@easy-cms/core 0.5.0 → 0.6.0

package/dist/index.js

@@ -82,6 +82,31 @@ var PayloadTooLargeError = class extends EasyCMSError {
   }
 };
 
+// src/fields.ts
+var hasRows = (field) => field.type === "array" || field.type === "blocks";
+function rowFields(field, row) {
+  if (field.type === "array") return field.fields;
+  const type = row && typeof row === "object" ? row.blockType : void 0;
+  return field.blocks.find((block) => block.slug === type)?.fields;
+}
+var FIELD_TYPES = [
+  "text",
+  "textarea",
+  "number",
+  "boolean",
+  "date",
+  "email",
+  "json",
+  "select",
+  "slug",
+  "richText",
+  "upload",
+  "relationship",
+  "array",
+  "group",
+  "blocks"
+];
+
 // src/access-control.ts
 async function evaluateAccess(access, args) {
   const result = await (access ?? isLoggedIn)(args);
@@ -123,11 +148,12 @@ async function stripFields(fields, doc, read) {
     const value = result[field.name];
     if (field.type === "group" && value && typeof value === "object") {
       result[field.name] = await stripFields(field.fields, value, read);
-    } else if (field.type === "array" && Array.isArray(value)) {
+    } else if (hasRows(field) && Array.isArray(value)) {
       result[field.name] = await Promise.all(
-        value.map(
-          (row) => row && typeof row === "object" ? stripFields(field.fields, row, read) : row
-        )
+        value.map((row) => {
+          const fields2 = rowFields(field, row);
+          return fields2 && row && typeof row === "object" ? stripFields(fields2, row, read) : row;
+        })
       );
     }
   }
@@ -144,11 +170,12 @@ async function filterInput(fields, data, update) {
     const value = result[field.name];
     if (field.type === "group" && value && typeof value === "object" && !Array.isArray(value)) {
       result[field.name] = await filterInput(field.fields, value, update);
-    } else if (field.type === "array" && Array.isArray(value)) {
+    } else if (hasRows(field) && Array.isArray(value)) {
       result[field.name] = await Promise.all(
-        value.map(
-          (row) => row && typeof row === "object" ? filterInput(field.fields, row, update) : row
-        )
+        value.map((row) => {
+          const fields2 = rowFields(field, row);
+          return fields2 && row && typeof row === "object" ? filterInput(fields2, row, update) : row;
+        })
       );
     }
   }
@@ -161,10 +188,12 @@ var MEDIA = "media";
 var SESSIONS = "sessions";
 var LOGIN_ATTEMPTS = "login-attempts";
 var VERSIONS = "document-versions";
+var SCHEDULED_JOBS = "scheduled-jobs";
 var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SESSIONS,
   LOGIN_ATTEMPTS,
-  VERSIONS
+  VERSIONS,
+  SCHEDULED_JOBS
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
 var adminOrSelf = ({ user }) => {
@@ -345,6 +374,22 @@ var versionsCollection = {
     { name: "snapshot", type: "json", required: true }
   ]
 };
+var scheduledJobsCollection = {
+  slug: SCHEDULED_JOBS,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    // Collection slug, or `global:<slug>`.
+    { name: "parent", type: "text", required: true, index: true },
+    // Document id; 0 for globals.
+    { name: "doc", type: "number", required: true, index: true },
+    { name: "action", type: "text", required: true },
+    { name: "runAt", type: "text", required: true, index: true },
+    // pending | done | failed
+    { name: "state", type: "text", required: true, index: true },
+    { name: "error", type: "text" },
+    { name: "author", type: "number" }
+  ]
+};
 
 // src/auth/password.ts
 import { randomBytes, scrypt, timingSafeEqual } from "crypto";
@@ -654,11 +699,12 @@ function applyDefaults(fields, data, localization = null) {
         isPlainObject(value) ? value : {},
         localization
       );
-    } else if (field.type === "array") {
+    } else if (hasRows(field) && !field.localized) {
       if (Array.isArray(value)) {
-        result[field.name] = value.map(
-          (row) => isPlainObject(row) ? applyDefaults(field.fields, row, localization) : row
-        );
+        result[field.name] = value.map((row) => {
+          const fields2 = rowFields(field, row);
+          return fields2 && isPlainObject(row) ? applyDefaults(fields2, row, localization) : row;
+        });
       }
     } else if (field.localized && localization && field.defaultValue !== void 0) {
       const map = isPlainObject(value) ? value : {};
@@ -681,7 +727,7 @@ function fillMissing(fields, data) {
     if (field.type === "group") {
       result[field.name] = fillMissing(field.fields, isPlainObject(value) ? value : {});
     } else if (value === void 0) {
-      result[field.name] = field.type === "array" || isHasMany(field) ? [] : null;
+      result[field.name] = hasRows(field) || isHasMany(field) ? [] : null;
     }
   }
   return result;
@@ -711,10 +757,11 @@ function generateSlugs(fields, data, localization = null) {
       }
     } else if (field.type === "group" && isPlainObject(result[field.name])) {
       result[field.name] = generateSlugs(field.fields, result[field.name], localization);
-    } else if (field.type === "array" && Array.isArray(result[field.name])) {
-      result[field.name] = result[field.name].map(
-        (row) => isPlainObject(row) ? generateSlugs(field.fields, row, localization) : row
-      );
+    } else if (hasRows(field) && Array.isArray(result[field.name])) {
+      result[field.name] = result[field.name].map((row) => {
+        const fields2 = rowFields(field, row);
+        return fields2 && isPlainObject(row) ? generateSlugs(fields2, row, localization) : row;
+      });
     }
   }
   return result;
@@ -779,9 +826,9 @@ async function validateFields(fields, input, options, prefix = "") {
         const localePath = own ? path : `${path}.${locale}`;
         const failLocale = (message) => errors.push({ field: localePath, message });
         const value2 = map[locale];
-        if (isEmpty(value2)) {
+        if (isEmpty(value2) || Array.isArray(value2) && value2.length === 0) {
           if (own && field.required && !options.skipRequired) failLocale("is required");
-          out[locale] = null;
+          out[locale] = hasRows(field) || isHasMany(field) ? [] : null;
           if (own && !field.required) await runCustom(field, null, options, failLocale);
           continue;
         }
@@ -803,7 +850,7 @@ async function validateFields(fields, input, options, prefix = "") {
     }
     if (isEmpty(raw) || Array.isArray(raw) && raw.length === 0) {
       if (field.required && !options.skipRequired) fail("is required");
-      data[field.name] = field.type === "array" || isHasMany(field) ? [] : null;
+      data[field.name] = hasRows(field) || isHasMany(field) ? [] : null;
       if (!field.required) await runCustom(field, null, options, fail);
       continue;
     }
@@ -905,10 +952,36 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
       }
       return rows;
     }
+    case "blocks":
+      return normalizeBlocks(field, raw, path, options, fail, errors, references);
     case "group":
       return raw;
   }
 }
+async function normalizeBlocks(field, raw, path, options, fail, errors, references) {
+  if (!Array.isArray(raw)) return fail("must be an array of blocks");
+  if (field.minRows !== void 0 && raw.length < field.minRows)
+    return fail(`must have at least ${field.minRows} blocks`);
+  if (field.maxRows !== void 0 && raw.length > field.maxRows)
+    return fail(`must have at most ${field.maxRows} blocks`);
+  const rows = [];
+  for (const [i, row] of raw.entries()) {
+    const fields = rowFields(field, row);
+    if (!isPlainObject(row) || !fields) {
+      errors.push({
+        field: `${path}.${i}.blockType`,
+        message: `must be one of: ${field.blocks.map((b) => b.slug).join(", ")}`
+      });
+      continue;
+    }
+    const sub = await validateFields(fields, row, options, `${path}.${i}.`);
+    errors.push(...sub.errors);
+    references.push(...sub.references);
+    const id = typeof row.id === "string" && row.id !== "" ? row.id : randomUUID();
+    rows.push({ id, blockType: row.blockType, ...sub.data });
+  }
+  return rows;
+}
 function normalizeSelect(field, raw, fail) {
   const allowed2 = field.options.map((o) => typeof o === "string" ? o : o.value);
   const values = field.hasMany ? raw : [raw];
@@ -920,29 +993,94 @@ function normalizeSelect(field, raw, fail) {
   return field.hasMany ? [...new Set(values)] : values[0];
 }
 
-// src/fields.ts
-var FIELD_TYPES = [
-  "text",
-  "textarea",
-  "number",
-  "boolean",
-  "date",
-  "email",
-  "json",
-  "select",
-  "slug",
-  "richText",
-  "upload",
-  "relationship",
-  "array",
-  "group"
-];
-
 // src/load-config.ts
 import { existsSync } from "fs";
 import { resolve } from "path";
 import { createJiti } from "jiti";
 
+// src/webhooks.ts
+import { createHmac as createHmac2, randomUUID as randomUUID2 } from "crypto";
+var WEBHOOK_EVENTS = [
+  "create",
+  "update",
+  "delete",
+  "publish",
+  "unpublish",
+  "draft"
+];
+var RETRY_DELAYS = [1e3, 5e3];
+var TIMEOUT = 1e4;
+var Webhooks = class {
+  constructor(hooks, logger, fetcher = (...args) => fetch(...args), retryDelays = RETRY_DELAYS) {
+    this.hooks = hooks;
+    this.logger = logger;
+    this.fetcher = fetcher;
+    this.retryDelays = retryDelays;
+  }
+  hooks;
+  logger;
+  fetcher;
+  retryDelays;
+  pending = /* @__PURE__ */ new Set();
+  emit(event, target, doc) {
+    if (this.hooks.length === 0) return;
+    const payload = { event, ...target, doc, timestamp: (/* @__PURE__ */ new Date()).toISOString() };
+    for (const hook of this.hooks) {
+      if (!matches(hook, payload)) continue;
+      const delivery = this.deliver(hook, payload).finally(() => this.pending.delete(delivery));
+      this.pending.add(delivery);
+    }
+  }
+  /** Waits for deliveries in progress, e.g. before a serverless function returns. */
+  async flush() {
+    while (this.pending.size > 0) await Promise.allSettled([...this.pending]);
+  }
+  async deliver(hook, payload) {
+    const body = JSON.stringify(payload);
+    const headers = {
+      "content-type": "application/json",
+      "user-agent": "easy-cms-webhooks",
+      "x-easy-cms-event": payload.event,
+      "x-easy-cms-delivery": randomUUID2(),
+      ...hook.headers
+    };
+    if (hook.secret) {
+      headers["x-easy-cms-signature"] = `sha256=${createHmac2("sha256", hook.secret).update(body).digest("hex")}`;
+    }
+    for (let attempt = 0; ; attempt++) {
+      try {
+        const response = await this.fetcher(hook.url, {
+          method: "POST",
+          headers,
+          body,
+          signal: AbortSignal.timeout(TIMEOUT)
+        });
+        if (response.ok || response.status < 500 && response.status !== 429) {
+          if (!response.ok)
+            this.logger.warn(`Webhook ${hook.url} answered ${response.status} to ${payload.event}`);
+          return;
+        }
+        throw new Error(`status ${response.status}`);
+      } catch (error) {
+        const delay = this.retryDelays[attempt];
+        if (delay === void 0) {
+          this.logger.error(
+            `Webhook ${hook.url} failed for ${payload.event}: ${error.message}`
+          );
+          return;
+        }
+        await new Promise((resolve3) => setTimeout(resolve3, delay));
+      }
+    }
+  }
+};
+function matches(hook, payload) {
+  if (hook.events && !hook.events.includes(payload.event)) return false;
+  if (payload.collection !== void 0)
+    return !hook.collections || hook.collections.includes(payload.collection);
+  return !hook.globals || hook.globals.includes(payload.global);
+}
+
 // src/validate-config.ts
 var MIN_SECRET_LENGTH = 32;
 var BUILTIN_COLLECTIONS = ["users", "media"];
@@ -952,6 +1090,8 @@ var RESERVED_SLUGS = /* @__PURE__ */ new Set([
   "sessions",
   "login-attempts",
   "document-versions",
+  "scheduled-jobs",
+  "jobs",
   "migrations",
   "access"
 ]);
@@ -974,6 +1114,7 @@ function validateConfig(config) {
   validateAuth(config, add);
   validateCors(config.cors, add);
   validateLocalization(config, add);
+  validateWebhooks(config, add);
   const collections = asArray(config.collections, "collections", add);
   const globals = asArray(config.globals, "globals", add);
   const collectionSlugs = /* @__PURE__ */ new Set([...BUILTIN_COLLECTIONS]);
@@ -1063,7 +1204,9 @@ var LOCALIZABLE = /* @__PURE__ */ new Set([
   "json",
   "select",
   "upload",
-  "relationship"
+  "relationship",
+  "blocks",
+  "array"
 ]);
 function validateLocalization(config, add) {
   const localization = config.localization;
@@ -1090,7 +1233,7 @@ function validateLocalization(config, add) {
       }
     }
   }
-  const walk = (fields, path) => {
+  const walk = (fields, path, insideLocalized = false) => {
     if (!Array.isArray(fields)) return;
     for (const field of fields) {
       if (typeof field?.name !== "string") continue;
@@ -1108,18 +1251,52 @@ function validateLocalization(config, add) {
             `${field.type} fields cannot be localized`,
             "localize the fields inside it instead"
           );
-        } else if ("hasMany" in field && field.hasMany) {
-          add(`${fieldPath}.localized`, "hasMany fields cannot be localized yet");
+        } else if (insideLocalized) {
+          add(
+            `${fieldPath}.localized`,
+            "is inside a localized field, which already holds one value per locale"
+          );
         }
       }
+      const inside = insideLocalized || field.localized === true;
       if (field.type === "group" || field.type === "array")
-        walk(field.fields, `${fieldPath}.fields`);
+        walk(field.fields, `${fieldPath}.fields`, inside);
+      if (field.type === "blocks")
+        for (const block of field.blocks ?? [])
+          walk(block?.fields, `${fieldPath}.blocks.${block?.slug}`, inside);
     }
   };
   for (const [i, c] of (config.collections ?? []).entries())
     walk(c?.fields, `collections[${i}].fields`);
   for (const [i, g] of (config.globals ?? []).entries()) walk(g?.fields, `globals[${i}].fields`);
 }
+function validateWebhooks(config, add) {
+  const hooks = config.webhooks;
+  if (hooks === void 0) return;
+  if (!Array.isArray(hooks)) {
+    add("webhooks", "must be a list", "webhooks: [{ url: 'https://example.com/hook' }]");
+    return;
+  }
+  const collections = /* @__PURE__ */ new Set([
+    ...BUILTIN_COLLECTIONS,
+    ...(config.collections ?? []).map((c) => c?.slug)
+  ]);
+  const globals = new Set((config.globals ?? []).map((g) => g?.slug));
+  for (const [i, hook] of hooks.entries()) {
+    const path = `webhooks[${i}]`;
+    if (typeof hook?.url !== "string" || !/^https?:\/\/\S+$/.test(hook.url)) {
+      add(`${path}.url`, "must be an http(s) URL");
+    }
+    for (const event of hook?.events ?? []) {
+      if (!WEBHOOK_EVENTS.includes(event))
+        add(`${path}.events`, `unknown event "${event}"`, `use: ${WEBHOOK_EVENTS.join(", ")}`);
+    }
+    for (const slug of hook?.collections ?? [])
+      if (!collections.has(slug)) add(`${path}.collections`, `unknown collection "${slug}"`);
+    for (const slug of hook?.globals ?? [])
+      if (!globals.has(slug)) add(`${path}.globals`, `unknown global "${slug}"`);
+  }
+}
 function validateCors(cors, add) {
   if (cors === void 0 || cors === "*") return;
   if (!Array.isArray(cors)) {
@@ -1187,6 +1364,9 @@ function validateContainer(container, path, collectionSlugs, add) {
       add(`${path}.versions.max`, "must be a positive integer");
     }
   }
+  if (container.schedule && !container.drafts) {
+    add(`${path}.schedule`, "needs `drafts: true`", "scheduling publishes and unpublishes drafts");
+  }
   if (container.preview !== void 0 && typeof container.preview !== "function") {
     add(
       `${path}.preview`,
@@ -1271,6 +1451,43 @@ function validateField(field, path, siblings, collectionSlugs, add) {
         checkRange(field.minRows, field.maxRows, "minRows", "maxRows", path, add);
       validateFields2(field.fields, `${path}.fields`, /* @__PURE__ */ new Set(["id"]), collectionSlugs, add);
       break;
+    case "blocks": {
+      if (!Array.isArray(field.blocks) || field.blocks.length === 0) {
+        add(
+          `${path}.blocks`,
+          "must contain at least one block",
+          "blocks: [{ slug: 'hero', fields: [...] }]"
+        );
+        break;
+      }
+      checkRange(field.minRows, field.maxRows, "minRows", "maxRows", path, add);
+      const seen = /* @__PURE__ */ new Set();
+      for (const [i, block] of field.blocks.entries()) {
+        const blockPath = `${path}.blocks[${i}]`;
+        if (typeof block?.slug !== "string" || !SLUG_PATTERN.test(block.slug)) {
+          add(
+            `${blockPath}.slug`,
+            'must be lowercase letters, digits, "-" or "_", starting with a letter'
+          );
+        } else if (seen.has(block.slug)) {
+          add(`${blockPath}.slug`, `duplicate block "${block.slug}"`);
+        } else {
+          seen.add(block.slug);
+        }
+        if (!Array.isArray(block?.fields)) {
+          add(`${blockPath}.fields`, "must be an array");
+          continue;
+        }
+        validateFields2(
+          block.fields,
+          `${blockPath}.fields`,
+          /* @__PURE__ */ new Set(["id", "blockType"]),
+          collectionSlugs,
+          add
+        );
+      }
+      break;
+    }
   }
 }
 function checkRange(min, max, minName, maxName, path, add) {
@@ -1362,7 +1579,8 @@ async function resolveConfig(input) {
     collections: [
       ...config.collections ?? [],
       ...internalCollections,
-      ...usesVersions(config) ? [versionsCollection] : []
+      ...usesVersions(config) ? [versionsCollection] : [],
+      ...usesSchedule(config) ? [scheduledJobsCollection] : []
     ],
     globals: config.globals ?? []
   };
@@ -1372,6 +1590,9 @@ async function resolveConfig(input) {
 function usesVersions(config) {
   return [...config.collections ?? [], ...config.globals ?? []].some((c) => c.versions);
 }
+function usesSchedule(config) {
+  return [...config.collections ?? [], ...config.globals ?? []].some((c) => c.schedule);
+}
 
 // src/load-config.ts
 var CONFIG_FILE_NAMES = [
@@ -1430,16 +1651,20 @@ function pickLocale(fields, data, locale, localization, fallback) {
   const result = { ...data };
   for (const field of fields) {
     const value = result[field.name];
-    if (field.type === "group" && isPlainObject2(value)) {
-      result[field.name] = pickLocale(field.fields, value, locale, localization, fallback);
-    } else if (field.type === "array" && Array.isArray(value)) {
-      result[field.name] = value.map(
-        (row) => isPlainObject2(row) ? pickLocale(field.fields, row, locale, localization, fallback) : row
-      );
-    } else if (field.localized) {
+    if (field.localized) {
       const map = isPlainObject2(value) ? value : {};
       const own = map[locale];
-      result[field.name] = isEmpty2(own) && fallback ? map[localization.defaultLocale] ?? null : own ?? null;
+      const blank = isEmpty2(own) || Array.isArray(own) && own.length === 0;
+      const picked = blank && fallback ? map[localization.defaultLocale] ?? null : own ?? null;
+      const list = hasRows(field) || "hasMany" in field && field.hasMany === true;
+      result[field.name] = picked === null && list ? [] : picked;
+    } else if (field.type === "group" && isPlainObject2(value)) {
+      result[field.name] = pickLocale(field.fields, value, locale, localization, fallback);
+    } else if (hasRows(field) && Array.isArray(value)) {
+      result[field.name] = value.map((row) => {
+        const fields2 = rowFields(field, row);
+        return fields2 && isPlainObject2(row) ? pickLocale(fields2, row, locale, localization, fallback) : row;
+      });
     }
   }
   return result;
@@ -1450,57 +1675,62 @@ function toLocaleMaps(fields, input, current, locale) {
     if (!Object.hasOwn(input, field.name)) continue;
     const value = input[field.name];
     const previous = current[field.name];
-    if (field.type === "group" && isPlainObject2(value)) {
+    if (field.localized) {
+      const map = isPlainObject2(previous) ? previous : {};
+      result[field.name] = { ...map, [locale]: value };
+    } else if (field.type === "group" && isPlainObject2(value)) {
       result[field.name] = toLocaleMaps(
         field.fields,
         value,
         isPlainObject2(previous) ? previous : {},
         locale
       );
-    } else if (field.type === "array" && Array.isArray(value)) {
+    } else if (hasRows(field) && Array.isArray(value)) {
       const rows = new Map(
         (Array.isArray(previous) ? previous : []).filter(isPlainObject2).map((row) => [String(row.id), row])
       );
-      result[field.name] = value.map(
-        (row) => isPlainObject2(row) ? toLocaleMaps(field.fields, row, rows.get(String(row.id)) ?? {}, locale) : row
-      );
-    } else if (field.localized) {
-      const map = isPlainObject2(previous) ? previous : {};
-      result[field.name] = { ...map, [locale]: value };
+      result[field.name] = value.map((row) => {
+        const fields2 = rowFields(field, row);
+        return fields2 && isPlainObject2(row) ? toLocaleMaps(fields2, row, rows.get(String(row.id)) ?? {}, locale) : row;
+      });
     }
   }
   return result;
 }
-function localizePath(fields, path, locale) {
+function localizePath(fields, path, locale, locales = []) {
   const segments = path.split(".");
   let list = fields;
   for (let i = 0; i < segments.length; i++) {
     const field = list.find((f) => f.name === segments[i]);
     if (!field) return path;
+    if (field.localized) {
+      const next = segments[i + 1];
+      if (next !== void 0 && locales.includes(next)) return path;
+      return [...segments.slice(0, i + 1), locale, ...segments.slice(i + 1)].join(".");
+    }
     if (field.type === "group" || field.type === "array") {
       list = field.fields;
       continue;
     }
-    if (field.localized && i === segments.length - 1) return `${path}.${locale}`;
     return path;
   }
   return path;
 }
-function localizeWhere(fields, where, locale) {
+function localizeWhere(fields, where, locale, locales = []) {
   if (!where) return where;
   const out = {};
   for (const [key2, value] of Object.entries(where)) {
     if ((key2 === "and" || key2 === "or") && Array.isArray(value)) {
-      out[key2] = value.map((w) => localizeWhere(fields, w, locale));
+      out[key2] = value.map((w) => localizeWhere(fields, w, locale, locales));
     } else {
-      out[localizePath(fields, key2, locale)] = value;
+      out[localizePath(fields, key2, locale, locales)] = value;
     }
   }
   return out;
 }
-function localizeSort(fields, sort, locale) {
+function localizeSort(fields, sort, locale, locales = []) {
   return sort.map(
-    (entry) => entry.startsWith("-") ? `-${localizePath(fields, entry.slice(1), locale)}` : localizePath(fields, entry, locale)
+    (entry) => entry.startsWith("-") ? `-${localizePath(fields, entry.slice(1), locale, locales)}` : localizePath(fields, entry, locale, locales)
   );
 }
 
@@ -1644,10 +1874,16 @@ function collectSlots(fields, data, bySlug, slots) {
     if (value === null || value === void 0) continue;
     if (field.type === "group") {
       if (typeof value === "object") collectSlots(field.fields, value, bySlug, slots);
-    } else if (field.type === "array") {
-      if (Array.isArray(value))
-        for (const row of value) collectSlots(field.fields, row, bySlug, slots);
+    } else if (hasRows(field)) {
+      if (Array.isArray(value)) {
+        for (const row of value) {
+          const fields2 = rowFields(field, row);
+          if (fields2 && row && typeof row === "object")
+            collectSlots(fields2, row, bySlug, slots);
+        }
+      }
     } else if (field.type === "relationship" || field.type === "upload") {
+      if (typeof value === "object" && !Array.isArray(value)) continue;
       const collection2 = field.type === "upload" ? "media" : field.to;
       if (!bySlug.has(collection2)) continue;
       if (Array.isArray(value)) {
@@ -1862,8 +2098,19 @@ async function createEasyCMS(config, options = {}) {
     logger,
     interactive: options.interactive ?? false
   });
-  return new EasyCMS(resolved2, db, logger, storage);
+  const cms = new EasyCMS(resolved2, db, logger, storage);
+  const scheduling = [...resolved2.collections, ...resolved2.globals].some((c) => c.schedule);
+  if (scheduling && options.scheduler !== false) cms.startScheduler();
+  return cms;
 }
+var toJob = (row) => ({
+  id: row.id,
+  action: row.action,
+  runAt: String(row.runAt),
+  state: row.state,
+  error: row.error ?? null,
+  author: row.author ?? null
+});
 var EasyCMS = class {
   config;
   db;
@@ -1873,12 +2120,14 @@ var EasyCMS = class {
   /** Where uploaded files are stored. */
   storage;
   versions;
+  webhooks;
   constructor(config, db, logger = consoleLogger, storage = localStorage({ dir: config.upload.dir })) {
     this.config = config;
     this.db = db;
     this.logger = logger;
     this.storage = storage;
     this.versions = new VersionStore(db);
+    this.webhooks = new Webhooks(config.webhooks ?? [], logger);
     this.auth = new Auth(this);
   }
   async find(collection2, options = {}) {
@@ -1899,7 +2148,8 @@ var EasyCMS = class {
     const sort = locale === void 0 ? requested : localizeSort(
       config.fields,
       requested,
-      locale === ALL_LOCALES ? this.config.localization?.defaultLocale ?? locale : locale
+      locale === ALL_LOCALES ? this.config.localization?.defaultLocale ?? locale : locale,
+      this.config.localization?.locales ?? []
     );
     const result = await this.db.find({ collection: collection2, where, sort, limit, page });
     const found = options.draft ? await this.withDrafts(config, result.docs) : result.docs;
@@ -2268,6 +2518,7 @@ var EasyCMS = class {
         previousDoc: current,
         operation: "update"
       });
+      this.emit(config, "draft", draft);
       const [out2] = await this.output(config, [draft], guard, {
         ...options,
         draft: true
@@ -2289,6 +2540,7 @@ var EasyCMS = class {
       previousDoc: current,
       operation: "update"
     });
+    this.emit(config, "update", doc, existing.status);
     const [out] = await this.output(config, [doc], guard, { ...options, draft: true });
     return out;
   }
@@ -2306,11 +2558,16 @@ var EasyCMS = class {
     if (config.slug === USERS) await this.auth.revokeSessions(parsed);
     await this.db.delete({ collection: collection2, id: parsed });
     if (versionLimit(config)) await this.versions.deleteAll(collectionParent(collection2), parsed);
+    if (config.schedule) {
+      for (const job of await this.pendingJobs(collection2, parsed))
+        await this.db.delete({ collection: SCHEDULED_JOBS, id: job.id });
+    }
     await this.notify(config.hooks?.afterDelete, "afterDelete", config.slug, {
       ...base,
       id: parsed,
       doc: existing
     });
+    this.emit(config, "delete", existing);
     const [out] = await this.output(config, [existing], guard, { depth: 0, draft: true });
     return out;
   }
@@ -2437,6 +2694,7 @@ var EasyCMS = class {
         previousDoc: current,
         operation: "update"
       });
+      this.emit(config, "draft", draft);
       return this.findGlobal(slug, { ...options, draft: true });
     }
     const doc = await this.db.updateGlobal({ slug, data: { ...prepared, updatedAt: now } });
@@ -2447,6 +2705,7 @@ var EasyCMS = class {
       previousDoc: current,
       operation: "update"
     });
+    this.emit(config, "update", doc, existing.status);
     return this.findGlobal(slug, { ...options, draft: true });
   }
   /**
@@ -2468,9 +2727,177 @@ var EasyCMS = class {
     return { update: await check("update"), delete: await check("delete") };
   }
   /** Closes the database connection. */
+  /**
+   * Waits until webhook deliveries in progress are done. Call it before a serverless function
+   * returns, which may otherwise stop them.
+   */
+  flushWebhooks() {
+    return this.webhooks.flush();
+  }
   async destroy() {
+    if (this.schedulerTimer) clearInterval(this.schedulerTimer);
+    await this.running;
+    await this.webhooks.flush();
     await this.db.destroy();
   }
+  // --- Scheduled publishing --------------------------------------------------
+  schedulerTimer;
+  running = Promise.resolve();
+  /** Runs due jobs every `interval` ms in this process (`createEasyCMS` does this by default). */
+  startScheduler(interval = 6e4) {
+    if (this.schedulerTimer) return;
+    this.schedulerTimer = setInterval(() => {
+      this.running = this.running.then(
+        () => this.runScheduled().catch(
+          (error) => this.logger.error(`Scheduled jobs failed: ${error.message}`)
+        )
+      );
+    }, interval);
+    this.schedulerTimer.unref?.();
+  }
+  /**
+   * Publishes or unpublishes documents whose scheduled time has come. Safe to call often, e.g.
+   * from a cron job (`GET <api>/jobs/run`) where no process keeps running.
+   */
+  async runScheduled(now = /* @__PURE__ */ new Date()) {
+    if (!this.config.collections.some((c) => c.slug === SCHEDULED_JOBS))
+      return { ran: 0, failed: 0 };
+    const due = await this.db.find({
+      collection: SCHEDULED_JOBS,
+      where: {
+        and: [{ state: { equals: "pending" } }, { runAt: { lte: now.toISOString() } }]
+      },
+      sort: ["runAt"],
+      limit: 100,
+      page: 1
+    });
+    let failed = 0;
+    for (const row of due.docs) {
+      const parent = String(row.parent);
+      const action = row.action;
+      try {
+        if (parent.startsWith("global:")) {
+          const slug = parent.slice("global:".length);
+          if (action === "publish") await this.saveGlobal(slug, { status: "published" }, {});
+          else await this.saveGlobal(slug, { status: "draft" }, {}, "unpublish");
+        } else if (action === "publish") {
+          await this.updateDocument(parent, row.doc, { status: "published" }, { depth: 0 });
+        } else {
+          await this.updateDocument(
+            parent,
+            row.doc,
+            { status: "draft" },
+            { depth: 0 },
+            "unpublish"
+          );
+        }
+        await this.db.update({
+          collection: SCHEDULED_JOBS,
+          id: row.id,
+          data: { ...row, state: "done" }
+        });
+      } catch (error) {
+        failed++;
+        const message = error.message;
+        this.logger.error(`Scheduled ${action} of ${parent} ${row.doc} failed: ${message}`);
+        await this.db.update({
+          collection: SCHEDULED_JOBS,
+          id: row.id,
+          data: { ...row, state: "failed", error: message.slice(0, 500) }
+        });
+      }
+    }
+    return { ran: due.docs.length - failed, failed };
+  }
+  /** Schedules a publish or unpublish, replacing a pending job with the same action. */
+  async schedule(collection2, id, job, options = {}) {
+    const { parsed } = await this.scheduleTarget(collection2, id, options);
+    return this.addJob(collection2, parsed, job, options);
+  }
+  /** Pending jobs of a document, soonest first. */
+  async scheduled(collection2, id, options = {}) {
+    const { parsed } = await this.scheduleTarget(collection2, id, options);
+    return this.pendingJobs(collection2, parsed);
+  }
+  async cancelSchedule(collection2, id, jobId, options = {}) {
+    const { parsed } = await this.scheduleTarget(collection2, id, options);
+    await this.removeJob(collection2, parsed, jobId);
+  }
+  async scheduleGlobal(slug, job, options = {}) {
+    await this.globalScheduleTarget(slug, options);
+    return this.addJob(`global:${slug}`, 0, job, options);
+  }
+  async scheduledGlobal(slug, options = {}) {
+    await this.globalScheduleTarget(slug, options);
+    return this.pendingJobs(`global:${slug}`, 0);
+  }
+  async cancelGlobalSchedule(slug, jobId, options = {}) {
+    await this.globalScheduleTarget(slug, options);
+    await this.removeJob(`global:${slug}`, 0, jobId);
+  }
+  async scheduleTarget(collection2, id, options) {
+    const config = this.collection(collection2);
+    if (!config.schedule) throw new QueryError(`"${collection2}" has no schedule`);
+    const parsed = parseId(id);
+    const existing = parsed === void 0 ? null : await this.db.findById({ collection: collection2, id: parsed });
+    if (!existing || parsed === void 0) throw new NotFoundError(collection2, id);
+    await this.checkDocumentAccess(config, "update", guardOf(options), parsed, void 0);
+    return { config, parsed };
+  }
+  async globalScheduleTarget(slug, options) {
+    const config = this.global(slug);
+    if (!config.schedule) throw new QueryError(`"${slug}" has no schedule`);
+    await this.checkGlobalAccess(config, "update", guardOf(options));
+  }
+  async addJob(parent, doc, job, options) {
+    const runAt = new Date(job.at);
+    const errors = [];
+    if (job.action !== "publish" && job.action !== "unpublish")
+      errors.push({ field: "action", message: 'must be "publish" or "unpublish"' });
+    if (Number.isNaN(runAt.getTime())) errors.push({ field: "at", message: "must be a valid date" });
+    if (errors.length > 0) throw new ValidationError(SCHEDULED_JOBS, errors);
+    for (const pending of await this.pendingJobs(parent, doc)) {
+      if (pending.action === job.action)
+        await this.db.delete({ collection: SCHEDULED_JOBS, id: pending.id });
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const row = await this.db.create({
+      collection: SCHEDULED_JOBS,
+      data: {
+        parent,
+        doc,
+        action: job.action,
+        runAt: runAt.toISOString(),
+        state: "pending",
+        error: null,
+        author: guardOf(options).user?.id ?? null,
+        createdAt: now,
+        updatedAt: now
+      }
+    });
+    return toJob(row);
+  }
+  async pendingJobs(parent, doc) {
+    const rows = await this.db.find({
+      collection: SCHEDULED_JOBS,
+      where: {
+        and: [
+          { parent: { equals: parent } },
+          { doc: { equals: doc } },
+          { state: { equals: "pending" } }
+        ]
+      },
+      sort: ["runAt"],
+      limit: 0,
+      page: 1
+    });
+    return rows.docs.map(toJob);
+  }
+  async removeJob(parent, doc, jobId) {
+    const job = (await this.pendingJobs(parent, doc)).find((j) => String(j.id) === String(jobId));
+    if (!job) throw new NotFoundError("scheduled job", jobId);
+    await this.db.delete({ collection: SCHEDULED_JOBS, id: job.id });
+  }
   // -------------------------------------------------------------------------
   /** @internal */
   collection(slug) {
@@ -2499,11 +2926,11 @@ var EasyCMS = class {
     });
     if (access === true) return;
     if (access !== false) {
-      const matches = await this.db.count({
+      const matches2 = await this.db.count({
         collection: config.slug,
         where: andWhere(access, { id: { equals: id } })
       });
-      if (matches > 0) return;
+      if (matches2 > 0) return;
     }
     throw deny(guard.user);
   }
@@ -2613,6 +3040,7 @@ var EasyCMS = class {
       doc,
       operation: "create"
     });
+    this.emit(config, "create", doc);
     const [out] = await this.output(config, [doc], hookGuard ?? guard, { ...options, draft: true });
     return out;
   }
@@ -2650,7 +3078,8 @@ var EasyCMS = class {
     return localizeWhere(
       config.fields,
       where,
-      locale === ALL_LOCALES ? localization.defaultLocale : locale
+      locale === ALL_LOCALES ? localization.defaultLocale : locale,
+      localization.locales
     );
   }
   /** Drafts are kept as versions (instead of unpublishing) when both are enabled. */
@@ -2667,6 +3096,24 @@ var EasyCMS = class {
       return version && doc.status === "published" && version.status === "draft" ? draftOf(doc, version) : doc;
     });
   }
+  /** Sends webhook events for a change; `before` is the stored status before it, if any. */
+  emit(config, event, doc, before) {
+    const isGlobal = !this.config.collections.includes(config);
+    if (!isGlobal && INTERNAL_COLLECTIONS.has(config.slug)) return;
+    const body = isGlobal ? { ...snapshotOf(config.fields, doc), updatedAt: doc.updatedAt } : {
+      id: doc.id,
+      ...snapshotOf(config.fields, doc),
+      createdAt: doc.createdAt,
+      updatedAt: doc.updatedAt
+    };
+    const target = isGlobal ? { global: config.slug } : { collection: config.slug, id: doc.id };
+    this.webhooks.emit(event, target, body);
+    if (event === "draft" || event === "delete" || !config.drafts) return;
+    const after = doc.status;
+    if (after === "published" && before !== "published") this.webhooks.emit("publish", target, body);
+    if (after !== "published" && before === "published")
+      this.webhooks.emit("unpublish", target, body);
+  }
   /** Records a version after a save, when the collection or global keeps versions. */
   async saveVersion(config, parent, id, doc, guard) {
     const max = versionLimit(config);
@@ -2951,6 +3398,17 @@ async function serializeFields(fields, update, localized) {
         if (field.maxRows !== void 0) f.maxRows = field.maxRows;
         f.fields = await serializeFields(field.fields, update, localized);
         break;
+      case "blocks":
+        if (field.minRows !== void 0) f.minRows = field.minRows;
+        if (field.maxRows !== void 0) f.maxRows = field.maxRows;
+        f.blocks = await Promise.all(
+          field.blocks.map(async (block) => ({
+            slug: block.slug,
+            ...block.labels ? { labels: block.labels } : {},
+            fields: await serializeFields(block.fields, update, localized)
+          }))
+        );
+        break;
       case "group":
         f.fields = await serializeFields(field.fields, update, localized);
         break;
@@ -2965,6 +3423,7 @@ async function collection(config, user, localized) {
     drafts: config.drafts === true,
     versions: Boolean(config.versions),
     preview: typeof config.preview === "function",
+    schedule: config.schedule === true,
     fields: await serializeFields(
       config.fields,
       new FieldAccessChecker("update", { user }),
@@ -2987,6 +3446,7 @@ async function global(config, user, localized) {
     drafts: config.drafts === true,
     versions: Boolean(config.versions),
     preview: typeof config.preview === "function",
+    schedule: config.schedule === true,
     fields: await serializeFields(
       config.fields,
       new FieldAccessChecker("update", { user }),
@@ -3225,6 +3685,16 @@ async function route(cms, ctx, method, segments, options) {
     }
     throw new HttpError("Not found", 404);
   }
+  if (first === "jobs" && second === "run" && third === void 0) {
+    if (method !== "GET" && method !== "POST") throw methodNotAllowed(ctx, "GET, POST");
+    const secret = cms.config.cronSecret ?? process.env.CRON_SECRET;
+    const header = ctx.request.headers.get("authorization") ?? "";
+    const byCron = !!secret && safeEqual(header, `Bearer ${secret}`);
+    if (!byCron && ctx.user?.role !== "admin") {
+      throw ctx.user ? new HttpError("Forbidden", 403) : new UnauthorizedError();
+    }
+    return { body: await cms.runScheduled() };
+  }
   if (first === "admin") {
     if (method !== "GET") throw methodNotAllowed(ctx, "GET");
     if (!ctx.user) throw new UnauthorizedError();
@@ -3349,6 +3819,20 @@ async function documentAction(cms, ctx, method, collection2, id, path) {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
     return { body: await cms.restoreVersion(collection2, id, versionId, { ...access, ...depth }) };
   }
+  if (action === "schedule" && path.length <= 2) {
+    if (path.length === 2) {
+      if (method !== "DELETE") throw methodNotAllowed(ctx, "DELETE");
+      await cms.cancelSchedule(collection2, id, versionId, access);
+      return { body: { message: "Cancelled" } };
+    }
+    if (method === "GET") return { body: await cms.scheduled(collection2, id, access) };
+    if (method !== "POST") throw methodNotAllowed(ctx, "GET, POST");
+    const body = await readJson(ctx.request);
+    return {
+      status: 201,
+      body: await cms.schedule(collection2, id, scheduleJob(body), access)
+    };
+  }
   if (path.length === 1 && action === "preview") {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
     const body = await readJson(ctx.request);
@@ -3383,6 +3867,17 @@ async function globalAction(cms, ctx, method, slug, path) {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
     return { body: await cms.restoreGlobalVersion(slug, versionId, { ...access, ...depth }) };
   }
+  if (action === "schedule" && path.length <= 2) {
+    if (path.length === 2) {
+      if (method !== "DELETE") throw methodNotAllowed(ctx, "DELETE");
+      await cms.cancelGlobalSchedule(slug, versionId, access);
+      return { body: { message: "Cancelled" } };
+    }
+    if (method === "GET") return { body: await cms.scheduledGlobal(slug, access) };
+    if (method !== "POST") throw methodNotAllowed(ctx, "GET, POST");
+    const body = await readJson(ctx.request);
+    return { status: 201, body: await cms.scheduleGlobal(slug, scheduleJob(body), access) };
+  }
   if (path.length === 1 && action === "preview") {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
     const body = await readJson(ctx.request);
@@ -3399,6 +3894,12 @@ async function globalAction(cms, ctx, method, slug, path) {
   }
   throw new HttpError("Not found", 404);
 }
+function scheduleJob(body) {
+  return {
+    action: body.action,
+    at: typeof body.at === "string" ? body.at : ""
+  };
+}
 function parseLocale(url) {
   const locale = url.searchParams.get("locale");
   const fallback = url.searchParams.get("fallback-locale");
@@ -3416,8 +3917,8 @@ function withPreviewToken(url, token) {
 }
 function requirePreview(cms, ctx, target) {
   const opened = cms.verifyPreviewToken(ctx.url.searchParams.get("preview"));
-  const matches = opened !== null && ("global" in target ? "global" in opened && opened.global === target.global : "collection" in opened && opened.collection === target.collection && opened.id === target.id);
-  if (!matches) throw new UnauthorizedError("Invalid or expired preview token");
+  const matches2 = opened !== null && ("global" in target ? "global" in opened && opened.global === target.global : "collection" in opened && opened.collection === target.collection && opened.id === target.id);
+  if (!matches2) throw new UnauthorizedError("Invalid or expired preview token");
 }
 function parsePage(url) {
   const { page, limit } = parseListQuery(url);
@@ -3633,6 +4134,16 @@ ${indent}}`;
 ${indent}  id: string
 ${fieldLines(field.fields, n, `${indent}  `).join("\n")}
 ${indent}}[]`;
+    case "blocks": {
+      const kinds = field.blocks.map(
+        (block) => `{
+${indent}  id: string
+${indent}  blockType: ${quote(block.slug)}
+${fieldLines(block.fields, n, `${indent}  `).join("\n")}
+${indent}}`
+      );
+      return `(${kinds.join(" | ")})[]`;
+    }
   }
 }
 function fieldLines(fields, n, indent) {
@@ -3640,7 +4151,7 @@ function fieldLines(fields, n, indent) {
   for (const field of fields) {
     if (field.hidden) continue;
     const type = fieldType(field, n, indent);
-    const alwaysPresent = field.type === "array" || field.type === "group" || (field.type === "select" || field.type === "relationship") && field.hasMany;
+    const alwaysPresent = field.type === "array" || field.type === "blocks" || field.type === "group" || (field.type === "select" || field.type === "relationship") && field.hasMany;
     if (field.required || alwaysPresent) lines.push(`${indent}${key(field.name)}: ${type}`);
     else lines.push(`${indent}${key(field.name)}?: ${type} | null`);
   }
@@ -3748,6 +4259,7 @@ export {
   TooManyRequestsError,
   UnauthorizedError,
   ValidationError,
+  WEBHOOK_EVENTS,
   anyone,
   applyDefaults,
   consoleLogger,
@@ -3758,6 +4270,7 @@ export {
   findConfigFile,
   generateSlugs,
   generateTypes,
+  hasRows,
   hashPassword,
   imageDimensions,
   importConfig,
@@ -3771,6 +4284,7 @@ export {
   populate,
   readCookie,
   resolveConfig,
+  rowFields,
   silentLogger,
   singularize,
   slugify,