@easy-cms/core 1.23.1 → 1.25.0

package/dist/{chunk-VZNL7HWC.js → chunk-AAZ35NPQ.js}

@@ -155,6 +155,7 @@ var USER_IDENTITIES = "user-identities";
 var AUDIT_LOGS = "audit-logs";
 var OUTBOX = "outbox";
 var RATE_LIMITS = "rate-limits";
+var BULK_OPERATIONS = "bulk-operations";
 var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SESSIONS,
   LOGIN_ATTEMPTS,
@@ -168,7 +169,8 @@ var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   USER_IDENTITIES,
   AUDIT_LOGS,
   OUTBOX,
-  RATE_LIMITS
+  RATE_LIMITS,
+  BULK_OPERATIONS
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
 var CREATED_BY_FIELD = {
@@ -528,6 +530,34 @@ var scheduledJobsCollection = {
     { name: "author", type: "number" }
   ]
 };
+var bulkOperationsCollection = {
+  slug: BULK_OPERATIONS,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    { name: "collection", type: "text", required: true },
+    // publish | unpublish | delete | move
+    { name: "action", type: "text", required: true },
+    // The list's `where`, and for `move` the folder (`null`: the top).
+    { name: "query", type: "json" },
+    { name: "folder", type: "text" },
+    { name: "transferTo", type: "text" },
+    { name: "user", type: "text", required: true, index: true },
+    // pending | running | cancelling | done | cancelled | failed
+    { name: "state", type: "text", required: true, index: true },
+    { name: "total", type: "number", required: true },
+    { name: "done", type: "number", required: true },
+    { name: "skipped", type: "number", required: true },
+    { name: "failed", type: "number", required: true },
+    // The last id handled: the next step continues after it, in id order.
+    { name: "after", type: "json" },
+    // The first documents skipped or failed, with why: `{ id, reason, message? }`.
+    { name: "problems", type: "json" },
+    { name: "error", type: "text" },
+    // A step holds the operation until then; a process that stopped lets it go.
+    { name: "leaseUntil", type: "text" },
+    { name: "finishedAt", type: "text" }
+  ]
+};
 var webhookDeliveriesCollection = {
   slug: WEBHOOK_DELIVERIES,
   access: { read: nobody, create: nobody, update: nobody, delete: nobody },
@@ -3000,9 +3030,9 @@ async function pendingMigrations(cms) {
   if (pending === 0) migrated.add(cms);
   return pending;
 }
-async function healthResponse(check3, instance) {
+async function healthResponse(check4, instance) {
   const cms = instance;
-  if (check3 === "healthz") return new Response("ok", { headers: { "cache-control": "no-store" } });
+  if (check4 === "healthz") return new Response("ok", { headers: { "cache-control": "no-store" } });
   if (!cms) {
     return Response.json(
       { status: "error", checks: { startup: "error" } },
@@ -4300,6 +4330,306 @@ zzzzzzzz
 `;
 var COMMON_PASSWORDS = new Set(LIST.split(/\s+/).filter(Boolean));
 
+// src/bulk.ts
+var BULK_ACTIONS = ["publish", "unpublish", "delete", "move"];
+var BULK_STEP = 100;
+var BULK_MAX = 1e4;
+var LEASE_MS = 6e4;
+var PROBLEMS_KEPT = 50;
+var FINISHED_KEPT = 10;
+var ACTIVE = ["pending", "running", "cancelling"];
+function check(cms, collection2, action, options) {
+  if (!BULK_ACTIONS.includes(action))
+    throw new QueryError(`action must be one of ${BULK_ACTIONS.join(", ")}`);
+  const config = cms.collection(collection2);
+  if ((action === "publish" || action === "unpublish") && !config.drafts)
+    throw new QueryError(`"${collection2}" has no drafts to publish`);
+  if (action === "move" && collection2 !== MEDIA)
+    throw new QueryError("Only media files move to folders");
+  if (action === "move" && options.folder === void 0)
+    throw new QueryError("folder is required to move files");
+}
+async function apply(cms, collection2, action, id, options) {
+  const access = {
+    overrideAccess: false,
+    user: options.user,
+    ...options.context ? { context: options.context } : {},
+    depth: 0
+  };
+  const slug2 = collection2;
+  try {
+    if (action === "publish") await cms.update(slug2, id, { status: "published" }, access);
+    else if (action === "unpublish") await cms.unpublish(slug2, id, access);
+    else if (action === "move")
+      await cms.update(slug2, id, { folder: options.folder ?? null }, access);
+    else
+      await cms.delete(slug2, id, {
+        ...access,
+        ...options.transferTo !== void 0 ? { transferTo: options.transferTo } : {}
+      });
+    return null;
+  } catch (error) {
+    if (error instanceof ForbiddenError) return { id, reason: "forbidden" };
+    if (error instanceof NotFoundError) return { id, reason: "not-found" };
+    return { id, reason: "error", message: error.message };
+  }
+}
+async function bulkIds(cms, collection2, action, ids, options) {
+  check(cms, collection2, action, options);
+  if (ids.length > BULK_STEP) throw new QueryError(`ids: at most ${BULK_STEP} at a time`);
+  const result = { done: 0, skipped: [], failed: [] };
+  for (const id of new Set(ids)) {
+    const problem = await apply(cms, collection2, action, id, options);
+    if (!problem) result.done++;
+    else if (problem.reason === "error") result.failed.push(problem);
+    else result.skipped.push(problem);
+  }
+  return result;
+}
+async function startBulk(cms, collection2, action, where, options) {
+  check(cms, collection2, action, options);
+  const total = await cms.count(collection2, {
+    ...where ? { where } : {},
+    draft: true,
+    overrideAccess: false,
+    user: options.user,
+    ...options.context ? { context: options.context } : {},
+    max: BULK_MAX
+  });
+  if (total > BULK_MAX)
+    throw new QueryError(
+      `More than ${BULK_MAX.toLocaleString("en")} documents match: filter the list further`
+    );
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const row = await cms.db.create({
+    collection: BULK_OPERATIONS,
+    data: {
+      collection: collection2,
+      action,
+      query: where ?? null,
+      folder: options.folder === void 0 ? null : JSON.stringify(options.folder),
+      transferTo: options.transferTo === void 0 ? null : JSON.stringify(options.transferTo),
+      user: String(options.user.id),
+      state: total === 0 ? "done" : "pending",
+      total,
+      done: 0,
+      skipped: 0,
+      failed: 0,
+      after: null,
+      problems: [],
+      error: null,
+      leaseUntil: null,
+      finishedAt: total === 0 ? now : null,
+      createdAt: now,
+      updatedAt: now
+    }
+  });
+  await cms.audit.record({
+    action: `bulk.${action}`,
+    target: collection2,
+    detail: { total, operation: String(row.id) }
+  });
+  await pruneFinished(cms, String(options.user.id));
+  if (total > 0) void runBulk(cms, row.id).catch(() => {
+  });
+  return toOperation(row);
+}
+async function runBulk(cms, id) {
+  while (await stepBulk(cms, id)) {
+  }
+}
+async function stepBulk(cms, id, now = /* @__PURE__ */ new Date()) {
+  const row = await cms.db.findById({ collection: BULK_OPERATIONS, id });
+  if (!row || !ACTIVE.includes(String(row.state))) return false;
+  const lease = row.leaseUntil ? Date.parse(String(row.leaseUntil)) : 0;
+  if (lease > now.getTime()) return false;
+  const claimedAt = new Date(Math.max(now.getTime(), Date.parse(String(row.updatedAt)) + 1));
+  const claimed = await save(cms, row, {
+    state: row.state === "pending" ? "running" : row.state,
+    leaseUntil: new Date(now.getTime() + LEASE_MS).toISOString(),
+    updatedAt: claimedAt.toISOString()
+  });
+  if (!claimed) return false;
+  if (claimed.state === "cancelling") {
+    await finish(cms, claimed, "cancelled");
+    return false;
+  }
+  const user = await cms.auth.activeUser(String(claimed.user));
+  if (!user) {
+    await finish(cms, claimed, "failed", "The user who started it is no longer active");
+    return false;
+  }
+  const collection2 = String(claimed.collection);
+  const action = claimed.action;
+  const options = {
+    user,
+    ...claimed.folder !== null && claimed.folder !== void 0 ? { folder: JSON.parse(String(claimed.folder)) } : {},
+    ...claimed.transferTo !== null && claimed.transferTo !== void 0 ? { transferTo: JSON.parse(String(claimed.transferTo)) } : {}
+  };
+  const handled = Number(claimed.done) + Number(claimed.skipped) + Number(claimed.failed);
+  const query = claimed.query ?? void 0;
+  const after = claimed.after;
+  const conditions = [query, after === null ? void 0 : { id: { gt: after } }].filter(
+    (w) => w !== void 0
+  );
+  let found;
+  try {
+    found = await cms.find(collection2, {
+      ...conditions.length ? { where: { and: conditions } } : {},
+      sort: "id",
+      limit: Math.min(BULK_STEP, BULK_MAX - handled),
+      depth: 0,
+      draft: true,
+      count: false,
+      overrideAccess: false,
+      user
+    });
+  } catch (error) {
+    await finish(cms, claimed, "failed", error.message);
+    return false;
+  }
+  const changes = {
+    done: Number(claimed.done),
+    skipped: Number(claimed.skipped),
+    failed: Number(claimed.failed),
+    problems: [...claimed.problems ?? []],
+    after
+  };
+  await auditContext.run({ user }, async () => {
+    for (const doc of found.docs) {
+      const problem = await apply(cms, collection2, action, doc.id, options);
+      if (!problem) changes.done++;
+      else {
+        if (problem.reason === "error") changes.failed++;
+        else changes.skipped++;
+        if (changes.problems.length < PROBLEMS_KEPT) changes.problems.push(problem);
+      }
+      changes.after = doc.id;
+    }
+  });
+  const finished = !found.hasNextPage || found.docs.length === 0 || changes.done + changes.skipped + changes.failed >= BULK_MAX;
+  const at = /* @__PURE__ */ new Date();
+  const saved = await save(cms, claimed, {
+    ...changes,
+    state: finished ? "done" : "running",
+    leaseUntil: null,
+    finishedAt: finished ? at.toISOString() : null,
+    updatedAt: later2(at, claimed).toISOString()
+  });
+  if (saved) return !finished;
+  const current = await cms.db.findById({ collection: BULK_OPERATIONS, id });
+  if (current?.state === "cancelling") await finish(cms, { ...current, ...changes }, "cancelled");
+  else if (current) await save(cms, current, { ...changes, leaseUntil: null });
+  return false;
+}
+function later2(at, row) {
+  return new Date(Math.max(at.getTime(), Date.parse(String(row.updatedAt)) + 1));
+}
+async function save(cms, row, changes) {
+  const { id, ...data } = row;
+  const next = { ...data, ...changes };
+  const saved = await cms.db.update({
+    collection: BULK_OPERATIONS,
+    id,
+    data: next,
+    where: { updatedAt: { equals: row.updatedAt } }
+  });
+  return saved ? { ...row, ...changes } : null;
+}
+async function finish(cms, row, state, error) {
+  const at = /* @__PURE__ */ new Date();
+  await save(cms, row, {
+    state,
+    leaseUntil: null,
+    finishedAt: at.toISOString(),
+    updatedAt: later2(at, row).toISOString(),
+    ...error ? { error } : {}
+  });
+}
+async function runBulkOperations(cms, now = /* @__PURE__ */ new Date(), budgetMs = 2e4) {
+  const { docs } = await cms.db.find({
+    collection: BULK_OPERATIONS,
+    where: { state: { in: ACTIVE } },
+    sort: ["createdAt"],
+    limit: 20,
+    page: 1
+  });
+  const until = Date.now() + budgetMs;
+  let steps = 0;
+  for (const row of docs) {
+    while (Date.now() < until) {
+      const more = await stepBulk(cms, row.id, now).catch((error) => {
+        cms.logger.error(`Bulk operation ${row.id}: ${error.message}`, { error });
+        return false;
+      });
+      steps++;
+      if (!more) break;
+    }
+  }
+  return { steps };
+}
+async function bulkProgress(cms, id, user) {
+  const row = await mine(cms, id, user);
+  if (ACTIVE.includes(String(row.state))) await stepBulk(cms, row.id);
+  return toOperation(await cms.db.findById({ collection: BULK_OPERATIONS, id: row.id }) ?? row);
+}
+async function bulkOperations(cms, user) {
+  const { docs } = await cms.db.find({
+    collection: BULK_OPERATIONS,
+    where: { user: { equals: String(user.id) } },
+    sort: ["-createdAt"],
+    limit: FINISHED_KEPT + 20,
+    page: 1
+  });
+  return docs.map(toOperation);
+}
+async function cancelBulk(cms, id, user) {
+  for (let attempt = 0; attempt < 5; attempt++) {
+    const row = await mine(cms, id, user);
+    if (!ACTIVE.includes(String(row.state))) return toOperation(row);
+    const at = /* @__PURE__ */ new Date();
+    const saved = row.leaseUntil ? await save(cms, row, { state: "cancelling", updatedAt: later2(at, row).toISOString() }) : await save(cms, row, {
+      state: "cancelled",
+      finishedAt: at.toISOString(),
+      updatedAt: later2(at, row).toISOString()
+    });
+    if (saved) return toOperation(saved);
+  }
+  return toOperation(await mine(cms, id, user));
+}
+async function mine(cms, id, user) {
+  const row = await cms.db.findById({ collection: BULK_OPERATIONS, id });
+  if (!row || String(row.user) !== String(user.id)) throw new NotFoundError(BULK_OPERATIONS, id);
+  return row;
+}
+async function pruneFinished(cms, user) {
+  const { docs } = await cms.db.find({
+    collection: BULK_OPERATIONS,
+    where: { and: [{ user: { equals: user } }, { state: { not_in: ACTIVE } }] },
+    sort: ["-createdAt"],
+    limit: 100,
+    page: 1
+  });
+  for (const old of docs.slice(FINISHED_KEPT))
+    await cms.db.delete({ collection: BULK_OPERATIONS, id: old.id });
+}
+function toOperation(row) {
+  return {
+    id: row.id,
+    collection: String(row.collection),
+    action: row.action,
+    state: row.state,
+    total: Number(row.total),
+    done: Number(row.done),
+    skipped: Number(row.skipped),
+    failed: Number(row.failed),
+    problems: row.problems ?? [],
+    error: row.error ?? null,
+    createdAt: String(row.createdAt),
+    finishedAt: row.finishedAt ?? null
+  };
+}
+
 // src/localization.ts
 var ALL_LOCALES = "all";
 var isPlainObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -4400,7 +4730,7 @@ function localizeSort(fields, sort, locale, locales = []) {
 var DELAYS = [6e4, 5 * 6e4, 30 * 6e4, 2 * 36e5, 12 * 36e5];
 var LEASE = 5 * 6e4;
 var BATCH2 = 50;
-var later2 = (from, ms) => new Date(from.getTime() + ms).toISOString();
+var later3 = (from, ms) => new Date(from.getTime() + ms).toISOString();
 var json = (value) => value === void 0 ? null : JSON.stringify(value);
 var parse2 = (value) => typeof value === "string" ? JSON.parse(value) : void 0;
 function withoutHash(value) {
@@ -4520,7 +4850,7 @@ var Outbox = class {
       ...data,
       state: "running",
       attempts,
-      nextAttemptAt: later2(now, LEASE),
+      nextAttemptAt: later3(now, LEASE),
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     const claimed = await this.db.update({
@@ -4553,7 +4883,7 @@ var Outbox = class {
         data: {
           ...current,
           state: delay === void 0 ? "failed" : "pending",
-          nextAttemptAt: later2(now, delay ?? 0),
+          nextAttemptAt: later3(now, delay ?? 0),
           error: message2,
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
         }
@@ -4855,7 +5185,7 @@ async function fetchRemoteFile(link, options) {
   const deadline = Date.now() + (options.timeout ?? 15e3);
   const maxRedirects = options.maxRedirects ?? 3;
   for (let redirects = 0; ; redirects++) {
-    check(url, options);
+    check2(url, options);
     const response = await get(url, options, deadline);
     const status = response.statusCode ?? 0;
     if (status >= 300 && status < 400 && response.headers.location) {
@@ -4877,7 +5207,7 @@ async function fetchRemoteFile(link, options) {
     };
   }
 }
-function check(url, options) {
+function check2(url, options) {
   if (url.protocol !== "http:" && url.protocol !== "https:")
     throw new RemoteFileError("must be an http(s) link");
   if (url.username || url.password) throw new RemoteFileError("must not contain a password");
@@ -5043,7 +5373,7 @@ function distance(a, b) {
   }
   return row[b.length];
 }
-function check2(value, path, scope, known, add) {
+function check3(value, path, scope, known, add) {
   if (!isObject(value)) return;
   for (const key of Object.keys(value)) {
     if (known.has(key)) continue;
@@ -5066,8 +5396,8 @@ function checkFields(fields, path, add) {
     if (!isObject(field)) continue;
     const at = `${path}.${typeof field.name === "string" ? field.name : `[${i}]`}`;
     const known = typeof field.type === "string" ? FIELD[field.type] : void 0;
-    if (known && field.customType === void 0) check2(field, at, "field", known, add);
-    check2(field.admin, `${at}.admin`, "fieldAdmin", FIELD_ADMIN, add);
+    if (known && field.customType === void 0) check3(field, at, "field", known, add);
+    check3(field.admin, `${at}.admin`, "fieldAdmin", FIELD_ADMIN, add);
     checkFields(field.fields, `${at}.fields`, add);
     if (Array.isArray(field.blocks)) {
       for (const block of field.blocks)
@@ -5077,21 +5407,21 @@ function checkFields(fields, path, add) {
 }
 function checkConfigKeys(config, add) {
   const c = config;
-  check2(c, "", "config", CONFIG, add);
-  check2(c.admin, "admin", "admin", ADMIN, add);
+  check3(c, "", "config", CONFIG, add);
+  check3(c.admin, "admin", "admin", ADMIN, add);
   const admin = isObject(c.admin) ? c.admin : {};
   if (Array.isArray(admin.commands)) {
     for (const [i, command] of admin.commands.entries())
       if (isObject(command) && "to" in command)
         add({ path: `admin.commands[${i}].to`, message: "is now `href`" });
   }
-  check2(c.auth, "auth", "auth", AUTH, add);
-  if (isObject(c.auth)) check2(c.auth.members, "auth.members", "members", MEMBERS, add);
-  check2(c.upload, "upload", "upload", UPLOAD, add);
-  check2(c.backups, "backups", "backups", BACKUPS, add);
-  if (isObject(c.audit)) check2(c.audit, "audit", "audit", AUDIT, add);
-  if (isObject(c.rateLimit)) check2(c.rateLimit, "rateLimit", "rateLimit", RATE_LIMIT, add);
-  check2(c.logs, "logs", "logs", LOGS, add);
+  check3(c.auth, "auth", "auth", AUTH, add);
+  if (isObject(c.auth)) check3(c.auth.members, "auth.members", "members", MEMBERS, add);
+  check3(c.upload, "upload", "upload", UPLOAD, add);
+  check3(c.backups, "backups", "backups", BACKUPS, add);
+  if (isObject(c.audit)) check3(c.audit, "audit", "audit", AUDIT, add);
+  if (isObject(c.rateLimit)) check3(c.rateLimit, "rateLimit", "rateLimit", RATE_LIMIT, add);
+  check3(c.logs, "logs", "logs", LOGS, add);
   for (const [kind, list] of [
     ["collections", c.collections],
     ["globals", c.globals]
@@ -5101,8 +5431,8 @@ function checkConfigKeys(config, add) {
     for (const [i, item] of list.entries()) {
       if (!isObject(item)) continue;
       const at = `${kind}.${typeof item.slug === "string" ? item.slug : `[${i}]`}`;
-      check2(item, at, collection2 ? "collection" : "global", collection2 ? COLLECTION : GLOBAL, add);
-      check2(
+      check3(item, at, collection2 ? "collection" : "global", collection2 ? COLLECTION : GLOBAL, add);
+      check3(
         item.admin,
         `${at}.admin`,
         "admin-of",
@@ -5110,9 +5440,9 @@ function checkConfigKeys(config, add) {
         add
       );
       if (collection2 && isObject(item.admin) && isObject(item.admin.calendar))
-        check2(item.admin.calendar, `${at}.admin.calendar`, "calendar", keys("start end color"), add);
+        check3(item.admin.calendar, `${at}.admin.calendar`, "calendar", keys("start end color"), add);
       if (isObject(item.versions))
-        check2(item.versions, `${at}.versions`, "versions", keys("keep"), add);
+        check3(item.versions, `${at}.versions`, "versions", keys("keep"), add);
       checkFields(item.fields, `${at}.fields`, add);
     }
   }
@@ -5561,7 +5891,7 @@ var Webhooks = class {
       const claimed = await this.queue.claim(id, queued, {
         ...queued,
         attempts,
-        nextAttemptAt: later3(now, CLAIM2)
+        nextAttemptAt: later4(now, CLAIM2)
       });
       if (!claimed) continue;
       const result = await this.attempt(hook, queued.event, queued.body, queued.delivery);
@@ -5575,7 +5905,7 @@ var Webhooks = class {
       await this.queue.update(id, {
         ...queued,
         attempts,
-        nextAttemptAt: later3(now, delay ?? 0),
+        nextAttemptAt: later4(now, delay ?? 0),
         state: delay === void 0 ? "failed" : "pending",
         error: result.error
       });
@@ -5613,7 +5943,7 @@ var Webhooks = class {
       error
     });
     const { queue } = this;
-    const saved = queue ? this.saving.then(() => queue.add(entry(0, later3(/* @__PURE__ */ new Date(), CLAIM2), null))) : Promise.resolve(void 0);
+    const saved = queue ? this.saving.then(() => queue.add(entry(0, later4(/* @__PURE__ */ new Date(), CLAIM2), null))) : Promise.resolve(void 0);
     this.saving = saved.catch(() => {
     });
     let queued;
@@ -5634,7 +5964,7 @@ var Webhooks = class {
       if (delay === void 0) {
         if (queued === void 0 || !this.queue)
           return this.giveUp(hook, event, result.error, attempt + 1);
-        const next = later3(/* @__PURE__ */ new Date(), QUEUE_DELAYS2[0]);
+        const next = later4(/* @__PURE__ */ new Date(), QUEUE_DELAYS2[0]);
         await this.queue.update(queued, entry(attempt + 1, next, result.error));
         this.logger.warn(
           `Webhook ${hook.url} failed for ${event} (${result.error}); will retry later`
@@ -5682,7 +6012,7 @@ var Webhooks = class {
     );
   }
 };
-var later3 = (from, ms) => new Date(from.getTime() + ms).toISOString();
+var later4 = (from, ms) => new Date(from.getTime() + ms).toISOString();
 var isContentEvent = (event) => WEBHOOK_EVENTS.includes(event);
 function matches(hook, payload) {
   if (!isContentEvent(payload.event)) return hook.events?.includes(payload.event) === true;
@@ -6593,7 +6923,7 @@ function validateNav(config, add) {
       add("admin.nav", "must be a list of groups", "e.g. nav: [{ id: 'shop', label: 'Shop' }]");
     else
       nav.forEach((group, i) => {
-        const check3 = (g, path, child) => {
+        const check4 = (g, path, child) => {
           const { id, label, children, order } = g ?? {};
           if (typeof id !== "string" || !NAV_ID.test(id))
             add(`${path}.id`, "must be lowercase letters, digits and -", "e.g. 'shop'");
@@ -6606,11 +6936,11 @@ function validateNav(config, add) {
             else if (!Array.isArray(children)) add(`${path}.children`, "must be a list of groups");
             else
               children.forEach((c, j) => {
-                check3(c, `${path}.children[${j}]`, true);
+                check4(c, `${path}.children[${j}]`, true);
               });
           }
         };
-        check3(group, `admin.nav[${i}]`, false);
+        check4(group, `admin.nav[${i}]`, false);
       });
   }
   const commands = config.admin?.commands;
@@ -7388,6 +7718,7 @@ async function resolveConfig(input) {
       ...config.outbox ? [outboxCollection] : [],
       ...config.rateLimit ? [rateLimitsCollection] : [],
       databaseBackupsCollection,
+      bulkOperationsCollection,
       ...config.auth?.rbac ? [rolesCollection] : [],
       ...(config.auth?.providers?.length ?? 0) > 0 ? [userIdentitiesCollection] : [],
       ...config.audit ? [auditLogsCollection] : []
@@ -7457,7 +7788,7 @@ function cacheableResponse(request, body, status, headers, times, tags) {
 }
 
 // src/version.ts
-var VERSION = true ? "1.23.1" : "0.0.0-dev";
+var VERSION = true ? "1.25.0" : "0.0.0-dev";
 
 // src/telemetry.ts
 var DB_CALLS = /* @__PURE__ */ new Set([
@@ -7909,6 +8240,10 @@ var EasyCMS = class {
       return out ?? null;
     });
   }
+  /**
+   * The documents matching `where` that the user may read. With `max`, counting stops after
+   * `max + 1`: a result above `max` means "more than `max`", without reading every row.
+   */
   async count(collection2, options = {}) {
     return this.traced("count", String(collection2), async () => {
       const config = this.collection(collection2);
@@ -7921,7 +8256,9 @@ var EasyCMS = class {
         ),
         options
       );
-      return this.db.count({ collection: collection2, where });
+      if (options.max !== void 0 && (!Number.isInteger(options.max) || options.max < 0))
+        throw new QueryError("max must be a whole number of 0 or more");
+      return this.db.count({ collection: collection2, where, max: options.max });
     });
   }
   async create(collection2, data, options = {}) {
@@ -9046,7 +9383,7 @@ var EasyCMS = class {
     const parsed = parseId(id);
     if (parsed === void 0) return { update: false, delete: false };
     const guard = { enforce: true, user, context };
-    const check3 = (operation) => this.checkDocumentAccess(config, operation, guard, parsed, void 0).then(
+    const check4 = (operation) => this.checkDocumentAccess(config, operation, guard, parsed, void 0).then(
       () => true,
       (error) => {
         if (error instanceof ForbiddenError || error instanceof UnauthorizedError || error instanceof NotFoundError)
@@ -9054,7 +9391,7 @@ var EasyCMS = class {
         throw error;
       }
     );
-    return { update: await check3("update"), delete: await check3("delete") };
+    return { update: await check4("update"), delete: await check4("delete") };
   }
   /** Closes the database connection. */
   /**
@@ -9281,7 +9618,11 @@ var EasyCMS = class {
         webhooks: await this.retryWebhooks(now),
         emails: await this.mailer.retry(now),
         jobs: await this.runConfigJobs(now),
-        outbox: await this.outbox?.run(now) ?? { ran: 0, failed: 0 }
+        outbox: await this.outbox?.run(now) ?? { ran: 0, failed: 0 },
+        bulk: await runBulkOperations(this, now).catch((error) => {
+          this.logger.error(`Bulk actions: ${error.message}`, { error });
+          return { steps: 0 };
+        })
       };
       if (this.telemetry?.measuresQueues)
         await this.countQueues(now).catch(
@@ -9872,9 +10213,9 @@ var EasyCMS = class {
     );
   }
   /** Runs a check; a `ForbiddenError` for a document the user can't read becomes a 404. */
-  async hidingDenied(collection2, guard, id, check3) {
+  async hidingDenied(collection2, guard, id, check4) {
     try {
-      await check3();
+      await check4();
     } catch (error) {
       if (error instanceof ForbiddenError && !await this.mayRead(collection2, guard, id))
         throw new NotFoundError(collection2, String(id));
@@ -9970,7 +10311,7 @@ var EasyCMS = class {
   /** Runs afterRead hooks, populates relationships and removes what the caller may not see. */
   async output(config, docs, guard, options) {
     const read2 = await this.fieldChecker("read", guard, void 0, void 0);
-    const finish = async (target, doc) => {
+    const finish2 = async (target, doc) => {
       const hooked = await this.transform(
         target.hooks?.afterRead,
         "doc",
@@ -9995,13 +10336,13 @@ var EasyCMS = class {
       });
       const docs2 = drafts ? await this.withDrafts(target, found.docs) : found.docs;
       return Promise.all(
-        docs2.map((d) => finish(target, this.pick(target, d, options)))
+        docs2.map((d) => finish2(target, this.pick(target, d, options)))
       );
     };
     const depth = Math.max(0, Math.min(MAX_DEPTH, Math.trunc(options.depth ?? DEFAULT_DEPTH)));
     const localized = docs.map((d) => this.pick(config, d, options));
     const populated = await populate(load, this.config.collections, config.fields, localized, depth);
-    return Promise.all(populated.map((d) => finish(config, d)));
+    return Promise.all(populated.map((d) => finish2(config, d)));
   }
   /** Creates a document: access, input filtering, hooks, validation, then afterChange. */
   async createDocument(config, raw, options, hookGuard) {
@@ -12455,6 +12796,7 @@ function parseDepth(url) {
 
 // src/rest/handler.ts
 var SCHEDULED_RANGE_LIMIT = 500;
+var LIST_TOTAL_MAX = 1e4;
 var CSRF_COOKIE = "ecms-csrf";
 var CSRF_HEADER = "x-csrf-token";
 var MAX_BODY_BYTES = 1024 * 1024;
@@ -12639,6 +12981,8 @@ var ADMIN_UI_ROUTES = /* @__PURE__ */ new Set([
   "modules",
   "scheduled",
   "access",
+  "bulk",
+  "total",
   "media-usage",
   "owned",
   "sso"
@@ -13210,6 +13554,23 @@ async function route(cms, ctx, method, path, options) {
         })
       };
     }
+    if (second === "total" && third !== void 0 && segments.length === 3) {
+      if (INTERNAL_COLLECTIONS.has(third) || !cms.config.collections.some((c) => c.slug === third)) {
+        throw new HttpError(`Unknown collection "${third}"`, 404);
+      }
+      const { where } = parseListQuery(ctx.url);
+      const total = await cms.count(third, {
+        ...access,
+        ...where ? { where } : {},
+        draft,
+        max: LIST_TOTAL_MAX
+      });
+      return {
+        body: { total: Math.min(total, LIST_TOTAL_MAX), more: total > LIST_TOTAL_MAX }
+      };
+    }
+    if (second === "bulk" && third === void 0)
+      return { body: { docs: await bulkOperations(cms, ctx.user) } };
     const [, , collection3, id2, extra] = segments;
     if (second === "access" && collection3 && id2 && extra === void 0) {
       if (INTERNAL_COLLECTIONS.has(collection3) || !cms.config.collections.some((c) => c.slug === collection3)) {
@@ -13327,6 +13688,7 @@ async function route(cms, ctx, method, path, options) {
   if (INTERNAL_COLLECTIONS.has(collection2) || !cms.config.collections.some((c) => c.slug === collection2)) {
     throw new HttpError(`Unknown collection "${collection2}"`, 404);
   }
+  if (second === "bulk") return bulkRoute(cms, ctx, method, collection2, segments.slice(2), access);
   if (second !== void 0 && third !== void 0) {
     return documentAction(cms, ctx, method, collection2, second, segments.slice(2));
   }
@@ -13464,6 +13826,42 @@ async function documentAction(cms, ctx, method, collection2, id, path) {
   }
   throw new HttpError("Not found", 404);
 }
+async function bulkRoute(cms, ctx, method, collection2, path, access) {
+  const user = ctx.user;
+  if (!user) throw new UnauthorizedError();
+  const [raw, action, extra] = path;
+  if (raw === void 0) {
+    if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+    const body = await readJson(ctx.request);
+    const options = {
+      user,
+      ...access.context ? { context: access.context } : {},
+      ...body.folder !== void 0 ? { folder: body.folder } : {},
+      ...body.transferTo !== void 0 ? { transferTo: body.transferTo } : {}
+    };
+    const name = String(body.action ?? "");
+    if (Array.isArray(body.ids))
+      return { body: await bulkIds(cms, collection2, name, body.ids, options) };
+    const where = body.where;
+    if (where !== void 0 && (typeof where !== "object" || where === null || Array.isArray(where)))
+      throw new QueryError("where must be an object");
+    return {
+      status: 202,
+      body: await startBulk(cms, collection2, name, where, options)
+    };
+  }
+  const id = parseId(raw);
+  if (id === void 0) throw new HttpError("Not found", 404);
+  if (action === void 0) {
+    if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+    return { body: await bulkProgress(cms, id, user) };
+  }
+  if (action === "cancel" && extra === void 0) {
+    if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+    return { body: await cancelBulk(cms, id, user) };
+  }
+  throw new HttpError("Not found", 404);
+}
 async function globalAction(cms, ctx, method, slug2, path) {
   const access = {
     overrideAccess: false,

package/dist/{config-BQ53ulBF.d.ts → config-Bsp6rkuH.d.ts}

@@ -235,9 +235,14 @@ interface Database {
         collection: string;
         ids: readonly ID[];
     }): Promise<RawDocument[]>;
+    /**
+     * With `max`, stops after `max + 1` matches (a result above `max` means "more than `max`"), so a
+     * count on a large collection doesn't read every row.
+     */
     count(args: {
         collection: string;
         where?: Where | undefined;
+        max?: number | undefined;
     }): Promise<number>;
     /** `data` holds every field, `createdAt` and `updatedAt`. Runs in one transaction. */
     create(args: {
@@ -1883,10 +1888,15 @@ declare class EasyCMS<C extends Config = Config> {
     findById<S extends Slug<C>, L extends string | undefined = undefined>(collection: S, id: ID, options?: ReadOptions & {
         readonly locale?: L;
     }): Promise<Doc<C, S, L> | null>;
+    /**
+     * The documents matching `where` that the user may read. With `max`, counting stops after
+     * `max + 1`: a result above `max` means "more than `max`", without reading every row.
+     */
     count<S extends Slug<C>>(collection: S, options?: {
         where?: Where;
         draft?: boolean;
         locale?: string;
+        max?: number;
     } & AccessOptions): Promise<number>;
     create<S extends Slug<C>>(collection: S, data: Create<C, S>, options?: DepthOptions): Promise<Doc<C, S>>;
     /**
@@ -2180,6 +2190,10 @@ declare class EasyCMS<C extends Config = Config> {
             ran: number;
             failed: number;
         };
+        /** Steps of bulk actions on a list's matches (100 documents each). */
+        bulk: {
+            steps: number;
+        };
     }>;
     private runJobsNow;
     /**

package/dist/{handler-B4GC_p5n.d.ts → handler-Br9Pu6z9.d.ts}

@@ -1,4 +1,4 @@
-import { I as ID, C as Config, E as EasyCMS, L as LocalizationConfig, F as Field, a as FieldError, b as FilterOptions, c as CreateEasyCMSOptions, R as ResolvedConfig } from './config-BQ53ulBF.js';
+import { I as ID, C as Config, E as EasyCMS, L as LocalizationConfig, F as Field, a as FieldError, b as FilterOptions, c as CreateEasyCMSOptions, R as ResolvedConfig } from './config-Bsp6rkuH.js';
 
 /** Decrypts a file from `encryptBackup`; throws for another key or a changed file. */
 declare function decryptBackup(data: Uint8Array, encryptionKey: string): Uint8Array;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { P as PaginatedDocs, I as ID, d as EmailSetting, W as WebhookPayload } from './config-BQ53ulBF.js';
-export { A as ADAPTER_API_VERSION, e as ADMIN_ICONS, f as Access, g as AccessArgs, h as AccessOptions, i as AdminBrand, j as AdminCommand, k as AdminComponent, l as AdminConfig, m as AdminFieldArgs, n as AdminIcon, o as AdminLocale, p as AdminPage, q as AdminRole, r as AdminRoleChange, s as AdminRoleField, t as AdminRoleTarget, u as AdminRoleView, v as AdminRoles, w as AdminSso, x as AdminSwitcher, y as AdminViewAccess, z as AfterChangeHook, B as AfterDeleteHook, D as AfterReadHook, G as ApiKeyContext, H as ApiKeyGlobalOperation, J as ApiKeyOperation, K as ApiKeyPermissions, M as ArrayField, N as AuditChange, O as AuditConfig, Q as AuditEntry, S as AuditLog, T as AuditPage, U as AuditVerification, V as Auth, X as AuthConfig, Y as AuthProvider, Z as AuthProviderProfile, _ as AuthProviderRequest, $ as AuthUser, a0 as BackupsConfig, a1 as BeforeChangeHook, a2 as BeforeDeleteHook, a3 as BeforeValidateHook, a4 as Block, a5 as BlocksField, a6 as BooleanField, a7 as BuiltinApiKeysCollection, a8 as BuiltinMediaCollection, a9 as BuiltinMediaFoldersCollection, aa as BuiltinUsersCollection, ab as BundleHints, ac as CliCommand, ad as CollectionAccess, ae as CollectionAdmin, af as CollectionCalendarAdmin, ag as CollectionConfig, ah as CollectionDocument, ai as CollectionHooks, aj as CollectionListAdmin, ak as CollectionSearch, al as CollectionSlug, C as Config, am as ConfigError, an as ConfigIssue, ao as ContainerAdmin, c as CreateEasyCMSOptions, ap as CreateInput, aq as CreateMigrationResult, ar as CursorDocs, as as CustomField, at as CustomFieldTypes, au as DashboardWidget, av as Database, aw as DatabaseAdapter, ax as DatabaseInitArgs, ay as DatabaseTransfer, az as DateField, aA as DepthOptions, aB as DirectUpload, aC as DiskStorageOptions, aD as DocumentOf, E as EasyCMS, aE as EasyCMSError, aF as EmailAdapter, aG as EmailField, aH as EmailMessage, aI as Endpoint, aJ as EndpointRequest, aK as ErrorCode, aL as FIELD_TYPES, F as Field, aM as FieldAccess, aN as FieldAccessFn, aO as FieldAdmin, a as FieldError, aP as FieldRule, aQ as FieldType, aR as FieldTypeBase, aS as FieldTypeDefinition, aT as FieldTypeValidateContext, aU as FieldValidate, aV as FieldValidateContext, aW as FieldValue, aX as FieldsInput, aY as FieldsValue, b as FilterOptions, aZ as FilterOptionsArgs, a_ as FindAfterArgs, a$ as FindArgs, b0 as FindOptions, b1 as FolderLevel, b2 as FolderPermissions, b3 as ForbiddenError, b4 as GlobalAccess, b5 as GlobalConfig, b6 as GlobalDocument, b7 as GlobalHooks, b8 as GlobalInput, b9 as GlobalSlug, ba as GroupField, bb as ImageSize, bc as IncrementOptions, bd as InferCollection, be as InferGlobal, bf as JobConfig, bg as JsonField, bh as KeysetPage, bi as Label, bj as LayoutNode, bk as LivePreview, bl as LocaleOf, L as LocalizationConfig, bm as LogDetails, bn as Logger, bo as LoginArgs, bp as LogsConfig, bq as MediaDocument, br as MediaSize, bs as MembersConfig, bt as MembersSignup, bu as MigrationInfo, bv as NavGroup, bw as NotFoundError, bx as NumberField, by as OnRequest, bz as OnRequestArgs, bA as Operation, bB as OutboxRow, bC as PLUGIN_API_VERSION, bD as PasswordEmail, bE as PasswordEmailArgs, bF as PasswordEmailFn, bG as PasswordLinkOptions, bH as PayloadTooLargeError, bI as Plugin, bJ as PluginInfo, bK as PluginTypes, bL as PreviewTarget, bM as PreviewURL, bN as QueryError, bO as ROLE_OPERATIONS, bP as RawDocument, bQ as ReadOptions, bR as RelationshipField, bS as RequestContext, R as ResolvedConfig, bT as RichTextDocument, bU as RichTextField, bV as Role, bW as RoleOperation, bX as RolePermissions, bY as Roles, bZ as RoutesConfig, b_ as ScheduledPublish, b$ as SchemaError, c0 as SchemaMode, c1 as SearchAdapter, c2 as SearchEntry, c3 as SearchHits, c4 as SearchOptions, c5 as SearchQuery, c6 as SearchResults, c7 as SearchSetting, c8 as SelectField, c9 as SelectOption, ca as Session, cb as SidebarPanel, cc as SignupArgs, cd as SignupResult, ce as SingleSignOn, cf as SlugField, cg as SlugOf, ch as SsoOutcome, ci as SsoProviderRef, cj as StorageAdapter, ck as StoredFile, cl as TRIGRAM_LIKE_MIN, cm as TelemetryConfig, cn as TextField, co as TextareaField, cp as TooManyRequestsError, cq as TypedPlugin, cr as UnauthorizedError, cs as UncountedDocs, ct as UpdateInput, cu as UpdateOptions, cv as UploadConfig, cw as UploadField, cx as UploadFromURLConfig, cy as UserIdentity, cz as ValidationError, cA as Version, cB as VersionSummary, cC as VersionsConfig, cD as WEBHOOK_EVENTS, cE as WebhookConfig, cF as WebhookEvent, cG as Where, cH as WhereOperators, cI as anyone, cJ as consoleEmail, cK as consoleLogger, cL as createEasyCMS, cM as defineConfig, cN as defineFieldType, cO as definePlugin, cP as diskStorage, cQ as hasRows, cR as isAdmin, cS as isHasMany, cT as isSignedIn, cU as isStaff, cV as isSystemAdmin, cW as jsonLogger, cX as memorySearch, cY as mimeAllowedBy, cZ as rowFields, c_ as silentLogger, c$ as uniqueWithinOf } from './config-BQ53ulBF.js';
-export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-I5C-9kXl.js';
-export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-B4GC_p5n.js';
+import { P as PaginatedDocs, I as ID, d as EmailSetting, W as WebhookPayload } from './config-Bsp6rkuH.js';
+export { A as ADAPTER_API_VERSION, e as ADMIN_ICONS, f as Access, g as AccessArgs, h as AccessOptions, i as AdminBrand, j as AdminCommand, k as AdminComponent, l as AdminConfig, m as AdminFieldArgs, n as AdminIcon, o as AdminLocale, p as AdminPage, q as AdminRole, r as AdminRoleChange, s as AdminRoleField, t as AdminRoleTarget, u as AdminRoleView, v as AdminRoles, w as AdminSso, x as AdminSwitcher, y as AdminViewAccess, z as AfterChangeHook, B as AfterDeleteHook, D as AfterReadHook, G as ApiKeyContext, H as ApiKeyGlobalOperation, J as ApiKeyOperation, K as ApiKeyPermissions, M as ArrayField, N as AuditChange, O as AuditConfig, Q as AuditEntry, S as AuditLog, T as AuditPage, U as AuditVerification, V as Auth, X as AuthConfig, Y as AuthProvider, Z as AuthProviderProfile, _ as AuthProviderRequest, $ as AuthUser, a0 as BackupsConfig, a1 as BeforeChangeHook, a2 as BeforeDeleteHook, a3 as BeforeValidateHook, a4 as Block, a5 as BlocksField, a6 as BooleanField, a7 as BuiltinApiKeysCollection, a8 as BuiltinMediaCollection, a9 as BuiltinMediaFoldersCollection, aa as BuiltinUsersCollection, ab as BundleHints, ac as CliCommand, ad as CollectionAccess, ae as CollectionAdmin, af as CollectionCalendarAdmin, ag as CollectionConfig, ah as CollectionDocument, ai as CollectionHooks, aj as CollectionListAdmin, ak as CollectionSearch, al as CollectionSlug, C as Config, am as ConfigError, an as ConfigIssue, ao as ContainerAdmin, c as CreateEasyCMSOptions, ap as CreateInput, aq as CreateMigrationResult, ar as CursorDocs, as as CustomField, at as CustomFieldTypes, au as DashboardWidget, av as Database, aw as DatabaseAdapter, ax as DatabaseInitArgs, ay as DatabaseTransfer, az as DateField, aA as DepthOptions, aB as DirectUpload, aC as DiskStorageOptions, aD as DocumentOf, E as EasyCMS, aE as EasyCMSError, aF as EmailAdapter, aG as EmailField, aH as EmailMessage, aI as Endpoint, aJ as EndpointRequest, aK as ErrorCode, aL as FIELD_TYPES, F as Field, aM as FieldAccess, aN as FieldAccessFn, aO as FieldAdmin, a as FieldError, aP as FieldRule, aQ as FieldType, aR as FieldTypeBase, aS as FieldTypeDefinition, aT as FieldTypeValidateContext, aU as FieldValidate, aV as FieldValidateContext, aW as FieldValue, aX as FieldsInput, aY as FieldsValue, b as FilterOptions, aZ as FilterOptionsArgs, a_ as FindAfterArgs, a$ as FindArgs, b0 as FindOptions, b1 as FolderLevel, b2 as FolderPermissions, b3 as ForbiddenError, b4 as GlobalAccess, b5 as GlobalConfig, b6 as GlobalDocument, b7 as GlobalHooks, b8 as GlobalInput, b9 as GlobalSlug, ba as GroupField, bb as ImageSize, bc as IncrementOptions, bd as InferCollection, be as InferGlobal, bf as JobConfig, bg as JsonField, bh as KeysetPage, bi as Label, bj as LayoutNode, bk as LivePreview, bl as LocaleOf, L as LocalizationConfig, bm as LogDetails, bn as Logger, bo as LoginArgs, bp as LogsConfig, bq as MediaDocument, br as MediaSize, bs as MembersConfig, bt as MembersSignup, bu as MigrationInfo, bv as NavGroup, bw as NotFoundError, bx as NumberField, by as OnRequest, bz as OnRequestArgs, bA as Operation, bB as OutboxRow, bC as PLUGIN_API_VERSION, bD as PasswordEmail, bE as PasswordEmailArgs, bF as PasswordEmailFn, bG as PasswordLinkOptions, bH as PayloadTooLargeError, bI as Plugin, bJ as PluginInfo, bK as PluginTypes, bL as PreviewTarget, bM as PreviewURL, bN as QueryError, bO as ROLE_OPERATIONS, bP as RawDocument, bQ as ReadOptions, bR as RelationshipField, bS as RequestContext, R as ResolvedConfig, bT as RichTextDocument, bU as RichTextField, bV as Role, bW as RoleOperation, bX as RolePermissions, bY as Roles, bZ as RoutesConfig, b_ as ScheduledPublish, b$ as SchemaError, c0 as SchemaMode, c1 as SearchAdapter, c2 as SearchEntry, c3 as SearchHits, c4 as SearchOptions, c5 as SearchQuery, c6 as SearchResults, c7 as SearchSetting, c8 as SelectField, c9 as SelectOption, ca as Session, cb as SidebarPanel, cc as SignupArgs, cd as SignupResult, ce as SingleSignOn, cf as SlugField, cg as SlugOf, ch as SsoOutcome, ci as SsoProviderRef, cj as StorageAdapter, ck as StoredFile, cl as TRIGRAM_LIKE_MIN, cm as TelemetryConfig, cn as TextField, co as TextareaField, cp as TooManyRequestsError, cq as TypedPlugin, cr as UnauthorizedError, cs as UncountedDocs, ct as UpdateInput, cu as UpdateOptions, cv as UploadConfig, cw as UploadField, cx as UploadFromURLConfig, cy as UserIdentity, cz as ValidationError, cA as Version, cB as VersionSummary, cC as VersionsConfig, cD as WEBHOOK_EVENTS, cE as WebhookConfig, cF as WebhookEvent, cG as Where, cH as WhereOperators, cI as anyone, cJ as consoleEmail, cK as consoleLogger, cL as createEasyCMS, cM as defineConfig, cN as defineFieldType, cO as definePlugin, cP as diskStorage, cQ as hasRows, cR as isAdmin, cS as isHasMany, cT as isSignedIn, cU as isStaff, cV as isSystemAdmin, cW as jsonLogger, cX as memorySearch, cY as mimeAllowedBy, cZ as rowFields, c_ as silentLogger, c$ as uniqueWithinOf } from './config-Bsp6rkuH.js';
+export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-CUzEJN31.js';
+export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-Br9Pu6z9.js';
 export { FieldCondition, matchesCondition } from './conditions.js';
 
 type DeliveryKind = 'webhook' | 'email';

package/dist/index.js

@@ -28,7 +28,7 @@ import {
   silentLogger,
   slugify,
   verifyWebhook
-} from "./chunk-VZNL7HWC.js";
+} from "./chunk-AAZ35NPQ.js";
 import {
   matchesCondition
 } from "./chunk-U266LV4M.js";

package/dist/internal.d.ts

@@ -1,6 +1,6 @@
 import { Config, Database, EasyCMS, NavGroup, CollectionConfig, ID, RawDocument, Field, ResolvedConfig, ConfigIssue } from './index.js';
-export { d0 as API_KEYS, d1 as API_KEY_GLOBAL_OPERATIONS, d2 as API_KEY_OPERATIONS, d3 as DEFAULT_MAX_VERSIONS, d4 as DEFAULT_PASSWORD_EMAILS, d5 as FIELD_TYPE_BASES, d6 as FOLDER_LEVELS, d7 as MediaFolders, d8 as SSO_COOKIE, d9 as Secrets, cl as TRIGRAM_LIKE_MIN, da as codeOfStatus, cQ as hasRows, cS as isHasMany, db as isJsonLogger, dc as keyAllows, dd as logFormat, cY as mimeAllowedBy, cZ as rowFields, de as secretsOf, c$ as uniqueWithinOf } from './config-BQ53ulBF.js';
-export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as isEmail, y as mergeForUpdate, z as parseId, E as platformClientIp, F as readCookie, G as validateFields, H as writeBackupFile } from './handler-B4GC_p5n.js';
+export { d0 as API_KEYS, d1 as API_KEY_GLOBAL_OPERATIONS, d2 as API_KEY_OPERATIONS, d3 as DEFAULT_MAX_VERSIONS, d4 as DEFAULT_PASSWORD_EMAILS, d5 as FIELD_TYPE_BASES, d6 as FOLDER_LEVELS, d7 as MediaFolders, d8 as SSO_COOKIE, d9 as Secrets, cl as TRIGRAM_LIKE_MIN, da as codeOfStatus, cQ as hasRows, cS as isHasMany, db as isJsonLogger, dc as keyAllows, dd as logFormat, cY as mimeAllowedBy, cZ as rowFields, de as secretsOf, c$ as uniqueWithinOf } from './config-Bsp6rkuH.js';
+export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as isEmail, y as mergeForUpdate, z as parseId, E as platformClientIp, F as readCookie, G as validateFields, H as writeBackupFile } from './handler-Br9Pu6z9.js';
 export { conditionIssues } from './conditions.js';
 
 /** The session cookie the REST API sets at login. */

package/dist/internal.js

@@ -58,7 +58,7 @@ import {
   verifyPassword,
   verifyTurnstile,
   writeBackupFile
-} from "./chunk-VZNL7HWC.js";
+} from "./chunk-AAZ35NPQ.js";
 import {
   conditionIssues
 } from "./chunk-U266LV4M.js";

package/dist/{plugin-I5C-9kXl.d.ts → plugin-CUzEJN31.d.ts}

@@ -1,4 +1,4 @@
-import { bi as Label, F as Field, I as ID, o as AdminLocale, x as AdminSwitcher, ci as SsoProviderRef } from './config-BQ53ulBF.js';
+import { bi as Label, F as Field, I as ID, o as AdminLocale, x as AdminSwitcher, ci as SsoProviderRef } from './config-Bsp6rkuH.js';
 import { FieldCondition } from './conditions.js';
 
 /** A Web Component from an admin module, with its `props` (plain JSON). */

package/dist/plugin.d.ts

@@ -1,3 +1,3 @@
-export { e as ADMIN_ICONS, k as AdminComponent, n as AdminIcon, $ as AuthUser, ac as CliCommand, ad as CollectionAccess, ag as CollectionConfig, C as Config, am as ConfigError, au as DashboardWidget, aE as EasyCMSError, aI as Endpoint, aJ as EndpointRequest, aK as ErrorCode, F as Field, aM as FieldAccess, a as FieldError, aR as FieldTypeBase, aS as FieldTypeDefinition, aT as FieldTypeValidateContext, b3 as ForbiddenError, b5 as GlobalConfig, I as ID, bf as JobConfig, bi as Label, bv as NavGroup, bw as NotFoundError, by as OnRequest, bz as OnRequestArgs, bC as PLUGIN_API_VERSION, bH as PayloadTooLargeError, bI as Plugin, bJ as PluginInfo, bK as PluginTypes, bN as QueryError, bS as RequestContext, cp as TooManyRequestsError, cq as TypedPlugin, cr as UnauthorizedError, cz as ValidationError, cG as Where, cN as defineFieldType, cO as definePlugin } from './config-BQ53ulBF.js';
-export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-I5C-9kXl.js';
+export { e as ADMIN_ICONS, k as AdminComponent, n as AdminIcon, $ as AuthUser, ac as CliCommand, ad as CollectionAccess, ag as CollectionConfig, C as Config, am as ConfigError, au as DashboardWidget, aE as EasyCMSError, aI as Endpoint, aJ as EndpointRequest, aK as ErrorCode, F as Field, aM as FieldAccess, a as FieldError, aR as FieldTypeBase, aS as FieldTypeDefinition, aT as FieldTypeValidateContext, b3 as ForbiddenError, b5 as GlobalConfig, I as ID, bf as JobConfig, bi as Label, bv as NavGroup, bw as NotFoundError, by as OnRequest, bz as OnRequestArgs, bC as PLUGIN_API_VERSION, bH as PayloadTooLargeError, bI as Plugin, bJ as PluginInfo, bK as PluginTypes, bN as QueryError, bS as RequestContext, cp as TooManyRequestsError, cq as TypedPlugin, cr as UnauthorizedError, cz as ValidationError, cG as Where, cN as defineFieldType, cO as definePlugin } from './config-Bsp6rkuH.js';
+export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-CUzEJN31.js';
 import './conditions.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "1.23.1",
+  "version": "1.25.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",