@easy-cms/core 0.61.0 → 0.63.0

package/dist/{chunk-HTE5O3EG.js → chunk-LN4M4BUP.js}

@@ -1169,11 +1169,13 @@ function safeEqual(a, b) {
   const right = Buffer.from(b);
   return left.length === right.length && timingSafeEqual4(left, right);
 }
-function signPreviewToken(secret, target, expiresAt) {
+function signPreviewToken(secret, target, expiresAt, user) {
   const payload = Buffer.from(
-    JSON.stringify(
-      "global" in target ? { g: target.global, e: expiresAt } : { c: target.collection, i: target.id, e: expiresAt }
-    )
+    JSON.stringify({
+      ..."global" in target ? { g: target.global } : { c: target.collection, i: target.id },
+      e: expiresAt,
+      ...user !== void 0 ? { u: user } : {}
+    })
   ).toString("base64url");
   return `${payload}.${hmac(secret, `preview:${payload}`)}`;
 }
@@ -1185,9 +1187,10 @@ function verifyPreviewToken(secret, token, now = Date.now()) {
   try {
     const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
     if (typeof data.e !== "number" || data.e <= now) return null;
-    if (typeof data.g === "string") return { global: data.g, expiresAt: data.e };
+    const user = typeof data.u === "string" ? { user: data.u } : {};
+    if (typeof data.g === "string") return { global: data.g, expiresAt: data.e, ...user };
     if (typeof data.c === "string" && typeof data.i === "string")
-      return { collection: data.c, id: data.i, expiresAt: data.e };
+      return { collection: data.c, id: data.i, expiresAt: data.e, ...user };
     return null;
   } catch {
     return null;
@@ -1723,7 +1726,14 @@ var Auth = class {
       ...args.name ? { name: args.name } : {}
     });
     const raw = await this.db.findById({ collection: USERS, id: user.id });
-    return this.startSession(raw);
+    const session = await this.startSession(raw);
+    await this.cms.audit.record({
+      action: "setup",
+      target: "auth",
+      user: session.user,
+      detail: { setupCode: !!code }
+    });
+    return session;
   }
   // --- Members signing up (`auth.members.signUp`) ---------------------------------------------
   /** What a sign-up form needs: a token proving when it was loaded, and Turnstile's site key. */
@@ -1927,6 +1937,12 @@ var Auth = class {
     if (!user || user.active === false) return null;
     return this.toAuthUser(user);
   }
+  /** An active user by id, as requests see them; `null` when deleted or deactivated. @internal */
+  async activeUser(id) {
+    const user = await this.db.findById({ collection: USERS, id });
+    if (!user || user.active === false) return null;
+    return this.toAuthUser(user);
+  }
   /** The CSRF token clients must echo for a signed session token. @internal */
   csrfFor(signedToken) {
     const token = unsignToken(this.config.secret, signedToken);
@@ -4612,6 +4628,7 @@ function validateConfig(config) {
     return issues;
   }
   validateSecret(config.secret, add);
+  validateCronSecret(config.cronSecret, (issue) => issues.push(issue));
   checkConfigKeys(config, (issue) => issues.push(issue));
   validateAdapterVersions(config, add);
   if (!config.db || typeof config.db.name !== "string" || typeof config.db.init !== "function") {
@@ -4687,6 +4704,27 @@ function validateSecret(secret, add) {
     add("secret", "looks like an example or a repeated pattern, not a random string", hint);
   }
 }
+function validateCronSecret(value, push) {
+  const hint = `use a random string of at least ${MIN_SECRET_LENGTH} characters, e.g. \`openssl rand -hex 32\``;
+  if (value !== void 0) {
+    if (typeof value !== "string") push({ path: "cronSecret", message: "must be a string" });
+    else if (value.length < MIN_SECRET_LENGTH)
+      push({
+        path: "cronSecret",
+        message: `must be at least ${MIN_SECRET_LENGTH} characters (got ${value.length})`,
+        hint
+      });
+    return;
+  }
+  const env = process.env.CRON_SECRET;
+  if (env && env.length < MIN_SECRET_LENGTH)
+    push({
+      path: "cronSecret",
+      message: `CRON_SECRET is ${env.length} characters; anyone who guesses it can run jobs`,
+      hint,
+      severity: "warning"
+    });
+}
 function guessable(secret) {
   return /change[-_ ]?me|example|placeholder|secret-?key/i.test(secret) || new Set(secret).size < 8;
 }
@@ -6021,6 +6059,221 @@ function resolveAudit(audit) {
 // src/local-api.ts
 import { createHmac as createHmac6, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual5 } from "crypto";
 
+// src/auth/common-passwords.ts
+var LIST = `
+0.0.0.000 01234567 063dyjuy 085tzzqi 09876543 10101010 11001001 11111111 11112222 11223344
+11235813 12121212 12312312 123123123 12341234 12344321 12345678 123456789 1234567890 12345679
+1234abcd 1234qwer 12locked 12qwaszx 13131313 13576479 14141414 14725836 14789632 151nxjmt
+154ugeiu 17011701 17171717 18436572 19691969 19741974 19781978 19841984 1a2b3c4d 1letmein
+1michael 1million 1passwor 1q2w3e4r 1q2w3e4r5t 1qaz2wsx 1qazxsw2 1x2zkg8w 20002000 20012001
+201jedlz 20202020 20spanks 21122112 21212121 22222222 23232323 23skidoo 24242424 24682468
+25252525 25802580 31415926 33333333 368ejhih 380zliki 383pdjvl 44444444 474jdvff 50spanks
+51505150 551scasi 554uzpad 55555555 55bgates 5wr2i7h8 66666666 66668888 69696969 69camaro
+766rglqy 77777777 78945612 863abgsg 87654321 88888888 8j4ye3uz 911turbo 98765432 987654321
+99999999 a1234567 a1b2c3d4 aaaaaaa1 aaaaaaaa aardvark abc12345 abcd1234 abcdefg1 abcdefgh
+aberdeen abnormal absolute absolutely acapulco access14 access99 achilles acidburn adelaide
+adrienne aerosmit airborne aircraft airforce airplane albatros alejandr alessand alexalex
+alexande alexander alexandr alexandra alfarome alleycat alliance allison1 allnight allstate
+almighty alpha123 alphabet amateurs amatuers ambrosia america1 american amethyst amsterda
+amsterdam anaconda anastasi andersen anderson andromed andyandy andyod22 angelica angelika
+angelina animated annabell annmarie antelope anthony1 anthony7 anything aolsucks apollo13
+apple123 applepie aquarius archange architec argentin arizona1 arkansas armstron arsenal1
+asdf1234 asdfasdf asdfghjk asdfghjkl ashleigh assassin asshole1 assholes atlantic atlantis
+atreides attitude attorney auckland augustus austin31 australi australia avalanch aviation
+azertyui b929ezzh baberuth babybaby babyblue babycake babydoll babyface babygirl babylon5
+babylove backbone backdoor badabing balloons baltimor bangbang barbados barcelon barcelona
+barefeet barefoot baritone basebal1 baseball baseball1 basement basketba basketball bastards
+bbbbbbbb bcfields bearbear bearcats beatles1 beatrice beautifu beautiful beefcake beerbeer
+beethove bellagio bendover benjamin bergkamp berkeley bettyboo bigballs bigblack bigblock
+bigboobs bigbooty bigbucks bigdaddy bigdick1 bigdicks bigmoney bigpenis bigpoppa bigtruck
+billabon billbill billybob billyboy binladen birthday birthday1 birthday4 bitchass blackbir
+blackcat blackcoc blackdog blackhaw blackice blackjac blackjack blacklab blackman blackout
+blessing blink182 blizzard blowfish blue1234 blueball bluebell blueberr bluebird blueblue
+blueeyes bluefish bluejays bluemoon bluesman bobafett bobdylan bollocks bonehead bookworm
+borabora bordeaux borussia bradford brandon1 brewster brighton brigitte brisbane brittany
+brittney broadway broncos1 brooklyn brothers browning brucelee bubba123 bubbles1 buckaroo
+buckeyes buckshot budapest buddy123 buddyboy budlight budweise buffalo1 building bukowski
+bulldawg bulldog1 bulldogs bulletin bullfrog bullseye bullshit bullwink bunghole business
+businessbabe buttercu butterfl butterfly buttfuck butthead butthole cabernet cadillac caldwell
+calendar caliente californ california caligula calimero callaway callisto camaross cambridg
+cameltoe cameron1 campbell canadian candyass candyman cannabis capetown capitals capricor
+capslock captain1 cardinal cardinals care1839 carebear carlitos carnival carolina caroline
+carpedie carpente cartman1 cartoons casanova cashflow cashmone cassandr castillo catalina
+catfight catherin catherine catwoman cavalier cbr900rr cccccccc celebrity cerberus cezer121
+chadwick chainsaw challeng chambers champion chandler changeme chargers charisma charlene
+charles1 charlie1 charlie123 charlie2 charlott charlotte charlton checkers checkmat cheerleaers
+chelsea1 chemical cherokee cherries cheshire chester1 chestnut chevelle chevrole chevrolet
+chewbacc cheyenne chicago1 chicken1 chickens children chipmunk chiquita chocolat chocolate
+choochoo chris123 chrisbln christia christian christie christin christina christine christma
+christmas christop christopher chrysler chuckles churchil cinnamon citation civilwar clarence
+clarinet clarissa classics claudia1 claymore clemente cleopatr clevelan cleveland clifford
+climbing clippers clitoris close-up clueless cocacola cocksuck cocksucker cocktail coldbeer
+coldplay colombia colonial colorado coltrane columbia columbus comanche commande commando
+complete computer concorde concrete confused conquest constant consumer contains contortionist
+contract coolcool cooldude coolhand coolness copenhag corleone cornhole cornwall corvet07
+corvette costello cosworth courtney coventry cowboys1 crawford crazybab crazyman creampie
+creation creative creature creepers crescent cricket1 criminal cristian cristina cromwell
+crusader crystal1 csfbr5yy culinary customer cutiepie cybersex cyclones cygnusx1 dad2ownu
+daedalus daisydog danielle dannyboy dapzu455 daredevi darkange darklord darkness darkside
+darkstar darthvad daughter davecole davedave davidson daylight dddddddd deadhead deadpool
+deadspin death666 december deepthroat deerhunt deeznuts deeznutz defender deftones delaware
+delldell delpiero designer destiny1 detectiv devil666 devildog devilman diamond1 diamonds
+dickdick dickhead dietcoke digital1 dilbert1 dilligaf dingdong dinosaur dipstick director
+dirtbike dirtydog disaster discover division doberman dodgeram dodgers1 doghouse dogpound
+dolemite dolphin1 dolphins dominick dominion dominiqu dontknow doomsday doughboy doughnut
+downhill downtown dragon12 dragon69 dragonba dragonball dragonfl dragster dreamcas dreamer1
+dreaming dripping drowssap drpepper drummer1 dudedude dukeduke dutchess dynamite earnhard
+earthlin earthlink eastside eastwood eatmenow eatpussy eclipse1 edgewise edmonton eeeeeeee
+eggplant eighteen einstein ejaculation elcamino eldiablo eldorado electric electron elephant
+elisabet elizabet elizabeth embalmer emmanuel enforcer engineer england1 enternow enterpri
+enterprise entrance envelope erection ericsson escalade espresso estrella eternity evangeli
+everlast evolutio excalibu excalibur exchange experience experienced explorer express1 f00tball
+fairlane faithful fandango fantasia fantasies farscape fastball fatluvr69 favorite favorite2
+favorite6 fearless feathers february federico feelgood fellatio ferguson fernando ferrari1
+festival ffffffff ffvdj474 fidelity fighting films+pic+galeries fingerig fireball fireblad
+firefigh firefire firehawk firewall fishbone fishcake fisherma fishfish fishhead fishing1
+fishtank flamingo flanders flashman flathead fletcher flexible flipflop flipmode florence
+florida1 flounder flyers88 football football1 fordf150 foreplay foreskin forgetit formula1
+forsaken fortress fortune12 fountain foxylady francesc francine francois frankie1 franklin
+freckles frederic fredfred fredrick freedom1 freefall freefree freepass freeporn freeuser
+freewill frenchie friendly frogfrog front242 frontier fuck_inside fuckface fuckfuck fuckhead
+fuckinside fuckoff1 fuckthis fuckyou1 fuckyou2 fullback fullmoon funstuff funtimes fussball
+fuzzball gabriel1 gabriela gabriell galeries gallaries gamecock gamecube gameover gandalf1
+gangbang gangbanged gangster garfield gargoyle garrison gateway1 gateway2 gatorade general1
+generals genesis1 geneviev geoffrey gerhardt geronimo gertrude gesperrt getmoney getsdown
+gfxqx686 gggggggg gilligan ginscoot giovanna giovanni girfriend giuseppe giveitup gizmodo1
+gladiato gladiator glendale glennwei gnasher23 godfathe godfather godsmack godspeed godzilla
+gogators goldberg goldeney goldfing goldfish goldstar goldwing golfball golfgolf gonzales
+gonzalez goodfell goodgirl goodluck goodtime goodyear goofball gooseman gordon24 gorgeous
+gotohell gotyoass graduate graphics grateful graywolf greatest greatone green123 greenbay
+greenday greenman gregory1 gretchen greywolf griffith gsxr1000 guardian guinness gymnastic
+hahahaha hairball halflife hallowee hamilton handball handsome handyman hannibal happines
+happy123 happyday happydog happyman hardball hardcock hardcore harddick hardrock hardware
+hardwood harrison hartford hastings hattrick hawaii50 hawaiian hawkeyes hawkwind hawthorn
+hayabusa heather1 hedgehog heineken heinrich hellfire hello123 hellohel hellyeah hercules
+herewego heritage hetfield hhhhhhhh highbury highheel highland highlander highlife hihje863
+hillbill hillside holidays hollywoo hollywood holyshit homemade homepage homepage- honeybee
+honeydew hongkong honolulu hooligan hoosiers hooters1 hopeless hornyman horseman horsemen
+hotgirls hotmail0 hotmail1 hotpussy hotstuff hounddog housewife housewifes houston1 hugetits
+hugohugo humphrey hurrican hurricane huskers1 hyperion hzze929b ibilltes icecream icehouse
+idontkno idontknow ihateyou iiiiiiii illinois illmatic illusion ilovegod ilovesex iloveyou
+iloveyou! iloveyou1 iloveyou2 immortal imperial implants infantry infinite infiniti infinity
+innocent insanity insertion insertions insomnia inspiron instinct interacial intercourse
+interest internal internet intrepid intruder iqzzt580 irishman isabella isabelle isacs155
+islander istanbul istheman italiano iverson3 jackass1 jackjack jackson1 jackson5 jakejake
+james007 jamesbon jamesbond japanees japanese jasmine1 jayhawks jeanette jediknig jeepjeep
+jeepster jefferso jeffjeff jellybea jennifer jennings jeremiah jermaine jessica1 jiggaman
+jjjjjjjj jo9k2jw2 johannes johndeer johngalt johnjohn johnmish johnson1 johnston jojojojo
+jonathan jonathon jordan23 josephin joystick juliette junkmail jupiter1 jupiter2 jurassic
+just4fun justdoit juventus kamikaze kangaroo katarina katherin katherine kathleen kawasaki
+kayleigh kcchiefs kcj9wx5n kentucky kenworth keyboard keystone kikimora killbill killkill
+kimberly kingfish kingkong kingrich kingston kirkland kisskiss kittycat kittykat kkkkkkkk
+klondike knickerless knickers knockers knuckles kordell1 kristian kristin1 kristina kristine
+labrador lacrosse laetitia lakeside lakewood lalakers lalalala lancelot landmark laserjet
+lasvegas laughing laurence lavalamp lawrence lebowski leedsutd lemonade leonardo lesbians
+letmein1 letmein2 letmein22 letmeinn letmesee letsdoit lexingky lifehack lifetime lighthou
+lighting lightnin lightning limewire lincoln1 lionhear lionking lipstick lisalisa littlema
+liverpoo liverpool lkjhgfds llllllll lockdown lockerroom logitech lollipop lollypop lonesome
+lonestar lonewolf longdong longhair longhorn longjohn longshot lorraine losangel lovelife
+lovelove loverboy loverman lowrider luckydog luckyone lunchbox luv2epus macaroni macdaddy
+macgyver macintos madeline madison1 magazine magellan magician magicman magnolia mainland
+majestic makaveli mallorca mallrats mamacita manchest manchester mandarin mandingo mandrake
+manhatta maradona marathon marauder marcello marcius2 margaret marianne marijuan mariners
+marines1 marino13 mariposa marjorie marlboro marriage marshall martinez maryjane maryland
+masamune maserati mash4077 master12 masterbaiting masterbate masterbating masturbation matchbox
+material matthew1 matthews matthias maverick maxwell1 mazda626 mazdarx7 mccarthy mcdonald
+mckenzie meatball meathead meatloaf mechanic medicine megadeth megapass megatron melanie1
+melissa1 meowmeow mephisto mercedes merchant mercury1 meredith meridian metallic metallica
+michael1 michael2 michaela michaels michelle michigan microsof microsoft midnight mikemike
+milamber military millions millwall minemine minimoni ministry minnesot mischief misfit99
+mississi missouri mistress mitchell mmmmmmmm mobydick modelsne mohammad mohammed mollydog
+monalisa money123 moneyman mongoose monkey12 monkeybo monopoly monster1 monsters montana1
+montecar monterey montreal montrose moonbeam moonligh moonlight moonshin morpheus morrison
+mortgage morticia mortimer motherfucker motocros motorola mounta1n mountain mudvayne muffdive
+mulligan munchkin mushroom musician musicman mustang1 mustang2 mustang5 mustang6 mustangs
+mwq6qlzo myspace1 myxworld nancy123 napoleon nascar24 natalie1 natasha1 natedogg nathalie
+nathanie national navyseal ncc1701a ncc1701d ncc1701e ncc74656 nebraska necklace negative
+nemrac58 netscape nevermin newcastl newcastle newpass6 newyork1 nicetits nicholas nightmar
+nightowl nightwin nineball nineinch nineteen nintendo nirvana1 nnnnnnnn nocturne nonenone
+normandy northern nostromo notebook notredam nounours november novifarm nwo4life nygiants
+nyyankee oblivion obsidian offshore oklahoma oooooooo opendoor operator optimist original
+outoutout outsider overkill overlord ozlq6qwm pa55w0rd pa55word packers1 paintbal paintball
+painting pakistan paladin1 pallmall palmtree panasoni panasonic pantera1 panther1 panthers
+papabear papillon paradigm paradise paramedi paranoid pasadena pass1234 passmast passpass
+passport passthie passw0rd passwor1 password password1 password2 password9 passwords passwort
+patches1 pathetic pathfind patience patricia patrick1 patriots paulpaul pavement pavilion
+peaches1 pearljam peekaboo penelope penetrating penetration penguin1 penguins pennywis pentagon
+penthous perfect1 personal pertinant pescator peterbil peternorth peterpan peterson phaedrus
+phantom1 pharmacy phialpha philippe phillies phillips phoenix1 pianoman pictuers piercing
+pimpdadd pimpdaddy pineappl pinetree pingpong pinkfloy pinkfloyd pinnacle pipeline pitchers
+pizzaman plastics platinum platypus playball playboy1 playboy2 playmate playoffs playstat
+playstation playtime pleasant pleasure plymouth polopolo poohbear pool6123 poontang poophead
+pooppoop porkchop porn4life pornking pornographic pornporn porsche1 porsche9 portland portugal
+poseidon positive postov1000 pounding pppppppp preacher precious predator pregnant prelude1
+presario presiden president pressure primetime21 princess princeto pringles printing private1
+producer progress property prophecy prospect ptfe3xxp pumpkin1 pumpkins punisher punkrock
+puppydog pussy123 pussy4me pussycat pussyeat pussyman pxx3eftp q1w2e3r4 qazwsxed qazwsxedc
+qcmfd454 qqqqqqqq quant4307s question qwer1234 qwerasdf qwerqwer qwert123 qwerty12 qwerty123
+qwertyui qwertyuiop qwertzui r2d2c3po rachelle radiohea ragnarok raiders1 railroad rainbow1
+rainbow6 rainbows rainyday raistlin randolph rangers1 rapunzel rasputin rasta220 rebecca1
+reckless recovery redalert redbaron reddevil reddwarf redheads redlight redshift redskins
+redstorm redwings reginald register reindeer remember remingto renegade republic research
+resident revoluti revolver reynolds rhiannon richard1 richards richmond riffraff rightnow
+riverrat riversid roadkill roadking roadrunn roadster robinson robotech robotics rochelle
+rockford rockhard rocknrol rockrock rockstar rockwell rolltide rootbeer rootedit rosemary
+rrrrrrrr rsalinas rt6ytere rush2112 rushmore russell1 rustydog sabrina1 sailboat salasana
+salesman salvador samadams samantha samsung1 sandberg sandiego sandrine sandwich sanity72
+santiago sapphire saratoga satan666 saturday sausages savannah save13tx saxophon scandinavian
+scarface scarlett scheisse scirocco scissors scoobydo scoobydoo scooter1 scorpio1 scorpion
+scotland scrabble scrapper screamer screwyou seahawks sealteam sebastia sebastian security
+seductive seinfeld seminole semperfi senators sentinel sentnece septembe september serenity
+sergeant services sexsexsex sexybabe sexygirl sexylady sexysexy shadow12 shamrock shanghai
+shannon1 sheepdog shepherd sheridan sherlock sherwood shitface shithead shitshit shopping
+showtime sickness sidekick sigmachi silverad simpsons sinclair singapor sinister sithlord
+sixtynin skeeter1 skinhead skipper1 skittles skydiver skywalke skywalker slamdunk slapnuts
+slapshot sleeping slimed123 slimshad slipknot slippery slowhand smackdow smartass smashing
+smeghead smirnoff smithers smoothie snapshot sneakers snickers sniffing snoopdog snowball
+snowbird snowboar snowboard snowflak snuggles soccer10 soccer11 soccer12 socrates softball
+softtail software solitude solution somerset somethin something sometime sonyfuck sonysony
+sooners1 sopranos soulmate southern southpar southpark southpaw spaceman spanking sparhawk
+sparkles spartan1 spartans speakers special1 specialk spectrum speedway spencer1 spiderma
+spiderman spitfire splinter spongebo sporting springer sprinter sprocket squerting squirrel
+srinivas ssptx452 ssssssss stafford stallion standard stanford stanley1 starbuck starcraf
+starcraft stardust starfire starfish stargate starligh starlite starship starstar startrek
+starwars steelers stefanie stephane stephani stephanie stephen1 stephens sterling stewart1
+stickman stiletto stingray stirling stocking stockton stonecol stonecold stonewal stoppedby
+straight stranger strawber streaming strength stripper suburban success1 suckcock suckdick
+sullivan summer69 summer99 sundance sundevil sunflowe sunlight sunnyday sunshine superfly
+superior superman supernov supersta superstar surprise surveyor survival survivor svetlana
+sweetnes sweetness sweetpea swimming swingers swinging swordfis swordfish sylveste syracuse
+tacobell tailgate takehana talisman tampabay tangerin tarheels tazmania technics techniques
+teddybea telephon temppass temptress tennesse terminal terminat terrapin test1234 testerer
+testibil testing1 testpass testtest thailand thanatos thankyou thedoors theforce thegreat
+thematri theodore therock1 thething thetruth thinking thirteen thisisit thompson thrasher
+threesom thriller thuglife thumbnils thumper1 thunder1 thunderb thursday tiberius tickling
+ticklish tiffany1 tiger123 tigercat tinkerbe titanium titleist tmjxn151 together tomahawk
+tommyboy tomorrow toonarmy toriamos tottenha tottenham touching trailers training transexual
+transfer traveler treasure treefrog triangle trinidad trinitro trinity1 trombone trooper1
+tropical trouble1 troubles trousers trucking trueblue truelove trumpet1 trustno1 tttttttt
+tunafish turkey50 twilight ultimate umbrella unbelievable uncencored underdog undertak
+undertaker undertow underwear universa universe university ursitesux username usmarine uuuuuuuu
+vacation vagabond valdepen valencia valentin valhalla valkyrie valleywa vampire1 vampires
+vancouve vanessa1 vanguard vanhalen vauxhall velocity verbatim veronica veronika verygood
+victoria viewsoni vikings1 vincent1 violator vipergts virginia virginie vivitron vladimir
+volkswag volleyba voyager1 vvvvvvvv wanderer wapapapa warcraft wareagle warhamme warrior1
+warriors washburn washingt washington watching waterboy waterfal waterloo waterman waterski
+webmaste webmaster wednesda wednesday welcome1 wellingt werewolf westside westwood wetpussy
+wg8e3wjf whatever whatwhat whiplash whiskers whistler whiteboy whiteout whitesox whocares
+wildbill wildcard wildcats wildfire wildstar wildwood william1 williams windmill windows1
+windsurf winfield wingchun winston1 winter99 wireless wishbone wolfgang wolfpack wolverin
+wolverine wonderboy wonderfu woodland woodstoc woodwork woofwoof wordpass wp2003wp wrangler
+wrestler wrestlin wrestling wrinkle1 wrinkle5 wwwwwwww xxxxxxx1 xxxxxxxx yamahar1 yankees1
+yankees2 yeahbaby yeahyeah year2005 yesterda yogibear yosemite yqlgr667 yvtte545 yy5rbfsc
+yyyyyyyy zachary1 zanzibar zaq12wsx zaq1xsw2 zeppelin zerocool zildjian zoomzoom zxcvbnm1
+zzzzzzzz
+`;
+var COMMON_PASSWORDS = new Set(LIST.split(/\s+/).filter(Boolean));
+
 // src/localization.ts
 var ALL_LOCALES = "all";
 var isPlainObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -6374,6 +6627,10 @@ async function createEasyCMS(config, options = {}) {
   const cms = new EasyCMS(resolved3, db, logger, storage, cwd);
   const scheduling = [...resolved3.collections, ...resolved3.globals].some((c) => c.schedule) || (resolved3.webhooks?.length ?? 0) > 0 || resolved3.email !== void 0 || resolved3.jobs.length > 0;
   if (scheduling && options.scheduler !== false) cms.startScheduler();
+  if (process.env.NODE_ENV === "production" && !resolved3.auth.setupCode && await cms.auth.hasUsers().catch(() => true) === false)
+    logger.warn(
+      "No admin exists yet and no setup code is set: whoever opens the admin first becomes the admin. Set EASY_CMS_SETUP_CODE, or create the admin with `easy-cms admin:create`."
+    );
   return cms;
 }
 var toJob = (row) => ({
@@ -6871,18 +7128,23 @@ var EasyCMS = class {
   }
   /**
    * How many documents use any of these files in a top-level upload field (rich text and fields
-   * inside groups, arrays and blocks are not counted). Drafts count too.
+   * inside groups, arrays and blocks are not counted). Drafts count too. With
+   * `overrideAccess: false`, only documents the user may read.
    */
-  async mediaUsage(ids) {
+  async mediaUsage(ids, options = {}) {
     if (ids.length === 0) return 0;
     let count = 0;
     for (const config of this.config.collections) {
       if (INTERNAL_COLLECTIONS.has(config.slug)) continue;
       for (const field of config.fields) {
         if (field.type !== "upload") continue;
-        count += await this.db.count({
-          collection: config.slug,
-          where: { [field.name]: { in: [...ids] } }
+        count += await this.count(config.slug, {
+          ...options,
+          where: { [field.name]: { in: [...ids] } },
+          draft: true
+        }).catch((error) => {
+          if (error instanceof ForbiddenError || error instanceof UnauthorizedError) return 0;
+          throw error;
         });
       }
     }
@@ -7133,12 +7395,15 @@ var EasyCMS = class {
   /**
    * A token that lets a page read one document's current draft for a while (default one hour),
    * without a login: `GET /api/cms/:collection/:id?preview=<token>`. The admin adds one to the
-   * preview URL as `easy-cms-preview`, for sites on another origin.
+   * preview URL as `easy-cms-preview`, for sites on another origin. With `user`, the page reads
+   * it with that user's access (fields they can't read are left out; a deactivated user's token
+   * stops working); without, with full access.
    */
   createPreviewToken(target, options = {}) {
     const seconds = options.expiresIn ?? 60 * 60;
     const normalized = "global" in target ? target : { collection: target.collection, id: String(target.id) };
-    return signPreviewToken(this.config.secret, normalized, Date.now() + seconds * 1e3);
+    const user = options.user ? String(options.user.id) : void 0;
+    return signPreviewToken(this.config.secret, normalized, Date.now() + seconds * 1e3, user);
   }
   /** What a preview token opens, or `null` when it is invalid or expired. */
   verifyPreviewToken(token) {
@@ -7598,7 +7863,8 @@ var EasyCMS = class {
     const check3 = (operation) => this.checkDocumentAccess(config, operation, guard, parsed, void 0).then(
       () => true,
       (error) => {
-        if (error instanceof ForbiddenError || error instanceof UnauthorizedError) return false;
+        if (error instanceof ForbiddenError || error instanceof UnauthorizedError || error instanceof NotFoundError)
+          return false;
         throw error;
       }
     );
@@ -8067,7 +8333,38 @@ var EasyCMS = class {
     await this.checkQueryFields(config, guard, where);
     return andWhere(andWhere(where, access), own);
   }
+  /**
+   * Throws unless the caller may update or delete this document. A user who may not even read
+   * it gets `NotFoundError`, as for an id that doesn't exist: a 403 would tell it does.
+   */
   async checkDocumentAccess(config, operation, guard, id, data) {
+    await this.hidingDenied(
+      config.slug,
+      guard,
+      id,
+      () => this.documentAccess(config, operation, guard, id, data)
+    );
+  }
+  /** Runs a check; a `ForbiddenError` for a document the user can't read becomes a 404. */
+  async hidingDenied(collection2, guard, id, check3) {
+    try {
+      await check3();
+    } catch (error) {
+      if (error instanceof ForbiddenError && !await this.mayRead(collection2, guard, id))
+        throw new NotFoundError(collection2, String(id));
+      throw error;
+    }
+  }
+  async mayRead(collection2, guard, id) {
+    const config = this.collection(collection2);
+    try {
+      const where = await this.readWhere(config, guard, { id: { equals: id } });
+      return await this.db.count({ collection: collection2, where }) > 0;
+    } catch {
+      return false;
+    }
+  }
+  async documentAccess(config, operation, guard, id, data) {
     if (!guard.enforce) return;
     const own = await this.checkGrant(guard, { collection: config.slug }, operation);
     const allowed2 = await evaluateAccess(config.access?.[operation], {
@@ -8134,13 +8431,15 @@ var EasyCMS = class {
   }
   /** `checkGrant` for one document: a role limited to its own documents must own it. */
   async checkDocumentGrant(guard, collection2, operation, id) {
-    const own = await this.checkGrant(guard, { collection: collection2 }, operation);
-    if (own === true) return;
-    const matches2 = await this.db.count({
-      collection: collection2,
-      where: andWhere(own, { id: { equals: id } })
+    await this.hidingDenied(collection2, guard, id, async () => {
+      const own = await this.checkGrant(guard, { collection: collection2 }, operation);
+      if (own === true) return;
+      const matches2 = await this.db.count({
+        collection: collection2,
+        where: andWhere(own, { id: { equals: id } })
+      });
+      if (matches2 === 0) throw deny(guard.user);
     });
-    if (matches2 === 0) throw deny(guard.user);
   }
   /** Runs afterRead hooks, populates relationships and removes what the caller may not see. */
   async output(config, docs, guard, options) {
@@ -8713,6 +9012,11 @@ function splitPassword(config, raw) {
       { field: "password", message: `must be at least ${MIN_PASSWORD_LENGTH} characters` }
     ]);
   }
+  if (COMMON_PASSWORDS.has(password.normalize("NFKC").toLowerCase())) {
+    throw new ValidationError(USERS, [
+      { field: "password", message: "is one of the most common passwords; choose another" }
+    ]);
+  }
   return { input, password };
 }
 function asObject(data, name) {
@@ -8789,7 +9093,7 @@ async function readAdminModule(cms, index) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.61.0" : "0.0.0-dev";
+var VERSION = true ? "0.63.0" : "0.0.0-dev";
 
 // src/rest/admin-deliveries.ts
 var PER_PAGE = 50;
@@ -10033,6 +10337,7 @@ async function route(cms, ctx, method, path, options) {
     if (!byCron && !isSystemAdmin(ctx.user)) {
       throw ctx.user ? new HttpError("Forbidden", 403) : new UnauthorizedError();
     }
+    if (!byCron && ctx.via === "cookie" && method !== "POST") throw methodNotAllowed(ctx, "POST");
     return { body: await cms.runJobs() };
   }
   if (first === "admin" && second === "backups") {
@@ -10152,7 +10457,12 @@ async function route(cms, ctx, method, path, options) {
     if (!ctx.user || ctx.user.apiKey) throw new UnauthorizedError();
     if (method !== "GET") throw methodNotAllowed(ctx, "GET");
     const ids = (ctx.url.searchParams.get("ids") ?? "").split(",").map((id2) => parseId(id2)).filter((id2) => id2 !== void 0);
-    return { body: { count: await cms.mediaUsage(ids) } };
+    const count = await cms.mediaUsage(ids, {
+      overrideAccess: false,
+      user: ctx.user,
+      context: ctx.context
+    });
+    return { body: { count } };
   }
   if (first === "admin" && second === "roles") {
     if (!ctx.user) throw new UnauthorizedError();
@@ -10297,9 +10607,10 @@ async function route(cms, ctx, method, path, options) {
     if (third !== void 0) return globalAction(cms, ctx, method, second, segments.slice(2));
     if (method === "GET") {
       if (ctx.url.searchParams.has("preview")) {
-        requirePreview(cms, ctx, { global: second });
+        const as = await requirePreview(cms, ctx, { global: second });
         return {
           body: await cms.findGlobal(second, {
+            ...as,
             ...parseDepth(ctx.url),
             ...parseLocale(ctx.url),
             draft: true
@@ -10408,8 +10719,9 @@ async function route(cms, ctx, method, path, options) {
   }
   const id = second;
   if (method === "GET" && ctx.url.searchParams.has("preview")) {
-    requirePreview(cms, ctx, { collection: collection2, id });
+    const as = await requirePreview(cms, ctx, { collection: collection2, id });
     const doc = await cms.findById(collection2, id, {
+      ...as,
       ...parseDepth(ctx.url),
       ...parseLocale(ctx.url),
       draft: true
@@ -10488,7 +10800,7 @@ async function documentAction(cms, ctx, method, collection2, id, path) {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
     const body = await readJson(ctx.request);
     const result = await cms.preview(collection2, id, body, { ...access, ...depth });
-    const token = cms.createPreviewToken({ collection: collection2, id });
+    const token = cms.createPreviewToken({ collection: collection2, id }, { user: ctx.user });
     return { body: { ...result, url: result.url && withPreviewToken(result.url, token) } };
   }
   if (path.length === 1 && (action === "unpublish" || action === "discard-draft")) {
@@ -10538,7 +10850,7 @@ async function globalAction(cms, ctx, method, slug2, path) {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
     const body = await readJson(ctx.request);
     const result = await cms.previewGlobal(slug2, body, { ...access, ...depth });
-    const token = cms.createPreviewToken({ global: slug2 });
+    const token = cms.createPreviewToken({ global: slug2 }, { user: ctx.user });
     return { body: { ...result, url: result.url && withPreviewToken(result.url, token) } };
   }
   if (path.length === 1 && (action === "unpublish" || action === "discard-draft")) {
@@ -10577,10 +10889,16 @@ function withPreviewToken(url, token) {
   const separator = base.includes("?") ? "&" : "?";
   return `${base}${separator}${PREVIEW_PARAM}=${encodeURIComponent(token)}${fragment}`;
 }
-function requirePreview(cms, ctx, target) {
+async function requirePreview(cms, ctx, target) {
   const opened = cms.verifyPreviewToken(ctx.url.searchParams.get("preview"));
   const matches2 = opened !== null && ("global" in target ? "global" in opened && opened.global === target.global : "collection" in opened && opened.collection === target.collection && opened.id === target.id);
   if (!matches2) throw new UnauthorizedError("Invalid or expired preview token");
+  if (opened.user === void 0) return {};
+  const id = parseId(opened.user);
+  const issuer = id === void 0 ? null : await cms.auth.activeUser(id);
+  if (!issuer) throw new UnauthorizedError("Invalid or expired preview token");
+  const { user, context } = await cms.applyOnRequest(ctx.request.headers, ctx.url, issuer);
+  return { overrideAccess: false, user, context };
 }
 function parsePage(url) {
   const { page, limit } = parseListQuery(url);

package/dist/{config-jzFGsNL6.d.ts → config-Dgs6FE0S.d.ts}

@@ -1746,9 +1746,10 @@ declare class EasyCMS<C extends Config = Config> {
     private mediaSignature;
     /**
      * How many documents use any of these files in a top-level upload field (rich text and fields
-     * inside groups, arrays and blocks are not counted). Drafts count too.
+     * inside groups, arrays and blocks are not counted). Drafts count too. With
+     * `overrideAccess: false`, only documents the user may read.
      */
-    mediaUsage(ids: readonly ID[]): Promise<number>;
+    mediaUsage(ids: readonly ID[], options?: AccessOptions): Promise<number>;
     /** The storage for public files, or for private ones. */
     storageFor(isPrivate: boolean): StorageAdapter;
     /**
@@ -1811,7 +1812,9 @@ declare class EasyCMS<C extends Config = Config> {
     /**
      * A token that lets a page read one document's current draft for a while (default one hour),
      * without a login: `GET /api/cms/:collection/:id?preview=<token>`. The admin adds one to the
-     * preview URL as `easy-cms-preview`, for sites on another origin.
+     * preview URL as `easy-cms-preview`, for sites on another origin. With `user`, the page reads
+     * it with that user's access (fields they can't read are left out; a deactivated user's token
+     * stops working); without, with full access.
      */
     createPreviewToken(target: {
         collection: string;
@@ -1820,10 +1823,12 @@ declare class EasyCMS<C extends Config = Config> {
         global: string;
     }, options?: {
         expiresIn?: number;
+        user?: AuthUser | null;
     }): string;
     /** What a preview token opens, or `null` when it is invalid or expired. */
     verifyPreviewToken(token: string | null | undefined): (PreviewTarget & {
         expiresAt: number;
+        user?: string;
     }) | null;
     /** Live preview of a global. See `preview`. */
     previewGlobal<S extends GSlug<C>>(slug: S, data: Record<string, unknown>, options?: DepthOptions): Promise<LivePreview<GDoc<C, S>>>;
@@ -1992,7 +1997,15 @@ declare class EasyCMS<C extends Config = Config> {
     private checkGrant;
     /** The query constraint read access adds, or `undefined` when there is none. Throws when denied. */
     private readWhere;
+    /**
+     * Throws unless the caller may update or delete this document. A user who may not even read
+     * it gets `NotFoundError`, as for an id that doesn't exist: a 403 would tell it does.
+     */
     private checkDocumentAccess;
+    /** Runs a check; a `ForbiddenError` for a document the user can't read becomes a 404. */
+    private hidingDenied;
+    private mayRead;
+    private documentAccess;
     private checkGlobalAccess;
     private fieldChecker;
     /**

package/dist/{handler-CMA1LIq7.d.ts → handler-CcQjkj5Q.d.ts}

@@ -1,4 +1,4 @@
-import { I as ID, ab as Config, au as EasyCMS, bd as LocalizationConfig, aD as Field, aH as FieldError, aS as FilterOptions, af as CreateEasyCMSOptions, bI as ResolvedConfig } from './config-jzFGsNL6.js';
+import { I as ID, ab as Config, au as EasyCMS, bd as LocalizationConfig, aD as Field, aH as FieldError, aS as FilterOptions, af as CreateEasyCMSOptions, bI as ResolvedConfig } from './config-Dgs6FE0S.js';
 
 type BackupState = 'pending' | 'running' | 'done' | 'failed';
 /** One backup as the admin shows it (`GET <api>/admin/backups`). */

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { P as PaginatedDocs, I as ID, E as EmailSetting } from './config-jzFGsNL6.js';
-export { A as ADAPTER_API_VERSION, a as ADMIN_ICONS, b as Access, c as AccessArgs, d as AccessOptions, e as AdminBrand, f as AdminCommand, g as AdminComponent, h as AdminConfig, i as AdminFieldArgs, j as AdminIcon, k as AdminLocale, l as AdminPage, m as AdminRole, n as AdminRoleChange, o as AdminRoleField, p as AdminRoleTarget, q as AdminRoleView, r as AdminRoles, s as AdminSso, t as AdminSwitcher, u as AdminViewAccess, v as AfterChangeHook, w as AfterDeleteHook, x as AfterReadHook, y as ApiKeyContext, z as ApiKeyGlobalOperation, B as ApiKeyOperation, C as ApiKeyPermissions, D as ArrayField, F as AuditChange, G as AuditConfig, H as AuditEntry, J as AuditLog, K as AuditPage, L as AuditVerification, M as Auth, N as AuthConfig, O as AuthProvider, Q as AuthProviderProfile, R as AuthProviderRequest, S as AuthUser, T as BackupsConfig, U as BeforeChangeHook, V as BeforeDeleteHook, W as BeforeValidateHook, X as Block, Y as BlocksField, Z as BooleanField, _ as BuiltinApiKeysCollection, $ as BuiltinMediaCollection, a0 as BuiltinMediaFoldersCollection, a1 as BuiltinUsersCollection, a2 as BundleHints, a3 as CliCommand, a4 as CollectionAccess, a5 as CollectionAdmin, a6 as CollectionConfig, a7 as CollectionDocument, a8 as CollectionHooks, a9 as CollectionListAdmin, aa as CollectionSlug, ab as Config, ac as ConfigError, ad as ConfigIssue, ae as ContainerAdmin, af as CreateEasyCMSOptions, ag as CreateInput, ah as CreateMigrationResult, ai as CustomField, aj as CustomFieldTypes, ak as DashboardWidget, al as Database, am as DatabaseAdapter, an as DatabaseInitArgs, ao as DatabaseTransfer, ap as DateField, aq as DepthOptions, ar as DirectUpload, as as DiskStorageOptions, at as DocumentOf, au as EasyCMS, av as EasyCMSError, aw as EmailAdapter, ax as EmailField, ay as EmailMessage, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aC as FIELD_TYPES, aD as Field, aE as FieldAccess, aF as FieldAccessFn, aG as FieldAdmin, aH as FieldError, aI as FieldRule, aJ as FieldType, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aN as FieldValidate, aO as FieldValidateContext, aP as FieldValue, aQ as FieldsInput, aR as FieldsValue, aS as FilterOptions, aT as FilterOptionsArgs, aU as FindArgs, aV as FindOptions, aW as FolderLevel, aX as FolderPermissions, aY as ForbiddenError, aZ as GlobalAccess, a_ as GlobalConfig, a$ as GlobalDocument, b0 as GlobalHooks, b1 as GlobalInput, b2 as GlobalSlug, b3 as GroupField, b4 as ImageSize, b5 as IncrementOptions, b6 as InferCollection, b7 as InferGlobal, b8 as JobConfig, b9 as JsonField, ba as Label, bb as LayoutNode, bc as LivePreview, bd as LocalizationConfig, be as Logger, bf as LoginArgs, bg as MediaDocument, bh as MediaSize, bi as MembersConfig, bj as MembersSignup, bk as MigrationInfo, bl as NavGroup, bm as NotFoundError, bn as NumberField, bo as OnRequest, bp as OnRequestArgs, bq as Operation, br as PLUGIN_API_VERSION, bs as PasswordEmail, bt as PasswordEmailArgs, bu as PasswordEmailFn, bv as PasswordLinkOptions, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bA as PreviewTarget, bB as PreviewURL, bC as QueryError, bD as ROLE_OPERATIONS, bE as RawDocument, bF as ReadOptions, bG as RelationshipField, bH as RequestContext, bI as ResolvedConfig, bJ as RichTextDocument, bK as RichTextField, bL as Role, bM as RoleOperation, bN as RolePermissions, bO as Roles, bP as RoutesConfig, bQ as ScheduledPublish, bR as SchemaError, bS as SchemaMode, bT as SelectField, bU as SelectOption, bV as Session, bW as SidebarPanel, bX as SignupArgs, bY as SignupResult, bZ as SingleSignOn, b_ as SlugField, b$ as SlugOf, c0 as SsoOutcome, c1 as SsoProviderRef, c2 as StorageAdapter, c3 as StoredFile, c4 as TextField, c5 as TextareaField, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, c9 as UpdateInput, ca as UpdateOptions, cb as UploadConfig, cc as UploadField, cd as UploadFromURLConfig, ce as UserIdentity, cf as ValidationError, cg as Version, ch as VersionSummary, ci as VersionsConfig, cj as WEBHOOK_EVENTS, ck as WebhookConfig, cl as WebhookEvent, cm as WebhookPayload, cn as Where, co as WhereOperators, cp as anyone, cq as consoleEmail, cr as consoleLogger, cs as createEasyCMS, ct as defineConfig, cu as defineFieldType, cv as definePlugin, cw as diskStorage, cx as hasRows, cy as isAdmin, cz as isHasMany, cA as isSignedIn, cB as isStaff, cC as isSystemAdmin, cD as mimeAllowedBy, cE as rowFields, cF as silentLogger, cG as uniqueWithinOf } from './config-jzFGsNL6.js';
-export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-C19Bt8ux.js';
-export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-CMA1LIq7.js';
+import { P as PaginatedDocs, I as ID, E as EmailSetting } from './config-Dgs6FE0S.js';
+export { A as ADAPTER_API_VERSION, a as ADMIN_ICONS, b as Access, c as AccessArgs, d as AccessOptions, e as AdminBrand, f as AdminCommand, g as AdminComponent, h as AdminConfig, i as AdminFieldArgs, j as AdminIcon, k as AdminLocale, l as AdminPage, m as AdminRole, n as AdminRoleChange, o as AdminRoleField, p as AdminRoleTarget, q as AdminRoleView, r as AdminRoles, s as AdminSso, t as AdminSwitcher, u as AdminViewAccess, v as AfterChangeHook, w as AfterDeleteHook, x as AfterReadHook, y as ApiKeyContext, z as ApiKeyGlobalOperation, B as ApiKeyOperation, C as ApiKeyPermissions, D as ArrayField, F as AuditChange, G as AuditConfig, H as AuditEntry, J as AuditLog, K as AuditPage, L as AuditVerification, M as Auth, N as AuthConfig, O as AuthProvider, Q as AuthProviderProfile, R as AuthProviderRequest, S as AuthUser, T as BackupsConfig, U as BeforeChangeHook, V as BeforeDeleteHook, W as BeforeValidateHook, X as Block, Y as BlocksField, Z as BooleanField, _ as BuiltinApiKeysCollection, $ as BuiltinMediaCollection, a0 as BuiltinMediaFoldersCollection, a1 as BuiltinUsersCollection, a2 as BundleHints, a3 as CliCommand, a4 as CollectionAccess, a5 as CollectionAdmin, a6 as CollectionConfig, a7 as CollectionDocument, a8 as CollectionHooks, a9 as CollectionListAdmin, aa as CollectionSlug, ab as Config, ac as ConfigError, ad as ConfigIssue, ae as ContainerAdmin, af as CreateEasyCMSOptions, ag as CreateInput, ah as CreateMigrationResult, ai as CustomField, aj as CustomFieldTypes, ak as DashboardWidget, al as Database, am as DatabaseAdapter, an as DatabaseInitArgs, ao as DatabaseTransfer, ap as DateField, aq as DepthOptions, ar as DirectUpload, as as DiskStorageOptions, at as DocumentOf, au as EasyCMS, av as EasyCMSError, aw as EmailAdapter, ax as EmailField, ay as EmailMessage, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aC as FIELD_TYPES, aD as Field, aE as FieldAccess, aF as FieldAccessFn, aG as FieldAdmin, aH as FieldError, aI as FieldRule, aJ as FieldType, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aN as FieldValidate, aO as FieldValidateContext, aP as FieldValue, aQ as FieldsInput, aR as FieldsValue, aS as FilterOptions, aT as FilterOptionsArgs, aU as FindArgs, aV as FindOptions, aW as FolderLevel, aX as FolderPermissions, aY as ForbiddenError, aZ as GlobalAccess, a_ as GlobalConfig, a$ as GlobalDocument, b0 as GlobalHooks, b1 as GlobalInput, b2 as GlobalSlug, b3 as GroupField, b4 as ImageSize, b5 as IncrementOptions, b6 as InferCollection, b7 as InferGlobal, b8 as JobConfig, b9 as JsonField, ba as Label, bb as LayoutNode, bc as LivePreview, bd as LocalizationConfig, be as Logger, bf as LoginArgs, bg as MediaDocument, bh as MediaSize, bi as MembersConfig, bj as MembersSignup, bk as MigrationInfo, bl as NavGroup, bm as NotFoundError, bn as NumberField, bo as OnRequest, bp as OnRequestArgs, bq as Operation, br as PLUGIN_API_VERSION, bs as PasswordEmail, bt as PasswordEmailArgs, bu as PasswordEmailFn, bv as PasswordLinkOptions, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bA as PreviewTarget, bB as PreviewURL, bC as QueryError, bD as ROLE_OPERATIONS, bE as RawDocument, bF as ReadOptions, bG as RelationshipField, bH as RequestContext, bI as ResolvedConfig, bJ as RichTextDocument, bK as RichTextField, bL as Role, bM as RoleOperation, bN as RolePermissions, bO as Roles, bP as RoutesConfig, bQ as ScheduledPublish, bR as SchemaError, bS as SchemaMode, bT as SelectField, bU as SelectOption, bV as Session, bW as SidebarPanel, bX as SignupArgs, bY as SignupResult, bZ as SingleSignOn, b_ as SlugField, b$ as SlugOf, c0 as SsoOutcome, c1 as SsoProviderRef, c2 as StorageAdapter, c3 as StoredFile, c4 as TextField, c5 as TextareaField, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, c9 as UpdateInput, ca as UpdateOptions, cb as UploadConfig, cc as UploadField, cd as UploadFromURLConfig, ce as UserIdentity, cf as ValidationError, cg as Version, ch as VersionSummary, ci as VersionsConfig, cj as WEBHOOK_EVENTS, ck as WebhookConfig, cl as WebhookEvent, cm as WebhookPayload, cn as Where, co as WhereOperators, cp as anyone, cq as consoleEmail, cr as consoleLogger, cs as createEasyCMS, ct as defineConfig, cu as defineFieldType, cv as definePlugin, cw as diskStorage, cx as hasRows, cy as isAdmin, cz as isHasMany, cA as isSignedIn, cB as isStaff, cC as isSystemAdmin, cD as mimeAllowedBy, cE as rowFields, cF as silentLogger, cG as uniqueWithinOf } from './config-Dgs6FE0S.js';
+export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-8hrkYMuR.js';
+export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-CcQjkj5Q.js';
 export { FieldCondition, matchesCondition } from './conditions.js';
 
 type DeliveryKind = 'webhook' | 'email';

package/dist/index.js

@@ -23,7 +23,7 @@ import {
   sharedEasyCMS,
   silentLogger,
   slugify
-} from "./chunk-HTE5O3EG.js";
+} from "./chunk-LN4M4BUP.js";
 import {
   matchesCondition
 } from "./chunk-U266LV4M.js";

package/dist/internal.d.ts

@@ -1,6 +1,6 @@
-import { ab as Config, al as Database, bl as NavGroup, a6 as CollectionConfig, I as ID, bE as RawDocument, aD as Field, bI as ResolvedConfig, ad as ConfigIssue } from './config-jzFGsNL6.js';
-export { cH as API_KEYS, cI as API_KEY_GLOBAL_OPERATIONS, cJ as API_KEY_OPERATIONS, cK as DEFAULT_MAX_VERSIONS, cL as DEFAULT_PASSWORD_EMAILS, cM as FIELD_TYPE_BASES, cN as FOLDER_LEVELS, cO as MediaFolders, cP as SSO_COOKIE, cQ as codeOfStatus, cx as hasRows, cz as isHasMany, cR as keyAllows, cD as mimeAllowedBy, cE as rowFields, cG as uniqueWithinOf } from './config-jzFGsNL6.js';
-export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as fillMissing, q as findConfigFile, t as forwardedClientIp, u as generateSlugs, v as importConfig, w as mergeForUpdate, x as parseId, y as platformClientIp, z as readCookie, E as validateFields, F as writeBackupFile } from './handler-CMA1LIq7.js';
+import { ab as Config, al as Database, bl as NavGroup, a6 as CollectionConfig, I as ID, bE as RawDocument, aD as Field, bI as ResolvedConfig, ad as ConfigIssue } from './config-Dgs6FE0S.js';
+export { cH as API_KEYS, cI as API_KEY_GLOBAL_OPERATIONS, cJ as API_KEY_OPERATIONS, cK as DEFAULT_MAX_VERSIONS, cL as DEFAULT_PASSWORD_EMAILS, cM as FIELD_TYPE_BASES, cN as FOLDER_LEVELS, cO as MediaFolders, cP as SSO_COOKIE, cQ as codeOfStatus, cx as hasRows, cz as isHasMany, cR as keyAllows, cD as mimeAllowedBy, cE as rowFields, cG as uniqueWithinOf } from './config-Dgs6FE0S.js';
+export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as fillMissing, q as findConfigFile, t as forwardedClientIp, u as generateSlugs, v as importConfig, w as mergeForUpdate, x as parseId, y as platformClientIp, z as readCookie, E as validateFields, F as writeBackupFile } from './handler-CcQjkj5Q.js';
 export { conditionIssues } from './conditions.js';
 
 /** The session cookie the REST API sets at login. */

package/dist/internal.js

@@ -52,7 +52,7 @@ import {
   verifyPassword,
   verifyTurnstile,
   writeBackupFile
-} from "./chunk-HTE5O3EG.js";
+} from "./chunk-LN4M4BUP.js";
 import {
   conditionIssues
 } from "./chunk-U266LV4M.js";

package/dist/{plugin-C19Bt8ux.d.ts → plugin-8hrkYMuR.d.ts}

@@ -1,4 +1,4 @@
-import { ba as Label, aD as Field, I as ID, k as AdminLocale, t as AdminSwitcher, c1 as SsoProviderRef } from './config-jzFGsNL6.js';
+import { ba as Label, aD as Field, I as ID, k as AdminLocale, t as AdminSwitcher, c1 as SsoProviderRef } from './config-Dgs6FE0S.js';
 import { FieldCondition } from './conditions.js';
 
 /** A Web Component from an admin module, with its `props` (plain JSON). */

package/dist/plugin.d.ts

@@ -1,3 +1,3 @@
-export { a as ADMIN_ICONS, g as AdminComponent, j as AdminIcon, S as AuthUser, a3 as CliCommand, a4 as CollectionAccess, a6 as CollectionConfig, ab as Config, ac as ConfigError, ak as DashboardWidget, av as EasyCMSError, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aD as Field, aE as FieldAccess, aH as FieldError, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aY as ForbiddenError, a_ as GlobalConfig, I as ID, b8 as JobConfig, ba as Label, bl as NavGroup, bm as NotFoundError, bo as OnRequest, bp as OnRequestArgs, br as PLUGIN_API_VERSION, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bC as QueryError, bH as RequestContext, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, cf as ValidationError, cn as Where, cu as defineFieldType, cv as definePlugin } from './config-jzFGsNL6.js';
-export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-C19Bt8ux.js';
+export { a as ADMIN_ICONS, g as AdminComponent, j as AdminIcon, S as AuthUser, a3 as CliCommand, a4 as CollectionAccess, a6 as CollectionConfig, ab as Config, ac as ConfigError, ak as DashboardWidget, av as EasyCMSError, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aD as Field, aE as FieldAccess, aH as FieldError, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aY as ForbiddenError, a_ as GlobalConfig, I as ID, b8 as JobConfig, ba as Label, bl as NavGroup, bm as NotFoundError, bo as OnRequest, bp as OnRequestArgs, br as PLUGIN_API_VERSION, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bC as QueryError, bH as RequestContext, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, cf as ValidationError, cn as Where, cu as defineFieldType, cv as definePlugin } from './config-Dgs6FE0S.js';
+export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-8hrkYMuR.js';
 import './conditions.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.61.0",
+  "version": "0.63.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",