@revealui/core 0.10.2 → 0.11.1

package/README.md

@@ -74,9 +74,10 @@ const Posts: RevealUICollection = {
 ### Server-Side API
 
 ```typescript
-import { revealui } from '@revealui/core/server'
+import { getRevealUI } from '@revealui/core'
 
 // Create, read, update, delete
+const revealui = await getRevealUI({ config })
 const post = await revealui.create({ collection: 'posts', data: { title: 'Hello' } })
 const posts = await revealui.find({ collection: 'posts', where: { status: { equals: 'published' } } })
 ```
@@ -106,7 +107,8 @@ defineField({ name: 'body', type: 'richText' })
 ### Feature Gating
 
 ```typescript
-import { isLicensed, isFeatureEnabled } from '@revealui/core/features'
+import { isLicensed } from '@revealui/core/license'
+import { isFeatureEnabled } from '@revealui/core/features'
 
 if (isLicensed('pro')) {
   // Pro-tier feature

package/dist/client/admin/components/DocumentForm.js

@@ -177,12 +177,23 @@ function FieldInput({ field, value, onChange }) {
             return (_jsx("input", { type: "number", id: field.name, value: typeof value === 'number' ? value : value ? Number(value) : '', onChange: (e) => onChange(Number(e.target.value) || undefined), className: baseClasses, required: field.required, min: field.min, max: field.max }));
         case 'checkbox':
             return (_jsx("input", { type: "checkbox", id: field.name, checked: Boolean(value), onChange: (e) => onChange(e.target.checked), className: "h-4 w-4 text-primary focus:ring-ring border-input rounded" }));
-        case 'select':
-            return (_jsxs("select", { id: field.name, value: formatTextValue(value), onChange: (e) => onChange(e.target.value), className: baseClasses, required: field.required, children: [_jsx("option", { value: "", children: "Select an option" }), field.options?.map((option) => {
-                        const optValue = typeof option === 'string' ? option : option.value;
-                        const optLabel = typeof option === 'string' ? option : option.label;
-                        return (_jsx("option", { value: optValue, children: optLabel }, optValue));
-                    })] }));
+        case 'select': {
+            const isMulti = field.hasMany === true;
+            const selectClasses = `${baseClasses} text-foreground bg-card`;
+            const optionNodes = field.options?.map((option) => {
+                const optValue = typeof option === 'string' ? option : option.value;
+                const optLabel = typeof option === 'string' ? option : option.label;
+                return (_jsx("option", { value: optValue, children: optLabel }, optValue));
+            });
+            if (isMulti) {
+                const selected = Array.isArray(value) ? value : value ? [String(value)] : [];
+                return (_jsx("select", { id: field.name, multiple: true, value: selected, onChange: (e) => {
+                        const vals = Array.from(e.target.selectedOptions).map((o) => o.value);
+                        onChange(vals);
+                    }, className: `${selectClasses} h-32`, required: field.required, children: optionNodes }));
+            }
+            return (_jsxs("select", { id: field.name, value: formatTextValue(value), onChange: (e) => onChange(e.target.value), className: selectClasses, required: field.required, children: [_jsx("option", { value: "", children: "Select an option" }), optionNodes] }));
+        }
         case 'radio':
             return (_jsx("div", { className: "space-y-2 mt-1", children: field.options?.map((option) => {
                     const optValue = typeof option === 'string' ? option : option.value;

package/dist/client/richtext/RichTextEditor.d.ts

@@ -43,6 +43,6 @@ export interface RichTextEditorProps {
 export { FloatingToolbarPlugin } from './plugins/FloatingToolbarPlugin.js';
 export { ToolbarPlugin } from './plugins/ToolbarPlugin.js';
 export declare function RichTextEditor({ editorConfig, initialValue, onChange, onSerializedChange, placeholder, className, editable, autoFocus, onError, namespace, collaborative, documentId, providerFactory, shouldBootstrap, username, cursorColor, clientType, agentModel, }: RichTextEditorProps): import("react").JSX.Element;
-export declare const richTextEditorStyles = "\n.revealui-rich-text-editor {\n  border: 1px solid #e2e8f0;\n  border-radius: 8px;\n  overflow: hidden;\n  font-family: system-ui, -apple-system, sans-serif;\n}\n\n.editor-toolbar {\n  display: flex;\n  gap: 4px;\n  padding: 8px;\n  border-bottom: 1px solid #e2e8f0;\n  background: #f8fafc;\n}\n\n.editor-toolbar--floating {\n  border-bottom: none;\n  border: 1px solid #e2e8f0;\n  border-radius: 8px;\n  box-shadow: 0 4px 12px rgba(0, 0, 0, 0.15);\n  background: white;\n  padding: 6px;\n  transition: opacity 0.2s ease;\n}\n\n.toolbar-btn {\n  padding: 6px 10px;\n  border: 1px solid #e2e8f0;\n  border-radius: 4px;\n  background: white;\n  cursor: pointer;\n  font-size: 14px;\n  transition: all 0.15s ease;\n}\n\n.toolbar-btn:hover {\n  background: #f1f5f9;\n}\n\n.toolbar-btn.active {\n  background: #3b82f6;\n  color: white;\n  border-color: #3b82f6;\n}\n\n.editor-container {\n  position: relative;\n  min-height: 150px;\n}\n\n.editor-input {\n  padding: 16px;\n  outline: none;\n  min-height: 150px;\n}\n\n.editor-placeholder {\n  position: absolute;\n  top: 16px;\n  left: 16px;\n  color: #94a3b8;\n  pointer-events: none;\n  user-select: none;\n}\n\n.editor-paragraph {\n  margin: 0 0 8px 0;\n}\n\n.editor-heading-h1 { font-size: 2em; font-weight: bold; margin: 0 0 12px 0; }\n.editor-heading-h2 { font-size: 1.5em; font-weight: bold; margin: 0 0 10px 0; }\n.editor-heading-h3 { font-size: 1.25em; font-weight: bold; margin: 0 0 8px 0; }\n.editor-heading-h4 { font-size: 1em; font-weight: bold; margin: 0 0 8px 0; }\n.editor-heading-h5 { font-size: 0.875em; font-weight: bold; margin: 0 0 8px 0; }\n.editor-heading-h6 { font-size: 0.75em; font-weight: bold; margin: 0 0 8px 0; }\n\n.editor-quote {\n  border-left: 4px solid #e2e8f0;\n  padding-left: 16px;\n  margin: 0 0 8px 0;\n  color: #64748b;\n}\n\n.editor-list-ol { list-style: decimal; padding-left: 24px; margin: 0 0 8px 0; }\n.editor-list-ul { list-style: disc; padding-left: 24px; margin: 0 0 8px 0; }\n.editor-listitem { margin: 4px 0; }\n\n.editor-link { color: #3b82f6; text-decoration: underline; }\n\n.editor-text-bold { font-weight: bold; }\n.editor-text-italic { font-style: italic; }\n.editor-text-underline { text-decoration: underline; }\n.editor-text-strikethrough { text-decoration: line-through; }\n.editor-text-code {\n  background: #f1f5f9;\n  padding: 2px 4px;\n  border-radius: 4px;\n  font-family: monospace;\n}\n.editor-text-subscript { vertical-align: sub; font-size: smaller; }\n.editor-text-superscript { vertical-align: super; font-size: smaller; }\n\n.editor-code {\n  background: #1e293b;\n  color: #e2e8f0;\n  padding: 16px;\n  border-radius: 4px;\n  font-family: monospace;\n  overflow-x: auto;\n  margin: 8px 0;\n}\n\n.collab-cursors-container {\n  position: relative;\n  pointer-events: none;\n}\n\n.cursor-agent {\n  animation: cursor-agent-pulse 2s ease-in-out infinite;\n}\n\n@keyframes cursor-agent-pulse {\n  0%, 100% { opacity: 1; }\n  50% { opacity: 0.6; }\n}\n\n.cursor-inactive {\n  opacity: 0.2;\n  transition: opacity 1s ease-out;\n}\n";
+export declare const richTextEditorStyles = "\n.revealui-rich-text-editor {\n  border: 1px solid var(--rvui-border, #e2e8f0);\n  border-radius: 8px;\n  overflow: hidden;\n  font-family: system-ui, -apple-system, sans-serif;\n}\n\n.editor-toolbar {\n  display: flex;\n  gap: 4px;\n  padding: 8px;\n  border-bottom: 1px solid var(--rvui-border, #e2e8f0);\n  background: var(--rvui-surface-1, #f8fafc);\n}\n\n.editor-toolbar--floating {\n  border-bottom: none;\n  border: 1px solid var(--rvui-border, #e2e8f0);\n  border-radius: 8px;\n  box-shadow: 0 4px 12px rgba(0, 0, 0, 0.15);\n  background: white;\n  padding: 6px;\n  transition: opacity 0.2s ease;\n}\n\n.toolbar-btn {\n  padding: 6px 10px;\n  border: 1px solid var(--rvui-border, #e2e8f0);\n  border-radius: 4px;\n  background: white;\n  cursor: pointer;\n  font-size: 14px;\n  transition: all 0.15s ease;\n}\n\n.toolbar-btn:hover {\n  background: var(--rvui-surface-2, #f1f5f9);\n}\n\n.toolbar-btn.active {\n  background: var(--rvui-brand, #3b82f6);\n  color: white;\n  border-color: var(--rvui-brand, #3b82f6);\n}\n\n.editor-container {\n  position: relative;\n  min-height: 150px;\n}\n\n.editor-input {\n  padding: 16px;\n  outline: none;\n  min-height: 150px;\n}\n\n.editor-placeholder {\n  position: absolute;\n  top: 16px;\n  left: 16px;\n  color: var(--rvui-text-2, #94a3b8);\n  pointer-events: none;\n  user-select: none;\n}\n\n.editor-paragraph {\n  margin: 0 0 8px 0;\n}\n\n.editor-heading-h1 { font-size: 2em; font-weight: bold; margin: 0 0 12px 0; }\n.editor-heading-h2 { font-size: 1.5em; font-weight: bold; margin: 0 0 10px 0; }\n.editor-heading-h3 { font-size: 1.25em; font-weight: bold; margin: 0 0 8px 0; }\n.editor-heading-h4 { font-size: 1em; font-weight: bold; margin: 0 0 8px 0; }\n.editor-heading-h5 { font-size: 0.875em; font-weight: bold; margin: 0 0 8px 0; }\n.editor-heading-h6 { font-size: 0.75em; font-weight: bold; margin: 0 0 8px 0; }\n\n.editor-quote {\n  border-left: 4px solid var(--rvui-border, #e2e8f0);\n  padding-left: 16px;\n  margin: 0 0 8px 0;\n  color: var(--rvui-text-2, #64748b);\n}\n\n.editor-list-ol { list-style: decimal; padding-left: 24px; margin: 0 0 8px 0; }\n.editor-list-ul { list-style: disc; padding-left: 24px; margin: 0 0 8px 0; }\n.editor-listitem { margin: 4px 0; }\n\n.editor-link { color: var(--rvui-brand, #3b82f6); text-decoration: underline; }\n\n.editor-text-bold { font-weight: bold; }\n.editor-text-italic { font-style: italic; }\n.editor-text-underline { text-decoration: underline; }\n.editor-text-strikethrough { text-decoration: line-through; }\n.editor-text-code {\n  background: var(--rvui-surface-2, #f1f5f9);\n  padding: 2px 4px;\n  border-radius: 4px;\n  font-family: monospace;\n}\n.editor-text-subscript { vertical-align: sub; font-size: smaller; }\n.editor-text-superscript { vertical-align: super; font-size: smaller; }\n\n.editor-code {\n  background: var(--rvui-text-0, #1e293b);\n  color: var(--rvui-border, #e2e8f0);\n  padding: 16px;\n  border-radius: 4px;\n  font-family: monospace;\n  overflow-x: auto;\n  margin: 8px 0;\n}\n\n.collab-cursors-container {\n  position: relative;\n  pointer-events: none;\n}\n\n.cursor-agent {\n  animation: cursor-agent-pulse 2s ease-in-out infinite;\n}\n\n@keyframes cursor-agent-pulse {\n  0%, 100% { opacity: 1; }\n  50% { opacity: 0.6; }\n}\n\n.cursor-inactive {\n  opacity: 0.2;\n  transition: opacity 1s ease-out;\n}\n";
 export default RichTextEditor;
 //# sourceMappingURL=RichTextEditor.d.ts.map

package/dist/client/richtext/RichTextEditor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RichTextEditor.d.ts","sourceRoot":"","sources":["../../../src/client/richtext/RichTextEditor.tsx"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,KAAK,EACV,WAAW,EAEX,aAAa,EAEb,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAEjB,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,KAAK,EACV,cAAc,IAAI,oBAAoB,EAEvC,MAAM,yBAAyB,CAAC;AAWjC,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,8CAA8C;IAC9C,YAAY,CAAC,EAAE,qBAAqB,GAAG,MAAM,GAAG,IAAI,CAAC;IACrD,oCAAoC;IACpC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IAC/D,8CAA8C;IAC9C,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,IAAI,CAAC;IAC3D,uBAAuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,0BAA0B;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,2BAA2B;IAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IACxD,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,QAAQ,CAAC;IACxE,+DAA+D;IAC/D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC/B,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA+ID,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AA2B3D,wBAAgB,cAAc,CAAC,EAC7B,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,kBAAkB,EAClB,WAA+B,EAC/B,SAAc,EACd,QAAe,EACf,SAAiB,EACjB,OAAO,EACP,SAA4B,EAC5B,aAAqB,EACrB,UAAU,EACV,eAAe,EACf,eAAuB,EACvB,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,GACX,EAAE,mBAAmB,+BA+GrB;AAMD,eAAO,MAAM,oBAAoB,0+FAmIhC,CAAC;AAEF,eAAe,cAAc,CAAC"}
+{"version":3,"file":"RichTextEditor.d.ts","sourceRoot":"","sources":["../../../src/client/richtext/RichTextEditor.tsx"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,KAAK,EACV,WAAW,EAEX,aAAa,EAEb,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAEjB,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,KAAK,EACV,cAAc,IAAI,oBAAoB,EAEvC,MAAM,yBAAyB,CAAC;AAWjC,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,8CAA8C;IAC9C,YAAY,CAAC,EAAE,qBAAqB,GAAG,MAAM,GAAG,IAAI,CAAC;IACrD,oCAAoC;IACpC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IAC/D,8CAA8C;IAC9C,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,IAAI,CAAC;IAC3D,uBAAuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,0BAA0B;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,2BAA2B;IAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IACxD,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,QAAQ,CAAC;IACxE,+DAA+D;IAC/D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC/B,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA+ID,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AA2B3D,wBAAgB,cAAc,CAAC,EAC7B,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,kBAAkB,EAClB,WAA+B,EAC/B,SAAc,EACd,QAAe,EACf,SAAiB,EACjB,OAAO,EACP,SAA4B,EAC5B,aAAqB,EACrB,UAAU,EACV,eAAe,EACf,eAAuB,EACvB,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,GACX,EAAE,mBAAmB,+BA+GrB;AAMD,eAAO,MAAM,oBAAoB,4xGAmIhC,CAAC;AAEF,eAAe,cAAc,CAAC"}

package/dist/client/richtext/RichTextEditor.js

@@ -227,7 +227,7 @@ export function RichTextEditor({ editorConfig, initialValue, onChange, onSeriali
 // ============================================
 export const richTextEditorStyles = `
 .revealui-rich-text-editor {
-  border: 1px solid #e2e8f0;
+  border: 1px solid var(--rvui-border, #e2e8f0);
   border-radius: 8px;
   overflow: hidden;
   font-family: system-ui, -apple-system, sans-serif;
@@ -237,13 +237,13 @@ export const richTextEditorStyles = `
   display: flex;
   gap: 4px;
   padding: 8px;
-  border-bottom: 1px solid #e2e8f0;
-  background: #f8fafc;
+  border-bottom: 1px solid var(--rvui-border, #e2e8f0);
+  background: var(--rvui-surface-1, #f8fafc);
 }
 
 .editor-toolbar--floating {
   border-bottom: none;
-  border: 1px solid #e2e8f0;
+  border: 1px solid var(--rvui-border, #e2e8f0);
   border-radius: 8px;
   box-shadow: 0 4px 12px rgba(0, 0, 0, 0.15);
   background: white;
@@ -253,7 +253,7 @@ export const richTextEditorStyles = `
 
 .toolbar-btn {
   padding: 6px 10px;
-  border: 1px solid #e2e8f0;
+  border: 1px solid var(--rvui-border, #e2e8f0);
   border-radius: 4px;
   background: white;
   cursor: pointer;
@@ -262,13 +262,13 @@ export const richTextEditorStyles = `
 }
 
 .toolbar-btn:hover {
-  background: #f1f5f9;
+  background: var(--rvui-surface-2, #f1f5f9);
 }
 
 .toolbar-btn.active {
-  background: #3b82f6;
+  background: var(--rvui-brand, #3b82f6);
   color: white;
-  border-color: #3b82f6;
+  border-color: var(--rvui-brand, #3b82f6);
 }
 
 .editor-container {
@@ -286,7 +286,7 @@ export const richTextEditorStyles = `
   position: absolute;
   top: 16px;
   left: 16px;
-  color: #94a3b8;
+  color: var(--rvui-text-2, #94a3b8);
   pointer-events: none;
   user-select: none;
 }
@@ -303,24 +303,24 @@ export const richTextEditorStyles = `
 .editor-heading-h6 { font-size: 0.75em; font-weight: bold; margin: 0 0 8px 0; }
 
 .editor-quote {
-  border-left: 4px solid #e2e8f0;
+  border-left: 4px solid var(--rvui-border, #e2e8f0);
   padding-left: 16px;
   margin: 0 0 8px 0;
-  color: #64748b;
+  color: var(--rvui-text-2, #64748b);
 }
 
 .editor-list-ol { list-style: decimal; padding-left: 24px; margin: 0 0 8px 0; }
 .editor-list-ul { list-style: disc; padding-left: 24px; margin: 0 0 8px 0; }
 .editor-listitem { margin: 4px 0; }
 
-.editor-link { color: #3b82f6; text-decoration: underline; }
+.editor-link { color: var(--rvui-brand, #3b82f6); text-decoration: underline; }
 
 .editor-text-bold { font-weight: bold; }
 .editor-text-italic { font-style: italic; }
 .editor-text-underline { text-decoration: underline; }
 .editor-text-strikethrough { text-decoration: line-through; }
 .editor-text-code {
-  background: #f1f5f9;
+  background: var(--rvui-surface-2, #f1f5f9);
   padding: 2px 4px;
   border-radius: 4px;
   font-family: monospace;
@@ -329,8 +329,8 @@ export const richTextEditorStyles = `
 .editor-text-superscript { vertical-align: super; font-size: smaller; }
 
 .editor-code {
-  background: #1e293b;
-  color: #e2e8f0;
+  background: var(--rvui-text-0, #1e293b);
+  color: var(--rvui-border, #e2e8f0);
   padding: 16px;
   border-radius: 4px;
   font-family: monospace;

package/dist/client/richtext/components/ImageNodeComponent.js

@@ -64,14 +64,14 @@ export const ImageNodeComponent = (props) => {
                         }, children: [_jsx("button", { type: "button", onClick: handleEdit, className: "editor-image-btn", style: {
                                     padding: '4px 8px',
                                     background: 'white',
-                                    border: '1px solid #e2e8f0',
+                                    border: `1px solid var(--rvui-border, #e2e8f0)`,
                                     borderRadius: '4px',
                                     cursor: 'pointer',
                                     fontSize: '12px',
                                 }, title: "Edit Image", "aria-label": "Edit Image", children: "\u270E" }), _jsx("button", { type: "button", onClick: removeImage, className: "editor-image-btn", style: {
                                     padding: '4px 8px',
                                     background: 'white',
-                                    border: '1px solid #e2e8f0',
+                                    border: `1px solid var(--rvui-border, #e2e8f0)`,
                                     borderRadius: '4px',
                                     cursor: 'pointer',
                                     fontSize: '12px',
@@ -87,12 +87,12 @@ export const ImageNodeComponent = (props) => {
                     width: '100%',
                     marginTop: '8px',
                     padding: '4px 8px',
-                    border: '1px solid #e2e8f0',
+                    border: `1px solid var(--rvui-border, #e2e8f0)`,
                     borderRadius: '4px',
                 } })) : (data.caption && (_jsx("figcaption", { style: {
                     marginTop: '8px',
                     fontSize: '14px',
-                    color: '#64748b',
+                    color: 'var(--rvui-text-2, #64748b)',
                     fontStyle: 'italic',
                 }, children: data.caption })))] }));
 };

package/dist/collections/CollectionOperations.d.ts

@@ -5,6 +5,7 @@
  * hooks, and query building.
  */
 import type { BatchCreateOptions, BatchDeleteOptions, BatchResult, BatchUpdateOptions, CollectionStorageDescriptor, PopulateType, QueryableDatabaseAdapter, RevealCollectionConfig, RevealCreateOptions, RevealDeleteOptions, RevealDocument, RevealFindOptions, RevealPaginatedResult, RevealRequest, RevealUpdateOptions } from '../types/index.js';
+import { type RestoreOptions, type SnapshotOptions } from './operations/snapshot.js';
 export declare class RevealUICollection {
     config: RevealCollectionConfig;
     storage: CollectionStorageDescriptor | null;
@@ -16,6 +17,8 @@ export declare class RevealUICollection {
         depth?: number;
         req?: RevealRequest;
         populate?: PopulateType;
+        overrideAccess?: boolean;
+        draft?: boolean;
     }): Promise<RevealDocument | null>;
     create(options: RevealCreateOptions): Promise<RevealDocument>;
     update(options: RevealUpdateOptions): Promise<RevealDocument>;
@@ -23,5 +26,7 @@ export declare class RevealUICollection {
     createMany(options: BatchCreateOptions): Promise<BatchResult<RevealDocument>>;
     updateMany(options: BatchUpdateOptions): Promise<BatchResult<RevealDocument>>;
     deleteMany(options: BatchDeleteOptions): Promise<BatchResult<RevealDocument>>;
+    snapshot(options: SnapshotOptions): Promise<RevealDocument>;
+    restore(options: RestoreOptions): Promise<RevealDocument>;
 }
 //# sourceMappingURL=CollectionOperations.d.ts.map

package/dist/collections/CollectionOperations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CollectionOperations.d.ts","sourceRoot":"","sources":["../../src/collections/CollectionOperations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,2BAA2B,EAC3B,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,mBAAmB,EACpB,MAAM,mBAAmB,CAAC;AAU3B,qBAAa,kBAAkB;IAC7B,MAAM,EAAE,sBAAsB,CAAC;IAC/B,OAAO,EAAE,2BAA2B,GAAG,IAAI,CAAC;IAC5C,EAAE,EAAE,wBAAwB,GAAG,IAAI,CAAC;gBAGlC,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,GAAE,2BAA2B,GAAG,IAAW;IAO9C,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAIhE,QAAQ,CAAC,OAAO,EAAE;QACtB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,aAAa,CAAC;QACpB,QAAQ,CAAC,EAAE,YAAY,CAAC;KACzB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAI5B,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7D,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7D,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7D,UAAU,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IAI7E,UAAU,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IAI7E,UAAU,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;CAGpF"}
+{"version":3,"file":"CollectionOperations.d.ts","sourceRoot":"","sources":["../../src/collections/CollectionOperations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,2BAA2B,EAC3B,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,mBAAmB,EACpB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAEL,KAAK,cAAc,EAEnB,KAAK,eAAe,EACrB,MAAM,0BAA0B,CAAC;AAIlC,qBAAa,kBAAkB;IAC7B,MAAM,EAAE,sBAAsB,CAAC;IAC/B,OAAO,EAAE,2BAA2B,GAAG,IAAI,CAAC;IAC5C,EAAE,EAAE,wBAAwB,GAAG,IAAI,CAAC;gBAGlC,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,GAAE,2BAA2B,GAAG,IAAW;IAO9C,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAIhE,QAAQ,CAAC,OAAO,EAAE;QACtB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,aAAa,CAAC;QACpB,QAAQ,CAAC,EAAE,YAAY,CAAC;QACxB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAI5B,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7D,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7D,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAI7D,UAAU,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IAI7E,UAAU,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IAI7E,UAAU,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IAI7E,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;IAI3D,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;CAGhE"}

package/dist/collections/CollectionOperations.js

@@ -10,6 +10,7 @@ import { deleteDocument } from './operations/delete.js';
 import { deleteMany } from './operations/deleteMany.js';
 import { find } from './operations/find.js';
 import { findByID } from './operations/findById.js';
+import { createSnapshot, restoreSnapshot, } from './operations/snapshot.js';
 import { update } from './operations/update.js';
 import { updateMany } from './operations/updateMany.js';
 export class RevealUICollection {
@@ -45,4 +46,10 @@ export class RevealUICollection {
     async deleteMany(options) {
         return deleteMany(this.config, this.db, options);
     }
+    async snapshot(options) {
+        return createSnapshot(this.config, this.db, options);
+    }
+    async restore(options) {
+        return restoreSnapshot(this.config, this.db, options);
+    }
 }

package/dist/collections/operations/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/create.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EACV,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,cAAc,EAGf,MAAM,sBAAsB,CAAC;AAwC9B,wBAAsB,MAAM,CAC1B,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,cAAc,CAAC,CA+IzB"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/create.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EACV,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,cAAc,EAGf,MAAM,sBAAsB,CAAC;AAyC9B,wBAAsB,MAAM,CAC1B,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAoKzB"}

package/dist/collections/operations/create.js

@@ -8,6 +8,7 @@ import bcrypt from 'bcryptjs';
 import { collectJsonFields, serializeValueForDatabase } from '../../utils/json-parsing.js';
 import { flattenFields, isJsonFieldType } from '../../utils/type-guards.js';
 import { runBeforeFieldHooks } from './fieldHooks.js';
+import { runFieldValidators } from './fieldValidation.js';
 import { findByID } from './findById.js';
 import { insertDocumentQuery } from './sqlAdapter.js';
 /**
@@ -72,6 +73,11 @@ export async function create(config, db, options) {
             }
         }
     }
+    // Run field-level `validate` predicates after the built-in required/email
+    // checks and before beforeChange hooks (Payload's beforeValidate → validate →
+    // beforeChange ordering). Throws a ValidationError (HTTP 400) on the first
+    // failing field.
+    await runFieldValidators(config, data, 'create', options.req);
     // Run beforeChange field hooks after validation but before the DB write.
     await runBeforeFieldHooks(config, data, 'create', 'beforeChange', undefined, options.req);
     // Hash password if present and not already hashed (doesn't start with $2a$ or $2b$)
@@ -79,6 +85,20 @@ export async function create(config, db, options) {
         const saltRounds = 12;
         data.password = await bcrypt.hash(data.password, saltRounds);
     }
+    // Typed-storage write seam: a registered collectionStorage adapter (e.g. the
+    // typed Drizzle bridge) may own this collection's writes. It receives the
+    // fully hook-processed `data` and returns the created document, or `undefined`
+    // to defer to the dynamic-SQL path below — same not-handled contract as the
+    // read seam in findById.ts / find.ts.
+    if (db?.collectionStorage?.create) {
+        const doc = await db.collectionStorage.create(config, {
+            data,
+            ...(options.req ? { req: options.req } : {}),
+        });
+        if (doc !== undefined) {
+            return doc;
+        }
+    }
     if (db?.query) {
         // Dynamic collection storage is quarantined in sqlAdapter.ts until this
         // layer is redesigned around typed tables that Drizzle can model directly.

package/dist/collections/operations/delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/delete.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,cAAc,EAGf,MAAM,sBAAsB,CAAC;AAsC9B,wBAAsB,cAAc,CAClC,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAkCzB"}
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/delete.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,cAAc,EAGf,MAAM,sBAAsB,CAAC;AAsC9B,wBAAsB,cAAc,CAClC,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAiDzB"}

package/dist/collections/operations/delete.js

@@ -49,6 +49,20 @@ export async function deleteDocument(config, db, options) {
             throw new Error('Access denied: insufficient permissions to delete this document');
         }
     }
+    // Typed-storage write seam: a registered collectionStorage adapter may own
+    // this collection's deletes (e.g. soft-delete semantics on a typed table). It
+    // returns the deleted document, throws for not-found, or returns `undefined`
+    // to defer to the dynamic-SQL path below (same not-handled contract as the
+    // read seam).
+    if (db?.collectionStorage?.delete) {
+        const result = await db.collectionStorage.delete(config, {
+            id,
+            ...(options.req ? { req: options.req } : {}),
+        });
+        if (result !== undefined) {
+            return result;
+        }
+    }
     if (db?.query) {
         // Dynamic collection storage is quarantined in sqlAdapter.ts until this
         // layer is redesigned around typed tables that Drizzle can model directly.

package/dist/collections/operations/drafts.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Draft read semantics
+ *
+ * A collection opts into drafts via `versions.drafts` (see the admin
+ * `VersionsConfigSchema`). When drafts are enabled, a document's `_status`
+ * column distinguishes `'draft'` from `'published'` state in a single row.
+ *
+ * These helpers centralize the ONE rule that keeps unpublished content from
+ * leaking to readers who should not see it: a read of a drafts-enabled
+ * collection is published-only by default, and `draft=true` relaxes ONLY that
+ * default. It never touches the `access.read` clause, which find()/findByID()
+ * AND-merge separately — so a caller scoped to published content by
+ * `access.read` stays published-only even when it asks for `draft=true`.
+ */
+import type { RevealCollectionConfig, RevealWhere } from '../../types/index.js';
+/**
+ * True when the collection enables drafts via `versions.drafts`.
+ *
+ * `versions: true` (version history without drafts) does NOT enable drafts —
+ * there is no `_status` lifecycle to gate, so reads are not filtered.
+ */
+export declare function collectionHasDrafts(config: RevealCollectionConfig): boolean;
+/**
+ * The additional published-only read filter for a drafts-enabled collection
+ * when draft mode is NOT requested. Returns `undefined` when no filter applies
+ * (collection has no drafts, or `draft=true` was passed).
+ *
+ * SECURITY: this is layered ON TOP of `access.read`, never a replacement.
+ * `draft=true` removes only this filter; the access clause is AND-merged by the
+ * caller and always wins.
+ */
+export declare function publishedOnlyReadFilter(config: RevealCollectionConfig, draft: boolean): RevealWhere | undefined;
+//# sourceMappingURL=drafts.d.ts.map

package/dist/collections/operations/drafts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drafts.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/drafts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEhF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAK3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,OAAO,GACb,WAAW,GAAG,SAAS,CAIzB"}

package/dist/collections/operations/drafts.js

@@ -0,0 +1,43 @@
+/**
+ * Draft read semantics
+ *
+ * A collection opts into drafts via `versions.drafts` (see the admin
+ * `VersionsConfigSchema`). When drafts are enabled, a document's `_status`
+ * column distinguishes `'draft'` from `'published'` state in a single row.
+ *
+ * These helpers centralize the ONE rule that keeps unpublished content from
+ * leaking to readers who should not see it: a read of a drafts-enabled
+ * collection is published-only by default, and `draft=true` relaxes ONLY that
+ * default. It never touches the `access.read` clause, which find()/findByID()
+ * AND-merge separately — so a caller scoped to published content by
+ * `access.read` stays published-only even when it asks for `draft=true`.
+ */
+/**
+ * True when the collection enables drafts via `versions.drafts`.
+ *
+ * `versions: true` (version history without drafts) does NOT enable drafts —
+ * there is no `_status` lifecycle to gate, so reads are not filtered.
+ */
+export function collectionHasDrafts(config) {
+    const versions = config.versions;
+    if (!versions || typeof versions !== 'object')
+        return false;
+    const drafts = versions.drafts;
+    return drafts === true || (typeof drafts === 'object' && drafts !== null);
+}
+/**
+ * The additional published-only read filter for a drafts-enabled collection
+ * when draft mode is NOT requested. Returns `undefined` when no filter applies
+ * (collection has no drafts, or `draft=true` was passed).
+ *
+ * SECURITY: this is layered ON TOP of `access.read`, never a replacement.
+ * `draft=true` removes only this filter; the access clause is AND-merged by the
+ * caller and always wins.
+ */
+export function publishedOnlyReadFilter(config, draft) {
+    if (draft)
+        return undefined;
+    if (!collectionHasDrafts(config))
+        return undefined;
+    return { _status: { equals: 'published' } };
+}

package/dist/collections/operations/fieldValidation.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Field Validation Execution
+ *
+ * Runs field-level `validate` predicates during create/update operations.
+ * Mirrors the fieldHooks.ts execution pattern: a single flattenFields traversal
+ * over the collection's fields.
+ *
+ * A field's `validate(value, { value, data, siblingData, operation, req })`
+ * returns `true` when the value is valid, or a non-empty string error message
+ * when it is not. On the first failure the engine throws a ValidationError
+ * (HTTP 400) carrying that message, so the write is rejected at ingress.
+ *
+ * Enforcement note: this is one of the engine's ingress checks and runs for
+ * EVERY collection written through create()/update(). For public page/post
+ * rich-text content it COMPLEMENTS — does not replace — the contracts walker
+ * (validateContent/validateBlocks, wired into the pages/posts write routes) and
+ * render-side sanitizeUrl. See docs/specs/2026-07-02-cms-render-path-hardening.md.
+ */
+import type { RevealCollectionConfig, RevealRequest } from '../../types/index.js';
+/**
+ * Thrown when a field's `validate` predicate rejects a value.
+ *
+ * Carries `status`/`statusCode` 400 so transports surface it as a client error
+ * with the validator's message intact (core `rest.ts` reads `status`; the
+ * server error middleware can branch on `name === 'ValidationError'`), rather
+ * than the generic 500 that a bare Error would produce.
+ */
+export declare class ValidationError extends Error {
+    readonly status = 400;
+    readonly statusCode = 400;
+    readonly field?: string;
+    constructor(message: string, field?: string);
+}
+/**
+ * Executes every field's `validate` predicate for the fields present in `data`.
+ *
+ * Called once per write, after the required-field / email-format checks and
+ * before the beforeChange field hooks — the same ordering Payload uses
+ * (beforeValidate hooks → validate → beforeChange hooks).
+ *
+ * A field is validated only when its name is present in `data`. This matches the
+ * engine's existing email check (which gates on `field.name in data`) and is
+ * correct for partial updates, where absent keys are untouched. Required-but-
+ * absent fields are still caught by the separate required-field check in the
+ * create operation.
+ *
+ * `flattenFields` recurses through `tabs`/`row` containers, whose child fields
+ * remain top-level keys in `data`, so `data[field.name]` and `siblingData: data`
+ * resolve correctly. `group`/`array`/`blocks` are validated as a single value
+ * (the whole sub-object), matching how the engine treats those JSON fields.
+ */
+export declare function runFieldValidators(config: RevealCollectionConfig, data: Record<string, unknown>, operation: 'create' | 'update', req?: RevealRequest): Promise<void>;
+//# sourceMappingURL=fieldValidation.d.ts.map

package/dist/collections/operations/fieldValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fieldValidation.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/fieldValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGlF;;;;;;;GAOG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,MAAM,OAAO;IACtB,QAAQ,CAAC,UAAU,OAAO;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;gBAEZ,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM;CAK5C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,sBAAsB,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,EAAE,QAAQ,GAAG,QAAQ,EAC9B,GAAG,CAAC,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CAoCf"}

package/dist/collections/operations/fieldValidation.js

@@ -0,0 +1,89 @@
+/**
+ * Field Validation Execution
+ *
+ * Runs field-level `validate` predicates during create/update operations.
+ * Mirrors the fieldHooks.ts execution pattern: a single flattenFields traversal
+ * over the collection's fields.
+ *
+ * A field's `validate(value, { value, data, siblingData, operation, req })`
+ * returns `true` when the value is valid, or a non-empty string error message
+ * when it is not. On the first failure the engine throws a ValidationError
+ * (HTTP 400) carrying that message, so the write is rejected at ingress.
+ *
+ * Enforcement note: this is one of the engine's ingress checks and runs for
+ * EVERY collection written through create()/update(). For public page/post
+ * rich-text content it COMPLEMENTS — does not replace — the contracts walker
+ * (validateContent/validateBlocks, wired into the pages/posts write routes) and
+ * render-side sanitizeUrl. See docs/specs/2026-07-02-cms-render-path-hardening.md.
+ */
+import { flattenFields } from '../../utils/type-guards.js';
+/**
+ * Thrown when a field's `validate` predicate rejects a value.
+ *
+ * Carries `status`/`statusCode` 400 so transports surface it as a client error
+ * with the validator's message intact (core `rest.ts` reads `status`; the
+ * server error middleware can branch on `name === 'ValidationError'`), rather
+ * than the generic 500 that a bare Error would produce.
+ */
+export class ValidationError extends Error {
+    status = 400;
+    statusCode = 400;
+    field;
+    constructor(message, field) {
+        super(message);
+        this.name = 'ValidationError';
+        this.field = field;
+    }
+}
+/**
+ * Executes every field's `validate` predicate for the fields present in `data`.
+ *
+ * Called once per write, after the required-field / email-format checks and
+ * before the beforeChange field hooks — the same ordering Payload uses
+ * (beforeValidate hooks → validate → beforeChange hooks).
+ *
+ * A field is validated only when its name is present in `data`. This matches the
+ * engine's existing email check (which gates on `field.name in data`) and is
+ * correct for partial updates, where absent keys are untouched. Required-but-
+ * absent fields are still caught by the separate required-field check in the
+ * create operation.
+ *
+ * `flattenFields` recurses through `tabs`/`row` containers, whose child fields
+ * remain top-level keys in `data`, so `data[field.name]` and `siblingData: data`
+ * resolve correctly. `group`/`array`/`blocks` are validated as a single value
+ * (the whole sub-object), matching how the engine treats those JSON fields.
+ */
+export async function runFieldValidators(config, data, operation, req) {
+    const fields = flattenFields(config.fields || []);
+    for (const field of fields) {
+        if (!field.name)
+            continue;
+        const validate = field.validate;
+        if (typeof validate !== 'function')
+            continue;
+        // Only validate fields carried by this write payload.
+        if (!(field.name in data))
+            continue;
+        const value = data[field.name];
+        // `req` is required by FieldValidateArgs; ingress writes always carry one.
+        // Bootstrap/test paths may not — pass it through and let validators that
+        // depend on `req` fail loudly rather than silently skipping validation.
+        // Cast the args object to the predicate's own parameter type: core's
+        // RevealRequest and the contracts FieldValidateArgs.req generic differ only
+        // in their default user parameter, so the shape is identical.
+        const args = {
+            value,
+            data,
+            siblingData: data,
+            operation,
+            req,
+        };
+        const result = await validate(value, args);
+        if (result !== true) {
+            const message = typeof result === 'string' && result.length > 0
+                ? result
+                : `Field '${field.name}' failed validation`;
+            throw new ValidationError(message, field.name);
+        }
+    }
+}

package/dist/collections/operations/find.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"find.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/find.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAEV,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EAItB,MAAM,sBAAsB,CAAC;AAiC9B,wBAAsB,IAAI,CACxB,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,qBAAqB,CAAC,CAgPhC"}
+{"version":3,"file":"find.d.ts","sourceRoot":"","sources":["../../../src/collections/operations/find.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAEV,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EAItB,MAAM,sBAAsB,CAAC;AAkC9B,wBAAsB,IAAI,CACxB,MAAM,EAAE,sBAAsB,EAC9B,EAAE,EAAE,wBAAwB,GAAG,IAAI,EACnC,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,qBAAqB,CAAC,CAuQhC"}