@easy-cms/core 0.62.0 → 0.63.0

package/dist/{chunk-CX7R6QBJ.js → chunk-LN4M4BUP.js}

@@ -1169,11 +1169,13 @@ function safeEqual(a, b) {
   const right = Buffer.from(b);
   return left.length === right.length && timingSafeEqual4(left, right);
 }
-function signPreviewToken(secret, target, expiresAt) {
+function signPreviewToken(secret, target, expiresAt, user) {
   const payload = Buffer.from(
-    JSON.stringify(
-      "global" in target ? { g: target.global, e: expiresAt } : { c: target.collection, i: target.id, e: expiresAt }
-    )
+    JSON.stringify({
+      ..."global" in target ? { g: target.global } : { c: target.collection, i: target.id },
+      e: expiresAt,
+      ...user !== void 0 ? { u: user } : {}
+    })
   ).toString("base64url");
   return `${payload}.${hmac(secret, `preview:${payload}`)}`;
 }
@@ -1185,9 +1187,10 @@ function verifyPreviewToken(secret, token, now = Date.now()) {
   try {
     const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
     if (typeof data.e !== "number" || data.e <= now) return null;
-    if (typeof data.g === "string") return { global: data.g, expiresAt: data.e };
+    const user = typeof data.u === "string" ? { user: data.u } : {};
+    if (typeof data.g === "string") return { global: data.g, expiresAt: data.e, ...user };
     if (typeof data.c === "string" && typeof data.i === "string")
-      return { collection: data.c, id: data.i, expiresAt: data.e };
+      return { collection: data.c, id: data.i, expiresAt: data.e, ...user };
     return null;
   } catch {
     return null;
@@ -1934,6 +1937,12 @@ var Auth = class {
     if (!user || user.active === false) return null;
     return this.toAuthUser(user);
   }
+  /** An active user by id, as requests see them; `null` when deleted or deactivated. @internal */
+  async activeUser(id) {
+    const user = await this.db.findById({ collection: USERS, id });
+    if (!user || user.active === false) return null;
+    return this.toAuthUser(user);
+  }
   /** The CSRF token clients must echo for a signed session token. @internal */
   csrfFor(signedToken) {
     const token = unsignToken(this.config.secret, signedToken);
@@ -7119,18 +7128,23 @@ var EasyCMS = class {
   }
   /**
    * How many documents use any of these files in a top-level upload field (rich text and fields
-   * inside groups, arrays and blocks are not counted). Drafts count too.
+   * inside groups, arrays and blocks are not counted). Drafts count too. With
+   * `overrideAccess: false`, only documents the user may read.
    */
-  async mediaUsage(ids) {
+  async mediaUsage(ids, options = {}) {
     if (ids.length === 0) return 0;
     let count = 0;
     for (const config of this.config.collections) {
       if (INTERNAL_COLLECTIONS.has(config.slug)) continue;
       for (const field of config.fields) {
         if (field.type !== "upload") continue;
-        count += await this.db.count({
-          collection: config.slug,
-          where: { [field.name]: { in: [...ids] } }
+        count += await this.count(config.slug, {
+          ...options,
+          where: { [field.name]: { in: [...ids] } },
+          draft: true
+        }).catch((error) => {
+          if (error instanceof ForbiddenError || error instanceof UnauthorizedError) return 0;
+          throw error;
         });
       }
     }
@@ -7381,12 +7395,15 @@ var EasyCMS = class {
   /**
    * A token that lets a page read one document's current draft for a while (default one hour),
    * without a login: `GET /api/cms/:collection/:id?preview=<token>`. The admin adds one to the
-   * preview URL as `easy-cms-preview`, for sites on another origin.
+   * preview URL as `easy-cms-preview`, for sites on another origin. With `user`, the page reads
+   * it with that user's access (fields they can't read are left out; a deactivated user's token
+   * stops working); without, with full access.
    */
   createPreviewToken(target, options = {}) {
     const seconds = options.expiresIn ?? 60 * 60;
     const normalized = "global" in target ? target : { collection: target.collection, id: String(target.id) };
-    return signPreviewToken(this.config.secret, normalized, Date.now() + seconds * 1e3);
+    const user = options.user ? String(options.user.id) : void 0;
+    return signPreviewToken(this.config.secret, normalized, Date.now() + seconds * 1e3, user);
   }
   /** What a preview token opens, or `null` when it is invalid or expired. */
   verifyPreviewToken(token) {
@@ -7846,7 +7863,8 @@ var EasyCMS = class {
     const check3 = (operation) => this.checkDocumentAccess(config, operation, guard, parsed, void 0).then(
       () => true,
       (error) => {
-        if (error instanceof ForbiddenError || error instanceof UnauthorizedError) return false;
+        if (error instanceof ForbiddenError || error instanceof UnauthorizedError || error instanceof NotFoundError)
+          return false;
         throw error;
       }
     );
@@ -8315,7 +8333,38 @@ var EasyCMS = class {
     await this.checkQueryFields(config, guard, where);
     return andWhere(andWhere(where, access), own);
   }
+  /**
+   * Throws unless the caller may update or delete this document. A user who may not even read
+   * it gets `NotFoundError`, as for an id that doesn't exist: a 403 would tell it does.
+   */
   async checkDocumentAccess(config, operation, guard, id, data) {
+    await this.hidingDenied(
+      config.slug,
+      guard,
+      id,
+      () => this.documentAccess(config, operation, guard, id, data)
+    );
+  }
+  /** Runs a check; a `ForbiddenError` for a document the user can't read becomes a 404. */
+  async hidingDenied(collection2, guard, id, check3) {
+    try {
+      await check3();
+    } catch (error) {
+      if (error instanceof ForbiddenError && !await this.mayRead(collection2, guard, id))
+        throw new NotFoundError(collection2, String(id));
+      throw error;
+    }
+  }
+  async mayRead(collection2, guard, id) {
+    const config = this.collection(collection2);
+    try {
+      const where = await this.readWhere(config, guard, { id: { equals: id } });
+      return await this.db.count({ collection: collection2, where }) > 0;
+    } catch {
+      return false;
+    }
+  }
+  async documentAccess(config, operation, guard, id, data) {
     if (!guard.enforce) return;
     const own = await this.checkGrant(guard, { collection: config.slug }, operation);
     const allowed2 = await evaluateAccess(config.access?.[operation], {
@@ -8382,13 +8431,15 @@ var EasyCMS = class {
   }
   /** `checkGrant` for one document: a role limited to its own documents must own it. */
   async checkDocumentGrant(guard, collection2, operation, id) {
-    const own = await this.checkGrant(guard, { collection: collection2 }, operation);
-    if (own === true) return;
-    const matches2 = await this.db.count({
-      collection: collection2,
-      where: andWhere(own, { id: { equals: id } })
+    await this.hidingDenied(collection2, guard, id, async () => {
+      const own = await this.checkGrant(guard, { collection: collection2 }, operation);
+      if (own === true) return;
+      const matches2 = await this.db.count({
+        collection: collection2,
+        where: andWhere(own, { id: { equals: id } })
+      });
+      if (matches2 === 0) throw deny(guard.user);
     });
-    if (matches2 === 0) throw deny(guard.user);
   }
   /** Runs afterRead hooks, populates relationships and removes what the caller may not see. */
   async output(config, docs, guard, options) {
@@ -9042,7 +9093,7 @@ async function readAdminModule(cms, index) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.62.0" : "0.0.0-dev";
+var VERSION = true ? "0.63.0" : "0.0.0-dev";
 
 // src/rest/admin-deliveries.ts
 var PER_PAGE = 50;
@@ -10406,7 +10457,12 @@ async function route(cms, ctx, method, path, options) {
     if (!ctx.user || ctx.user.apiKey) throw new UnauthorizedError();
     if (method !== "GET") throw methodNotAllowed(ctx, "GET");
     const ids = (ctx.url.searchParams.get("ids") ?? "").split(",").map((id2) => parseId(id2)).filter((id2) => id2 !== void 0);
-    return { body: { count: await cms.mediaUsage(ids) } };
+    const count = await cms.mediaUsage(ids, {
+      overrideAccess: false,
+      user: ctx.user,
+      context: ctx.context
+    });
+    return { body: { count } };
   }
   if (first === "admin" && second === "roles") {
     if (!ctx.user) throw new UnauthorizedError();
@@ -10551,9 +10607,10 @@ async function route(cms, ctx, method, path, options) {
     if (third !== void 0) return globalAction(cms, ctx, method, second, segments.slice(2));
     if (method === "GET") {
       if (ctx.url.searchParams.has("preview")) {
-        requirePreview(cms, ctx, { global: second });
+        const as = await requirePreview(cms, ctx, { global: second });
         return {
           body: await cms.findGlobal(second, {
+            ...as,
             ...parseDepth(ctx.url),
             ...parseLocale(ctx.url),
             draft: true
@@ -10662,8 +10719,9 @@ async function route(cms, ctx, method, path, options) {
   }
   const id = second;
   if (method === "GET" && ctx.url.searchParams.has("preview")) {
-    requirePreview(cms, ctx, { collection: collection2, id });
+    const as = await requirePreview(cms, ctx, { collection: collection2, id });
     const doc = await cms.findById(collection2, id, {
+      ...as,
       ...parseDepth(ctx.url),
       ...parseLocale(ctx.url),
       draft: true
@@ -10742,7 +10800,7 @@ async function documentAction(cms, ctx, method, collection2, id, path) {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
     const body = await readJson(ctx.request);
     const result = await cms.preview(collection2, id, body, { ...access, ...depth });
-    const token = cms.createPreviewToken({ collection: collection2, id });
+    const token = cms.createPreviewToken({ collection: collection2, id }, { user: ctx.user });
     return { body: { ...result, url: result.url && withPreviewToken(result.url, token) } };
   }
   if (path.length === 1 && (action === "unpublish" || action === "discard-draft")) {
@@ -10792,7 +10850,7 @@ async function globalAction(cms, ctx, method, slug2, path) {
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
     const body = await readJson(ctx.request);
     const result = await cms.previewGlobal(slug2, body, { ...access, ...depth });
-    const token = cms.createPreviewToken({ global: slug2 });
+    const token = cms.createPreviewToken({ global: slug2 }, { user: ctx.user });
     return { body: { ...result, url: result.url && withPreviewToken(result.url, token) } };
   }
   if (path.length === 1 && (action === "unpublish" || action === "discard-draft")) {
@@ -10831,10 +10889,16 @@ function withPreviewToken(url, token) {
   const separator = base.includes("?") ? "&" : "?";
   return `${base}${separator}${PREVIEW_PARAM}=${encodeURIComponent(token)}${fragment}`;
 }
-function requirePreview(cms, ctx, target) {
+async function requirePreview(cms, ctx, target) {
   const opened = cms.verifyPreviewToken(ctx.url.searchParams.get("preview"));
   const matches2 = opened !== null && ("global" in target ? "global" in opened && opened.global === target.global : "collection" in opened && opened.collection === target.collection && opened.id === target.id);
   if (!matches2) throw new UnauthorizedError("Invalid or expired preview token");
+  if (opened.user === void 0) return {};
+  const id = parseId(opened.user);
+  const issuer = id === void 0 ? null : await cms.auth.activeUser(id);
+  if (!issuer) throw new UnauthorizedError("Invalid or expired preview token");
+  const { user, context } = await cms.applyOnRequest(ctx.request.headers, ctx.url, issuer);
+  return { overrideAccess: false, user, context };
 }
 function parsePage(url) {
   const { page, limit } = parseListQuery(url);

package/dist/{config-jzFGsNL6.d.ts → config-Dgs6FE0S.d.ts}

@@ -1746,9 +1746,10 @@ declare class EasyCMS<C extends Config = Config> {
     private mediaSignature;
     /**
      * How many documents use any of these files in a top-level upload field (rich text and fields
-     * inside groups, arrays and blocks are not counted). Drafts count too.
+     * inside groups, arrays and blocks are not counted). Drafts count too. With
+     * `overrideAccess: false`, only documents the user may read.
      */
-    mediaUsage(ids: readonly ID[]): Promise<number>;
+    mediaUsage(ids: readonly ID[], options?: AccessOptions): Promise<number>;
     /** The storage for public files, or for private ones. */
     storageFor(isPrivate: boolean): StorageAdapter;
     /**
@@ -1811,7 +1812,9 @@ declare class EasyCMS<C extends Config = Config> {
     /**
      * A token that lets a page read one document's current draft for a while (default one hour),
      * without a login: `GET /api/cms/:collection/:id?preview=<token>`. The admin adds one to the
-     * preview URL as `easy-cms-preview`, for sites on another origin.
+     * preview URL as `easy-cms-preview`, for sites on another origin. With `user`, the page reads
+     * it with that user's access (fields they can't read are left out; a deactivated user's token
+     * stops working); without, with full access.
      */
     createPreviewToken(target: {
         collection: string;
@@ -1820,10 +1823,12 @@ declare class EasyCMS<C extends Config = Config> {
         global: string;
     }, options?: {
         expiresIn?: number;
+        user?: AuthUser | null;
     }): string;
     /** What a preview token opens, or `null` when it is invalid or expired. */
     verifyPreviewToken(token: string | null | undefined): (PreviewTarget & {
         expiresAt: number;
+        user?: string;
     }) | null;
     /** Live preview of a global. See `preview`. */
     previewGlobal<S extends GSlug<C>>(slug: S, data: Record<string, unknown>, options?: DepthOptions): Promise<LivePreview<GDoc<C, S>>>;
@@ -1992,7 +1997,15 @@ declare class EasyCMS<C extends Config = Config> {
     private checkGrant;
     /** The query constraint read access adds, or `undefined` when there is none. Throws when denied. */
     private readWhere;
+    /**
+     * Throws unless the caller may update or delete this document. A user who may not even read
+     * it gets `NotFoundError`, as for an id that doesn't exist: a 403 would tell it does.
+     */
     private checkDocumentAccess;
+    /** Runs a check; a `ForbiddenError` for a document the user can't read becomes a 404. */
+    private hidingDenied;
+    private mayRead;
+    private documentAccess;
     private checkGlobalAccess;
     private fieldChecker;
     /**

package/dist/{handler-CMA1LIq7.d.ts → handler-CcQjkj5Q.d.ts}

@@ -1,4 +1,4 @@
-import { I as ID, ab as Config, au as EasyCMS, bd as LocalizationConfig, aD as Field, aH as FieldError, aS as FilterOptions, af as CreateEasyCMSOptions, bI as ResolvedConfig } from './config-jzFGsNL6.js';
+import { I as ID, ab as Config, au as EasyCMS, bd as LocalizationConfig, aD as Field, aH as FieldError, aS as FilterOptions, af as CreateEasyCMSOptions, bI as ResolvedConfig } from './config-Dgs6FE0S.js';
 
 type BackupState = 'pending' | 'running' | 'done' | 'failed';
 /** One backup as the admin shows it (`GET <api>/admin/backups`). */

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { P as PaginatedDocs, I as ID, E as EmailSetting } from './config-jzFGsNL6.js';
-export { A as ADAPTER_API_VERSION, a as ADMIN_ICONS, b as Access, c as AccessArgs, d as AccessOptions, e as AdminBrand, f as AdminCommand, g as AdminComponent, h as AdminConfig, i as AdminFieldArgs, j as AdminIcon, k as AdminLocale, l as AdminPage, m as AdminRole, n as AdminRoleChange, o as AdminRoleField, p as AdminRoleTarget, q as AdminRoleView, r as AdminRoles, s as AdminSso, t as AdminSwitcher, u as AdminViewAccess, v as AfterChangeHook, w as AfterDeleteHook, x as AfterReadHook, y as ApiKeyContext, z as ApiKeyGlobalOperation, B as ApiKeyOperation, C as ApiKeyPermissions, D as ArrayField, F as AuditChange, G as AuditConfig, H as AuditEntry, J as AuditLog, K as AuditPage, L as AuditVerification, M as Auth, N as AuthConfig, O as AuthProvider, Q as AuthProviderProfile, R as AuthProviderRequest, S as AuthUser, T as BackupsConfig, U as BeforeChangeHook, V as BeforeDeleteHook, W as BeforeValidateHook, X as Block, Y as BlocksField, Z as BooleanField, _ as BuiltinApiKeysCollection, $ as BuiltinMediaCollection, a0 as BuiltinMediaFoldersCollection, a1 as BuiltinUsersCollection, a2 as BundleHints, a3 as CliCommand, a4 as CollectionAccess, a5 as CollectionAdmin, a6 as CollectionConfig, a7 as CollectionDocument, a8 as CollectionHooks, a9 as CollectionListAdmin, aa as CollectionSlug, ab as Config, ac as ConfigError, ad as ConfigIssue, ae as ContainerAdmin, af as CreateEasyCMSOptions, ag as CreateInput, ah as CreateMigrationResult, ai as CustomField, aj as CustomFieldTypes, ak as DashboardWidget, al as Database, am as DatabaseAdapter, an as DatabaseInitArgs, ao as DatabaseTransfer, ap as DateField, aq as DepthOptions, ar as DirectUpload, as as DiskStorageOptions, at as DocumentOf, au as EasyCMS, av as EasyCMSError, aw as EmailAdapter, ax as EmailField, ay as EmailMessage, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aC as FIELD_TYPES, aD as Field, aE as FieldAccess, aF as FieldAccessFn, aG as FieldAdmin, aH as FieldError, aI as FieldRule, aJ as FieldType, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aN as FieldValidate, aO as FieldValidateContext, aP as FieldValue, aQ as FieldsInput, aR as FieldsValue, aS as FilterOptions, aT as FilterOptionsArgs, aU as FindArgs, aV as FindOptions, aW as FolderLevel, aX as FolderPermissions, aY as ForbiddenError, aZ as GlobalAccess, a_ as GlobalConfig, a$ as GlobalDocument, b0 as GlobalHooks, b1 as GlobalInput, b2 as GlobalSlug, b3 as GroupField, b4 as ImageSize, b5 as IncrementOptions, b6 as InferCollection, b7 as InferGlobal, b8 as JobConfig, b9 as JsonField, ba as Label, bb as LayoutNode, bc as LivePreview, bd as LocalizationConfig, be as Logger, bf as LoginArgs, bg as MediaDocument, bh as MediaSize, bi as MembersConfig, bj as MembersSignup, bk as MigrationInfo, bl as NavGroup, bm as NotFoundError, bn as NumberField, bo as OnRequest, bp as OnRequestArgs, bq as Operation, br as PLUGIN_API_VERSION, bs as PasswordEmail, bt as PasswordEmailArgs, bu as PasswordEmailFn, bv as PasswordLinkOptions, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bA as PreviewTarget, bB as PreviewURL, bC as QueryError, bD as ROLE_OPERATIONS, bE as RawDocument, bF as ReadOptions, bG as RelationshipField, bH as RequestContext, bI as ResolvedConfig, bJ as RichTextDocument, bK as RichTextField, bL as Role, bM as RoleOperation, bN as RolePermissions, bO as Roles, bP as RoutesConfig, bQ as ScheduledPublish, bR as SchemaError, bS as SchemaMode, bT as SelectField, bU as SelectOption, bV as Session, bW as SidebarPanel, bX as SignupArgs, bY as SignupResult, bZ as SingleSignOn, b_ as SlugField, b$ as SlugOf, c0 as SsoOutcome, c1 as SsoProviderRef, c2 as StorageAdapter, c3 as StoredFile, c4 as TextField, c5 as TextareaField, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, c9 as UpdateInput, ca as UpdateOptions, cb as UploadConfig, cc as UploadField, cd as UploadFromURLConfig, ce as UserIdentity, cf as ValidationError, cg as Version, ch as VersionSummary, ci as VersionsConfig, cj as WEBHOOK_EVENTS, ck as WebhookConfig, cl as WebhookEvent, cm as WebhookPayload, cn as Where, co as WhereOperators, cp as anyone, cq as consoleEmail, cr as consoleLogger, cs as createEasyCMS, ct as defineConfig, cu as defineFieldType, cv as definePlugin, cw as diskStorage, cx as hasRows, cy as isAdmin, cz as isHasMany, cA as isSignedIn, cB as isStaff, cC as isSystemAdmin, cD as mimeAllowedBy, cE as rowFields, cF as silentLogger, cG as uniqueWithinOf } from './config-jzFGsNL6.js';
-export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-C19Bt8ux.js';
-export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-CMA1LIq7.js';
+import { P as PaginatedDocs, I as ID, E as EmailSetting } from './config-Dgs6FE0S.js';
+export { A as ADAPTER_API_VERSION, a as ADMIN_ICONS, b as Access, c as AccessArgs, d as AccessOptions, e as AdminBrand, f as AdminCommand, g as AdminComponent, h as AdminConfig, i as AdminFieldArgs, j as AdminIcon, k as AdminLocale, l as AdminPage, m as AdminRole, n as AdminRoleChange, o as AdminRoleField, p as AdminRoleTarget, q as AdminRoleView, r as AdminRoles, s as AdminSso, t as AdminSwitcher, u as AdminViewAccess, v as AfterChangeHook, w as AfterDeleteHook, x as AfterReadHook, y as ApiKeyContext, z as ApiKeyGlobalOperation, B as ApiKeyOperation, C as ApiKeyPermissions, D as ArrayField, F as AuditChange, G as AuditConfig, H as AuditEntry, J as AuditLog, K as AuditPage, L as AuditVerification, M as Auth, N as AuthConfig, O as AuthProvider, Q as AuthProviderProfile, R as AuthProviderRequest, S as AuthUser, T as BackupsConfig, U as BeforeChangeHook, V as BeforeDeleteHook, W as BeforeValidateHook, X as Block, Y as BlocksField, Z as BooleanField, _ as BuiltinApiKeysCollection, $ as BuiltinMediaCollection, a0 as BuiltinMediaFoldersCollection, a1 as BuiltinUsersCollection, a2 as BundleHints, a3 as CliCommand, a4 as CollectionAccess, a5 as CollectionAdmin, a6 as CollectionConfig, a7 as CollectionDocument, a8 as CollectionHooks, a9 as CollectionListAdmin, aa as CollectionSlug, ab as Config, ac as ConfigError, ad as ConfigIssue, ae as ContainerAdmin, af as CreateEasyCMSOptions, ag as CreateInput, ah as CreateMigrationResult, ai as CustomField, aj as CustomFieldTypes, ak as DashboardWidget, al as Database, am as DatabaseAdapter, an as DatabaseInitArgs, ao as DatabaseTransfer, ap as DateField, aq as DepthOptions, ar as DirectUpload, as as DiskStorageOptions, at as DocumentOf, au as EasyCMS, av as EasyCMSError, aw as EmailAdapter, ax as EmailField, ay as EmailMessage, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aC as FIELD_TYPES, aD as Field, aE as FieldAccess, aF as FieldAccessFn, aG as FieldAdmin, aH as FieldError, aI as FieldRule, aJ as FieldType, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aN as FieldValidate, aO as FieldValidateContext, aP as FieldValue, aQ as FieldsInput, aR as FieldsValue, aS as FilterOptions, aT as FilterOptionsArgs, aU as FindArgs, aV as FindOptions, aW as FolderLevel, aX as FolderPermissions, aY as ForbiddenError, aZ as GlobalAccess, a_ as GlobalConfig, a$ as GlobalDocument, b0 as GlobalHooks, b1 as GlobalInput, b2 as GlobalSlug, b3 as GroupField, b4 as ImageSize, b5 as IncrementOptions, b6 as InferCollection, b7 as InferGlobal, b8 as JobConfig, b9 as JsonField, ba as Label, bb as LayoutNode, bc as LivePreview, bd as LocalizationConfig, be as Logger, bf as LoginArgs, bg as MediaDocument, bh as MediaSize, bi as MembersConfig, bj as MembersSignup, bk as MigrationInfo, bl as NavGroup, bm as NotFoundError, bn as NumberField, bo as OnRequest, bp as OnRequestArgs, bq as Operation, br as PLUGIN_API_VERSION, bs as PasswordEmail, bt as PasswordEmailArgs, bu as PasswordEmailFn, bv as PasswordLinkOptions, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bA as PreviewTarget, bB as PreviewURL, bC as QueryError, bD as ROLE_OPERATIONS, bE as RawDocument, bF as ReadOptions, bG as RelationshipField, bH as RequestContext, bI as ResolvedConfig, bJ as RichTextDocument, bK as RichTextField, bL as Role, bM as RoleOperation, bN as RolePermissions, bO as Roles, bP as RoutesConfig, bQ as ScheduledPublish, bR as SchemaError, bS as SchemaMode, bT as SelectField, bU as SelectOption, bV as Session, bW as SidebarPanel, bX as SignupArgs, bY as SignupResult, bZ as SingleSignOn, b_ as SlugField, b$ as SlugOf, c0 as SsoOutcome, c1 as SsoProviderRef, c2 as StorageAdapter, c3 as StoredFile, c4 as TextField, c5 as TextareaField, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, c9 as UpdateInput, ca as UpdateOptions, cb as UploadConfig, cc as UploadField, cd as UploadFromURLConfig, ce as UserIdentity, cf as ValidationError, cg as Version, ch as VersionSummary, ci as VersionsConfig, cj as WEBHOOK_EVENTS, ck as WebhookConfig, cl as WebhookEvent, cm as WebhookPayload, cn as Where, co as WhereOperators, cp as anyone, cq as consoleEmail, cr as consoleLogger, cs as createEasyCMS, ct as defineConfig, cu as defineFieldType, cv as definePlugin, cw as diskStorage, cx as hasRows, cy as isAdmin, cz as isHasMany, cA as isSignedIn, cB as isStaff, cC as isSystemAdmin, cD as mimeAllowedBy, cE as rowFields, cF as silentLogger, cG as uniqueWithinOf } from './config-Dgs6FE0S.js';
+export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-8hrkYMuR.js';
+export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-CcQjkj5Q.js';
 export { FieldCondition, matchesCondition } from './conditions.js';
 
 type DeliveryKind = 'webhook' | 'email';

package/dist/index.js

@@ -23,7 +23,7 @@ import {
   sharedEasyCMS,
   silentLogger,
   slugify
-} from "./chunk-CX7R6QBJ.js";
+} from "./chunk-LN4M4BUP.js";
 import {
   matchesCondition
 } from "./chunk-U266LV4M.js";

package/dist/internal.d.ts

@@ -1,6 +1,6 @@
-import { ab as Config, al as Database, bl as NavGroup, a6 as CollectionConfig, I as ID, bE as RawDocument, aD as Field, bI as ResolvedConfig, ad as ConfigIssue } from './config-jzFGsNL6.js';
-export { cH as API_KEYS, cI as API_KEY_GLOBAL_OPERATIONS, cJ as API_KEY_OPERATIONS, cK as DEFAULT_MAX_VERSIONS, cL as DEFAULT_PASSWORD_EMAILS, cM as FIELD_TYPE_BASES, cN as FOLDER_LEVELS, cO as MediaFolders, cP as SSO_COOKIE, cQ as codeOfStatus, cx as hasRows, cz as isHasMany, cR as keyAllows, cD as mimeAllowedBy, cE as rowFields, cG as uniqueWithinOf } from './config-jzFGsNL6.js';
-export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as fillMissing, q as findConfigFile, t as forwardedClientIp, u as generateSlugs, v as importConfig, w as mergeForUpdate, x as parseId, y as platformClientIp, z as readCookie, E as validateFields, F as writeBackupFile } from './handler-CMA1LIq7.js';
+import { ab as Config, al as Database, bl as NavGroup, a6 as CollectionConfig, I as ID, bE as RawDocument, aD as Field, bI as ResolvedConfig, ad as ConfigIssue } from './config-Dgs6FE0S.js';
+export { cH as API_KEYS, cI as API_KEY_GLOBAL_OPERATIONS, cJ as API_KEY_OPERATIONS, cK as DEFAULT_MAX_VERSIONS, cL as DEFAULT_PASSWORD_EMAILS, cM as FIELD_TYPE_BASES, cN as FOLDER_LEVELS, cO as MediaFolders, cP as SSO_COOKIE, cQ as codeOfStatus, cx as hasRows, cz as isHasMany, cR as keyAllows, cD as mimeAllowedBy, cE as rowFields, cG as uniqueWithinOf } from './config-Dgs6FE0S.js';
+export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as fillMissing, q as findConfigFile, t as forwardedClientIp, u as generateSlugs, v as importConfig, w as mergeForUpdate, x as parseId, y as platformClientIp, z as readCookie, E as validateFields, F as writeBackupFile } from './handler-CcQjkj5Q.js';
 export { conditionIssues } from './conditions.js';
 
 /** The session cookie the REST API sets at login. */

package/dist/internal.js

@@ -52,7 +52,7 @@ import {
   verifyPassword,
   verifyTurnstile,
   writeBackupFile
-} from "./chunk-CX7R6QBJ.js";
+} from "./chunk-LN4M4BUP.js";
 import {
   conditionIssues
 } from "./chunk-U266LV4M.js";

package/dist/{plugin-C19Bt8ux.d.ts → plugin-8hrkYMuR.d.ts}

@@ -1,4 +1,4 @@
-import { ba as Label, aD as Field, I as ID, k as AdminLocale, t as AdminSwitcher, c1 as SsoProviderRef } from './config-jzFGsNL6.js';
+import { ba as Label, aD as Field, I as ID, k as AdminLocale, t as AdminSwitcher, c1 as SsoProviderRef } from './config-Dgs6FE0S.js';
 import { FieldCondition } from './conditions.js';
 
 /** A Web Component from an admin module, with its `props` (plain JSON). */

package/dist/plugin.d.ts

@@ -1,3 +1,3 @@
-export { a as ADMIN_ICONS, g as AdminComponent, j as AdminIcon, S as AuthUser, a3 as CliCommand, a4 as CollectionAccess, a6 as CollectionConfig, ab as Config, ac as ConfigError, ak as DashboardWidget, av as EasyCMSError, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aD as Field, aE as FieldAccess, aH as FieldError, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aY as ForbiddenError, a_ as GlobalConfig, I as ID, b8 as JobConfig, ba as Label, bl as NavGroup, bm as NotFoundError, bo as OnRequest, bp as OnRequestArgs, br as PLUGIN_API_VERSION, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bC as QueryError, bH as RequestContext, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, cf as ValidationError, cn as Where, cu as defineFieldType, cv as definePlugin } from './config-jzFGsNL6.js';
-export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-C19Bt8ux.js';
+export { a as ADMIN_ICONS, g as AdminComponent, j as AdminIcon, S as AuthUser, a3 as CliCommand, a4 as CollectionAccess, a6 as CollectionConfig, ab as Config, ac as ConfigError, ak as DashboardWidget, av as EasyCMSError, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aD as Field, aE as FieldAccess, aH as FieldError, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aY as ForbiddenError, a_ as GlobalConfig, I as ID, b8 as JobConfig, ba as Label, bl as NavGroup, bm as NotFoundError, bo as OnRequest, bp as OnRequestArgs, br as PLUGIN_API_VERSION, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bC as QueryError, bH as RequestContext, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, cf as ValidationError, cn as Where, cu as defineFieldType, cv as definePlugin } from './config-Dgs6FE0S.js';
+export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-8hrkYMuR.js';
 import './conditions.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.62.0",
+  "version": "0.63.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",