@easy-cms/core 0.63.0 → 0.65.0

package/dist/{chunk-LN4M4BUP.js → chunk-BGGQ36LR.js}

@@ -33,8 +33,9 @@ import {
   typeFromName,
   uniqueWithinOf,
   warnDeprecated,
+  withCharset,
   withPrivacy
-} from "./chunk-FPFWLQB5.js";
+} from "./chunk-RTKWMVAC.js";
 
 // src/access.ts
 var isSystemAdmin = (user) => user?.role === "admin" && !user.apiKey && user.scoped !== true;
@@ -521,6 +522,7 @@ var CSV_LIMIT = 1e4;
 var DAY = 864e5;
 var BULKY = /* @__PURE__ */ new Set(["richText", "blocks", "array", "json"]);
 var auditContext = new AsyncLocalStorage();
+var SIGN_IN_FAILURES = /* @__PURE__ */ new Set(["login.failed", "login.locked", "sso.failed"]);
 function stable(value) {
   if (value === void 0 || value === null) return "null";
   if (Array.isArray(value)) return `[${value.map(stable).join(",")}]`;
@@ -577,7 +579,15 @@ var AuditLog = class {
    * counted, and the dashboard says so.
    */
   async record(entry) {
-    if (!this.enabled) return;
+    if (!this.enabled) {
+      if (SIGN_IN_FAILURES.has(entry.action)) {
+        const ip = auditContext.getStore()?.ip;
+        this.cms.logger.warn(
+          `${entry.action}: ${entry.email ?? entry.user?.email ?? "unknown"}${ip ? ` from ${ip}` : ""}`
+        );
+      }
+      return;
+    }
     try {
       const context = auditContext.getStore();
       const user = entry.user !== void 0 ? entry.user : context?.user ?? null;
@@ -730,8 +740,11 @@ var AuditLog = class {
     await this.record({
       action: "audit.verify",
       target: "audit",
-      detail: { checked, invalid: invalid.length, gaps }
+      detail: { checked, invalid: invalid.length, gaps, lastId: previous ?? null }
     });
+    this.cms.logger.info(
+      `Audit log checked: ${checked} entries, last #${previous ?? "-"}; ${invalid.length} changed, ${gaps} missing`
+    );
     return verification;
   }
   /**
@@ -1015,6 +1028,21 @@ async function verifyTurnstile(secretKey, response, ip, fetcher = fetch) {
 
 // src/auth/cookie.ts
 var SESSION_COOKIE = "ecms-session";
+var hostCookie = (name) => `__Host-${name}`;
+function cookieValue(header, name) {
+  if (!header) return void 0;
+  let plain;
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq <= 0) continue;
+    const key = part.slice(0, eq).trim();
+    if (key !== name && key !== hostCookie(name)) continue;
+    const value = decodeURIComponent(part.slice(eq + 1).trim());
+    if (key !== name) return value;
+    plain ??= value;
+  }
+  return plain;
+}
 
 // src/auth/emails.ts
 var esc = (value) => value.replace(
@@ -1911,12 +1939,8 @@ var Auth = class {
   async userFromHeaders(headers) {
     const authorization = headers.get("authorization");
     if (authorization?.startsWith("Bearer ")) return this.verify(authorization.slice(7).trim());
-    for (const part of headers.get("cookie")?.split(";") ?? []) {
-      const eq = part.indexOf("=");
-      if (eq > 0 && part.slice(0, eq).trim() === SESSION_COOKIE)
-        return this.verify(decodeURIComponent(part.slice(eq + 1).trim()));
-    }
-    return null;
+    const cookie2 = cookieValue(headers.get("cookie"), SESSION_COOKIE);
+    return cookie2 ? this.verify(cookie2) : null;
   }
   /**
    * Returns the user for a signed session token, or for an API key (`ecms_…`, with `apiKey` set
@@ -2820,12 +2844,38 @@ function diskStorage(options = {}) {
 }
 
 // src/backups.ts
+import { createCipheriv, createDecipheriv, createHash as createHash3, randomBytes as randomBytes5 } from "crypto";
 import { mkdtemp, readFile as readFile2, rm as rm2 } from "fs/promises";
 import { tmpdir } from "os";
 import { join as join2 } from "path";
 import { promisify } from "util";
 import { gzip } from "zlib";
 var gzipAsync = promisify(gzip);
+var MAGIC = Buffer.from("ECMSBAK1");
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+var keyOf = (encryptionKey) => createHash3("sha256").update(encryptionKey).digest();
+function encryptBackup(data, encryptionKey) {
+  const iv = randomBytes5(IV_BYTES);
+  const cipher = createCipheriv("aes-256-gcm", keyOf(encryptionKey), iv);
+  const body = Buffer.concat([cipher.update(data), cipher.final()]);
+  return new Uint8Array(Buffer.concat([MAGIC, iv, body, cipher.getAuthTag()]));
+}
+function decryptBackup(data, encryptionKey) {
+  const buffer = Buffer.from(data);
+  if (buffer.length < MAGIC.length + IV_BYTES + TAG_BYTES || !buffer.subarray(0, 8).equals(MAGIC))
+    throw new EasyCMSError("Not an encrypted Easy CMS backup", 400);
+  const iv = buffer.subarray(MAGIC.length, MAGIC.length + IV_BYTES);
+  const tag = buffer.subarray(buffer.length - TAG_BYTES);
+  const body = buffer.subarray(MAGIC.length + IV_BYTES, buffer.length - TAG_BYTES);
+  const decipher = createDecipheriv("aes-256-gcm", keyOf(encryptionKey), iv);
+  decipher.setAuthTag(tag);
+  try {
+    return new Uint8Array(Buffer.concat([decipher.update(body), decipher.final()]));
+  } catch {
+    throw new EasyCMSError("The backup could not be decrypted: wrong key, or a changed file", 400);
+  }
+}
 var DEFAULT_BACKUP_TIME = "03:00";
 var DEFAULT_BACKUP_KEEP = 7;
 var DEFAULT_DIR = "backups";
@@ -2970,11 +3020,15 @@ async function runBackup(cms, record) {
   try {
     const file = join2(dir, "backup.db");
     await writeBackupFile(cms, file);
-    const data = new Uint8Array(await gzipAsync(await readFile2(file)));
+    const encryptionKey = cms.config.backups?.encryptionKey;
+    const gzipped = new Uint8Array(await gzipAsync(await readFile2(file)));
+    const data = encryptionKey ? encryptBackup(gzipped, encryptionKey) : gzipped;
     const storage = await backupStorage(cms);
-    const filename = filenameFor(cms, started);
-    const key = await storage.get(filename) ? filename.replace(/\.db\.gz$/, `-${row.id}.db.gz`) : filename;
-    await storage.put(key, data, { contentType: "application/gzip" });
+    const filename = `${filenameFor(cms, started)}${encryptionKey ? ".enc" : ""}`;
+    const key = await storage.get(filename) ? filename.replace(/\.db\.gz(\.enc)?$/, `-${row.id}.db.gz$1`) : filename;
+    await storage.put(key, data, {
+      contentType: encryptionKey ? "application/octet-stream" : "application/gzip"
+    });
     await pruneBackups(cms, 1);
     row = await update(cms, row, {
       state: "done",
@@ -3101,8 +3155,20 @@ async function downloadBackup(cms, id, by) {
   const file = await (await backupStorage(cms)).get(row.filename);
   if (!file)
     throw new EasyCMSError(`The file ${row.filename} is no longer in the backup storage`, 404);
+  let { filename } = row;
+  let body = file.body;
+  if (filename.endsWith(".enc")) {
+    const encryptionKey = cms.config.backups?.encryptionKey;
+    if (!encryptionKey)
+      throw new EasyCMSError(
+        "This backup is encrypted: set backups.encryptionKey to download it",
+        400
+      );
+    body = decryptBackup(body, encryptionKey);
+    filename = filename.slice(0, -".enc".length);
+  }
   await update(cms, row, { downloadedBy: by, downloadedAt: (/* @__PURE__ */ new Date()).toISOString() });
-  return { filename: row.filename, body: file.body };
+  return { filename, body };
 }
 async function deleteBackup(cms, id) {
   const row = await cms.db.findById({ collection: DATABASE_BACKUPS, id });
@@ -4195,7 +4261,7 @@ var AUTH = keys(`roles rbac tokenExpiration maxLoginAttempts lockWindow trustedO
   resetPasswordExpiration inviteExpiration providers providerSignUp password setupCode members emails`);
 var MEMBERS = keys("roles signUp pages emails");
 var UPLOAD = keys("dir maxFileSize mimeTypes storage imageSizes fromURL folders privateStorage");
-var BACKUPS = keys("frequency at keep dir storage sqlite");
+var BACKUPS = keys("frequency at keep dir storage sqlite encryptionKey");
 var AUDIT = keys("keepDays values failedLogins scope");
 var COLLECTION = keys(`slug labels fields useAsTitle drafts versions schedule preview access hooks
   admin`);
@@ -4637,7 +4703,7 @@ function validateConfig(config) {
   validateAdmin(config, add);
   validateAdminViews(config, add);
   validateUpload(config, add);
-  validateBackups(config, add);
+  validateBackups(config, add, (issue) => issues.push(issue));
   validateAudit(config, add);
   validateAuth(config, add);
   validateCors(config.cors, add);
@@ -4725,6 +4791,14 @@ function validateCronSecret(value, push) {
       severity: "warning"
     });
 }
+function publicURLs(storage) {
+  const url = storage.url;
+  try {
+    return typeof url === "function" && url.call(storage, "backup.db.gz") !== void 0;
+  } catch {
+    return false;
+  }
+}
 function guessable(secret) {
   return /change[-_ ]?me|example|placeholder|secret-?key/i.test(secret) || new Set(secret).size < 8;
 }
@@ -5242,14 +5316,21 @@ function validateAudit(config, add) {
     }
   }
 }
-function validateBackups(config, add) {
+function validateBackups(config, add, push) {
+  const pushWarning = (path, message2, hint) => push({ path, message: message2, hint, severity: "warning" });
   const backups = config.backups;
   if (backups === void 0) return;
   if (typeof backups !== "object" || backups === null) {
     add("backups", "must be an object", "e.g. backups: { frequency: 'daily', keep: 7 }");
     return;
   }
-  const { frequency, at, keep, dir, storage, sqlite } = backups;
+  const { frequency, at, keep, dir, storage, sqlite, encryptionKey } = backups;
+  if (encryptionKey !== void 0 && (typeof encryptionKey !== "string" || encryptionKey.length < MIN_SECRET_LENGTH))
+    add(
+      "backups.encryptionKey",
+      `must be at least ${MIN_SECRET_LENGTH} characters`,
+      "e.g. `openssl rand -hex 32`, kept somewhere other than the backups"
+    );
   if (frequency !== void 0 && frequency !== "daily" && frequency !== "weekly")
     add("backups.frequency", 'must be "daily" or "weekly"');
   if (at !== void 0 && (typeof at !== "string" || !/^([01]\d|2[0-3]):[0-5]\d$/.test(at)))
@@ -5262,6 +5343,14 @@ function validateBackups(config, add) {
     add("backups.dir", "must not be the uploads folder: uploads are served publicly");
   if (storage !== void 0 && (typeof storage !== "object" || storage === null || typeof storage.put !== "function"))
     add("backups.storage", "must be a storage adapter, e.g. s3Storage()");
+  else if (storage !== void 0 && publicURLs(storage)) {
+    const message2 = encryptionKey ? "gives files public URLs; the backups are encrypted, but keep them in a private bucket" : "gives files public URLs: anyone with the address of a backup could download the whole database";
+    pushWarning(
+      "backups.storage",
+      message2,
+      "use a private bucket (no publicURL), or set backups.encryptionKey"
+    );
+  }
   if (sqlite !== void 0 && typeof sqlite !== "function")
     add(
       "backups.sqlite",
@@ -6057,7 +6146,7 @@ function resolveAudit(audit) {
 }
 
 // src/local-api.ts
-import { createHmac as createHmac6, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual5 } from "crypto";
+import { createHmac as createHmac6, randomBytes as randomBytes6, timingSafeEqual as timingSafeEqual5 } from "crypto";
 
 // src/auth/common-passwords.ts
 var LIST = `
@@ -6821,13 +6910,13 @@ var EasyCMS = class {
         }
       ]);
     }
-    const random2 = randomBytes5(4).toString("hex");
+    const random2 = randomBytes6(4).toString("hex");
     const isPrivate = await this.folders.isPrivate(folderOf(MEDIA, data));
     const storage = this.storageFor(isPrivate);
     const filename = withPrivacy(storageKey(file.name, mimeType, random2), isPrivate);
     const stored = [];
     try {
-      await storage.put(filename, file.data, { contentType: mimeType });
+      await storage.put(filename, file.data, { contentType: withCharset(mimeType) });
       stored.push(filename);
       const dimensions = imageDimensions(file.data, mimeType);
       const sizes = await this.resizeImage(
@@ -6889,7 +6978,7 @@ var EasyCMS = class {
       ]);
     const isPrivate = await this.folders.isPrivate(folder);
     const storage = this.storageFor(isPrivate);
-    const key = withPrivacy(storageKey(name, type, randomBytes5(4).toString("hex")), isPrivate);
+    const key = withPrivacy(storageKey(name, type, randomBytes6(4).toString("hex")), isPrivate);
     const upload = storage.uploadURL ? await storage.uploadURL(key, { contentType: type, size, expiresIn: UPLOAD_URL_SECONDS }) : null;
     const ticket = this.sign("upload", {
       key,
@@ -7173,7 +7262,7 @@ var EasyCMS = class {
     const old = [String(doc.filename)];
     const copy = async (source, target) => {
       const file = await from.get(source);
-      if (file) await to.put(target, file.body, { contentType });
+      if (file) await to.put(target, file.body, { contentType: withCharset(contentType) });
     };
     await copy(String(doc.filename), filename);
     const sizes = {};
@@ -9048,7 +9137,7 @@ function durationSeconds(value) {
 }
 
 // src/rest/admin-modules.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { readFile as readFile3 } from "fs/promises";
 import { createRequire } from "module";
 import { join as join3 } from "path";
@@ -9089,11 +9178,11 @@ async function readAdminModule(cms, index) {
   if (!file) return void 0;
   const body = await readFile3(file, "utf8").catch(() => void 0);
   if (body === void 0) return void 0;
-  return { body, etag: `"${createHash3("sha1").update(body).digest("base64url")}"` };
+  return { body, etag: `"${createHash4("sha1").update(body).digest("base64url")}"` };
 }
 
 // src/version.ts
-var VERSION = true ? "0.63.0" : "0.0.0-dev";
+var VERSION = true ? "0.65.0" : "0.0.0-dev";
 
 // src/rest/admin-deliveries.ts
 var PER_PAGE = 50;
@@ -10029,7 +10118,8 @@ async function respond(cms, request, url, path, root, options, production) {
   const headers = new Headers({
     "content-type": "application/json; charset=utf-8",
     "cache-control": "no-store",
-    "x-content-type-options": "nosniff"
+    "x-content-type-options": "nosniff",
+    ...production ? { "strict-transport-security": "max-age=31536000" } : {}
   });
   try {
     if (path === null) throw new HttpError("Not found", 404);
@@ -10046,7 +10136,8 @@ async function respond(cms, request, url, path, root, options, production) {
       context,
       via: signedIn ? via : null,
       token,
-      headers
+      headers,
+      trustProxy: options.trustProxy === true
     };
     const method = request.method.toUpperCase();
     if (method !== "GET" && method !== "HEAD") checkCsrf(cms, ctx);
@@ -10222,6 +10313,7 @@ async function route(cms, ctx, method, path, options) {
       case "POST logout": {
         if (ctx.token) await cms.auth.logout(ctx.token);
         clearSessionCookies(ctx);
+        ctx.headers.set("clear-site-data", '"cache"');
         return { body: { message: "Logged out" } };
       }
       case "GET me": {
@@ -10916,23 +11008,17 @@ function readToken(request) {
   return { token, via: token ? "cookie" : null };
 }
 function readCookie(request, name) {
-  const header = request.headers.get("cookie");
-  if (!header) return void 0;
-  for (const part of header.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq > 0 && part.slice(0, eq).trim() === name)
-      return decodeURIComponent(part.slice(eq + 1).trim());
-  }
-  return void 0;
+  return cookieValue(request.headers.get("cookie"), name);
 }
-function sameHost(origin, request) {
+function sameHost(origin, request, trustProxy) {
   let host;
   try {
     host = new URL(origin).host;
   } catch {
     return false;
   }
-  const forwarded = request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+  const trusted = trustProxy || !!process.env.VERCEL || !!process.env.NETLIFY;
+  const forwarded = trusted ? request.headers.get("x-forwarded-host")?.split(",")[0]?.trim() : void 0;
   return host === (forwarded || request.headers.get("host"));
 }
 function checkCsrf(cms, ctx) {
@@ -10940,7 +11026,7 @@ function checkCsrf(cms, ctx) {
   const fetchSite = ctx.request.headers.get("sec-fetch-site");
   const cookie2 = ctx.via === "cookie" && ctx.token !== void 0;
   const { cors } = cms.config;
-  const trusted = origin !== null && (origin === ctx.url.origin || sameHost(origin, ctx.request) || cms.config.auth.trustedOrigins.includes(origin) || !cookie2 && (cors === "*" || cors.includes(origin)));
+  const trusted = origin !== null && (origin === ctx.url.origin || sameHost(origin, ctx.request, ctx.trustProxy) || cms.config.auth.trustedOrigins.includes(origin) || !cookie2 && (cors === "*" || cors.includes(origin)));
   if (origin !== null && !trusted) throw new ForbiddenError("CSRF check failed: untrusted origin");
   if (origin === null && fetchSite === "cross-site")
     throw new ForbiddenError("CSRF check failed: cross-site request");
@@ -10962,7 +11048,7 @@ async function serveFile(cms, key, head) {
   const file = await cms.storage.get(key);
   if (!file) throw new HttpError("Not found", 404);
   const extension = key.slice(key.lastIndexOf(".") + 1);
-  const type = TYPE_BY_EXTENSION[extension] ?? "application/octet-stream";
+  const type = withCharset(TYPE_BY_EXTENSION[extension] ?? "application/octet-stream");
   return new Response(
     head ? null : file.body,
     {
@@ -11005,7 +11091,9 @@ async function servePrivateFile(cms, ctx, key, head) {
   }
   const file = await cms.privateStorage.get(key);
   if (!file) throw new HttpError("Not found", 404);
-  const type = TYPE_BY_EXTENSION[key.slice(key.lastIndexOf(".") + 1)] ?? "application/octet-stream";
+  const type = withCharset(
+    TYPE_BY_EXTENSION[key.slice(key.lastIndexOf(".") + 1)] ?? "application/octet-stream"
+  );
   return new Response(
     head ? null : file.body,
     {
@@ -11116,9 +11204,14 @@ function isSecure(ctx) {
   return ctx.url.protocol === "https:" || process.env.NODE_ENV === "production";
 }
 function cookie(ctx, name, value, opts) {
-  const parts = [`${name}=${encodeURIComponent(value)}`, "Path=/", "SameSite=Lax"];
+  const secure = isSecure(ctx);
+  const parts = [
+    `${secure ? hostCookie(name) : name}=${encodeURIComponent(value)}`,
+    "Path=/",
+    "SameSite=Lax"
+  ];
   if (opts.httpOnly) parts.push("HttpOnly");
-  if (isSecure(ctx)) parts.push("Secure");
+  if (secure) parts.push("Secure");
   if (opts.maxAge !== void 0) parts.push(`Max-Age=${opts.maxAge}`);
   return parts.join("; ");
 }
@@ -11197,6 +11290,9 @@ function setSessionCookies(cms, ctx, session) {
 function clearSessionCookies(ctx) {
   ctx.headers.append("set-cookie", cookie(ctx, SESSION_COOKIE, "", { httpOnly: true, maxAge: 0 }));
   ctx.headers.append("set-cookie", cookie(ctx, CSRF_COOKIE, "", { httpOnly: false, maxAge: 0 }));
+  if (isSecure(ctx))
+    for (const name of [SESSION_COOKIE, CSRF_COOKIE])
+      ctx.headers.append("set-cookie", `${name}=; Path=/; Max-Age=0; Secure; SameSite=Lax`);
 }
 function errorResponse(cms, error, headers, production) {
   if (error instanceof EasyCMSError) {
@@ -11262,6 +11358,7 @@ function createApiHandler(config, options = {}) {
     if (!handler) {
       handler = createRestHandler(cms, {
         getClientIp,
+        trustProxy: options.trustProxy === true,
         ...options.basePath ? { basePath: options.basePath } : {}
       });
       handlers.set(cms, handler);
@@ -11356,6 +11453,7 @@ export {
   configSignature,
   copyDatabase,
   diskStorage,
+  decryptBackup,
   writeBackupFile,
   consoleLogger,
   silentLogger,

package/dist/{chunk-FPFWLQB5.js → chunk-RTKWMVAC.js}

@@ -271,6 +271,12 @@ function sizeKey(filename, size) {
   return filename.replace(/\.([^.]+)$/, `-${size}.$1`);
 }
 var PRIVATE_KEY = /^[\p{L}\p{M}\p{N}-]+\.private(-[\p{L}\p{N}_-]+)?\.[a-z0-9]+$/u;
+function withCharset(type) {
+  if (/;\s*charset=/i.test(type)) return type;
+  const base = type.split(";")[0]?.trim().toLowerCase() ?? "";
+  const text = base.startsWith("text/") || /^application\/(json|xml|javascript|ecmascript)$/.test(base) || /\+(json|xml)$/.test(base);
+  return text ? `${type}; charset=utf-8` : type;
+}
 
 // src/fields.ts
 var uniqueWithinOf = (field) => field.uniqueWithin === void 0 ? [] : [field.uniqueWithin].flat();
@@ -534,6 +540,7 @@ export {
   withPrivacy,
   sizeKey,
   PRIVATE_KEY,
+  withCharset,
   uniqueWithinOf,
   isHasMany,
   mimeAllowedBy,

package/dist/{config-Dgs6FE0S.d.ts → config-DE8ez-a9.d.ts}

@@ -2148,7 +2148,11 @@ interface AuditVerification {
     checked: number;
     /** Entries whose signature does not match: changed after they were written. */
     invalid: ID[];
-    /** Missing ids between entries: deleted entries, or (rarely) inserts that failed. */
+    /**
+     * Missing ids between entries: deleted entries, or (rarely) inserts that failed. Ids are never
+     * reused, so the newest entries deleted show up here once anything is written after them (a
+     * check writes an entry itself). The server's log has each check's last id, to compare with.
+     */
     gaps: number;
     at: string;
 }
@@ -3102,6 +3106,13 @@ interface BackupsConfig {
     readonly dir?: string;
     /** Where backups are stored instead, e.g. `s3Storage()` with a private bucket. */
     readonly storage?: StorageAdapter;
+    /**
+     * Encrypts the backup files (AES-256-GCM), so a leaked bucket or disk holds nothing readable.
+     * At least 32 characters, e.g. from `process.env.EASY_CMS_BACKUP_KEY`; keep a copy somewhere
+     * other than the backups: without it they can't be restored. Downloads from the admin are
+     * decrypted; `easy-cms backup:decrypt <file>` decrypts one by hand.
+     */
+    readonly encryptionKey?: string;
     /**
      * For Postgres: the SQLite adapter that writes the backup file, `sqlite` from
      * `@easy-cms/db-sqlite`. SQLite databases back themselves up and don't need it.

package/dist/{handler-CcQjkj5Q.d.ts → handler-Cm1ehtkm.d.ts}

@@ -1,5 +1,7 @@
-import { I as ID, ab as Config, au as EasyCMS, bd as LocalizationConfig, aD as Field, aH as FieldError, aS as FilterOptions, af as CreateEasyCMSOptions, bI as ResolvedConfig } from './config-Dgs6FE0S.js';
+import { I as ID, ab as Config, au as EasyCMS, bd as LocalizationConfig, aD as Field, aH as FieldError, aS as FilterOptions, af as CreateEasyCMSOptions, bI as ResolvedConfig } from './config-DE8ez-a9.js';
 
+/** Decrypts a file from `encryptBackup`; throws for another key or a changed file. */
+declare function decryptBackup(data: Uint8Array, encryptionKey: string): Uint8Array;
 type BackupState = 'pending' | 'running' | 'done' | 'failed';
 /** One backup as the admin shows it (`GET <api>/admin/backups`). */
 interface AdminBackup {
@@ -172,6 +174,11 @@ interface RestHandlerOptions {
     readonly basePath?: string;
     /** Client IP, used with the email to rate-limit logins. Adapters provide it. */
     readonly getClientIp?: (request: Request) => string | undefined;
+    /**
+     * Behind a reverse proxy you control: its `X-Forwarded-Host` names the public host (for the
+     * CSRF check of a request's Origin). Vercel and Netlify are recognized without it.
+     */
+    readonly trustProxy?: boolean;
 }
 type RestHandler = (request: Request) => Promise<Response>;
 /** Creates the REST API as a Web-standard `(Request) => Response` handler. */
@@ -183,6 +190,7 @@ declare function createRestHandler<C extends Config>(instance: EasyCMS<C>, optio
  * use it; the standalone server does.
  */
 declare function createRootEndpointHandler<C extends Config>(instance: EasyCMS<C>, options?: Pick<RestHandlerOptions, 'getClientIp'>): (request: Request) => Promise<Response | undefined>;
+/** A cookie of the request; the `__Host-` one (set over HTTPS) first. */
 declare function readCookie(request: Request, name: string): string | undefined;
 
-export { type AdminBackup as A, type BackupState as B, CONFIG_FILE_NAMES as C, DEFAULT_ADMIN_PATH as D, validateFields as E, writeBackupFile as F, type LoadConfigOptions as L, type RestHandler as R, type AdminBackups as a, type ApiHandlerOptions as b, type RestHandlerOptions as c, createApiHandler as d, createRestHandler as e, slugify as f, CSRF_COOKIE as g, CSRF_HEADER as h, DEFAULT_API_PATH as i, DEFAULT_MAX_FILE_SIZE as j, DEFAULT_TOKEN_EXPIRATION as k, loadConfig as l, applyDefaults as m, applyPlugins as n, createRootEndpointHandler as o, fillMissing as p, findConfigFile as q, resolveConfig as r, sharedEasyCMS as s, forwardedClientIp as t, generateSlugs as u, importConfig as v, mergeForUpdate as w, parseId as x, platformClientIp as y, readCookie as z };
+export { type AdminBackup as A, type BackupState as B, CONFIG_FILE_NAMES as C, DEFAULT_ADMIN_PATH as D, readCookie as E, validateFields as F, writeBackupFile as G, type LoadConfigOptions as L, type RestHandler as R, type AdminBackups as a, type ApiHandlerOptions as b, type RestHandlerOptions as c, createApiHandler as d, createRestHandler as e, slugify as f, CSRF_COOKIE as g, CSRF_HEADER as h, DEFAULT_API_PATH as i, DEFAULT_MAX_FILE_SIZE as j, DEFAULT_TOKEN_EXPIRATION as k, loadConfig as l, applyDefaults as m, applyPlugins as n, createRootEndpointHandler as o, decryptBackup as p, fillMissing as q, resolveConfig as r, sharedEasyCMS as s, findConfigFile as t, forwardedClientIp as u, generateSlugs as v, importConfig as w, mergeForUpdate as x, parseId as y, platformClientIp as z };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { P as PaginatedDocs, I as ID, E as EmailSetting } from './config-Dgs6FE0S.js';
-export { A as ADAPTER_API_VERSION, a as ADMIN_ICONS, b as Access, c as AccessArgs, d as AccessOptions, e as AdminBrand, f as AdminCommand, g as AdminComponent, h as AdminConfig, i as AdminFieldArgs, j as AdminIcon, k as AdminLocale, l as AdminPage, m as AdminRole, n as AdminRoleChange, o as AdminRoleField, p as AdminRoleTarget, q as AdminRoleView, r as AdminRoles, s as AdminSso, t as AdminSwitcher, u as AdminViewAccess, v as AfterChangeHook, w as AfterDeleteHook, x as AfterReadHook, y as ApiKeyContext, z as ApiKeyGlobalOperation, B as ApiKeyOperation, C as ApiKeyPermissions, D as ArrayField, F as AuditChange, G as AuditConfig, H as AuditEntry, J as AuditLog, K as AuditPage, L as AuditVerification, M as Auth, N as AuthConfig, O as AuthProvider, Q as AuthProviderProfile, R as AuthProviderRequest, S as AuthUser, T as BackupsConfig, U as BeforeChangeHook, V as BeforeDeleteHook, W as BeforeValidateHook, X as Block, Y as BlocksField, Z as BooleanField, _ as BuiltinApiKeysCollection, $ as BuiltinMediaCollection, a0 as BuiltinMediaFoldersCollection, a1 as BuiltinUsersCollection, a2 as BundleHints, a3 as CliCommand, a4 as CollectionAccess, a5 as CollectionAdmin, a6 as CollectionConfig, a7 as CollectionDocument, a8 as CollectionHooks, a9 as CollectionListAdmin, aa as CollectionSlug, ab as Config, ac as ConfigError, ad as ConfigIssue, ae as ContainerAdmin, af as CreateEasyCMSOptions, ag as CreateInput, ah as CreateMigrationResult, ai as CustomField, aj as CustomFieldTypes, ak as DashboardWidget, al as Database, am as DatabaseAdapter, an as DatabaseInitArgs, ao as DatabaseTransfer, ap as DateField, aq as DepthOptions, ar as DirectUpload, as as DiskStorageOptions, at as DocumentOf, au as EasyCMS, av as EasyCMSError, aw as EmailAdapter, ax as EmailField, ay as EmailMessage, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aC as FIELD_TYPES, aD as Field, aE as FieldAccess, aF as FieldAccessFn, aG as FieldAdmin, aH as FieldError, aI as FieldRule, aJ as FieldType, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aN as FieldValidate, aO as FieldValidateContext, aP as FieldValue, aQ as FieldsInput, aR as FieldsValue, aS as FilterOptions, aT as FilterOptionsArgs, aU as FindArgs, aV as FindOptions, aW as FolderLevel, aX as FolderPermissions, aY as ForbiddenError, aZ as GlobalAccess, a_ as GlobalConfig, a$ as GlobalDocument, b0 as GlobalHooks, b1 as GlobalInput, b2 as GlobalSlug, b3 as GroupField, b4 as ImageSize, b5 as IncrementOptions, b6 as InferCollection, b7 as InferGlobal, b8 as JobConfig, b9 as JsonField, ba as Label, bb as LayoutNode, bc as LivePreview, bd as LocalizationConfig, be as Logger, bf as LoginArgs, bg as MediaDocument, bh as MediaSize, bi as MembersConfig, bj as MembersSignup, bk as MigrationInfo, bl as NavGroup, bm as NotFoundError, bn as NumberField, bo as OnRequest, bp as OnRequestArgs, bq as Operation, br as PLUGIN_API_VERSION, bs as PasswordEmail, bt as PasswordEmailArgs, bu as PasswordEmailFn, bv as PasswordLinkOptions, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bA as PreviewTarget, bB as PreviewURL, bC as QueryError, bD as ROLE_OPERATIONS, bE as RawDocument, bF as ReadOptions, bG as RelationshipField, bH as RequestContext, bI as ResolvedConfig, bJ as RichTextDocument, bK as RichTextField, bL as Role, bM as RoleOperation, bN as RolePermissions, bO as Roles, bP as RoutesConfig, bQ as ScheduledPublish, bR as SchemaError, bS as SchemaMode, bT as SelectField, bU as SelectOption, bV as Session, bW as SidebarPanel, bX as SignupArgs, bY as SignupResult, bZ as SingleSignOn, b_ as SlugField, b$ as SlugOf, c0 as SsoOutcome, c1 as SsoProviderRef, c2 as StorageAdapter, c3 as StoredFile, c4 as TextField, c5 as TextareaField, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, c9 as UpdateInput, ca as UpdateOptions, cb as UploadConfig, cc as UploadField, cd as UploadFromURLConfig, ce as UserIdentity, cf as ValidationError, cg as Version, ch as VersionSummary, ci as VersionsConfig, cj as WEBHOOK_EVENTS, ck as WebhookConfig, cl as WebhookEvent, cm as WebhookPayload, cn as Where, co as WhereOperators, cp as anyone, cq as consoleEmail, cr as consoleLogger, cs as createEasyCMS, ct as defineConfig, cu as defineFieldType, cv as definePlugin, cw as diskStorage, cx as hasRows, cy as isAdmin, cz as isHasMany, cA as isSignedIn, cB as isStaff, cC as isSystemAdmin, cD as mimeAllowedBy, cE as rowFields, cF as silentLogger, cG as uniqueWithinOf } from './config-Dgs6FE0S.js';
-export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-8hrkYMuR.js';
-export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-CcQjkj5Q.js';
+import { P as PaginatedDocs, I as ID, E as EmailSetting } from './config-DE8ez-a9.js';
+export { A as ADAPTER_API_VERSION, a as ADMIN_ICONS, b as Access, c as AccessArgs, d as AccessOptions, e as AdminBrand, f as AdminCommand, g as AdminComponent, h as AdminConfig, i as AdminFieldArgs, j as AdminIcon, k as AdminLocale, l as AdminPage, m as AdminRole, n as AdminRoleChange, o as AdminRoleField, p as AdminRoleTarget, q as AdminRoleView, r as AdminRoles, s as AdminSso, t as AdminSwitcher, u as AdminViewAccess, v as AfterChangeHook, w as AfterDeleteHook, x as AfterReadHook, y as ApiKeyContext, z as ApiKeyGlobalOperation, B as ApiKeyOperation, C as ApiKeyPermissions, D as ArrayField, F as AuditChange, G as AuditConfig, H as AuditEntry, J as AuditLog, K as AuditPage, L as AuditVerification, M as Auth, N as AuthConfig, O as AuthProvider, Q as AuthProviderProfile, R as AuthProviderRequest, S as AuthUser, T as BackupsConfig, U as BeforeChangeHook, V as BeforeDeleteHook, W as BeforeValidateHook, X as Block, Y as BlocksField, Z as BooleanField, _ as BuiltinApiKeysCollection, $ as BuiltinMediaCollection, a0 as BuiltinMediaFoldersCollection, a1 as BuiltinUsersCollection, a2 as BundleHints, a3 as CliCommand, a4 as CollectionAccess, a5 as CollectionAdmin, a6 as CollectionConfig, a7 as CollectionDocument, a8 as CollectionHooks, a9 as CollectionListAdmin, aa as CollectionSlug, ab as Config, ac as ConfigError, ad as ConfigIssue, ae as ContainerAdmin, af as CreateEasyCMSOptions, ag as CreateInput, ah as CreateMigrationResult, ai as CustomField, aj as CustomFieldTypes, ak as DashboardWidget, al as Database, am as DatabaseAdapter, an as DatabaseInitArgs, ao as DatabaseTransfer, ap as DateField, aq as DepthOptions, ar as DirectUpload, as as DiskStorageOptions, at as DocumentOf, au as EasyCMS, av as EasyCMSError, aw as EmailAdapter, ax as EmailField, ay as EmailMessage, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aC as FIELD_TYPES, aD as Field, aE as FieldAccess, aF as FieldAccessFn, aG as FieldAdmin, aH as FieldError, aI as FieldRule, aJ as FieldType, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aN as FieldValidate, aO as FieldValidateContext, aP as FieldValue, aQ as FieldsInput, aR as FieldsValue, aS as FilterOptions, aT as FilterOptionsArgs, aU as FindArgs, aV as FindOptions, aW as FolderLevel, aX as FolderPermissions, aY as ForbiddenError, aZ as GlobalAccess, a_ as GlobalConfig, a$ as GlobalDocument, b0 as GlobalHooks, b1 as GlobalInput, b2 as GlobalSlug, b3 as GroupField, b4 as ImageSize, b5 as IncrementOptions, b6 as InferCollection, b7 as InferGlobal, b8 as JobConfig, b9 as JsonField, ba as Label, bb as LayoutNode, bc as LivePreview, bd as LocalizationConfig, be as Logger, bf as LoginArgs, bg as MediaDocument, bh as MediaSize, bi as MembersConfig, bj as MembersSignup, bk as MigrationInfo, bl as NavGroup, bm as NotFoundError, bn as NumberField, bo as OnRequest, bp as OnRequestArgs, bq as Operation, br as PLUGIN_API_VERSION, bs as PasswordEmail, bt as PasswordEmailArgs, bu as PasswordEmailFn, bv as PasswordLinkOptions, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bA as PreviewTarget, bB as PreviewURL, bC as QueryError, bD as ROLE_OPERATIONS, bE as RawDocument, bF as ReadOptions, bG as RelationshipField, bH as RequestContext, bI as ResolvedConfig, bJ as RichTextDocument, bK as RichTextField, bL as Role, bM as RoleOperation, bN as RolePermissions, bO as Roles, bP as RoutesConfig, bQ as ScheduledPublish, bR as SchemaError, bS as SchemaMode, bT as SelectField, bU as SelectOption, bV as Session, bW as SidebarPanel, bX as SignupArgs, bY as SignupResult, bZ as SingleSignOn, b_ as SlugField, b$ as SlugOf, c0 as SsoOutcome, c1 as SsoProviderRef, c2 as StorageAdapter, c3 as StoredFile, c4 as TextField, c5 as TextareaField, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, c9 as UpdateInput, ca as UpdateOptions, cb as UploadConfig, cc as UploadField, cd as UploadFromURLConfig, ce as UserIdentity, cf as ValidationError, cg as Version, ch as VersionSummary, ci as VersionsConfig, cj as WEBHOOK_EVENTS, ck as WebhookConfig, cl as WebhookEvent, cm as WebhookPayload, cn as Where, co as WhereOperators, cp as anyone, cq as consoleEmail, cr as consoleLogger, cs as createEasyCMS, ct as defineConfig, cu as defineFieldType, cv as definePlugin, cw as diskStorage, cx as hasRows, cy as isAdmin, cz as isHasMany, cA as isSignedIn, cB as isStaff, cC as isSystemAdmin, cD as mimeAllowedBy, cE as rowFields, cF as silentLogger, cG as uniqueWithinOf } from './config-DE8ez-a9.js';
+export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-CX7E7RZZ.js';
+export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-Cm1ehtkm.js';
 export { FieldCondition, matchesCondition } from './conditions.js';
 
 type DeliveryKind = 'webhook' | 'email';

package/dist/index.js

@@ -23,7 +23,7 @@ import {
   sharedEasyCMS,
   silentLogger,
   slugify
-} from "./chunk-LN4M4BUP.js";
+} from "./chunk-BGGQ36LR.js";
 import {
   matchesCondition
 } from "./chunk-U266LV4M.js";
@@ -48,7 +48,7 @@ import {
   defineFieldType,
   definePlugin,
   warnDeprecated
-} from "./chunk-FPFWLQB5.js";
+} from "./chunk-RTKWMVAC.js";
 export {
   ADAPTER_API_VERSION,
   ADMIN_API_VERSION,

package/dist/internal.d.ts

@@ -1,6 +1,6 @@
-import { ab as Config, al as Database, bl as NavGroup, a6 as CollectionConfig, I as ID, bE as RawDocument, aD as Field, bI as ResolvedConfig, ad as ConfigIssue } from './config-Dgs6FE0S.js';
-export { cH as API_KEYS, cI as API_KEY_GLOBAL_OPERATIONS, cJ as API_KEY_OPERATIONS, cK as DEFAULT_MAX_VERSIONS, cL as DEFAULT_PASSWORD_EMAILS, cM as FIELD_TYPE_BASES, cN as FOLDER_LEVELS, cO as MediaFolders, cP as SSO_COOKIE, cQ as codeOfStatus, cx as hasRows, cz as isHasMany, cR as keyAllows, cD as mimeAllowedBy, cE as rowFields, cG as uniqueWithinOf } from './config-Dgs6FE0S.js';
-export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as fillMissing, q as findConfigFile, t as forwardedClientIp, u as generateSlugs, v as importConfig, w as mergeForUpdate, x as parseId, y as platformClientIp, z as readCookie, E as validateFields, F as writeBackupFile } from './handler-CcQjkj5Q.js';
+import { ab as Config, al as Database, bl as NavGroup, a6 as CollectionConfig, I as ID, bE as RawDocument, aD as Field, bI as ResolvedConfig, ad as ConfigIssue } from './config-DE8ez-a9.js';
+export { cH as API_KEYS, cI as API_KEY_GLOBAL_OPERATIONS, cJ as API_KEY_OPERATIONS, cK as DEFAULT_MAX_VERSIONS, cL as DEFAULT_PASSWORD_EMAILS, cM as FIELD_TYPE_BASES, cN as FOLDER_LEVELS, cO as MediaFolders, cP as SSO_COOKIE, cQ as codeOfStatus, cx as hasRows, cz as isHasMany, cR as keyAllows, cD as mimeAllowedBy, cE as rowFields, cG as uniqueWithinOf } from './config-DE8ez-a9.js';
+export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as mergeForUpdate, y as parseId, z as platformClientIp, E as readCookie, F as validateFields, G as writeBackupFile } from './handler-Cm1ehtkm.js';
 export { conditionIssues } from './conditions.js';
 
 /** The session cookie the REST API sets at login. */

package/dist/internal.js

@@ -31,6 +31,7 @@ import {
   configSignature,
   copyDatabase,
   createRootEndpointHandler,
+  decryptBackup,
   fillMissing,
   findConfigFile,
   formToken,
@@ -52,7 +53,7 @@ import {
   verifyPassword,
   verifyTurnstile,
   writeBackupFile
-} from "./chunk-LN4M4BUP.js";
+} from "./chunk-BGGQ36LR.js";
 import {
   conditionIssues
 } from "./chunk-U266LV4M.js";
@@ -70,7 +71,7 @@ import {
   rowFields,
   sniffMimeType,
   uniqueWithinOf
-} from "./chunk-FPFWLQB5.js";
+} from "./chunk-RTKWMVAC.js";
 
 // src/typegen.ts
 var pascal = (name) => name.split(/[^A-Za-z0-9]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
@@ -275,6 +276,7 @@ export {
   configSignature,
   copyDatabase,
   createRootEndpointHandler,
+  decryptBackup,
   expandMimeTypes,
   fillMissing,
   findConfigFile,

package/dist/{plugin-8hrkYMuR.d.ts → plugin-CX7E7RZZ.d.ts}

@@ -1,4 +1,4 @@
-import { ba as Label, aD as Field, I as ID, k as AdminLocale, t as AdminSwitcher, c1 as SsoProviderRef } from './config-Dgs6FE0S.js';
+import { ba as Label, aD as Field, I as ID, k as AdminLocale, t as AdminSwitcher, c1 as SsoProviderRef } from './config-DE8ez-a9.js';
 import { FieldCondition } from './conditions.js';
 
 /** A Web Component from an admin module, with its `props` (plain JSON). */

package/dist/plugin.d.ts

@@ -1,3 +1,3 @@
-export { a as ADMIN_ICONS, g as AdminComponent, j as AdminIcon, S as AuthUser, a3 as CliCommand, a4 as CollectionAccess, a6 as CollectionConfig, ab as Config, ac as ConfigError, ak as DashboardWidget, av as EasyCMSError, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aD as Field, aE as FieldAccess, aH as FieldError, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aY as ForbiddenError, a_ as GlobalConfig, I as ID, b8 as JobConfig, ba as Label, bl as NavGroup, bm as NotFoundError, bo as OnRequest, bp as OnRequestArgs, br as PLUGIN_API_VERSION, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bC as QueryError, bH as RequestContext, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, cf as ValidationError, cn as Where, cu as defineFieldType, cv as definePlugin } from './config-Dgs6FE0S.js';
-export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-8hrkYMuR.js';
+export { a as ADMIN_ICONS, g as AdminComponent, j as AdminIcon, S as AuthUser, a3 as CliCommand, a4 as CollectionAccess, a6 as CollectionConfig, ab as Config, ac as ConfigError, ak as DashboardWidget, av as EasyCMSError, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aD as Field, aE as FieldAccess, aH as FieldError, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aY as ForbiddenError, a_ as GlobalConfig, I as ID, b8 as JobConfig, ba as Label, bl as NavGroup, bm as NotFoundError, bo as OnRequest, bp as OnRequestArgs, br as PLUGIN_API_VERSION, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bC as QueryError, bH as RequestContext, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, cf as ValidationError, cn as Where, cu as defineFieldType, cv as definePlugin } from './config-DE8ez-a9.js';
+export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-CX7E7RZZ.js';
 import './conditions.js';

package/dist/plugin.js

@@ -16,7 +16,7 @@ import {
   defineFieldType,
   definePlugin,
   warnDeprecated
-} from "./chunk-FPFWLQB5.js";
+} from "./chunk-RTKWMVAC.js";
 export {
   ADMIN_API_VERSION,
   ADMIN_ICONS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.63.0",
+  "version": "0.65.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",