@easy-cms/core 1.30.0 → 1.31.0

package/dist/{chunk-JTBPGZMF.js → chunk-ZA5KIRYX.js}

@@ -161,6 +161,7 @@ var AUDIT_LOGS = "audit-logs";
 var OUTBOX = "outbox";
 var RATE_LIMITS = "rate-limits";
 var BULK_OPERATIONS = "bulk-operations";
+var SAVED_VIEWS = "saved-views";
 var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SESSIONS,
   LOGIN_ATTEMPTS,
@@ -175,7 +176,8 @@ var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   AUDIT_LOGS,
   OUTBOX,
   RATE_LIMITS,
-  BULK_OPERATIONS
+  BULK_OPERATIONS,
+  SAVED_VIEWS
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
 var CREATED_BY_FIELD = {
@@ -563,6 +565,22 @@ var bulkOperationsCollection = {
     { name: "finishedAt", type: "text" }
   ]
 };
+var savedViewsCollection = {
+  slug: SAVED_VIEWS,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    { name: "collection", type: "text", required: true, index: true },
+    { name: "user", type: "text", required: true, index: true },
+    // view | default
+    { name: "kind", type: "text", required: true },
+    { name: "name", type: "text" },
+    { name: "shared", type: "boolean" },
+    // `{ query, columns?, pageSize?, density? }`: the list's URL query, and what the browser kept.
+    { name: "state", type: "json" },
+    // For `default`: a view's id, or `config:<id>` for one of `admin.views`.
+    { name: "target", type: "text" }
+  ]
+};
 var webhookDeliveriesCollection = {
   slug: WEBHOOK_DELIVERIES,
   access: { read: nobody, create: nobody, update: nobody, delete: nobody },
@@ -705,6 +723,15 @@ var emailDeliveriesCollection = {
 // src/audit.ts
 import { AsyncLocalStorage } from "async_hooks";
 import { createHmac as createHmac2 } from "crypto";
+
+// src/csv.ts
+function csvCell(value) {
+  const s = value === null || value === void 0 ? "" : typeof value === "string" ? value : JSON.stringify(value);
+  const safe = /^[=+\-@\t\r]/.test(s) ? `'${s}` : s;
+  return /[",\n\r]/.test(safe) ? `"${safe.replaceAll('"', '""')}"` : safe;
+}
+
+// src/audit.ts
 var DEFAULT_AUDIT_KEEP = 365;
 var DEFAULT_FAILED_LOGINS = 20;
 var MAX_VALUE = 500;
@@ -877,11 +904,7 @@ var AuditLog = class {
       limit: CSV_LIMIT,
       page: 1
     });
-    const cell = (value) => {
-      const s = value === null || value === void 0 ? "" : typeof value === "string" ? value : JSON.stringify(value);
-      const safe = /^[=+\-@\t\r]/.test(s) ? `'${s}` : s;
-      return /[",\n\r]/.test(safe) ? `"${safe.replaceAll('"', '""')}"` : safe;
-    };
+    const cell = csvCell;
     const lines = [
       ["at", "action", "target", "doc", "title", "actor", "via", "ip", "changes", "detail"].join(
         ","
@@ -1304,9 +1327,9 @@ var esc = (value) => value.replace(
   (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]
 );
 function email(subject, lines, button) {
-  const text3 = [...lines, ...button ? ["", button.url] : []].join("\n");
+  const text4 = [...lines, ...button ? ["", button.url] : []].join("\n");
   const html = `<div style="font-family:system-ui,sans-serif;font-size:15px;line-height:1.5;color:#1f2328">${lines.map((line) => `<p>${esc(line)}</p>`).join("")}${button ? `<p><a href="${esc(button.url)}" style="display:inline-block;padding:10px 18px;border-radius:8px;background:#2f6f5e;color:#fff;text-decoration:none;font-weight:600">${esc(button.label)}</a></p><p style="font-size:13px;color:#656d76">${esc(button.url)}</p>` : ""}</div>`;
-  return { subject, text: text3, html };
+  return { subject, text: text4, html };
 }
 var hours = (expiresAt) => Math.max(1, Math.round(((expiresAt?.getTime() ?? Date.now()) - Date.now()) / 36e5));
 var days = (expiresAt) => Math.max(1, Math.round(hours(expiresAt) / 24));
@@ -2597,8 +2620,8 @@ function itemsOf(field, n) {
   return `${n} ${unit}${n === 1 ? "" : "s"}`;
 }
 var isEmpty = (value) => value === void 0 || value === null || value === "";
-function slugify(text3) {
-  return text3.normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{M}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "");
+function slugify(text4) {
+  return text4.normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{M}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "");
 }
 function applyDefaults(fields, data, localization = null) {
   const result = { ...data };
@@ -2907,7 +2930,7 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
         return fail(`must have at least ${field.minRows} rows`);
       if (field.maxRows !== void 0 && raw.length > field.maxRows)
         return fail(`must have at most ${field.maxRows} rows`);
-      const rows = [];
+      const rows2 = [];
       for (const [i, row] of raw.entries()) {
         if (!isPlainObject(row)) {
           errors.push({ field: `${path}.${i}`, message: "must be an object" });
@@ -2917,9 +2940,9 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
         errors.push(...sub.errors);
         references2.push(...sub.references);
         const id = typeof row.id === "string" && row.id !== "" ? row.id : randomUUID();
-        rows.push({ id, ...sub.data });
+        rows2.push({ id, ...sub.data });
       }
-      return rows;
+      return rows2;
     }
     case "blocks":
       return normalizeBlocks(field, raw, path, options, fail, errors, references2);
@@ -2933,7 +2956,7 @@ async function normalizeBlocks(field, raw, path, options, fail, errors, referenc
     return fail(`must have at least ${field.minRows} blocks`);
   if (field.maxRows !== void 0 && raw.length > field.maxRows)
     return fail(`must have at most ${field.maxRows} blocks`);
-  const rows = [];
+  const rows2 = [];
   for (const [i, row] of raw.entries()) {
     const fields = rowFields(field, row);
     if (!isPlainObject(row) || !fields) {
@@ -2947,9 +2970,9 @@ async function normalizeBlocks(field, raw, path, options, fail, errors, referenc
     errors.push(...sub.errors);
     references2.push(...sub.references);
     const id = typeof row.id === "string" && row.id !== "" ? row.id : randomUUID();
-    rows.push({ id, blockType: row.blockType, ...sub.data });
+    rows2.push({ id, blockType: row.blockType, ...sub.data });
   }
-  return rows;
+  return rows2;
 }
 function normalizeSelect(field, raw, fail) {
   const allowed2 = field.options.map((o) => typeof o === "string" ? o : o.value);
@@ -3198,11 +3221,11 @@ async function copyDatabase(source, target, options = {}) {
   for (const table of tables) {
     let copied = 0;
     for (; ; ) {
-      const rows = await from.read(table, copied, BATCH);
-      if (rows.length === 0) break;
-      await to.write(table, rows);
-      copied += rows.length;
-      if (rows.length < BATCH) break;
+      const rows2 = await from.read(table, copied, BATCH);
+      if (rows2.length === 0) break;
+      await to.write(table, rows2);
+      copied += rows2.length;
+      if (rows2.length < BATCH) break;
     }
     total += copied;
     options.onTable?.({ table, rows: copied });
@@ -3413,26 +3436,26 @@ async function writeBackupFile(cms, file) {
       });
   }
 }
-var slug = (text3) => text3.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "easy-cms";
+var slug = (text4) => text4.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "easy-cms";
 function filenameFor(cms, date) {
   const pad = (n) => String(n).padStart(2, "0");
   const stamp = `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}-${pad(date.getHours())}${pad(date.getMinutes())}`;
   return `${slug(cms.config.admin.brand.name || "easy-cms")}-${stamp}.db.gz`;
 }
 function toAdmin(row) {
-  const text3 = (value) => typeof value === "string" && value !== "" ? value : null;
+  const text4 = (value) => typeof value === "string" && value !== "" ? value : null;
   return {
     id: row.id,
     state: ["pending", "running", "done", "failed"].includes(row.state) ? row.state : "failed",
     trigger: row.trigger === "scheduled" ? "scheduled" : "manual",
-    filename: text3(row.filename),
+    filename: text4(row.filename),
     size: typeof row.size === "number" ? row.size : null,
-    startedAt: text3(row.startedAt),
-    finishedAt: text3(row.finishedAt),
-    error: text3(row.error),
-    author: text3(row.author),
-    downloadedBy: text3(row.downloadedBy),
-    downloadedAt: text3(row.downloadedAt)
+    startedAt: text4(row.startedAt),
+    finishedAt: text4(row.finishedAt),
+    error: text4(row.error),
+    author: text4(row.author),
+    downloadedBy: text4(row.downloadedBy),
+    downloadedAt: text4(row.downloadedAt)
   };
 }
 async function update(cms, row, data) {
@@ -3771,10 +3794,10 @@ var MediaFolders = class {
   async rows() {
     if (this.cache && Date.now() - this.cache.at < TTL) return this.cache.rows;
     const found = await this.db.find({ collection: MEDIA_FOLDERS, sort: [], limit: 0, page: 1 });
-    const rows = /* @__PURE__ */ new Map();
+    const rows2 = /* @__PURE__ */ new Map();
     for (const doc of found.docs) {
       const permissions = doc.permissions;
-      rows.set(String(doc.id), {
+      rows2.set(String(doc.id), {
         id: doc.id,
         parent: doc.parent ?? null,
         name: String(doc.name ?? ""),
@@ -3784,31 +3807,31 @@ var MediaFolders = class {
         doc
       });
     }
-    this.cache = { at: Date.now(), rows };
-    return rows;
+    this.cache = { at: Date.now(), rows: rows2 };
+    return rows2;
   }
   /** A role's level in a folder (`null`: the top level): the nearest permissions up the tree. */
-  levelIn(rows, role, id) {
+  levelIn(rows2, role, id) {
     const seen = /* @__PURE__ */ new Set();
-    let current = id === null ? void 0 : rows.get(String(id));
+    let current = id === null ? void 0 : rows2.get(String(id));
     while (current && !seen.has(String(current.id))) {
       seen.add(String(current.id));
       if (current.permissions) {
         const level = current.permissions[role];
         return level && level in RANK ? level : "none";
       }
-      current = current.parent === null ? void 0 : rows.get(String(current.parent));
+      current = current.parent === null ? void 0 : rows2.get(String(current.parent));
     }
     return "manage";
   }
   /** Whether files in a folder (`null`: the top level) are private: it or a folder above is. */
-  privateIn(rows, id) {
+  privateIn(rows2, id) {
     const seen = /* @__PURE__ */ new Set();
-    let current = id === null ? void 0 : rows.get(String(id));
+    let current = id === null ? void 0 : rows2.get(String(id));
     while (current && !seen.has(String(current.id))) {
       if (current.private) return true;
       seen.add(String(current.id));
-      current = current.parent === null ? void 0 : rows.get(String(current.parent));
+      current = current.parent === null ? void 0 : rows2.get(String(current.parent));
     }
     return false;
   }
@@ -3818,26 +3841,26 @@ var MediaFolders = class {
     return this.privateIn(await this.rows(), id);
   }
   /** The folder and every folder inside it. */
-  within(rows, ids) {
+  within(rows2, ids) {
     const out = new Set(ids.map(String));
     let grew = true;
     while (grew) {
       grew = false;
-      for (const row of rows.values())
+      for (const row of rows2.values())
         if (row.parent !== null && out.has(String(row.parent)) && !out.has(String(row.id))) {
           out.add(String(row.id));
           grew = true;
         }
     }
-    return [...rows.values()].filter((r) => out.has(String(r.id))).map((r) => r.id);
+    return [...rows2.values()].filter((r) => out.has(String(r.id))).map((r) => r.id);
   }
   /**
    * Folders whose privacy follows this one: it and those inside, with their privacy now.
    * @internal
    */
   async subtree(id) {
-    const rows = await this.fresh();
-    return this.within(rows, [id]).map((f) => ({ id: f, private: this.privateIn(rows, f) }));
+    const rows2 = await this.fresh();
+    return this.within(rows2, [id]).map((f) => ({ id: f, private: this.privateIn(rows2, f) }));
   }
   /**
    * The privacy each folder of a subtree would have after a change to its top folder: made
@@ -3845,15 +3868,15 @@ var MediaFolders = class {
    * @internal
    */
   async privacyAfter(id, change) {
-    const rows = new Map(await this.fresh());
-    const row = rows.get(String(id));
+    const rows2 = new Map(await this.fresh());
+    const row = rows2.get(String(id));
     if (!row) return [];
-    rows.set(String(id), {
+    rows2.set(String(id), {
       ...row,
       ...change.private !== void 0 ? { private: change.private } : {},
       ...change.parent !== void 0 ? { parent: change.parent } : {}
     });
-    return this.within(rows, [id]).map((f) => ({ id: f, private: this.privateIn(rows, f) }));
+    return this.within(rows2, [id]).map((f) => ({ id: f, private: this.privateIn(rows2, f) }));
   }
   async keyed(key, scope = {}, create = true) {
     const find = async () => [...(await this.rows()).values()].find((r) => r.key === key && inScope(r.doc, scope));
@@ -3891,9 +3914,9 @@ var MediaFolders = class {
   /** Whether a file in `folder` is in the folder with this key, or below it. @internal */
   async inKeyed(key, folder, scope = {}) {
     if (folder === null) return false;
-    const rows = await this.rows();
-    const root = [...rows.values()].find((r) => r.key === key && inScope(r.doc, scope));
-    return !!root && this.within(rows, [root.id]).some((id) => String(id) === String(folder));
+    const rows2 = await this.rows();
+    const root = [...rows2.values()].find((r) => r.key === key && inScope(r.doc, scope));
+    return !!root && this.within(rows2, [root.id]).some((id) => String(id) === String(folder));
   }
   /** The user's level in a folder (`null`: the top level). */
   async level(user, id) {
@@ -3916,11 +3939,11 @@ var MediaFolders = class {
     if (!this.applies(user)) return true;
     if (operation === "create") return true;
     const need = RANK[needed(collection2, operation)];
-    const rows = await this.rows();
+    const rows2 = await this.rows();
     const allowed2 = [];
     let all = true;
-    for (const row of rows.values()) {
-      if (RANK[this.levelIn(rows, user.role, row.id)] >= need) allowed2.push(row.id);
+    for (const row of rows2.values()) {
+      if (RANK[this.levelIn(rows2, user.role, row.id)] >= need) allowed2.push(row.id);
       else all = false;
     }
     if (all) return true;
@@ -3948,12 +3971,12 @@ var MediaFolders = class {
    * @internal
    */
   async validate(data, self) {
-    const rows = await this.fresh();
+    const rows2 = await this.fresh();
     const name = typeof data.name === "string" ? data.name.trim() : "";
     const parent = data.parent ?? null;
     const errors = [];
     if (parent !== null && self !== void 0) {
-      let current = rows.get(String(parent));
+      let current = rows2.get(String(parent));
       const seen = /* @__PURE__ */ new Set();
       while (current && !seen.has(String(current.id))) {
         if (String(current.id) === String(self)) {
@@ -3961,10 +3984,10 @@ var MediaFolders = class {
           break;
         }
         seen.add(String(current.id));
-        current = current.parent === null ? void 0 : rows.get(String(current.parent));
+        current = current.parent === null ? void 0 : rows2.get(String(current.parent));
       }
     }
-    const taken = [...rows.values()].some(
+    const taken = [...rows2.values()].some(
       (row) => String(row.id) !== String(self) && String(row.parent) === String(parent) && row.name.trim().toLocaleLowerCase() === name.toLocaleLowerCase()
     );
     if (name && taken) errors.push({ field: "name", message: "is already used in this folder" });
@@ -4218,7 +4241,7 @@ var VersionStore = class {
   async latest(parent, docs) {
     const result = /* @__PURE__ */ new Map();
     if (docs.length === 0) return result;
-    const rows = await this.db.find({
+    const rows2 = await this.db.find({
       collection: VERSIONS,
       where: {
         and: [
@@ -4231,7 +4254,7 @@ var VersionStore = class {
       limit: 0,
       page: 1
     });
-    for (const row of rows.docs) result.set(String(row.doc), this.toVersion(row));
+    for (const row of rows2.docs) result.set(String(row.doc), this.toVersion(row));
     return result;
   }
   async list(parent, doc, limit, page) {
@@ -4256,24 +4279,24 @@ var VersionStore = class {
     return row ? this.toVersion(row) : null;
   }
   async deleteAll(parent, doc) {
-    const rows = await this.db.find({
+    const rows2 = await this.db.find({
       collection: VERSIONS,
       where: { and: this.of(parent, doc) },
       sort: [],
       limit: 0,
       page: 1
     });
-    for (const row of rows.docs) await this.db.delete({ collection: VERSIONS, id: row.id });
+    for (const row of rows2.docs) await this.db.delete({ collection: VERSIONS, id: row.id });
   }
   async prune(parent, doc, max) {
-    const rows = await this.db.find({
+    const rows2 = await this.db.find({
       collection: VERSIONS,
       where: { and: this.of(parent, doc) },
       sort: ["-id"],
       limit: 0,
       page: 1
     });
-    for (const row of rows.docs.slice(max)) {
+    for (const row of rows2.docs.slice(max)) {
       await this.db.delete({ collection: VERSIONS, id: row.id });
     }
   }
@@ -4847,12 +4870,12 @@ function toLocaleMaps(fields, input, current, locale) {
         locale
       );
     } else if (hasRows(field) && Array.isArray(value)) {
-      const rows = new Map(
+      const rows2 = new Map(
         (Array.isArray(previous) ? previous : []).filter(isPlainObject2).map((row) => [String(row.id), row])
       );
       result[field.name] = value.map((row) => {
         const fields2 = rowFields(field, row);
-        return fields2 && isPlainObject2(row) ? toLocaleMaps(fields2, row, rows.get(String(row.id)) ?? {}, locale) : row;
+        return fields2 && isPlainObject2(row) ? toLocaleMaps(fields2, row, rows2.get(String(row.id)) ?? {}, locale) : row;
       });
     }
   }
@@ -5272,13 +5295,13 @@ function embeddedIPv4(address) {
   return bytes ? bytes.slice(12).join(".") : void 0;
 }
 function ipv6Bytes(address) {
-  let text3 = address;
-  const tail = /(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(text3);
+  let text4 = address;
+  const tail = /(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(text4);
   if (tail) {
     const [a, b, c, d] = tail.slice(1).map(Number);
-    text3 = `${text3.slice(0, tail.index)}${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
+    text4 = `${text4.slice(0, tail.index)}${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
   }
-  const [head = "", rest] = text3.split("::");
+  const [head = "", rest] = text4.split("::");
   const left = head ? head.split(":") : [];
   const right = rest === void 0 ? [] : rest ? rest.split(":") : [];
   const groups = rest === void 0 ? left : [...left, ...Array(8 - left.length - right.length).fill("0"), ...right];
@@ -5476,7 +5499,7 @@ var GLOBAL = keys(
 );
 var CONTAINER_ADMIN = keys("icon order sidebar layout group");
 var COLLECTION_ADMIN = keys(
-  "icon order sidebar layout group editIn badge count empty list calendar ownerField confirmDelete"
+  "icon order sidebar layout group editIn badge count empty list calendar ownerField confirmDelete views export"
 );
 var FIELD_ADMIN = keys(
   "description width condition component after cell column allowCreate initialValue position filter"
@@ -5747,26 +5770,26 @@ function fieldsText(fields, data) {
 }
 function richText(node) {
   if (!node || typeof node !== "object") return "";
-  const { text: text3, content } = node;
-  if (typeof text3 === "string") return text3;
+  const { text: text4, content } = node;
+  if (typeof text4 === "string") return text4;
   if (!Array.isArray(content)) return "";
   const inline = content.some((child) => typeof child?.text === "string");
   return content.map(richText).filter(Boolean).join(inline ? "" : "\n");
 }
 function searchText(fields, doc, paths) {
-  const text3 = {};
+  const text4 = {};
   for (const path of paths) {
     const field = fieldAt(fields, path);
     let value = doc;
     for (const name of path.split("."))
       value = value && typeof value === "object" ? value[name] : void 0;
-    text3[path] = field ? textOf(field, value) : "";
+    text4[path] = field ? textOf(field, value) : "";
   }
-  return text3;
+  return text4;
 }
 var segmenter = new Intl.Segmenter(void 0, { granularity: "word" });
-function words(text3) {
-  return [...segmenter.segment(text3.normalize("NFC").toLowerCase())].filter((s) => s.isWordLike).map((s) => s.segment);
+function words(text4) {
+  return [...segmenter.segment(text4.normalize("NFC").toLowerCase())].filter((s) => s.isWordLike).map((s) => s.segment);
 }
 function memorySearch() {
   const entries = /* @__PURE__ */ new Map();
@@ -7207,7 +7230,26 @@ function validateLayout(layout, container, path, add) {
   nodes(layout, path, true);
 }
 function validateCollectionAdmin(admin, path, add) {
-  const { badge, count, empty } = admin;
+  const { badge, count, empty, views } = admin;
+  if (views !== void 0) {
+    if (!Array.isArray(views)) add(`${path}.views`, "must be an array");
+    const ids = /* @__PURE__ */ new Set();
+    for (const [i, raw] of (Array.isArray(views) ? views : []).entries()) {
+      const view = raw ?? {};
+      const at = `${path}.views[${i}]`;
+      if (typeof view.id !== "string" || !/^[a-z0-9][a-z0-9_-]*$/.test(view.id))
+        add(`${at}.id`, 'must be lowercase letters, digits, "-" or "_"', "e.g. id: 'to-review'");
+      else if (ids.has(view.id)) add(`${at}.id`, `duplicate view "${view.id}"`);
+      else ids.add(view.id);
+      if (!isLabel(view.label)) add(`${at}.label`, "must be a string or { en, th }");
+      if (view.where !== void 0 && (typeof view.where !== "object" || view.where === null || Array.isArray(view.where)))
+        add(`${at}.where`, "must be a where query", "e.g. { status: { equals: 'draft' } }");
+      if (view.pageSize !== void 0 && ![10, 25, 50, 100].includes(view.pageSize))
+        add(`${at}.pageSize`, "must be 10, 25, 50 or 100");
+      if (view.density !== void 0 && !["comfortable", "compact"].includes(view.density))
+        add(`${at}.density`, "must be 'comfortable' or 'compact'");
+    }
+  }
   if (badge !== void 0) {
     const b = badge ?? {};
     if (typeof b.where !== "object" || b.where === null || Array.isArray(b.where))
@@ -7217,6 +7259,8 @@ function validateCollectionAdmin(admin, path, add) {
   }
   if (count !== void 0 && typeof count !== "boolean")
     add(`${path}.count`, "must be true or false");
+  if (admin.export !== void 0 && typeof admin.export !== "boolean")
+    add(`${path}.export`, "must be true or false");
   if (empty !== void 0) {
     const e = empty ?? {};
     if (e.description !== void 0 && !isLabel(e.description))
@@ -7981,6 +8025,7 @@ async function resolveConfig(input) {
       ...config.rateLimit ? [rateLimitsCollection] : [],
       databaseBackupsCollection,
       bulkOperationsCollection,
+      savedViewsCollection,
       ...config.auth?.rbac ? [rolesCollection] : [],
       ...(config.auth?.providers?.length ?? 0) > 0 ? [userIdentitiesCollection] : [],
       ...config.audit ? [auditLogsCollection] : []
@@ -8101,7 +8146,7 @@ function cacheableResponse(request, body, status, headers, times, tags) {
 }
 
 // src/version.ts
-var VERSION = true ? "1.30.0" : "0.0.0-dev";
+var VERSION = true ? "1.31.0" : "0.0.0-dev";
 
 // src/telemetry.ts
 var DB_CALLS = /* @__PURE__ */ new Set([
@@ -9801,12 +9846,12 @@ var EasyCMS = class {
       if (asked !== void 0 && localization && !localization.locales.includes(asked))
         throw new QueryError(`Unknown locale "${asked}"`);
       const locale = localization ? asked ?? localization.defaultLocale ?? null : null;
-      const text3 = query.trim().slice(0, 200);
+      const text4 = query.trim().slice(0, 200);
       const empty = { hits: [], total: 0, page, limit, hasNextPage: false };
-      if (!text3 || collections.length === 0) return empty;
+      if (!text4 || collections.length === 0) return empty;
       const { collections: _, limit: __, page: ___, ...read2 } = options;
       const { hits, total } = await index.search(
-        { query: text3, collections, locale, limit, offset: (page - 1) * limit },
+        { query: text4, collections, locale, limit, offset: (page - 1) * limit },
         async (collection2, ids) => (await this.find(collection2, {
           ...read2,
           ...locale ? { locale } : {},
@@ -9960,13 +10005,13 @@ var EasyCMS = class {
     const { jobs } = this.config;
     if (jobs.length === 0) return { ran: 0, failed: 0 };
     const { docs } = await this.db.find({ collection: JOB_RUNS, sort: ["name"], limit: 0, page: 1 });
-    const rows = new Map(docs.map((row) => [String(row.name), row]));
+    const rows2 = new Map(docs.map((row) => [String(row.name), row]));
     let legacy;
     const stamp = now.toISOString();
     let ran = 0;
     let failed = 0;
     for (const job of jobs) {
-      const fresh = rows.has(job.name) ? await this.db.findById({ collection: JOB_RUNS, id: rows.get(job.name)?.id }) : null;
+      const fresh = rows2.has(job.name) ? await this.db.findById({ collection: JOB_RUNS, id: rows2.get(job.name)?.id }) : null;
       const row = fresh ?? void 0;
       if (row?.pausedAt) continue;
       const schedule = jobSchedule(job, row);
@@ -10350,7 +10395,7 @@ var EasyCMS = class {
       ...options.from !== void 0 ? { gte: options.from } : {},
       ...options.to !== void 0 ? { lt: options.to } : {}
     };
-    const rows = await this.db.find({
+    const rows2 = await this.db.find({
       collection: SCHEDULED_JOBS,
       where: {
         and: [
@@ -10385,7 +10430,7 @@ var EasyCMS = class {
       return result;
     };
     const jobs = [];
-    for (const row of rows.docs) {
+    for (const row of rows2.docs) {
       const parent = String(row.parent);
       if (!await may2(parent)) continue;
       const target = parent.startsWith("global:") ? { global: splitGlobalKey(parent.slice("global:".length)).slug } : { collection: parent };
@@ -10395,7 +10440,7 @@ var EasyCMS = class {
     return jobs;
   }
   async pendingJobs(parent, doc) {
-    const rows = await this.db.find({
+    const rows2 = await this.db.find({
       collection: SCHEDULED_JOBS,
       where: {
         and: [
@@ -10408,7 +10453,7 @@ var EasyCMS = class {
       limit: 0,
       page: 1
     });
-    return rows.docs.map(toJob);
+    return rows2.docs.map(toJob);
   }
   async removeJob(parent, doc, jobId) {
     const job = (await this.pendingJobs(parent, doc)).find((j) => String(j.id) === String(jobId));
@@ -11441,8 +11486,8 @@ function hasCalendarPage(config) {
 var text2 = (value) => typeof value === "string" && value !== "" ? value : null;
 async function adminJobs(cms, user) {
   const { config } = cms;
-  const rows = has(config, JOB_RUNS) ? (await cms.db.find({ collection: JOB_RUNS, sort: ["name"], limit: 0, page: 1 })).docs : [];
-  const byName = new Map(rows.map((row) => [String(row.name), row]));
+  const rows2 = has(config, JOB_RUNS) ? (await cms.db.find({ collection: JOB_RUNS, sort: ["name"], limit: 0, page: 1 })).docs : [];
+  const byName = new Map(rows2.map((row) => [String(row.name), row]));
   const jobs = config.jobs.map((job) => {
     const row = byName.get(job.name);
     const lastRunAt = text2(row?.lastRunAt);
@@ -11816,9 +11861,9 @@ var Roles = class {
   }
   async addMissing() {
     if (!this.enabled) return;
-    const rows = await this.rows();
-    const first = rows.length === 0;
-    const known = new Set(rows.map((r) => String(r.key)));
+    const rows2 = await this.rows();
+    const first = rows2.length === 0;
+    const known = new Set(rows2.map((r) => String(r.key)));
     for (const key of this.config.auth.roles) {
       if (known.has(key)) continue;
       try {
@@ -11876,15 +11921,15 @@ var Roles = class {
   // --- Settings → Roles ----------------------------------------------------
   async list() {
     await this.sync();
-    const rows = await this.rows();
+    const rows2 = await this.rows();
     const counts = /* @__PURE__ */ new Map();
-    for (const row of rows) {
+    for (const row of rows2) {
       counts.set(
         String(row.key),
         await this.db.count({ collection: USERS, where: { role: { equals: row.key } } })
       );
     }
-    const roles = rows.map((row) => this.toRole(row, counts.get(String(row.key)) ?? 0)).sort((a, b) => rank(a, this.config) - rank(b, this.config) || a.key.localeCompare(b.key));
+    const roles = rows2.map((row) => this.toRole(row, counts.get(String(row.key)) ?? 0)).sort((a, b) => rank(a, this.config) - rank(b, this.config) || a.key.localeCompare(b.key));
     const decided = roles.filter((r) => r.key !== "admin").map((r) => r.permissions);
     const seen = (group, slug2) => decided.some((p) => p[group]?.[slug2] !== void 0);
     return {
@@ -12261,9 +12306,9 @@ var PER_PAGE = 50;
 var collectionOf = (kind) => kind === "webhook" ? WEBHOOK_DELIVERIES : EMAIL_DELIVERIES;
 var exists = (cms, kind) => cms.config.collections.some((c) => c.slug === collectionOf(kind));
 var isDeliveryKind = (value) => value === "webhook" || value === "email";
-function parse3(text3) {
+function parse3(text4) {
   try {
-    const value = JSON.parse(String(text3 ?? ""));
+    const value = JSON.parse(String(text4 ?? ""));
     return typeof value === "object" && value !== null ? value : {};
   } catch {
     return {};
@@ -12445,7 +12490,7 @@ async function sendTestEmail(cms, user, to, locale) {
   const th = locale === "th" || locale !== "en" && cms.config.admin.locale === "th";
   const time = (/* @__PURE__ */ new Date()).toISOString();
   const subject = th ? `\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E17\u0E14\u0E2A\u0E2D\u0E1A\u0E08\u0E32\u0E01 ${site}` : `Test email from ${site}`;
-  const text3 = th ? `\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E19\u0E35\u0E49\u0E2A\u0E48\u0E07\u0E08\u0E32\u0E01\u0E2B\u0E19\u0E49\u0E32 \u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32 \u2192 \u0E2D\u0E35\u0E40\u0E21\u0E25 \u0E02\u0E2D\u0E07 ${site} \u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E17\u0E14\u0E2A\u0E2D\u0E1A\u0E01\u0E32\u0E23\u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32
+  const text4 = th ? `\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E19\u0E35\u0E49\u0E2A\u0E48\u0E07\u0E08\u0E32\u0E01\u0E2B\u0E19\u0E49\u0E32 \u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32 \u2192 \u0E2D\u0E35\u0E40\u0E21\u0E25 \u0E02\u0E2D\u0E07 ${site} \u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E17\u0E14\u0E2A\u0E2D\u0E1A\u0E01\u0E32\u0E23\u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32
 
 \u0E2A\u0E48\u0E07\u0E42\u0E14\u0E22: ${user.email}
 Adapter: ${adapter.name ?? "custom"}
@@ -12457,7 +12502,7 @@ Adapter: ${adapter.name ?? "custom"}
 From: ${from}
 Time: ${time}`;
   try {
-    await adapter.send({ to: address, subject, text: text3, from });
+    await adapter.send({ to: address, subject, text: text4, from });
     return logsOnly(cms) ? { ok: true, logged: true } : { ok: true };
   } catch (error) {
     return { ok: false, error: message(error) };
@@ -12647,6 +12692,8 @@ async function collection(cms, config, user, localized, roles, context) {
   if (config.admin?.empty) result.empty = JSON.parse(JSON.stringify(config.admin.empty));
   if (config.admin?.list?.tree) result.tree = config.admin.list.tree;
   if (config.admin?.list?.sort) result.defaultSort = config.admin.list.sort;
+  if (config.admin?.views?.length) result.views = JSON.parse(JSON.stringify(config.admin.views));
+  if (config.admin?.export === false) result.noExport = true;
   if (config.admin?.calendar) result.calendar = { ...config.admin.calendar };
   if (config.admin?.confirmDelete) result.confirmDelete = { ...config.admin.confirmDelete };
   const owner = cms.roles.ownerOf(config.slug);
@@ -12931,21 +12978,42 @@ async function readable(cms, c, who) {
     return false;
   }
 }
-async function adminCounts(cms, who) {
+var LIST_TOTAL_MAX = 1e4;
+var MENU_COUNTS_TTL = 3e4;
+var kept = /* @__PURE__ */ new WeakMap();
+async function adminCounts(cms, who, options = {}) {
+  const key = `${String(who.user.id)}:${who.user.apiKey ? "key" : "user"}:${JSON.stringify(who.context)}`;
+  const cache = kept.get(cms) ?? /* @__PURE__ */ new Map();
+  kept.set(cms, cache);
+  const now = Date.now();
+  const hit = cache.get(key);
+  if (hit && !options.fresh && now - hit.at < MENU_COUNTS_TTL) return hit.value;
   const counts = {};
   const badges = {};
+  const more = [];
   await Promise.all(
     listed(cms).map(async (c) => {
       const read2 = { ...who, overrideAccess: false, draft: true };
       try {
-        if (c.admin?.count !== false) counts[c.slug] = await cms.count(c.slug, read2);
+        if (c.admin?.count !== false) {
+          const total = await cms.count(c.slug, { ...read2, max: LIST_TOTAL_MAX });
+          counts[c.slug] = Math.min(total, LIST_TOTAL_MAX);
+          if (total > LIST_TOTAL_MAX) more.push(c.slug);
+        }
         if (c.admin?.badge)
-          badges[c.slug] = await cms.count(c.slug, { ...read2, where: c.admin.badge.where });
+          badges[c.slug] = await cms.count(c.slug, {
+            ...read2,
+            where: c.admin.badge.where,
+            max: LIST_TOTAL_MAX
+          });
       } catch {
       }
     })
   );
-  return { counts, badges };
+  const value = { counts, badges, more };
+  for (const [k, entry] of cache) if (now - entry.at >= MENU_COUNTS_TTL) cache.delete(k);
+  cache.set(key, { at: now, value });
+  return value;
 }
 async function adminSearch(cms, who, q, perCollection = 5) {
   const query = q.trim().slice(0, 100);
@@ -13076,6 +13144,182 @@ async function adminStatus(cms) {
   };
 }
 
+// src/rest/export-csv.ts
+var EXPORT_MAX = 1e5;
+var STEP = 500;
+var SYSTEM = {
+  id: "ID",
+  status: { en: "Status", th: "\u0E2A\u0E16\u0E32\u0E19\u0E30" },
+  createdAt: { en: "Created", th: "\u0E2A\u0E23\u0E49\u0E32\u0E07\u0E40\u0E21\u0E37\u0E48\u0E2D" },
+  updatedAt: { en: "Updated", th: "\u0E41\u0E01\u0E49\u0E44\u0E02\u0E40\u0E21\u0E37\u0E48\u0E2D" }
+};
+var text3 = (label, fallback, lang) => label === void 0 ? fallback : typeof label === "string" ? label : label[lang] ?? label.en ?? Object.values(label)[0] ?? fallback;
+function isoInZone(value, timeZone) {
+  const date = new Date(value);
+  if (!timeZone || Number.isNaN(date.getTime())) return value;
+  const parts = Object.fromEntries(
+    new Intl.DateTimeFormat("en-CA", {
+      timeZone,
+      year: "numeric",
+      month: "2-digit",
+      day: "2-digit",
+      hour: "2-digit",
+      minute: "2-digit",
+      second: "2-digit",
+      hourCycle: "h23"
+    }).formatToParts(date).map((p) => [p.type, p.value])
+  );
+  const local = `${parts.year}-${parts.month}-${parts.day}T${parts.hour}:${parts.minute}:${parts.second}`;
+  const offset = Math.round((Date.parse(`${local}Z`) - date.getTime()) / 6e4);
+  const sign3 = offset < 0 ? "-" : "+";
+  const abs = Math.abs(offset);
+  return `${local}${sign3}${String(Math.floor(abs / 60)).padStart(2, "0")}:${String(abs % 60).padStart(2, "0")}`;
+}
+function cellOf(cms, field, value, key, lang) {
+  if (value === null || value === void 0) return "";
+  const timeZone = cms.config.timeZone;
+  if (!field)
+    return key === "createdAt" || key === "updatedAt" ? isoInZone(String(value), timeZone) : value;
+  const titleOf = (slug2, doc) => {
+    if (!doc || typeof doc !== "object") return String(doc);
+    const d = doc;
+    if (slug2 === "media" && typeof d.url === "string") return d.url;
+    const collection2 = cms.config.collections.find((c) => c.slug === slug2);
+    const title = collection2?.useAsTitle ? d[collection2.useAsTitle] : void 0;
+    return typeof title === "string" && title !== "" ? title : String(d.id ?? "");
+  };
+  switch (field.type) {
+    case "date":
+      return isoInZone(String(value), timeZone);
+    case "boolean":
+      return value ? "true" : "false";
+    case "select": {
+      const label = (v) => {
+        const option = field.options.find((o) => (typeof o === "string" ? o : o.value) === v);
+        return option === void 0 || typeof option === "string" ? String(v) : text3(option.label, String(v), lang);
+      };
+      return Array.isArray(value) ? value.map(label).join("; ") : label(value);
+    }
+    case "richText":
+      return richText(value);
+    case "relationship":
+    case "upload": {
+      const one = (item) => {
+        if (isPolymorphic(field)) {
+          const pair = polymorphicValue(item);
+          if (!pair) return "";
+          const collection2 = cms.config.collections.find((c) => c.slug === pair.relationTo);
+          const name = text3(collection2?.labels?.singular, pair.relationTo, lang);
+          return `${name} \xB7 ${titleOf(pair.relationTo, pair.value)}`;
+        }
+        return titleOf(relationTargets(field)[0], item);
+      };
+      return Array.isArray(value) ? value.map(one).join("; ") : one(value);
+    }
+    default:
+      return value;
+  }
+}
+async function columnsOf(cms, config, asked, options) {
+  const rules = await cms.roles.fieldRules(options.user);
+  const read2 = new FieldAccessChecker(
+    "read",
+    { user: options.user, context: options.context },
+    rules
+  );
+  const readable3 = [];
+  for (const field of config.fields)
+    if (!field.hidden && field.name !== "password" && await read2.allows(field))
+      readable3.push(field);
+  const system2 = [...config.drafts ? ["status"] : [], "createdAt", "updatedAt"];
+  const of = (key) => {
+    const field = readable3.find((f) => f.name === key);
+    if (field) return { key, label: field.label ?? key, field };
+    return key in SYSTEM && (key !== "status" || config.drafts) ? { key, label: SYSTEM[key] } : void 0;
+  };
+  const keys2 = asked ?? [...readable3.map((f) => f.name), ...system2];
+  const columns = keys2.filter((k) => k !== "id").map(of).filter((c) => c !== void 0);
+  return [{ key: "id", label: SYSTEM.id }, ...columns];
+}
+async function exportCsv(cms, slug2, url, options) {
+  const config = cms.collection(slug2);
+  if (config.admin?.export === false)
+    throw new ForbiddenError("Export is turned off for this collection");
+  const q = url.searchParams;
+  const lang = q.get("lang") ?? "en";
+  const names = q.get("headers") === "names";
+  const columnsParam = q.get("columns");
+  const asked = columnsParam && columnsParam !== "all" ? columnsParam.split(",").filter(Boolean) : null;
+  const ids = q.get("ids")?.split(",").filter(Boolean);
+  const where = ids?.length ? { and: [...options.where ? [options.where] : [], { id: { in: ids } }] } : options.where;
+  const read2 = {
+    user: options.user,
+    context: options.context,
+    overrideAccess: false,
+    draft: options.draft,
+    ...options.locale ? { locale: options.locale } : {},
+    ...options.fallbackLocale === false ? { fallbackLocale: false } : {}
+  };
+  const total = await cms.count(slug2, { ...read2, ...where ? { where } : {}, max: EXPORT_MAX });
+  if (total > EXPORT_MAX)
+    throw new QueryError(
+      `More than ${EXPORT_MAX.toLocaleString("en")} documents match: filter the list further`
+    );
+  const columns = await columnsOf(cms, config, asked, options);
+  const header2 = columns.map((c) => names ? c.key : text3(c.label, c.key, lang));
+  await cms.audit.record({
+    action: "export",
+    target: slug2,
+    user: options.user,
+    detail: { rows: total, columns: columns.map((c) => c.key) }
+  });
+  const encoder = new TextEncoder();
+  let cursor = "";
+  const stream = new ReadableStream({
+    start(controller) {
+      controller.enqueue(encoder.encode(`\uFEFF${header2.map(csvCell).join(",")}\r
+`));
+    },
+    async pull(controller) {
+      if (cursor === null) {
+        controller.close();
+        return;
+      }
+      try {
+        const page = await cms.find(
+          slug2,
+          {
+            ...read2,
+            ...where ? { where } : {},
+            ...options.sort?.length ? { sort: options.sort } : {},
+            limit: STEP,
+            depth: 1,
+            cursor
+          }
+        );
+        const lines = page.docs.map(
+          (doc) => columns.map((c) => csvCell(cellOf(cms, c.field, doc[c.key], c.key, lang))).join(",")
+        );
+        if (lines.length) controller.enqueue(encoder.encode(`${lines.join("\r\n")}\r
+`));
+        cursor = page.nextCursor ?? null;
+        if (cursor === null) controller.close();
+      } catch (error) {
+        controller.error(error);
+      }
+    }
+  });
+  const day = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  return new Response(stream, {
+    headers: {
+      "content-type": "text/csv; charset=utf-8",
+      "content-disposition": `attachment; filename="${slug2}-${day}.csv"`,
+      "cache-control": "no-store",
+      "x-content-type-options": "nosniff"
+    }
+  });
+}
+
 // src/rest/filter-options.ts
 function fieldAt2(fields, path) {
   let current = fields;
@@ -13117,12 +13361,12 @@ async function blockSummaries(cms, user, body) {
     const summary = field.blocks.find((b) => b.slug === blockType)?.admin?.summary;
     if (typeof id !== "string" || typeof summary !== "function") continue;
     try {
-      const text3 = await summary({
+      const text4 = await summary({
         fields: fields && typeof fields === "object" ? fields : {},
         user,
         cms
       });
-      if (typeof text3 === "string") summaries[id] = text3;
+      if (typeof text4 === "string") summaries[id] = text4;
     } catch (error) {
       cms.logger.warn(`admin.summary of block "${String(blockType)}" failed: ${String(error)}`);
     }
@@ -13231,9 +13475,193 @@ function parseDepth(url) {
   return depth === void 0 ? {} : { depth };
 }
 
+// src/rest/saved-views.ts
+var MAX_OWN_VIEWS = 50;
+var MAX_STATE = 1e4;
+var QUERY_KEY = /^(where\[and\]\[\d+\]\[[^\]]+\]\[[a-z_]+\]|q|sort|scheduled|type|calendar)$/;
+var userKey = (user) => String(user.id);
+var stamps = () => {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  return { createdAt: now, updatedAt: now };
+};
+async function readable2(cms, slug2, who) {
+  if (INTERNAL_COLLECTIONS.has(slug2) || !cms.config.collections.some((c) => c.slug === slug2))
+    throw new NotFoundError("collections", slug2);
+  try {
+    await cms.count(slug2, { ...who, overrideAccess: false, where: { id: { exists: false } } });
+  } catch {
+    throw new ForbiddenError();
+  }
+}
+function cleanState(raw) {
+  const input = raw && typeof raw === "object" ? raw : {};
+  const query = {};
+  const rawQuery = input.query && typeof input.query === "object" ? input.query : {};
+  for (const [key, value] of Object.entries(rawQuery))
+    if (QUERY_KEY.test(key) && typeof value === "string") query[key] = value;
+  const columns = Array.isArray(input.columns) ? input.columns.filter((c) => typeof c === "string").slice(0, 50) : void 0;
+  const pageSize = [10, 25, 50, 100].includes(input.pageSize) ? input.pageSize : void 0;
+  const density = input.density === "compact" || input.density === "comfortable" ? input.density : void 0;
+  const state = {
+    query,
+    ...columns ? { columns } : {},
+    ...pageSize ? { pageSize } : {},
+    ...density ? { density } : {}
+  };
+  if (JSON.stringify(state).length > MAX_STATE)
+    throw new ValidationError(SAVED_VIEWS, [{ field: "state", message: "is too large" }]);
+  return state;
+}
+function toView(row, user) {
+  const mine2 = row.user === userKey(user);
+  return {
+    id: row.id,
+    name: String(row.name ?? ""),
+    shared: row.shared === true,
+    mine: mine2,
+    editable: mine2 || row.shared === true && isSystemAdmin(user),
+    state: cleanState(row.state)
+  };
+}
+async function rows(cms, slug2, where) {
+  const found = await cms.db.find({
+    collection: SAVED_VIEWS,
+    where: { and: [{ collection: { equals: slug2 } }, where] },
+    sort: ["id"],
+    limit: 0,
+    page: 1
+  });
+  return found.docs;
+}
+async function listViews(cms, slug2, who) {
+  await readable2(cms, slug2, who);
+  const key = userKey(who.user);
+  const found = await rows(cms, slug2, {
+    or: [
+      { and: [{ kind: { equals: "view" } }, { shared: { equals: true } }] },
+      { user: { equals: key } }
+    ]
+  });
+  const views = found.filter((r) => r.kind === "view").map((r) => toView(r, who.user));
+  const preference = found.find((r) => r.kind === "default" && r.user === key);
+  return {
+    views: [...views.filter((v) => v.shared), ...views.filter((v) => !v.shared)],
+    default: typeof preference?.target === "string" ? preference.target : null
+  };
+}
+function checkName(name) {
+  const trimmed = typeof name === "string" ? name.trim() : "";
+  if (trimmed === "" || trimmed.length > 60)
+    throw new ValidationError(SAVED_VIEWS, [
+      { field: "name", message: "must be 1 to 60 characters" }
+    ]);
+  return trimmed;
+}
+async function checkUnique(cms, slug2, who, name, shared, self) {
+  const same = await rows(cms, slug2, {
+    and: [
+      { kind: { equals: "view" } },
+      { name: { equals: name } },
+      shared ? { shared: { equals: true } } : { user: { equals: userKey(who.user) } }
+    ]
+  });
+  if (same.some((r) => r.id !== self && (shared || r.shared !== true)))
+    throw new ValidationError(SAVED_VIEWS, [
+      { field: "name", message: `there is already a view named "${name}"` }
+    ]);
+}
+async function createView(cms, slug2, who, body) {
+  await readable2(cms, slug2, who);
+  const input = body ?? {};
+  const name = checkName(input.name);
+  const shared = input.shared === true;
+  await checkUnique(cms, slug2, who, name, shared);
+  const own = await rows(cms, slug2, {
+    and: [{ kind: { equals: "view" } }, { user: { equals: userKey(who.user) } }]
+  });
+  if (own.length >= MAX_OWN_VIEWS)
+    throw new ValidationError(SAVED_VIEWS, [
+      { field: "name", message: `at most ${MAX_OWN_VIEWS} views per list` }
+    ]);
+  const row = await cms.db.create({
+    collection: SAVED_VIEWS,
+    data: {
+      collection: slug2,
+      user: userKey(who.user),
+      kind: "view",
+      name,
+      shared,
+      state: cleanState(input.state),
+      target: null,
+      ...stamps()
+    }
+  });
+  return toView(row, who.user);
+}
+async function editable(cms, slug2, who, id) {
+  await readable2(cms, slug2, who);
+  const row = await cms.db.findById({ collection: SAVED_VIEWS, id });
+  if (!row || row.collection !== slug2 || row.kind !== "view")
+    throw new NotFoundError(SAVED_VIEWS, id);
+  const view = toView(row, who.user);
+  if (!view.mine && !view.shared) throw new NotFoundError(SAVED_VIEWS, id);
+  if (!view.editable) throw new ForbiddenError("Only its owner or an admin can change this view");
+  return row;
+}
+async function updateView(cms, slug2, who, id, body) {
+  const row = await editable(cms, slug2, who, id);
+  const input = body ?? {};
+  const name = input.name === void 0 ? String(row.name) : checkName(input.name);
+  const shared = input.shared === void 0 ? row.shared === true : input.shared === true;
+  if (name !== row.name || shared !== (row.shared === true))
+    await checkUnique(cms, slug2, who, name, shared, id);
+  const updated = await cms.db.update({
+    collection: SAVED_VIEWS,
+    id,
+    // The whole row, as the adapter writes it.
+    data: {
+      ...row,
+      name,
+      shared,
+      ...input.state !== void 0 ? { state: cleanState(input.state) } : {},
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  });
+  return toView(updated, who.user);
+}
+async function deleteView(cms, slug2, who, id) {
+  await editable(cms, slug2, who, id);
+  await cms.db.delete({ collection: SAVED_VIEWS, id });
+  return { deleted: 1 };
+}
+async function setDefaultView(cms, slug2, who, body) {
+  await readable2(cms, slug2, who);
+  const raw = body ?? {};
+  const target = raw.view === null || raw.view === void 0 ? null : String(raw.view);
+  const key = userKey(who.user);
+  const current = await rows(cms, slug2, {
+    and: [{ kind: { equals: "default" } }, { user: { equals: key } }]
+  });
+  for (const row of current) await cms.db.delete({ collection: SAVED_VIEWS, id: row.id });
+  if (target !== null)
+    await cms.db.create({
+      collection: SAVED_VIEWS,
+      data: {
+        collection: slug2,
+        user: key,
+        kind: "default",
+        name: null,
+        shared: false,
+        state: null,
+        target,
+        ...stamps()
+      }
+    });
+  return { default: target };
+}
+
 // src/rest/handler.ts
 var SCHEDULED_RANGE_LIMIT = 500;
-var LIST_TOTAL_MAX = 1e4;
 var CSRF_COOKIE = "ecms-csrf";
 var CSRF_HEADER = "x-csrf-token";
 var MAX_BODY_BYTES = 1024 * 1024;
@@ -13423,7 +13851,8 @@ var ADMIN_UI_ROUTES = /* @__PURE__ */ new Set([
   "media-usage",
   "owned",
   "sso",
-  "block-summaries"
+  "block-summaries",
+  "views"
 ]);
 var CORS_METHODS = "GET, HEAD, POST, PATCH, PUT, DELETE";
 var CORS_HEADERS = `authorization, content-type, ${CSRF_HEADER}`;
@@ -13800,6 +14229,27 @@ async function route(cms, ctx, method, path, options) {
     if (parsed === void 0) throw new HttpError("Not found", 404);
     return { body: await cms.roles.owned(parsed) };
   }
+  if (first === "admin" && second === "views" && third !== void 0 && segments.length <= 4) {
+    if (!ctx.user || ctx.user.apiKey) throw new UnauthorizedError();
+    const who = { user: ctx.user, context: ctx.context };
+    const fourth = segments[3];
+    if (fourth === void 0) {
+      if (method === "GET") return { body: await listViews(cms, third, who) };
+      if (method === "POST")
+        return { status: 201, body: await createView(cms, third, who, await readJson(ctx.request)) };
+      throw methodNotAllowed(ctx, "GET, POST");
+    }
+    if (fourth === "default") {
+      if (method !== "PUT") throw methodNotAllowed(ctx, "PUT");
+      return { body: await setDefaultView(cms, third, who, await readJson(ctx.request)) };
+    }
+    const id2 = parseId(fourth);
+    if (id2 === void 0) throw new HttpError("Not found", 404);
+    if (method === "PATCH")
+      return { body: await updateView(cms, third, who, id2, await readJson(ctx.request)) };
+    if (method === "DELETE") return { body: await deleteView(cms, third, who, id2) };
+    throw methodNotAllowed(ctx, "PATCH, DELETE");
+  }
   if (first === "admin" && second === "block-summaries" && third === void 0) {
     if (!ctx.user) throw new UnauthorizedError();
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
@@ -13948,7 +14398,14 @@ async function route(cms, ctx, method, path, options) {
     if (second === "schema" && third === void 0)
       return { body: await adminSchema(cms, ctx.user, ctx.url.origin, ctx.context) };
     if (second === "counts" && third === void 0)
-      return { body: await adminCounts(cms, { user: ctx.user, context: ctx.context }) };
+      return {
+        body: await adminCounts(
+          cms,
+          { user: ctx.user, context: ctx.context },
+          // `?fresh`: after creating or deleting, not the numbers kept for 30 s.
+          { fresh: ctx.url.searchParams.has("fresh") }
+        )
+      };
     if (second === "search" && third === void 0)
       return {
         body: {
@@ -14139,6 +14596,21 @@ async function route(cms, ctx, method, path, options) {
   if (INTERNAL_COLLECTIONS.has(collection2) || !cms.config.collections.some((c) => c.slug === collection2)) {
     throw new HttpError(`Unknown collection "${collection2}"`, 404);
   }
+  if (second === "export.csv" && third === void 0) {
+    if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+    if (!ctx.user) throw new UnauthorizedError();
+    const { where, sort } = parseListQuery(ctx.url);
+    return {
+      body: await exportCsv(cms, collection2, ctx.url, {
+        user: ctx.user,
+        context: ctx.context,
+        ...parseLocale(ctx.url),
+        draft,
+        ...where ? { where } : {},
+        ...sort ? { sort } : {}
+      })
+    };
+  }
   if (second === "bulk") return bulkRoute(cms, ctx, method, collection2, segments.slice(2), access);
   if (second !== void 0 && third !== void 0) {
     return documentAction(cms, ctx, method, collection2, second, segments.slice(2));
@@ -14596,10 +15068,10 @@ async function readJson(request) {
   if (!type.toLowerCase().startsWith("application/json")) {
     throw new HttpError("Content-Type must be application/json", 415);
   }
-  const text3 = new TextDecoder().decode(await readBody(request, MAX_BODY_BYTES));
+  const text4 = new TextDecoder().decode(await readBody(request, MAX_BODY_BYTES));
   let body;
   try {
-    body = JSON.parse(text3);
+    body = JSON.parse(text4);
   } catch {
     throw new HttpError("Request body is not valid JSON", 400);
   }