@easy-cms/core 1.15.0 → 1.15.1

package/dist/{chunk-63UEVLN6.js → chunk-Q3QLUBFK.js}

@@ -35,7 +35,7 @@ import {
   warnDeprecated,
   withCharset,
   withPrivacy
-} from "./chunk-RTKWMVAC.js";
+} from "./chunk-SKGKGKUN.js";
 
 // src/access.ts
 var isSystemAdmin = (user) => user?.role === "admin" && !user.apiKey && user.scoped !== true;
@@ -2314,7 +2314,10 @@ var ADAPTER_API_VERSION = 1;
 
 // src/document.ts
 import { randomUUID } from "crypto";
-var EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function isEmail(value) {
+  const at = value.indexOf("@");
+  return at > 0 && !value.includes("@", at + 1) && !/\s/.test(value) && value.slice(at + 2, -1).includes(".");
+}
 var isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 function itemsOf(field, n) {
   const unit = field.type === "upload" ? "file" : field.type === "relationship" ? "document" : "row";
@@ -2522,8 +2525,7 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
       return raw;
     }
     case "email": {
-      if (typeof raw !== "string" || !EMAIL_PATTERN.test(raw))
-        return fail("must be a valid email address");
+      if (typeof raw !== "string" || !isEmail(raw)) return fail("must be a valid email address");
       return raw.trim().toLowerCase();
     }
     case "number": {
@@ -3735,6 +3737,7 @@ async function populate(load, collections, fields, docs, depth) {
 }
 function collectSlots(fields, data, bySlug, slots) {
   for (const field of fields) {
+    if (field.name === "__proto__") continue;
     const value = data[field.name];
     if (value === null || value === void 0) continue;
     if (field.type === "group") {
@@ -4440,7 +4443,10 @@ for (const [net, prefix] of [
   ["::1", 128],
   ["64:ff9b:1::", 48],
   ["100::", 64],
+  // Teredo and 6to4 tunnel to an IPv4 address the IPv6 one carries: any of them, private too.
+  ["2001::", 32],
   ["2001:db8::", 32],
+  ["2002::", 16],
   ["fc00::", 7],
   ["fe80::", 10],
   ["ff00::", 8]
@@ -6406,6 +6412,15 @@ function validateFields2(fields, path, reserved, collectionSlugs, add) {
       add(`${path}[${i}].name`, `must be a valid identifier (got ${JSON.stringify(name)})`);
       return;
     }
+    if (name === "__proto__") {
+      add(`${path}[${i}].name`, '"__proto__" is reserved by JavaScript');
+      return;
+    }
+    if (name === "constructor" || name === "prototype")
+      warnDeprecated(
+        "EASY_CMS_DEP006",
+        `A field named "${name}" (${path}.${name}) works through 1.x; rename it before 2.0.`
+      );
     if (reserved.has(name)) {
       add(`${path}.${name}`, `"${name}" is reserved`, "Easy CMS adds this field automatically");
     }
@@ -7030,7 +7045,7 @@ function cacheableResponse(request, body, status, headers, times, tags) {
 }
 
 // src/version.ts
-var VERSION = true ? "1.15.0" : "0.0.0-dev";
+var VERSION = true ? "1.15.1" : "0.0.0-dev";
 
 // src/telemetry.ts
 var DB_CALLS = /* @__PURE__ */ new Set([
@@ -11183,7 +11198,6 @@ async function deleteFailedDeliveries(cms, kind) {
 }
 
 // src/rest/admin-email.ts
-var EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 var LIMIT = 5;
 var WINDOW = 10 * 6e4;
 var sentAt = /* @__PURE__ */ new WeakMap();
@@ -11232,7 +11246,7 @@ async function sendTestEmail(cms, user, to, locale) {
   const adapter = cms.config.email;
   if (!adapter) return { ok: false, error: "Email is not set up (`email` in the config)" };
   const address = typeof to === "string" && to.trim() ? to.trim() : user.email;
-  if (!EMAIL.test(address))
+  if (!isEmail(address))
     throw new ValidationError("email", [{ field: "to", message: "must be an email address" }]);
   const times = sentAt.get(cms) ?? /* @__PURE__ */ new Map();
   sentAt.set(cms, times);
@@ -13354,13 +13368,14 @@ function errorResponse(cms, error, headers, production) {
     }
     return new Response(JSON.stringify({ errors }), { status: error.status, headers });
   }
-  const message2 = error instanceof Error ? error.message : String(error);
-  cms.logger.error(`REST request failed: ${message2}`, { error });
-  const body = {
-    errors: [
-      { message: production ? "Internal Server Error" : message2, code: "INTERNAL_SERVER_ERROR" }
-    ]
-  };
+  cms.logger.error(
+    `REST request failed: ${error instanceof Error ? error.message : String(error)}`,
+    {
+      error
+    }
+  );
+  const message2 = !production && error instanceof Error ? error.message : "Internal Server Error";
+  const body = { errors: [{ message: message2, code: "INTERNAL_SERVER_ERROR" }] };
   return new Response(JSON.stringify(body), { status: 500, headers });
 }
 
@@ -13496,6 +13511,7 @@ export {
   SSO_COOKIE,
   Auth,
   ADAPTER_API_VERSION,
+  isEmail,
   slugify,
   applyDefaults,
   fillMissing,

package/dist/{chunk-RTKWMVAC.js → chunk-SKGKGKUN.js}

@@ -166,6 +166,25 @@ function zipType(data) {
   if (contains(data, "ppt/presentation.xml")) return OFFICE[2];
   return "application/zip";
 }
+function isSvg(text) {
+  let rest = text;
+  if (rest.slice(0, 5).toLowerCase() === "<?xml") {
+    const end = rest.indexOf(">");
+    if (end < 0) return false;
+    rest = rest.slice(end + 1).trimStart();
+  }
+  while (rest.startsWith("<!--")) {
+    const end = rest.indexOf("-->", 4);
+    if (end < 0) return false;
+    rest = rest.slice(end + 3).trimStart();
+  }
+  if (/^<!DOCTYPE svg/i.test(rest)) {
+    const end = rest.indexOf(">");
+    if (end < 0) return false;
+    rest = rest.slice(end + 1).trimStart();
+  }
+  return /^<svg[\s>]/i.test(rest);
+}
 function sniffMimeType(data, name = "") {
   if (startsWith(data, [137, 80, 78, 71, 13, 10, 26, 10])) return "image/png";
   if (startsWith(data, [255, 216, 255])) return "image/jpeg";
@@ -195,8 +214,7 @@ function sniffMimeType(data, name = "") {
     return void 0;
   }
   const trimmed = text.replace(/^/, "").trimStart();
-  if (/^(<\?xml[^>]*>\s*)?(<!--[\s\S]*?-->\s*)*(<!DOCTYPE svg[^>]*>\s*)?<svg[\s>]/i.test(trimmed))
-    return "image/svg+xml";
+  if (isSvg(trimmed)) return "image/svg+xml";
   return /\.csv$/i.test(name) ? "text/csv" : "text/plain";
 }
 function mimeAllowed(type, allowed) {

package/dist/{handler-BjlBwaiO.d.ts → handler-Ccc-CwBq.d.ts}

@@ -45,6 +45,11 @@ declare function writeBackupFile<C extends Config>(cms: EasyCMS<C>, file: string
 type Localization = Required<LocalizationConfig>;
 
 type Data = Record<string, unknown>;
+/**
+ * `name@host.tld`: no whitespace, one `@`, and a dot inside the part after it. String operations,
+ * not a regex: `/^[^\s@]+@[^\s@]+\.[^\s@]+$/` takes time quadratic in the length.
+ */
+declare function isEmail(value: string): boolean;
 /**
  * Turns text into a URL slug. Keeps letters and digits of any script,
  * so Thai titles stay readable: "สวัสดี World!" → "สวัสดี-world".
@@ -193,5 +198,5 @@ declare function createRootEndpointHandler<C extends Config>(instance: EasyCMS<C
 /** A cookie of the request; the `__Host-` one (set over HTTPS) first. */
 declare function readCookie(request: Request, name: string): string | undefined;
 
-export { CONFIG_FILE_NAMES as C, DEFAULT_ADMIN_PATH as D, readCookie as E, validateFields as F, writeBackupFile as G, createApiHandler as d, createRestHandler as e, slugify as f, CSRF_COOKIE as g, CSRF_HEADER as h, DEFAULT_API_PATH as i, DEFAULT_MAX_FILE_SIZE as j, DEFAULT_TOKEN_EXPIRATION as k, loadConfig as l, applyDefaults as m, applyPlugins as n, createRootEndpointHandler as o, decryptBackup as p, fillMissing as q, resolveConfig as r, sharedEasyCMS as s, findConfigFile as t, forwardedClientIp as u, generateSlugs as v, importConfig as w, mergeForUpdate as x, parseId as y, platformClientIp as z };
+export { CONFIG_FILE_NAMES as C, DEFAULT_ADMIN_PATH as D, platformClientIp as E, readCookie as F, validateFields as G, writeBackupFile as H, createApiHandler as d, createRestHandler as e, slugify as f, CSRF_COOKIE as g, CSRF_HEADER as h, DEFAULT_API_PATH as i, DEFAULT_MAX_FILE_SIZE as j, DEFAULT_TOKEN_EXPIRATION as k, loadConfig as l, applyDefaults as m, applyPlugins as n, createRootEndpointHandler as o, decryptBackup as p, fillMissing as q, resolveConfig as r, sharedEasyCMS as s, findConfigFile as t, forwardedClientIp as u, generateSlugs as v, importConfig as w, isEmail as x, mergeForUpdate as y, parseId as z };
 export type { AdminBackup as A, BackupState as B, LoadConfigOptions as L, RestHandler as R, AdminBackups as a, ApiHandlerOptions as b, RestHandlerOptions as c };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { P as PaginatedDocs, I as ID, E as EmailSetting } from './config-BLxN8qcy.js';
 export { A as ADAPTER_API_VERSION, a as ADMIN_ICONS, b as Access, c as AccessArgs, d as AccessOptions, e as AdminBrand, f as AdminCommand, g as AdminComponent, h as AdminConfig, i as AdminFieldArgs, j as AdminIcon, k as AdminLocale, l as AdminPage, m as AdminRole, n as AdminRoleChange, o as AdminRoleField, p as AdminRoleTarget, q as AdminRoleView, r as AdminRoles, s as AdminSso, t as AdminSwitcher, u as AdminViewAccess, v as AfterChangeHook, w as AfterDeleteHook, x as AfterReadHook, y as ApiKeyContext, z as ApiKeyGlobalOperation, B as ApiKeyOperation, C as ApiKeyPermissions, D as ArrayField, F as AuditChange, G as AuditConfig, H as AuditEntry, J as AuditLog, K as AuditPage, L as AuditVerification, M as Auth, N as AuthConfig, O as AuthProvider, Q as AuthProviderProfile, R as AuthProviderRequest, S as AuthUser, T as BackupsConfig, U as BeforeChangeHook, V as BeforeDeleteHook, W as BeforeValidateHook, X as Block, Y as BlocksField, Z as BooleanField, _ as BuiltinApiKeysCollection, $ as BuiltinMediaCollection, a0 as BuiltinMediaFoldersCollection, a1 as BuiltinUsersCollection, a2 as BundleHints, a3 as CliCommand, a4 as CollectionAccess, a5 as CollectionAdmin, a6 as CollectionConfig, a7 as CollectionDocument, a8 as CollectionHooks, a9 as CollectionListAdmin, aa as CollectionSearch, ab as CollectionSlug, ac as Config, ad as ConfigError, ae as ConfigIssue, af as ContainerAdmin, ag as CreateEasyCMSOptions, ah as CreateInput, ai as CreateMigrationResult, aj as CursorDocs, ak as CustomField, al as CustomFieldTypes, am as DashboardWidget, an as Database, ao as DatabaseAdapter, ap as DatabaseInitArgs, aq as DatabaseTransfer, ar as DateField, as as DepthOptions, at as DirectUpload, au as DiskStorageOptions, av as DocumentOf, aw as EasyCMS, ax as EasyCMSError, ay as EmailAdapter, az as EmailField, aA as EmailMessage, aB as Endpoint, aC as EndpointRequest, aD as ErrorCode, aE as FIELD_TYPES, aF as Field, aG as FieldAccess, aH as FieldAccessFn, aI as FieldAdmin, aJ as FieldError, aK as FieldRule, aL as FieldType, aM as FieldTypeBase, aN as FieldTypeDefinition, aO as FieldTypeValidateContext, aP as FieldValidate, aQ as FieldValidateContext, aR as FieldValue, aS as FieldsInput, aT as FieldsValue, aU as FilterOptions, aV as FilterOptionsArgs, aW as FindAfterArgs, aX as FindArgs, aY as FindOptions, aZ as FolderLevel, a_ as FolderPermissions, a$ as ForbiddenError, b0 as GlobalAccess, b1 as GlobalConfig, b2 as GlobalDocument, b3 as GlobalHooks, b4 as GlobalInput, b5 as GlobalSlug, b6 as GroupField, b7 as ImageSize, b8 as IncrementOptions, b9 as InferCollection, ba as InferGlobal, bb as JobConfig, bc as JsonField, bd as KeysetPage, be as Label, bf as LayoutNode, bg as LivePreview, bh as LocaleOf, bi as LocalizationConfig, bj as LogDetails, bk as Logger, bl as LoginArgs, bm as LogsConfig, bn as MediaDocument, bo as MediaSize, bp as MembersConfig, bq as MembersSignup, br as MigrationInfo, bs as NavGroup, bt as NotFoundError, bu as NumberField, bv as OnRequest, bw as OnRequestArgs, bx as Operation, by as OutboxRow, bz as PLUGIN_API_VERSION, bA as PasswordEmail, bB as PasswordEmailArgs, bC as PasswordEmailFn, bD as PasswordLinkOptions, bE as PayloadTooLargeError, bF as Plugin, bG as PluginInfo, bH as PluginTypes, bI as PreviewTarget, bJ as PreviewURL, bK as QueryError, bL as ROLE_OPERATIONS, bM as RawDocument, bN as ReadOptions, bO as RelationshipField, bP as RequestContext, bQ as ResolvedConfig, bR as RichTextDocument, bS as RichTextField, bT as Role, bU as RoleOperation, bV as RolePermissions, bW as Roles, bX as RoutesConfig, bY as ScheduledPublish, bZ as SchemaError, b_ as SchemaMode, b$ as SearchAdapter, c0 as SearchEntry, c1 as SearchHits, c2 as SearchOptions, c3 as SearchQuery, c4 as SearchResults, c5 as SearchSetting, c6 as SelectField, c7 as SelectOption, c8 as Session, c9 as SidebarPanel, ca as SignupArgs, cb as SignupResult, cc as SingleSignOn, cd as SlugField, ce as SlugOf, cf as SsoOutcome, cg as SsoProviderRef, ch as StorageAdapter, ci as StoredFile, cj as TelemetryConfig, ck as TextField, cl as TextareaField, cm as TooManyRequestsError, cn as TypedPlugin, co as UnauthorizedError, cp as UncountedDocs, cq as UpdateInput, cr as UpdateOptions, cs as UploadConfig, ct as UploadField, cu as UploadFromURLConfig, cv as UserIdentity, cw as ValidationError, cx as Version, cy as VersionSummary, cz as VersionsConfig, cA as WEBHOOK_EVENTS, cB as WebhookConfig, cC as WebhookEvent, cD as WebhookPayload, cE as Where, cF as WhereOperators, cG as anyone, cH as consoleEmail, cI as consoleLogger, cJ as createEasyCMS, cK as defineConfig, cL as defineFieldType, cM as definePlugin, cN as diskStorage, cO as hasRows, cP as isAdmin, cQ as isHasMany, cR as isSignedIn, cS as isStaff, cT as isSystemAdmin, cU as jsonLogger, cV as memorySearch, cW as mimeAllowedBy, cX as rowFields, cY as silentLogger, cZ as uniqueWithinOf } from './config-BLxN8qcy.js';
 export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-JIb70PKm.js';
-export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-BjlBwaiO.js';
+export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-Ccc-CwBq.js';
 export { FieldCondition, matchesCondition } from './conditions.js';
 
 type DeliveryKind = 'webhook' | 'email';

package/dist/index.js

@@ -26,7 +26,7 @@ import {
   sharedEasyCMS,
   silentLogger,
   slugify
-} from "./chunk-63UEVLN6.js";
+} from "./chunk-Q3QLUBFK.js";
 import {
   matchesCondition
 } from "./chunk-U266LV4M.js";
@@ -51,7 +51,7 @@ import {
   defineFieldType,
   definePlugin,
   warnDeprecated
-} from "./chunk-RTKWMVAC.js";
+} from "./chunk-SKGKGKUN.js";
 export {
   ADAPTER_API_VERSION,
   ADMIN_API_VERSION,

package/dist/internal.d.ts

@@ -1,6 +1,6 @@
 import { Config, Database, EasyCMS, NavGroup, CollectionConfig, ID, RawDocument, Field, ResolvedConfig, ConfigIssue } from './index.js';
 export { c_ as API_KEYS, c$ as API_KEY_GLOBAL_OPERATIONS, d0 as API_KEY_OPERATIONS, d1 as DEFAULT_MAX_VERSIONS, d2 as DEFAULT_PASSWORD_EMAILS, d3 as FIELD_TYPE_BASES, d4 as FOLDER_LEVELS, d5 as MediaFolders, d6 as SSO_COOKIE, d7 as codeOfStatus, cO as hasRows, cQ as isHasMany, d8 as isJsonLogger, d9 as keyAllows, da as logFormat, cW as mimeAllowedBy, cX as rowFields, cZ as uniqueWithinOf } from './config-BLxN8qcy.js';
-export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as mergeForUpdate, y as parseId, z as platformClientIp, E as readCookie, F as validateFields, G as writeBackupFile } from './handler-BjlBwaiO.js';
+export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as isEmail, y as mergeForUpdate, z as parseId, E as platformClientIp, F as readCookie, G as validateFields, H as writeBackupFile } from './handler-Ccc-CwBq.js';
 export { conditionIssues } from './conditions.js';
 
 /** The session cookie the REST API sets at login. */

package/dist/internal.js

@@ -41,6 +41,7 @@ import {
   healthResponse,
   honeypotName,
   importConfig,
+  isEmail,
   isJsonLogger,
   keyAllows,
   logFormat,
@@ -56,7 +57,7 @@ import {
   verifyPassword,
   verifyTurnstile,
   writeBackupFile
-} from "./chunk-63UEVLN6.js";
+} from "./chunk-Q3QLUBFK.js";
 import {
   conditionIssues
 } from "./chunk-U266LV4M.js";
@@ -74,7 +75,7 @@ import {
   rowFields,
   sniffMimeType,
   uniqueWithinOf
-} from "./chunk-RTKWMVAC.js";
+} from "./chunk-SKGKGKUN.js";
 
 // src/typegen.ts
 var pascal = (name) => name.split(/[^A-Za-z0-9]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
@@ -293,6 +294,7 @@ export {
   honeypotName,
   imageDimensions,
   importConfig,
+  isEmail,
   isHasMany,
   isJsonLogger,
   keyAllows,

package/dist/plugin.js

@@ -16,7 +16,7 @@ import {
   defineFieldType,
   definePlugin,
   warnDeprecated
-} from "./chunk-RTKWMVAC.js";
+} from "./chunk-SKGKGKUN.js";
 export {
   ADMIN_API_VERSION,
   ADMIN_ICONS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "1.15.0",
+  "version": "1.15.1",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",