@momentumcms/server-analog 0.5.0 → 0.5.2

package/index.cjs

@@ -317,7 +317,7 @@ function detectMimeType(buffer) {
     if (match) {
       if (sig.bytes[0] === 82 && sig.bytes[1] === 73) {
         if (buffer.length >= 12) {
-          const formatId = buffer.slice(8, 12).toString("ascii");
+          const formatId = String.fromCharCode(...buffer.subarray(8, 12));
           if (formatId === "WEBP") {
             return "image/webp";
           }
@@ -330,7 +330,7 @@ function detectMimeType(buffer) {
         }
       }
       if (sig.mimeType === "video/mp4" && buffer.length >= 8) {
-        const boxType = buffer.slice(4, 8).toString("ascii");
+        const boxType = String.fromCharCode(...buffer.subarray(4, 8));
         if (boxType === "ftyp") {
           return "video/mp4";
         }
@@ -339,7 +339,7 @@ function detectMimeType(buffer) {
     }
   }
   if (isTextContent(buffer)) {
-    const text2 = buffer.toString("utf8", 0, Math.min(buffer.length, 1e3));
+    const text2 = new TextDecoder().decode(buffer.subarray(0, Math.min(buffer.length, 1e3)));
     if (text2.trim().startsWith("{") || text2.trim().startsWith("[")) {
       return "application/json";
     }
@@ -531,6 +531,383 @@ var init_src = __esm({
   }
 });
 
+// libs/email/src/lib/utils/escape-html.ts
+function escapeHtml2(unsafe) {
+  return unsafe.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
+}
+var init_escape_html = __esm({
+  "libs/email/src/lib/utils/escape-html.ts"() {
+    "use strict";
+  }
+});
+
+// libs/email/src/lib/utils/css-inliner.ts
+function inlineCss(html) {
+  return (0, import_juice.default)(html, {
+    removeStyleTags: true,
+    preserveMediaQueries: true,
+    preserveFontFaces: true,
+    insertPreservedExtraCss: true
+  });
+}
+var import_juice;
+var init_css_inliner = __esm({
+  "libs/email/src/lib/utils/css-inliner.ts"() {
+    "use strict";
+    import_juice = __toESM(require("juice"));
+  }
+});
+
+// libs/email/src/lib/utils/replace-variables.ts
+function replaceVariables(text2, variables) {
+  return text2.replace(/\{\{(\w+)\}\}/g, (_, key) => variables[key] ?? "");
+}
+function replaceBlockVariables(blocks2, variables) {
+  return blocks2.map((block) => ({
+    ...block,
+    data: replaceDataVariables(block.data, variables)
+  }));
+}
+function replaceDataVariables(data, variables) {
+  const result = {};
+  for (const [key, value] of Object.entries(data)) {
+    if (typeof value === "string") {
+      result[key] = replaceVariables(value, variables);
+    } else if (Array.isArray(value)) {
+      result[key] = value.map((item) => {
+        if (typeof item === "object" && item !== null && "blocks" in item) {
+          const col = item;
+          const nestedBlocks = Array.isArray(col["blocks"]) ? col["blocks"] : [];
+          return { ...col, blocks: replaceBlockVariables(nestedBlocks, variables) };
+        }
+        return item;
+      });
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+var init_replace_variables = __esm({
+  "libs/email/src/lib/utils/replace-variables.ts"() {
+    "use strict";
+  }
+});
+
+// libs/email/src/lib/utils/sanitize.ts
+function sanitizeAlignment(value) {
+  return VALID_ALIGNMENTS.has(value) ? value : "left";
+}
+function sanitizeCssValue(value) {
+  return value.replace(/[;{}()"'<>\\]/g, "");
+}
+function sanitizeFontFamily(value) {
+  return value.replace(/[;{}()"<>\\]/g, "");
+}
+function sanitizeCssNumber(value, fallback) {
+  if (value === null || value === void 0)
+    return String(fallback);
+  const num = Number(value);
+  return Number.isFinite(num) && num >= 0 ? String(num) : String(fallback);
+}
+function sanitizeUrl(url) {
+  const trimmed = url.trim();
+  if (!trimmed || trimmed === "#")
+    return trimmed || "#";
+  try {
+    const parsed = new URL(trimmed);
+    return SAFE_URL_PROTOCOLS.has(parsed.protocol) ? trimmed : "#";
+  } catch {
+    if (trimmed.startsWith("/") || trimmed.startsWith("#"))
+      return trimmed;
+    return "#";
+  }
+}
+var VALID_ALIGNMENTS, SAFE_URL_PROTOCOLS;
+var init_sanitize = __esm({
+  "libs/email/src/lib/utils/sanitize.ts"() {
+    "use strict";
+    VALID_ALIGNMENTS = /* @__PURE__ */ new Set(["left", "center", "right"]);
+    SAFE_URL_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:"]);
+  }
+});
+
+// libs/email/src/types.ts
+var DEFAULT_EMAIL_THEME;
+var init_types = __esm({
+  "libs/email/src/types.ts"() {
+    "use strict";
+    DEFAULT_EMAIL_THEME = {
+      primaryColor: "#18181b",
+      backgroundColor: "#f4f4f5",
+      textColor: "#3f3f46",
+      mutedColor: "#71717a",
+      fontFamily: "-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif",
+      borderRadius: "8px"
+    };
+  }
+});
+
+// libs/email/src/lib/render/render-blocks.ts
+function renderEmailFromBlocks(template, options) {
+  const theme = { ...DEFAULT_EMAIL_THEME, ...template.theme };
+  const shouldInline = options?.inlineCss ?? true;
+  const blocks2 = options?.variables ? replaceBlockVariables(template.blocks, options.variables) : template.blocks;
+  const validBlocks = blocks2.filter((block) => {
+    if (!isValidBlock(block)) {
+      console.warn("[momentum:email] Skipping invalid email block:", block);
+      return false;
+    }
+    return true;
+  });
+  const blocksHtml = validBlocks.map((block) => renderBlock(block, theme, 0)).join("\n");
+  let html = wrapEmailDocument(blocksHtml, theme);
+  if (shouldInline) {
+    html = inlineCss(html);
+  }
+  return html;
+}
+function wrapEmailDocument(content, theme) {
+  const fontFamily = sanitizeFontFamily(theme.fontFamily);
+  const bgColor = sanitizeCssValue(theme.backgroundColor);
+  const borderRadius = sanitizeCssValue(theme.borderRadius);
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+</head>
+<body style="margin: 0; padding: 0; font-family: ${fontFamily}; background-color: ${bgColor}; line-height: 1.6;">
+  <table role="presentation" width="100%" cellspacing="0" cellpadding="0" style="background-color: ${bgColor};">
+    <tr>
+      <td style="padding: 40px 20px;">
+        <table role="presentation" width="100%" cellspacing="0" cellpadding="0" style="max-width: 480px; margin: 0 auto; background-color: #ffffff; border-radius: ${borderRadius}; box-shadow: 0 1px 3px rgba(0,0,0,0.1);">
+          <tr>
+            <td style="padding: 40px;">
+              ${content}
+            </td>
+          </tr>
+        </table>
+      </td>
+    </tr>
+  </table>
+</body>
+</html>`;
+}
+function isValidBlock(block) {
+  const rec = block;
+  return typeof block === "object" && block !== null && typeof rec["id"] === "string" && rec["id"].length > 0 && typeof rec["type"] === "string" && typeof rec["data"] === "object" && rec["data"] !== null;
+}
+function renderBlock(block, theme, depth) {
+  switch (block.type) {
+    case "header":
+      return renderHeaderBlock(block.data, theme);
+    case "text":
+      return renderTextBlock(block.data, theme);
+    case "button":
+      return renderButtonBlock(block.data, theme);
+    case "image":
+      return renderImageBlock(block.data);
+    case "divider":
+      return renderDividerBlock(block.data);
+    case "spacer":
+      return renderSpacerBlock(block.data);
+    case "columns":
+      if (depth >= MAX_BLOCK_DEPTH) {
+        console.warn("[momentum:email] Max nesting depth reached, skipping columns block");
+        return "";
+      }
+      return renderColumnsBlock(block.data, theme, depth);
+    case "footer":
+      return renderFooterBlock(block.data, theme);
+    default:
+      return `<!-- unknown block type: ${escapeHtml2(block.type)} -->`;
+  }
+}
+function renderHeaderBlock(data, theme) {
+  const title = escapeHtml2(String(data["title"] ?? ""));
+  const subtitle = data["subtitle"] ? escapeHtml2(String(data["subtitle"])) : "";
+  const alignment = sanitizeAlignment(String(data["alignment"] ?? "left"));
+  return `<h1 style="margin: 0 0 8px; font-size: 24px; font-weight: 600; color: ${sanitizeCssValue(theme.textColor)}; text-align: ${alignment};">${title}</h1>${subtitle ? `<p style="margin: 0 0 16px; font-size: 16px; color: ${sanitizeCssValue(theme.mutedColor)}; text-align: ${alignment};">${subtitle}</p>` : ""}`;
+}
+function renderTextBlock(data, theme) {
+  const content = escapeHtml2(String(data["content"] ?? ""));
+  const fontSize = sanitizeCssNumber(data["fontSize"], 16);
+  const color = sanitizeCssValue(String(data["color"] ?? theme.textColor));
+  const alignment = sanitizeAlignment(String(data["alignment"] ?? "left"));
+  return `<p style="margin: 0 0 16px; font-size: ${fontSize}px; color: ${color}; text-align: ${alignment}; line-height: 1.6;">${content}</p>`;
+}
+function renderButtonBlock(data, theme) {
+  const label = escapeHtml2(String(data["label"] ?? "Click here"));
+  const href = escapeHtml2(sanitizeUrl(String(data["href"] ?? "#")));
+  const bgColor = sanitizeCssValue(String(data["backgroundColor"] ?? theme.primaryColor));
+  const color = sanitizeCssValue(String(data["color"] ?? "#ffffff"));
+  const alignment = sanitizeAlignment(String(data["alignment"] ?? "left"));
+  return `<table role="presentation" width="100%" cellspacing="0" cellpadding="0">
+  <tr>
+    <td style="padding: 0 0 16px;" align="${alignment}">
+      <a href="${href}" style="display: inline-block; padding: 12px 24px; background-color: ${bgColor}; color: ${color}; text-decoration: none; border-radius: 6px; font-weight: 500; font-size: 16px;">${label}</a>
+    </td>
+  </tr>
+</table>`;
+}
+function renderImageBlock(data) {
+  const rawSrc = String(data["src"] ?? "").trim();
+  if (!rawSrc)
+    return "<!-- image block: no src configured -->";
+  const src = escapeHtml2(sanitizeUrl(rawSrc));
+  const alt = escapeHtml2(String(data["alt"] ?? ""));
+  const width = sanitizeCssValue(String(data["width"] ?? "100%"));
+  const img = `<img src="${src}" alt="${alt}" width="${width}" style="display: block; max-width: 100%; height: auto; border: 0;">`;
+  if (data["href"]) {
+    const href = escapeHtml2(sanitizeUrl(String(data["href"])));
+    return `<a href="${href}" style="display: block;">${img}</a>`;
+  }
+  return img;
+}
+function renderDividerBlock(data) {
+  const color = sanitizeCssValue(String(data["color"] ?? "#e4e4e7"));
+  const margin = sanitizeCssValue(String(data["margin"] ?? "24px 0"));
+  return `<hr style="border: none; border-top: 1px solid ${color}; margin: ${margin};">`;
+}
+function renderSpacerBlock(data) {
+  const height = sanitizeCssNumber(data["height"], 24);
+  return `<div style="height: ${height}px; line-height: ${height}px; font-size: 1px;">&nbsp;</div>`;
+}
+function renderColumnsBlock(data, theme, depth) {
+  const rawColumns = data["columns"];
+  const columns = Array.isArray(rawColumns) ? rawColumns : [];
+  const width = Math.floor(100 / (columns.length || 1));
+  const tds = columns.map((col) => {
+    const colObj = (
+      // eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- narrowing unknown column objects
+      typeof col === "object" && col !== null ? col : {}
+    );
+    const rawBlocks = colObj["blocks"];
+    const colContent = (Array.isArray(rawBlocks) ? rawBlocks : []).filter(isValidBlock).map((b) => renderBlock(b, theme, depth + 1)).join("\n");
+    return `<td style="width: ${width}%; vertical-align: top; padding: 0 8px;">${colContent}</td>`;
+  }).join("\n");
+  return `<table role="presentation" width="100%" cellspacing="0" cellpadding="0"><tr>${tds}</tr></table>`;
+}
+function renderFooterBlock(data, theme) {
+  const text2 = escapeHtml2(String(data["text"] ?? ""));
+  const color = sanitizeCssValue(String(data["color"] ?? theme.mutedColor));
+  return `<p style="margin: 16px 0 0; font-size: 12px; color: ${color}; text-align: center;">${text2}</p>`;
+}
+var MAX_BLOCK_DEPTH;
+var init_render_blocks = __esm({
+  "libs/email/src/lib/render/render-blocks.ts"() {
+    "use strict";
+    init_escape_html();
+    init_css_inliner();
+    init_replace_variables();
+    init_sanitize();
+    init_types();
+    MAX_BLOCK_DEPTH = 5;
+  }
+});
+
+// libs/email/src/lib/utils/blocks-to-plain-text.ts
+function blocksToPlainText(blocks2, depth = 0) {
+  const lines = [];
+  for (const block of blocks2) {
+    const text2 = blockToText(block, depth);
+    if (text2) {
+      lines.push(text2);
+    }
+  }
+  return lines.join("\n\n");
+}
+function blockToText(block, depth) {
+  switch (block.type) {
+    case "header":
+      return headerToText(block.data);
+    case "text":
+      return String(block.data["content"] ?? "");
+    case "button":
+      return buttonToText(block.data);
+    case "footer":
+      return String(block.data["text"] ?? "");
+    case "columns":
+      if (depth >= MAX_BLOCK_DEPTH2) {
+        console.warn("[momentum:email] Max nesting depth reached, skipping columns block");
+        return "";
+      }
+      return columnsToText(block.data, depth);
+    case "divider":
+    case "spacer":
+    case "image":
+      return "";
+    default:
+      return "";
+  }
+}
+function headerToText(data) {
+  const title = String(data["title"] ?? "");
+  const subtitle = data["subtitle"] ? String(data["subtitle"]) : "";
+  if (!title && !subtitle)
+    return "";
+  if (!subtitle)
+    return title;
+  return `${title}
+${subtitle}`;
+}
+function buttonToText(data) {
+  const label = String(data["label"] ?? "");
+  const href = data["href"] ? String(data["href"]) : "";
+  if (!label)
+    return "";
+  if (!href)
+    return label;
+  return `${label}: ${href}`;
+}
+function columnsToText(data, depth) {
+  const columns = data["columns"];
+  if (!Array.isArray(columns))
+    return "";
+  const parts = [];
+  for (const col of columns) {
+    if (col && typeof col === "object" && Array.isArray(col.blocks)) {
+      const colText = blocksToPlainText(col.blocks, depth + 1);
+      if (colText) {
+        parts.push(colText);
+      }
+    }
+  }
+  return parts.join("\n\n");
+}
+var MAX_BLOCK_DEPTH2;
+var init_blocks_to_plain_text = __esm({
+  "libs/email/src/lib/utils/blocks-to-plain-text.ts"() {
+    "use strict";
+    MAX_BLOCK_DEPTH2 = 5;
+  }
+});
+
+// libs/email/src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  DEFAULT_EMAIL_THEME: () => DEFAULT_EMAIL_THEME,
+  blocksToPlainText: () => blocksToPlainText,
+  escapeHtml: () => escapeHtml2,
+  inlineCss: () => inlineCss,
+  isValidBlock: () => isValidBlock,
+  renderEmailFromBlocks: () => renderEmailFromBlocks,
+  replaceBlockVariables: () => replaceBlockVariables,
+  replaceVariables: () => replaceVariables
+});
+var init_server = __esm({
+  "libs/email/src/server.ts"() {
+    "use strict";
+    init_render_blocks();
+    init_replace_variables();
+    init_blocks_to_plain_text();
+    init_css_inliner();
+    init_escape_html();
+    init_types();
+  }
+});
+
 // libs/server-analog/src/index.ts
 var src_exports2 = {};
 __export(src_exports2, {
@@ -973,6 +1350,31 @@ function validateRowCount(name, label, count, minRows, maxRows, errors) {
 }
 
 // libs/core/src/lib/collections/media.collection.ts
+var validateFocalPoint = (value) => {
+  if (value === null || value === void 0)
+    return true;
+  if (typeof value !== "object" || Array.isArray(value)) {
+    return "Focal point must be an object with x and y coordinates";
+  }
+  const fp = Object.fromEntries(Object.entries(value));
+  if (!("x" in fp) || !("y" in fp)) {
+    return "Focal point must have both x and y properties";
+  }
+  const { x, y } = fp;
+  if (typeof x !== "number" || !Number.isFinite(x)) {
+    return "Focal point x must be a finite number";
+  }
+  if (typeof y !== "number" || !Number.isFinite(y)) {
+    return "Focal point y must be a finite number";
+  }
+  if (x < 0 || x > 1) {
+    return `Focal point x must be between 0 and 1 (received ${x})`;
+  }
+  if (y < 0 || y > 1) {
+    return `Focal point y must be between 0 and 1 (received ${y})`;
+  }
+  return true;
+};
 var MediaCollection = defineCollection({
   slug: "media",
   labels: {
@@ -1027,6 +1429,14 @@ var MediaCollection = defineCollection({
     json("focalPoint", {
       label: "Focal Point",
       description: "Focal point coordinates for image cropping",
+      validate: validateFocalPoint,
+      admin: {
+        hidden: true
+      }
+    }),
+    json("sizes", {
+      label: "Image Sizes",
+      description: "Generated image size variants",
       admin: {
         hidden: true
       }
@@ -1796,6 +2206,15 @@ function deepEqual(a, b) {
     (key) => Object.prototype.hasOwnProperty.call(bRec, key) && deepEqual(aRec[key], bRec[key])
   );
 }
+function stripTransientKeys(data) {
+  const result = {};
+  for (const [key, value] of Object.entries(data)) {
+    if (!key.startsWith("_")) {
+      result[key] = value;
+    }
+  }
+  return result;
+}
 function flattenWhereClause(where) {
   if (!where)
     return {};
@@ -1959,6 +2378,7 @@ var CollectionOperationsImpl = class _CollectionOperationsImpl {
       );
     }
     processedData = await this.runHooks("beforeChange", processedData, "create");
+    processedData = stripTransientKeys(processedData);
     const doc = await this.adapter.create(this.slug, processedData);
     await this.runHooks("afterChange", doc, "create");
     if (hasFieldHooks(this.collectionConfig.fields)) {
@@ -2019,6 +2439,7 @@ var CollectionOperationsImpl = class _CollectionOperationsImpl {
       );
     }
     processedData = await this.runHooks("beforeChange", processedData, "update", originalDoc);
+    processedData = stripTransientKeys(processedData);
     const doc = await this.adapter.update(this.slug, id, processedData);
     await this.runHooks("afterChange", doc, "update", originalDoc);
     if (hasFieldHooks(this.collectionConfig.fields)) {
@@ -3566,7 +3987,8 @@ async function handleUpload(config, request) {
       filesize: file.size,
       path: storedFile.path,
       url: storedFile.url,
-      alt: alt ?? ""
+      alt: alt ?? "",
+      _file: file
     };
     const api = getMomentumAPI().setContext({ user });
     const doc = await api.collection(collection).create(mediaData);
@@ -3633,7 +4055,8 @@ async function handleCollectionUpload(globalConfig, request) {
       mimeType: file.mimeType,
       filesize: file.size,
       path: storedFile.path,
-      url: storedFile.url
+      url: storedFile.url,
+      _file: file
     };
     const api = getMomentumAPI().setContext({ user });
     const doc = await api.collection(collectionSlug).create(docData);
@@ -3670,6 +4093,7 @@ function getMimeTypeFromPath(path) {
     png: "image/png",
     gif: "image/gif",
     webp: "image/webp",
+    avif: "image/avif",
     svg: "image/svg+xml",
     pdf: "application/pdf",
     json: "application/json",
@@ -4335,11 +4759,11 @@ SwaggerUIBundle({
 
 // libs/server-core/src/lib/preview-renderer.ts
 function renderPreviewHTML(options) {
-  const { doc, collection } = options;
+  const { doc, collection, customFieldRenderers } = options;
   const titleField = collection.admin?.useAsTitle ?? "id";
   const title = escapeHtml(String(doc[titleField] ?? doc["id"] ?? "Untitled"));
   const fields = collection.fields ?? [];
-  const fieldHtml = fields.filter((f) => !isHiddenField(f) && !isLayoutField(f) && f.name !== titleField).map((f) => renderField(f, doc)).filter(Boolean).join("\n");
+  const fieldHtml = fields.filter((f) => !isHiddenField(f) && !isLayoutField(f) && f.name !== titleField).map((f) => renderField(f, doc, customFieldRenderers)).filter(Boolean).join("\n");
   const richTextFields = fields.filter((f) => f.type === "richText").map((f) => f.name);
   return `<!DOCTYPE html>
 <html lang="en">
@@ -4373,6 +4797,7 @@ ${fieldHtml}
 (function(){
 var richTextFields=${JSON.stringify(richTextFields)};
 window.addEventListener('message',function(e){
+if(e.origin!==window.location.origin)return;
 if(!e.data||e.data.type!=='momentum-preview-update')return;
 var d=e.data.data;if(!d)return;
 document.querySelectorAll('[data-field]').forEach(function(el){
@@ -4393,16 +4818,20 @@ if(titleEl){var tf=titleEl.getAttribute('data-field');if(d[tf]!==undefined)title
 </body>
 </html>`;
 }
-function renderField(field, doc) {
+function renderField(field, doc, customRenderers) {
   const value = doc[field.name];
   if (value === void 0 || value === null) {
     return renderFieldWrapper(field, "");
   }
+  const editorKey = field.admin?.editor;
+  if (editorKey && customRenderers?.[editorKey]) {
+    return renderFieldWrapper(field, customRenderers[editorKey](value, field));
+  }
   switch (field.type) {
     case "richText":
       return renderFieldWrapper(
         field,
-        `<div class="field-value rich-text" data-field="${escapeHtml(field.name)}">${String(value)}</div>`
+        `<div class="field-value rich-text" data-field="${escapeHtml(field.name)}">${escapeHtml(String(value))}</div>`
       );
     case "checkbox":
       return renderFieldWrapper(
@@ -4733,6 +5162,20 @@ function coerceCsvValue(value, fieldType) {
 }
 
 // libs/server-analog/src/lib/server-analog.ts
+function getEmailBuilderFieldName(collection) {
+  const field = collection.fields.find(
+    (f) => f.type === "json" && f.admin?.editor === "email-builder"
+  );
+  return field?.name;
+}
+async function renderEmailPreviewHTML(doc, blocksFieldName) {
+  const { renderEmailFromBlocks: renderEmailFromBlocks2 } = await Promise.resolve().then(() => (init_server(), server_exports));
+  const blocks2 = doc[blocksFieldName];
+  if (!Array.isArray(blocks2) || blocks2.length === 0) {
+    return '<html><body style="display:flex;align-items:center;justify-content:center;min-height:100vh;color:#666;font-family:sans-serif"><p>No email blocks yet.</p></body></html>';
+  }
+  return renderEmailFromBlocks2({ blocks: blocks2 });
+}
 function nestBracketParams(flat) {
   const result = {};
   for (const [key, value] of Object.entries(flat)) {
@@ -5320,6 +5763,63 @@ function createComprehensiveMomentumHandler(config) {
         }
       }
     }
+    if (seg2 === "preview" && seg1 && (method === "GET" || method === "POST")) {
+      if (!user) {
+        utils.setResponseStatus(event, 401);
+        return { error: "Authentication required to access preview" };
+      }
+      try {
+        const collectionSlug2 = seg0;
+        const docId = seg1;
+        const collectionConfig = config.collections.find((c) => c.slug === collectionSlug2);
+        if (!collectionConfig) {
+          utils.setResponseStatus(event, 404);
+          return { error: "Collection not found" };
+        }
+        const accessFn = collectionConfig.access?.read;
+        if (accessFn) {
+          const allowed = await Promise.resolve(accessFn({ req: { user } }));
+          if (!allowed) {
+            utils.setResponseStatus(event, 403);
+            return { error: "Access denied" };
+          }
+        }
+        let docRecord;
+        if (method === "POST") {
+          const body2 = await safeReadBody(event, utils, method);
+          if (body2["data"] && typeof body2["data"] === "object") {
+            docRecord = body2["data"];
+          } else {
+            utils.setResponseStatus(event, 400);
+            return { error: "POST preview requires { data: ... } body" };
+          }
+        } else {
+          const contextApi = getContextualAPI(user);
+          const doc = await contextApi.collection(collectionSlug2).findById(docId);
+          if (!doc) {
+            utils.setResponseStatus(event, 404);
+            return { error: "Document not found" };
+          }
+          docRecord = doc;
+        }
+        const emailField = getEmailBuilderFieldName(collectionConfig);
+        const html = emailField ? await renderEmailPreviewHTML(docRecord, emailField) : renderPreviewHTML({ doc: docRecord, collection: collectionConfig });
+        utils.setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
+        return utils.send(event, html);
+      } catch (error) {
+        const message = sanitizeErrorMessage(error, "Unknown error");
+        if (message.includes("Access denied")) {
+          utils.setResponseStatus(event, 403);
+          return { error: message };
+        }
+        if (message.includes("not found")) {
+          utils.setResponseStatus(event, 404);
+          return { error: message };
+        }
+        utils.setResponseStatus(event, 500);
+        return { error: "Preview failed", message };
+      }
+    }
     if (seg1 && seg2 && method === "POST") {
       const collectionSlug2 = seg0;
       const docId = seg1;
@@ -5417,42 +5917,6 @@ function createComprehensiveMomentumHandler(config) {
         };
       }
     }
-    if (seg2 === "preview" && seg1 && method === "GET") {
-      try {
-        const collectionSlug2 = seg0;
-        const docId = seg1;
-        const contextApi = getContextualAPI(user);
-        const doc = await contextApi.collection(collectionSlug2).findById(docId);
-        if (!doc) {
-          utils.setResponseStatus(event, 404);
-          return { error: "Document not found" };
-        }
-        const collectionConfig = config.collections.find((c) => c.slug === collectionSlug2);
-        if (!collectionConfig) {
-          utils.setResponseStatus(event, 404);
-          return { error: "Collection not found" };
-        }
-        const html = renderPreviewHTML({
-          // eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- doc type from API
-          doc,
-          collection: collectionConfig
-        });
-        utils.setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
-        return utils.send(event, html);
-      } catch (error) {
-        const message = sanitizeErrorMessage(error, "Unknown error");
-        if (message.includes("Access denied")) {
-          utils.setResponseStatus(event, 403);
-          return { error: message };
-        }
-        if (message.includes("not found")) {
-          utils.setResponseStatus(event, 404);
-          return { error: message };
-        }
-        utils.setResponseStatus(event, 500);
-        return { error: "Preview failed", message };
-      }
-    }
     if (seg0 && seg1 && !seg2) {
       const customKey = `${method}:${seg0}/${seg1}`;
       const customEntry = customEndpointMap.get(customKey);
@@ -5705,12 +6169,13 @@ function createComprehensiveMomentumHandler(config) {
           fields[field.name] = field.data.toString("utf-8");
         }
       }
+      const collectionUpload = postUploadCol.upload ?? {};
       const uploadRequest = {
         file,
         user,
         fields,
         collectionSlug: seg0,
-        collectionUpload: postUploadCol.upload
+        collectionUpload
       };
       const response2 = await handleCollectionUpload(uploadConfig, uploadRequest);
       utils.setResponseStatus(event, response2.status);