as ar, type DiskStorageOptions as as, type DocumentOf as at, EasyCMS as au, EasyCMSError as av, type EmailAdapter as aw, type EmailField as ax, type EmailMessage as ay, type Endpoint as az, type Access as b, type SlugOf as b$, type GlobalHooks as b0, type GlobalInput as b1, type GlobalSlug as b2, type GroupField as b3, type ImageSize as b4, type IncrementOptions as b5, type InferCollection as b6, type InferGlobal as b7, type JobConfig as b8, type JsonField as b9, type PreviewTarget as bA, type PreviewURL as bB, QueryError as bC, ROLE_OPERATIONS as bD, type RawDocument as bE, type ReadOptions as bF, type RelationshipField as bG, type RequestContext as bH, type ResolvedConfig as bI, type RichTextDocument as bJ, type RichTextField as bK, type Role as bL, type RoleOperation as bM, type RolePermissions as bN, Roles as bO, type RoutesConfig as bP, type ScheduledPublish as bQ, SchemaError as bR, type SchemaMode as bS, type SelectField as bT, type SelectOption as bU, type Session as bV, type SidebarPanel as bW, type SignupArgs as bX, type SignupResult as bY, SingleSignOn as bZ, type SlugField as b_, type Label as ba, type LayoutNode as bb, type LivePreview as bc, type LocalizationConfig as bd, type Logger as be, type LoginArgs as bf, type MediaDocument as bg, type MediaSize as bh, type MembersConfig as bi, type MembersSignup as bj, type MigrationInfo as bk, type NavGroup as bl, NotFoundError as bm, type NumberField as bn, type OnRequest as bo, type OnRequestArgs as bp, type Operation as bq, PLUGIN_API_VERSION as br, type PasswordEmail as bs, type PasswordEmailArgs as bt, type PasswordEmailFn as bu, type PasswordLinkOptions as bv, PayloadTooLargeError as bw, type Plugin as bx, type PluginInfo as by, type PluginTypes as bz, type AccessArgs as c, type SsoOutcome as c0, type SsoProviderRef as c1, type StorageAdapter as c2, type StoredFile as c3, type TextField as c4, type TextareaField as c5, TooManyRequestsError as c6, type TypedPlugin as c7, UnauthorizedError as c8, type UpdateInput as c9, isSignedIn as cA, isStaff as cB, isSystemAdmin as cC, mimeAllowedBy as cD, rowFields as cE, silentLogger as cF, uniqueWithinOf as cG, API_KEYS as cH, API_KEY_GLOBAL_OPERATIONS as cI, API_KEY_OPERATIONS as cJ, DEFAULT_MAX_VERSIONS as cK, DEFAULT_PASSWORD_EMAILS as cL, FIELD_TYPE_BASES as cM, FOLDER_LEVELS as cN, MediaFolders as cO, SSO_COOKIE as cP, codeOfStatus as cQ, keyAllows as cR, type UpdateOptions as ca, type UploadConfig as cb, type UploadField as cc, type UploadFromURLConfig as cd, type UserIdentity as ce, ValidationError as cf, type Version as cg, type VersionSummary as ch, type VersionsConfig as ci, WEBHOOK_EVENTS as cj, type WebhookConfig as ck, type WebhookEvent as cl, type WebhookPayload as cm, type Where as cn, type WhereOperators as co, anyone as cp, consoleEmail as cq, consoleLogger as cr, createEasyCMS as cs, defineConfig as ct, defineFieldType as cu, definePlugin as cv, diskStorage as cw, hasRows as cx, isAdmin as cy, isHasMany as cz, type AccessOptions as d, type AdminBrand as e, type AdminCommand as f, type AdminComponent as g, type AdminConfig as h, type AdminFieldArgs as i, type AdminIcon as j, type AdminLocale as k, type AdminPage as l, type AdminRole as m, type AdminRoleChange as n, type AdminRoleField as o, type AdminRoleTarget as p, type AdminRoleView as q, type AdminRoles as r, type AdminSso as s, type AdminSwitcher as t, type AdminViewAccess as u, type AfterChangeHook as v, type AfterDeleteHook as w, type AfterReadHook as x, type ApiKeyContext as y, type ApiKeyGlobalOperation as z };