@tetherto/dev-websites-core 0.3.3 → 0.3.4

package/README.md

@@ -5,11 +5,13 @@ Shared CMS, SEO, i18n, utils, UI, and analytics primitives for WDK / QVAC / PEAR
 | Import | Contents |
 | --- | --- |
 | `@tetherto/dev-websites-core/cms` | Payload `buildCmsConfig`, stock collections, access, Lexical, media I/O |
+| `@tetherto/dev-websites-core/cms/google-oauth` | Google admin login handlers (`google-auth-library` peer) |
 | `@tetherto/dev-websites-core/seo` | `createMetadataFactory`, `getSiteUrl`, `getOgBackgroundDataUrl` |
 | `@tetherto/dev-websites-core/i18n` | `Languages` / `LanguageLabel` |
 | `@tetherto/dev-websites-core/utils` | `createLogger`, `toPlainValue`, `stripShikiPreBackground` |
 | `@tetherto/dev-websites-core/analytics` | `GtmLoader`, `createTrackedLink` (optional `@next/third-parties` peer) |
 | `@tetherto/dev-websites-core/ui` | UI primitives (`Button`, `Dialog`, `Pagination`, `Tooltip`, …) + `cn` |
+| `@tetherto/dev-websites-core/ui/google-oauth` | Payload `GoogleOAuthButton` (Tailwind classes; source `dist` from Payload CSS) |
 | `@tetherto/dev-websites-core/ui/a11y` | `focusRingClassName`, `VisuallyHidden` |
 | `@tetherto/dev-websites-core/ui/carousel` | `Carousel` (+ optional `embla-carousel-react` peer) |
 | `@tetherto/dev-websites-core/ui/theme.css` | One-shot: tokens + Tailwind v4 `@theme` preset |
@@ -51,6 +53,71 @@ rm -rf node_modules/@tetherto/dev-websites-core && npm install @tetherto/dev-web
 Do **not** import `@tetherto/dev-websites-core/cms` from Client Components — it includes Node-only
 modules (`fs`, Payload, S3). Prefer domain subpaths over the root barrel.
 
+### Google admin login
+
+Stock `users` includes `googleId` / `name` / `picture`. Sites add Next.js routes and
+Payload `afterLogin` (optional `google-auth-library` peer):
+
+```ts
+// src/payload.config.ts
+import { GOOGLE_OAUTH_AFTER_LOGIN } from '@tetherto/dev-websites-core/cms/google-oauth'
+
+admin: {
+  components: { afterLogin: [...GOOGLE_OAUTH_AFTER_LOGIN] },
+}
+```
+
+```ts
+// src/app/api/auth/google/route.ts
+import { handleGoogleOAuthStart } from '@tetherto/dev-websites-core/cms/google-oauth'
+
+export function GET() {
+  return handleGoogleOAuthStart({
+    clientId: process.env.GOOGLE_OAUTH_CLIENT_ID ?? '',
+    clientSecret: process.env.GOOGLE_OAUTH_CLIENT_SECRET ?? '',
+  })
+}
+```
+
+```ts
+// src/app/api/auth/google/callback/route.ts
+import { handleGoogleOAuthCallback } from '@tetherto/dev-websites-core/cms/google-oauth'
+import config from '@payload-config'
+
+import type { NextRequest } from 'next/server'
+
+export function GET(request: NextRequest) {
+  return handleGoogleOAuthCallback(request, {
+    config,
+    clientId: process.env.GOOGLE_OAUTH_CLIENT_ID ?? '',
+    clientSecret: process.env.GOOGLE_OAUTH_CLIENT_SECRET ?? '',
+  })
+}
+```
+
+```css
+/* src/app/(payload)/custom.css — utilities only; do not import Tailwind preflight */
+@import 'tailwindcss/theme.css' layer(theme) source(none);
+@import 'tailwindcss/utilities.css' layer(utilities) source(none);
+@source '../../../node_modules/@tetherto/dev-websites-core/src/ui/components/GoogleOAuthButton';
+
+.login__form > .form-submit .btn {
+  margin-bottom: 0;
+}
+```
+
+Apps using Next.js should also transpile the package so the Payload button shares the app React instance:
+
+```ts
+// next.config.ts
+transpilePackages: ['@tetherto/dev-websites-core']
+```
+
+The app passes `clientId` and `clientSecret` into both handlers (usually from its own
+`GOOGLE_OAUTH_CLIENT_ID` and `GOOGLE_OAUTH_CLIENT_SECRET`). Redirect URI:
+`{NEXT_PUBLIC_SITE_URL}/api/auth/google/callback`. Existing `users` emails are
+required — Google login does not create accounts.
+
 ### Analytics
 
 ```ts
@@ -142,6 +209,11 @@ Changelog stock ships shared fields only; site-specific body / GitHub /
 `overrides.hooks` (site-owned, e.g. `src/lib/cache`) — hook arrays are **appended**
 to stock hooks, not replaced.
 
+Draft collections enable Payload `schedulePublish`. `buildCmsConfig` starts
+`jobs.autoRun` every minute so scheduled publishes run in a long-lived Node
+process (`next start` / Docker). Override or disable via `payload.jobs`. This
+is not for serverless hosts.
+
 ### Peer dependencies
 
 CMS / Next (required for `/cms` consumers):

package/dist/cms/google-oauth.d.mts

@@ -0,0 +1,20 @@
+import { Config, SanitizedConfig } from "payload";
+import { NextRequest, NextResponse } from "next/server.js";
+//#region src/cms/auth/google-oauth.d.ts
+/** Payload `admin.components.afterLogin` path for the shared Google button. */
+declare const GOOGLE_OAUTH_AFTER_LOGIN: readonly ["@tetherto/dev-websites-core/ui/google-oauth#GoogleOAuthButton"];
+type GoogleOAuthClientConfig = {
+  clientId: string;
+  clientSecret: string;
+};
+type HandleGoogleOAuthCallbackOptions = GoogleOAuthClientConfig & {
+  /** Site Payload config default export (`import config from '@payload-config'`). */
+  config: Config | SanitizedConfig | Promise<Config | SanitizedConfig>;
+};
+/** GET `/api/auth/google` — start the Google OAuth redirect. */
+declare function handleGoogleOAuthStart(clientConfig: GoogleOAuthClientConfig): Promise<NextResponse<unknown>>;
+/** GET `/api/auth/google/callback` — exchange the code and set the Payload session cookie. */
+declare function handleGoogleOAuthCallback(request: NextRequest, { config, ...clientConfig }: HandleGoogleOAuthCallbackOptions): Promise<NextResponse<unknown>>;
+//#endregion
+export { GOOGLE_OAUTH_AFTER_LOGIN, GoogleOAuthClientConfig, HandleGoogleOAuthCallbackOptions, handleGoogleOAuthCallback, handleGoogleOAuthStart };
+//# sourceMappingURL=google-oauth.d.mts.map

package/dist/cms/google-oauth.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-oauth.d.mts","names":[],"sources":["../../src/cms/auth/google-oauth.ts"],"mappings":";;;;cAiBa;KAMD;EACV;EACA;;KAGU,mCAAmC;;EAE7C,QAAQ,SAAS,kBAAkB,QAAQ,SAAS;;;iBAqBhC,uBAAuB,cAAc,0BAAuB,QAAA;;iBAoB5D,0BACpB,SAAS,eACP,WAAW,gBAAgB,mCAAgC,QAAA"}

package/dist/cms/google-oauth.mjs

@@ -0,0 +1,130 @@
+import { t as createLogger } from "../logger.mjs";
+import { t as getSiteUrl } from "../site-url.mjs";
+import { getFieldsToSign, getPayload, jwtSign } from "payload";
+import { OAuth2Client } from "google-auth-library";
+import { NextResponse } from "next/server.js";
+import { addSessionToUser, generatePayloadCookie } from "payload/shared";
+//#region src/cms/auth/google-oauth.ts
+const log = createLogger("googleOAuth");
+const GOOGLE_OAUTH_CALLBACK_PATH = "/api/auth/google/callback";
+const GOOGLE_OAUTH_LOGIN_PATH = "/admin/login";
+const GOOGLE_OAUTH_ADMIN_PATH = "/admin";
+/** Payload `admin.components.afterLogin` path for the shared Google button. */
+const GOOGLE_OAUTH_AFTER_LOGIN = ["@tetherto/dev-websites-core/ui/google-oauth#GoogleOAuthButton"];
+const GOOGLE_OAUTH_SCOPES = [
+	"openid",
+	"email",
+	"profile"
+];
+function getGoogleOAuthClient(redirectUri, { clientId, clientSecret }) {
+	if (!clientId || !clientSecret) throw new Error("Google OAuth credentials not configured");
+	return new OAuth2Client(clientId, clientSecret, redirectUri);
+}
+function loginErrorRedirect(siteUrl, error) {
+	return NextResponse.redirect(`${siteUrl}${GOOGLE_OAUTH_LOGIN_PATH}?error=${encodeURIComponent(error)}`);
+}
+/** GET `/api/auth/google` — start the Google OAuth redirect. */
+async function handleGoogleOAuthStart(clientConfig) {
+	try {
+		const authorizeUrl = getGoogleOAuthClient(`${getSiteUrl()}${GOOGLE_OAUTH_CALLBACK_PATH}`, clientConfig).generateAuthUrl({
+			access_type: "offline",
+			scope: [...GOOGLE_OAUTH_SCOPES],
+			prompt: "select_account"
+		});
+		return NextResponse.redirect(authorizeUrl);
+	} catch (error) {
+		log.error(error instanceof Error ? error.message : "OAuth configuration error");
+		return NextResponse.json({ error: "OAuth configuration error" }, { status: 500 });
+	}
+}
+/** GET `/api/auth/google/callback` — exchange the code and set the Payload session cookie. */
+async function handleGoogleOAuthCallback(request, { config, ...clientConfig }) {
+	try {
+		const { searchParams } = new URL(request.url);
+		const siteUrl = getSiteUrl();
+		const code = searchParams.get("code");
+		const error = searchParams.get("error");
+		if (error) return loginErrorRedirect(siteUrl, error);
+		if (!code) return loginErrorRedirect(siteUrl, "no_code");
+		const client = getGoogleOAuthClient(`${siteUrl}${GOOGLE_OAUTH_CALLBACK_PATH}`, clientConfig);
+		const { tokens } = await client.getToken(code);
+		client.setCredentials(tokens);
+		if (!tokens.id_token) return loginErrorRedirect(siteUrl, "no_token");
+		const googlePayload = (await client.verifyIdToken({
+			idToken: tokens.id_token,
+			audience: clientConfig.clientId
+		})).getPayload();
+		if (!googlePayload?.email) return loginErrorRedirect(siteUrl, "no_email");
+		const { email, sub: googleId, name, picture } = googlePayload;
+		const payload = await getPayload({ config: await config });
+		const users = await payload.find({
+			collection: "users",
+			where: { or: [{ email: { equals: email } }, { googleId: { equals: googleId } }] },
+			limit: 1
+		});
+		let user = users.docs[0];
+		if (users.docs.length > 0) {
+			user = users.docs[0];
+			const googleUser = user;
+			const updateData = {};
+			if (!googleUser.googleId) {
+				updateData.googleId = googleId;
+				updateData.name = name || googleUser.name;
+				updateData.picture = picture || googleUser.picture;
+			}
+			if (Object.keys(updateData).length > 0) user = await payload.update({
+				collection: "users",
+				id: user.id,
+				data: updateData
+			});
+		} else return loginErrorRedirect(siteUrl, "user_not_found");
+		const collectionConfig = payload.collections["users"].config;
+		const sessionUser = user;
+		const { sid } = await addSessionToUser({
+			collectionConfig,
+			payload,
+			req: {
+				payload,
+				user: sessionUser
+			},
+			user: sessionUser
+		});
+		const fieldsToSign = getFieldsToSign({
+			collectionConfig,
+			email: sessionUser.email,
+			sid,
+			user: sessionUser
+		});
+		const tokenExpiration = collectionConfig.auth.tokenExpiration || 7200;
+		const secret = payload.secret;
+		const { token } = await jwtSign({
+			fieldsToSign,
+			secret,
+			tokenExpiration
+		});
+		const cookie = generatePayloadCookie({
+			collectionAuthConfig: collectionConfig.auth,
+			cookiePrefix: payload.config.cookiePrefix || "payload",
+			token,
+			returnCookieAsObject: true
+		});
+		const response = NextResponse.redirect(`${siteUrl}${GOOGLE_OAUTH_ADMIN_PATH}`);
+		response.cookies.set(cookie.name, cookie.value, {
+			httpOnly: cookie.httpOnly,
+			sameSite: cookie.sameSite?.toLowerCase(),
+			secure: cookie.secure,
+			path: cookie.path,
+			expires: cookie.expires ? new Date(cookie.expires) : void 0,
+			maxAge: cookie.maxAge
+		});
+		return response;
+	} catch (error) {
+		const errorMessage = error instanceof Error ? error.message : "Authentication failed";
+		log.error(errorMessage);
+		return loginErrorRedirect(getSiteUrl(), errorMessage);
+	}
+}
+//#endregion
+export { GOOGLE_OAUTH_AFTER_LOGIN, handleGoogleOAuthCallback, handleGoogleOAuthStart };
+
+//# sourceMappingURL=google-oauth.mjs.map

package/dist/cms/google-oauth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-oauth.mjs","names":[],"sources":["../../src/cms/auth/google-oauth.ts"],"sourcesContent":["import { OAuth2Client } from 'google-auth-library'\nimport { NextRequest, NextResponse } from 'next/server'\nimport { getFieldsToSign, getPayload, jwtSign } from 'payload'\nimport { addSessionToUser, generatePayloadCookie } from 'payload/shared'\n\nimport { getSiteUrl } from '../../seo/site-url.js'\nimport { createLogger } from '../../utils/logger/logger.js'\n\nimport type { Config, SanitizedConfig } from 'payload'\n\nconst log = createLogger('googleOAuth')\n\nconst GOOGLE_OAUTH_CALLBACK_PATH = '/api/auth/google/callback'\nconst GOOGLE_OAUTH_LOGIN_PATH = '/admin/login'\nconst GOOGLE_OAUTH_ADMIN_PATH = '/admin'\n\n/** Payload `admin.components.afterLogin` path for the shared Google button. */\nexport const GOOGLE_OAUTH_AFTER_LOGIN = [\n  '@tetherto/dev-websites-core/ui/google-oauth#GoogleOAuthButton',\n] as const\n\nconst GOOGLE_OAUTH_SCOPES = ['openid', 'email', 'profile'] as const\n\nexport type GoogleOAuthClientConfig = {\n  clientId: string\n  clientSecret: string\n}\n\nexport type HandleGoogleOAuthCallbackOptions = GoogleOAuthClientConfig & {\n  /** Site Payload config default export (`import config from '@payload-config'`). */\n  config: Config | SanitizedConfig | Promise<Config | SanitizedConfig>\n}\n\nfunction getGoogleOAuthClient(\n  redirectUri: string,\n  { clientId, clientSecret }: GoogleOAuthClientConfig\n) {\n  if (!clientId || !clientSecret) {\n    throw new Error('Google OAuth credentials not configured')\n  }\n\n  return new OAuth2Client(clientId, clientSecret, redirectUri)\n}\n\nfunction loginErrorRedirect(siteUrl: string, error: string) {\n  return NextResponse.redirect(\n    `${siteUrl}${GOOGLE_OAUTH_LOGIN_PATH}?error=${encodeURIComponent(error)}`\n  )\n}\n\n/** GET `/api/auth/google` — start the Google OAuth redirect. */\nexport async function handleGoogleOAuthStart(clientConfig: GoogleOAuthClientConfig) {\n  try {\n    const siteUrl = getSiteUrl()\n    const redirectUri = `${siteUrl}${GOOGLE_OAUTH_CALLBACK_PATH}`\n    const client = getGoogleOAuthClient(redirectUri, clientConfig)\n\n    const authorizeUrl = client.generateAuthUrl({\n      access_type: 'offline',\n      scope: [...GOOGLE_OAUTH_SCOPES],\n      prompt: 'select_account',\n    })\n\n    return NextResponse.redirect(authorizeUrl)\n  } catch (error) {\n    log.error(error instanceof Error ? error.message : 'OAuth configuration error')\n    return NextResponse.json({ error: 'OAuth configuration error' }, { status: 500 })\n  }\n}\n\n/** GET `/api/auth/google/callback` — exchange the code and set the Payload session cookie. */\nexport async function handleGoogleOAuthCallback(\n  request: NextRequest,\n  { config, ...clientConfig }: HandleGoogleOAuthCallbackOptions\n) {\n  try {\n    const { searchParams } = new URL(request.url)\n    const siteUrl = getSiteUrl()\n    const code = searchParams.get('code')\n    const error = searchParams.get('error')\n\n    if (error) {\n      return loginErrorRedirect(siteUrl, error)\n    }\n\n    if (!code) {\n      return loginErrorRedirect(siteUrl, 'no_code')\n    }\n\n    const redirectUri = `${siteUrl}${GOOGLE_OAUTH_CALLBACK_PATH}`\n    const client = getGoogleOAuthClient(redirectUri, clientConfig)\n\n    const { tokens } = await client.getToken(code)\n    client.setCredentials(tokens)\n\n    if (!tokens.id_token) {\n      return loginErrorRedirect(siteUrl, 'no_token')\n    }\n\n    const ticket = await client.verifyIdToken({\n      idToken: tokens.id_token,\n      audience: clientConfig.clientId,\n    })\n\n    const googlePayload = ticket.getPayload()\n    if (!googlePayload?.email) {\n      return loginErrorRedirect(siteUrl, 'no_email')\n    }\n\n    const { email, sub: googleId, name, picture } = googlePayload\n    const payload = await getPayload({\n      config: (await config) as SanitizedConfig,\n    })\n\n    const users = await payload.find({\n      collection: 'users',\n      where: {\n        or: [{ email: { equals: email } }, { googleId: { equals: googleId } }],\n      },\n      limit: 1,\n    })\n\n    let user = users.docs[0]\n    if (users.docs.length > 0) {\n      user = users.docs[0]\n\n      const googleUser = user as typeof user & {\n        googleId?: string | null\n        name?: string | null\n        picture?: string | null\n      }\n      const updateData: Record<string, unknown> = {}\n\n      if (!googleUser.googleId) {\n        updateData.googleId = googleId\n        updateData.name = name || googleUser.name\n        updateData.picture = picture || googleUser.picture\n      }\n\n      if (Object.keys(updateData).length > 0) {\n        user = await payload.update({\n          collection: 'users',\n          id: user.id,\n          data: updateData,\n        })\n      }\n    } else {\n      return loginErrorRedirect(siteUrl, 'user_not_found')\n    }\n\n    const collectionConfig = payload.collections['users'].config\n\n    const sessionUser = user as Parameters<typeof addSessionToUser>[0]['user']\n\n    const { sid } = await addSessionToUser({\n      collectionConfig,\n      payload,\n      req: {\n        payload,\n        user: sessionUser,\n      } as unknown as Parameters<typeof addSessionToUser>[0]['req'],\n      user: sessionUser,\n    })\n\n    const fieldsToSign = getFieldsToSign({\n      collectionConfig,\n      email: sessionUser.email as string,\n      sid,\n      user: sessionUser,\n    })\n\n    const tokenExpiration = collectionConfig.auth.tokenExpiration || 7200\n    const secret = payload.secret\n\n    const { token } = await jwtSign({\n      fieldsToSign,\n      secret,\n      tokenExpiration,\n    })\n\n    const cookie = generatePayloadCookie({\n      collectionAuthConfig: collectionConfig.auth,\n      cookiePrefix: payload.config.cookiePrefix || 'payload',\n      token,\n      returnCookieAsObject: true,\n    })\n\n    const response = NextResponse.redirect(`${siteUrl}${GOOGLE_OAUTH_ADMIN_PATH}`)\n\n    response.cookies.set(cookie.name, cookie.value!, {\n      httpOnly: cookie.httpOnly,\n      sameSite: cookie.sameSite?.toLowerCase() as 'strict' | 'lax' | 'none' | undefined,\n      secure: cookie.secure,\n      path: cookie.path,\n      expires: cookie.expires ? new Date(cookie.expires) : undefined,\n      maxAge: cookie.maxAge,\n    })\n\n    return response\n  } catch (error) {\n    const errorMessage = error instanceof Error ? error.message : 'Authentication failed'\n    log.error(errorMessage)\n    return loginErrorRedirect(getSiteUrl(), errorMessage)\n  }\n}\n"],"mappings":";;;;;;;AAUA,MAAM,MAAM,aAAa,aAAa;AAEtC,MAAM,6BAA6B;AACnC,MAAM,0BAA0B;AAChC,MAAM,0BAA0B;;AAGhC,MAAa,2BAA2B,CACtC,+DACF;AAEA,MAAM,sBAAsB;CAAC;CAAU;CAAS;AAAS;AAYzD,SAAS,qBACP,aACA,EAAE,UAAU,gBACZ;CACA,IAAI,CAAC,YAAY,CAAC,cAChB,MAAM,IAAI,MAAM,yCAAyC;CAG3D,OAAO,IAAI,aAAa,UAAU,cAAc,WAAW;AAC7D;AAEA,SAAS,mBAAmB,SAAiB,OAAe;CAC1D,OAAO,aAAa,SAClB,GAAG,UAAU,wBAAwB,SAAS,mBAAmB,KAAK,GACxE;AACF;;AAGA,eAAsB,uBAAuB,cAAuC;CAClF,IAAI;EAKF,MAAM,eAFS,qBAAqB,GAFpB,WACa,IAAI,8BACgB,YAEvB,CAAC,CAAC,gBAAgB;GAC1C,aAAa;GACb,OAAO,CAAC,GAAG,mBAAmB;GAC9B,QAAQ;EACV,CAAC;EAED,OAAO,aAAa,SAAS,YAAY;CAC3C,SAAS,OAAO;EACd,IAAI,MAAM,iBAAiB,QAAQ,MAAM,UAAU,2BAA2B;EAC9E,OAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;CAClF;AACF;;AAGA,eAAsB,0BACpB,SACA,EAAE,QAAQ,GAAG,gBACb;CACA,IAAI;EACF,MAAM,EAAE,iBAAiB,IAAI,IAAI,QAAQ,GAAG;EAC5C,MAAM,UAAU,WAAW;EAC3B,MAAM,OAAO,aAAa,IAAI,MAAM;EACpC,MAAM,QAAQ,aAAa,IAAI,OAAO;EAEtC,IAAI,OACF,OAAO,mBAAmB,SAAS,KAAK;EAG1C,IAAI,CAAC,MACH,OAAO,mBAAmB,SAAS,SAAS;EAI9C,MAAM,SAAS,qBAAqB,GADb,UAAU,8BACgB,YAAY;EAE7D,MAAM,EAAE,WAAW,MAAM,OAAO,SAAS,IAAI;EAC7C,OAAO,eAAe,MAAM;EAE5B,IAAI,CAAC,OAAO,UACV,OAAO,mBAAmB,SAAS,UAAU;EAQ/C,MAAM,iBAAgB,MALD,OAAO,cAAc;GACxC,SAAS,OAAO;GAChB,UAAU,aAAa;EACzB,CAAC,EAAA,CAE4B,WAAW;EACxC,IAAI,CAAC,eAAe,OAClB,OAAO,mBAAmB,SAAS,UAAU;EAG/C,MAAM,EAAE,OAAO,KAAK,UAAU,MAAM,YAAY;EAChD,MAAM,UAAU,MAAM,WAAW,EAC/B,QAAS,MAAM,OACjB,CAAC;EAED,MAAM,QAAQ,MAAM,QAAQ,KAAK;GAC/B,YAAY;GACZ,OAAO,EACL,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,SAAS,EAAE,CAAC,EACvE;GACA,OAAO;EACT,CAAC;EAED,IAAI,OAAO,MAAM,KAAK;EACtB,IAAI,MAAM,KAAK,SAAS,GAAG;GACzB,OAAO,MAAM,KAAK;GAElB,MAAM,aAAa;GAKnB,MAAM,aAAsC,CAAC;GAE7C,IAAI,CAAC,WAAW,UAAU;IACxB,WAAW,WAAW;IACtB,WAAW,OAAO,QAAQ,WAAW;IACrC,WAAW,UAAU,WAAW,WAAW;GAC7C;GAEA,IAAI,OAAO,KAAK,UAAU,CAAC,CAAC,SAAS,GACnC,OAAO,MAAM,QAAQ,OAAO;IAC1B,YAAY;IACZ,IAAI,KAAK;IACT,MAAM;GACR,CAAC;EAEL,OACE,OAAO,mBAAmB,SAAS,gBAAgB;EAGrD,MAAM,mBAAmB,QAAQ,YAAY,QAAQ,CAAC;EAEtD,MAAM,cAAc;EAEpB,MAAM,EAAE,QAAQ,MAAM,iBAAiB;GACrC;GACA;GACA,KAAK;IACH;IACA,MAAM;GACR;GACA,MAAM;EACR,CAAC;EAED,MAAM,eAAe,gBAAgB;GACnC;GACA,OAAO,YAAY;GACnB;GACA,MAAM;EACR,CAAC;EAED,MAAM,kBAAkB,iBAAiB,KAAK,mBAAmB;EACjE,MAAM,SAAS,QAAQ;EAEvB,MAAM,EAAE,UAAU,MAAM,QAAQ;GAC9B;GACA;GACA;EACF,CAAC;EAED,MAAM,SAAS,sBAAsB;GACnC,sBAAsB,iBAAiB;GACvC,cAAc,QAAQ,OAAO,gBAAgB;GAC7C;GACA,sBAAsB;EACxB,CAAC;EAED,MAAM,WAAW,aAAa,SAAS,GAAG,UAAU,yBAAyB;EAE7E,SAAS,QAAQ,IAAI,OAAO,MAAM,OAAO,OAAQ;GAC/C,UAAU,OAAO;GACjB,UAAU,OAAO,UAAU,YAAY;GACvC,QAAQ,OAAO;GACf,MAAM,OAAO;GACb,SAAS,OAAO,UAAU,IAAI,KAAK,OAAO,OAAO,IAAI,KAAA;GACrD,QAAQ,OAAO;EACjB,CAAC;EAED,OAAO;CACT,SAAS,OAAO;EACd,MAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU;EAC9D,IAAI,MAAM,YAAY;EACtB,OAAO,mBAAmB,WAAW,GAAG,YAAY;CACtD;AACF"}

package/dist/cms/index.d.mts

@@ -1,3 +1,3 @@
-import { A as videoBlock, B as buildCmsConfig, C as defaultCodeLanguage, D as accordionBlock, E as sectionHeadingBlock, F as setPublishedAt, G as GlobalOverride, H as STOCK_COLLECTION_SLUGS, I as slugify, J as AccessHelpers, K as applyCollectionOverride, L as seoFields, M as codeTabsBlock, N as codeBlock, O as stepsBlock, P as richTextBlock, R as draftsWithAutosave, S as codeBlockLanguages, T as leafBlocks, U as StockCollectionSlug, V as Overrides, W as CollectionOverride, X as createAccessHelpers, Y as AccessOptions, _ as getRichTextEditorConfig, a as createChangelogTags, b as pageContentBlocks, c as createBlogPosts, d as createMedia, f as createApiTokens, g as requireEnvAtRuntime, h as createS3MediaPlugin, i as createChangelog, j as imageBlock, k as downloadCtaBlock, l as createCategories, m as CreateS3MediaPluginOptions, n as createEvents, o as createLegalPages, p as createUsers, q as applyGlobalOverride, r as createEventTags, s as createPages, t as createSiteSettings, u as createAuthors, v as richTextEditor, w as languageOptions, x as showcaseContentBlocks, y as blogContentBlocks, z as BuildCmsConfigOptions } from "../index.mjs";
+import { $ as createAccessHelpers, A as downloadCtaBlock, B as seoFields, C as codeBlockLanguages, D as sectionHeadingBlock, E as leafBlocks, F as richTextBlock, G as STOCK_COLLECTION_SLUGS, H as BuildCmsConfigOptions, I as coerceBlogPostCategoriesOnRead, J as GlobalOverride, K as StockCollectionSlug, L as coerceBlogPostCategoriesOnWrite, M as imageBlock, N as codeTabsBlock, O as accordionBlock, P as codeBlock, Q as AccessOptions, R as setPublishedAt, S as showcaseContentBlocks, T as languageOptions, U as buildCmsConfig, V as draftsWithAutosave, W as Overrides, X as applyGlobalOverride, Y as applyCollectionOverride, Z as AccessHelpers, _ as requireEnvAtRuntime, a as createChangelog, b as blogContentBlocks, c as createPages, d as createAuthors, f as createMedia, g as createS3MediaPlugin, h as CreateS3MediaPluginOptions, i as createEventTags, j as videoBlock, k as stepsBlock, l as createBlogPosts, m as createUsers, n as createSiteSettings, o as createChangelogTags, p as createApiTokens, q as CollectionOverride, r as createEvents, s as createLegalPages, t as createAnnouncementBanner, u as createCategories, v as getRichTextEditorConfig, w as defaultCodeLanguage, x as pageContentBlocks, y as richTextEditor, z as slugify } from "../index.mjs";
 import { n as readPayloadMediaAsDataUrl, r as readPayloadMediaBuffer, t as PayloadMedia } from "../readMediaBuffer.mjs";
-export { type AccessHelpers, type AccessOptions, type BuildCmsConfigOptions, type CollectionOverride, type CreateS3MediaPluginOptions, type GlobalOverride, type Overrides, type PayloadMedia, STOCK_COLLECTION_SLUGS, type StockCollectionSlug, accordionBlock, applyCollectionOverride, applyGlobalOverride, blogContentBlocks, buildCmsConfig, codeBlock, codeBlockLanguages, codeTabsBlock, createAccessHelpers, createApiTokens, createAuthors, createBlogPosts, createCategories, createChangelog, createChangelogTags, createEventTags, createEvents, createLegalPages, createMedia, createPages, createS3MediaPlugin, createSiteSettings, createUsers, defaultCodeLanguage, downloadCtaBlock, draftsWithAutosave, getRichTextEditorConfig, imageBlock, languageOptions, leafBlocks, pageContentBlocks, readPayloadMediaAsDataUrl, readPayloadMediaBuffer, requireEnvAtRuntime, richTextBlock, richTextEditor, sectionHeadingBlock, seoFields, setPublishedAt, showcaseContentBlocks, slugify, stepsBlock, videoBlock };
+export { type AccessHelpers, type AccessOptions, type BuildCmsConfigOptions, type CollectionOverride, type CreateS3MediaPluginOptions, type GlobalOverride, type Overrides, type PayloadMedia, STOCK_COLLECTION_SLUGS, type StockCollectionSlug, accordionBlock, applyCollectionOverride, applyGlobalOverride, blogContentBlocks, buildCmsConfig, codeBlock, codeBlockLanguages, codeTabsBlock, coerceBlogPostCategoriesOnRead, coerceBlogPostCategoriesOnWrite, createAccessHelpers, createAnnouncementBanner, createApiTokens, createAuthors, createBlogPosts, createCategories, createChangelog, createChangelogTags, createEventTags, createEvents, createLegalPages, createMedia, createPages, createS3MediaPlugin, createSiteSettings, createUsers, defaultCodeLanguage, downloadCtaBlock, draftsWithAutosave, getRichTextEditorConfig, imageBlock, languageOptions, leafBlocks, pageContentBlocks, readPayloadMediaAsDataUrl, readPayloadMediaBuffer, requireEnvAtRuntime, richTextBlock, richTextEditor, sectionHeadingBlock, seoFields, setPublishedAt, showcaseContentBlocks, slugify, stepsBlock, videoBlock };

package/dist/cms/index.mjs

@@ -1,3 +1,3 @@
-import { A as videoBlock, B as slugify, C as sectionHeadingBlock, D as richTextBlock, E as stepsBlock, F as codeBlockLanguages, H as createAccessHelpers, I as defaultCodeLanguage, L as languageOptions, M as downloadCtaBlock, N as codeTabsBlock, O as getRichTextEditorConfig, P as codeBlock, R as createAuthors, S as showcaseContentBlocks, T as leafBlocks, V as createApiTokens, _ as createBlogPosts, a as applyCollectionOverride, b as blogContentBlocks, c as createUsers, d as createMedia, f as createEvents, g as createCategories, h as createChangelog, i as STOCK_COLLECTION_SLUGS, j as imageBlock, k as richTextEditor, l as createLegalPages, m as createChangelogTags, n as requireEnvAtRuntime, o as applyGlobalOverride, p as createEventTags, r as buildCmsConfig, s as createSiteSettings, t as createS3MediaPlugin, u as createPages, v as draftsWithAutosave, w as accordionBlock, x as pageContentBlocks, y as setPublishedAt, z as seoFields } from "../cms.mjs";
+import { A as richTextBlock, B as languageOptions, C as blogContentBlocks, D as accordionBlock, E as sectionHeadingBlock, F as downloadCtaBlock, G as createAccessHelpers, H as seoFields, I as codeTabsBlock, L as codeBlock, M as richTextEditor, N as videoBlock, O as leafBlocks, P as imageBlock, R as codeBlockLanguages, S as coerceBlogPostCategoriesOnWrite, T as showcaseContentBlocks, U as slugify, V as createAuthors, W as createApiTokens, _ as createCategories, a as STOCK_COLLECTION_SLUGS, b as setPublishedAt, c as createSiteSettings, d as createPages, f as createMedia, g as createChangelog, h as createChangelogTags, i as buildCmsConfig, j as getRichTextEditorConfig, k as stepsBlock, l as createUsers, m as createEventTags, n as createS3MediaPlugin, o as applyCollectionOverride, p as createEvents, r as requireEnvAtRuntime, s as applyGlobalOverride, t as createAnnouncementBanner, u as createLegalPages, v as createBlogPosts, w as pageContentBlocks, x as coerceBlogPostCategoriesOnRead, y as draftsWithAutosave, z as defaultCodeLanguage } from "../cms.mjs";
 import { n as readPayloadMediaBuffer, t as readPayloadMediaAsDataUrl } from "../readMediaBuffer.mjs";
-export { STOCK_COLLECTION_SLUGS, accordionBlock, applyCollectionOverride, applyGlobalOverride, blogContentBlocks, buildCmsConfig, codeBlock, codeBlockLanguages, codeTabsBlock, createAccessHelpers, createApiTokens, createAuthors, createBlogPosts, createCategories, createChangelog, createChangelogTags, createEventTags, createEvents, createLegalPages, createMedia, createPages, createS3MediaPlugin, createSiteSettings, createUsers, defaultCodeLanguage, downloadCtaBlock, draftsWithAutosave, getRichTextEditorConfig, imageBlock, languageOptions, leafBlocks, pageContentBlocks, readPayloadMediaAsDataUrl, readPayloadMediaBuffer, requireEnvAtRuntime, richTextBlock, richTextEditor, sectionHeadingBlock, seoFields, setPublishedAt, showcaseContentBlocks, slugify, stepsBlock, videoBlock };
+export { STOCK_COLLECTION_SLUGS, accordionBlock, applyCollectionOverride, applyGlobalOverride, blogContentBlocks, buildCmsConfig, codeBlock, codeBlockLanguages, codeTabsBlock, coerceBlogPostCategoriesOnRead, coerceBlogPostCategoriesOnWrite, createAccessHelpers, createAnnouncementBanner, createApiTokens, createAuthors, createBlogPosts, createCategories, createChangelog, createChangelogTags, createEventTags, createEvents, createLegalPages, createMedia, createPages, createS3MediaPlugin, createSiteSettings, createUsers, defaultCodeLanguage, downloadCtaBlock, draftsWithAutosave, getRichTextEditorConfig, imageBlock, languageOptions, leafBlocks, pageContentBlocks, readPayloadMediaAsDataUrl, readPayloadMediaBuffer, requireEnvAtRuntime, richTextBlock, richTextEditor, sectionHeadingBlock, seoFields, setPublishedAt, showcaseContentBlocks, slugify, stepsBlock, videoBlock };

package/dist/cms.mjs

@@ -708,6 +708,31 @@ const showcaseContentBlocks = [
 	imageBlock
 ];
 //#endregion
+//#region src/cms/hooks/coerce-blog-post-categories.ts
+function toCategoryIdList(value) {
+	if (value == null || value === "") return [];
+	return (Array.isArray(value) ? value : [value]).map((item) => {
+		if (typeof item === "string" || typeof item === "number") return String(item);
+		if (item && typeof item === "object" && "id" in item && item.id != null) return String(item.id);
+		return null;
+	}).filter((id) => Boolean(id));
+}
+/** Posts saved before `category` became `hasMany` still store a single value. */
+const coerceBlogPostCategoriesOnWrite = ({ data }) => {
+	if (!data || !("category" in data)) return data;
+	data.category = toCategoryIdList(data.category);
+	return data;
+};
+const coerceBlogPostCategoriesOnRead = ({ doc }) => {
+	if (!doc) return doc;
+	if (doc.category == null || doc.category === "") {
+		doc.category = [];
+		return doc;
+	}
+	if (!Array.isArray(doc.category)) doc.category = [doc.category];
+	return doc;
+};
+//#endregion
 //#region src/cms/hooks/set-published-at.ts
 const setPublishedAt = ({ data }) => {
 	if (data && !data.publishedAt && data._status === "published") data.publishedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -746,7 +771,10 @@ function createBlogPosts(access) {
 			delete: access.adminOnly
 		},
 		versions: draftsWithAutosave,
-		hooks: { beforeChange: [setPublishedAt] },
+		hooks: {
+			beforeChange: [setPublishedAt, coerceBlogPostCategoriesOnWrite],
+			afterRead: [coerceBlogPostCategoriesOnRead]
+		},
 		fields: [
 			{
 				name: "title",
@@ -798,6 +826,8 @@ function createBlogPosts(access) {
 				name: "category",
 				type: "relationship",
 				relationTo: "categories",
+				hasMany: true,
+				label: "Categories",
 				admin: { position: "sidebar" }
 			},
 			{
@@ -1468,7 +1498,7 @@ function createUsers(access) {
 	return {
 		slug: "users",
 		admin: { useAsTitle: "email" },
-		auth: true,
+		auth: { verify: false },
 		access: {
 			read: access.adminOnly,
 			create: access.adminOnly,
@@ -1476,7 +1506,29 @@ function createUsers(access) {
 			delete: access.adminOnly,
 			admin: access.adminOnly
 		},
-		fields: []
+		fields: [
+			{
+				name: "googleId",
+				type: "text",
+				unique: true,
+				index: true,
+				admin: {
+					position: "sidebar",
+					readOnly: true,
+					description: "Google OAuth user ID"
+				}
+			},
+			{
+				name: "name",
+				type: "text",
+				admin: { description: "Display name from Google" }
+			},
+			{
+				name: "picture",
+				type: "text",
+				admin: { description: "Profile picture URL from Google" }
+			}
+		]
 	};
 }
 //#endregion
@@ -1644,8 +1696,13 @@ function buildCmsConfig(options) {
 	const collections = [...STOCK_COLLECTION_SLUGS.map((slug) => applyCollectionOverride(stock[slug], overrides[slug])).filter((c) => c !== null), ...options.extraCollections ?? []];
 	const siteSettings = applyGlobalOverride(createSiteSettings(access), overrides["site-settings"]);
 	const globals = [...siteSettings ? [siteSettings] : [], ...options.extraGlobals ?? []];
+	const { jobs: jobsOverride, ...payloadRest } = options.payload ?? {};
 	return buildConfig({
-		...options.payload,
+		...payloadRest,
+		jobs: {
+			autoRun: [{ cron: "* * * * *" }],
+			...jobsOverride
+		},
 		...defined({
 			sharp: options.sharp,
 			cors: options.cors,
@@ -1712,6 +1769,80 @@ function createS3MediaPlugin(options = {}) {
 	});
 }
 //#endregion
-export { videoBlock as A, slugify as B, sectionHeadingBlock as C, richTextBlock as D, stepsBlock as E, codeBlockLanguages as F, createAccessHelpers as H, defaultCodeLanguage as I, languageOptions as L, downloadCtaBlock as M, codeTabsBlock as N, getRichTextEditorConfig as O, codeBlock as P, createAuthors as R, showcaseContentBlocks as S, leafBlocks as T, createApiTokens as V, createBlogPosts as _, applyCollectionOverride as a, blogContentBlocks as b, createUsers as c, createMedia as d, createEvents as f, createCategories as g, createChangelog as h, STOCK_COLLECTION_SLUGS as i, imageBlock as j, richTextEditor as k, createLegalPages as l, createChangelogTags as m, requireEnvAtRuntime as n, applyGlobalOverride as o, createEventTags as p, buildCmsConfig as r, createSiteSettings as s, createS3MediaPlugin as t, createPages as u, draftsWithAutosave as v, accordionBlock as w, pageContentBlocks as x, setPublishedAt as y, seoFields as z };
+//#region src/cms/globals/createAnnouncementBanner.ts
+const validateBannerId = (value, { siblingData }) => {
+	if (siblingData?.enabled && !String(value ?? "").trim()) return "Banner ID is required when the banner is enabled.";
+	return true;
+};
+/** Announcement banner global (no site revalidation — add via applyGlobalOverride hooks). */
+function createAnnouncementBanner(access) {
+	return {
+		slug: "announcement-banner",
+		label: "Announcement Banner",
+		admin: { description: "Sticky site-wide banner shown above the main navigation. Bump Banner ID when replacing content so users who dismissed an older message in the current session see the new one." },
+		access: {
+			read: access.publicRead,
+			update: access.adminOnly
+		},
+		fields: [
+			{
+				name: "enabled",
+				type: "checkbox",
+				defaultValue: false,
+				admin: { description: "When off, the banner is hidden on the public site." }
+			},
+			{
+				name: "bannerId",
+				type: "text",
+				admin: { description: "Stable identifier for this banner version. Change it when publishing new copy so users who dismissed an older banner in this session see the update." },
+				validate: validateBannerId
+			},
+			{
+				type: "row",
+				fields: [{
+					name: "prefix",
+					type: "text",
+					localized: true,
+					maxLength: 8,
+					admin: {
+						width: "25%",
+						description: "Accent label (max 8 characters), e.g. \"New:\""
+					}
+				}, {
+					name: "description",
+					type: "text",
+					localized: true,
+					maxLength: 1e3,
+					admin: {
+						width: "75%",
+						description: "Banner message (max 1000 characters)."
+					}
+				}]
+			},
+			{
+				type: "row",
+				fields: [{
+					name: "ctaLabel",
+					type: "text",
+					localized: true,
+					maxLength: 18,
+					admin: {
+						width: "50%",
+						description: "Optional button label (max 18 characters)."
+					}
+				}, {
+					name: "ctaHref",
+					type: "text",
+					admin: {
+						width: "50%",
+						description: "Optional button URL. Relative paths stay in-site."
+					}
+				}]
+			}
+		]
+	};
+}
+//#endregion
+export { richTextBlock as A, languageOptions as B, blogContentBlocks as C, accordionBlock as D, sectionHeadingBlock as E, downloadCtaBlock as F, createAccessHelpers as G, seoFields as H, codeTabsBlock as I, codeBlock as L, richTextEditor as M, videoBlock as N, leafBlocks as O, imageBlock as P, codeBlockLanguages as R, coerceBlogPostCategoriesOnWrite as S, showcaseContentBlocks as T, slugify as U, createAuthors as V, createApiTokens as W, createCategories as _, STOCK_COLLECTION_SLUGS as a, setPublishedAt as b, createSiteSettings as c, createPages as d, createMedia as f, createChangelog as g, createChangelogTags as h, buildCmsConfig as i, getRichTextEditorConfig as j, stepsBlock as k, createUsers as l, createEventTags as m, createS3MediaPlugin as n, applyCollectionOverride as o, createEvents as p, requireEnvAtRuntime as r, applyGlobalOverride as s, createAnnouncementBanner as t, createLegalPages as u, createBlogPosts as v, pageContentBlocks as w, coerceBlogPostCategoriesOnRead as x, draftsWithAutosave as y, defaultCodeLanguage as z };
 
 //# sourceMappingURL=cms.mjs.map