@vexcms/core 0.0.19 → 0.1.0-alpha.2

package/dist/chunk-2DU7JDEX.js

@@ -0,0 +1,1877 @@
+// src/api/server.ts
+import {
+  paginationOptsValidator
+} from "convex/server";
+import { v } from "convex/values";
+
+// src/api/depth.ts
+function buildDepthPopulate(config, slug, depth, visited = /* @__PURE__ */ new Set()) {
+  if (depth <= 0) return {};
+  const source = config.collections.find((c) => c.slug === slug) ?? config.globals?.find((g) => g.slug === slug);
+  if (!source) return {};
+  const nextVisited = new Set(visited).add(slug);
+  const result = {};
+  for (const [key, field] of Object.entries(source.fields)) {
+    if (field.type !== "relationship") continue;
+    const targetSlug = field.collection.slug;
+    if (depth === 1 || nextVisited.has(targetSlug)) {
+      result[key] = true;
+      continue;
+    }
+    const nested = buildDepthPopulate(config, targetSlug, depth - 1, nextVisited);
+    result[key] = Object.keys(nested).length > 0 ? { populate: nested } : true;
+  }
+  return result;
+}
+
+// ../../node_modules/.pnpm/convex-helpers@0.1.120_@standard-schema+spec@1.1.0_convex@1.44.0_react@19.2.7__hono@4.1_fda37119e0b134c2babc8f4bd1faf097/node_modules/convex-helpers/index.js
+async function asyncMap(list, asyncTransform) {
+  const promises = [];
+  let index = 0;
+  list = await list;
+  for (const item of list) {
+    promises.push(asyncTransform(item, index));
+    index += 1;
+  }
+  return Promise.all(promises);
+}
+
+// ../../node_modules/.pnpm/convex-helpers@0.1.120_@standard-schema+spec@1.1.0_convex@1.44.0_react@19.2.7__hono@4.1_fda37119e0b134c2babc8f4bd1faf097/node_modules/convex-helpers/server/relationships.js
+async function getAll(db, arg1, arg2) {
+  const [table, ids] = arg2 !== void 0 ? [arg1, arg2] : [null, arg1];
+  return table ? asyncMap(ids, (id) => db.get(table, id)) : asyncMap(ids, (id) => db.get(id));
+}
+
+// src/api/populate.ts
+async function populateDocs(ctx, docs, populate) {
+  const result = await asyncMap(docs, async (doc) => {
+    const out = { ...doc };
+    for (const [fieldKey, opts] of Object.entries(populate)) {
+      const ids = doc[fieldKey];
+      if (!Array.isArray(ids)) continue;
+      const targets = await getAll(ctx.db, ids);
+      const filtered = targets.filter((t) => t !== null);
+      if (typeof opts === "object" && opts !== null && "populate" in opts && opts.populate && filtered.length > 0) {
+        out[fieldKey] = await populateDocs(ctx, filtered, opts.populate);
+      } else {
+        out[fieldKey] = filtered;
+      }
+    }
+    return out;
+  });
+  return result;
+}
+
+// src/access/constants.ts
+var CRUD_ACTIONS = {
+  create: "create",
+  read: "read",
+  update: "update",
+  delete: "delete"
+};
+var DRAFT_ACTIONS = {
+  readDrafts: "readDrafts",
+  saveDraft: "saveDraft",
+  publish: "publish",
+  unpublish: "unpublish"
+};
+var QUERY_ACTIONS = {
+  read: CRUD_ACTIONS.read,
+  readDrafts: DRAFT_ACTIONS.readDrafts
+};
+var PERMISSION_MODES = {
+  allow: "allow",
+  deny: "deny"
+};
+var PERMISSION_SCOPES = {
+  doc: "doc",
+  any: "any",
+  all: "all"
+};
+var WILDCARD_KEY = "*";
+var ADMIN_CUSTOM_SUBJECTS = {
+  adminPanel: {
+    key: "adminPanel",
+    actions: ["access", "impersonate"]
+  }
+};
+
+// src/access/types.ts
+import { ConvexError } from "convex/values";
+function dataType() {
+  return {};
+}
+var VexAccessError = class extends ConvexError {
+  /** The subject on which access was denied. */
+  resource;
+  /** The denied action. */
+  action;
+  /**
+   * @param options — Structured denial context.
+   * @param options.message — Human-readable error message.
+   * @param options.resource — Subject name.
+   * @param options.action — Action name.
+   */
+  constructor(options) {
+    super({
+      code: "ACCESS_DENIED",
+      resource: options.resource,
+      action: options.action,
+      message: options.message ?? `Access Denied: ${options.resource}/${options.action}`
+    });
+    this.name = "VexAccessError";
+    this.resource = options.resource;
+    this.action = options.action;
+  }
+};
+var VexAccessConfigError = class extends Error {
+  /** @param message — Human-readable description of the configuration error. */
+  constructor(message) {
+    super(message);
+    this.name = "VexAccessConfigError";
+  }
+};
+
+// src/access/createFilterConstraintBuilder.ts
+function createFilterConstraintBuilder() {
+  const asFilterConstraint = (result) => result;
+  const compare = (op) => (field, value) => ({
+    kind: "compare",
+    field,
+    op,
+    value
+  });
+  const builder = {
+    eq: compare("eq"),
+    neq: compare("neq"),
+    gt: compare("gt"),
+    gte: compare("gte"),
+    lt: compare("lt"),
+    lte: compare("lte"),
+    and: (...nodes) => ({ kind: "and", nodes: nodes.map(asFilterConstraint) }),
+    or: (...nodes) => ({ kind: "or", nodes: nodes.map(asFilterConstraint) }),
+    not: (node) => ({ kind: "not", node: asFilterConstraint(node) })
+  };
+  return builder;
+}
+
+// src/access/createIndexConstraintBuilder.ts
+var CONSTRAINTS = /* @__PURE__ */ Symbol("vex.access.indexConstraints");
+function createIndexConstraintBuilder() {
+  function node(constraints) {
+    const extend = (op, field, value) => node([
+      ...constraints,
+      { field, op, value }
+    ]);
+    return {
+      eq: (field, value) => extend("eq", field, value),
+      gt: (field, value) => extend("gt", field, value),
+      gte: (field, value) => extend("gte", field, value),
+      lt: (field, value) => extend("lt", field, value),
+      lte: (field, value) => extend("lte", field, value),
+      [CONSTRAINTS]: constraints
+    };
+  }
+  return node([]);
+}
+function readIndexConstraints(result) {
+  const carried = result[CONSTRAINTS];
+  return carried ?? [];
+}
+
+// src/access/createAccessQueryBuilder.ts
+var CONDITION = /* @__PURE__ */ Symbol("vex.access.condition");
+function createAccessQueryBuilder() {
+  const conditionNode = (condition) => ({
+    [CONDITION]: condition
+  });
+  const runFilter = (predicate) => predicate(createFilterConstraintBuilder());
+  const builder = {
+    withIndex: (name, range) => {
+      const built = range(createIndexConstraintBuilder());
+      const constraints = readIndexConstraints(built);
+      const base = { index: { name, constraints } };
+      return {
+        ...conditionNode(base),
+        // Continuing with `.filter(…)` produces a NEW condition carrying both
+        // halves; the index-only value the rule already holds is unchanged.
+        filter: (predicate) => conditionNode({ ...base, filter: runFilter(predicate) })
+      };
+    },
+    filter: (predicate) => conditionNode({ filter: runFilter(predicate) })
+  };
+  return builder;
+}
+function readAccessCondition(result) {
+  if (result === null || typeof result !== "object" && typeof result !== "function") {
+    return void 0;
+  }
+  return result[CONDITION];
+}
+
+// src/access/compileConstraints.ts
+function convexValuesEqual(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
+  if (a instanceof ArrayBuffer || b instanceof ArrayBuffer) {
+    if (!(a instanceof ArrayBuffer) || !(b instanceof ArrayBuffer)) return false;
+    if (a.byteLength !== b.byteLength) return false;
+    const left2 = new Uint8Array(a);
+    const right2 = new Uint8Array(b);
+    return left2.every((byte, i) => byte === right2[i]);
+  }
+  if (Array.isArray(a) || Array.isArray(b)) {
+    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+    return a.every((item, i) => convexValuesEqual(item, b[i]));
+  }
+  const left = a;
+  const right = b;
+  const leftKeys = Object.keys(left);
+  if (leftKeys.length !== Object.keys(right).length) return false;
+  return leftKeys.every(
+    (key) => key in right && convexValuesEqual(left[key], right[key])
+  );
+}
+var CONSTRAINT_COMPARATORS = {
+  eq: convexValuesEqual,
+  gt: (a, b) => a > b,
+  gte: (a, b) => a >= b,
+  lt: (a, b) => a < b,
+  lte: (a, b) => a <= b
+};
+function accessConstraintsToIndexRange(props) {
+  return (q) => props.constraints.reduce(
+    (builder, c) => (
+      // Convex's `IndexRangeBuilder` narrows its RETURN TYPE per call, exactly as
+      // `ConstraintBuilder` does — so a dynamic reduce over an untyped op string
+      // needs one cast at this boundary. The static safety already happened when
+      // the rule's `constraints` callback was type-checked, and again at
+      // `defineAccess` time in `validateAccessConstraints`.
+      builder[c.op](
+        c.field,
+        c.value
+      )
+    ),
+    q
+    // Every `IndexRangeBuilder` structurally extends `IndexRange`, including one
+    // with zero calls applied — so an empty constraint list returns `q` itself,
+    // matching Convex's own "no restriction" semantics.
+  );
+}
+function accessConstraintsToFilter(props) {
+  const q = props.q;
+  const [first, ...rest] = props.constraints.map((c) => q[c.op](q.field(c.field), c.value));
+  if (first === void 0) {
+    throw new Error(
+      "accessConstraintsToFilter: `constraints` must be non-empty \u2014 an unrestricted rule is resolved to a boolean before it reaches a compile target."
+    );
+  }
+  return rest.length === 0 ? first : q.and(first, ...rest);
+}
+function accessConstraintsToPredicate(props) {
+  return (doc) => props.constraints.every((c) => CONSTRAINT_COMPARATORS[c.op](doc[c.field], c.value));
+}
+var FILTER_COMPARATORS = {
+  ...CONSTRAINT_COMPARATORS,
+  neq: (a, b) => !convexValuesEqual(a, b)
+};
+function accessFilterTreeToFilter(props) {
+  const q = props.q;
+  function compile(node) {
+    switch (node.kind) {
+      case "compare":
+        return q[node.op](q.field(node.field), node.value);
+      case "and":
+        return q.and(...node.nodes.map(compile));
+      case "or":
+        return q.or(...node.nodes.map(compile));
+      case "not":
+        return q.not(compile(node.node));
+    }
+  }
+  return compile(props.node);
+}
+function accessFilterTreeToPredicate(props) {
+  function evaluate(node, doc) {
+    switch (node.kind) {
+      case "compare":
+        return FILTER_COMPARATORS[node.op](doc[node.field], node.value);
+      case "and":
+        return node.nodes.every((child) => evaluate(child, doc));
+      case "or":
+        return node.nodes.some((child) => evaluate(child, doc));
+      case "not":
+        return !evaluate(node.node, doc);
+    }
+  }
+  return (doc) => evaluate(props.node, doc);
+}
+
+// src/access/hasPermission.ts
+function hasPermission(props) {
+  const { access } = props;
+  if (!access || access === void 0 || !access.enabled) {
+    return true;
+  }
+  const rawRoles = props.user ? props.user[access.userRolesField] : [];
+  const userRoles = typeof rawRoles === "string" ? [rawRoles] : Array.isArray(rawRoles) ? rawRoles.filter((role) => typeof role === "string") : [];
+  const effectiveRoles = userRoles.length === 0 && access.anonRole !== void 0 ? [access.anonRole] : userRoles;
+  const knownRoles = effectiveRoles.filter((role) => access.roles.includes(role));
+  const defaultAllowed = access.defaultPermissionMode === PERMISSION_MODES.allow;
+  let allPermissions;
+  if (knownRoles.length === 0) {
+    allPermissions = false;
+  } else {
+    const resolved = knownRoles.map((userRole) => {
+      const role = access.permissions[userRole];
+      const resource = role?.[props.resource];
+      let check;
+      if (typeof resource === "boolean") {
+        check = resource;
+      } else if (resource !== null && resource !== void 0 && typeof resource === "object") {
+        check = resolveActionCheck({
+          resource,
+          action: props.action
+        }) ?? defaultAllowed;
+      } else {
+        const roleWildcard = role?.[WILDCARD_KEY];
+        check = typeof roleWildcard === "boolean" ? roleWildcard : defaultAllowed;
+      }
+      return resolvePermissionCheck({
+        check,
+        user: props.user,
+        data: props.data,
+        organization: access.orgCollectionSlug !== void 0 ? props.organization : void 0,
+        resource: props.resource,
+        action: props.action,
+        scope: props.scope ?? PERMISSION_SCOPES.all
+      }) ?? defaultAllowed;
+    });
+    allPermissions = resolved.some(Boolean);
+  }
+  if (allPermissions === false) {
+    if (props.throwOnDenied) {
+      throw new VexAccessError({
+        resource: props.resource,
+        action: props.action
+      });
+    }
+    return false;
+  }
+  return true;
+}
+var CAPABILITY_PROBE = /* @__PURE__ */ Symbol("vex.capabilityProbe");
+function isConstrainedCheck(check) {
+  return typeof check === "object" && check !== null && "constraints" in check;
+}
+function resolveConstrainedCheck(props) {
+  const outcome = props.check.constraints({
+    user: props.user,
+    q: createAccessQueryBuilder(),
+    ...props.organization !== void 0 ? { organization: props.organization } : {}
+  });
+  if (typeof outcome === "boolean") return outcome;
+  if (props.data === void 0) {
+    if (props.scope === PERMISSION_SCOPES.any) return true;
+    if (props.scope === PERMISSION_SCOPES.all) return false;
+    throw new VexAccessError({
+      resource: props.resource,
+      action: props.action,
+      message: `hasPermission: "${props.resource}.${props.action}" needs a "data" object (its check is a constraint). Pass "data" for an exact check, or use scope: "any" (nav/list gating) or scope: "all" (bulk actions).`
+    });
+  }
+  const condition = readAccessCondition(outcome);
+  if (condition === void 0) return false;
+  const doc = props.data;
+  const indexHolds = condition.index === void 0 || accessConstraintsToPredicate({ constraints: condition.index.constraints })(doc);
+  const filterHolds = condition.filter === void 0 || accessFilterTreeToPredicate({ node: condition.filter })(doc);
+  if (!indexHolds || !filterHolds) return false;
+  if (props.check.filter === void 0) return true;
+  return resolvePermissionCheck({
+    ...props,
+    check: props.check.filter
+  });
+}
+function resolvePermissionCheck(props) {
+  if (isConstrainedCheck(props.check)) {
+    return resolveConstrainedCheck({
+      ...props,
+      check: props.check
+    });
+  }
+  if (typeof props.check !== "function") {
+    return props.check;
+  }
+  const callbackProps = {
+    user: props.user,
+    data: props.data !== void 0 ? props.data : void 0,
+    organization: props.organization !== void 0 ? props.organization : void 0
+  };
+  if (props.data !== void 0) {
+    const result = props.check(callbackProps);
+    return result === void 0 ? false : result;
+  }
+  try {
+    const probe = new Proxy(
+      {},
+      {
+        get() {
+          throw { [CAPABILITY_PROBE]: true };
+        },
+        has() {
+          throw { [CAPABILITY_PROBE]: true };
+        },
+        ownKeys() {
+          throw { [CAPABILITY_PROBE]: true };
+        }
+      }
+    );
+    const result = props.check({ ...callbackProps, data: probe });
+    return result === void 0 ? false : result;
+  } catch (e) {
+    const touchedData = typeof e === "object" && e !== null && e[CAPABILITY_PROBE] === true;
+    if (!touchedData) throw e;
+    if (props.scope === PERMISSION_SCOPES.any) {
+      return true;
+    }
+    if (props.scope === PERMISSION_SCOPES.all) {
+      return false;
+    }
+    throw new VexAccessError({
+      resource: props.resource,
+      action: props.action,
+      message: `hasPermission: "${props.resource}.${props.action}" needs a "data" object (its check reads the document). Pass "data" for an exact check, or use scope: "any" (nav/list gating) or scope: "all" (bulk actions).`
+    });
+  }
+}
+function resolveActionCheck(props) {
+  if (props.action in props.resource) {
+    return props.resource[props.action];
+  }
+  if (WILDCARD_KEY in props.resource) {
+    return props.resource[WILDCARD_KEY];
+  }
+  return void 0;
+}
+
+// src/access/resolveAccessRule.ts
+function isConstrainedCheck2(check) {
+  return typeof check === "object" && check !== null && "constraints" in check;
+}
+function classifyRole(props) {
+  const defaultAllowed = props.access.defaultPermissionMode === PERMISSION_MODES.allow;
+  const roleRules = props.access.permissions[props.role];
+  const subject = roleRules?.[props.resource];
+  let check;
+  if (typeof subject === "boolean") {
+    check = subject;
+  } else if (subject !== null && subject !== void 0 && typeof subject === "object") {
+    check = resolveActionCheck({
+      resource: subject,
+      action: props.action
+    }) ?? defaultAllowed;
+  } else {
+    const roleWildcard = roleRules?.[WILDCARD_KEY];
+    check = typeof roleWildcard === "boolean" ? roleWildcard : defaultAllowed;
+  }
+  if (check === false) return { kind: "deny" };
+  if (check === true) return { kind: "unrestricted" };
+  if (!isConstrainedCheck2(check)) return { kind: "opaque" };
+  const outcome = check.constraints({
+    user: props.user ?? {},
+    q: createAccessQueryBuilder(),
+    ...props.access.orgCollectionSlug !== void 0 ? { organization: props.organization } : {}
+  });
+  if (outcome === true) return { kind: "unrestricted" };
+  if (outcome === false) return { kind: "deny" };
+  const condition = readAccessCondition(outcome);
+  if (condition === void 0) return { kind: "opaque" };
+  return { kind: "conditional", condition };
+}
+function selectSingleCondition(props) {
+  const { access } = props;
+  const rawRoles = props.user ? props.user[access.userRolesField] : [];
+  const userRoles = typeof rawRoles === "string" ? [rawRoles] : Array.isArray(rawRoles) ? rawRoles.filter((role) => typeof role === "string") : [];
+  const effectiveRoles = userRoles.length === 0 && access.anonRole !== void 0 ? [access.anonRole] : userRoles;
+  const knownRoles = effectiveRoles.filter((role) => access.roles.includes(role));
+  if (knownRoles.length === 0) return void 0;
+  const candidates = [];
+  for (const role of knownRoles) {
+    const contribution = classifyRole({
+      access,
+      role,
+      resource: props.resource,
+      action: props.action,
+      user: props.user,
+      organization: props.organization
+    });
+    if (contribution.kind === "deny") continue;
+    if (contribution.kind === "unrestricted" || contribution.kind === "opaque") return void 0;
+    candidates.push(contribution.condition);
+  }
+  if (candidates.length !== 1) return void 0;
+  return candidates[0];
+}
+function resolveAccessIndex(props) {
+  const access = props.access;
+  if (!access || !access.enabled) return void 0;
+  const condition = selectSingleCondition({
+    access,
+    user: props.user,
+    organization: props.organization,
+    resource: props.resource,
+    action: props.action
+  });
+  if (condition?.index === void 0) return void 0;
+  return {
+    name: condition.index.name,
+    range: accessConstraintsToIndexRange({ constraints: condition.index.constraints })
+  };
+}
+function resolveAccessConstraint(props) {
+  const access = props.access;
+  if (!access || !access.enabled) return void 0;
+  const condition = selectSingleCondition({
+    access,
+    user: props.user,
+    organization: props.organization,
+    resource: props.resource,
+    action: props.action
+  });
+  if (condition === void 0) return void 0;
+  const { index, filter } = condition;
+  const indexConstrains = props.indexAlreadyApplied !== true && index !== void 0 && index.constraints.length > 0;
+  if (indexConstrains && filter !== void 0) {
+    return (q) => q.and(
+      accessConstraintsToFilter({ constraints: index.constraints, q }),
+      accessFilterTreeToFilter({ node: filter, q })
+    );
+  }
+  if (indexConstrains) {
+    return (q) => accessConstraintsToFilter({ constraints: index.constraints, q });
+  }
+  if (filter !== void 0) {
+    return (q) => accessFilterTreeToFilter({ node: filter, q });
+  }
+  return void 0;
+}
+
+// src/access/pickQueryIndex.ts
+var warnedDisplacements = /* @__PURE__ */ new Set();
+function warnDisplacedAccessIndex(props) {
+  if (process.env.NODE_ENV === "production") return;
+  const key = `${props.accessIndexName}\0${props.callerIndexName}`;
+  if (warnedDisplacements.has(key)) return;
+  warnedDisplacements.add(key);
+  console.warn(
+    `[vexcms] Access index "${props.accessIndexName}" cannot be applied: this query already uses "${props.callerIndexName}". Convex permits one index per query, so the access rule falls back to a per-document check and reads scale with the caller's range instead. Declare a compound index covering both fields to serve them in one query.`
+  );
+}
+function composeRanges(props) {
+  const { first, second } = props;
+  if (!first) return second;
+  if (!second) return first;
+  return (q) => second(first(q));
+}
+function pickQueryIndex(props) {
+  const { accessIndex, callerIndex } = props;
+  if (!accessIndex && !callerIndex) return void 0;
+  if (!callerIndex) return accessIndex;
+  if (!accessIndex) return callerIndex;
+  if (accessIndex.name === callerIndex.name) {
+    return {
+      name: accessIndex.name,
+      range: composeRanges({ first: accessIndex.range, second: callerIndex.range })
+    };
+  }
+  warnDisplacedAccessIndex({
+    accessIndexName: accessIndex.name,
+    callerIndexName: callerIndex.name
+  });
+  return callerIndex;
+}
+
+// src/fields/constants.ts
+var ADMIN_FIELDS = {
+  text: {
+    type: "text",
+    interfaceType: "string",
+    validator: "v.string()",
+    defaultValue: ""
+  },
+  url: {
+    type: "url",
+    interfaceType: "string",
+    validator: "v.string()",
+    defaultValue: ""
+  },
+  color: {
+    type: "color",
+    interfaceType: "string",
+    validator: "v.string()",
+    defaultValue: ""
+  },
+  number: {
+    type: "number",
+    interfaceType: "number",
+    validator: "v.number()",
+    defaultValue: 0
+  },
+  checkbox: {
+    type: "checkbox",
+    interfaceType: "boolean",
+    validator: "v.boolean()",
+    defaultValue: false
+  },
+  date: {
+    type: "date",
+    interfaceType: "number",
+    validator: "v.number()",
+    defaultValue: void 0
+  },
+  select: {
+    type: "select",
+    interfaceType: "string[]",
+    validator: "v.array(\nv.string()\n)",
+    defaultValue: []
+  },
+  relationship: {
+    type: "relationship",
+    interfaceType: "Id<CollectionSlug>[]",
+    validator: "v.array(\nv.string()\n)",
+    defaultValue: []
+  },
+  array: {
+    type: "array",
+    interfaceType: "unknown[]",
+    validator: "v.array(\nv.any()\n)",
+    defaultValue: []
+  },
+  group: {
+    type: "group",
+    interfaceType: "Record<string, any>",
+    validator: "v.object({})",
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    defaultValue: {}
+  },
+  blocks: {
+    type: "blocks",
+    interfaceType: "Record<string, any>[]",
+    // placeholder - blocks() overridses per instance
+    validator: "v.array(v.any())",
+    // placeholder - blocksFieldToValidator builds dynamically
+    defaultValue: []
+  },
+  upload: {
+    type: "upload",
+    interfaceType: "Id<MediaCollectionSlug>[]",
+    validator: "v.array(\nv.string()\n)",
+    defaultValue: void 0
+  }
+  // richtext: {
+  //   type: "richtext",
+  //   validator: "v.any()",
+  //   defaultValue: {},
+  // },
+};
+
+// src/api/utils.ts
+function resolveAccessCall(props) {
+  const configured = props.config?.access;
+  const bypassed = props.access?.bypass === true;
+  const action = props.access?.action ?? props.defaultAction;
+  if (process.env.NODE_ENV !== "production") {
+    if (bypassed && configured === void 0) {
+      console.warn(
+        `[vexcms] access.bypass was set for "${props.resource}" but this call has no access config, so RBAC was already off and the flag changed nothing. Either drop it, or check that the call receives the config you expect.`
+      );
+    }
+    if (!bypassed && props.access?.action !== void 0 && configured !== void 0) {
+      const declaredForResource = configured.customActions?.[props.resource];
+      const declared = /* @__PURE__ */ new Set([
+        ...Object.values(CRUD_ACTIONS),
+        ...Object.values(DRAFT_ACTIONS),
+        ...declaredForResource?.query ?? [],
+        ...declaredForResource?.mutation ?? []
+      ]);
+      if (!declared.has(action)) {
+        console.warn(
+          `[vexcms] Action "${action}" is not declared for "${props.resource}": it is neither a built-in verb nor listed in customActions["${props.resource}"]. No rule can name it, so this call resolves to a denial. Check for a typo.`
+        );
+      }
+    }
+  }
+  return { access: bypassed ? void 0 : configured, action, resource: props.resource };
+}
+function resolveCollectionSlug(props) {
+  for (const c of props.config?.collections ?? []) {
+    if (props.ctx.db.normalizeId(c.slug, props.id) !== null) {
+      return c.slug;
+    }
+  }
+  throw new Error("[resolveCollectionSlug]: document id does not match a collection slug");
+}
+
+// src/api/find/server.ts
+async function find(args) {
+  const { access, action, resource } = resolveAccessCall({
+    config: args.config,
+    access: args.access,
+    defaultAction: CRUD_ACTIONS.read,
+    resource: args.collection
+  });
+  const accessIndex = resolveAccessIndex({
+    access,
+    user: args.auth?.user ?? null,
+    organization: args.auth?.organization,
+    resource,
+    action
+  });
+  const callerIndex = args.withIndex;
+  const resolvedIndex = pickQueryIndex({ accessIndex, callerIndex });
+  const accessFilter = resolveAccessConstraint({
+    access,
+    user: args.auth?.user ?? null,
+    organization: args.auth?.organization,
+    resource,
+    action,
+    indexAlreadyApplied: accessIndex !== void 0 && resolvedIndex?.name === accessIndex.name
+  });
+  const findQuery = buildQuery({
+    ...args,
+    resolvedIndex,
+    accessFilter
+  });
+  let docs;
+  let convexPaginationResult;
+  if (args.paginationOpts) {
+    convexPaginationResult = await findQuery.paginate(args.paginationOpts);
+    docs = convexPaginationResult.page.filter(
+      (d) => hasPermission({
+        access,
+        resource,
+        action,
+        data: d,
+        user: args.auth?.user ?? {},
+        organization: args.auth?.organization
+      })
+    );
+  } else if (args.limit) {
+    docs = (await findQuery.take(args.limit)).filter(
+      (d) => hasPermission({
+        access,
+        resource,
+        action,
+        data: d,
+        user: args.auth?.user ?? {},
+        organization: args.auth?.organization
+      })
+    );
+  } else {
+    docs = (await findQuery.collect()).filter(
+      (d) => hasPermission({
+        access,
+        resource,
+        action,
+        data: d,
+        user: args.auth?.user ?? {},
+        organization: args.auth?.organization
+      })
+    );
+  }
+  const effectivePopulate = args.populate ?? (args.depth !== void 0 && args.depth > 0 && args.config ? buildDepthPopulate(args.config, args.collection, args.depth) : void 0);
+  const finalDocs = !effectivePopulate || Object.keys(effectivePopulate).length === 0 ? docs : await populateDocs(args.ctx, docs, effectivePopulate);
+  if (args.paginationOpts && convexPaginationResult) {
+    if (args.paginationOpts.totalDocs && !args.paginationOpts.cursor) {
+      try {
+        if (convexPaginationResult.isDone) {
+          return {
+            ...convexPaginationResult,
+            page: finalDocs,
+            totalDocs: finalDocs.length
+          };
+        } else {
+          const countQuery = buildQuery({
+            ...args,
+            resolvedIndex,
+            accessFilter
+          });
+          const totalDocs = (await countQuery.collect()).filter(
+            (d) => hasPermission({
+              access,
+              resource,
+              action,
+              data: d,
+              user: args.auth?.user ?? {},
+              organization: args.auth?.organization
+            })
+          );
+          return {
+            ...convexPaginationResult,
+            page: finalDocs,
+            totalDocs: totalDocs.length
+          };
+        }
+      } catch (error) {
+        console.warn("Failed to collect all documents:", error);
+        return {
+          ...convexPaginationResult,
+          page: finalDocs,
+          totalDocs: null
+          // Signals "too large to count"
+        };
+      }
+    }
+    return {
+      ...convexPaginationResult,
+      page: finalDocs
+    };
+  }
+  return finalDocs;
+}
+function buildQuery(props) {
+  const tableName = props.collection;
+  let q = props.ctx.db.query(tableName);
+  if (props.resolvedIndex) {
+    q = props.resolvedIndex.range ? q.withIndex(props.resolvedIndex.name, props.resolvedIndex.range) : q.withIndex(props.resolvedIndex.name);
+  }
+  if (props.order) q = q.order(props.order);
+  if (props.accessFilter && props.filter) {
+    q = q.filter((filterQ) => filterQ.and(props.accessFilter(filterQ), props.filter(filterQ)));
+  } else if (props.accessFilter) {
+    q = q.filter(props.accessFilter);
+  } else if (props.filter) {
+    q = q.filter(props.filter);
+  }
+  return q;
+}
+
+// src/api/get/server.ts
+async function get(args) {
+  const doc = await args.ctx.db.get(args.id);
+  if (doc && args.config?.access !== void 0) {
+    const { access, action, resource } = resolveAccessCall({
+      config: args.config,
+      access: args.access,
+      defaultAction: CRUD_ACTIONS.read,
+      resource: args.collection
+    });
+    hasPermission({
+      throwOnDenied: true,
+      access,
+      user: args.auth?.user ?? {},
+      organization: args.auth?.organization,
+      resource,
+      action,
+      data: doc
+    });
+  }
+  const effectivePopulate = args.populate ?? (args.depth !== void 0 && args.depth > 0 && args.config && args.collection ? buildDepthPopulate(args.config, args.collection, args.depth) : void 0);
+  if (!effectivePopulate || !doc) {
+    return doc;
+  }
+  const [populated] = await populateDocs(
+    args.ctx,
+    [doc],
+    effectivePopulate
+  );
+  return populated ?? null;
+}
+
+// src/api/search/server.ts
+async function search(args) {
+  const { access, action, resource } = resolveAccessCall({
+    config: args.config,
+    access: args.access,
+    defaultAction: CRUD_ACTIONS.read,
+    resource: args.collection
+  });
+  const accessFilter = resolveAccessConstraint({
+    access,
+    user: args.auth?.user ?? null,
+    organization: args.auth?.organization,
+    resource,
+    action
+  });
+  const searchQuery = buildQuery2({
+    ...args,
+    accessFilter
+  });
+  let docs;
+  let convexPaginationResult;
+  if (args.paginationOpts) {
+    convexPaginationResult = await searchQuery.paginate(args.paginationOpts);
+    docs = convexPaginationResult.page.filter(
+      (d) => hasPermission({
+        access,
+        user: args.auth?.user ?? {},
+        organization: args.auth?.organization,
+        resource,
+        action,
+        data: d
+      })
+    );
+  } else if (args.limit) {
+    docs = (await searchQuery.take(args.limit)).filter(
+      (d) => hasPermission({
+        access,
+        user: args.auth?.user ?? {},
+        organization: args.auth?.organization,
+        resource,
+        action,
+        data: d
+      })
+    );
+  } else {
+    docs = (await searchQuery.collect()).filter(
+      (d) => hasPermission({
+        access,
+        user: args.auth?.user ?? {},
+        organization: args.auth?.organization,
+        resource,
+        action,
+        data: d
+      })
+    );
+  }
+  const effectivePopulate = args.populate ?? (args.depth !== void 0 && args.depth > 0 && args.config ? buildDepthPopulate(args.config, args.collection, args.depth) : void 0);
+  const finalDocs = !effectivePopulate || Object.keys(effectivePopulate).length === 0 ? docs : await populateDocs(args.ctx, docs, effectivePopulate);
+  if (args.paginationOpts) {
+    if (args.paginationOpts.totalDocs && !args.paginationOpts.cursor) {
+      try {
+        const countQuery = buildQuery2(args);
+        const allDocs = (await countQuery.collect()).filter(
+          (d) => hasPermission({
+            access,
+            user: args.auth?.user ?? {},
+            organization: args.auth?.organization,
+            resource,
+            action,
+            data: d
+          })
+        );
+        if (convexPaginationResult) {
+          return {
+            ...convexPaginationResult,
+            page: finalDocs,
+            totalDocs: allDocs.length
+          };
+        }
+      } catch (error) {
+        console.warn("Failed to count search results:", error);
+        if (convexPaginationResult) {
+          return {
+            ...convexPaginationResult,
+            page: finalDocs,
+            totalDocs: null
+          };
+        }
+      }
+    }
+    if (convexPaginationResult) {
+      return {
+        ...convexPaginationResult,
+        page: finalDocs
+      };
+    }
+  }
+  return finalDocs;
+}
+function buildQuery2(args) {
+  let q = args.ctx.db.query(args.collection);
+  if (args.query) {
+    q = q.withSearchIndex(args.searchIndexName, (q2) => q2.search(args.searchField, args.query));
+  }
+  if (args.accessFilter && args.filter) {
+    q = q.filter((fq) => fq.and(args.accessFilter(fq), args.filter(fq)));
+  } else if (args.accessFilter) {
+    q = q.filter(args.accessFilter);
+  } else if (args.filter) {
+    q = q.filter(args.filter);
+  }
+  return q;
+}
+
+// src/api/create/server.ts
+async function create(args) {
+  if (args.config.access !== void 0) {
+    const { access, action, resource } = resolveAccessCall({
+      config: args.config,
+      access: args.access,
+      defaultAction: CRUD_ACTIONS.create,
+      resource: args.collection
+    });
+    hasPermission({
+      access,
+      user: args.auth?.user ?? {},
+      organization: args.auth?.organization,
+      resource,
+      action,
+      data: args.data,
+      throwOnDenied: true
+    });
+  }
+  const id = await args.ctx.db.insert(
+    args.collection,
+    args.data
+  );
+  return id;
+}
+
+// src/api/update/server.ts
+async function update(args) {
+  if (args.config.access !== void 0) {
+    const doc = await args.ctx.db.get(args.id);
+    const { access, action, resource } = resolveAccessCall({
+      config: args.config,
+      access: args.access,
+      defaultAction: CRUD_ACTIONS.update,
+      resource: args.collection
+    });
+    hasPermission({
+      throwOnDenied: true,
+      access,
+      user: args.auth?.user ?? {},
+      organization: args.auth?.organization,
+      resource,
+      action,
+      data: doc ?? void 0
+    });
+  }
+  await args.ctx.db.patch(args.id, args.data);
+}
+
+// src/api/remove/server.ts
+async function remove(args) {
+  async function removeById(id) {
+    if (args.config.access !== void 0) {
+      const doc = await args.ctx.db.get(id);
+      const { access, action, resource } = resolveAccessCall({
+        config: args.config,
+        access: args.access,
+        defaultAction: CRUD_ACTIONS.delete,
+        resource: args.collection
+      });
+      hasPermission({
+        throwOnDenied: true,
+        access,
+        user: args.auth?.user ?? {},
+        organization: args.auth?.organization,
+        resource,
+        action,
+        data: doc ?? void 0
+      });
+    }
+    if (args.softDelete) {
+      return await args.ctx.db.patch(args.collection, id, { [args.softDelete]: true });
+    }
+    return await args.ctx.db.delete(args.collection, id);
+  }
+  await Promise.all(args.ids.map((id) => removeById(id)));
+}
+
+// src/api/globals/get.server.ts
+function flattenGlobalRow(row) {
+  const { slug, data, _id, _creationTime } = row;
+  return { _id, _creationTime, _slug: slug, ...data ?? {} };
+}
+async function getGlobal(args) {
+  const { ctx, slug, populate, depth, config } = args;
+  const row = await ctx.db.query("vex_globals").withIndex("by_slug", (q) => q.eq("slug", slug)).first();
+  if (!row) return null;
+  let flat = flattenGlobalRow(row);
+  if (args.config?.access !== void 0) {
+    const { access, action, resource } = resolveAccessCall({
+      config: args.config,
+      access: args.access,
+      defaultAction: CRUD_ACTIONS.read,
+      resource: args.slug
+    });
+    hasPermission({
+      throwOnDenied: true,
+      user: args.auth?.user ?? {},
+      organization: args.auth?.organization,
+      access,
+      resource,
+      action,
+      data: flat
+    });
+  }
+  if (depth && depth > 0 && config) {
+    const globalConfig = config.globals.find((g) => g.slug === slug);
+    if (globalConfig) {
+      const depthPopulate = buildDepthPopulate(config, slug, depth);
+      if (depthPopulate && Object.keys(depthPopulate).length > 0) {
+        const [populated] = await populateDocs(ctx, [flat], depthPopulate);
+        flat = populated;
+      }
+    }
+  }
+  if (populate && Object.keys(populate).length > 0) {
+    const [populated] = await populateDocs(ctx, [flat], populate);
+    flat = populated;
+  }
+  return flat;
+}
+
+// src/api/globals/find.server.ts
+async function findGlobals(args) {
+  const { ctx } = args;
+  let rows = await ctx.db.query("vex_globals").collect();
+  if (args.config.access !== void 0) {
+    rows = rows.filter((r) => {
+      const { access, action, resource } = resolveAccessCall({
+        config: args.config,
+        access: args.access,
+        defaultAction: CRUD_ACTIONS.read,
+        resource: r.slug
+      });
+      return hasPermission({
+        access,
+        user: args.auth?.user ?? {},
+        organization: args.auth?.organization,
+        resource,
+        action,
+        data: r.data
+      });
+    });
+  }
+  return rows.map((row) => {
+    const { slug, data, _id, _creationTime } = row;
+    return { _id, _creationTime, _slug: slug, ...data ?? {} };
+  });
+}
+
+// src/api/globals/upsert.server.ts
+import { ConvexError as ConvexError2 } from "convex/values";
+
+// src/globals/utils.ts
+import { z as z13 } from "zod";
+
+// src/fields/text/inputSchema.ts
+import { z } from "zod";
+
+// src/fields/inputSchemas/utils.ts
+function applyBaseInputSchemaMeta(props) {
+  const { field, inputSchema } = props;
+  const fieldMeta = {
+    fieldType: field.type,
+    label: field.label,
+    description: field.description ?? ""
+  };
+  if (!field.required) {
+    return inputSchema.meta(fieldMeta).optional();
+  }
+  return inputSchema.meta(fieldMeta);
+}
+
+// src/fields/text/inputSchema.ts
+function textFieldToInputSchema(props) {
+  const { field } = props;
+  const fieldMinError = field.min?.error ?? "This field is too short.";
+  const fieldMaxError = field.max?.error ?? "This field is too long.";
+  let inputSchema = z.string().default(field.defaultValue);
+  if (field.required) {
+    inputSchema = z.string().min(1, "This field is required.").default(field.defaultValue);
+  }
+  if (field.min) {
+    if (field.max) {
+      inputSchema = z.string().min(field.min.value, fieldMinError).max(field.max.value, fieldMaxError).default(field.defaultValue);
+    } else {
+      inputSchema = z.string().min(field.min.value, fieldMinError).default(field.defaultValue);
+    }
+  } else if (field.max) {
+    inputSchema = z.string().max(field.max.value, fieldMaxError).default(field.defaultValue);
+  }
+  return applyBaseInputSchemaMeta({ field, inputSchema });
+}
+
+// src/fields/number/inputSchema.ts
+import { z as z2 } from "zod";
+function numberFieldToInputSchema(props) {
+  const { field } = props;
+  const fieldMinError = field.min?.error ?? "This field is too small.";
+  const fieldMaxError = field.max?.error ?? "This field is too large.";
+  let inputSchema = z2.number().default(field.defaultValue);
+  if (field.min) {
+    let defaultValue = field.defaultValue < field.min.value ? field.min.value : field.defaultValue;
+    if (field.max) {
+      if (field.defaultValue > field.max.value) {
+        defaultValue = field.min.value;
+      }
+      inputSchema = z2.number().min(field.min.value, fieldMinError).max(field.max.value, fieldMaxError).default(defaultValue);
+    } else {
+      inputSchema = z2.number().min(field.min.value, fieldMinError).default(defaultValue);
+    }
+  } else if (field.max) {
+    let defaultValue = field.defaultValue > field.max.value ? field.max.value : field.defaultValue;
+    inputSchema = z2.number().max(field.max.value, fieldMaxError).default(defaultValue);
+  }
+  return applyBaseInputSchemaMeta({ field, inputSchema });
+}
+
+// src/fields/checkbox/inputSchema.ts
+import { z as z3 } from "zod";
+function checkboxFieldToInputSchema(props) {
+  const { field } = props;
+  const inputSchema = z3.boolean().default(field.defaultValue);
+  return applyBaseInputSchemaMeta({ field, inputSchema });
+}
+
+// src/fields/date/inputSchema.ts
+import { z as z4 } from "zod";
+function dateFieldToInputSchema(props) {
+  const { field } = props;
+  let inputSchema = z4.number();
+  if (field.required) {
+    inputSchema = z4.number().default((/* @__PURE__ */ new Date()).getTime());
+  }
+  return applyBaseInputSchemaMeta({ field, inputSchema });
+}
+
+// src/fields/select/inputSchema.ts
+import { z as z5 } from "zod";
+function selectFieldToInputSchema(props) {
+  const { field } = props;
+  const optionValues = field.options.map((o) => o.value);
+  const itemSchema = optionValues.length > 0 ? z5.enum(optionValues) : z5.string();
+  let inputSchema = z5.array(itemSchema).default(field.defaultValue);
+  if (!field.hasMany) {
+    inputSchema = z5.array(itemSchema).max(1, "Only one value may be selected.").default(field.defaultValue);
+  }
+  return applyBaseInputSchemaMeta({ field, inputSchema });
+}
+
+// src/fields/url/inputSchema.ts
+import { z as z6 } from "zod";
+function urlFieldToInputSchema(props) {
+  const { field } = props;
+  let inputSchema = z6.url();
+  if (field.required) {
+    inputSchema = z6.url().min(1, "This field is required.");
+    if (field.defaultValue) {
+      inputSchema = z6.url().min(1, "This field is required.").default(field.defaultValue);
+    }
+  } else if (field.defaultValue !== void 0) {
+    inputSchema = z6.union([z6.url(), z6.literal("")]).default(field.defaultValue);
+  }
+  return applyBaseInputSchemaMeta({ field, inputSchema });
+}
+
+// src/fields/color/formats.ts
+var COLOR_FORMATS = {
+  hex: {
+    format: "hex",
+    /** `#E8622A`, `#E8622A80`. Shorthand is rejected — the picker never emits it. */
+    pattern: /^#[0-9a-fA-F]{6}(?:[0-9a-fA-F]{2})?$/
+  },
+  rgb: {
+    format: "rgb",
+    /** `rgb(232, 98, 42)`, `rgba(232, 98, 42, 0.5)`. */
+    pattern: /^rgba?\(\s*\d{1,3}\s*,\s*\d{1,3}\s*,\s*\d{1,3}\s*(?:,\s*(?:0|1|0?\.\d+)\s*)?\)$/
+  },
+  hsl: {
+    format: "hsl",
+    /** `hsl(17.7, 81%, 54%)`, `hsla(17.7, 81%, 54%, 0.5)`. */
+    pattern: /^hsla?\(\s*-?\d+(?:\.\d+)?\s*,\s*\d+(?:\.\d+)?%\s*,\s*\d+(?:\.\d+)?%\s*(?:,\s*(?:0|1|0?\.\d+)\s*)?\)$/
+  },
+  oklch: {
+    format: "oklch",
+    /** `oklch(65.7% 0.179 40.9)`, `oklch(65.7% 0.179 40.9 / 0.5)`. */
+    pattern: /^oklch\(\s*\d+(?:\.\d+)?%\s+\d+(?:\.\d+)?\s+-?\d+(?:\.\d+)?\s*(?:\/\s*(?:0|1|0?\.\d+)\s*)?\)$/
+  }
+};
+var COLOR_FORMAT_PATTERNS = Object.values(COLOR_FORMATS).map((f) => f.pattern);
+var CSS_VAR_REFERENCE = /^var\(--[A-Za-z0-9_-]+\)$/;
+
+// src/fields/color/inputSchema.ts
+import { z as z7 } from "zod";
+var FORMAT_EXAMPLES = {
+  hex: "#E8622A",
+  rgb: "rgb(232, 98, 42)",
+  hsl: "hsl(17.7, 81%, 54%)",
+  oklch: "oklch(65.7% 0.179 40.9)"
+};
+function colorPattern(props) {
+  const sources = COLOR_FORMAT_PATTERNS.map((pattern) => pattern.source);
+  if (props.themeColors) sources.push(CSS_VAR_REFERENCE.source);
+  return new RegExp(sources.join("|"));
+}
+function colorMessage(props) {
+  const example = FORMAT_EXAMPLES[props.field.format];
+  const base = `Enter a colour, e.g. ${example}.`;
+  if (!props.field.themeColors) return base;
+  return `${base} A theme token such as var(--primary) is also accepted.`;
+}
+function colorFieldToInputSchema(props) {
+  const { field } = props;
+  const pattern = colorPattern({ themeColors: field.themeColors });
+  const message = colorMessage({ field });
+  let inputSchema = z7.string().regex(pattern, message);
+  if (field.required) {
+    inputSchema = z7.string().min(1, "This field is required.").regex(pattern, message);
+    if (field.defaultValue) {
+      inputSchema = inputSchema.default(field.defaultValue);
+    }
+  } else if (field.defaultValue !== void 0) {
+    inputSchema = z7.union([z7.string().regex(pattern, message), z7.literal("")]).default(field.defaultValue);
+  }
+  return applyBaseInputSchemaMeta({ field, inputSchema });
+}
+
+// src/fields/relationship/inputSchema.ts
+import { z as z8 } from "zod";
+function relationshipFieldToInputSchema(props) {
+  const { field } = props;
+  const inputSchema = z8.array(z8.string()).default(ADMIN_FIELDS.relationship.defaultValue);
+  return applyBaseInputSchemaMeta({ field, inputSchema });
+}
+
+// src/fields/array/inputSchema.ts
+import { z as z12 } from "zod";
+
+// src/fields/group/inputSchema.ts
+import { z as z9 } from "zod";
+function groupFieldToInputSchema(props) {
+  const { field } = props;
+  const subSchemas = Object.fromEntries(
+    Object.entries(field.fields).map(([key, subField]) => [
+      key,
+      adminFieldToInputSchema({ field: subField })
+    ])
+  );
+  const schema = z9.object(subSchemas).default(field.defaultValue ?? {});
+  return applyBaseInputSchemaMeta({ field, inputSchema: schema });
+}
+
+// src/fields/blocks/inputSchema.ts
+import { z as z10 } from "zod";
+function blocksFieldToInputSchema(props) {
+  const { field } = props;
+  const blockSchemas = field.blocks.map((block) => {
+    const userSubSchemas = Object.fromEntries(
+      Object.entries(block.fields).map(([key, subField]) => [
+        key,
+        adminFieldToInputSchema({ field: subField })
+      ])
+    );
+    return z10.object({
+      blockType: z10.literal(block.blockType),
+      blockName: z10.string().optional(),
+      id: z10.string(),
+      ...userSubSchemas
+    });
+  });
+  const itemSchema = blockSchemas.length <= 1 ? blockSchemas[0] ?? z10.object({ blockType: z10.string(), id: z10.string() }) : (
+    // @ts-expect-error mismatched zod types, works in practice
+    z10.discriminatedUnion("blockType", blockSchemas)
+  );
+  let schema = z10.array(itemSchema);
+  if (field.min) {
+    schema = schema.min(field.min, `At least ${field.min} ${field.labels.plural} required.`);
+  }
+  if (field.max) {
+    schema = schema.max(field.max, `No more than ${field.max} ${field.labels.plural} allowed.`);
+  }
+  schema = schema.default(field.defaultValue ?? []);
+  return applyBaseInputSchemaMeta({ field, inputSchema: schema });
+}
+
+// src/fields/upload/inputSchema.ts
+import { z as z11 } from "zod";
+function uploadFieldToInputSchema(props) {
+  const inputSchema = z11.array(z11.string());
+  return applyBaseInputSchemaMeta({ field: props.field, inputSchema });
+}
+
+// src/fields/inputSchemas/index.ts
+function adminFieldToInputSchema(props) {
+  const fieldType = props.field.type;
+  switch (props.field.type) {
+    case ADMIN_FIELDS.text.type:
+      return textFieldToInputSchema({ field: props.field });
+    case ADMIN_FIELDS.number.type:
+      return numberFieldToInputSchema({ field: props.field });
+    case ADMIN_FIELDS.checkbox.type:
+      return checkboxFieldToInputSchema({ field: props.field });
+    case ADMIN_FIELDS.date.type:
+      return dateFieldToInputSchema({ field: props.field });
+    case ADMIN_FIELDS.select.type:
+      return selectFieldToInputSchema({ field: props.field });
+    case ADMIN_FIELDS.url.type:
+      return urlFieldToInputSchema({ field: props.field });
+    case ADMIN_FIELDS.color.type:
+      return colorFieldToInputSchema({ field: props.field });
+    case ADMIN_FIELDS.relationship.type:
+      return relationshipFieldToInputSchema({ field: props.field });
+    case ADMIN_FIELDS.array.type:
+      return arrayFieldToInputSchema({ field: props.field });
+    case ADMIN_FIELDS.group.type:
+      return groupFieldToInputSchema({ field: props.field });
+    case ADMIN_FIELDS.blocks.type:
+      return blocksFieldToInputSchema({ field: props.field });
+    case ADMIN_FIELDS.upload.type:
+      return uploadFieldToInputSchema({ field: props.field });
+    default: {
+      const unhandled = props.field;
+      throw new Error(
+        `unrecognized field type: ${fieldType} \u2014 ${JSON.stringify(unhandled)}`
+      );
+    }
+  }
+}
+
+// src/fields/array/inputSchema.ts
+function arrayFieldToInputSchema(props) {
+  const { field } = props;
+  const fieldMinError = field.min?.error ?? "This field is too short.";
+  const fieldMaxError = field.max?.error ?? "This field is too long.";
+  const itemsInputSchema = adminFieldToInputSchema({ field: field.items });
+  let inputSchema = z12.array(itemsInputSchema).default(field.defaultValue ?? []);
+  if (field.required) {
+    inputSchema = z12.array(itemsInputSchema).superRefine((val, ctx) => {
+      if (val === void 0 || val === null) {
+        ctx.addIssue({
+          code: "custom",
+          message: "This field is required."
+        });
+      }
+    }).default(field.defaultValue ?? []);
+  }
+  if (field.min) {
+    if (field.max) {
+      inputSchema = z12.array(itemsInputSchema).min(field.min.value, fieldMinError).max(field.max.value, fieldMaxError).default(field.defaultValue ?? []);
+    } else {
+      inputSchema = z12.array(itemsInputSchema).min(field.min.value, fieldMinError).default(field.defaultValue ?? []);
+    }
+  } else if (field.max) {
+    inputSchema = z12.array(itemsInputSchema).max(field.max.value, fieldMaxError).default(field.defaultValue ?? []);
+  }
+  let finalSchema = inputSchema;
+  if (!field.required && field.defaultValue !== void 0) {
+    finalSchema = inputSchema.default(field.defaultValue);
+  }
+  finalSchema = applyBaseInputSchemaMeta({
+    field,
+    inputSchema: finalSchema
+  });
+  return finalSchema;
+}
+
+// src/globals/utils.ts
+function getGlobalDefaultValues(props) {
+  const res = {};
+  for (const [fieldKey, fieldDef] of Object.entries(props.global.fields)) {
+    if (fieldDef.admin.hidden) continue;
+    if (props.document && Boolean(props.document[fieldKey])) {
+      res[fieldKey] = props.document[fieldKey];
+    } else {
+      res[fieldKey] = fieldDef.defaultValue;
+    }
+  }
+  return res;
+}
+function getGlobalInputSchema(props) {
+  const res = {};
+  for (const [fieldKey, fieldDef] of Object.entries(props.global.fields)) {
+    if (fieldDef.admin.hidden) continue;
+    res[fieldKey] = adminFieldToInputSchema({ field: fieldDef });
+  }
+  return z13.object({ ...res });
+}
+
+// src/api/globals/upsert.server.ts
+var STRIPPED_KEYS = /* @__PURE__ */ new Set(["_id", "_creationTime", "_slug"]);
+async function upsertGlobal(args) {
+  const { ctx, slug, data } = args;
+  const globalConfig = args.config.globals.find((g) => g.slug === args.slug);
+  if (!globalConfig) {
+    throw new ConvexError2(`No global registered with slug "${args.slug}"`);
+  }
+  if (args.config.access !== void 0) {
+    const { access, action, resource } = resolveAccessCall({
+      config: args.config,
+      access: args.access,
+      defaultAction: CRUD_ACTIONS.read,
+      resource: args.slug
+    });
+    hasPermission({
+      throwOnDenied: true,
+      access,
+      user: args.auth?.user ?? {},
+      organization: args.auth?.organization,
+      resource,
+      action
+    });
+  }
+  const userFields = {};
+  for (const [k, v2] of Object.entries(data)) {
+    if (!STRIPPED_KEYS.has(k)) userFields[k] = v2;
+  }
+  const schema = getGlobalInputSchema({ global: globalConfig });
+  const result = schema.safeParse(userFields);
+  if (!result.success) {
+    throw new ConvexError2({
+      message: "Global validation failed",
+      errors: result.error.message
+    });
+  }
+  const existingGlobal = await ctx.db.query("vex_globals").withIndex("by_slug", (q) => q.eq("slug", slug)).first();
+  if (existingGlobal) {
+    await ctx.db.patch(existingGlobal._id, { data: result.data });
+    return existingGlobal._id;
+  }
+  const id = await ctx.db.insert("vex_globals", {
+    slug,
+    data: result.data
+  });
+  return id;
+}
+
+// src/api/server.ts
+function collectionsApi({
+  config,
+  query,
+  mutation,
+  getAuth
+}) {
+  return {
+    find: query({
+      args: {
+        collection: v.string(),
+        populate: v.optional(v.any()),
+        depth: v.optional(v.number()),
+        limit: v.optional(v.number()),
+        paginationOpts: v.optional(
+          paginationOptsValidator.extend({ totalDocs: v.optional(v.boolean()) })
+        )
+      },
+      handler: async (ctx, args) => {
+        const auth = await resolveGetAuth({ ctx, config, getAuth });
+        return await find({
+          ctx,
+          auth,
+          collection: args.collection,
+          populate: args.populate,
+          depth: args.depth,
+          config,
+          limit: args.limit,
+          paginationOpts: args.paginationOpts
+        });
+      }
+    }),
+    get: query({
+      args: {
+        collection: v.string(),
+        id: v.string(),
+        populate: v.optional(v.any()),
+        depth: v.optional(v.number())
+      },
+      handler: async (ctx, args) => {
+        const auth = await resolveGetAuth({ ctx, config, getAuth });
+        return await get({
+          auth,
+          ctx,
+          collection: args.collection,
+          id: args.id,
+          populate: args.populate,
+          depth: args.depth,
+          config
+        });
+      }
+    }),
+    search: query({
+      args: {
+        collection: v.string(),
+        searchIndexName: v.string(),
+        searchField: v.string(),
+        query: v.string(),
+        limit: v.optional(v.number()),
+        populate: v.optional(v.any()),
+        depth: v.optional(v.number()),
+        paginationOpts: v.optional(
+          paginationOptsValidator.extend({ totalDocs: v.optional(v.boolean()) })
+        )
+      },
+      handler: async (ctx, args) => {
+        const auth = await resolveGetAuth({ ctx, config, getAuth });
+        return search({
+          auth,
+          ctx,
+          collection: args.collection,
+          query: args.query,
+          searchIndexName: args.searchIndexName,
+          searchField: args.searchField,
+          limit: args.limit,
+          populate: args.populate,
+          depth: args.depth,
+          paginationOpts: args.paginationOpts,
+          config
+        });
+      }
+    }),
+    // MUTATIONS
+    create: mutation({
+      args: {
+        collection: v.string(),
+        data: v.any()
+      },
+      returns: v.string(),
+      handler: async (ctx, args) => {
+        const auth = await resolveGetAuth({ ctx, config, getAuth });
+        return await create({
+          auth,
+          ctx,
+          config,
+          collection: args.collection,
+          data: args.data
+        });
+      }
+    }),
+    update: mutation({
+      args: {
+        id: v.string(),
+        collection: v.string(),
+        data: v.any()
+      },
+      handler: async (ctx, args) => {
+        const auth = await resolveGetAuth({ ctx, config, getAuth });
+        return update({
+          auth,
+          ctx,
+          config,
+          collection: args.collection,
+          id: args.id,
+          data: args.data
+        });
+      }
+    }),
+    remove: mutation({
+      args: {
+        collection: v.string(),
+        ids: v.array(v.string()),
+        softDelete: v.optional(v.string())
+      },
+      handler: async (ctx, args) => {
+        const auth = await resolveGetAuth({ ctx, config, getAuth });
+        return remove({
+          auth,
+          collection: args.collection,
+          ctx,
+          config,
+          ids: args.ids,
+          softDelete: args.softDelete
+        });
+      }
+    })
+  };
+}
+function globalsApi({
+  config,
+  query,
+  mutation,
+  getAuth
+}) {
+  return {
+    get: query({
+      args: {
+        slug: v.string(),
+        populate: v.optional(v.any())
+      },
+      handler: async (ctx, args) => {
+        const auth = await resolveGetAuth({ ctx, config, getAuth });
+        return await getGlobal({
+          auth,
+          ctx,
+          slug: args.slug,
+          populate: args.populate,
+          config
+        });
+      }
+    }),
+    find: query({
+      args: {},
+      handler: async (ctx) => {
+        const auth = await resolveGetAuth({ ctx, config, getAuth });
+        return await findGlobals({ auth, ctx, config });
+      }
+    }),
+    upsert: mutation({
+      args: {
+        slug: v.string(),
+        data: v.any()
+      },
+      returns: v.string(),
+      handler: async (ctx, args) => {
+        const auth = await resolveGetAuth({ ctx, config, getAuth });
+        return await upsertGlobal({
+          auth,
+          ctx,
+          config,
+          slug: args.slug,
+          data: args.data
+        });
+      }
+    })
+  };
+}
+async function resolveGetAuth({
+  config,
+  ctx,
+  getAuth
+}) {
+  let auth = void 0;
+  if (config.access !== void 0) {
+    if (!getAuth) {
+      throw new VexAccessConfigError(
+        "getAuth not configured in collectionsApi. configure @ /src/convex/vex.ts"
+      );
+    }
+    auth = await getAuth(ctx);
+  }
+  return auth;
+}
+function vexServerApi(options) {
+  const { config, getAuth } = options;
+  async function inject(ctx, bypassAccess) {
+    const authConfig = bypassAccess === true ? { ...config, access: void 0 } : config;
+    return { config, auth: await resolveGetAuth({ ctx, config: authConfig, getAuth }) };
+  }
+  return {
+    get: async (args) => {
+      const { access, ...rest } = args;
+      return await get({
+        access,
+        ...rest,
+        ...await inject(rest.ctx, access?.bypass)
+      });
+    },
+    // Cast to the overloaded interface: an implementation signature cannot be
+    // structurally assignable to two call signatures at once.
+    find: (async (args) => {
+      const { access, ...rest } = args;
+      return await find({
+        access,
+        ...rest,
+        ...await inject(rest.ctx, access?.bypass)
+      });
+    }),
+    search: (async (args) => {
+      const { access, ...rest } = args;
+      return await search({
+        access,
+        ...rest,
+        ...await inject(rest.ctx, access?.bypass)
+      });
+    }),
+    create: async (args) => {
+      const { access, ...rest } = args;
+      return await create({
+        access,
+        ...rest,
+        ...await inject(rest.ctx, access?.bypass)
+      });
+    },
+    update: async (args) => {
+      const { access, ...rest } = args;
+      return await update({
+        access,
+        ...rest,
+        ...await inject(rest.ctx, access?.bypass)
+      });
+    },
+    remove: async (args) => {
+      const { access, ...rest } = args;
+      return await remove({
+        access,
+        ...rest,
+        ...await inject(rest.ctx, access?.bypass)
+      });
+    },
+    globals: {
+      get: async (args) => {
+        const { access, ...rest } = args;
+        return await getGlobal({
+          access,
+          ...rest,
+          ...await inject(rest.ctx, access?.bypass)
+        });
+      },
+      find: async (args) => {
+        const { access, ...rest } = args;
+        return await findGlobals({
+          access,
+          ...rest,
+          ...await inject(rest.ctx, access?.bypass)
+        });
+      },
+      upsert: async (args) => {
+        const { access, ...rest } = args;
+        return await upsertGlobal({
+          access,
+          ...rest,
+          ...await inject(rest.ctx, access?.bypass)
+        });
+      }
+    }
+  };
+}
+
+export {
+  ADMIN_FIELDS,
+  textFieldToInputSchema,
+  numberFieldToInputSchema,
+  checkboxFieldToInputSchema,
+  dateFieldToInputSchema,
+  selectFieldToInputSchema,
+  urlFieldToInputSchema,
+  COLOR_FORMATS,
+  COLOR_FORMAT_PATTERNS,
+  CSS_VAR_REFERENCE,
+  colorFieldToInputSchema,
+  relationshipFieldToInputSchema,
+  groupFieldToInputSchema,
+  blocksFieldToInputSchema,
+  uploadFieldToInputSchema,
+  adminFieldToInputSchema,
+  arrayFieldToInputSchema,
+  getGlobalDefaultValues,
+  getGlobalInputSchema,
+  dataType,
+  VexAccessError,
+  VexAccessConfigError,
+  createFilterConstraintBuilder,
+  createIndexConstraintBuilder,
+  readIndexConstraints,
+  createAccessQueryBuilder,
+  readAccessCondition,
+  CRUD_ACTIONS,
+  DRAFT_ACTIONS,
+  QUERY_ACTIONS,
+  PERMISSION_MODES,
+  PERMISSION_SCOPES,
+  WILDCARD_KEY,
+  ADMIN_CUSTOM_SUBJECTS,
+  hasPermission,
+  resolveActionCheck,
+  resolveAccessIndex,
+  resolveAccessConstraint,
+  pickQueryIndex,
+  resolveAccessCall,
+  resolveCollectionSlug,
+  buildDepthPopulate,
+  find,
+  get,
+  search,
+  create,
+  update,
+  remove,
+  getGlobal,
+  findGlobals,
+  upsertGlobal,
+  collectionsApi,
+  globalsApi,
+  resolveGetAuth,
+  vexServerApi
+};
+//# sourceMappingURL=chunk-2DU7JDEX.js.map