@easy-cms/core 1.18.0 → 1.19.0

package/dist/{chunk-NTAFZ4M6.js → chunk-FZCQXH5M.js}

@@ -154,6 +154,7 @@ var ROLES = "user-roles";
 var USER_IDENTITIES = "user-identities";
 var AUDIT_LOGS = "audit-logs";
 var OUTBOX = "outbox";
+var RATE_LIMITS = "rate-limits";
 var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SESSIONS,
   LOGIN_ATTEMPTS,
@@ -166,7 +167,8 @@ var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   ROLES,
   USER_IDENTITIES,
   AUDIT_LOGS,
-  OUTBOX
+  OUTBOX,
+  RATE_LIMITS
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
 var CREATED_BY_FIELD = {
@@ -640,6 +642,17 @@ var outboxCollection = {
     { name: "error", type: "text" }
   ]
 };
+var rateLimitsCollection = {
+  slug: RATE_LIMITS,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    // `<anonymous|user|apiKey>:<id or HMAC of the IP>:<window number>`
+    { name: "key", type: "text", required: true, unique: true },
+    { name: "count", type: "number", required: true },
+    // When the window is over, for clearing old rows.
+    { name: "expiresAt", type: "text", required: true, index: true }
+  ]
+};
 var emailDeliveriesCollection = {
   slug: EMAIL_DELIVERIES,
   access: { read: nobody, create: nobody, update: nobody, delete: nobody },
@@ -3977,7 +3990,7 @@ var VersionStore = class {
 };
 
 // src/local-api.ts
-import { createHash as createHash5, createHmac as createHmac7, randomBytes as randomBytes6, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash5, createHmac as createHmac8, randomBytes as randomBytes6, randomUUID as randomUUID3 } from "crypto";
 
 // src/auth/common-passwords.ts
 var LIST = `
@@ -4473,6 +4486,141 @@ function entryOf(row) {
   };
 }
 
+// src/rate-limit.ts
+import { createHmac as createHmac5 } from "crypto";
+var SYNC_MS = 5e3;
+var DEFAULTS = { window: 60, anonymous: 300, users: 1200, apiKeys: 1200 };
+var RateLimiter = class {
+  constructor(db, secret, logger, settings) {
+    this.db = db;
+    this.secret = secret;
+    this.logger = logger;
+    this.settings = { ...DEFAULTS, ...settings };
+  }
+  db;
+  secret;
+  logger;
+  counts = /* @__PURE__ */ new Map();
+  settings;
+  lastSync = Date.now();
+  syncing;
+  warnedNoIp = false;
+  /**
+   * Counts a request, or returns the seconds until the client may send another when it is over
+   * its limit. Health checks and the cron's `jobs/run` aren't counted (the caller skips them).
+   */
+  hit(user, ip, now = Date.now()) {
+    const client = this.client(user, ip);
+    if (!client) return void 0;
+    const [kind, id, limit] = client;
+    const windowMs = this.settings.window * 1e3;
+    const bucket = Math.floor(now / windowMs);
+    const key = `${kind}:${id}:${bucket}`;
+    let count = this.counts.get(key);
+    if (!count) {
+      count = { total: 0, pending: 0, ends: (bucket + 1) * windowMs };
+      this.counts.set(key, count);
+    }
+    if (now - this.lastSync >= SYNC_MS && !this.syncing) void this.sync(now);
+    if (count.total + count.pending >= limit)
+      return Math.max(1, Math.ceil((count.ends - now) / 1e3));
+    count.pending++;
+    return void 0;
+  }
+  /** Who is counted, and their limit; `undefined` when nothing limits them. */
+  client(user, ip) {
+    const { anonymous, users, apiKeys } = this.settings;
+    const key = user?.apiKey;
+    if (key) return apiKeys === false ? void 0 : ["apiKey", String(key.id), apiKeys];
+    if (user) return users === false ? void 0 : ["user", String(user.id), users];
+    if (anonymous === false) return void 0;
+    if (!ip) {
+      if (!this.warnedNoIp) {
+        this.warnedNoIp = true;
+        this.logger.warn(
+          "rateLimit: the client IP is unknown, so visitors who are not signed in are not limited. Behind a proxy, set trustProxy on the adapter."
+        );
+      }
+      return void 0;
+    }
+    const hashed = createHmac5("sha256", this.secret).update(`rate:${ip}`).digest("base64url");
+    return ["anonymous", hashed.slice(0, 22), anonymous];
+  }
+  /**
+   * Adds what this instance counted to the database and reads the totals back; forgets windows
+   * that are over. Runs in the background every few seconds; `await` it in tests.
+   */
+  sync(now = Date.now()) {
+    this.lastSync = now;
+    this.syncing ??= this.write(now).catch((error) => this.logger.warn(`rateLimit: counts not saved: ${String(error)}`)).finally(() => {
+      this.syncing = void 0;
+    });
+    return this.syncing;
+  }
+  async write(now) {
+    for (const [key, count] of this.counts) {
+      if (count.ends <= now) {
+        this.counts.delete(key);
+        continue;
+      }
+      const added = count.pending;
+      count.pending = 0;
+      count.total = await this.add(key, count, added) ?? count.total + added;
+    }
+  }
+  /** Adds `by` to the key's row (made if missing) and returns the new total. */
+  async add(key, count, by) {
+    count.id ??= await this.rowId(key);
+    if (count.id === void 0) {
+      const stamp = (/* @__PURE__ */ new Date()).toISOString();
+      try {
+        const created = await this.db.create({
+          collection: RATE_LIMITS,
+          data: {
+            key,
+            count: by,
+            expiresAt: new Date(count.ends).toISOString(),
+            createdAt: stamp,
+            updatedAt: stamp
+          }
+        });
+        count.id = created.id;
+        return by;
+      } catch (error) {
+        count.id = await this.rowId(key);
+        if (count.id === void 0) throw error;
+      }
+    }
+    return this.db.increment({ collection: RATE_LIMITS, id: count.id, field: "count", by });
+  }
+  async rowId(key) {
+    const { docs } = await this.db.find({
+      collection: RATE_LIMITS,
+      where: { key: { equals: key } },
+      sort: [],
+      limit: 1,
+      page: 1
+    });
+    return docs[0]?.id;
+  }
+  /** Deletes the rows of windows that are over. From `runJobs`. */
+  async clear(now = /* @__PURE__ */ new Date()) {
+    let deleted = 0;
+    for (; ; ) {
+      const { docs } = await this.db.find({
+        collection: RATE_LIMITS,
+        where: { expiresAt: { lt: now.toISOString() } },
+        sort: ["id"],
+        limit: 500,
+        page: 1
+      });
+      for (const row of docs) await this.db.delete({ collection: RATE_LIMITS, id: row.id });
+      deleted += docs.length;
+      if (docs.length < 500) return deleted;
+    }
+  }
+};
+
 // src/remote-file.ts
 import { lookup as dnsLookup } from "dns";
 import { request as httpRequest } from "http";
@@ -4715,7 +4863,7 @@ function read(response, maxBytes, deadline) {
 var keys = (list) => new Set(list.split(/\s+/).filter(Boolean));
 var CONFIG = keys(`secret previousSecrets db serverURL cors cronSecret timeZone webhooks events jobs localization routes admin
   upload auth collections globals endpoints cliCommands onRequest fieldTypes apiKeys email backups
-  audit logs countCacheSeconds maxPage httpCache outbox search telemetry plugins`);
+  audit logs countCacheSeconds maxPage httpCache outbox rateLimit search telemetry plugins`);
 var ADMIN = keys("path locale brand siteURL nav commands modules pages dashboard switcher");
 var AUTH = keys(`roles rbac tokenExpiration maxLoginAttempts lockWindow trustedOrigins
   resetPasswordExpiration inviteExpiration providers providerSignUp password setupCode members emails`);
@@ -4723,6 +4871,7 @@ var MEMBERS = keys("roles signUp pages emails");
 var UPLOAD = keys("dir maxFileSize mimeTypes storage imageSizes fromURL folders privateStorage");
 var BACKUPS = keys("frequency at keep dir storage sqlite encryptionKey");
 var AUDIT = keys("keepDays values failedLogins scope");
+var RATE_LIMIT = keys("window anonymous users apiKeys");
 var LOGS = keys("format requests");
 var COLLECTION = keys(`slug labels fields useAsTitle drafts versions schedule preview access hooks
   admin httpCache search`);
@@ -4848,6 +4997,7 @@ function checkConfigKeys(config, add) {
   check2(c.upload, "upload", "upload", UPLOAD, add);
   check2(c.backups, "backups", "backups", BACKUPS, add);
   if (isObject(c.audit)) check2(c.audit, "audit", "audit", AUDIT, add);
+  if (isObject(c.rateLimit)) check2(c.rateLimit, "rateLimit", "rateLimit", RATE_LIMIT, add);
   check2(c.logs, "logs", "logs", LOGS, add);
   for (const [kind, list] of [
     ["collections", c.collections],
@@ -5204,13 +5354,13 @@ var SearchIndex = class {
 };
 
 // src/webhooks.ts
-import { createHmac as createHmac6, randomUUID as randomUUID2 } from "crypto";
+import { createHmac as createHmac7, randomUUID as randomUUID2 } from "crypto";
 
 // src/webhook-signature.ts
-import { createHmac as createHmac5, timingSafeEqual as timingSafeEqual5 } from "crypto";
+import { createHmac as createHmac6, timingSafeEqual as timingSafeEqual5 } from "crypto";
 var TOLERANCE_SECONDS = 5 * 60;
 function signWebhook(secret, delivery, timestamp, body) {
-  return `v1=${createHmac5("sha256", secret).update(`${delivery}.${timestamp}.${body}`).digest("hex")}`;
+  return `v1=${createHmac6("sha256", secret).update(`${delivery}.${timestamp}.${body}`).digest("hex")}`;
 }
 function header(headers, name) {
   if (headers instanceof Headers) return headers.get(name) ?? void 0;
@@ -5411,7 +5561,7 @@ var Webhooks = class {
       const timestamp = Math.floor(Date.now() / 1e3);
       headers["x-easy-cms-timestamp"] = String(timestamp);
       headers["x-easy-cms-signature-v2"] = signWebhook(hook.secret, delivery, timestamp, body);
-      headers["x-easy-cms-signature"] = `sha256=${createHmac6("sha256", hook.secret).update(body).digest("hex")}`;
+      headers["x-easy-cms-signature"] = `sha256=${createHmac7("sha256", hook.secret).update(body).digest("hex")}`;
     }
     try {
       const response = await this.fetcher(hook.url, {
@@ -7096,6 +7246,7 @@ async function resolveConfig(input) {
       ...config.email ? [emailDeliveriesCollection] : [],
       ...(config.jobs?.length ?? 0) > 0 ? [jobRunsCollection] : [],
       ...config.outbox ? [outboxCollection] : [],
+      ...config.rateLimit ? [rateLimitsCollection] : [],
       databaseBackupsCollection,
       ...config.auth?.rbac ? [rolesCollection] : [],
       ...(config.auth?.providers?.length ?? 0) > 0 ? [userIdentitiesCollection] : [],
@@ -7166,7 +7317,7 @@ function cacheableResponse(request, body, status, headers, times, tags) {
 }
 
 // src/version.ts
-var VERSION = true ? "1.18.0" : "0.0.0-dev";
+var VERSION = true ? "1.19.0" : "0.0.0-dev";
 
 // src/telemetry.ts
 var DB_CALLS = /* @__PURE__ */ new Set([
@@ -7444,6 +7595,8 @@ var EasyCMS = class {
   mailer;
   /** With `outbox: true`: runs after hooks and events from rows saves write. */
   outbox;
+  /** @internal Requests per client (`rateLimit`), for the REST API. */
+  rateLimiter;
   /** With `search`: keeps the index in step with published documents. */
   searchIndex;
   /** @internal With `telemetry`: OpenTelemetry spans and metrics (set by `createEasyCMS`). */
@@ -7484,6 +7637,7 @@ var EasyCMS = class {
         () => this.runOutbox(entry, done, mark)
       ) : this.runOutbox(entry, done, mark)
     ) : void 0;
+    this.rateLimiter = config.rateLimit ? new RateLimiter(db, config.secret, logger, config.rateLimit) : void 0;
     this.searchIndex = config.search ? new SearchIndex(
       config.search,
       config.collections,
@@ -7830,7 +7984,7 @@ var EasyCMS = class {
   /** A value with its HMAC (`secret`), for `purpose` only: `<base64url JSON>.<signature>`. */
   sign(purpose, value) {
     const payload = Buffer.from(JSON.stringify(value)).toString("base64url");
-    const mac = createHmac7("sha256", this.config.secret).update(`${purpose}:${payload}`);
+    const mac = createHmac8("sha256", this.config.secret).update(`${purpose}:${payload}`);
     return `${payload}.${mac.digest("base64url")}`;
   }
   /** The value of a token made by `sign`, or `undefined` when it isn't genuine. */
@@ -7957,7 +8111,7 @@ var EasyCMS = class {
     return signedWith(secretsOf(this.config), `media:${key}:${at}`, signature);
   }
   mediaSignature(key, expires) {
-    return createHmac7("sha256", this.config.secret).update(`media:${key}:${expires}`).digest("base64url");
+    return createHmac8("sha256", this.config.secret).update(`media:${key}:${expires}`).digest("base64url");
   }
   /**
    * How many documents use any of these files in a top-level upload field (rich text and fields
@@ -8974,6 +9128,7 @@ var EasyCMS = class {
         (error) => this.logger.error(`Backups: ${error.message}`, { error })
       );
       await this.audit.upkeep(now).catch((error) => this.logger.error(`Audit log: ${error.message}`, { error }));
+      await this.rateLimiter?.clear(now).catch((error) => this.logger.error(`Rate limits: ${error.message}`, { error }));
       const result = {
         scheduled,
         webhooks: await this.retryWebhooks(now),
@@ -12242,6 +12397,10 @@ async function respondNow(cms, request, url, path, root, options, production, re
       trustProxy: options.trustProxy === true
     };
     const method = request.method.toUpperCase();
+    const isJobsRun = !root && segments[0] === "jobs" && segments[1] === "run";
+    const wait = isJobsRun ? void 0 : cms.rateLimiter?.hit(user, options.getClientIp?.(request));
+    if (wait !== void 0)
+      throw new TooManyRequestsError("Too many requests: try again later", wait);
     if (method !== "GET" && method !== "HEAD") checkCsrf(cms, ctx);
     const audit = {
       user,

package/dist/{config-CpeC7EvC.d.ts → config-U1mRwD4t.d.ts}

@@ -3366,6 +3366,20 @@ interface AuthConfig {
         readonly passwordChanged?: PasswordEmailFn;
     };
 }
+interface RateLimitConfig {
+    /** Seconds each count lasts. Default 60. */
+    readonly window?: number;
+    /**
+     * Requests per window from one IP without signing in. Default 300; `false`: no limit. Needs the
+     * client's IP: behind a proxy, set `trustProxy` on the adapter (without it, visitors aren't
+     * limited, and the log says so once).
+     */
+    readonly anonymous?: number | false;
+    /** Requests per window from one signed-in user (the admin included). Default 1200; `false`: no limit. */
+    readonly users?: number | false;
+    /** Requests per window with one API key. Default 1200; `false`: no limit. */
+    readonly apiKeys?: number | false;
+}
 /** What `onRequest` receives. */
 interface OnRequestArgs {
     readonly headers: Headers;
@@ -3673,6 +3687,13 @@ interface Config {
      * Default `false`: hooks run in the request, after the save.
      */
     readonly outbox?: boolean;
+    /**
+     * Limits requests to the API per client and minute, counted across instances: each visitor's
+     * IP, each signed-in user and each API key. Over the limit, the API answers `429` with
+     * `Retry-After`. `{}` uses the defaults. Needs a migration for the `rate-limits` table. Default
+     * off.
+     */
+    readonly rateLimit?: RateLimitConfig;
     /**
      * Relevance-ranked search of the collections that have `search`, e.g. `memorySearch()` for
      * development and small sites, or an adapter for a search engine. Published documents are

package/dist/{handler-BpKo6gh0.d.ts → handler-D2y4WSSM.d.ts}

@@ -1,4 +1,4 @@
-import { I as ID, C as Config, E as EasyCMS, L as LocalizationConfig, F as Field, a as FieldError, b as FilterOptions, c as CreateEasyCMSOptions, R as ResolvedConfig } from './config-CpeC7EvC.js';
+import { I as ID, C as Config, E as EasyCMS, L as LocalizationConfig, F as Field, a as FieldError, b as FilterOptions, c as CreateEasyCMSOptions, R as ResolvedConfig } from './config-U1mRwD4t.js';
 
 /** Decrypts a file from `encryptBackup`; throws for another key or a changed file. */
 declare function decryptBackup(data: Uint8Array, encryptionKey: string): Uint8Array;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { P as PaginatedDocs, I as ID, d as EmailSetting, W as WebhookPayload } from './config-CpeC7EvC.js';
-export { A as ADAPTER_API_VERSION, e as ADMIN_ICONS, f as Access, g as AccessArgs, h as AccessOptions, i as AdminBrand, j as AdminCommand, k as AdminComponent, l as AdminConfig, m as AdminFieldArgs, n as AdminIcon, o as AdminLocale, p as AdminPage, q as AdminRole, r as AdminRoleChange, s as AdminRoleField, t as AdminRoleTarget, u as AdminRoleView, v as AdminRoles, w as AdminSso, x as AdminSwitcher, y as AdminViewAccess, z as AfterChangeHook, B as AfterDeleteHook, D as AfterReadHook, G as ApiKeyContext, H as ApiKeyGlobalOperation, J as ApiKeyOperation, K as ApiKeyPermissions, M as ArrayField, N as AuditChange, O as AuditConfig, Q as AuditEntry, S as AuditLog, T as AuditPage, U as AuditVerification, V as Auth, X as AuthConfig, Y as AuthProvider, Z as AuthProviderProfile, _ as AuthProviderRequest, $ as AuthUser, a0 as BackupsConfig, a1 as BeforeChangeHook, a2 as BeforeDeleteHook, a3 as BeforeValidateHook, a4 as Block, a5 as BlocksField, a6 as BooleanField, a7 as BuiltinApiKeysCollection, a8 as BuiltinMediaCollection, a9 as BuiltinMediaFoldersCollection, aa as BuiltinUsersCollection, ab as BundleHints, ac as CliCommand, ad as CollectionAccess, ae as CollectionAdmin, af as CollectionConfig, ag as CollectionDocument, ah as CollectionHooks, ai as CollectionListAdmin, aj as CollectionSearch, ak as CollectionSlug, C as Config, al as ConfigError, am as ConfigIssue, an as ContainerAdmin, c as CreateEasyCMSOptions, ao as CreateInput, ap as CreateMigrationResult, aq as CursorDocs, ar as CustomField, as as CustomFieldTypes, at as DashboardWidget, au as Database, av as DatabaseAdapter, aw as DatabaseInitArgs, ax as DatabaseTransfer, ay as DateField, az as DepthOptions, aA as DirectUpload, aB as DiskStorageOptions, aC as DocumentOf, E as EasyCMS, aD as EasyCMSError, aE as EmailAdapter, aF as EmailField, aG as EmailMessage, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, aK as FIELD_TYPES, F as Field, aL as FieldAccess, aM as FieldAccessFn, aN as FieldAdmin, a as FieldError, aO as FieldRule, aP as FieldType, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, aT as FieldValidate, aU as FieldValidateContext, aV as FieldValue, aW as FieldsInput, aX as FieldsValue, b as FilterOptions, aY as FilterOptionsArgs, aZ as FindAfterArgs, a_ as FindArgs, a$ as FindOptions, b0 as FolderLevel, b1 as FolderPermissions, b2 as ForbiddenError, b3 as GlobalAccess, b4 as GlobalConfig, b5 as GlobalDocument, b6 as GlobalHooks, b7 as GlobalInput, b8 as GlobalSlug, b9 as GroupField, ba as ImageSize, bb as IncrementOptions, bc as InferCollection, bd as InferGlobal, be as JobConfig, bf as JsonField, bg as KeysetPage, bh as Label, bi as LayoutNode, bj as LivePreview, bk as LocaleOf, L as LocalizationConfig, bl as LogDetails, bm as Logger, bn as LoginArgs, bo as LogsConfig, bp as MediaDocument, bq as MediaSize, br as MembersConfig, bs as MembersSignup, bt as MigrationInfo, bu as NavGroup, bv as NotFoundError, bw as NumberField, bx as OnRequest, by as OnRequestArgs, bz as Operation, bA as OutboxRow, bB as PLUGIN_API_VERSION, bC as PasswordEmail, bD as PasswordEmailArgs, bE as PasswordEmailFn, bF as PasswordLinkOptions, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bK as PreviewTarget, bL as PreviewURL, bM as QueryError, bN as ROLE_OPERATIONS, bO as RawDocument, bP as ReadOptions, bQ as RelationshipField, bR as RequestContext, R as ResolvedConfig, bS as RichTextDocument, bT as RichTextField, bU as Role, bV as RoleOperation, bW as RolePermissions, bX as Roles, bY as RoutesConfig, bZ as ScheduledPublish, b_ as SchemaError, b$ as SchemaMode, c0 as SearchAdapter, c1 as SearchEntry, c2 as SearchHits, c3 as SearchOptions, c4 as SearchQuery, c5 as SearchResults, c6 as SearchSetting, c7 as SelectField, c8 as SelectOption, c9 as Session, ca as SidebarPanel, cb as SignupArgs, cc as SignupResult, cd as SingleSignOn, ce as SlugField, cf as SlugOf, cg as SsoOutcome, ch as SsoProviderRef, ci as StorageAdapter, cj as StoredFile, ck as TRIGRAM_LIKE_MIN, cl as TelemetryConfig, cm as TextField, cn as TextareaField, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cr as UncountedDocs, cs as UpdateInput, ct as UpdateOptions, cu as UploadConfig, cv as UploadField, cw as UploadFromURLConfig, cx as UserIdentity, cy as ValidationError, cz as Version, cA as VersionSummary, cB as VersionsConfig, cC as WEBHOOK_EVENTS, cD as WebhookConfig, cE as WebhookEvent, cF as Where, cG as WhereOperators, cH as anyone, cI as consoleEmail, cJ as consoleLogger, cK as createEasyCMS, cL as defineConfig, cM as defineFieldType, cN as definePlugin, cO as diskStorage, cP as hasRows, cQ as isAdmin, cR as isHasMany, cS as isSignedIn, cT as isStaff, cU as isSystemAdmin, cV as jsonLogger, cW as memorySearch, cX as mimeAllowedBy, cY as rowFields, cZ as silentLogger, c_ as uniqueWithinOf } from './config-CpeC7EvC.js';
-export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-_XG-lqA5.js';
-export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-BpKo6gh0.js';
+import { P as PaginatedDocs, I as ID, d as EmailSetting, W as WebhookPayload } from './config-U1mRwD4t.js';
+export { A as ADAPTER_API_VERSION, e as ADMIN_ICONS, f as Access, g as AccessArgs, h as AccessOptions, i as AdminBrand, j as AdminCommand, k as AdminComponent, l as AdminConfig, m as AdminFieldArgs, n as AdminIcon, o as AdminLocale, p as AdminPage, q as AdminRole, r as AdminRoleChange, s as AdminRoleField, t as AdminRoleTarget, u as AdminRoleView, v as AdminRoles, w as AdminSso, x as AdminSwitcher, y as AdminViewAccess, z as AfterChangeHook, B as AfterDeleteHook, D as AfterReadHook, G as ApiKeyContext, H as ApiKeyGlobalOperation, J as ApiKeyOperation, K as ApiKeyPermissions, M as ArrayField, N as AuditChange, O as AuditConfig, Q as AuditEntry, S as AuditLog, T as AuditPage, U as AuditVerification, V as Auth, X as AuthConfig, Y as AuthProvider, Z as AuthProviderProfile, _ as AuthProviderRequest, $ as AuthUser, a0 as BackupsConfig, a1 as BeforeChangeHook, a2 as BeforeDeleteHook, a3 as BeforeValidateHook, a4 as Block, a5 as BlocksField, a6 as BooleanField, a7 as BuiltinApiKeysCollection, a8 as BuiltinMediaCollection, a9 as BuiltinMediaFoldersCollection, aa as BuiltinUsersCollection, ab as BundleHints, ac as CliCommand, ad as CollectionAccess, ae as CollectionAdmin, af as CollectionConfig, ag as CollectionDocument, ah as CollectionHooks, ai as CollectionListAdmin, aj as CollectionSearch, ak as CollectionSlug, C as Config, al as ConfigError, am as ConfigIssue, an as ContainerAdmin, c as CreateEasyCMSOptions, ao as CreateInput, ap as CreateMigrationResult, aq as CursorDocs, ar as CustomField, as as CustomFieldTypes, at as DashboardWidget, au as Database, av as DatabaseAdapter, aw as DatabaseInitArgs, ax as DatabaseTransfer, ay as DateField, az as DepthOptions, aA as DirectUpload, aB as DiskStorageOptions, aC as DocumentOf, E as EasyCMS, aD as EasyCMSError, aE as EmailAdapter, aF as EmailField, aG as EmailMessage, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, aK as FIELD_TYPES, F as Field, aL as FieldAccess, aM as FieldAccessFn, aN as FieldAdmin, a as FieldError, aO as FieldRule, aP as FieldType, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, aT as FieldValidate, aU as FieldValidateContext, aV as FieldValue, aW as FieldsInput, aX as FieldsValue, b as FilterOptions, aY as FilterOptionsArgs, aZ as FindAfterArgs, a_ as FindArgs, a$ as FindOptions, b0 as FolderLevel, b1 as FolderPermissions, b2 as ForbiddenError, b3 as GlobalAccess, b4 as GlobalConfig, b5 as GlobalDocument, b6 as GlobalHooks, b7 as GlobalInput, b8 as GlobalSlug, b9 as GroupField, ba as ImageSize, bb as IncrementOptions, bc as InferCollection, bd as InferGlobal, be as JobConfig, bf as JsonField, bg as KeysetPage, bh as Label, bi as LayoutNode, bj as LivePreview, bk as LocaleOf, L as LocalizationConfig, bl as LogDetails, bm as Logger, bn as LoginArgs, bo as LogsConfig, bp as MediaDocument, bq as MediaSize, br as MembersConfig, bs as MembersSignup, bt as MigrationInfo, bu as NavGroup, bv as NotFoundError, bw as NumberField, bx as OnRequest, by as OnRequestArgs, bz as Operation, bA as OutboxRow, bB as PLUGIN_API_VERSION, bC as PasswordEmail, bD as PasswordEmailArgs, bE as PasswordEmailFn, bF as PasswordLinkOptions, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bK as PreviewTarget, bL as PreviewURL, bM as QueryError, bN as ROLE_OPERATIONS, bO as RawDocument, bP as ReadOptions, bQ as RelationshipField, bR as RequestContext, R as ResolvedConfig, bS as RichTextDocument, bT as RichTextField, bU as Role, bV as RoleOperation, bW as RolePermissions, bX as Roles, bY as RoutesConfig, bZ as ScheduledPublish, b_ as SchemaError, b$ as SchemaMode, c0 as SearchAdapter, c1 as SearchEntry, c2 as SearchHits, c3 as SearchOptions, c4 as SearchQuery, c5 as SearchResults, c6 as SearchSetting, c7 as SelectField, c8 as SelectOption, c9 as Session, ca as SidebarPanel, cb as SignupArgs, cc as SignupResult, cd as SingleSignOn, ce as SlugField, cf as SlugOf, cg as SsoOutcome, ch as SsoProviderRef, ci as StorageAdapter, cj as StoredFile, ck as TRIGRAM_LIKE_MIN, cl as TelemetryConfig, cm as TextField, cn as TextareaField, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cr as UncountedDocs, cs as UpdateInput, ct as UpdateOptions, cu as UploadConfig, cv as UploadField, cw as UploadFromURLConfig, cx as UserIdentity, cy as ValidationError, cz as Version, cA as VersionSummary, cB as VersionsConfig, cC as WEBHOOK_EVENTS, cD as WebhookConfig, cE as WebhookEvent, cF as Where, cG as WhereOperators, cH as anyone, cI as consoleEmail, cJ as consoleLogger, cK as createEasyCMS, cL as defineConfig, cM as defineFieldType, cN as definePlugin, cO as diskStorage, cP as hasRows, cQ as isAdmin, cR as isHasMany, cS as isSignedIn, cT as isStaff, cU as isSystemAdmin, cV as jsonLogger, cW as memorySearch, cX as mimeAllowedBy, cY as rowFields, cZ as silentLogger, c_ as uniqueWithinOf } from './config-U1mRwD4t.js';
+export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-DRV5HA4a.js';
+export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-D2y4WSSM.js';
 export { FieldCondition, matchesCondition } from './conditions.js';
 
 type DeliveryKind = 'webhook' | 'email';

package/dist/index.js

@@ -28,7 +28,7 @@ import {
   silentLogger,
   slugify,
   verifyWebhook
-} from "./chunk-NTAFZ4M6.js";
+} from "./chunk-FZCQXH5M.js";
 import {
   matchesCondition
 } from "./chunk-U266LV4M.js";

package/dist/internal.d.ts

@@ -1,6 +1,6 @@
 import { Config, Database, EasyCMS, NavGroup, CollectionConfig, ID, RawDocument, Field, ResolvedConfig, ConfigIssue } from './index.js';
-export { c$ as API_KEYS, d0 as API_KEY_GLOBAL_OPERATIONS, d1 as API_KEY_OPERATIONS, d2 as DEFAULT_MAX_VERSIONS, d3 as DEFAULT_PASSWORD_EMAILS, d4 as FIELD_TYPE_BASES, d5 as FOLDER_LEVELS, d6 as MediaFolders, d7 as SSO_COOKIE, d8 as Secrets, ck as TRIGRAM_LIKE_MIN, d9 as codeOfStatus, cP as hasRows, cR as isHasMany, da as isJsonLogger, db as keyAllows, dc as logFormat, cX as mimeAllowedBy, cY as rowFields, dd as secretsOf, c_ as uniqueWithinOf } from './config-CpeC7EvC.js';
-export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as isEmail, y as mergeForUpdate, z as parseId, E as platformClientIp, F as readCookie, G as validateFields, H as writeBackupFile } from './handler-BpKo6gh0.js';
+export { c$ as API_KEYS, d0 as API_KEY_GLOBAL_OPERATIONS, d1 as API_KEY_OPERATIONS, d2 as DEFAULT_MAX_VERSIONS, d3 as DEFAULT_PASSWORD_EMAILS, d4 as FIELD_TYPE_BASES, d5 as FOLDER_LEVELS, d6 as MediaFolders, d7 as SSO_COOKIE, d8 as Secrets, ck as TRIGRAM_LIKE_MIN, d9 as codeOfStatus, cP as hasRows, cR as isHasMany, da as isJsonLogger, db as keyAllows, dc as logFormat, cX as mimeAllowedBy, cY as rowFields, dd as secretsOf, c_ as uniqueWithinOf } from './config-U1mRwD4t.js';
+export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as isEmail, y as mergeForUpdate, z as parseId, E as platformClientIp, F as readCookie, G as validateFields, H as writeBackupFile } from './handler-D2y4WSSM.js';
 export { conditionIssues } from './conditions.js';
 
 /** The session cookie the REST API sets at login. */

package/dist/internal.js

@@ -58,7 +58,7 @@ import {
   verifyPassword,
   verifyTurnstile,
   writeBackupFile
-} from "./chunk-NTAFZ4M6.js";
+} from "./chunk-FZCQXH5M.js";
 import {
   conditionIssues
 } from "./chunk-U266LV4M.js";

package/dist/{plugin-_XG-lqA5.d.ts → plugin-DRV5HA4a.d.ts}

@@ -1,4 +1,4 @@
-import { bh as Label, F as Field, I as ID, o as AdminLocale, x as AdminSwitcher, ch as SsoProviderRef } from './config-CpeC7EvC.js';
+import { bh as Label, F as Field, I as ID, o as AdminLocale, x as AdminSwitcher, ch as SsoProviderRef } from './config-U1mRwD4t.js';
 import { FieldCondition } from './conditions.js';
 
 /** A Web Component from an admin module, with its `props` (plain JSON). */

package/dist/plugin.d.ts

@@ -1,3 +1,3 @@
-export { e as ADMIN_ICONS, k as AdminComponent, n as AdminIcon, $ as AuthUser, ac as CliCommand, ad as CollectionAccess, af as CollectionConfig, C as Config, al as ConfigError, at as DashboardWidget, aD as EasyCMSError, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, F as Field, aL as FieldAccess, a as FieldError, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, b2 as ForbiddenError, b4 as GlobalConfig, I as ID, be as JobConfig, bh as Label, bu as NavGroup, bv as NotFoundError, bx as OnRequest, by as OnRequestArgs, bB as PLUGIN_API_VERSION, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bM as QueryError, bR as RequestContext, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cy as ValidationError, cF as Where, cM as defineFieldType, cN as definePlugin } from './config-CpeC7EvC.js';
-export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-_XG-lqA5.js';
+export { e as ADMIN_ICONS, k as AdminComponent, n as AdminIcon, $ as AuthUser, ac as CliCommand, ad as CollectionAccess, af as CollectionConfig, C as Config, al as ConfigError, at as DashboardWidget, aD as EasyCMSError, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, F as Field, aL as FieldAccess, a as FieldError, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, b2 as ForbiddenError, b4 as GlobalConfig, I as ID, be as JobConfig, bh as Label, bu as NavGroup, bv as NotFoundError, bx as OnRequest, by as OnRequestArgs, bB as PLUGIN_API_VERSION, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bM as QueryError, bR as RequestContext, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cy as ValidationError, cF as Where, cM as defineFieldType, cN as definePlugin } from './config-U1mRwD4t.js';
+export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-DRV5HA4a.js';
 import './conditions.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "1.18.0",
+  "version": "1.19.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",