@easy-cms/core 0.64.0 → 0.65.0

package/dist/{chunk-JZW6G6XI.js → chunk-BGGQ36LR.js}

@@ -522,6 +522,7 @@ var CSV_LIMIT = 1e4;
 var DAY = 864e5;
 var BULKY = /* @__PURE__ */ new Set(["richText", "blocks", "array", "json"]);
 var auditContext = new AsyncLocalStorage();
+var SIGN_IN_FAILURES = /* @__PURE__ */ new Set(["login.failed", "login.locked", "sso.failed"]);
 function stable(value) {
   if (value === void 0 || value === null) return "null";
   if (Array.isArray(value)) return `[${value.map(stable).join(",")}]`;
@@ -578,7 +579,15 @@ var AuditLog = class {
    * counted, and the dashboard says so.
    */
   async record(entry) {
-    if (!this.enabled) return;
+    if (!this.enabled) {
+      if (SIGN_IN_FAILURES.has(entry.action)) {
+        const ip = auditContext.getStore()?.ip;
+        this.cms.logger.warn(
+          `${entry.action}: ${entry.email ?? entry.user?.email ?? "unknown"}${ip ? ` from ${ip}` : ""}`
+        );
+      }
+      return;
+    }
     try {
       const context = auditContext.getStore();
       const user = entry.user !== void 0 ? entry.user : context?.user ?? null;
@@ -731,8 +740,11 @@ var AuditLog = class {
     await this.record({
       action: "audit.verify",
       target: "audit",
-      detail: { checked, invalid: invalid.length, gaps }
+      detail: { checked, invalid: invalid.length, gaps, lastId: previous ?? null }
     });
+    this.cms.logger.info(
+      `Audit log checked: ${checked} entries, last #${previous ?? "-"}; ${invalid.length} changed, ${gaps} missing`
+    );
     return verification;
   }
   /**
@@ -2832,12 +2844,38 @@ function diskStorage(options = {}) {
 }
 
 // src/backups.ts
+import { createCipheriv, createDecipheriv, createHash as createHash3, randomBytes as randomBytes5 } from "crypto";
 import { mkdtemp, readFile as readFile2, rm as rm2 } from "fs/promises";
 import { tmpdir } from "os";
 import { join as join2 } from "path";
 import { promisify } from "util";
 import { gzip } from "zlib";
 var gzipAsync = promisify(gzip);
+var MAGIC = Buffer.from("ECMSBAK1");
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+var keyOf = (encryptionKey) => createHash3("sha256").update(encryptionKey).digest();
+function encryptBackup(data, encryptionKey) {
+  const iv = randomBytes5(IV_BYTES);
+  const cipher = createCipheriv("aes-256-gcm", keyOf(encryptionKey), iv);
+  const body = Buffer.concat([cipher.update(data), cipher.final()]);
+  return new Uint8Array(Buffer.concat([MAGIC, iv, body, cipher.getAuthTag()]));
+}
+function decryptBackup(data, encryptionKey) {
+  const buffer = Buffer.from(data);
+  if (buffer.length < MAGIC.length + IV_BYTES + TAG_BYTES || !buffer.subarray(0, 8).equals(MAGIC))
+    throw new EasyCMSError("Not an encrypted Easy CMS backup", 400);
+  const iv = buffer.subarray(MAGIC.length, MAGIC.length + IV_BYTES);
+  const tag = buffer.subarray(buffer.length - TAG_BYTES);
+  const body = buffer.subarray(MAGIC.length + IV_BYTES, buffer.length - TAG_BYTES);
+  const decipher = createDecipheriv("aes-256-gcm", keyOf(encryptionKey), iv);
+  decipher.setAuthTag(tag);
+  try {
+    return new Uint8Array(Buffer.concat([decipher.update(body), decipher.final()]));
+  } catch {
+    throw new EasyCMSError("The backup could not be decrypted: wrong key, or a changed file", 400);
+  }
+}
 var DEFAULT_BACKUP_TIME = "03:00";
 var DEFAULT_BACKUP_KEEP = 7;
 var DEFAULT_DIR = "backups";
@@ -2982,11 +3020,15 @@ async function runBackup(cms, record) {
   try {
     const file = join2(dir, "backup.db");
     await writeBackupFile(cms, file);
-    const data = new Uint8Array(await gzipAsync(await readFile2(file)));
+    const encryptionKey = cms.config.backups?.encryptionKey;
+    const gzipped = new Uint8Array(await gzipAsync(await readFile2(file)));
+    const data = encryptionKey ? encryptBackup(gzipped, encryptionKey) : gzipped;
     const storage = await backupStorage(cms);
-    const filename = filenameFor(cms, started);
-    const key = await storage.get(filename) ? filename.replace(/\.db\.gz$/, `-${row.id}.db.gz`) : filename;
-    await storage.put(key, data, { contentType: "application/gzip" });
+    const filename = `${filenameFor(cms, started)}${encryptionKey ? ".enc" : ""}`;
+    const key = await storage.get(filename) ? filename.replace(/\.db\.gz(\.enc)?$/, `-${row.id}.db.gz$1`) : filename;
+    await storage.put(key, data, {
+      contentType: encryptionKey ? "application/octet-stream" : "application/gzip"
+    });
     await pruneBackups(cms, 1);
     row = await update(cms, row, {
       state: "done",
@@ -3113,8 +3155,20 @@ async function downloadBackup(cms, id, by) {
   const file = await (await backupStorage(cms)).get(row.filename);
   if (!file)
     throw new EasyCMSError(`The file ${row.filename} is no longer in the backup storage`, 404);
+  let { filename } = row;
+  let body = file.body;
+  if (filename.endsWith(".enc")) {
+    const encryptionKey = cms.config.backups?.encryptionKey;
+    if (!encryptionKey)
+      throw new EasyCMSError(
+        "This backup is encrypted: set backups.encryptionKey to download it",
+        400
+      );
+    body = decryptBackup(body, encryptionKey);
+    filename = filename.slice(0, -".enc".length);
+  }
   await update(cms, row, { downloadedBy: by, downloadedAt: (/* @__PURE__ */ new Date()).toISOString() });
-  return { filename: row.filename, body: file.body };
+  return { filename, body };
 }
 async function deleteBackup(cms, id) {
   const row = await cms.db.findById({ collection: DATABASE_BACKUPS, id });
@@ -4207,7 +4261,7 @@ var AUTH = keys(`roles rbac tokenExpiration maxLoginAttempts lockWindow trustedO
   resetPasswordExpiration inviteExpiration providers providerSignUp password setupCode members emails`);
 var MEMBERS = keys("roles signUp pages emails");
 var UPLOAD = keys("dir maxFileSize mimeTypes storage imageSizes fromURL folders privateStorage");
-var BACKUPS = keys("frequency at keep dir storage sqlite");
+var BACKUPS = keys("frequency at keep dir storage sqlite encryptionKey");
 var AUDIT = keys("keepDays values failedLogins scope");
 var COLLECTION = keys(`slug labels fields useAsTitle drafts versions schedule preview access hooks
   admin`);
@@ -4649,7 +4703,7 @@ function validateConfig(config) {
   validateAdmin(config, add);
   validateAdminViews(config, add);
   validateUpload(config, add);
-  validateBackups(config, add);
+  validateBackups(config, add, (issue) => issues.push(issue));
   validateAudit(config, add);
   validateAuth(config, add);
   validateCors(config.cors, add);
@@ -4737,6 +4791,14 @@ function validateCronSecret(value, push) {
       severity: "warning"
     });
 }
+function publicURLs(storage) {
+  const url = storage.url;
+  try {
+    return typeof url === "function" && url.call(storage, "backup.db.gz") !== void 0;
+  } catch {
+    return false;
+  }
+}
 function guessable(secret) {
   return /change[-_ ]?me|example|placeholder|secret-?key/i.test(secret) || new Set(secret).size < 8;
 }
@@ -5254,14 +5316,21 @@ function validateAudit(config, add) {
     }
   }
 }
-function validateBackups(config, add) {
+function validateBackups(config, add, push) {
+  const pushWarning = (path, message2, hint) => push({ path, message: message2, hint, severity: "warning" });
   const backups = config.backups;
   if (backups === void 0) return;
   if (typeof backups !== "object" || backups === null) {
     add("backups", "must be an object", "e.g. backups: { frequency: 'daily', keep: 7 }");
     return;
   }
-  const { frequency, at, keep, dir, storage, sqlite } = backups;
+  const { frequency, at, keep, dir, storage, sqlite, encryptionKey } = backups;
+  if (encryptionKey !== void 0 && (typeof encryptionKey !== "string" || encryptionKey.length < MIN_SECRET_LENGTH))
+    add(
+      "backups.encryptionKey",
+      `must be at least ${MIN_SECRET_LENGTH} characters`,
+      "e.g. `openssl rand -hex 32`, kept somewhere other than the backups"
+    );
   if (frequency !== void 0 && frequency !== "daily" && frequency !== "weekly")
     add("backups.frequency", 'must be "daily" or "weekly"');
   if (at !== void 0 && (typeof at !== "string" || !/^([01]\d|2[0-3]):[0-5]\d$/.test(at)))
@@ -5274,6 +5343,14 @@ function validateBackups(config, add) {
     add("backups.dir", "must not be the uploads folder: uploads are served publicly");
   if (storage !== void 0 && (typeof storage !== "object" || storage === null || typeof storage.put !== "function"))
     add("backups.storage", "must be a storage adapter, e.g. s3Storage()");
+  else if (storage !== void 0 && publicURLs(storage)) {
+    const message2 = encryptionKey ? "gives files public URLs; the backups are encrypted, but keep them in a private bucket" : "gives files public URLs: anyone with the address of a backup could download the whole database";
+    pushWarning(
+      "backups.storage",
+      message2,
+      "use a private bucket (no publicURL), or set backups.encryptionKey"
+    );
+  }
   if (sqlite !== void 0 && typeof sqlite !== "function")
     add(
       "backups.sqlite",
@@ -6069,7 +6146,7 @@ function resolveAudit(audit) {
 }
 
 // src/local-api.ts
-import { createHmac as createHmac6, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual5 } from "crypto";
+import { createHmac as createHmac6, randomBytes as randomBytes6, timingSafeEqual as timingSafeEqual5 } from "crypto";
 
 // src/auth/common-passwords.ts
 var LIST = `
@@ -6833,7 +6910,7 @@ var EasyCMS = class {
         }
       ]);
     }
-    const random2 = randomBytes5(4).toString("hex");
+    const random2 = randomBytes6(4).toString("hex");
     const isPrivate = await this.folders.isPrivate(folderOf(MEDIA, data));
     const storage = this.storageFor(isPrivate);
     const filename = withPrivacy(storageKey(file.name, mimeType, random2), isPrivate);
@@ -6901,7 +6978,7 @@ var EasyCMS = class {
       ]);
     const isPrivate = await this.folders.isPrivate(folder);
     const storage = this.storageFor(isPrivate);
-    const key = withPrivacy(storageKey(name, type, randomBytes5(4).toString("hex")), isPrivate);
+    const key = withPrivacy(storageKey(name, type, randomBytes6(4).toString("hex")), isPrivate);
     const upload = storage.uploadURL ? await storage.uploadURL(key, { contentType: type, size, expiresIn: UPLOAD_URL_SECONDS }) : null;
     const ticket = this.sign("upload", {
       key,
@@ -9060,7 +9137,7 @@ function durationSeconds(value) {
 }
 
 // src/rest/admin-modules.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { readFile as readFile3 } from "fs/promises";
 import { createRequire } from "module";
 import { join as join3 } from "path";
@@ -9101,11 +9178,11 @@ async function readAdminModule(cms, index) {
   if (!file) return void 0;
   const body = await readFile3(file, "utf8").catch(() => void 0);
   if (body === void 0) return void 0;
-  return { body, etag: `"${createHash3("sha1").update(body).digest("base64url")}"` };
+  return { body, etag: `"${createHash4("sha1").update(body).digest("base64url")}"` };
 }
 
 // src/version.ts
-var VERSION = true ? "0.64.0" : "0.0.0-dev";
+var VERSION = true ? "0.65.0" : "0.0.0-dev";
 
 // src/rest/admin-deliveries.ts
 var PER_PAGE = 50;
@@ -11376,6 +11453,7 @@ export {
   configSignature,
   copyDatabase,
   diskStorage,
+  decryptBackup,
   writeBackupFile,
   consoleLogger,
   silentLogger,

package/dist/{config-Dgs6FE0S.d.ts → config-DE8ez-a9.d.ts}

@@ -2148,7 +2148,11 @@ interface AuditVerification {
     checked: number;
     /** Entries whose signature does not match: changed after they were written. */
     invalid: ID[];
-    /** Missing ids between entries: deleted entries, or (rarely) inserts that failed. */
+    /**
+     * Missing ids between entries: deleted entries, or (rarely) inserts that failed. Ids are never
+     * reused, so the newest entries deleted show up here once anything is written after them (a
+     * check writes an entry itself). The server's log has each check's last id, to compare with.
+     */
     gaps: number;
     at: string;
 }
@@ -3102,6 +3106,13 @@ interface BackupsConfig {
     readonly dir?: string;
     /** Where backups are stored instead, e.g. `s3Storage()` with a private bucket. */
     readonly storage?: StorageAdapter;
+    /**
+     * Encrypts the backup files (AES-256-GCM), so a leaked bucket or disk holds nothing readable.
+     * At least 32 characters, e.g. from `process.env.EASY_CMS_BACKUP_KEY`; keep a copy somewhere
+     * other than the backups: without it they can't be restored. Downloads from the admin are
+     * decrypted; `easy-cms backup:decrypt <file>` decrypts one by hand.
+     */
+    readonly encryptionKey?: string;
     /**
      * For Postgres: the SQLite adapter that writes the backup file, `sqlite` from
      * `@easy-cms/db-sqlite`. SQLite databases back themselves up and don't need it.

package/dist/{handler-CcmsrLs8.d.ts → handler-Cm1ehtkm.d.ts}

@@ -1,5 +1,7 @@
-import { I as ID, ab as Config, au as EasyCMS, bd as LocalizationConfig, aD as Field, aH as FieldError, aS as FilterOptions, af as CreateEasyCMSOptions, bI as ResolvedConfig } from './config-Dgs6FE0S.js';
+import { I as ID, ab as Config, au as EasyCMS, bd as LocalizationConfig, aD as Field, aH as FieldError, aS as FilterOptions, af as CreateEasyCMSOptions, bI as ResolvedConfig } from './config-DE8ez-a9.js';
 
+/** Decrypts a file from `encryptBackup`; throws for another key or a changed file. */
+declare function decryptBackup(data: Uint8Array, encryptionKey: string): Uint8Array;
 type BackupState = 'pending' | 'running' | 'done' | 'failed';
 /** One backup as the admin shows it (`GET <api>/admin/backups`). */
 interface AdminBackup {
@@ -191,4 +193,4 @@ declare function createRootEndpointHandler<C extends Config>(instance: EasyCMS<C
 /** A cookie of the request; the `__Host-` one (set over HTTPS) first. */
 declare function readCookie(request: Request, name: string): string | undefined;
 
-export { type AdminBackup as A, type BackupState as B, CONFIG_FILE_NAMES as C, DEFAULT_ADMIN_PATH as D, validateFields as E, writeBackupFile as F, type LoadConfigOptions as L, type RestHandler as R, type AdminBackups as a, type ApiHandlerOptions as b, type RestHandlerOptions as c, createApiHandler as d, createRestHandler as e, slugify as f, CSRF_COOKIE as g, CSRF_HEADER as h, DEFAULT_API_PATH as i, DEFAULT_MAX_FILE_SIZE as j, DEFAULT_TOKEN_EXPIRATION as k, loadConfig as l, applyDefaults as m, applyPlugins as n, createRootEndpointHandler as o, fillMissing as p, findConfigFile as q, resolveConfig as r, sharedEasyCMS as s, forwardedClientIp as t, generateSlugs as u, importConfig as v, mergeForUpdate as w, parseId as x, platformClientIp as y, readCookie as z };
+export { type AdminBackup as A, type BackupState as B, CONFIG_FILE_NAMES as C, DEFAULT_ADMIN_PATH as D, readCookie as E, validateFields as F, writeBackupFile as G, type LoadConfigOptions as L, type RestHandler as R, type AdminBackups as a, type ApiHandlerOptions as b, type RestHandlerOptions as c, createApiHandler as d, createRestHandler as e, slugify as f, CSRF_COOKIE as g, CSRF_HEADER as h, DEFAULT_API_PATH as i, DEFAULT_MAX_FILE_SIZE as j, DEFAULT_TOKEN_EXPIRATION as k, loadConfig as l, applyDefaults as m, applyPlugins as n, createRootEndpointHandler as o, decryptBackup as p, fillMissing as q, resolveConfig as r, sharedEasyCMS as s, findConfigFile as t, forwardedClientIp as u, generateSlugs as v, importConfig as w, mergeForUpdate as x, parseId as y, platformClientIp as z };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { P as PaginatedDocs, I as ID, E as EmailSetting } from './config-Dgs6FE0S.js';
-export { A as ADAPTER_API_VERSION, a as ADMIN_ICONS, b as Access, c as AccessArgs, d as AccessOptions, e as AdminBrand, f as AdminCommand, g as AdminComponent, h as AdminConfig, i as AdminFieldArgs, j as AdminIcon, k as AdminLocale, l as AdminPage, m as AdminRole, n as AdminRoleChange, o as AdminRoleField, p as AdminRoleTarget, q as AdminRoleView, r as AdminRoles, s as AdminSso, t as AdminSwitcher, u as AdminViewAccess, v as AfterChangeHook, w as AfterDeleteHook, x as AfterReadHook, y as ApiKeyContext, z as ApiKeyGlobalOperation, B as ApiKeyOperation, C as ApiKeyPermissions, D as ArrayField, F as AuditChange, G as AuditConfig, H as AuditEntry, J as AuditLog, K as AuditPage, L as AuditVerification, M as Auth, N as AuthConfig, O as AuthProvider, Q as AuthProviderProfile, R as AuthProviderRequest, S as AuthUser, T as BackupsConfig, U as BeforeChangeHook, V as BeforeDeleteHook, W as BeforeValidateHook, X as Block, Y as BlocksField, Z as BooleanField, _ as BuiltinApiKeysCollection, $ as BuiltinMediaCollection, a0 as BuiltinMediaFoldersCollection, a1 as BuiltinUsersCollection, a2 as BundleHints, a3 as CliCommand, a4 as CollectionAccess, a5 as CollectionAdmin, a6 as CollectionConfig, a7 as CollectionDocument, a8 as CollectionHooks, a9 as CollectionListAdmin, aa as CollectionSlug, ab as Config, ac as ConfigError, ad as ConfigIssue, ae as ContainerAdmin, af as CreateEasyCMSOptions, ag as CreateInput, ah as CreateMigrationResult, ai as CustomField, aj as CustomFieldTypes, ak as DashboardWidget, al as Database, am as DatabaseAdapter, an as DatabaseInitArgs, ao as DatabaseTransfer, ap as DateField, aq as DepthOptions, ar as DirectUpload, as as DiskStorageOptions, at as DocumentOf, au as EasyCMS, av as EasyCMSError, aw as EmailAdapter, ax as EmailField, ay as EmailMessage, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aC as FIELD_TYPES, aD as Field, aE as FieldAccess, aF as FieldAccessFn, aG as FieldAdmin, aH as FieldError, aI as FieldRule, aJ as FieldType, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aN as FieldValidate, aO as FieldValidateContext, aP as FieldValue, aQ as FieldsInput, aR as FieldsValue, aS as FilterOptions, aT as FilterOptionsArgs, aU as FindArgs, aV as FindOptions, aW as FolderLevel, aX as FolderPermissions, aY as ForbiddenError, aZ as GlobalAccess, a_ as GlobalConfig, a$ as GlobalDocument, b0 as GlobalHooks, b1 as GlobalInput, b2 as GlobalSlug, b3 as GroupField, b4 as ImageSize, b5 as IncrementOptions, b6 as InferCollection, b7 as InferGlobal, b8 as JobConfig, b9 as JsonField, ba as Label, bb as LayoutNode, bc as LivePreview, bd as LocalizationConfig, be as Logger, bf as LoginArgs, bg as MediaDocument, bh as MediaSize, bi as MembersConfig, bj as MembersSignup, bk as MigrationInfo, bl as NavGroup, bm as NotFoundError, bn as NumberField, bo as OnRequest, bp as OnRequestArgs, bq as Operation, br as PLUGIN_API_VERSION, bs as PasswordEmail, bt as PasswordEmailArgs, bu as PasswordEmailFn, bv as PasswordLinkOptions, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bA as PreviewTarget, bB as PreviewURL, bC as QueryError, bD as ROLE_OPERATIONS, bE as RawDocument, bF as ReadOptions, bG as RelationshipField, bH as RequestContext, bI as ResolvedConfig, bJ as RichTextDocument, bK as RichTextField, bL as Role, bM as RoleOperation, bN as RolePermissions, bO as Roles, bP as RoutesConfig, bQ as ScheduledPublish, bR as SchemaError, bS as SchemaMode, bT as SelectField, bU as SelectOption, bV as Session, bW as SidebarPanel, bX as SignupArgs, bY as SignupResult, bZ as SingleSignOn, b_ as SlugField, b$ as SlugOf, c0 as SsoOutcome, c1 as SsoProviderRef, c2 as StorageAdapter, c3 as StoredFile, c4 as TextField, c5 as TextareaField, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, c9 as UpdateInput, ca as UpdateOptions, cb as UploadConfig, cc as UploadField, cd as UploadFromURLConfig, ce as UserIdentity, cf as ValidationError, cg as Version, ch as VersionSummary, ci as VersionsConfig, cj as WEBHOOK_EVENTS, ck as WebhookConfig, cl as WebhookEvent, cm as WebhookPayload, cn as Where, co as WhereOperators, cp as anyone, cq as consoleEmail, cr as consoleLogger, cs as createEasyCMS, ct as defineConfig, cu as defineFieldType, cv as definePlugin, cw as diskStorage, cx as hasRows, cy as isAdmin, cz as isHasMany, cA as isSignedIn, cB as isStaff, cC as isSystemAdmin, cD as mimeAllowedBy, cE as rowFields, cF as silentLogger, cG as uniqueWithinOf } from './config-Dgs6FE0S.js';
-export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-8hrkYMuR.js';
-export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-CcmsrLs8.js';
+import { P as PaginatedDocs, I as ID, E as EmailSetting } from './config-DE8ez-a9.js';
+export { A as ADAPTER_API_VERSION, a as ADMIN_ICONS, b as Access, c as AccessArgs, d as AccessOptions, e as AdminBrand, f as AdminCommand, g as AdminComponent, h as AdminConfig, i as AdminFieldArgs, j as AdminIcon, k as AdminLocale, l as AdminPage, m as AdminRole, n as AdminRoleChange, o as AdminRoleField, p as AdminRoleTarget, q as AdminRoleView, r as AdminRoles, s as AdminSso, t as AdminSwitcher, u as AdminViewAccess, v as AfterChangeHook, w as AfterDeleteHook, x as AfterReadHook, y as ApiKeyContext, z as ApiKeyGlobalOperation, B as ApiKeyOperation, C as ApiKeyPermissions, D as ArrayField, F as AuditChange, G as AuditConfig, H as AuditEntry, J as AuditLog, K as AuditPage, L as AuditVerification, M as Auth, N as AuthConfig, O as AuthProvider, Q as AuthProviderProfile, R as AuthProviderRequest, S as AuthUser, T as BackupsConfig, U as BeforeChangeHook, V as BeforeDeleteHook, W as BeforeValidateHook, X as Block, Y as BlocksField, Z as BooleanField, _ as BuiltinApiKeysCollection, $ as BuiltinMediaCollection, a0 as BuiltinMediaFoldersCollection, a1 as BuiltinUsersCollection, a2 as BundleHints, a3 as CliCommand, a4 as CollectionAccess, a5 as CollectionAdmin, a6 as CollectionConfig, a7 as CollectionDocument, a8 as CollectionHooks, a9 as CollectionListAdmin, aa as CollectionSlug, ab as Config, ac as ConfigError, ad as ConfigIssue, ae as ContainerAdmin, af as CreateEasyCMSOptions, ag as CreateInput, ah as CreateMigrationResult, ai as CustomField, aj as CustomFieldTypes, ak as DashboardWidget, al as Database, am as DatabaseAdapter, an as DatabaseInitArgs, ao as DatabaseTransfer, ap as DateField, aq as DepthOptions, ar as DirectUpload, as as DiskStorageOptions, at as DocumentOf, au as EasyCMS, av as EasyCMSError, aw as EmailAdapter, ax as EmailField, ay as EmailMessage, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aC as FIELD_TYPES, aD as Field, aE as FieldAccess, aF as FieldAccessFn, aG as FieldAdmin, aH as FieldError, aI as FieldRule, aJ as FieldType, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aN as FieldValidate, aO as FieldValidateContext, aP as FieldValue, aQ as FieldsInput, aR as FieldsValue, aS as FilterOptions, aT as FilterOptionsArgs, aU as FindArgs, aV as FindOptions, aW as FolderLevel, aX as FolderPermissions, aY as ForbiddenError, aZ as GlobalAccess, a_ as GlobalConfig, a$ as GlobalDocument, b0 as GlobalHooks, b1 as GlobalInput, b2 as GlobalSlug, b3 as GroupField, b4 as ImageSize, b5 as IncrementOptions, b6 as InferCollection, b7 as InferGlobal, b8 as JobConfig, b9 as JsonField, ba as Label, bb as LayoutNode, bc as LivePreview, bd as LocalizationConfig, be as Logger, bf as LoginArgs, bg as MediaDocument, bh as MediaSize, bi as MembersConfig, bj as MembersSignup, bk as MigrationInfo, bl as NavGroup, bm as NotFoundError, bn as NumberField, bo as OnRequest, bp as OnRequestArgs, bq as Operation, br as PLUGIN_API_VERSION, bs as PasswordEmail, bt as PasswordEmailArgs, bu as PasswordEmailFn, bv as PasswordLinkOptions, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bA as PreviewTarget, bB as PreviewURL, bC as QueryError, bD as ROLE_OPERATIONS, bE as RawDocument, bF as ReadOptions, bG as RelationshipField, bH as RequestContext, bI as ResolvedConfig, bJ as RichTextDocument, bK as RichTextField, bL as Role, bM as RoleOperation, bN as RolePermissions, bO as Roles, bP as RoutesConfig, bQ as ScheduledPublish, bR as SchemaError, bS as SchemaMode, bT as SelectField, bU as SelectOption, bV as Session, bW as SidebarPanel, bX as SignupArgs, bY as SignupResult, bZ as SingleSignOn, b_ as SlugField, b$ as SlugOf, c0 as SsoOutcome, c1 as SsoProviderRef, c2 as StorageAdapter, c3 as StoredFile, c4 as TextField, c5 as TextareaField, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, c9 as UpdateInput, ca as UpdateOptions, cb as UploadConfig, cc as UploadField, cd as UploadFromURLConfig, ce as UserIdentity, cf as ValidationError, cg as Version, ch as VersionSummary, ci as VersionsConfig, cj as WEBHOOK_EVENTS, ck as WebhookConfig, cl as WebhookEvent, cm as WebhookPayload, cn as Where, co as WhereOperators, cp as anyone, cq as consoleEmail, cr as consoleLogger, cs as createEasyCMS, ct as defineConfig, cu as defineFieldType, cv as definePlugin, cw as diskStorage, cx as hasRows, cy as isAdmin, cz as isHasMany, cA as isSignedIn, cB as isStaff, cC as isSystemAdmin, cD as mimeAllowedBy, cE as rowFields, cF as silentLogger, cG as uniqueWithinOf } from './config-DE8ez-a9.js';
+export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-CX7E7RZZ.js';
+export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-Cm1ehtkm.js';
 export { FieldCondition, matchesCondition } from './conditions.js';
 
 type DeliveryKind = 'webhook' | 'email';

package/dist/index.js

@@ -23,7 +23,7 @@ import {
   sharedEasyCMS,
   silentLogger,
   slugify
-} from "./chunk-JZW6G6XI.js";
+} from "./chunk-BGGQ36LR.js";
 import {
   matchesCondition
 } from "./chunk-U266LV4M.js";

package/dist/internal.d.ts

@@ -1,6 +1,6 @@
-import { ab as Config, al as Database, bl as NavGroup, a6 as CollectionConfig, I as ID, bE as RawDocument, aD as Field, bI as ResolvedConfig, ad as ConfigIssue } from './config-Dgs6FE0S.js';
-export { cH as API_KEYS, cI as API_KEY_GLOBAL_OPERATIONS, cJ as API_KEY_OPERATIONS, cK as DEFAULT_MAX_VERSIONS, cL as DEFAULT_PASSWORD_EMAILS, cM as FIELD_TYPE_BASES, cN as FOLDER_LEVELS, cO as MediaFolders, cP as SSO_COOKIE, cQ as codeOfStatus, cx as hasRows, cz as isHasMany, cR as keyAllows, cD as mimeAllowedBy, cE as rowFields, cG as uniqueWithinOf } from './config-Dgs6FE0S.js';
-export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as fillMissing, q as findConfigFile, t as forwardedClientIp, u as generateSlugs, v as importConfig, w as mergeForUpdate, x as parseId, y as platformClientIp, z as readCookie, E as validateFields, F as writeBackupFile } from './handler-CcmsrLs8.js';
+import { ab as Config, al as Database, bl as NavGroup, a6 as CollectionConfig, I as ID, bE as RawDocument, aD as Field, bI as ResolvedConfig, ad as ConfigIssue } from './config-DE8ez-a9.js';
+export { cH as API_KEYS, cI as API_KEY_GLOBAL_OPERATIONS, cJ as API_KEY_OPERATIONS, cK as DEFAULT_MAX_VERSIONS, cL as DEFAULT_PASSWORD_EMAILS, cM as FIELD_TYPE_BASES, cN as FOLDER_LEVELS, cO as MediaFolders, cP as SSO_COOKIE, cQ as codeOfStatus, cx as hasRows, cz as isHasMany, cR as keyAllows, cD as mimeAllowedBy, cE as rowFields, cG as uniqueWithinOf } from './config-DE8ez-a9.js';
+export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as mergeForUpdate, y as parseId, z as platformClientIp, E as readCookie, F as validateFields, G as writeBackupFile } from './handler-Cm1ehtkm.js';
 export { conditionIssues } from './conditions.js';
 
 /** The session cookie the REST API sets at login. */

package/dist/internal.js

@@ -31,6 +31,7 @@ import {
   configSignature,
   copyDatabase,
   createRootEndpointHandler,
+  decryptBackup,
   fillMissing,
   findConfigFile,
   formToken,
@@ -52,7 +53,7 @@ import {
   verifyPassword,
   verifyTurnstile,
   writeBackupFile
-} from "./chunk-JZW6G6XI.js";
+} from "./chunk-BGGQ36LR.js";
 import {
   conditionIssues
 } from "./chunk-U266LV4M.js";
@@ -275,6 +276,7 @@ export {
   configSignature,
   copyDatabase,
   createRootEndpointHandler,
+  decryptBackup,
   expandMimeTypes,
   fillMissing,
   findConfigFile,

package/dist/{plugin-8hrkYMuR.d.ts → plugin-CX7E7RZZ.d.ts}

@@ -1,4 +1,4 @@
-import { ba as Label, aD as Field, I as ID, k as AdminLocale, t as AdminSwitcher, c1 as SsoProviderRef } from './config-Dgs6FE0S.js';
+import { ba as Label, aD as Field, I as ID, k as AdminLocale, t as AdminSwitcher, c1 as SsoProviderRef } from './config-DE8ez-a9.js';
 import { FieldCondition } from './conditions.js';
 
 /** A Web Component from an admin module, with its `props` (plain JSON). */

package/dist/plugin.d.ts

@@ -1,3 +1,3 @@
-export { a as ADMIN_ICONS, g as AdminComponent, j as AdminIcon, S as AuthUser, a3 as CliCommand, a4 as CollectionAccess, a6 as CollectionConfig, ab as Config, ac as ConfigError, ak as DashboardWidget, av as EasyCMSError, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aD as Field, aE as FieldAccess, aH as FieldError, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aY as ForbiddenError, a_ as GlobalConfig, I as ID, b8 as JobConfig, ba as Label, bl as NavGroup, bm as NotFoundError, bo as OnRequest, bp as OnRequestArgs, br as PLUGIN_API_VERSION, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bC as QueryError, bH as RequestContext, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, cf as ValidationError, cn as Where, cu as defineFieldType, cv as definePlugin } from './config-Dgs6FE0S.js';
-export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-8hrkYMuR.js';
+export { a as ADMIN_ICONS, g as AdminComponent, j as AdminIcon, S as AuthUser, a3 as CliCommand, a4 as CollectionAccess, a6 as CollectionConfig, ab as Config, ac as ConfigError, ak as DashboardWidget, av as EasyCMSError, az as Endpoint, aA as EndpointRequest, aB as ErrorCode, aD as Field, aE as FieldAccess, aH as FieldError, aK as FieldTypeBase, aL as FieldTypeDefinition, aM as FieldTypeValidateContext, aY as ForbiddenError, a_ as GlobalConfig, I as ID, b8 as JobConfig, ba as Label, bl as NavGroup, bm as NotFoundError, bo as OnRequest, bp as OnRequestArgs, br as PLUGIN_API_VERSION, bw as PayloadTooLargeError, bx as Plugin, by as PluginInfo, bz as PluginTypes, bC as QueryError, bH as RequestContext, c6 as TooManyRequestsError, c7 as TypedPlugin, c8 as UnauthorizedError, cf as ValidationError, cn as Where, cu as defineFieldType, cv as definePlugin } from './config-DE8ez-a9.js';
+export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-CX7E7RZZ.js';
 import './conditions.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.64.0",
+  "version": "0.65.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",