init

kirby/src/Api/Api.php

@@ -0,0 +1,741 @@
+<?php
+
+namespace Kirby\Api;
+
+use Closure;
+use Exception;
+use Kirby\Cms\User;
+use Kirby\Exception\Exception as ExceptionException;
+use Kirby\Exception\NotFoundException;
+use Kirby\Filesystem\F;
+use Kirby\Http\Response;
+use Kirby\Http\Route;
+use Kirby\Http\Router;
+use Kirby\Toolkit\Collection as BaseCollection;
+use Kirby\Toolkit\I18n;
+use Kirby\Toolkit\Pagination;
+use Kirby\Toolkit\Str;
+use Throwable;
+
+/**
+ * The API class is a generic container
+ * for API routes, models and collections and is used
+ * to run our REST API. You can find our API setup
+ * in `kirby/config/api.php`.
+ *
+ * @package   Kirby Api
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Api
+{
+	/**
+	 * Authentication callback
+	 */
+	protected Closure|null $authentication = null;
+
+	/**
+	 * Debugging flag
+	 */
+	protected bool $debug = false;
+
+	/**
+	 * Collection definition
+	 */
+	protected array $collections = [];
+
+	/**
+	 * Injected data/dependencies
+	 */
+	protected array $data = [];
+
+	/**
+	 * Model definitions
+	 */
+	protected array $models = [];
+
+	/**
+	 * The current route
+	 */
+	protected Route|null $route = null;
+
+	/**
+	 * The Router instance
+	 */
+	protected Router|null $router = null;
+
+	/**
+	 * Route definition
+	 */
+	protected array $routes = [];
+
+	/**
+	 * Request data
+	 * [query, body, files]
+	 */
+	protected array $requestData = [];
+
+	/**
+	 * The applied request method
+	 * (GET, POST, PATCH, etc.)
+	 */
+	protected string|null $requestMethod = null;
+
+	/**
+	 * Creates a new API instance
+	 */
+	public function __construct(array $props)
+	{
+		$this->authentication = $props['authentication'] ?? null;
+		$this->data           = $props['data'] ?? [];
+		$this->routes         = $props['routes'] ?? [];
+		$this->debug  		  = $props['debug'] ?? false;
+
+		if ($collections = $props['collections'] ?? null) {
+			$this->collections = array_change_key_case($collections);
+		}
+
+		if ($models = $props['models'] ?? null) {
+			$this->models = array_change_key_case($models);
+		}
+
+		$this->setRequestData($props['requestData'] ?? null);
+		$this->setRequestMethod($props['requestMethod'] ?? null);
+	}
+
+	/**
+	 * Magic accessor for any given data
+	 *
+	 * @throws \Kirby\Exception\NotFoundException
+	 */
+	public function __call(string $method, array $args = [])
+	{
+		return $this->data($method, ...$args);
+	}
+
+	/**
+	 * Runs the authentication method
+	 * if set
+	 */
+	public function authenticate()
+	{
+		return $this->authentication()?->call($this) ?? true;
+	}
+
+	/**
+	 * Returns the authentication callback
+	 */
+	public function authentication(): Closure|null
+	{
+		return $this->authentication;
+	}
+
+	/**
+	 * Execute an API call for the given path,
+	 * request method and optional request data
+	 *
+	 * @throws \Kirby\Exception\NotFoundException
+	 * @throws \Exception
+	 */
+	public function call(
+		string|null $path = null,
+		string $method = 'GET',
+		array $requestData = []
+	): mixed {
+		$path = rtrim($path ?? '', '/');
+
+		$this->setRequestMethod($method);
+		$this->setRequestData($requestData);
+
+		$this->router = new Router($this->routes());
+		$this->route  = $this->router->find($path, $method);
+		$auth = $this->route?->attributes()['auth'] ?? true;
+
+		if ($auth !== false) {
+			$user = $this->authenticate();
+
+			// set PHP locales based on *user* language
+			// so that e.g. strftime() gets formatted correctly
+			if ($user instanceof User) {
+				$language = $user->language();
+
+				// get the locale from the translation
+				$locale = $user->kirby()->translation($language)->locale();
+
+				// provide some variants as fallbacks to be
+				// compatible with as many systems as possible
+				$locales = [
+					$locale . '.UTF-8',
+					$locale . '.UTF8',
+					$locale . '.ISO8859-1',
+					$locale,
+					$language,
+					setlocale(LC_ALL, 0) // fall back to the previously defined locale
+				];
+
+				// set the locales that are relevant for string formatting
+				// *don't* set LC_CTYPE to avoid breaking other parts of the system
+				setlocale(LC_MONETARY, $locales);
+				setlocale(LC_NUMERIC, $locales);
+				setlocale(LC_TIME, $locales);
+			}
+		}
+
+		// don't throw pagination errors if pagination
+		// page is out of bounds
+		$validate = Pagination::$validate;
+		Pagination::$validate = false;
+
+		$output = $this->route?->action()->call(
+			$this,
+			...$this->route->arguments()
+		);
+
+		// restore old pagination validation mode
+		Pagination::$validate = $validate;
+
+		if (
+			is_object($output) === true &&
+			$output instanceof Response === false
+		) {
+			return $this->resolve($output)->toResponse();
+		}
+
+		return $output;
+	}
+
+	/**
+	 * Creates a new instance while
+	 * merging initial and new properties
+	 */
+	public function clone(array $props = []): static
+	{
+		return new static(array_merge([
+			'autentication' => $this->authentication,
+			'data'			=> $this->data,
+			'routes'		=> $this->routes,
+			'debug'			=> $this->debug,
+			'collections'   => $this->collections,
+			'models'		=> $this->models,
+			'requestData'   => $this->requestData,
+			'requestMethod' => $this->requestMethod
+		], $props));
+	}
+
+	/**
+	 * Setter and getter for an API collection
+	 *
+	 * @throws \Kirby\Exception\NotFoundException If no collection for `$name` exists
+	 * @throws \Exception
+	 */
+	public function collection(
+		string $name,
+		array|BaseCollection|null $collection = null
+	): Collection {
+		if (isset($this->collections[$name]) === false) {
+			throw new NotFoundException(sprintf('The collection "%s" does not exist', $name));
+		}
+
+		return new Collection($this, $collection, $this->collections[$name]);
+	}
+
+	/**
+	 * Returns the collections definition
+	 */
+	public function collections(): array
+	{
+		return $this->collections;
+	}
+
+	/**
+	 * Returns the injected data array
+	 * or certain parts of it by key
+	 *
+	 * @throws \Kirby\Exception\NotFoundException If no data for `$key` exists
+	 */
+	public function data(string|null $key = null, ...$args): mixed
+	{
+		if ($key === null) {
+			return $this->data;
+		}
+
+		if ($this->hasData($key) === false) {
+			throw new NotFoundException(sprintf('Api data for "%s" does not exist', $key));
+		}
+
+		// lazy-load data wrapped in Closures
+		if ($this->data[$key] instanceof Closure) {
+			return $this->data[$key]->call($this, ...$args);
+		}
+
+		return $this->data[$key];
+	}
+
+	/**
+	 * Returns the debugging flag
+	 */
+	public function debug(): bool
+	{
+		return $this->debug;
+	}
+
+	/**
+	 * Checks if injected data exists for the given key
+	 */
+	public function hasData(string $key): bool
+	{
+		return isset($this->data[$key]) === true;
+	}
+
+	/**
+	 * Matches an object with an array item
+	 * based on the `type` field
+	 *
+	 * @param array models or collections
+	 * @return string|null key of match
+	 */
+	protected function match(
+		array $array,
+		$object = null
+	): string|null {
+		foreach ($array as $definition => $model) {
+			if ($object instanceof $model['type']) {
+				return $definition;
+			}
+		}
+
+		return null;
+	}
+
+	/**
+	 * Returns an API model instance by name
+	 *
+	 * @throws \Kirby\Exception\NotFoundException If no model for `$name` exists
+	 */
+	public function model(
+		string|null $name = null,
+		$object = null
+	): Model {
+		// Try to auto-match object with API models
+		$name ??= $this->match($this->models, $object);
+
+		if (isset($this->models[$name]) === false) {
+			throw new NotFoundException(sprintf('The model "%s" does not exist', $name ?? 'NULL'));
+		}
+
+		return new Model($this, $object, $this->models[$name]);
+	}
+
+	/**
+	 * Returns all model definitions
+	 */
+	public function models(): array
+	{
+		return $this->models;
+	}
+
+	/**
+	 * Getter for request data
+	 * Can either get all the data
+	 * or certain parts of it.
+	 */
+	public function requestData(
+		string|null $type = null,
+		string|null $key = null,
+		mixed $default = null
+	): mixed {
+		if ($type === null) {
+			return $this->requestData;
+		}
+
+		if ($key === null) {
+			return $this->requestData[$type] ?? [];
+		}
+
+		$data = array_change_key_case($this->requestData($type));
+		$key  = strtolower($key);
+
+		return $data[$key] ?? $default;
+	}
+
+	/**
+	 * Returns the request body if available
+	 */
+	public function requestBody(
+		string|null $key = null,
+		mixed $default = null
+	): mixed {
+		return $this->requestData('body', $key, $default);
+	}
+
+	/**
+	 * Returns the files from the request if available
+	 */
+	public function requestFiles(
+		string|null $key = null,
+		mixed $default = null
+	): mixed {
+		return $this->requestData('files', $key, $default);
+	}
+
+	/**
+	 * Returns all headers from the request if available
+	 */
+	public function requestHeaders(
+		string|null $key = null,
+		mixed $default = null
+	): mixed {
+		return $this->requestData('headers', $key, $default);
+	}
+
+	/**
+	 * Returns the request method
+	 */
+	public function requestMethod(): string|null
+	{
+		return $this->requestMethod;
+	}
+
+	/**
+	 * Returns the request query if available
+	 */
+	public function requestQuery(
+		string|null $key = null,
+		mixed $default = null
+	): mixed {
+		return $this->requestData('query', $key, $default);
+	}
+
+	/**
+	 * Turns a Kirby object into an
+	 * API model or collection representation
+	 *
+	 * @throws \Kirby\Exception\NotFoundException If `$object` cannot be resolved
+	 */
+	public function resolve($object): Model|Collection
+	{
+		if (
+			$object instanceof Model ||
+			$object instanceof Collection
+		) {
+			return $object;
+		}
+
+		if ($model = $this->match($this->models, $object)) {
+			return $this->model($model, $object);
+		}
+
+		if ($collection = $this->match($this->collections, $object)) {
+			return $this->collection($collection, $object);
+		}
+
+		throw new NotFoundException(sprintf('The object "%s" cannot be resolved', get_class($object)));
+	}
+
+	/**
+	 * Returns all defined routes
+	 */
+	public function routes(): array
+	{
+		return $this->routes;
+	}
+
+	/**
+	 * Renders the API call
+	 */
+	public function render(
+		string $path,
+		string $method = 'GET',
+		array $requestData = []
+	): mixed {
+		try {
+			$result = $this->call($path, $method, $requestData);
+		} catch (Throwable $e) {
+			$result = $this->responseForException($e);
+		}
+
+		$result = match ($result) {
+			null    => $this->responseFor404(),
+			false   => $this->responseFor400(),
+			true    => $this->responseFor200(),
+			default => $result
+		};
+
+		if (is_array($result) === false) {
+			return $result;
+		}
+
+		// pretty print json data
+		$pretty = (bool)($requestData['query']['pretty'] ?? false) === true;
+
+		if (($result['status'] ?? 'ok') === 'error') {
+			$code = $result['code'] ?? 400;
+
+			// sanitize the error code
+			if ($code < 400 || $code > 599) {
+				$code = 500;
+			}
+
+			return Response::json($result, $code, $pretty);
+		}
+
+		return Response::json($result, 200, $pretty);
+	}
+
+	/**
+	 * Returns a 200 - ok
+	 * response array.
+	 */
+	public function responseFor200(): array
+	{
+		return [
+			'status'  => 'ok',
+			'message' => 'ok',
+			'code'    => 200
+		];
+	}
+
+	/**
+	 * Returns a 400 - bad request
+	 * response array.
+	 */
+	public function responseFor400(): array
+	{
+		return [
+			'status'  => 'error',
+			'message' => 'bad request',
+			'code'    => 400,
+		];
+	}
+
+	/**
+	 * Returns a 404 - not found
+	 * response array.
+	 */
+	public function responseFor404(): array
+	{
+		return [
+			'status'  => 'error',
+			'message' => 'not found',
+			'code'    => 404,
+		];
+	}
+
+	/**
+	 * Creates the response array for
+	 * an exception. Kirby exceptions will
+	 * have more information
+	 */
+	public function responseForException(Throwable $e): array
+	{
+		if (isset($this->kirby) === true) {
+			$docRoot = $this->kirby->environment()->get('DOCUMENT_ROOT');
+		} else {
+			$docRoot = $_SERVER['DOCUMENT_ROOT'] ?? null;
+		}
+
+		// prepare the result array for all exception types
+		$result = [
+			'status'    => 'error',
+			'message'   => $e->getMessage(),
+			'code'      => empty($e->getCode()) === true ? 500 : $e->getCode(),
+			'exception' => get_class($e),
+			'key'       => null,
+			'file'      => F::relativepath($e->getFile(), $docRoot),
+			'line'      => $e->getLine(),
+			'details'   => [],
+			'route'     => $this->route?->pattern()
+		];
+
+		// extend the information for Kirby Exceptions
+		if ($e instanceof ExceptionException) {
+			$result['key']     = $e->getKey();
+			$result['details'] = $e->getDetails();
+			$result['code']    = $e->getHttpCode();
+		}
+
+		// remove critical info from the result set if
+		// debug mode is switched off
+		if ($this->debug !== true) {
+			unset(
+				$result['file'],
+				$result['exception'],
+				$result['line'],
+				$result['route']
+			);
+		}
+
+		return $result;
+	}
+
+	/**
+	 * Setter for the request data
+	 * @return $this
+	 */
+	protected function setRequestData(
+		array|null $requestData = []
+	): static {
+		$defaults = [
+			'query' => [],
+			'body'  => [],
+			'files' => []
+		];
+
+		$this->requestData = array_merge($defaults, (array)$requestData);
+		return $this;
+	}
+
+	/**
+	 * Setter for the request method
+	 * @return $this
+	 */
+	protected function setRequestMethod(
+		string $requestMethod = null
+	): static {
+		$this->requestMethod = $requestMethod ?? 'GET';
+		return $this;
+	}
+
+	/**
+	 * Upload helper method
+	 *
+	 * move_uploaded_file() not working with unit test
+	 * Added debug parameter for testing purposes as we did in the Email class
+	 *
+	 * @throws \Exception If request has no files or there was an error with the upload
+	 */
+	public function upload(
+		Closure $callback,
+		bool $single = false,
+		bool $debug = false
+	): array {
+		$trials  = 0;
+		$uploads = [];
+		$errors  = [];
+		$files   = $this->requestFiles();
+
+		// get error messages from translation
+		$errorMessages = [
+			UPLOAD_ERR_INI_SIZE   => I18n::translate('upload.error.iniSize'),
+			UPLOAD_ERR_FORM_SIZE  => I18n::translate('upload.error.formSize'),
+			UPLOAD_ERR_PARTIAL    => I18n::translate('upload.error.partial'),
+			UPLOAD_ERR_NO_FILE    => I18n::translate('upload.error.noFile'),
+			UPLOAD_ERR_NO_TMP_DIR => I18n::translate('upload.error.tmpDir'),
+			UPLOAD_ERR_CANT_WRITE => I18n::translate('upload.error.cantWrite'),
+			UPLOAD_ERR_EXTENSION  => I18n::translate('upload.error.extension')
+		];
+
+		if (empty($files) === true) {
+			$postMaxSize       = Str::toBytes(ini_get('post_max_size'));
+			$uploadMaxFileSize = Str::toBytes(ini_get('upload_max_filesize'));
+
+			if ($postMaxSize < $uploadMaxFileSize) {
+				throw new Exception(
+					I18n::translate(
+						'upload.error.iniPostSize',
+						'The uploaded file exceeds the post_max_size directive in php.ini'
+					)
+				);
+			}
+
+			throw new Exception(
+				I18n::translate(
+					'upload.error.noFiles',
+					'No files were uploaded'
+				)
+			);
+		}
+
+		foreach ($files as $upload) {
+			if (
+				isset($upload['tmp_name']) === false &&
+				is_array($upload) === true
+			) {
+				continue;
+			}
+
+			$trials++;
+
+			try {
+				if ($upload['error'] !== 0) {
+					throw new Exception(
+						$errorMessages[$upload['error']] ??
+						I18n::translate('upload.error.default', 'The file could not be uploaded')
+					);
+				}
+
+				// get the extension of the uploaded file
+				$extension = F::extension($upload['name']);
+
+				// try to detect the correct mime and add the extension
+				// accordingly. This will avoid .tmp filenames
+				if (
+					empty($extension) === true ||
+					in_array($extension, ['tmp', 'temp']) === true
+				) {
+					$mime      = F::mime($upload['tmp_name']);
+					$extension = F::mimeToExtension($mime);
+					$filename  = F::name($upload['name']) . '.' . $extension;
+				} else {
+					$filename = basename($upload['name']);
+				}
+
+				$source = dirname($upload['tmp_name']) . '/' . uniqid() . '.' . $filename;
+
+				// move the file to a location including the extension,
+				// for better mime detection
+				if (
+					$debug === false &&
+					move_uploaded_file($upload['tmp_name'], $source) === false
+				) {
+					throw new Exception(
+						I18n::translate('upload.error.cantMove')
+					);
+				}
+
+				$data = $callback($source, $filename);
+
+				if (is_object($data) === true) {
+					$data = $this->resolve($data)->toArray();
+				}
+
+				$uploads[$upload['name']] = $data;
+			} catch (Exception $e) {
+				$errors[$upload['name']] = $e->getMessage();
+			}
+
+			if ($single === true) {
+				break;
+			}
+		}
+
+		// return a single upload response
+		if ($trials === 1) {
+			if (empty($errors) === false) {
+				return [
+					'status'  => 'error',
+					'message' => current($errors)
+				];
+			}
+
+			return [
+				'status' => 'ok',
+				'data'   => current($uploads)
+			];
+		}
+
+		if (empty($errors) === false) {
+			return [
+				'status' => 'error',
+				'errors' => $errors
+			];
+		}
+
+		return [
+			'status' => 'ok',
+			'data'   => $uploads
+		];
+	}
+}

kirby/src/Api/Collection.php

@@ -0,0 +1,153 @@
+<?php
+
+namespace Kirby\Api;
+
+use Closure;
+use Exception;
+use Kirby\Toolkit\Collection as BaseCollection;
+use Kirby\Toolkit\Str;
+
+/**
+ * The Collection class is a wrapper
+ * around our Kirby Collections and handles
+ * stuff like pagination and proper JSON output
+ * for collections in REST calls.
+ *
+ * @package   Kirby Api
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Collection
+{
+	protected string|null $model;
+	protected array|null $select = null;
+	protected string|null $view;
+
+	/**
+	 * Collection constructor
+	 *
+	 * @throws \Exception
+	 */
+	public function __construct(
+		protected Api $api,
+		protected BaseCollection|array|null $data,
+		array $schema
+	) {
+		$this->model = $schema['model'] ?? null;
+		$this->view  = $schema['view'] ?? null;
+
+		if ($data === null) {
+			if (($schema['default'] ?? null) instanceof Closure === false) {
+				throw new Exception('Missing collection data');
+			}
+
+			$this->data = $schema['default']->call($this->api);
+		}
+
+		if (
+			isset($schema['type']) === true &&
+			$this->data instanceof $schema['type'] === false
+		) {
+			throw new Exception('Invalid collection type');
+		}
+	}
+
+	/**
+	 * @return $this
+	 * @throws \Exception
+	 */
+	public function select($keys = null): static
+	{
+		if ($keys === false) {
+			return $this;
+		}
+
+		if (is_string($keys)) {
+			$keys = Str::split($keys);
+		}
+
+		if ($keys !== null && is_array($keys) === false) {
+			throw new Exception('Invalid select keys');
+		}
+
+		$this->select = $keys;
+		return $this;
+	}
+
+	/**
+	 * @throws \Kirby\Exception\NotFoundException
+	 * @throws \Exception
+	 */
+	public function toArray(): array
+	{
+		$result = [];
+
+		foreach ($this->data as $item) {
+			$model = $this->api->model($this->model, $item);
+
+			if ($this->view !== null) {
+				$model = $model->view($this->view);
+			}
+
+			if ($this->select !== null) {
+				$model = $model->select($this->select);
+			}
+
+			$result[] = $model->toArray();
+		}
+
+		return $result;
+	}
+
+	/**
+	 * @throws \Kirby\Exception\NotFoundException
+	 * @throws \Exception
+	 */
+	public function toResponse(): array
+	{
+		if ($query = $this->api->requestQuery('query')) {
+			$this->data = $this->data->query($query);
+		}
+
+		if (!$this->data->pagination()) {
+			$this->data = $this->data->paginate([
+				'page'  => $this->api->requestQuery('page', 1),
+				'limit' => $this->api->requestQuery('limit', 100)
+			]);
+		}
+
+		$pagination = $this->data->pagination();
+
+		if ($select = $this->api->requestQuery('select')) {
+			$this->select($select);
+		}
+
+		if ($view = $this->api->requestQuery('view')) {
+			$this->view($view);
+		}
+
+		return [
+			'code'       => 200,
+			'data'       => $this->toArray(),
+			'pagination' => [
+				'page'   => $pagination->page(),
+				'total'  => $pagination->total(),
+				'offset' => $pagination->offset(),
+				'limit'  => $pagination->limit(),
+			],
+			'status' => 'ok',
+			'type'   => 'collection'
+		];
+	}
+
+	/**
+	 * @return $this
+	 */
+	public function view(string $view): static
+	{
+		$this->view = $view;
+		return $this;
+	}
+}

kirby/src/Api/Model.php

@@ -0,0 +1,227 @@
+<?php
+
+namespace Kirby\Api;
+
+use Closure;
+use Exception;
+use Kirby\Toolkit\Str;
+
+/**
+ * The API Model class can be wrapped around any
+ * kind of object. Each model defines a set of properties that
+ * are available in REST calls. Those properties are defined as
+ * simple Closures which are resolved on demand. This is inspired
+ * by GraphQLs architecture and makes it possible to load
+ * only the model data that is needed for the current API call.
+ *
+ * @package   Kirby Api
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Model
+{
+	protected array $fields;
+	protected array|null $select;
+	protected array $views;
+
+	/**
+	 * Model constructor
+	 *
+	 * @throws \Exception
+	 */
+	public function __construct(
+		protected Api $api,
+		protected object|array|string|null $data,
+		array $schema
+	) {
+		$this->fields = $schema['fields'] ?? [];
+		$this->select = $schema['select'] ?? null;
+		$this->views  = $schema['views']  ?? [];
+
+		if (
+			$this->select === null &&
+			array_key_exists('default', $this->views)
+		) {
+			$this->view('default');
+		}
+
+		if ($data === null) {
+			if (($schema['default'] ?? null) instanceof Closure === false) {
+				throw new Exception('Missing model data');
+			}
+
+			$this->data = $schema['default']->call($this->api);
+		}
+
+		if (
+			isset($schema['type']) === true &&
+			$this->data instanceof $schema['type'] === false
+		) {
+			$class = match ($this->data) {
+				null    => 'null',
+				default => get_class($this->data),
+			};
+			throw new Exception(sprintf('Invalid model type "%s" expected: "%s"', $class, $schema['type']));
+		}
+	}
+
+	/**
+	 * @return $this
+	 * @throws \Exception
+	 */
+	public function select($keys = null): static
+	{
+		if ($keys === false) {
+			return $this;
+		}
+
+		if (is_string($keys)) {
+			$keys = Str::split($keys);
+		}
+
+		if ($keys !== null && is_array($keys) === false) {
+			throw new Exception('Invalid select keys');
+		}
+
+		$this->select = $keys;
+		return $this;
+	}
+
+	/**
+	 * @throws \Exception
+	 */
+	public function selection(): array
+	{
+		$select    = $this->select;
+		$select  ??= array_keys($this->fields);
+		$selection = [];
+
+		foreach ($select as $key => $value) {
+			if (is_int($key) === true) {
+				$selection[$value] = [
+					'view'   => null,
+					'select' => null
+				];
+				continue;
+			}
+
+			if (is_string($value) === true) {
+				if ($value === 'any') {
+					throw new Exception('Invalid sub view: "any"');
+				}
+
+				$selection[$key] = [
+					'view'   => $value,
+					'select' => null
+				];
+
+				continue;
+			}
+
+			if (is_array($value) === true) {
+				$selection[$key] = [
+					'view'   => null,
+					'select' => $value
+				];
+			}
+		}
+
+		return $selection;
+	}
+
+	/**
+	 * @throws \Kirby\Exception\NotFoundException
+	 * @throws \Exception
+	 */
+	public function toArray(): array
+	{
+		$select = $this->selection();
+		$result = [];
+
+		foreach ($this->fields as $key => $resolver) {
+			if (
+				array_key_exists($key, $select) === false ||
+				$resolver instanceof Closure === false
+			) {
+				continue;
+			}
+
+			$value = $resolver->call($this->api, $this->data);
+
+			if (is_object($value)) {
+				$value = $this->api->resolve($value);
+			}
+
+			if (
+				$value instanceof Collection ||
+				$value instanceof self
+			) {
+				$selection = $select[$key];
+
+				if ($subview = $selection['view']) {
+					$value->view($subview);
+				}
+
+				if ($subselect = $selection['select']) {
+					$value->select($subselect);
+				}
+
+				$value = $value->toArray();
+			}
+
+			$result[$key] = $value;
+		}
+
+		ksort($result);
+
+		return $result;
+	}
+
+	/**
+	 * @throws \Kirby\Exception\NotFoundException
+	 * @throws \Exception
+	 */
+	public function toResponse(): array
+	{
+		$model = $this;
+
+		if ($select = $this->api->requestQuery('select')) {
+			$model = $model->select($select);
+		}
+
+		if ($view = $this->api->requestQuery('view')) {
+			$model = $model->view($view);
+		}
+
+		return [
+			'code'   => 200,
+			'data'   => $model->toArray(),
+			'status' => 'ok',
+			'type'   => 'model'
+		];
+	}
+
+	/**
+	 * @return $this
+	 * @throws \Exception
+	 */
+	public function view(string $name): static
+	{
+		if ($name === 'any') {
+			return $this->select(null);
+		}
+
+		if (isset($this->views[$name]) === false) {
+			$name = 'default';
+
+			// try to fall back to the default view at least
+			if (isset($this->views[$name]) === false) {
+				throw new Exception(sprintf('The view "%s" does not exist', $name));
+			}
+		}
+
+		return $this->select($this->views[$name]);
+	}
+}

kirby/src/Blueprint/Collection.php

@@ -0,0 +1,97 @@
+<?php
+
+namespace Kirby\Blueprint;
+
+use Kirby\Cms\Collection as BaseCollection;
+use Kirby\Cms\ModelWithContent;
+use Kirby\Toolkit\A;
+use TypeError;
+
+/**
+ * Typed collection
+ *
+ * @package   Kirby Blueprint
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://opensource.org/licenses/MIT
+ *
+ * // TODO: include in test coverage once blueprint refactoring is done
+ * @codeCoverageIgnore
+ */
+class Collection extends BaseCollection
+{
+	/**
+	 * The expected object type
+	 */
+	public const TYPE = Node::class;
+
+	public function __construct(array $objects = [])
+	{
+		foreach ($objects as $object) {
+			$this->__set($object->id, $object);
+		}
+	}
+
+	/**
+	 * The Kirby Collection class only shows the key to
+	 * avoid huge tress with dump, but for the blueprint
+	 * collections this is really not useful
+	 *
+	 * @codeCoverageIgnore
+	 */
+	public function __debugInfo(): array
+	{
+		return A::map($this->data, fn ($item) => (array)$item);
+	}
+
+	/**
+	 * Validate the type of every item that is being
+	 * added to the collection. They need to have
+	 * the class defined by static::TYPE.
+	 */
+	public function __set(string $key, $value): void
+	{
+		if (is_a($value, static::TYPE) === false) {
+			throw new TypeError('Each value in the collection must be an instance of ' . static::TYPE);
+		}
+
+		parent::__set($key, $value);
+	}
+
+	/**
+	 * Creates a collection from a nested array structure
+	 */
+	public static function factory(array $items): static
+	{
+		$collection = new static();
+		$className  = static::TYPE;
+
+		foreach ($items as $id => $item) {
+			if (is_array($item) === true) {
+				$item['id'] ??= $id;
+				$item = $className::factory($item);
+				$collection->__set($item->id, $item);
+			} else {
+				$collection->__set($id, $className::factory($item));
+			}
+		}
+
+		return $collection;
+	}
+
+	/**
+	 * Renders each item with a model and returns
+	 * an array of all rendered results
+	 */
+	public function render(ModelWithContent $model): array
+	{
+		$props = [];
+
+		foreach ($this->data as $key => $item) {
+			$props[$key] = $item->render($model);
+		}
+
+		return $props;
+	}
+}

kirby/src/Blueprint/Config.php

@@ -0,0 +1,75 @@
+<?php
+
+namespace Kirby\Blueprint;
+
+use Closure;
+use Kirby\Cms\App;
+use Kirby\Data\Yaml;
+use Kirby\Exception\NotFoundException;
+use Kirby\Filesystem\F;
+
+/**
+ * Config
+ *
+ * @package   Kirby Blueprint
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://opensource.org/licenses/MIT
+ *
+ * // TODO: include in test coverage once blueprint refactoring is done
+ * @codeCoverageIgnore
+ */
+class Config
+{
+	public string $file;
+	public string $id;
+	public string|array|Closure|null $plugin;
+	public string $root;
+
+	public function __construct(
+		public string $path
+	) {
+		$kirby = App::instance();
+
+		$this->id     = basename($this->path);
+		$this->root   = $kirby->root('blueprints');
+		$this->file   = $this->root . '/' . $this->path . '.yml';
+		$this->plugin = $kirby->extension('blueprints', $this->path);
+	}
+
+	public function read(): array
+	{
+		if (F::exists($this->file, $this->root) === true) {
+			return $this->unpack($this->file);
+		}
+
+		return $this->unpack($this->plugin);
+	}
+
+	public function write(array $props): bool
+	{
+		return Yaml::write($this->file, $props);
+	}
+
+	public function unpack(string|array|Closure|null $extension): array
+	{
+		return match (true) {
+			// extension does not exist
+			is_null($extension)
+				=> throw new NotFoundException('"' . $this->path . '" could not be found'),
+
+			// extension is stored as a file path
+			is_string($extension)
+				=> Yaml::read($extension),
+
+			// extension is a callback to be resolved
+			is_callable($extension)
+				=> $extension(App::instance()),
+
+			// extension is already defined as array
+			default
+			=> $extension
+		};
+	}
+}

kirby/src/Blueprint/Extension.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace Kirby\Blueprint;
+
+/**
+ * Extension
+ *
+ * @package   Kirby Blueprint
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://opensource.org/licenses/MIT
+ *
+ * // TODO: include in test coverage once blueprint refactoring is done
+ * @codeCoverageIgnore
+ */
+class Extension
+{
+	public function __construct(
+		public string $path
+	) {
+	}
+
+	public static function apply(array $props): array
+	{
+		if (isset($props['extends']) === false) {
+			return $props;
+		}
+
+		// already extended
+		if (is_a($props['extends'], Extension::class) === true) {
+			return $props;
+		}
+
+		$extension = new static($props['extends']);
+		return $extension->extend($props);
+	}
+
+	public function extend(array $props): array
+	{
+		$props = array_replace_recursive(
+			$this->read(),
+			$props
+		);
+
+		$props['extends'] = $this;
+
+		return $props;
+	}
+
+	public static function factory(string|array $path): static
+	{
+		if (is_string($path) === true) {
+			return new static(path: $path);
+		}
+
+		return new static(...$path);
+	}
+
+	public function read(): array
+	{
+		$config = new Config($this->path);
+		return $config->read();
+	}
+}

kirby/src/Blueprint/Factory.php

@@ -0,0 +1,119 @@
+<?php
+
+namespace Kirby\Blueprint;
+
+use ReflectionException;
+use ReflectionNamedType;
+use ReflectionProperty;
+use ReflectionUnionType;
+
+/**
+ * Factory
+ *
+ * @package   Kirby Blueprint
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://opensource.org/licenses/MIT
+ *
+ * // TODO: include in test coverage once blueprint refactoring is done
+ * @codeCoverageIgnore
+ */
+class Factory
+{
+	/**
+	 * Resolves the properties by
+	 * applying a map of factories (propName => class)
+	 */
+	public static function apply(array $properties, array $factories): array
+	{
+		foreach ($factories as $property => $class) {
+			// skip non-existing properties, empty properties
+			// or properties that are matching objects
+			if (
+				isset($properties[$property]) === false ||
+				$properties[$property] === null ||
+				is_a($properties[$property], $class) === true
+			) {
+				continue;
+			}
+
+			$properties[$property] = $class::factory($properties[$property]);
+		}
+
+		return $properties;
+	}
+
+	public static function forNamedType(ReflectionNamedType|null $type, $value)
+	{
+		// get the class name for the single type
+		$className = $type->getName();
+
+		// check if there's a factory for the value
+		if (method_exists($className, 'factory') === true) {
+			return $className::factory($value);
+		}
+
+		// try to assign the value directly and trust
+		// in PHP's type system.
+		return $value;
+	}
+
+	public static function forProperties(string $class, array $properties): array
+	{
+		foreach ($properties as $property => $value) {
+			try {
+				$properties[$property] = static::forProperty($class, $property, $value);
+			} catch (ReflectionException $e) {
+				// the property does not exist
+				unset($properties[$property]);
+			}
+		}
+
+		return $properties;
+	}
+
+	public static function forProperty(string $class, string $property, $value)
+	{
+		if (is_null($value) === true) {
+			return $value;
+		}
+
+		// instantly assign objects
+		// PHP's type system will find issues automatically
+		if (is_object($value) === true) {
+			return $value;
+		}
+
+		// get the type for the property
+		$reflection = new ReflectionProperty($class, $property);
+		$propType   = $reflection->getType();
+
+		// no type given
+		if ($propType === null) {
+			return $value;
+		}
+
+		// union types
+		if ($propType instanceof ReflectionUnionType) {
+			return static::forUnionType($propType, $value);
+		}
+
+		return static::forNamedType($propType, $value);
+	}
+
+	/**
+	 * For properties with union types,
+	 * the first named type is used to create
+	 * the factory or pass a built-in value
+	 */
+	public static function forUnionType(ReflectionUnionType $type, $value)
+	{
+		return static::forNamedType($type->getTypes()[0], $value);
+	}
+
+	public static function make(string $class, array $properties): object
+	{
+		return new $class(...static::forProperties($class, $properties));
+	}
+}

kirby/src/Blueprint/Node.php

@@ -0,0 +1,117 @@
+<?php
+
+namespace Kirby\Blueprint;
+
+use Kirby\Cms\ModelWithContent;
+
+/**
+ * A node of the blueprint
+ *
+ * @package   Kirby Blueprint
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://opensource.org/licenses/MIT
+ *
+ * // TODO: include in test coverage once blueprint refactoring is done
+ * @codeCoverageIgnore
+ */
+class Node
+{
+	public const TYPE = 'node';
+
+	public function __construct(
+		public string $id,
+		public Extension|null $extends = null,
+	) {
+	}
+
+	/**
+	 * Dynamic getter for properties
+	 */
+	public function __call(string $name, array $args)
+	{
+		$this->defaults();
+		return $this->$name;
+	}
+
+	/**
+	 * Apply default values
+	 */
+	public function defaults(): static
+	{
+		return $this;
+	}
+
+	/**
+	 * Creates an instance by a set of array properties.
+	 */
+	public static function factory(array $props): static
+	{
+		$props = Extension::apply($props);
+		$props = static::polyfill($props);
+		return Factory::make(static::class, $props);
+	}
+
+	public static function load(string|array $props): static
+	{
+		// load by path
+		if (is_string($props) === true) {
+			$props = static::loadProps($props);
+		}
+
+		return static::factory($props);
+	}
+
+	public static function loadProps(string $path): array
+	{
+		$config = new Config($path);
+		$props  = $config->read();
+
+		// add the id if it's not set yet
+		$props['id'] ??= basename($path);
+
+		return $props;
+	}
+
+	/**
+	 * Optional method that runs before static::factory sends
+	 * its properties to the instance. This is perfect to clean
+	 * up props or keep deprecated props compatible.
+	 */
+	public static function polyfill(array $props): array
+	{
+		return $props;
+	}
+
+	public function render(ModelWithContent $model)
+	{
+		// apply default values
+		$this->defaults();
+
+		$array = [];
+
+		// go through all public properties
+		foreach (get_object_vars($this) as $key => $value) {
+			if (is_object($value) === false && is_resource($value) === false) {
+				$array[$key] = $value;
+				continue;
+			}
+
+			if (method_exists($value, 'render') === true) {
+				$array[$key] = $value->render($model);
+			}
+		}
+
+		return $array;
+	}
+
+	/**
+	 * Universal setter for properties
+	 */
+	public function set(string $property, $value): static
+	{
+		$this->$property = Factory::forProperty(static::class, $property, $value);
+		return $this;
+	}
+}

kirby/src/Blueprint/NodeI18n.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace Kirby\Blueprint;
+
+use Kirby\Cms\ModelWithContent;
+use Kirby\Toolkit\I18n;
+
+/**
+ * Translatable node property
+ *
+ * @package   Kirby Blueprint
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://opensource.org/licenses/MIT
+ *
+ * // TODO: include in test coverage once blueprint refactoring is done
+ * @codeCoverageIgnore
+ */
+class NodeI18n extends NodeProperty
+{
+	public function __construct(
+		public array $translations,
+	) {
+	}
+
+	public static function factory($value = null): static|null
+	{
+		if ($value === false || $value === null) {
+			return null;
+		}
+
+		if (is_array($value) === false) {
+			$value = ['en' => $value];
+		}
+
+		return new static($value);
+	}
+
+	public function render(ModelWithContent $model): string|null
+	{
+		return I18n::translate($this->translations, $this->translations);
+	}
+}

kirby/src/Blueprint/NodeIcon.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace Kirby\Blueprint;
+
+/**
+ * Custom emoji or icon from the Kirby iconset
+ *
+ * @package   Kirby Blueprint
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://opensource.org/licenses/MIT
+ *
+ * // TODO: include in test coverage once blueprint refactoring is done
+ * @codeCoverageIgnore
+ */
+class NodeIcon extends NodeString
+{
+	public static function field()
+	{
+		$field = parent::field();
+		$field->id = 'icon';
+		$field->label->translations = ['en' => 'Icon'];
+
+		return $field;
+	}
+}

kirby/src/Blueprint/NodeProperty.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace Kirby\Blueprint;
+
+use Kirby\Cms\ModelWithContent;
+
+/**
+ * Represents a property for a node
+ *
+ * @package   Kirby Blueprint
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://opensource.org/licenses/MIT
+ *
+ * // TODO: include in test coverage once blueprint refactoring is done
+ * @codeCoverageIgnore
+ */
+abstract class NodeProperty
+{
+	abstract public static function factory($value = null): static|null;
+
+	public function render(ModelWithContent $model)
+	{
+		return null;
+	}
+}

kirby/src/Blueprint/NodeString.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace Kirby\Blueprint;
+
+use Kirby\Cms\ModelWithContent;
+
+/**
+ * Simple string blueprint node
+ *
+ * @package   Kirby Blueprint
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://opensource.org/licenses/MIT
+ *
+ * // TODO: include in test coverage once blueprint refactoring is done
+ * @codeCoverageIgnore
+ */
+class NodeString extends NodeProperty
+{
+	public function __construct(
+		public string $value,
+	) {
+	}
+
+	public static function factory($value = null): static|null
+	{
+		if ($value === null) {
+			return null;
+		}
+
+		return new static($value);
+	}
+
+	public function render(ModelWithContent $model): string|null
+	{
+		return $this->value;
+	}
+}

kirby/src/Blueprint/NodeText.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace Kirby\Blueprint;
+
+use Kirby\Cms\ModelWithContent;
+
+/**
+ * The text node is translatable
+ * and will parse query template strings
+ *
+ * @package   Kirby Blueprint
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://opensource.org/licenses/MIT
+ *
+ * // TODO: include in test coverage once blueprint refactoring is done
+ * @codeCoverageIgnore
+ */
+class NodeText extends NodeI18n
+{
+	public function render(ModelWithContent $model): string|null
+	{
+		if ($text = parent::render($model)) {
+			return $model->toSafeString($text);
+		}
+
+		return $text;
+	}
+}

kirby/src/Cache/ApcuCache.php

@@ -0,0 +1,83 @@
+<?php
+
+namespace Kirby\Cache;
+
+use APCUIterator;
+
+/**
+ * APCu Cache Driver
+ *
+ * @package   Kirby Cache
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://opensource.org/licenses/MIT
+ */
+class ApcuCache extends Cache
+{
+	/**
+	 * Returns whether the cache is ready to
+	 * store values
+	 */
+	public function enabled(): bool
+	{
+		return apcu_enabled();
+	}
+
+	/**
+	 * Determines if an item exists in the cache
+	 */
+	public function exists(string $key): bool
+	{
+		return apcu_exists($this->key($key));
+	}
+
+	/**
+	 * Flushes the entire cache and returns
+	 * whether the operation was successful
+	 */
+	public function flush(): bool
+	{
+		if (empty($this->options['prefix']) === false) {
+			return apcu_delete(new APCUIterator('!^' . preg_quote($this->options['prefix']) . '!'));
+		}
+
+		return apcu_clear_cache();
+	}
+
+	/**
+	 * Removes an item from the cache and returns
+	 * whether the operation was successful
+	 */
+	public function remove(string $key): bool
+	{
+		return apcu_delete($this->key($key));
+	}
+
+	/**
+	 * Internal method to retrieve the raw cache value;
+	 * needs to return a Value object or null if not found
+	 */
+	public function retrieve(string $key): Value|null
+	{
+		$value = apcu_fetch($this->key($key));
+		return Value::fromJson($value);
+	}
+
+	/**
+	 * Writes an item to the cache for a given number of minutes and
+	 * returns whether the operation was successful
+	 *
+	 * <code>
+	 *   // put an item in the cache for 15 minutes
+	 *   $cache->set('value', 'my value', 15);
+	 * </code>
+	 */
+	public function set(string $key, $value, int $minutes = 0): bool
+	{
+		$key     = $this->key($key);
+		$value   = (new Value($value, $minutes))->toJson();
+		$expires = $this->expiration($minutes);
+		return apcu_store($key, $value, $expires);
+	}
+}

kirby/src/Cache/Cache.php

@@ -0,0 +1,238 @@
+<?php
+
+namespace Kirby\Cache;
+
+use Closure;
+
+/**
+ * Cache foundation
+ * This abstract class is used as
+ * foundation for other cache drivers
+ * by extending it
+ *
+ * @package   Kirby Cache
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://opensource.org/licenses/MIT
+ */
+abstract class Cache
+{
+	/**
+	 * Stores all options for the driver
+	 */
+	protected array $options = [];
+
+	/**
+	 * Sets all parameters which are needed to connect to the cache storage
+	 */
+	public function __construct(array $options = [])
+	{
+		$this->options = $options;
+	}
+
+	/**
+	 * Checks when the cache has been created;
+	 * returns the creation timestamp on success
+	 * and false if the item does not exist
+	 */
+	public function created(string $key): int|false
+	{
+		// get the Value object
+		$value = $this->retrieve($key);
+
+		// check for a valid Value object
+		if ($value instanceof Value === false) {
+			return false;
+		}
+
+		// return the expires timestamp
+		return $value->created();
+	}
+
+	/**
+	 * Returns whether the cache is ready to
+	 * store values
+	 */
+	public function enabled(): bool
+	{
+		// TODO: Make this method abstract in a future
+		// release to ensure that cache drivers override it;
+		// until then, we assume that the cache is enabled
+		return true;
+	}
+
+	/**
+	 * Determines if an item exists in the cache
+	 */
+	public function exists(string $key): bool
+	{
+		return $this->expired($key) === false;
+	}
+
+
+	/**
+	 * Calculates the expiration timestamp
+	 */
+	protected function expiration(int $minutes = 0): int
+	{
+		// 0 = keep forever
+		if ($minutes === 0) {
+			return 0;
+		}
+
+		// calculate the time
+		return time() + ($minutes * 60);
+	}
+
+	/**
+	 * Checks when an item in the cache expires;
+	 * returns the expiry timestamp on success, null if the
+	 * item never expires and false if the item does not exist
+	 */
+	public function expires(string $key): int|false|null
+	{
+		// get the Value object
+		$value = $this->retrieve($key);
+
+		// check for a valid Value object
+		if ($value instanceof Value === false) {
+			return false;
+		}
+
+		// return the expires timestamp
+		return $value->expires();
+	}
+
+	/**
+	 * Checks if an item in the cache is expired
+	 */
+	public function expired(string $key): bool
+	{
+		$expires = $this->expires($key);
+
+		if ($expires === null) {
+			return false;
+		}
+
+		if (is_int($expires) === false) {
+			return true;
+		}
+
+		return time() >= $expires;
+	}
+
+	/**
+	 * Flushes the entire cache and returns
+	 * whether the operation was successful;
+	 * this needs to be defined by the driver
+	 */
+	abstract public function flush(): bool;
+
+	/**
+	 * Gets an item from the cache
+	 *
+	 * <code>
+	 *   // get an item from the cache driver
+	 *   $value = $cache->get('value');
+	 *
+	 *   // return a default value if the requested item isn't cached
+	 *   $value = $cache->get('value', 'default value');
+	 * </code>
+	 */
+	public function get(string $key, $default = null)
+	{
+		// get the Value
+		$value = $this->retrieve($key);
+
+		// check for a valid cache value
+		if ($value instanceof Value === false) {
+			return $default;
+		}
+
+		// remove the item if it is expired
+		if ($value->expires() > 0 && time() >= $value->expires()) {
+			$this->remove($key);
+			return $default;
+		}
+
+		// return the pure value
+		return $value->value();
+	}
+
+	/**
+	 * Returns a value by either getting it from the cache
+	 * or via the callback function which then is stored in
+	 * the cache for future retrieval. This method cannot be
+	 * used for `null` as value to be cached.
+	 * @since 3.8.0
+	 */
+	public function getOrSet(
+		string $key,
+		Closure $result,
+		int $minutes = 0
+	) {
+		$value  = $this->get($key);
+		$result = $value ?? $result();
+
+		if ($value === null) {
+			$this->set($key, $result, $minutes);
+		}
+
+		return $result;
+	}
+
+	/**
+	 * Adds the prefix to the key if given
+	 */
+	protected function key(string $key): string
+	{
+		if (empty($this->options['prefix']) === false) {
+			$key = $this->options['prefix'] . '/' . $key;
+		}
+
+		return $key;
+	}
+
+	/**
+	 * Alternate version for Cache::created($key)
+	 */
+	public function modified(string $key): int|false
+	{
+		return static::created($key);
+	}
+
+	/**
+	 * Returns all passed cache options
+	 */
+	public function options(): array
+	{
+		return $this->options;
+	}
+
+	/**
+	 * Removes an item from the cache and returns
+	 * whether the operation was successful;
+	 * this needs to be defined by the driver
+	 */
+	abstract public function remove(string $key): bool;
+
+	/**
+	 * Internal method to retrieve the raw cache value;
+	 * needs to return a Value object or null if not found;
+	 * this needs to be defined by the driver
+	 */
+	abstract public function retrieve(string $key): Value|null;
+
+	/**
+	 * Writes an item to the cache for a given number of minutes and
+	 * returns whether the operation was successful;
+	 * this needs to be defined by the driver
+	 *
+	 * <code>
+	 *   // put an item in the cache for 15 minutes
+	 *   $cache->set('value', 'my value', 15);
+	 * </code>
+	 */
+	abstract public function set(string $key, $value, int $minutes = 0): bool;
+}

kirby/src/Cache/FileCache.php

@@ -0,0 +1,227 @@
+<?php
+
+namespace Kirby\Cache;
+
+use Kirby\Exception\Exception;
+use Kirby\Filesystem\Dir;
+use Kirby\Filesystem\F;
+use Kirby\Toolkit\Str;
+
+/**
+ * File System Cache Driver
+ *
+ * @package   Kirby Cache
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://opensource.org/licenses/MIT
+ */
+class FileCache extends Cache
+{
+	/**
+	 * Full root including prefix
+	 */
+	protected string $root;
+
+	/**
+	 * Sets all parameters which are needed for the file cache
+	 *
+	 * @param array $options 'root' (required)
+	 *                       'prefix' (default: none)
+	 *                       'extension' (file extension for cache files, default: none)
+	 */
+	public function __construct(array $options)
+	{
+		$defaults = [
+			'root'      => null,
+			'prefix'    => null,
+			'extension' => null
+		];
+
+		parent::__construct(array_merge($defaults, $options));
+
+		// build the full root including prefix
+		$this->root = $this->options['root'];
+
+		if (empty($this->options['prefix']) === false) {
+			$this->root .= '/' . $this->options['prefix'];
+		}
+
+		// try to create the directory
+		Dir::make($this->root, true);
+	}
+
+	/**
+	 * Returns whether the cache is ready to
+	 * store values
+	 */
+	public function enabled(): bool
+	{
+		return is_writable($this->root) === true;
+	}
+
+	/**
+	 * Returns the full root including prefix
+	 */
+	public function root(): string
+	{
+		return $this->root;
+	}
+
+	/**
+	 * Returns the full path to a file for a given key
+	 */
+	protected function file(string $key): string
+	{
+		// strip out invalid characters in each path segment
+		// split by slash or backslash
+		$keyParts = [];
+		foreach (preg_split('#([\/\\\\])#', $key, 0, PREG_SPLIT_DELIM_CAPTURE) as $part) {
+			switch ($part) {
+				case '/':
+					// forward slashes don't need special treatment
+					break;
+
+				case '\\':
+					// backslashes get their own marker in the path
+					// to differentiate the cache key from one with forward slashes
+					$keyParts[] = '_backslash';
+					break;
+
+				case '':
+					// empty part means two slashes in a row;
+					// special marker like for backslashes
+					$keyParts[] = '_empty';
+					break;
+
+				default:
+					// an actual path segment:
+					// check if the segment only contains safe characters;
+					// underscores are *not* safe to guarantee uniqueness
+					// as they are used in the special cases
+					if (preg_match('/^[a-zA-Z0-9-]+$/', $part) === 1) {
+						$keyParts[] = $part;
+					} else {
+						$keyParts[] = Str::slug($part) . '_' . sha1($part);
+					}
+			}
+		}
+
+		$file = $this->root . '/' . implode('/', $keyParts);
+
+		if (isset($this->options['extension'])) {
+			return $file . '.' . $this->options['extension'];
+		}
+
+		return $file;
+	}
+
+	/**
+	 * Writes an item to the cache for a given number of minutes and
+	 * returns whether the operation was successful
+	 *
+	 * <code>
+	 *   // put an item in the cache for 15 minutes
+	 *   $cache->set('value', 'my value', 15);
+	 * </code>
+	 */
+	public function set(string $key, $value, int $minutes = 0): bool
+	{
+		$file = $this->file($key);
+
+		return F::write($file, (new Value($value, $minutes))->toJson());
+	}
+
+	/**
+	 * Internal method to retrieve the raw cache value;
+	 * needs to return a Value object or null if not found
+	 */
+	public function retrieve(string $key): Value|null
+	{
+		$file  = $this->file($key);
+		$value = F::read($file);
+
+		return $value ? Value::fromJson($value) : null;
+	}
+
+	/**
+	 * Checks when the cache has been created;
+	 * returns the creation timestamp on success
+	 * and false if the item does not exist
+	 */
+	public function created(string $key): int|false
+	{
+		// use the modification timestamp
+		// as indicator when the cache has been created/overwritten
+		clearstatcache();
+
+		// get the file for this cache key
+		$file = $this->file($key);
+		return file_exists($file) ? filemtime($file) : false;
+	}
+
+	/**
+	 * Removes an item from the cache and returns
+	 * whether the operation was successful
+	 */
+	public function remove(string $key): bool
+	{
+		$file = $this->file($key);
+
+		if (is_file($file) === true && F::remove($file) === true) {
+			$this->removeEmptyDirectories(dirname($file));
+			return true;
+		}
+
+		return false;
+	}
+
+	/**
+	 * Removes empty directories safely by checking each directory
+	 * up to the root directory
+	 */
+	protected function removeEmptyDirectories(string $dir): void
+	{
+		try {
+			// ensure the path doesn't end with a slash for the next comparison
+			$dir = rtrim($dir, '/\/');
+
+			// checks all directory segments until reaching the root directory
+			while (Str::startsWith($dir, $this->root()) === true && $dir !== $this->root()) {
+				$files = scandir($dir);
+
+				if ($files === false) {
+					$files = []; // @codeCoverageIgnore
+				}
+
+				$files = array_diff($files, ['.', '..']);
+
+				if (empty($files) === true && Dir::remove($dir) === true) {
+					// continue with the next level up
+					$dir = dirname($dir);
+				} else {
+					// no need to continue with the next level up as `$dir` was not deleted
+					break;
+				}
+			}
+		} catch (Exception) { // @codeCoverageIgnore
+			// silently stops the process
+		}
+	}
+
+	/**
+	 * Flushes the entire cache and returns
+	 * whether the operation was successful
+	 */
+	public function flush(): bool
+	{
+		if (
+			Dir::remove($this->root) === true &&
+			Dir::make($this->root) === true
+		) {
+			return true;
+		}
+
+		return false; // @codeCoverageIgnore
+	}
+}

kirby/src/Cache/MemCached.php

@@ -0,0 +1,106 @@
+<?php
+
+namespace Kirby\Cache;
+
+use Memcached as MemcachedExt;
+
+/**
+ * Memcached Driver
+ *
+ * @package   Kirby Cache
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://opensource.org/licenses/MIT
+ */
+class MemCached extends Cache
+{
+	/**
+	 * Store for the memcache connection
+	 */
+	protected MemcachedExt $connection;
+
+	/**
+	 * Stores whether the connection was successful
+	 */
+	protected bool $enabled;
+
+	/**
+	 * Sets all parameters which are needed to connect to Memcached
+	 *
+	 * @param array $options 'host'   (default: localhost)
+	 *                       'port'   (default: 11211)
+	 *                       'prefix' (default: null)
+	 */
+	public function __construct(array $options = [])
+	{
+		$defaults = [
+			'host'    => 'localhost',
+			'port'    => 11211,
+			'prefix'  => null,
+		];
+
+		parent::__construct(array_merge($defaults, $options));
+
+		$this->connection = new MemcachedExt();
+		$this->enabled = $this->connection->addServer(
+			$this->options['host'],
+			$this->options['port']
+		);
+	}
+
+	/**
+	 * Returns whether the cache is ready to
+	 * store values
+	 */
+	public function enabled(): bool
+	{
+		return $this->enabled;
+	}
+
+	/**
+	 * Writes an item to the cache for a given number of minutes and
+	 * returns whether the operation was successful
+	 *
+	 * <code>
+	 *   // put an item in the cache for 15 minutes
+	 *   $cache->set('value', 'my value', 15);
+	 * </code>
+	 */
+	public function set(string $key, $value, int $minutes = 0): bool
+	{
+		$key     = $this->key($key);
+		$value   = (new Value($value, $minutes))->toJson();
+		$expires = $this->expiration($minutes);
+		return $this->connection->set($key, $value, $expires);
+	}
+
+	/**
+	 * Internal method to retrieve the raw cache value;
+	 * needs to return a Value object or null if not found
+	 */
+	public function retrieve(string $key): Value|null
+	{
+		$value = $this->connection->get($this->key($key));
+		return Value::fromJson($value);
+	}
+
+	/**
+	 * Removes an item from the cache and returns
+	 * whether the operation was successful
+	 */
+	public function remove(string $key): bool
+	{
+		return $this->connection->delete($this->key($key));
+	}
+
+	/**
+	 * Flushes the entire cache and returns
+	 * whether the operation was successful;
+	 * WARNING: Memcached only supports flushing the whole cache at once!
+	 */
+	public function flush(): bool
+	{
+		return $this->connection->flush();
+	}
+}

kirby/src/Cache/MemoryCache.php

@@ -0,0 +1,77 @@
+<?php
+
+namespace Kirby\Cache;
+
+/**
+ * Memory Cache Driver (cache in memory for current request only)
+ *
+ * @package   Kirby Cache
+ * @author    Lukas Bestle <lukas@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://opensource.org/licenses/MIT
+ */
+class MemoryCache extends Cache
+{
+	/**
+	 * Cache data
+	 */
+	protected array $store = [];
+
+	/**
+	 * Returns whether the cache is ready to
+	 * store values
+	 */
+	public function enabled(): bool
+	{
+		return true;
+	}
+
+	/**
+	 * Writes an item to the cache for a given number of minutes and
+	 * returns whether the operation was successful
+	 *
+	 * <code>
+	 *   // put an item in the cache for 15 minutes
+	 *   $cache->set('value', 'my value', 15);
+	 * </code>
+	 */
+	public function set(string $key, $value, int $minutes = 0): bool
+	{
+		$this->store[$key] = new Value($value, $minutes);
+		return true;
+	}
+
+	/**
+	 * Internal method to retrieve the raw cache value;
+	 * needs to return a Value object or null if not found
+	 */
+	public function retrieve(string $key): Value|null
+	{
+		return $this->store[$key] ?? null;
+	}
+
+	/**
+	 * Removes an item from the cache and returns
+	 * whether the operation was successful
+	 */
+	public function remove(string $key): bool
+	{
+		if (isset($this->store[$key])) {
+			unset($this->store[$key]);
+			return true;
+		}
+
+		return false;
+	}
+
+	/**
+	 * Flushes the entire cache and returns
+	 * whether the operation was successful
+	 */
+	public function flush(): bool
+	{
+		$this->store = [];
+		return true;
+	}
+}

kirby/src/Cache/NullCache.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace Kirby\Cache;
+
+/**
+ * Dummy Cache Driver (does not do any caching)
+ *
+ * @package   Kirby Cache
+ * @author    Lukas Bestle <lukas@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://opensource.org/licenses/MIT
+ */
+class NullCache extends Cache
+{
+	/**
+	 * Returns whether the cache is ready to
+	 * store values
+	 */
+	public function enabled(): bool
+	{
+		return false;
+	}
+
+	/**
+	 * Writes an item to the cache for a given number of minutes and
+	 * returns whether the operation was successful
+	 *
+	 * <code>
+	 *   // put an item in the cache for 15 minutes
+	 *   $cache->set('value', 'my value', 15);
+	 * </code>
+	 */
+	public function set(string $key, $value, int $minutes = 0): bool
+	{
+		return true;
+	}
+
+	/**
+	 * Internal method to retrieve the raw cache value;
+	 * needs to return a Value object or null if not found
+	 */
+	public function retrieve(string $key): Value|null
+	{
+		return null;
+	}
+
+	/**
+	 * Removes an item from the cache and returns
+	 * whether the operation was successful
+	 */
+	public function remove(string $key): bool
+	{
+		return true;
+	}
+
+	/**
+	 * Flushes the entire cache and returns
+	 * whether the operation was successful
+	 */
+	public function flush(): bool
+	{
+		return true;
+	}
+}

kirby/src/Cache/Value.php

@@ -0,0 +1,137 @@
+<?php
+
+namespace Kirby\Cache;
+
+use Throwable;
+
+/**
+ * Cache Value
+ * Stores the value, creation timestamp and expiration timestamp
+ * and makes it possible to store all three with a single cache key
+ *
+ * @package   Kirby Cache
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://opensource.org/licenses/MIT
+ */
+class Value
+{
+	/**
+	 * Cached value
+	 */
+	protected $value;
+
+	/**
+	 * the number of minutes until the value expires
+	 * @todo Rename this property to $expiry to reflect
+	 *       both minutes and absolute timestamps
+	 */
+	protected int $minutes;
+
+	/**
+	 * Creation timestamp
+	 */
+	protected int $created;
+
+	/**
+	 * Constructor
+	 *
+	 * @param int $minutes the number of minutes until the value expires
+	 *                     or an absolute UNIX timestamp
+	 * @param int|null $created the UNIX timestamp when the value has been created
+	 *                          (defaults to the current time)
+	 */
+	public function __construct($value, int $minutes = 0, int|null $created = null)
+	{
+		$this->value   = $value;
+		$this->minutes = $minutes;
+		$this->created = $created ?? time();
+	}
+
+	/**
+	 * Returns the creation date as UNIX timestamp
+	 */
+	public function created(): int
+	{
+		return $this->created;
+	}
+
+	/**
+	 * Returns the expiration date as UNIX timestamp or
+	 * null if the value never expires
+	 */
+	public function expires(): int|null
+	{
+		// 0 = keep forever
+		if ($this->minutes === 0) {
+			return null;
+		}
+
+		if ($this->minutes > 1000000000) {
+			// absolute timestamp
+			return $this->minutes;
+		}
+
+		return $this->created + ($this->minutes * 60);
+	}
+
+	/**
+	 * Creates a value object from an array
+	 */
+	public static function fromArray(array $array): static
+	{
+		return new static(
+			$array['value'] ?? null,
+			$array['minutes'] ?? 0,
+			$array['created'] ?? null
+		);
+	}
+
+	/**
+	 * Creates a value object from a JSON string;
+	 * returns null on error
+	 */
+	public static function fromJson(string $json): static|null
+	{
+		try {
+			$array = json_decode($json, true);
+
+			if (is_array($array) === true) {
+				return static::fromArray($array);
+			}
+
+			return null;
+		} catch (Throwable) {
+			return null;
+		}
+	}
+
+	/**
+	 * Converts the object to a JSON string
+	 */
+	public function toJson(): string
+	{
+		return json_encode($this->toArray());
+	}
+
+	/**
+	 * Converts the object to an array
+	 */
+	public function toArray(): array
+	{
+		return [
+			'created' => $this->created,
+			'minutes' => $this->minutes,
+			'value'   => $this->value,
+		];
+	}
+
+	/**
+	 * Returns the pure value
+	 */
+	public function value()
+	{
+		return $this->value;
+	}
+}

kirby/src/Cms/Api.php

@@ -0,0 +1,260 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Api\Api as BaseApi;
+use Kirby\Exception\NotFoundException;
+use Kirby\Form\Form;
+use Kirby\Session\Session;
+
+/**
+ * Api
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Api extends BaseApi
+{
+	protected App $kirby;
+
+	public function __construct(array $props)
+	{
+		$this->kirby = $props['kirby'];
+		parent::__construct($props);
+	}
+
+	/**
+	 * Execute an API call for the given path,
+	 * request method and optional request data
+	 */
+	public function call(
+		string|null $path = null,
+		string $method = 'GET',
+		array $requestData = []
+	): mixed {
+		$this->setRequestMethod($method);
+		$this->setRequestData($requestData);
+
+		$this->kirby->setCurrentLanguage($this->language());
+
+		$allowImpersonation = $this->kirby()->option('api.allowImpersonation', false);
+
+		$translation   = $this->kirby->user(null, $allowImpersonation)?->language();
+		$translation ??= $this->kirby->panelLanguage();
+		$this->kirby->setCurrentTranslation($translation);
+
+		return parent::call($path, $method, $requestData);
+	}
+
+	/**
+	 * Creates a new instance while
+	 * merging initial and new properties
+	 */
+	public function clone(array $props = []): static
+	{
+		return parent::clone(array_merge([
+			'kirby' => $this->kirby
+		], $props));
+	}
+
+	/**
+	 * @throws \Kirby\Exception\NotFoundException if the field type cannot be found or the field cannot be loaded
+	 */
+	public function fieldApi(
+		ModelWithContent $model,
+		string $name,
+		string|null $path = null
+	): mixed {
+		$field = Form::for($model)->field($name);
+
+		$fieldApi = $this->clone([
+			'data'   => [...$this->data(), 'field' => $field],
+			'routes' => $field->api(),
+		]);
+
+		return $fieldApi->call(
+			$path,
+			$this->requestMethod(),
+			$this->requestData()
+		);
+	}
+
+	/**
+	 * Returns the file object for the given
+	 * parent path and filename
+	 *
+	 * @param string $path Path to file's parent model
+	 * @throws \Kirby\Exception\NotFoundException if the file cannot be found
+	 */
+	public function file(
+		string $path,
+		string $filename
+	): File|null {
+		return Find::file($path, $filename);
+	}
+
+	/**
+	 * Returns the all readable files for the parent
+	 *
+	 * @param string $path Path to file's parent model
+	 * @throws \Kirby\Exception\NotFoundException if the file cannot be found
+	 */
+	public function files(string $path): Files
+	{
+		return $this->parent($path)->files()->filter('isAccessible', true);
+	}
+
+	/**
+	 * Returns the model's object for the given path
+	 *
+	 * @param string $path Path to parent model
+	 * @throws \Kirby\Exception\InvalidArgumentException if the model type is invalid
+	 * @throws \Kirby\Exception\NotFoundException if the model cannot be found
+	 */
+	public function parent(string $path): ModelWithContent|null
+	{
+		return Find::parent($path);
+	}
+
+	/**
+	 * Returns the Kirby instance
+	 */
+	public function kirby(): App
+	{
+		return $this->kirby;
+	}
+
+	/**
+	 * Returns the language request header
+	 */
+	public function language(): string|null
+	{
+		return
+			$this->requestQuery('language') ??
+			$this->requestHeaders('x-language');
+	}
+
+	/**
+	 * Returns the page object for the given id
+	 *
+	 * @param string $id Page's id
+	 * @throws \Kirby\Exception\NotFoundException if the page cannot be found
+	 */
+	public function page(string $id): Page|null
+	{
+		return Find::page($id);
+	}
+
+	/**
+	 * Returns the subpages for the given
+	 * parent. The subpages can be filtered
+	 * by status (draft, listed, unlisted, published, all)
+	 */
+	public function pages(
+		string|null $parentId = null,
+		string|null $status = null
+	): Pages {
+		$parent = $parentId === null ? $this->site() : $this->page($parentId);
+		$pages  = match ($status) {
+			'all'             => $parent->childrenAndDrafts(),
+			'draft', 'drafts' => $parent->drafts(),
+			'listed'          => $parent->children()->listed(),
+			'unlisted'        => $parent->children()->unlisted(),
+			'published'       => $parent->children(),
+			default           => $parent->children()
+		};
+
+		return $pages->filter('isAccessible', true);
+	}
+
+	/**
+	 * Search for direct subpages of the
+	 * given parent
+	 */
+	public function searchPages(string|null $parent = null): Pages
+	{
+		$pages = $this->pages($parent, $this->requestQuery('status'));
+
+		if ($this->requestMethod() === 'GET') {
+			return $pages->search($this->requestQuery('q'));
+		}
+
+		return $pages->query($this->requestBody());
+	}
+
+	/**
+	 * @throws \Kirby\Exception\NotFoundException if the section type cannot be found or the section cannot be loaded
+	 */
+	public function sectionApi(
+		ModelWithContent $model,
+		string $name,
+		string|null $path = null
+	): mixed {
+		if (!$section = $model->blueprint()?->section($name)) {
+			throw new NotFoundException('The section "' . $name . '" could not be found');
+		}
+
+		$sectionApi = $this->clone([
+			'data'   => [...$this->data(), 'section' => $section],
+			'routes' => $section->api(),
+		]);
+
+		return $sectionApi->call(
+			$path,
+			$this->requestMethod(),
+			$this->requestData()
+		);
+	}
+
+	/**
+	 * Returns the current Session instance
+	 *
+	 * @param array $options Additional options, see the session component
+	 */
+	public function session(array $options = []): Session
+	{
+		return $this->kirby->session(array_merge([
+			'detect' => true
+		], $options));
+	}
+
+	/**
+	 * Returns the site object
+	 */
+	public function site(): Site
+	{
+		return $this->kirby->site();
+	}
+
+	/**
+	 * Returns the user object for the given id or
+	 * returns the current authenticated user if no
+	 * id is passed
+	 *
+	 * @param string|null $id User's id
+	 * @throws \Kirby\Exception\NotFoundException if the user for the given id cannot be found
+	 */
+	public function user(string|null $id = null): User|null
+	{
+		try {
+			return Find::user($id);
+		} catch (NotFoundException $e) {
+			if ($id === null) {
+				return null;
+			}
+
+			throw $e;
+		}
+	}
+
+	/**
+	 * Returns the users collection
+	 */
+	public function users(): Users
+	{
+		return $this->kirby->users();
+	}
+}

kirby/src/Cms/AppCaches.php

@@ -0,0 +1,131 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Cache\Cache;
+use Kirby\Cache\NullCache;
+use Kirby\Exception\InvalidArgumentException;
+
+/**
+ * AppCaches
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+trait AppCaches
+{
+	protected array $caches = [];
+
+	/**
+	 * Returns a cache instance by key
+	 */
+	public function cache(string $key): Cache
+	{
+		if (isset($this->caches[$key]) === true) {
+			return $this->caches[$key];
+		}
+
+		// get the options for this cache type
+		$options = $this->cacheOptions($key);
+
+		if ($options['active'] === false) {
+			// use a dummy cache that does nothing
+			return $this->caches[$key] = new NullCache();
+		}
+
+		$type  = strtolower($options['type']);
+		$types = $this->extensions['cacheTypes'] ?? [];
+
+		if (array_key_exists($type, $types) === false) {
+			throw new InvalidArgumentException([
+				'key'  => 'cache.type.invalid',
+				'data' => ['type' => $type]
+			]);
+		}
+
+		$className = $types[$type];
+
+		// initialize the cache class
+		$cache = new $className($options);
+
+		// check if it is a usable cache object
+		if ($cache instanceof Cache === false) {
+			throw new InvalidArgumentException([
+				'key'  => 'cache.type.invalid',
+				'data' => ['type' => $type]
+			]);
+		}
+
+		return $this->caches[$key] = $cache;
+	}
+
+	/**
+	 * Returns the cache options by key
+	 */
+	protected function cacheOptions(string $key): array
+	{
+		$options   = $this->option($this->cacheOptionsKey($key), null);
+		$options ??= $this->core()->caches()[$key] ?? false;
+
+		if ($options === false) {
+			return [
+				'active' => false
+			];
+		}
+
+		$prefix =
+			str_replace(['/', ':'], '_', $this->system()->indexUrl()) .
+			'/' .
+			str_replace('.', '/', $key);
+
+		$defaults = [
+			'active'    => true,
+			'type'      => 'file',
+			'extension' => 'cache',
+			'root'      => $this->root('cache'),
+			'prefix'    => $prefix
+		];
+
+		if ($options === true) {
+			return $defaults;
+		}
+
+		return array_merge($defaults, $options);
+	}
+
+	/**
+	 * Takes care of converting prefixed plugin cache setups
+	 * to the right cache key, while leaving regular cache
+	 * setups untouched.
+	 */
+	protected function cacheOptionsKey(string $key): string
+	{
+		$prefixedKey = 'cache.' . $key;
+
+		if (isset($this->options[$prefixedKey])) {
+			return $prefixedKey;
+		}
+
+		// plain keys without dots don't need further investigation
+		// since they can never be from a plugin.
+		if (strpos($key, '.') === false) {
+			return $prefixedKey;
+		}
+
+		// try to extract the plugin name
+		$parts        = explode('.', $key);
+		$pluginName   = implode('/', array_slice($parts, 0, 2));
+		$pluginPrefix = implode('.', array_slice($parts, 0, 2));
+		$cacheName    = implode('.', array_slice($parts, 2));
+
+		// check if such a plugin exists
+		if ($this->plugin($pluginName)) {
+			return empty($cacheName) === true ? $pluginPrefix . '.cache' : $pluginPrefix . '.cache.' . $cacheName;
+		}
+
+		return $prefixedKey;
+	}
+}

kirby/src/Cms/AppErrors.php

@@ -0,0 +1,216 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Closure;
+use Kirby\Exception\Exception;
+use Kirby\Filesystem\F;
+use Kirby\Http\Response;
+use Kirby\Toolkit\I18n;
+use Throwable;
+use Whoops\Handler\CallbackHandler;
+use Whoops\Handler\Handler;
+use Whoops\Handler\HandlerInterface;
+use Whoops\Handler\PlainTextHandler;
+use Whoops\Handler\PrettyPageHandler;
+use Whoops\Run as Whoops;
+
+/**
+ * PHP error handling using the Whoops library
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+trait AppErrors
+{
+	/**
+	 * Allows to disable Whoops globally in CI;
+	 * can be overridden by explicitly setting
+	 * the `whoops` option to `true` or `false`
+	 *
+	 * @internal
+	 */
+	public static bool $enableWhoops = true;
+
+	/**
+	 * Whoops instance cache
+	 */
+	protected Whoops $whoops;
+
+	/**
+	 * Registers the PHP error handler for CLI usage
+	 */
+	protected function handleCliErrors(): void
+	{
+		$this->setWhoopsHandler(new PlainTextHandler());
+	}
+
+	/**
+	 * Registers the PHP error handler
+	 * based on the environment
+	 */
+	protected function handleErrors(): void
+	{
+		// no matter the environment, exit early if
+		// Whoops was disabled globally
+		// (but continue if the option was explicitly
+		// set to `true` in the config)
+		if (
+			static::$enableWhoops === false &&
+			$this->option('whoops') !== true
+		) {
+			return;
+		}
+
+		if ($this->environment()->cli() === true) {
+			$this->handleCliErrors();
+			return;
+		}
+
+		if ($this->visitor()->prefersJson() === true) {
+			$this->handleJsonErrors();
+			return;
+		}
+
+		$this->handleHtmlErrors();
+	}
+
+	/**
+	 * Registers the PHP error handler for HTML output
+	 */
+	protected function handleHtmlErrors(): void
+	{
+		$handler = null;
+
+		if ($this->option('debug') === true) {
+			if ($this->option('whoops', true) !== false) {
+				$handler = new PrettyPageHandler();
+				$handler->setPageTitle('Kirby CMS Debugger');
+				$handler->addResourcePath(dirname(__DIR__, 2) . '/assets');
+				$handler->addCustomCss('whoops.css');
+
+				if ($editor = $this->option('editor')) {
+					$handler->setEditor($editor);
+				}
+
+				if ($blocklist = $this->option('whoops.blocklist')) {
+					foreach ($blocklist as $superglobal => $vars) {
+						foreach ($vars as $var) {
+							$handler->blacklist($superglobal, $var);
+						}
+					}
+				}
+			}
+		} else {
+			$handler = new CallbackHandler(function ($exception, $inspector, $run) {
+				$fatal = $this->option('fatal');
+
+				if ($fatal instanceof Closure) {
+					echo $fatal($this, $exception);
+				} else {
+					include $this->root('kirby') . '/views/fatal.php';
+				}
+
+				return Handler::QUIT;
+			});
+		}
+
+		if ($handler !== null) {
+			$this->setWhoopsHandler($handler);
+		} else {
+			$this->unsetWhoopsHandler();
+		}
+	}
+
+	/**
+	 * Registers the PHP error handler for JSON output
+	 */
+	protected function handleJsonErrors(): void
+	{
+		$handler = new CallbackHandler(function ($exception, $inspector, $run) {
+			if ($exception instanceof Exception) {
+				$httpCode = $exception->getHttpCode();
+				$code     = $exception->getCode();
+				$details  = $exception->getDetails();
+			} elseif ($exception instanceof Throwable) {
+				$httpCode = 500;
+				$code     = $exception->getCode();
+				$details  = null;
+			} else {
+				$httpCode = 500;
+				$code     = 500;
+				$details  = null;
+			}
+
+			if ($this->option('debug') === true) {
+				echo Response::json([
+					'status'    => 'error',
+					'exception' => get_class($exception),
+					'code'      => $code,
+					'message'   => $exception->getMessage(),
+					'details'   => $details,
+					'file'      => F::relativepath($exception->getFile(), $this->environment()->get('DOCUMENT_ROOT', '')),
+					'line'      => $exception->getLine(),
+				], $httpCode);
+			} else {
+				echo Response::json([
+					'status'  => 'error',
+					'code'    => $code,
+					'details' => $details,
+					'message' => I18n::translate('error.unexpected'),
+				], $httpCode);
+			}
+
+			return Handler::QUIT;
+		});
+
+		$this->setWhoopsHandler($handler);
+		$this->whoops()->sendHttpCode(false);
+	}
+
+	/**
+	 * Enables Whoops with the specified handler
+	 */
+	protected function setWhoopsHandler(callable|HandlerInterface $handler): void
+	{
+		$whoops = $this->whoops();
+		$whoops->clearHandlers();
+		$whoops->pushHandler($handler);
+		$whoops->pushHandler($this->getAdditionalWhoopsHandler());
+		$whoops->register(); // will only do something if not already registered
+	}
+
+	/**
+	 * Whoops callback handler for additional error handling
+	 * (`system.exception` hook and output to error log)
+	 */
+	protected function getAdditionalWhoopsHandler(): CallbackHandler
+	{
+		return new CallbackHandler(function ($exception, $inspector, $run) {
+			$this->trigger('system.exception', compact('exception'));
+			error_log($exception);
+			return Handler::DONE;
+		});
+	}
+
+	/**
+	 * Clears the Whoops handlers and disables Whoops
+	 */
+	protected function unsetWhoopsHandler(): void
+	{
+		$whoops = $this->whoops();
+		$whoops->clearHandlers();
+		$whoops->unregister(); // will only do something if currently registered
+	}
+
+	/**
+	 * Returns the Whoops error handler instance
+	 */
+	protected function whoops(): Whoops
+	{
+		return $this->whoops ??= new Whoops();
+	}
+}

kirby/src/Cms/AppPlugins.php

@@ -0,0 +1,817 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Closure;
+use Kirby\Content\Field;
+use Kirby\Exception\DuplicateException;
+use Kirby\Filesystem\Asset;
+use Kirby\Filesystem\Dir;
+use Kirby\Filesystem\F;
+use Kirby\Filesystem\Mime;
+use Kirby\Form\Field as FormField;
+use Kirby\Image\Image;
+use Kirby\Text\KirbyTag;
+use Kirby\Toolkit\A;
+use Kirby\Toolkit\Collection as ToolkitCollection;
+use Kirby\Toolkit\V;
+
+/**
+ * AppPlugins
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+trait AppPlugins
+{
+	/**
+	 * A list of all registered plugins
+	 */
+	protected static array $plugins = [];
+
+	/**
+	 * The extension registry
+	 */
+	protected array $extensions = [
+		// load options first to make them available for the rest
+		'options' => [],
+
+		// other plugin types
+		'api' => [],
+		'areas' => [],
+		'assetMethods' => [],
+		'authChallenges' => [],
+		'blockMethods' => [],
+		'blockModels' => [],
+		'blocksMethods' => [],
+		'blueprints' => [],
+		'cacheTypes' => [],
+		'collections' => [],
+		'commands' => [],
+		'components' => [],
+		'controllers' => [],
+		'collectionFilters' => [],
+		'collectionMethods' => [],
+		'fieldMethods' => [],
+		'fileMethods' => [],
+		'fileTypes' => [],
+		'filesMethods' => [],
+		'fields' => [],
+		'hooks' => [],
+		'layoutMethods' => [],
+		'layoutColumnMethods' => [],
+		'layoutsMethods' => [],
+		'pages' => [],
+		'pageMethods' => [],
+		'pagesMethods' => [],
+		'pageModels' => [],
+		'permissions' => [],
+		'routes' => [],
+		'sections' => [],
+		'siteMethods' => [],
+		'snippets' => [],
+		'structureMethods' => [],
+		'structureObjectMethods' => [],
+		'tags' => [],
+		'templates' => [],
+		'thirdParty' => [],
+		'translations' => [],
+		'userMethods' => [],
+		'userModels' => [],
+		'usersMethods' => [],
+		'validators' => [],
+	];
+
+	/**
+	 * Flag when plugins have been loaded
+	 * to not load them again
+	 */
+	protected bool $pluginsAreLoaded = false;
+
+	/**
+	 * Register all given extensions
+	 *
+	 * @internal
+	 * @param \Kirby\Cms\Plugin $plugin|null The plugin which defined those extensions
+	 */
+	public function extend(
+		array $extensions,
+		Plugin $plugin = null
+	): array {
+		foreach ($this->extensions as $type => $registered) {
+			if (isset($extensions[$type]) === true) {
+				$this->{'extend' . $type}($extensions[$type], $plugin);
+			}
+		}
+
+		return $this->extensions;
+	}
+
+	/**
+	 * Registers API extensions
+	 */
+	protected function extendApi(array|bool $api): array
+	{
+		if (is_array($api) === true) {
+			if (($api['routes'] ?? []) instanceof Closure) {
+				$api['routes'] = $api['routes']($this);
+			}
+
+			return $this->extensions['api'] = A::merge($this->extensions['api'], $api, A::MERGE_APPEND);
+		}
+
+		return $this->extensions['api'];
+	}
+
+	/**
+	 * Registers additional custom Panel areas
+	 */
+	protected function extendAreas(array $areas): array
+	{
+		foreach ($areas as $id => $area) {
+			$this->extensions['areas'][$id] ??= [];
+			$this->extensions['areas'][$id][] = $area;
+		}
+
+		return $this->extensions['areas'];
+	}
+
+	/**
+	 * Registers additional asset methods
+	 */
+	protected function extendAssetMethods(array $methods): array
+	{
+		return $this->extensions['assetMethods'] = Asset::$methods = array_merge(Asset::$methods, $methods);
+	}
+
+	/**
+	 * Registers additional authentication challenges
+	 */
+	protected function extendAuthChallenges(array $challenges): array
+	{
+		return $this->extensions['authChallenges'] = Auth::$challenges = array_merge(Auth::$challenges, $challenges);
+	}
+
+	/**
+	 * Registers additional block methods
+	 */
+	protected function extendBlockMethods(array $methods): array
+	{
+		return $this->extensions['blockMethods'] = Block::$methods = array_merge(Block::$methods, $methods);
+	}
+
+	/**
+	 * Registers additional block models
+	 */
+	protected function extendBlockModels(array $models): array
+	{
+		return $this->extensions['blockModels'] = Block::$models = array_merge(Block::$models, $models);
+	}
+
+	/**
+	 * Registers additional blocks methods
+	 */
+	protected function extendBlocksMethods(array $methods): array
+	{
+		return $this->extensions['blockMethods'] = Blocks::$methods = array_merge(Blocks::$methods, $methods);
+	}
+
+	/**
+	 * Registers additional blueprints
+	 */
+	protected function extendBlueprints(array $blueprints): array
+	{
+		return $this->extensions['blueprints'] = array_merge($this->extensions['blueprints'], $blueprints);
+	}
+
+	/**
+	 * Registers additional cache types
+	 */
+	protected function extendCacheTypes(array $cacheTypes): array
+	{
+		return $this->extensions['cacheTypes'] = array_merge($this->extensions['cacheTypes'], $cacheTypes);
+	}
+
+	/**
+	 * Registers additional CLI commands
+	 */
+	protected function extendCommands(array $commands): array
+	{
+		return $this->extensions['commands'] = array_merge($this->extensions['commands'], $commands);
+	}
+
+	/**
+	 * Registers additional collection filters
+	 */
+	protected function extendCollectionFilters(array $filters): array
+	{
+		return $this->extensions['collectionFilters'] = ToolkitCollection::$filters = array_merge(ToolkitCollection::$filters, $filters);
+	}
+
+	/**
+	 * Registers additional collection methods
+	 */
+	protected function extendCollectionMethods(array $methods): array
+	{
+		return $this->extensions['collectionMethods'] = Collection::$methods = array_merge(Collection::$methods, $methods);
+	}
+
+	/**
+	 * Registers additional collections
+	 */
+	protected function extendCollections(array $collections): array
+	{
+		return $this->extensions['collections'] = array_merge($this->extensions['collections'], $collections);
+	}
+
+	/**
+	 * Registers core components
+	 */
+	protected function extendComponents(array $components): array
+	{
+		return $this->extensions['components'] = array_merge($this->extensions['components'], $components);
+	}
+
+	/**
+	 * Registers additional controllers
+	 */
+	protected function extendControllers(array $controllers): array
+	{
+		return $this->extensions['controllers'] = array_merge($this->extensions['controllers'], $controllers);
+	}
+
+	/**
+	 * Registers additional file methods
+	 */
+	protected function extendFileMethods(array $methods): array
+	{
+		return $this->extensions['fileMethods'] = File::$methods = array_merge(File::$methods, $methods);
+	}
+
+	/**
+	 * Registers additional custom file types and mimes
+	 */
+	protected function extendFileTypes(array $fileTypes): array
+	{
+		// normalize array
+		foreach ($fileTypes as $ext => $file) {
+			$extension = $file['extension'] ?? $ext;
+			$type      = $file['type'] ?? null;
+			$mime      = $file['mime'] ?? null;
+			$resizable = $file['resizable'] ?? false;
+			$viewable  = $file['viewable'] ?? false;
+
+			if (is_string($type) === true) {
+				if (isset(F::$types[$type]) === false) {
+					F::$types[$type] = [];
+				}
+
+				if (in_array($extension, F::$types[$type]) === false) {
+					F::$types[$type][] = $extension;
+				}
+			}
+
+			if ($mime !== null) {
+				if (array_key_exists($extension, Mime::$types) === true) {
+					// if `Mime::$types[$extension]` is not already an array, make it one
+					// and append the new MIME type unless it's already in the list
+					Mime::$types[$extension] = array_unique(array_merge((array)Mime::$types[$extension], (array)$mime));
+				} else {
+					Mime::$types[$extension] = $mime;
+				}
+			}
+
+			if ($resizable === true && in_array($extension, Image::$resizableTypes) === false) {
+				Image::$resizableTypes[] = $extension;
+			}
+
+			if ($viewable === true && in_array($extension, Image::$viewableTypes) === false) {
+				Image::$viewableTypes[] = $extension;
+			}
+		}
+
+		return $this->extensions['fileTypes'] = [
+			'type'      => F::$types,
+			'mime'      => Mime::$types,
+			'resizable' => Image::$resizableTypes,
+			'viewable'  => Image::$viewableTypes
+		];
+	}
+
+	/**
+	 * Registers additional files methods
+	 */
+	protected function extendFilesMethods(array $methods): array
+	{
+		return $this->extensions['filesMethods'] = Files::$methods = array_merge(Files::$methods, $methods);
+	}
+
+	/**
+	 * Registers additional field methods
+	 */
+	protected function extendFieldMethods(array $methods): array
+	{
+		return $this->extensions['fieldMethods'] = Field::$methods = array_merge(Field::$methods, array_change_key_case($methods));
+	}
+
+	/**
+	 * Registers Panel fields
+	 */
+	protected function extendFields(array $fields): array
+	{
+		return $this->extensions['fields'] = FormField::$types = array_merge(FormField::$types, $fields);
+	}
+
+	/**
+	 * Registers hooks
+	 */
+	protected function extendHooks(array $hooks): array
+	{
+		foreach ($hooks as $name => $callbacks) {
+			$this->extensions['hooks'][$name] ??= [];
+
+			if (is_array($callbacks) === false) {
+				$callbacks = [$callbacks];
+			}
+
+			foreach ($callbacks as $callback) {
+				$this->extensions['hooks'][$name][] = $callback;
+			}
+		}
+
+		return $this->extensions['hooks'];
+	}
+
+	/**
+	 * Registers markdown component
+	 */
+	protected function extendMarkdown(Closure $markdown): Closure
+	{
+		return $this->extensions['markdown'] = $markdown;
+	}
+
+	/**
+	 * Registers additional layout methods
+	 */
+	protected function extendLayoutMethods(array $methods): array
+	{
+		return $this->extensions['layoutMethods'] = Layout::$methods = array_merge(Layout::$methods, $methods);
+	}
+
+	/**
+	 * Registers additional layout column methods
+	 */
+	protected function extendLayoutColumnMethods(array $methods): array
+	{
+		return $this->extensions['layoutColumnMethods'] = LayoutColumn::$methods = array_merge(LayoutColumn::$methods, $methods);
+	}
+
+	/**
+	 * Registers additional layouts methods
+	 */
+	protected function extendLayoutsMethods(array $methods): array
+	{
+		return $this->extensions['layoutsMethods'] = Layouts::$methods = array_merge(Layouts::$methods, $methods);
+	}
+
+	/**
+	 * Registers additional options
+	 */
+	protected function extendOptions(
+		array $options,
+		Plugin $plugin = null
+	): array {
+		if ($plugin !== null) {
+			$options = [$plugin->prefix() => $options];
+		}
+
+		return $this->extensions['options'] = $this->options = A::merge($options, $this->options, A::MERGE_REPLACE);
+	}
+
+	/**
+	 * Registers additional page methods
+	 */
+	protected function extendPageMethods(array $methods): array
+	{
+		return $this->extensions['pageMethods'] = Page::$methods = array_merge(Page::$methods, $methods);
+	}
+
+	/**
+	 * Registers additional pages methods
+	 */
+	protected function extendPagesMethods(array $methods): array
+	{
+		return $this->extensions['pagesMethods'] = Pages::$methods = array_merge(Pages::$methods, $methods);
+	}
+
+	/**
+	 * Registers additional page models
+	 */
+	protected function extendPageModels(array $models): array
+	{
+		return $this->extensions['pageModels'] = Page::$models = array_merge(Page::$models, $models);
+	}
+
+	/**
+	 * Registers pages
+	 */
+	protected function extendPages(array $pages): array
+	{
+		return $this->extensions['pages'] = array_merge($this->extensions['pages'], $pages);
+	}
+
+	/**
+	 * Registers additional permissions
+	 */
+	protected function extendPermissions(
+		array $permissions,
+		Plugin $plugin = null
+	): array {
+		if ($plugin !== null) {
+			$permissions = [$plugin->prefix() => $permissions];
+		}
+
+		return $this->extensions['permissions'] = Permissions::$extendedActions = array_merge(Permissions::$extendedActions, $permissions);
+	}
+
+	/**
+	 * Registers additional routes
+	 */
+	protected function extendRoutes(array|Closure $routes): array
+	{
+		if ($routes instanceof Closure) {
+			$routes = $routes($this);
+		}
+
+		return $this->extensions['routes'] = array_merge($this->extensions['routes'], $routes);
+	}
+
+	/**
+	 * Registers Panel sections
+	 */
+	protected function extendSections(array $sections): array
+	{
+		return $this->extensions['sections'] = Section::$types = array_merge(Section::$types, $sections);
+	}
+
+	/**
+	 * Registers additional site methods
+	 */
+	protected function extendSiteMethods(array $methods): array
+	{
+		return $this->extensions['siteMethods'] = Site::$methods = array_merge(Site::$methods, $methods);
+	}
+
+	/**
+	 * Registers SmartyPants component
+	 */
+	protected function extendSmartypants(Closure $smartypants): Closure
+	{
+		return $this->extensions['smartypants'] = $smartypants;
+	}
+
+	/**
+	 * Registers additional snippets
+	 */
+	protected function extendSnippets(array $snippets): array
+	{
+		return $this->extensions['snippets'] = array_merge($this->extensions['snippets'], $snippets);
+	}
+
+	/**
+	 * Registers additional structure methods
+	 */
+	protected function extendStructureMethods(array $methods): array
+	{
+		return $this->extensions['structureMethods'] = Structure::$methods = array_merge(Structure::$methods, $methods);
+	}
+
+	/**
+	 * Registers additional structure object methods
+	 */
+	protected function extendStructureObjectMethods(array $methods): array
+	{
+		return $this->extensions['structureObjectMethods'] = StructureObject::$methods = array_merge(StructureObject::$methods, $methods);
+	}
+
+	/**
+	 * Registers additional KirbyTags
+	 */
+	protected function extendTags(array $tags): array
+	{
+		return $this->extensions['tags'] = KirbyTag::$types = array_merge(KirbyTag::$types, array_change_key_case($tags));
+	}
+
+	/**
+	 * Registers additional templates
+	 */
+	protected function extendTemplates(array $templates): array
+	{
+		return $this->extensions['templates'] = array_merge($this->extensions['templates'], $templates);
+	}
+
+	/**
+	 * Registers translations
+	 */
+	protected function extendTranslations(array $translations): array
+	{
+		return $this->extensions['translations'] = array_replace_recursive($this->extensions['translations'], $translations);
+	}
+
+	/**
+	 * Add third party extensions to the registry
+	 * so they can be used as plugins for plugins
+	 * for example.
+	 */
+	protected function extendThirdParty(array $extensions): array
+	{
+		return $this->extensions['thirdParty'] = array_replace_recursive($this->extensions['thirdParty'], $extensions);
+	}
+
+	/**
+	 * Registers additional user methods
+	 */
+	protected function extendUserMethods(array $methods): array
+	{
+		return $this->extensions['userMethods'] = User::$methods = array_merge(User::$methods, $methods);
+	}
+
+	/**
+	 * Registers additional user models
+	 */
+	protected function extendUserModels(array $models): array
+	{
+		return $this->extensions['userModels'] = User::$models = array_merge(User::$models, $models);
+	}
+
+	/**
+	 * Registers additional users methods
+	 */
+	protected function extendUsersMethods(array $methods): array
+	{
+		return $this->extensions['usersMethods'] = Users::$methods = array_merge(Users::$methods, $methods);
+	}
+
+	/**
+	 * Registers additional custom validators
+	 */
+	protected function extendValidators(array $validators): array
+	{
+		return $this->extensions['validators'] = V::$validators = array_merge(V::$validators, $validators);
+	}
+
+	/**
+	 * Returns a given extension by type and name
+	 *
+	 * @internal
+	 * @param string $type i.e. `'hooks'`
+	 * @param string $name i.e. `'page.delete:before'`
+	 */
+	public function extension(
+		string $type,
+		string $name,
+		mixed $fallback = null
+	): mixed {
+		return $this->extensions($type)[$name] ?? $fallback;
+	}
+
+	/**
+	 * Returns the extensions registry
+	 *
+	 * @internal
+	 */
+	public function extensions(string $type = null): array
+	{
+		if ($type === null) {
+			return $this->extensions;
+		}
+
+		return $this->extensions[$type] ?? [];
+	}
+
+	/**
+	 * Load extensions from site folders.
+	 * This is only used for models for now, but
+	 * could be extended later
+	 */
+	protected function extensionsFromFolders(): void
+	{
+		$models = [];
+
+		foreach (glob($this->root('models') . '/*.php') as $model) {
+			$name  = F::name($model);
+			$class = str_replace(['.', '-', '_'], '', $name) . 'Page';
+
+			// load the model class
+			F::loadOnce($model, allowOutput: false);
+
+			if (class_exists($class) === true) {
+				$models[$name] = $class;
+			}
+		}
+
+		$this->extendPageModels($models);
+	}
+
+	/**
+	 * Register extensions that could be located in
+	 * the options array. I.e. hooks and routes can be
+	 * setup from the config.
+	 */
+	protected function extensionsFromOptions(): void
+	{
+		// register routes and hooks from options
+		$this->extend([
+			'api'    => $this->options['api']    ?? [],
+			'routes' => $this->options['routes'] ?? [],
+			'hooks'  => $this->options['hooks']  ?? []
+		]);
+	}
+
+	/**
+	 * Apply all plugin extensions
+	 */
+	protected function extensionsFromPlugins(): void
+	{
+		// register all their extensions
+		foreach ($this->plugins() as $plugin) {
+			$extends = $plugin->extends();
+
+			if (empty($extends) === false) {
+				$this->extend($extends, $plugin);
+			}
+		}
+	}
+
+	/**
+	 * Apply all passed extensions
+	 */
+	protected function extensionsFromProps(array $props): void
+	{
+		$this->extend($props);
+	}
+
+	/**
+	 * Apply all default extensions
+	 */
+	protected function extensionsFromSystem(): void
+	{
+		// Always start with fresh fields and sections
+		// from the core and add plugins on top of that
+		FormField::$types = [];
+		Section::$types   = [];
+
+		// mixins
+		FormField::$mixins = $this->core->fieldMixins();
+		Section::$mixins   = $this->core->sectionMixins();
+
+		// aliases
+		KirbyTag::$aliases = $this->core->kirbyTagAliases();
+		Field::$aliases    = $this->core->fieldMethodAliases();
+
+		// blueprint presets
+		PageBlueprint::$presets = $this->core->blueprintPresets();
+
+		$this->extendAuthChallenges($this->core->authChallenges());
+		$this->extendCacheTypes($this->core->cacheTypes());
+		$this->extendComponents($this->core->components());
+		$this->extendBlueprints($this->core->blueprints());
+		$this->extendFieldMethods($this->core->fieldMethods());
+		$this->extendFields($this->core->fields());
+		$this->extendSections($this->core->sections());
+		$this->extendSnippets($this->core->snippets());
+		$this->extendTags($this->core->kirbyTags());
+		$this->extendTemplates($this->core->templates());
+	}
+
+	/**
+	 * Checks if a native component was extended
+	 * @since 3.7.0
+	 */
+	public function isNativeComponent(string $component): bool
+	{
+		return $this->component($component) === $this->nativeComponent($component);
+	}
+
+	/**
+	 * Returns the native implementation
+	 * of a core component
+	 */
+	public function nativeComponent(string $component): Closure|false
+	{
+		return $this->core->components()[$component] ?? false;
+	}
+
+	/**
+	 * Kirby plugin factory and getter
+	 *
+	 * @param array|null $extends If null is passed it will be used as getter. Otherwise as factory.
+	 * @throws \Kirby\Exception\DuplicateException
+	 */
+	public static function plugin(
+		string $name,
+		array $extends = null,
+		array $info = [],
+		string|null $root = null,
+		string|null $version = null
+	): Plugin|null {
+		if ($extends === null) {
+			return static::$plugins[$name] ?? null;
+		}
+
+		$plugin = new Plugin(
+			name:    $name,
+			extends: $extends,
+			info:    $info,
+			// TODO: Remove fallback to $extends in v7
+			root:    $root ?? $extends['root'] ?? dirname(debug_backtrace()[0]['file']),
+			version: $version
+		);
+
+		$name = $plugin->name();
+
+		if (isset(static::$plugins[$name]) === true) {
+			throw new DuplicateException('The plugin "' . $name . '" has already been registered');
+		}
+
+		return static::$plugins[$name] = $plugin;
+	}
+
+	/**
+	 * Loads and returns all plugins in the site/plugins directory
+	 * Loading only happens on the first call.
+	 *
+	 * @internal
+	 * @param array|null $plugins Can be used to overwrite the plugins registry
+	 */
+	public function plugins(array $plugins = null): array
+	{
+		// overwrite the existing plugins registry
+		if ($plugins !== null) {
+			$this->pluginsAreLoaded = true;
+			return static::$plugins = $plugins;
+		}
+
+		// don't load plugins twice
+		if ($this->pluginsAreLoaded === true) {
+			return static::$plugins;
+		}
+
+		// load all plugins from site/plugins
+		$this->pluginsLoader();
+
+		// mark plugins as loaded to stop doing it twice
+		$this->pluginsAreLoaded = true;
+		return static::$plugins;
+	}
+
+	/**
+	 * Loads all plugins from site/plugins
+	 *
+	 * @return array Array of loaded directories
+	 */
+	protected function pluginsLoader(): array
+	{
+		$root   = $this->root('plugins');
+		$loaded = [];
+
+		foreach (Dir::read($root) as $dirname) {
+			if (in_array(substr($dirname, 0, 1), ['.', '_']) === true) {
+				continue;
+			}
+
+			$dir = $root . '/' . $dirname;
+
+			if (is_dir($dir) !== true) {
+				continue;
+			}
+
+			$entry  = $dir . '/index.php';
+			$script = $dir . '/index.js';
+			$styles = $dir . '/index.css';
+
+			if (is_file($entry) === true) {
+				F::loadOnce($entry, allowOutput: false);
+			} elseif (is_file($script) === true || is_file($styles) === true) {
+				// if no PHP file is present but an index.js or index.css,
+				// register as anonymous plugin (without actual extensions)
+				// to be picked up by the Panel\Document class when
+				// rendering the Panel view
+				static::plugin(
+					name: 'plugins/' . $dirname,
+					extends: [],
+					root: $dir
+				);
+			} else {
+				continue;
+			}
+
+			$loaded[] = $dir;
+		}
+
+		return $loaded;
+	}
+}

kirby/src/Cms/AppTranslations.php

@@ -0,0 +1,174 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Toolkit\I18n;
+use Kirby\Toolkit\Str;
+
+/**
+ * AppTranslations
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+trait AppTranslations
+{
+	protected Translations|null $translations = null;
+
+	/**
+	 * Setup internationalization
+	 */
+	protected function i18n(): void
+	{
+		I18n::$load = function ($locale): array {
+			$data = $this->translation($locale)?->data() ?? [];
+
+			// inject translations from the current language
+			if (
+				$this->multilang() === true &&
+				$language = $this->languages()->find($locale)
+			) {
+				$data = array_merge($data, $language->translations());
+			}
+
+
+			return $data;
+		};
+
+		// the actual locale is set using $app->setCurrentTranslation()
+		I18n::$locale = function (): string {
+			if ($this->multilang() === true) {
+				return $this->defaultLanguage()->code();
+			}
+
+			return 'en';
+		};
+
+		I18n::$fallback = function (): array {
+			if ($this->multilang() === true) {
+				// first try to fall back to the configured default language
+				$defaultCode = $this->defaultLanguage()->code();
+				$fallback = [$defaultCode];
+
+				// if the default language is specified with a country code
+				// (e.g. `en-us`), also try with just the language code
+				if (preg_match('/^([a-z]{2})-[a-z]+$/i', $defaultCode, $matches) === 1) {
+					$fallback[] = $matches[1];
+				}
+
+				// fall back to the complete English translation
+				// as a last resort
+				$fallback[] = 'en';
+
+				return $fallback;
+			}
+
+			return ['en'];
+		};
+
+		I18n::$translations = [];
+
+		// add slug rules based on config option
+		if ($slugs = $this->option('slugs')) {
+			// two ways that the option can be defined:
+			// "slugs" => "de" or "slugs" => ["language" => "de"]
+			if ($slugs = $slugs['language'] ?? $slugs ?? null) {
+				Str::$language = Language::loadRules($slugs);
+			}
+		}
+	}
+
+	/**
+	 * Returns the language code that will be used
+	 * for the Panel if no user is logged in or if
+	 * no language is configured for the user
+	 */
+	public function panelLanguage(): string
+	{
+		if ($this->multilang() === true) {
+			$defaultCode = $this->defaultLanguage()->code();
+
+			// extract the language code from a language that
+			// contains the country code (e.g. `en-us`)
+			if (preg_match('/^([a-z]{2})-[a-z]+$/i', $defaultCode, $matches) === 1) {
+				$defaultCode = $matches[1];
+			}
+		} else {
+			$defaultCode = 'en';
+		}
+
+		return $this->option('panel.language', $defaultCode);
+	}
+
+	/**
+	 * Set the current translation
+	 *
+	 * @internal
+	 */
+	public function setCurrentTranslation(string $translationCode = null): void
+	{
+		I18n::$locale = $translationCode ?? 'en';
+	}
+
+	/**
+	 * Load a specific translation by locale
+	 *
+	 * @param string|null $locale Locale name or `null` for the current locale
+	 */
+	public function translation(string|null $locale = null): Translation
+	{
+		$locale ??= I18n::locale();
+		$locale = basename($locale);
+
+		// prefer loading them from the translations collection
+		if ($this->translations instanceof Translations) {
+			if ($translation = $this->translations()->find($locale)) {
+				return $translation;
+			}
+		}
+
+		// get injected translation data from plugins etc.
+		$inject = $this->extensions['translations'][$locale] ?? [];
+
+		// inject current language translations
+		if ($language = $this->language($locale)) {
+			$inject = array_merge($inject, $language->translations());
+		}
+
+		// load from disk instead
+		return Translation::load($locale, $this->root('i18n:translations') . '/' . $locale . '.json', $inject);
+	}
+
+	/**
+	 * Returns all available translations
+	 */
+	public function translations(): Translations
+	{
+		if ($this->translations instanceof Translations) {
+			return $this->translations;
+		}
+
+		$translations = $this->extensions['translations'] ?? [];
+
+		// injects languages translations
+		if ($languages = $this->languages()) {
+			foreach ($languages as $language) {
+				$languageCode         = $language->code();
+				$languageTranslations = $language->translations();
+
+				// merges language translations with extensions translations
+				if (empty($languageTranslations) === false) {
+					$translations[$languageCode] = array_merge(
+						$translations[$languageCode] ?? [],
+						$languageTranslations
+					);
+				}
+			}
+		}
+
+		return $this->translations = Translations::load($this->root('i18n:translations'), $translations);
+	}
+}

kirby/src/Cms/AppUsers.php

@@ -0,0 +1,131 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Closure;
+use Throwable;
+
+/**
+ * AppUsers
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+trait AppUsers
+{
+	protected Auth|null $auth = null;
+	protected User|string|null $user = null;
+	protected Users|null $users = null;
+
+	/**
+	 * Returns the Authentication layer class
+	 * @internal
+	 */
+	public function auth(): Auth
+	{
+		return $this->auth ??= new Auth($this);
+	}
+
+	/**
+	 * Become any existing user or disable the current user
+	 *
+	 * @param string|null $who User ID or email address,
+	 *                         `null` to use the actual user again,
+	 *                         `'kirby'` for a virtual admin user or
+	 *                         `'nobody'` to disable the actual user
+	 * @param Closure|null $callback Optional action function that will be run with
+	 *                               the permissions of the impersonated user; the
+	 *                               impersonation will be reset afterwards
+	 * @return mixed If called without callback: User that was impersonated;
+	 *               if called with callback: Return value from the callback
+	 * @throws \Throwable
+	 */
+	public function impersonate(
+		string|null $who = null,
+		Closure|null $callback = null
+	): mixed {
+		$auth = $this->auth();
+
+		$userBefore = $auth->currentUserFromImpersonation();
+		$userAfter  = $auth->impersonate($who);
+
+		if ($callback === null) {
+			return $userAfter;
+		}
+
+		try {
+			return $callback($userAfter);
+		} catch (Throwable $e) {
+			throw $e;
+		} finally {
+			// ensure that the impersonation is *always* reset
+			// to the original value, even if an error occurred
+			$auth->impersonate($userBefore?->id());
+		}
+	}
+
+	/**
+	 * Set the currently active user id
+	 *
+	 * @return $this
+	 */
+	protected function setUser(User|string $user = null): static
+	{
+		$this->user = $user;
+		return $this;
+	}
+
+	/**
+	 * Create your own set of app users
+	 *
+	 * @return $this
+	 */
+	protected function setUsers(array $users = null): static
+	{
+		if ($users !== null) {
+			$this->users = Users::factory($users);
+		}
+
+		return $this;
+	}
+
+	/**
+	 * Returns a specific user by id
+	 * or the current user if no id is given
+	 *
+	 * @param bool $allowImpersonation If set to false, only the actually
+	 *                                 logged in user will be returned
+	 *                                 (when `$id` is passed as `null`)
+	 */
+	public function user(
+		string|null $id = null,
+		bool $allowImpersonation = true
+	): User|null {
+		if ($id !== null) {
+			return $this->users()->find($id);
+		}
+
+		if ($allowImpersonation === true && is_string($this->user) === true) {
+			return $this->auth()->impersonate($this->user);
+		}
+
+		try {
+			return $this->auth()->user(null, $allowImpersonation);
+		} catch (Throwable) {
+			return null;
+		}
+	}
+
+	/**
+	 * Returns all users
+	 */
+	public function users(): Users
+	{
+		return $this->users ??= Users::load(
+			$this->root('accounts'),
+		);
+	}
+}

kirby/src/Cms/Auth.php

@@ -0,0 +1,928 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Cms\Auth\Challenge;
+use Kirby\Cms\Auth\Status;
+use Kirby\Data\Data;
+use Kirby\Exception\Exception;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Exception\LogicException;
+use Kirby\Exception\NotFoundException;
+use Kirby\Exception\PermissionException;
+use Kirby\Filesystem\F;
+use Kirby\Http\Idn;
+use Kirby\Http\Request\Auth\BasicAuth;
+use Kirby\Session\Session;
+use Kirby\Toolkit\A;
+use SensitiveParameter;
+use Throwable;
+
+/**
+ * Authentication layer
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Auth
+{
+	/**
+	 * Available auth challenge classes
+	 * from the core and plugins
+	 */
+	public static array $challenges = [];
+
+	/**
+	 * Currently impersonated user
+	 */
+	protected User|null $impersonate = null;
+
+	/**
+	 * Cache of the auth status object
+	 */
+	protected Status|null $status = null;
+
+	/**
+	 * Instance of the currently logged in user or
+	 * `false` if the user was not yet determined
+	 */
+	protected User|false|null $user = false;
+
+	/**
+	 * Exception that was thrown while
+	 * determining the current user
+	 */
+	protected Throwable|null $userException = null;
+
+	/**
+	 * @codeCoverageIgnore
+	 */
+	public function __construct(
+		protected App $kirby
+	) {
+	}
+
+	/**
+	 * Creates an authentication challenge
+	 * (one-time auth code)
+	 * @since 3.5.0
+	 *
+	 * @param bool $long If `true`, a long session will be created
+	 * @param 'login'|'password-reset'|'2fa' $mode Purpose of the code
+	 *
+	 * @throws \Kirby\Exception\LogicException If there is no suitable authentication challenge (only in debug mode)
+	 * @throws \Kirby\Exception\NotFoundException If the user does not exist (only in debug mode)
+	 * @throws \Kirby\Exception\PermissionException If the rate limit is exceeded
+	 */
+	public function createChallenge(
+		string $email,
+		bool $long = false,
+		string $mode = 'login'
+	): Status {
+		$email = Idn::decodeEmail($email);
+
+		$session = $this->kirby->session([
+			'createMode' => 'cookie',
+			'long'       => $long === true
+		]);
+
+		$timeout = $this->kirby->option('auth.challenge.timeout', 10 * 60);
+
+		// catch every exception to hide them from attackers
+		// unless auth debugging is enabled
+		try {
+			$this->checkRateLimit($email);
+
+			// rate-limit the number of challenges for DoS/DDoS protection
+			$this->track($email, false);
+
+			// try to find the provided user
+			$user = $this->kirby->users()->find($email);
+			if ($user === null) {
+				$this->kirby->trigger('user.login:failed', compact('email'));
+
+				throw new NotFoundException([
+					'key'  => 'user.notFound',
+					'data' => [
+						'name' => $email
+					]
+				]);
+			}
+
+			// try to find an enabled challenge that is available for that user
+			$challenge = null;
+			foreach ($this->enabledChallenges() as $name) {
+				$class = static::$challenges[$name] ?? null;
+				if (
+					$class &&
+					class_exists($class) === true &&
+					is_subclass_of($class, Challenge::class) === true &&
+					$class::isAvailable($user, $mode) === true
+				) {
+					$challenge = $name;
+					$code = $class::create($user, compact('mode', 'timeout'));
+
+					$session->set('kirby.challenge.type', $challenge);
+
+					if ($code !== null) {
+						$session->set(
+							'kirby.challenge.code',
+							password_hash($code, PASSWORD_DEFAULT)
+						);
+					}
+
+					break;
+				}
+			}
+
+			// if no suitable challenge was found, `$challenge === null` at this point
+			if ($challenge === null) {
+				throw new LogicException('Could not find a suitable authentication challenge');
+			}
+		} catch (Throwable $e) {
+			// only throw the exception in auth debug mode
+			$this->fail($e);
+		}
+
+		// always set the email and timeout, even if the challenge
+		// won't be created; this avoids leaking whether the user exists
+		$session->set('kirby.challenge.email', $email);
+		$session->set('kirby.challenge.timeout', time() + $timeout);
+
+		// sleep for a random amount of milliseconds
+		// to make automated attacks harder and to
+		// avoid leaking whether the user exists
+		usleep(random_int(50000, 300000));
+
+		// clear the status cache
+		$this->status = null;
+
+		return $this->status($session, false);
+	}
+
+	/**
+	 * Returns the csrf token if it exists and if it is valid
+	 */
+	public function csrf(): string|false
+	{
+		// get the csrf from the header
+		$fromHeader = $this->kirby->request()->csrf();
+
+		// check for a predefined csrf or use the one from session
+		$fromSession = $this->csrfFromSession();
+
+		// compare both tokens
+		if (hash_equals((string)$fromSession, (string)$fromHeader) !== true) {
+			return false;
+		}
+
+		return $fromSession;
+	}
+
+	/**
+	 * Returns either predefined csrf or the one from session
+	 * @since 3.6.0
+	 */
+	public function csrfFromSession(): string
+	{
+		$isDev    = $this->kirby->option('panel.dev', false) !== false;
+		$fallback = $isDev ? 'dev' : $this->kirby->csrf();
+		return $this->kirby->option('api.csrf', $fallback);
+	}
+
+	/**
+	 * Returns the logged in user by checking
+	 * for a basic authentication header with
+	 * valid credentials
+	 *
+	 * @param \Kirby\Http\Request\Auth\BasicAuth|null $auth
+	 * @throws \Kirby\Exception\InvalidArgumentException if the authorization header is invalid
+	 * @throws \Kirby\Exception\PermissionException if basic authentication is not allowed
+	 */
+	public function currentUserFromBasicAuth(BasicAuth $auth = null): User|null
+	{
+		if ($this->kirby->option('api.basicAuth', false) !== true) {
+			throw new PermissionException('Basic authentication is not activated');
+		}
+
+		// if logging in with password is disabled, basic auth cannot be possible either
+		$loginMethods = $this->kirby->system()->loginMethods();
+		if (isset($loginMethods['password']) !== true) {
+			throw new PermissionException('Login with password is not enabled');
+		}
+
+		// if any login method requires 2FA, basic auth without 2FA would be a weakness
+		foreach ($loginMethods as $method) {
+			if (isset($method['2fa']) === true && $method['2fa'] === true) {
+				throw new PermissionException('Basic authentication cannot be used with 2FA');
+			}
+		}
+
+		$request   = $this->kirby->request();
+		$auth    ??= $request->auth();
+
+		if (!$auth || $auth->type() !== 'basic') {
+			throw new InvalidArgumentException('Invalid authorization header');
+		}
+
+		// only allow basic auth when https is enabled or insecure requests permitted
+		if ($request->ssl() === false && $this->kirby->option('api.allowInsecure', false) !== true) {
+			throw new PermissionException('Basic authentication is only allowed over HTTPS');
+		}
+
+		return $this->validatePassword($auth->username(), $auth->password());
+	}
+
+	/**
+	 * Returns the currently impersonated user
+	 */
+	public function currentUserFromImpersonation(): User|null
+	{
+		return $this->impersonate;
+	}
+
+	/**
+	 * Returns the logged in user by checking
+	 * the current session and finding a valid
+	 * valid user id in there
+	 */
+	public function currentUserFromSession(
+		Session|array $session = null
+	): User|null {
+		$session = $this->session($session);
+
+		$id = $session->data()->get('kirby.userId');
+
+		// if no user is logged in, return immediately
+		if (is_string($id) !== true) {
+			return null;
+		}
+
+		// a user is logged in, ensure it exists
+		$user = $this->kirby->users()->find($id);
+		if ($user === null) {
+			return null;
+		}
+
+		if ($passwordTimestamp = $user->passwordTimestamp()) {
+			$loginTimestamp = $session->data()->get('kirby.loginTimestamp');
+			if (is_int($loginTimestamp) !== true) {
+				// session that was created before Kirby
+				// 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1 or 3.9.6
+				// or when the user didn't have a password set
+				$user->logout();
+				return null;
+			}
+
+			// invalidate the session if the password
+			// changed since the login
+			if ($loginTimestamp < $passwordTimestamp) {
+				$user->logout();
+				return null;
+			}
+		}
+
+		// in case the session needs to be updated, do it now
+		// for better performance
+		$session->commit();
+		return $user;
+	}
+
+	/**
+	 * Returns the list of enabled challenges in the
+	 * configured order
+	 * @since 3.5.1
+	 */
+	public function enabledChallenges(): array
+	{
+		return A::wrap(
+			$this->kirby->option('auth.challenges', ['totp', 'email'])
+		);
+	}
+
+	/**
+	 * Become any existing user or disable the current user
+	 *
+	 * @param string|null $who User ID or email address,
+	 *                         `null` to use the actual user again,
+	 *                         `'kirby'` for a virtual admin user or
+	 *                         `'nobody'` to disable the actual user
+	 * @throws \Kirby\Exception\NotFoundException if the given user cannot be found
+	 */
+	public function impersonate(string|null $who = null): User|null
+	{
+		// clear the status cache
+		$this->status = null;
+
+		return $this->impersonate = match ($who) {
+			null     => null,
+			'kirby'  => new User([
+				'email' => 'kirby@getkirby.com',
+				'id'    => 'kirby',
+				'role'  => 'admin',
+			]),
+			'nobody' => new User([
+				'email' => 'nobody@getkirby.com',
+				'id'    => 'nobody',
+				'role'  => 'nobody',
+			]),
+			default  => ($this->kirby->users()->find($who) ?? throw new NotFoundException('The user "' . $who . '" cannot be found'))
+		};
+	}
+
+	/**
+	 * Returns the hashed ip of the visitor
+	 * which is used to track invalid logins
+	 */
+	public function ipHash(): string
+	{
+		$hash = hash('sha256', $this->kirby->visitor()->ip());
+
+		// only use the first 50 chars to ensure privacy
+		return substr($hash, 0, 50);
+	}
+
+	/**
+	 * Check if logins are blocked for the current ip or email
+	 */
+	public function isBlocked(string $email): bool
+	{
+		$ip     = $this->ipHash();
+		$log    = $this->log();
+		$trials = $this->kirby->option('auth.trials', 10);
+
+		if ($entry = ($log['by-ip'][$ip] ?? null)) {
+			if ($entry['trials'] >= $trials) {
+				return true;
+			}
+		}
+
+		if ($this->kirby->users()->find($email)) {
+			if ($entry = ($log['by-email'][$email] ?? null)) {
+				if ($entry['trials'] >= $trials) {
+					return true;
+				}
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	 * Login a user by email and password
+	 *
+	 * @throws \Kirby\Exception\PermissionException If the rate limit was exceeded or if any other error occurred with debug mode off
+	 * @throws \Kirby\Exception\NotFoundException If the email was invalid
+	 * @throws \Kirby\Exception\InvalidArgumentException If the password is not valid (via `$user->login()`)
+	 */
+	public function login(
+		string $email,
+		#[SensitiveParameter]
+		string $password,
+		bool $long = false
+	): User {
+		// session options
+		$options = [
+			'createMode' => 'cookie',
+			'long'       => $long === true
+		];
+
+		// validate the user and log in to the session
+		$user = $this->validatePassword($email, $password);
+		$user->loginPasswordless($options);
+
+		// clear the status cache
+		$this->status = null;
+
+		return $user;
+	}
+
+	/**
+	 * Login a user by email, password and auth challenge
+	 * @since 3.5.0
+	 *
+	 * @throws \Kirby\Exception\PermissionException If the rate limit was exceeded or if any other error occurred with debug mode off
+	 * @throws \Kirby\Exception\NotFoundException If the email was invalid
+	 * @throws \Kirby\Exception\InvalidArgumentException If the password is not valid (via `$user->login()`)
+	 */
+	public function login2fa(
+		string $email,
+		#[SensitiveParameter]
+		string $password,
+		bool $long = false
+	): Status {
+		$this->validatePassword($email, $password);
+		return $this->createChallenge($email, $long, '2fa');
+	}
+
+	/**
+	 * Sets a user object as the current user in the cache
+	 * @internal
+	 */
+	public function setUser(User $user): void
+	{
+		// stop impersonating
+		$this->impersonate = null;
+		$this->user        = $user;
+
+		// clear the status cache
+		$this->status = null;
+	}
+
+	/**
+	 * Returns the authentication status object
+	 * @since 3.5.1
+	 *
+	 * @param bool $allowImpersonation If set to false, only the actually
+	 *                                 logged in user will be returned
+	 */
+	public function status(
+		Session|array $session = null,
+		bool $allowImpersonation = true
+	): Status {
+		// try to return from cache
+		if ($this->status && $session === null && $allowImpersonation === true) {
+			return $this->status;
+		}
+
+		$sessionObj = $this->session($session);
+
+		$props = ['kirby' => $this->kirby];
+		if ($user = $this->user($sessionObj, $allowImpersonation)) {
+			// a user is currently logged in
+			if ($allowImpersonation === true && $this->impersonate !== null) {
+				$props['status'] = 'impersonated';
+			} else {
+				$props['status'] = 'active';
+			}
+
+			$props['email'] = $user->email();
+		} elseif ($email = $sessionObj->get('kirby.challenge.email')) {
+			// a challenge is currently pending
+			$props['status']            = 'pending';
+			$props['email']             = $email;
+			$props['challenge']         = $sessionObj->get('kirby.challenge.type');
+			$props['challengeFallback'] = A::last($this->enabledChallenges());
+		} else {
+			// no active authentication
+			$props['status'] = 'inactive';
+		}
+
+		$status = new Status($props);
+
+		// only cache the default object
+		if ($session === null && $allowImpersonation === true) {
+			$this->status = $status;
+		}
+
+		return $status;
+	}
+
+	/**
+	 * Ensures that the rate limit was not exceeded
+	 *
+	 * @throws \Kirby\Exception\PermissionException If the rate limit was exceeded
+	 */
+	protected function checkRateLimit(string $email): void
+	{
+		// check for blocked ips
+		if ($this->isBlocked($email) === true) {
+			$this->kirby->trigger('user.login:failed', compact('email'));
+
+			throw new PermissionException([
+				'details'  => ['reason' => 'rate-limited'],
+				'fallback' => 'Rate limit exceeded'
+			]);
+		}
+	}
+
+	/**
+	 * Validates the user credentials and returns the user object on success;
+	 * otherwise logs the failed attempt
+	 *
+	 * @throws \Kirby\Exception\PermissionException If the rate limit was exceeded or if any other error occurred with debug mode off
+	 * @throws \Kirby\Exception\NotFoundException If the email was invalid
+	 * @throws \Kirby\Exception\InvalidArgumentException If the password is not valid (via `$user->login()`)
+	 */
+	public function validatePassword(
+		string $email,
+		#[SensitiveParameter]
+		string $password
+	): User {
+		$email = Idn::decodeEmail($email);
+
+		try {
+			$this->checkRateLimit($email);
+
+			// validate the user and its password
+			if ($user = $this->kirby->users()->find($email)) {
+				if ($user->validatePassword($password) === true) {
+					return $user;
+				}
+			}
+
+			throw new NotFoundException([
+				'key'  => 'user.notFound',
+				'data' => [
+					'name' => $email
+				]
+			]);
+		} catch (Throwable $e) {
+			$details = $e instanceof Exception ? $e->getDetails() : [];
+
+			// log invalid login trial unless the rate limit is already active
+			if (($details['reason'] ?? null) !== 'rate-limited') {
+				try {
+					$this->track($email);
+				} catch (Throwable $e) {
+					// $e is overwritten with the exception
+					// from the track method if there's one
+				}
+			}
+
+			// sleep for a random amount of milliseconds
+			// to make automated attacks harder
+			usleep(random_int(10000, 2000000));
+
+			// keep throwing the original error in debug mode,
+			// otherwise hide it to avoid leaking security-relevant information
+			$this->fail($e, new PermissionException(['key' => 'access.login']));
+		}
+	}
+
+	/**
+	 * Returns the absolute path to the logins log
+	 */
+	public function logfile(): string
+	{
+		return $this->kirby->root('accounts') . '/.logins';
+	}
+
+	/**
+	 * Read all tracked logins
+	 */
+	public function log(): array
+	{
+		try {
+			$log  = Data::read($this->logfile(), 'json');
+			$read = true;
+		} catch (Throwable) {
+			$log  = [];
+			$read = false;
+		}
+
+		// ensure that the category arrays are defined
+		$log['by-ip']    ??= [];
+		$log['by-email'] ??= [];
+
+		// remove all elements on the top level with different keys (old structure)
+		$log = array_intersect_key($log, array_flip(['by-ip', 'by-email']));
+
+		// remove entries that are no longer needed
+		$originalLog = $log;
+		$time = time() - $this->kirby->option('auth.timeout', 3600);
+		foreach ($log as $category => $entries) {
+			$log[$category] = array_filter(
+				$entries,
+				fn ($entry) => $entry['time'] > $time
+			);
+		}
+
+		// write new log to the file system if it changed
+		if ($read === false || $log !== $originalLog) {
+			if (count($log['by-ip']) === 0 && count($log['by-email']) === 0) {
+				F::remove($this->logfile());
+			} else {
+				Data::write($this->logfile(), $log, 'json');
+			}
+		}
+
+		return $log;
+	}
+
+	/**
+	 * Logout the current user
+	 */
+	public function logout(): void
+	{
+		// stop impersonating;
+		// ensures that we log out the actually logged in user
+		$this->impersonate = null;
+
+		// logout the current user if it exists
+		$this->user()?->logout();
+
+		// clear the pending challenge
+		$session = $this->kirby->session();
+		$session->remove('kirby.challenge.code');
+		$session->remove('kirby.challenge.email');
+		$session->remove('kirby.challenge.timeout');
+		$session->remove('kirby.challenge.type');
+
+		// clear the status cache
+		$this->status = null;
+	}
+
+	/**
+	 * Clears the cached user data after logout
+	 * @internal
+	 */
+	public function flush(): void
+	{
+		$this->impersonate = null;
+		$this->status = null;
+		$this->user = null;
+	}
+
+	/**
+	 * Tracks a login
+	 *
+	 * @param bool $triggerHook If `false`, no user.login:failed hook is triggered
+	 */
+	public function track(
+		string|null $email,
+		bool $triggerHook = true
+	): bool {
+		if ($triggerHook === true) {
+			$this->kirby->trigger('user.login:failed', compact('email'));
+		}
+
+		$ip   = $this->ipHash();
+		$log  = $this->log();
+		$time = time();
+
+		if (isset($log['by-ip'][$ip]) === true) {
+			$log['by-ip'][$ip] = [
+				'time'   => $time,
+				'trials' => ($log['by-ip'][$ip]['trials'] ?? 0) + 1
+			];
+		} else {
+			$log['by-ip'][$ip] = [
+				'time'   => $time,
+				'trials' => 1
+			];
+		}
+
+		if ($email !== null && $this->kirby->users()->find($email)) {
+			if (isset($log['by-email'][$email]) === true) {
+				$log['by-email'][$email] = [
+					'time'   => $time,
+					'trials' => ($log['by-email'][$email]['trials'] ?? 0) + 1
+				];
+			} else {
+				$log['by-email'][$email] = [
+					'time'   => $time,
+					'trials' => 1
+				];
+			}
+		}
+
+		return Data::write($this->logfile(), $log, 'json');
+	}
+
+	/**
+	 * Returns the current authentication type
+	 *
+	 * @param bool $allowImpersonation If set to false, 'impersonate' won't
+	 *                                 be returned as authentication type
+	 *                                 even if an impersonation is active
+	 */
+	public function type(bool $allowImpersonation = true): string
+	{
+		$basicAuth = $this->kirby->option('api.basicAuth', false);
+		$request   = $this->kirby->request();
+
+		if (
+			$basicAuth === true &&
+
+			// only get the auth object if the option is enabled
+			// to avoid triggering `$responder->usesAuth()` if
+			// the option is disabled
+			$request->auth() &&
+			$request->auth()->type() === 'basic'
+		) {
+			return 'basic';
+		}
+
+		if ($allowImpersonation === true && $this->impersonate !== null) {
+			return 'impersonate';
+		}
+
+		return 'session';
+	}
+
+	/**
+	 * Validates the currently logged in user
+	 *
+	 * @param bool $allowImpersonation If set to false, only the actually
+	 *                                 logged in user will be returned
+	 *
+	 * @throws \Throwable If an authentication error occurred
+	 */
+	public function user(
+		Session|array $session = null,
+		bool $allowImpersonation = true
+	): User|null {
+		if ($allowImpersonation === true && $this->impersonate !== null) {
+			return $this->impersonate;
+		}
+
+		// return from cache
+		if ($this->user === null) {
+			// throw the same Exception again if one was captured before
+			if ($this->userException !== null) {
+				throw $this->userException;
+			}
+
+			return null;
+		}
+
+		if ($this->user !== false) {
+			return $this->user;
+		}
+
+		try {
+			if ($this->type() === 'basic') {
+				return $this->user = $this->currentUserFromBasicAuth();
+			}
+
+			return $this->user = $this->currentUserFromSession($session);
+		} catch (Throwable $e) {
+			$this->user = null;
+
+			// capture the Exception for future calls
+			$this->userException = $e;
+
+			throw $e;
+		}
+	}
+
+	/**
+	 * Verifies an authentication code that was
+	 * requested with the `createChallenge()` method;
+	 * if successful, the user is automatically logged in
+	 * @since 3.5.0
+	 *
+	 * @param string $code User-provided auth code to verify
+	 * @return \Kirby\Cms\User User object of the logged-in user
+	 *
+	 * @throws \Kirby\Exception\PermissionException If the rate limit was exceeded, the challenge timed out, the code
+	 *                                              is incorrect or if any other error occurred with debug mode off
+	 * @throws \Kirby\Exception\NotFoundException If the user from the challenge doesn't exist
+	 * @throws \Kirby\Exception\InvalidArgumentException If no authentication challenge is active
+	 * @throws \Kirby\Exception\LogicException If the authentication challenge is invalid
+	 */
+	public function verifyChallenge(
+		#[SensitiveParameter]
+		string $code
+	): User {
+		try {
+			$session = $this->kirby->session();
+
+			// time-limiting; check this early so that we can destroy the session no
+			// matter if the user exists (avoids leaking user information to attackers)
+			$timeout = $session->get('kirby.challenge.timeout');
+			if ($timeout !== null && time() > $timeout) {
+				// this challenge can never be completed,
+				// so delete it immediately
+				$this->logout();
+
+				throw new PermissionException([
+					'details'  => ['challengeDestroyed' => true],
+					'fallback' => 'Authentication challenge timeout'
+				]);
+			}
+
+			// check if we have an active challenge
+			$email     = $session->get('kirby.challenge.email');
+			$challenge = $session->get('kirby.challenge.type');
+			if (is_string($email) !== true || is_string($challenge) !== true) {
+				// if the challenge timed out on the previous request, the
+				// challenge data was already deleted from the session, so we can
+				// set `challengeDestroyed` to `true` in this response as well;
+				// however we must only base this on the email, not the type
+				// (otherwise "faked" challenges would be leaked)
+				$challengeDestroyed = is_string($email) !== true;
+
+				throw new InvalidArgumentException([
+					'details'  => compact('challengeDestroyed'),
+					'fallback' => 'No authentication challenge is active'
+				]);
+			}
+
+			$user = $this->kirby->users()->find($email);
+			if ($user === null) {
+				throw new NotFoundException([
+					'key'  => 'user.notFound',
+					'data' => [
+						'name' => $email
+					]
+				]);
+			}
+
+			// rate-limiting
+			$this->checkRateLimit($email);
+
+			if (
+				isset(static::$challenges[$challenge]) === true &&
+				class_exists(static::$challenges[$challenge]) === true &&
+				is_subclass_of(static::$challenges[$challenge], Challenge::class) === true
+			) {
+				$class = static::$challenges[$challenge];
+				if ($class::verify($user, $code) === true) {
+					$this->logout();
+					$user->loginPasswordless();
+
+					// clear the status cache
+					$this->status = null;
+
+					return $user;
+				}
+
+				throw new PermissionException(['key' => 'access.code']);
+			}
+
+			throw new LogicException(
+				'Invalid authentication challenge: ' . $challenge
+			);
+		} catch (Throwable $e) {
+			$details = $e instanceof Exception ? $e->getDetails() : [];
+
+			if (
+				empty($email) === false &&
+				($details['reason'] ?? null) !== 'rate-limited'
+			) {
+				$this->track($email);
+			}
+
+			// sleep for a random amount of milliseconds
+			// to make automated attacks harder and to
+			// avoid leaking whether the user exists
+			usleep(random_int(10000, 2000000));
+
+			// specifically copy over the marker for a destroyed challenge
+			// even in production (used by the Panel to reset to the login form)
+			$challengeDestroyed = $details['challengeDestroyed'] ?? false;
+
+			$fallback = new PermissionException([
+				'details' => compact('challengeDestroyed'),
+				'key'     => 'access.code'
+			]);
+
+			// keep throwing the original error in debug mode,
+			// otherwise hide it to avoid leaking security-relevant information
+			$this->fail($e, $fallback);
+		}
+	}
+
+	/**
+	 * Throws an exception only in debug mode, otherwise falls back
+	 * to a public error without sensitive information
+	 *
+	 * @throws \Throwable Either the passed `$exception` or the `$fallback`
+	 *                    (no exception if debugging is disabled and no fallback was passed)
+	 */
+	protected function fail(
+		Throwable $exception,
+		Throwable $fallback = null
+	): void {
+		$debug = $this->kirby->option('auth.debug', 'log');
+
+		// throw the original exception only in debug mode
+		if ($debug === true) {
+			throw $exception;
+		}
+
+		// otherwise hide the real error and only print it to the error log
+		// unless disabled by setting `auth.debug` to `false`
+		if ($debug === 'log') {
+			error_log($exception); // @codeCoverageIgnore
+		}
+
+		// only throw an error in production if requested by the calling method
+		if ($fallback !== null) {
+			throw $fallback;
+		}
+	}
+
+	/**
+	 * Creates a session object from the passed options
+	 */
+	protected function session(Session|array $session = null): Session
+	{
+		// use passed session options or session object if set
+		if (is_array($session) === true) {
+			return $this->kirby->session($session);
+		}
+
+		// try session in header or cookie
+		if ($session instanceof Session === false) {
+			return $this->kirby->session(['detect' => true]);
+		}
+
+		return $session;
+	}
+}

kirby/src/Cms/Auth/Challenge.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace Kirby\Cms\Auth;
+
+use Kirby\Cms\User;
+use SensitiveParameter;
+
+/**
+ * Template class for authentication challenges
+ * that create and verify one-time auth codes
+ *
+ * @package   Kirby Cms
+ * @author    Lukas Bestle <lukas@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+abstract class Challenge
+{
+	/**
+	 * Checks whether the challenge is available
+	 * for the passed user and purpose
+	 *
+	 * @param \Kirby\Cms\User $user User the code will be generated for
+	 * @param 'login'|'password-reset'|'2fa' $mode Purpose of the code
+	 */
+	abstract public static function isAvailable(User $user, string $mode): bool;
+
+	/**
+	 * Generates a random one-time auth code and returns that code
+	 * for later verification
+	 *
+	 * @param \Kirby\Cms\User $user User to generate the code for
+	 * @param array $options Details of the challenge request:
+	 *                       - 'mode': Purpose of the code ('login', 'password-reset' or '2fa')
+	 *                       - 'timeout': Number of seconds the code will be valid for
+	 * @return string|null The generated and sent code or `null` in case
+	 *                     there was no code to generate by this algorithm
+	 */
+	abstract public static function create(User $user, array $options): string|null;
+
+	/**
+	 * Verifies the provided code against the created one;
+	 * default implementation that checks the code that was
+	 * returned from the `create()` method
+	 *
+	 * @param \Kirby\Cms\User $user User to check the code for
+	 * @param string $code Code to verify
+	 */
+	public static function verify(
+		User $user,
+		#[SensitiveParameter]
+		string $code
+	): bool {
+		$hash = $user->kirby()->session()->get('kirby.challenge.code');
+		if (is_string($hash) !== true) {
+			return false;
+		}
+
+		// normalize the formatting in the user-provided code
+		$code = str_replace(' ', '', $code);
+
+		return password_verify($code, $hash);
+	}
+}

kirby/src/Cms/Auth/EmailChallenge.php

@@ -0,0 +1,76 @@
+<?php
+
+namespace Kirby\Cms\Auth;
+
+use Kirby\Cms\User;
+use Kirby\Toolkit\I18n;
+use Kirby\Toolkit\Str;
+
+/**
+ * Creates and verifies one-time auth codes
+ * that are sent via email
+ *
+ * @package   Kirby Cms
+ * @author    Lukas Bestle <lukas@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class EmailChallenge extends Challenge
+{
+	/**
+	 * Checks whether the challenge is available
+	 * for the passed user and purpose
+	 *
+	 * @param \Kirby\Cms\User $user User the code will be generated for
+	 * @param 'login'|'password-reset'|'2fa' $mode Purpose of the code
+	 */
+	public static function isAvailable(User $user, string $mode): bool
+	{
+		return true;
+	}
+
+	/**
+	 * Generates a random one-time auth code and returns that code
+	 * for later verification
+	 *
+	 * @param \Kirby\Cms\User $user User to generate the code for
+	 * @param array $options Details of the challenge request:
+	 *                       - 'mode': Purpose of the code ('login', 'password-reset' or '2fa')
+	 *                       - 'timeout': Number of seconds the code will be valid for
+	 * @return string The generated and sent code
+	 */
+	public static function create(User $user, array $options): string
+	{
+		$code = Str::random(6, 'num');
+
+		// insert a space in the middle for easier readability
+		$formatted = substr($code, 0, 3) . ' ' . substr($code, 3, 3);
+
+		// use the login templates for 2FA
+		$mode = $options['mode'];
+		if ($mode === '2fa') {
+			$mode = 'login';
+		}
+
+		$kirby = $user->kirby();
+		$kirby->email([
+			'from' => $kirby->option('auth.challenge.email.from', 'noreply@' . $kirby->url('index', true)->host()),
+			'fromName' => $kirby->option('auth.challenge.email.fromName', $kirby->site()->title()),
+			'to' => $user,
+			'subject' => $kirby->option(
+				'auth.challenge.email.subject',
+				I18n::translate('login.email.' . $mode . '.subject', null, $user->language())
+			),
+			'template' => 'auth/' . $mode,
+			'data' => [
+				'user'    => $user,
+				'site'    => $kirby->system()->title(),
+				'code'    => $formatted,
+				'timeout' => round($options['timeout'] / 60)
+			]
+		]);
+
+		return $code;
+	}
+}

kirby/src/Cms/Auth/Status.php

@@ -0,0 +1,160 @@
+<?php
+
+namespace Kirby\Cms\Auth;
+
+use Kirby\Cms\App;
+use Kirby\Cms\User;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Toolkit\Properties;
+
+/**
+ * Information container for the
+ * authentication status
+ * @since 3.5.1
+ *
+ * @package   Kirby Cms
+ * @author    Lukas Bestle <lukas@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Status
+{
+	/**
+	 * Type of the active challenge
+	 */
+	protected string|null $challenge = null;
+
+	/**
+	 * Challenge type to use as a fallback
+	 * when $challenge is `null`
+	 */
+	protected string|null $challengeFallback = null;
+
+	/**
+	 * Email address of the current/pending user
+	 */
+	protected string|null $email;
+
+	/**
+	 * Kirby instance for user lookup
+	 */
+	protected App $kirby;
+
+	/**
+	 * Authentication status:
+	 * `active|impersonated|pending|inactive`
+	 */
+	protected string $status;
+
+	/**
+	 * Class constructor
+	 *
+	 * @param array $props
+	 */
+	public function __construct(array $props)
+	{
+		if (in_array($props['status'], ['active', 'impersonated', 'pending', 'inactive']) !== true) {
+			throw new InvalidArgumentException([
+				'data' => [
+					'argument' => '$props[\'status\']',
+					'method'   => 'Status::__construct'
+				]
+			]);
+		}
+
+		$this->kirby 		 	 = $props['kirby'];
+		$this->challenge 		 = $props['challenge'] ?? null;
+		$this->challengeFallback = $props['challengeFallback'] ?? null;
+		$this->email 		 	 = $props['email'] ?? null;
+		$this->status 			 = $props['status'];
+	}
+
+	/**
+	 * Returns the authentication status
+	 */
+	public function __toString(): string
+	{
+		return $this->status();
+	}
+
+	/**
+	 * Returns the type of the active challenge
+	 *
+	 * @param bool $automaticFallback If set to `false`, no faked challenge is returned;
+	 *                                WARNING: never send the resulting `null` value to the
+	 *                                user to avoid leaking whether the pending user exists
+	 */
+	public function challenge(bool $automaticFallback = true): string|null
+	{
+		// never return a challenge type if the status doesn't match
+		if ($this->status() !== 'pending') {
+			return null;
+		}
+
+		if ($automaticFallback === false) {
+			return $this->challenge;
+		}
+
+		return $this->challenge ?? $this->challengeFallback;
+	}
+
+	/**
+	 * Creates a new instance while
+	 * merging initial and new properties
+	 */
+	public function clone(array $props = []): static
+	{
+		return new static(array_replace_recursive([
+			'kirby' 			=> $this->kirby,
+			'challenge' 		=> $this->challenge,
+			'challengeFallback' => $this->challengeFallback,
+			'email' 			=> $this->email,
+			'status' 			=> $this->status,
+		], $props));
+	}
+
+	/**
+	 * Returns the email address of the current/pending user
+	 */
+	public function email(): string|null
+	{
+		return $this->email;
+	}
+
+	/**
+	 * Returns the authentication status
+	 *
+	 * @return string `active|impersonated|pending|inactive`
+	 */
+	public function status(): string
+	{
+		return $this->status;
+	}
+
+	/**
+	 * Returns an array with all public status data
+	 */
+	public function toArray(): array
+	{
+		return [
+			'challenge' => $this->challenge(),
+			'email'     => $this->email(),
+			'status'    => $this->status()
+		];
+	}
+
+	/**
+	 * Returns the currently logged in user
+	 */
+	public function user(): User|null
+	{
+		// for security, only return the user if they are
+		// already logged in
+		if (in_array($this->status(), ['active', 'impersonated']) !== true) {
+			return null;
+		}
+
+		return $this->kirby->user($this->email());
+	}
+}

kirby/src/Cms/Auth/TotpChallenge.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace Kirby\Cms\Auth;
+
+use Kirby\Cms\User;
+use Kirby\Toolkit\Totp;
+
+/**
+ * Verifies one-time time-based auth codes
+ * that are generated with an authenticator app.
+ * Users first have to set up time-based codes
+ * (storing the TOTP secret in their user account).
+ * @since 4.0.0
+ *
+ * @package   Kirby Cms
+ * @author    Nico Hoffmann <nico@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class TotpChallenge extends Challenge
+{
+	/**
+	 * Checks whether the challenge is available
+	 * for the passed user and purpose
+	 *
+	 * @param \Kirby\Cms\User $user User the code will be generated for
+	 * @param 'login'|'password-reset'|'2fa' $mode Purpose of the code
+	 */
+	public static function isAvailable(User $user, string $mode): bool
+	{
+		// user needs to have a TOTP secret set up
+		return $user->secret('totp') !== null;
+	}
+
+	/**
+	 * Generates a random one-time auth code and returns that code
+	 * for later verification
+	 *
+	 * @param \Kirby\Cms\User $user User to generate the code for
+	 * @param array $options Details of the challenge request:
+	 *                       - 'mode': Purpose of the code ('login', 'password-reset' or '2fa')
+	 *                       - 'timeout': Number of seconds the code will be valid for
+	 * @todo set return type to `null` once support for PHP 8.1 is dropped
+	 */
+	public static function create(User $user, array $options): string|null
+	{
+		// the user's app will generate the code, we only verify it
+		return null;
+	}
+
+	/**
+	 * Verifies the provided code against the created one
+	 *
+	 * @param \Kirby\Cms\User $user User to check the code for
+	 * @param string $code Code to verify
+	 */
+	public static function verify(User $user, string $code): bool
+	{
+		// verify if code is current, previous or next TOTP code
+		$secret = $user->secret('totp');
+		$totp   = new Totp($secret);
+		return $totp->verify($code);
+	}
+}

kirby/src/Cms/Block.php

@@ -0,0 +1,245 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Content\Content;
+use Kirby\Content\Field;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Toolkit\Str;
+use Throwable;
+
+/**
+ * Represents a single block
+ * which can be inspected further or
+ * converted to HTML
+ * @since 3.5.0
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Block extends Item
+{
+	use HasMethods;
+
+	public const ITEMS_CLASS = Blocks::class;
+
+	/**
+	 * Registry with all block models
+	 */
+	public static array $models = [];
+
+	protected Content $content;
+	protected bool $isHidden;
+	protected string $type;
+
+	/**
+	 * Proxy for content fields
+	 */
+	public function __call(string $method, array $args = []): mixed
+	{
+		// block methods
+		if ($this->hasMethod($method)) {
+			return $this->callMethod($method, $args);
+		}
+
+		return $this->content()->get($method);
+	}
+
+	/**
+	 * Creates a new block object
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException
+	 */
+	public function __construct(array $params)
+	{
+		parent::__construct($params);
+
+		// @deprecated import old builder format
+		// @todo block.converter remove eventually
+		// @codeCoverageIgnoreStart
+		$params = BlockConverter::builderBlock($params);
+		$params = BlockConverter::editorBlock($params);
+		// @codeCoverageIgnoreEnd
+
+		if (isset($params['type']) === false) {
+			throw new InvalidArgumentException('The block type is missing');
+		}
+
+		// make sure the content is always defined as array to keep
+		// at least a bit of backward compatibility with older fields
+		if (is_array($params['content'] ?? null) === false) {
+			$params['content'] = [];
+		}
+
+		$this->isHidden = $params['isHidden'] ?? false;
+		$this->type     = $params['type'];
+
+		// create the content object
+		$this->content = new Content($params['content'], $this->parent);
+	}
+
+	/**
+	 * Converts the object to a string
+	 */
+	public function __toString(): string
+	{
+		return $this->toHtml();
+	}
+
+	/**
+	 * Returns the content object
+	 */
+	public function content(): Content
+	{
+		return $this->content;
+	}
+
+	/**
+	 * Controller for the block snippet
+	 */
+	public function controller(): array
+	{
+		return [
+			'block'   => $this,
+			'content' => $this->content(),
+			// deprecated block data
+			'data'    => $this,
+			'id'      => $this->id(),
+			'prev'    => $this->prev(),
+			'next'    => $this->next()
+		];
+	}
+
+	/**
+	 * Converts the block to HTML and then
+	 * uses the Str::excerpt method to create
+	 * a non-formatted, shortened excerpt from it
+	 */
+	public function excerpt(mixed ...$args): string
+	{
+		return Str::excerpt($this->toHtml(), ...$args);
+	}
+
+	/**
+	 * Constructs a block object with registering blocks models
+	 * @internal
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException
+	 */
+	public static function factory(array $params): static
+	{
+		$type = $params['type'] ?? null;
+
+		if (
+			empty($type) === false &&
+			$class = (static::$models[$type] ?? null)
+		) {
+			$object = new $class($params);
+
+			if ($object instanceof self) {
+				return $object;
+			}
+		}
+
+		// default model for blocks
+		if ($class = (static::$models['default'] ?? null)) {
+			$object = new $class($params);
+
+			if ($object instanceof self) {
+				return $object;
+			}
+		}
+
+		return new static($params);
+	}
+
+	/**
+	 * Checks if the block is empty
+	 */
+	public function isEmpty(): bool
+	{
+		return empty($this->content()->toArray());
+	}
+
+	/**
+	 * Checks if the block is hidden
+	 * from being rendered in the frontend
+	 */
+	public function isHidden(): bool
+	{
+		return $this->isHidden;
+	}
+
+	/**
+	 * Checks if the block is not empty
+	 */
+	public function isNotEmpty(): bool
+	{
+		return $this->isEmpty() === false;
+	}
+
+	/**
+	 * Returns the sibling collection that filtered by block status
+	 */
+	protected function siblingsCollection(): Blocks
+	{
+		return $this->siblings->filter('isHidden', $this->isHidden());
+	}
+
+	/**
+	 * Returns the block type
+	 */
+	public function type(): string
+	{
+		return $this->type;
+	}
+
+	/**
+	 * The result is being sent to the editor
+	 * via the API in the panel
+	 */
+	public function toArray(): array
+	{
+		return [
+			'content'  => $this->content()->toArray(),
+			'id'       => $this->id(),
+			'isHidden' => $this->isHidden(),
+			'type'     => $this->type(),
+		];
+	}
+
+	/**
+	 * Converts the block to html first
+	 * and then places that inside a field
+	 * object. This can be used further
+	 * with all available field methods
+	 */
+	public function toField(): Field
+	{
+		return new Field($this->parent(), $this->id(), $this->toHtml());
+	}
+
+	/**
+	 * Converts the block to HTML
+	 */
+	public function toHtml(): string
+	{
+		try {
+			$kirby = $this->parent()->kirby();
+			return (string)$kirby->snippet(
+				'blocks/' . $this->type(),
+				$this->controller(),
+				true
+			);
+		} catch (Throwable $e) {
+			if ($kirby->option('debug') === true) {
+				return '<p>Block error: "' . $e->getMessage() . '" in block type: "' . $this->type() . '"</p>';
+			}
+
+			return '';
+		}
+	}
+}

kirby/src/Cms/BlockConverter.php

@@ -0,0 +1,285 @@
+<?php
+
+namespace Kirby\Cms;
+
+/**
+ * Converts the data from the old builder and editor fields
+ * to the format supported by the new block field.
+ * @since 3.9.0
+ * @deprecated
+ *
+ * @todo block.converter remove eventually
+ * @codeCoverageIgnore
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier GmbH
+ * @license   https://getkirby.com/license
+ */
+class BlockConverter
+{
+	public static function builderBlock(array $params): array
+	{
+		if (isset($params['_key']) === false) {
+			return $params;
+		}
+
+		$params['type']    = $params['_key'];
+		$params['content'] = $params;
+		unset($params['_uid']);
+
+		return $params;
+	}
+
+	public static function editorBlock(array $params): array
+	{
+		if (static::isEditorBlock($params) === false) {
+			return $params;
+		}
+
+		$method = 'editor' . $params['type'];
+
+		if (method_exists(static::class, $method) === true) {
+			$params = static::$method($params);
+		} else {
+			$params = static::editorCustom($params);
+		}
+
+		return $params;
+	}
+
+	public static function editorBlocks(array $blocks = []): array
+	{
+		if (empty($blocks) === true) {
+			return $blocks;
+		}
+
+		if (static::isEditorBlock($blocks[0]) === false) {
+			return $blocks;
+		}
+
+		$list = [];
+		$listStart = null;
+
+		foreach ($blocks as $index => $block) {
+			if (in_array($block['type'], ['ul', 'ol']) === true) {
+				$prev = $blocks[$index - 1] ?? null;
+				$next = $blocks[$index + 1] ?? null;
+
+				// new list starts here
+				if (!$prev || $prev['type'] !== $block['type']) {
+					$listStart = $index;
+				}
+
+				// add the block to the list
+				$list[] = $block;
+
+				// list ends here
+				if (!$next || $next['type'] !== $block['type']) {
+					$blocks[$listStart] = [
+						'content' => [
+							'text' =>
+								'<' . $block['type'] . '>' .
+									implode(array_map(
+										fn ($item) => '<li>' . $item['content'] . '</li>',
+										$list
+									)) .
+								'</' . $block['type'] . '>',
+						],
+						'type' => 'list'
+					];
+
+					$start = $listStart + 1;
+					$end   = $listStart + count($list);
+
+					for ($x = $start; $x <= $end; $x++) {
+						$blocks[$x] = false;
+					}
+
+					$listStart = null;
+					$list = [];
+				}
+			} else {
+				$blocks[$index] = static::editorBlock($block);
+			}
+		}
+
+		return array_filter($blocks);
+	}
+
+	public static function editorBlockquote(array $params): array
+	{
+		return [
+			'content' => [
+				'text' => $params['content']
+			],
+			'type' => 'quote'
+		];
+	}
+
+	public static function editorCode(array $params): array
+	{
+		return [
+			'content' => [
+				'language' => $params['attrs']['language'] ?? null,
+				'code'     => $params['content']
+			],
+			'type' => 'code'
+		];
+	}
+
+	public static function editorCustom(array $params): array
+	{
+		return [
+			'content' => array_merge(
+				$params['attrs'] ?? [],
+				[
+					'body' => $params['content'] ?? null
+				]
+			),
+			'type' => $params['type'] ?? 'unknown'
+		];
+	}
+
+	public static function editorH1(array $params): array
+	{
+		return static::editorHeading($params, 'h1');
+	}
+
+	public static function editorH2(array $params): array
+	{
+		return static::editorHeading($params, 'h2');
+	}
+
+	public static function editorH3(array $params): array
+	{
+		return static::editorHeading($params, 'h3');
+	}
+
+	public static function editorH4(array $params): array
+	{
+		return static::editorHeading($params, 'h4');
+	}
+
+	public static function editorH5(array $params): array
+	{
+		return static::editorHeading($params, 'h5');
+	}
+
+	public static function editorH6(array $params): array
+	{
+		return static::editorHeading($params, 'h6');
+	}
+
+	public static function editorHr(array $params): array
+	{
+		return [
+			'content' => [],
+			'type'    => 'line'
+		];
+	}
+
+	public static function editorHeading(array $params, string $level = 'h1'): array
+	{
+		return [
+			'content' => [
+				'level' => $level,
+				'text'  => $params['content']
+			],
+			'type' => 'heading'
+		];
+	}
+
+	public static function editorImage(array $params): array
+	{
+		// internal image
+		if (isset($params['attrs']['id']) === true) {
+			return [
+				'content' => [
+					'alt'      => $params['attrs']['alt'] ?? null,
+					'caption'  => $params['attrs']['caption'] ?? null,
+					'image'    => $params['attrs']['id'] ?? $params['attrs']['src'] ?? null,
+					'location' => 'kirby',
+					'ratio'    => $params['attrs']['ratio'] ?? null,
+				],
+				'type' => 'image'
+			];
+		}
+
+		return [
+			'content' => [
+				'alt'      => $params['attrs']['alt'] ?? null,
+				'caption'  => $params['attrs']['caption'] ?? null,
+				'src'      => $params['attrs']['src'] ?? null,
+				'location' => 'web',
+				'ratio'    => $params['attrs']['ratio'] ?? null,
+			],
+			'type' => 'image'
+		];
+	}
+
+	public static function editorKirbytext(array $params): array
+	{
+		return [
+			'content' => [
+				'text' => $params['content']
+			],
+			'type' => 'markdown'
+		];
+	}
+
+	public static function editorOl(array $params): array
+	{
+		return [
+			'content' => [
+				'text' => $params['content']
+			],
+			'type' => 'list'
+		];
+	}
+
+	public static function editorParagraph(array $params): array
+	{
+		return [
+			'content' => [
+				'text' => '<p>' . $params['content'] . '</p>'
+			],
+			'type' => 'text'
+		];
+	}
+
+	public static function editorUl(array $params): array
+	{
+		return [
+			'content' => [
+				'text' => $params['content']
+			],
+			'type' => 'list'
+		];
+	}
+
+	public static function editorVideo(array $params): array
+	{
+		return [
+			'content' => [
+				'caption' => $params['attrs']['caption'] ?? null,
+				'url'     => $params['attrs']['src'] ?? null
+			],
+			'type' => 'video'
+		];
+	}
+
+	public static function isEditorBlock(array $params): bool
+	{
+		if (isset($params['attrs']) === true) {
+			return true;
+		}
+
+		if (is_string($params['content'] ?? null) === true) {
+			return true;
+		}
+
+		return false;
+	}
+}

kirby/src/Cms/Blocks.php

@@ -0,0 +1,167 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Exception;
+use Kirby\Data\Json;
+use Kirby\Data\Yaml;
+use Kirby\Parsley\Parsley;
+use Kirby\Parsley\Schema\Blocks as BlockSchema;
+use Kirby\Toolkit\A;
+use Kirby\Toolkit\Str;
+use Throwable;
+
+/**
+ * A collection of blocks
+ * @since 3.5.0
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Blocks extends Items
+{
+	public const ITEM_CLASS = Block::class;
+
+	/**
+	 * All registered blocks methods
+	 */
+	public static array $methods = [];
+
+	/**
+	 * Return HTML when the collection is
+	 * converted to a string
+	 */
+	public function __toString(): string
+	{
+		return $this->toHtml();
+	}
+
+	/**
+	 * Converts the blocks to HTML and then
+	 * uses the Str::excerpt method to create
+	 * a non-formatted, shortened excerpt from it
+	 */
+	public function excerpt(mixed ...$args): string
+	{
+		return Str::excerpt($this->toHtml(), ...$args);
+	}
+
+	/**
+	 * Wrapper around the factory to
+	 * catch blocks from layouts
+	 */
+	public static function factory(
+		array $items = null,
+		array $params = []
+	): static {
+		$items = static::extractFromLayouts($items);
+
+		// @deprecated old editor format
+		// @todo block.converter remove eventually
+		// @codeCoverageIgnoreStart
+		$items = BlockConverter::editorBlocks($items);
+		// @codeCoverageIgnoreEnd
+
+		return parent::factory($items, $params);
+	}
+
+	/**
+	 * Pull out blocks from layouts
+	 */
+	protected static function extractFromLayouts(array $input): array
+	{
+		if (empty($input) === true) {
+			return [];
+		}
+
+		if (
+			// no columns = no layout
+			array_key_exists('columns', $input[0]) === false  ||
+			// @deprecated checks if this is a block for the builder plugin
+			// @todo block.converter remove eventually
+			array_key_exists('_key', $input[0]) === true
+		) {
+			return $input;
+		}
+
+		$blocks = [];
+
+		foreach ($input as $layout) {
+			foreach (($layout['columns'] ?? []) as $column) {
+				foreach (($column['blocks'] ?? []) as $block) {
+					$blocks[] = $block;
+				}
+			}
+		}
+
+		return $blocks;
+	}
+
+	/**
+	 * Checks if a given block type exists in the collection
+	 * @since 3.6.0
+	 */
+	public function hasType(string $type): bool
+	{
+		return $this->filterBy('type', $type)->count() > 0;
+	}
+
+	/**
+	 * Parse and sanitize various block formats
+	 */
+	public static function parse(array|string|null $input): array
+	{
+		if (empty($input) === false && is_array($input) === false) {
+			try {
+				$input = Json::decode((string)$input);
+			} catch (Throwable) {
+				// @deprecated try to import the old YAML format
+				// @todo block.converter remove eventually
+				// @codeCoverageIgnoreStart
+				try {
+					$yaml  = Yaml::decode((string)$input);
+					$first = A::first($yaml);
+
+					// check for valid yaml
+					if (
+						empty($yaml) === true ||
+						(
+							isset($first['_key']) === false &&
+							isset($first['type']) === false
+						)
+					) {
+						throw new Exception('Invalid YAML');
+					} else {
+						$input = $yaml;
+					}
+				} catch (Throwable $e) {
+					// the next 2 lines remain after removing block.converter
+					// @codeCoverageIgnoreEnd
+					$parser = new Parsley((string)$input, new BlockSchema());
+					$input  = $parser->blocks();
+					// @codeCoverageIgnoreStart
+				}
+				// @codeCoverageIgnoreEnd
+			}
+		}
+
+		if (empty($input) === true) {
+			return [];
+		}
+
+		return $input;
+	}
+
+	/**
+	 * Convert all blocks to HTML
+	 */
+	public function toHtml(): string
+	{
+		$html = A::map($this->data, fn ($block) => $block->toHtml());
+
+		return implode($html);
+	}
+}

kirby/src/Cms/Blueprint.php

@@ -0,0 +1,882 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Exception;
+use Kirby\Data\Data;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Exception\NotFoundException;
+use Kirby\Filesystem\F;
+use Kirby\Form\Field;
+use Kirby\Toolkit\A;
+use Kirby\Toolkit\I18n;
+use Throwable;
+
+/**
+ * The Blueprint class normalizes an array from a
+ * blueprint file and converts sections, columns, fields
+ * etc. into a correct tab layout.
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Blueprint
+{
+	public static $presets = [];
+	public static $loaded = [];
+
+	protected $fields = [];
+	protected $model;
+	protected $props;
+	protected $sections = [];
+	protected $tabs = [];
+
+	protected array|null $fileTemplates = null;
+
+	/**
+	 * Magic getter/caller for any blueprint prop
+	 */
+	public function __call(string $key, array $arguments = null): mixed
+	{
+		return $this->props[$key] ?? null;
+	}
+
+	/**
+	 * Creates a new blueprint object with the given props
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the blueprint model is missing
+	 */
+	public function __construct(array $props)
+	{
+		if (empty($props['model']) === true) {
+			throw new InvalidArgumentException('A blueprint model is required');
+		}
+
+		if ($props['model'] instanceof ModelWithContent === false) {
+			throw new InvalidArgumentException('Invalid blueprint model');
+		}
+
+		$this->model = $props['model'];
+
+		// the model should not be included in the props array
+		unset($props['model']);
+
+		// extend the blueprint in general
+		$props = static::extend($props);
+
+		// apply any blueprint preset
+		$props = $this->preset($props);
+
+		// normalize the name
+		$props['name'] ??= 'default';
+
+		// normalize and translate the title
+		$props['title'] ??= ucfirst($props['name']);
+		$props['title']   = $this->i18n($props['title']);
+
+		// convert all shortcuts
+		$props = $this->convertFieldsToSections('main', $props);
+		$props = $this->convertSectionsToColumns('main', $props);
+		$props = $this->convertColumnsToTabs('main', $props);
+
+		// normalize all tabs
+		$props['tabs'] = $this->normalizeTabs($props['tabs'] ?? []);
+
+		$this->props = $props;
+	}
+
+	/**
+	 * Improved `var_dump` output
+	 *
+	 * @codeCoverageIgnore
+	 */
+	public function __debugInfo(): array
+	{
+		return $this->props ?? [];
+	}
+
+	/**
+	 * Gathers what file templates are allowed in
+	 * this model based on the blueprint
+	 */
+	public function acceptedFileTemplates(string $inSection = null): array
+	{
+		// get cached results for the current file model
+		// (except when collecting for a specific section)
+		if ($inSection === null && $this->fileTemplates !== null) {
+			return $this->fileTemplates; // @codeCoverageIgnore
+		}
+
+		$templates = [];
+
+		// collect all allowed file templates from blueprint…
+		foreach ($this->sections() as $section) {
+			// if collecting for a specific section, skip all others
+			if ($inSection !== null && $section->name() !== $inSection) {
+				continue;
+			}
+
+			$templates = match ($section->type()) {
+				'files'  => [...$templates, $section->template() ?? 'default'],
+				'fields' => [
+					...$templates,
+					...$this->acceptedFileTemplatesFromFields($section->fields())
+				],
+				default  => $templates
+			};
+		}
+
+		// no caching for when collecting for specific section
+		if ($inSection !== null) {
+			return $templates; // @codeCoverageIgnore
+		}
+
+		return $this->fileTemplates = $templates;
+	}
+
+	/**
+	 * Gathers the allowed file templates from model's fields
+	 */
+	protected function acceptedFileTemplatesFromFields(array $fields): array
+	{
+		$templates = [];
+
+		foreach ($fields as $field) {
+			// fields with uploads settings
+			if (isset($field['uploads']) === true && is_array($field['uploads']) === true) {
+				$templates = [
+					...$templates,
+					...$this->acceptedFileTemplatesFromFieldUploads($field['uploads'])
+				];
+				continue;
+			}
+
+			// structure and object fields
+			if (isset($field['fields']) === true && is_array($field['fields']) === true) {
+				$templates = [
+					...$templates,
+					...$this->acceptedFileTemplatesFromFields($field['fields']),
+				];
+				continue;
+			}
+
+			// layout and blocks fields
+			if (isset($field['fieldsets']) === true && is_array($field['fieldsets']) === true) {
+				$templates = [
+					...$templates,
+					...$this->acceptedFileTemplatesFromFieldsets($field['fieldsets'])
+				];
+				continue;
+			}
+		}
+
+		return $templates;
+	}
+
+	/**
+	 * Gathers the allowed file templates from fieldsets
+	 */
+	protected function acceptedFileTemplatesFromFieldsets(array $fieldsets): array
+	{
+		$templates = [];
+
+		foreach ($fieldsets as $fieldset) {
+			foreach (($fieldset['tabs'] ?? []) as $tab) {
+				$templates = array_merge($templates, $this->acceptedFileTemplatesFromFields($tab['fields'] ?? []));
+			}
+		}
+
+		return $templates;
+	}
+
+	/**
+	 * Extracts templates from field uploads settings
+	 */
+	protected function acceptedFileTemplatesFromFieldUploads(array $uploads): array
+	{
+		// only if the `uploads` parent is this model
+		if ($target = $uploads['parent'] ?? null) {
+			if ($this->model->id() !== $target) {
+				return [];
+			}
+		}
+
+		return [($uploads['template'] ?? 'default')];
+	}
+
+	/**
+	 * Converts all column definitions, that
+	 * are not wrapped in a tab, into a generic tab
+	 */
+	protected function convertColumnsToTabs(
+		string $tabName,
+		array $props
+	): array {
+		if (isset($props['columns']) === false) {
+			return $props;
+		}
+
+		// wrap everything in a main tab
+		$props['tabs'] = [
+			$tabName => [
+				'columns' => $props['columns']
+			]
+		];
+
+		unset($props['columns']);
+
+		return $props;
+	}
+
+	/**
+	 * Converts all field definitions, that are not
+	 * wrapped in a fields section into a generic
+	 * fields section.
+	 */
+	protected function convertFieldsToSections(
+		string $tabName,
+		array $props
+	): array {
+		if (isset($props['fields']) === false) {
+			return $props;
+		}
+
+		// wrap all fields in a section
+		$props['sections'] = [
+			$tabName . '-fields' => [
+				'type'   => 'fields',
+				'fields' => $props['fields']
+			]
+		];
+
+		unset($props['fields']);
+
+		return $props;
+	}
+
+	/**
+	 * Converts all sections that are not wrapped in
+	 * columns, into a single generic column.
+	 */
+	protected function convertSectionsToColumns(
+		string $tabName,
+		array $props
+	): array {
+		if (isset($props['sections']) === false) {
+			return $props;
+		}
+
+		// wrap everything in one big column
+		$props['columns'] = [
+			[
+				'width'    => '1/1',
+				'sections' => $props['sections']
+			]
+		];
+
+		unset($props['sections']);
+
+		return $props;
+	}
+
+	/**
+	 * Extends the props with props from a given
+	 * mixin, when an extends key is set or the
+	 * props is just a string
+	 *
+	 * @param array|string $props
+	 */
+	public static function extend($props): array
+	{
+		if (is_string($props) === true) {
+			$props = [
+				'extends' => $props
+			];
+		}
+
+		if ($extends = $props['extends'] ?? null) {
+			foreach (A::wrap($extends) as $extend) {
+				try {
+					$mixin = static::find($extend);
+					$mixin = static::extend($mixin);
+					$props = A::merge($mixin, $props, A::MERGE_REPLACE);
+				} catch (Exception) {
+					// keep the props unextended if the snippet wasn't found
+				}
+			}
+
+			// remove the extends flag
+			unset($props['extends']);
+		}
+
+		return $props;
+	}
+
+	/**
+	 * Create a new blueprint for a model
+	 */
+	public static function factory(
+		string $name,
+		string $fallback = null,
+		ModelWithContent $model
+	): static|null {
+		try {
+			$props = static::load($name);
+		} catch (Exception) {
+			$props = $fallback !== null ? static::load($fallback) : null;
+		}
+
+		if ($props === null) {
+			return null;
+		}
+
+		// inject the parent model
+		$props['model'] = $model;
+
+		return new static($props);
+	}
+
+	/**
+	 * Returns a single field definition by name
+	 */
+	public function field(string $name): array|null
+	{
+		return $this->fields[$name] ?? null;
+	}
+
+	/**
+	 * Returns all field definitions
+	 */
+	public function fields(): array
+	{
+		return $this->fields;
+	}
+
+	/**
+	 * Find a blueprint by name
+	 *
+	 * @throws \Kirby\Exception\NotFoundException If the blueprint cannot be found
+	 */
+	public static function find(string $name): array
+	{
+		if (isset(static::$loaded[$name]) === true) {
+			return static::$loaded[$name];
+		}
+
+		$kirby = App::instance();
+		$root  = $kirby->root('blueprints');
+		$file  = $root . '/' . $name . '.yml';
+
+		// first try to find the blueprint in the `site/blueprints` root,
+		// then check in the plugin extensions which includes some default
+		// core blueprints (e.g. page, file, site and block defaults)
+		// as well as blueprints provided by plugins
+		if (F::exists($file, $root) !== true) {
+			$file = $kirby->extension('blueprints', $name);
+		}
+
+		// callback option can be return array or blueprint file path
+		if (is_callable($file) === true) {
+			$file = $file($kirby);
+		}
+
+		// now ensure that we always return the data array
+		if (is_string($file) === true && F::exists($file) === true) {
+			return static::$loaded[$name] = Data::read($file);
+		}
+
+		if (is_array($file) === true) {
+			return static::$loaded[$name] = $file;
+		}
+
+		// neither a valid file nor array data
+		throw new NotFoundException([
+			'key'  => 'blueprint.notFound',
+			'data' => ['name' => $name]
+		]);
+	}
+
+	/**
+	 * Used to translate any label, heading, etc.
+	 */
+	protected function i18n(mixed $value, mixed $fallback = null): mixed
+	{
+		return I18n::translate($value, $fallback) ?? $value;
+	}
+
+	/**
+	 * Checks if this is the default blueprint
+	 */
+	public function isDefault(): bool
+	{
+		return $this->name() === 'default';
+	}
+
+	/**
+	 * Loads a blueprint from file or array
+	 */
+	public static function load(string $name): array
+	{
+		$props = static::find($name);
+
+		// inject the filename as name if no name is set
+		$props['name'] ??= $name;
+
+		// normalize the title
+		$title = $props['title'] ?? ucfirst($props['name']);
+
+		// translate the title
+		$props['title'] = I18n::translate($title) ?? $title;
+
+		return $props;
+	}
+
+	/**
+	 * Returns the parent model
+	 */
+	public function model(): ModelWithContent
+	{
+		return $this->model;
+	}
+
+	/**
+	 * Returns the blueprint name
+	 */
+	public function name(): string
+	{
+		return $this->props['name'];
+	}
+
+	/**
+	 * Normalizes all required props in a column setup
+	 */
+	protected function normalizeColumns(string $tabName, array $columns): array
+	{
+		foreach ($columns as $columnKey => $columnProps) {
+			// unset/remove column if its property is not array
+			if (is_array($columnProps) === false) {
+				unset($columns[$columnKey]);
+				continue;
+			}
+
+			$columnProps = $this->convertFieldsToSections(
+				$tabName . '-col-' . $columnKey,
+				$columnProps
+			);
+
+			// inject getting started info, if the sections are empty
+			if (empty($columnProps['sections']) === true) {
+				$columnProps['sections'] = [
+					$tabName . '-info-' . $columnKey => [
+						'label' => 'Column (' . ($columnProps['width'] ?? '1/1') . ')',
+						'type'  => 'info',
+						'text'  => 'No sections yet'
+					]
+				];
+			}
+
+			$columns[$columnKey] = [
+				...$columnProps,
+				'width'    => $columnProps['width'] ?? '1/1',
+				'sections' => $this->normalizeSections(
+					$tabName,
+					$columnProps['sections'] ?? []
+				)
+			];
+		}
+
+		return $columns;
+	}
+
+	public static function helpList(array $items): string
+	{
+		$md = [];
+
+		foreach ($items as $item) {
+			$md[] = '- *' . $item . '*';
+		}
+
+		return PHP_EOL . implode(PHP_EOL, $md);
+	}
+
+	/**
+	 * Normalize field props for a single field
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the filed name is missing or the field type is invalid
+	 */
+	public static function fieldProps(array|string $props): array
+	{
+		$props = static::extend($props);
+
+		if (isset($props['name']) === false) {
+			throw new InvalidArgumentException('The field name is missing');
+		}
+
+		$name = $props['name'];
+		$type = $props['type'] ?? $name;
+
+		if ($type !== 'group' && isset(Field::$types[$type]) === false) {
+			throw new InvalidArgumentException('Invalid field type ("' . $type . '")');
+		}
+
+		// support for nested fields
+		if (isset($props['fields']) === true) {
+			$props['fields'] = static::fieldsProps($props['fields']);
+		}
+
+		// groups don't need all the crap
+		if ($type === 'group') {
+			$fields = $props['fields'];
+
+			if (isset($props['when']) === true) {
+				$fields = array_map(
+					fn ($field) => array_replace_recursive(['when' => $props['when']], $field),
+					$fields
+				);
+			}
+
+			return [
+				'fields' => $fields,
+				'name'   => $name,
+				'type'   => $type
+			];
+		}
+
+		// add some useful defaults
+		return [
+			...$props,
+			'label' => $props['label'] ?? ucfirst($name),
+			'name'  => $name,
+			'type'  => $type,
+			'width' => $props['width'] ?? '1/1',
+		];
+	}
+
+	/**
+	 * Creates an error field with the given error message
+	 */
+	public static function fieldError(string $name, string $message): array
+	{
+		return [
+			'label' => 'Error',
+			'name'  => $name,
+			'text'  => strip_tags($message),
+			'theme' => 'negative',
+			'type'  => 'info',
+		];
+	}
+
+	/**
+	 * Normalizes all fields and adds automatic labels,
+	 * types and widths.
+	 */
+	public static function fieldsProps($fields): array
+	{
+		if (is_array($fields) === false) {
+			$fields = [];
+		}
+
+		foreach ($fields as $fieldName => $fieldProps) {
+			// extend field from string
+			if (is_string($fieldProps) === true) {
+				$fieldProps = [
+					'extends' => $fieldProps,
+					'name'    => $fieldName
+				];
+			}
+
+			// use the name as type definition
+			if ($fieldProps === true) {
+				$fieldProps = [];
+			}
+
+			// unset / remove field if its property is false
+			if ($fieldProps === false) {
+				unset($fields[$fieldName]);
+				continue;
+			}
+
+			// inject the name
+			$fieldProps['name'] = $fieldName;
+
+			// create all props
+			try {
+				$fieldProps = static::fieldProps($fieldProps);
+			} catch (Throwable $e) {
+				$fieldProps = static::fieldError($fieldName, $e->getMessage());
+			}
+
+			// resolve field groups
+			if ($fieldProps['type'] === 'group') {
+				if (
+					empty($fieldProps['fields']) === false &&
+					is_array($fieldProps['fields']) === true
+				) {
+					$index  = array_search($fieldName, array_keys($fields));
+					$fields = [
+						...array_slice($fields, 0, $index),
+						...$fieldProps['fields'] ?? [],
+						...array_slice($fields, $index + 1)
+					];
+				} else {
+					unset($fields[$fieldName]);
+				}
+			} else {
+				$fields[$fieldName] = $fieldProps;
+			}
+		}
+
+		return $fields;
+	}
+
+	/**
+	 * Normalizes blueprint options. This must be used in the
+	 * constructor of an extended class, if you want to make use of it.
+	 */
+	protected function normalizeOptions(
+		array|string|bool|null $options,
+		array $defaults,
+		array $aliases = []
+	): array {
+		// return defaults when options are not defined or set to true
+		if ($options === true) {
+			return $defaults;
+		}
+
+		// set all options to false
+		if ($options === false) {
+			return array_map(fn () => false, $defaults);
+		}
+
+		// extend options if possible
+		$options = static::extend($options);
+
+		foreach ($options as $key => $value) {
+			$alias = $aliases[$key] ?? null;
+
+			if ($alias !== null) {
+				$options[$alias] ??= $value;
+				unset($options[$key]);
+			}
+		}
+
+		return [...$defaults, ...$options];
+	}
+
+	/**
+	 * Normalizes all required keys in sections
+	 */
+	protected function normalizeSections(
+		string $tabName,
+		array $sections
+	): array {
+		foreach ($sections as $sectionName => $sectionProps) {
+			// unset / remove section if its property is false
+			if ($sectionProps === false) {
+				unset($sections[$sectionName]);
+				continue;
+			}
+
+			// fallback to default props when true is passed
+			if ($sectionProps === true) {
+				$sectionProps = [];
+			}
+
+			// inject all section extensions
+			$sectionProps = static::extend($sectionProps);
+
+			$sections[$sectionName] = $sectionProps = [
+				...$sectionProps,
+				'name' => $sectionName,
+				'type' => $type = $sectionProps['type'] ?? $sectionName
+			];
+
+			if (empty($type) === true || is_string($type) === false) {
+				$sections[$sectionName] = [
+					'name'  => $sectionName,
+					'label' => 'Invalid section type for section "' . $sectionName . '"',
+					'type'  => 'info',
+					'text'  => 'The following section types are available: ' . static::helpList(array_keys(Section::$types))
+				];
+			} elseif (isset(Section::$types[$type]) === false) {
+				$sections[$sectionName] = [
+					'name'  => $sectionName,
+					'label' => 'Invalid section type ("' . $type . '")',
+					'type'  => 'info',
+					'text'  => 'The following section types are available: ' . static::helpList(array_keys(Section::$types))
+				];
+			}
+
+			if ($sectionProps['type'] === 'fields') {
+				$fields = Blueprint::fieldsProps($sectionProps['fields'] ?? []);
+
+				// inject guide fields guide
+				if (empty($fields) === true) {
+					$fields = [
+						$tabName . '-info' => [
+							'label' => 'Fields',
+							'text'  => 'No fields yet',
+							'type'  => 'info'
+						]
+					];
+				} else {
+					foreach ($fields as $fieldName => $fieldProps) {
+						if (isset($this->fields[$fieldName]) === true) {
+							$this->fields[$fieldName] = $fields[$fieldName] = [
+								'type'  => 'info',
+								'label' => $fieldProps['label'] ?? 'Error',
+								'text'  => 'The field name <strong>"' . $fieldName . '"</strong> already exists in your blueprint.',
+								'theme' => 'negative'
+							];
+						} else {
+							$this->fields[$fieldName] = $fieldProps;
+						}
+					}
+				}
+
+				$sections[$sectionName]['fields'] = $fields;
+			}
+		}
+
+		// store all normalized sections
+		$this->sections = [...$this->sections, ...$sections];
+
+		return $sections;
+	}
+
+	/**
+	 * Normalizes all required keys in tabs
+	 */
+	protected function normalizeTabs($tabs): array
+	{
+		if (is_array($tabs) === false) {
+			$tabs = [];
+		}
+
+		foreach ($tabs as $tabName => $tabProps) {
+			// unset / remove tab if its property is false
+			if ($tabProps === false) {
+				unset($tabs[$tabName]);
+				continue;
+			}
+
+			// inject all tab extensions
+			$tabProps = static::extend($tabProps);
+
+			// inject a preset if available
+			$tabProps = $this->preset($tabProps);
+
+			$tabProps = $this->convertFieldsToSections($tabName, $tabProps);
+			$tabProps = $this->convertSectionsToColumns($tabName, $tabProps);
+
+			$tabs[$tabName] = [
+				...$tabProps,
+				'columns' => $this->normalizeColumns($tabName, $tabProps['columns'] ?? []),
+				'icon'    => $tabProps['icon']  ?? null,
+				'label'   => $this->i18n($tabProps['label'] ?? ucfirst($tabName)),
+				'link'    => $this->model->panel()->url(true) . '/?tab=' . $tabName,
+				'name'    => $tabName,
+			];
+		}
+
+		return $this->tabs = $tabs;
+	}
+
+	/**
+	 * Injects a blueprint preset
+	 */
+	protected function preset(array $props): array
+	{
+		if (isset($props['preset']) === false) {
+			return $props;
+		}
+
+		if (isset(static::$presets[$props['preset']]) === false) {
+			return $props;
+		}
+
+		$preset = static::$presets[$props['preset']];
+
+		if (is_string($preset) === true) {
+			$preset = F::load($preset, allowOutput: false);
+		}
+
+		return $preset($props);
+	}
+
+	/**
+	 * Returns a single section by name
+	 */
+	public function section(string $name): Section|null
+	{
+		if (empty($this->sections[$name]) === true) {
+			return null;
+		}
+
+		if ($this->sections[$name] instanceof Section) {
+			return $this->sections[$name]; //@codeCoverageIgnore
+		}
+
+		// get all props
+		$props = $this->sections[$name];
+
+		// inject the blueprint model
+		$props['model'] = $this->model();
+
+		// create a new section object
+		return $this->sections[$name] = new Section($props['type'], $props);
+	}
+
+	/**
+	 * Returns all sections
+	 */
+	public function sections(): array
+	{
+		return A::map(
+			$this->sections,
+			fn ($section) => match (true) {
+				$section instanceof Section => $section,
+				default                     => $this->section($section['name'])
+			}
+		);
+	}
+
+	/**
+	 * Returns a single tab by name
+	 */
+	public function tab(string|null $name = null): array|null
+	{
+		if ($name === null) {
+			return A::first($this->tabs);
+		}
+
+		return $this->tabs[$name] ?? null;
+	}
+
+	/**
+	 * Returns all tabs
+	 */
+	public function tabs(): array
+	{
+		return array_values($this->tabs);
+	}
+
+	/**
+	 * Returns the blueprint title
+	 */
+	public function title(): string
+	{
+		return $this->props['title'];
+	}
+
+	/**
+	 * Converts the blueprint object to a plain array
+	 */
+	public function toArray(): array
+	{
+		return $this->props;
+	}
+}

kirby/src/Cms/Collection.php

@@ -0,0 +1,383 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Closure;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Toolkit\Collection as BaseCollection;
+use Kirby\Toolkit\Str;
+use Kirby\Uuid\Uuid;
+
+/**
+ * The Collection class serves as foundation
+ * for the Pages, Files, Users and Structure
+ * classes. It handles object validation and sets
+ * the parent collection property for each object.
+ * The `getAttribute` method is also adjusted to
+ * handle values from Field objects correctly, so
+ * those can be used in filters as well.
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Collection extends BaseCollection
+{
+	use HasMethods;
+
+	/**
+	 * Stores the parent object, which is needed
+	 * in some collections to get the finder methods right.
+	 *
+	 * @var object
+	 */
+	protected $parent;
+
+	/**
+	 * Magic getter function
+	 *
+	 * @param string $key
+	 * @param mixed $arguments
+	 * @return mixed
+	 */
+	public function __call(string $key, $arguments)
+	{
+		// collection methods
+		if ($this->hasMethod($key) === true) {
+			return $this->callMethod($key, $arguments);
+		}
+	}
+
+	/**
+	 * Creates a new Collection with the given objects
+	 *
+	 * @param array $objects
+	 * @param object|null $parent
+	 */
+	public function __construct($objects = [], $parent = null)
+	{
+		$this->parent = $parent;
+
+		foreach ($objects as $object) {
+			$this->add($object);
+		}
+	}
+
+	/**
+	 * Internal setter for each object in the Collection;
+	 * override from the Toolkit Collection is needed to
+	 * make the CMS collections case-sensitive;
+	 * child classes can override it again to add validation
+	 * and custom behavior depending on the object type
+	 *
+	 * @param object $object
+	 */
+	public function __set(string $id, $object): void
+	{
+		$this->data[$id] = $object;
+	}
+
+	/**
+	 * Internal remover for each object in the Collection;
+	 * override from the Toolkit Collection is needed to
+	 * make the CMS collections case-sensitive
+	 */
+	public function __unset($id)
+	{
+		unset($this->data[$id]);
+	}
+
+	/**
+	 * Adds a single object or
+	 * an entire second collection to the
+	 * current collection
+	 *
+	 * @param mixed $object
+	 */
+	public function add($object)
+	{
+		if ($object instanceof self) {
+			$this->data = array_merge($this->data, $object->data);
+		} elseif (
+			is_object($object) === true &&
+			method_exists($object, 'id') === true
+		) {
+			$this->__set($object->id(), $object);
+		} else {
+			$this->append($object);
+		}
+
+		return $this;
+	}
+
+	/**
+	 * Appends an element to the data array
+	 *
+	 * @param mixed ...$args
+	 * @param mixed $key Optional collection key, will be determined from the item if not given
+	 * @param mixed $item
+	 * @return \Kirby\Cms\Collection
+	 */
+	public function append(...$args)
+	{
+		if (count($args) === 1) {
+			// try to determine the key from the provided item
+			if (
+				is_object($args[0]) === true &&
+				is_callable([$args[0], 'id']) === true
+			) {
+				return parent::append($args[0]->id(), $args[0]);
+			}
+
+			return parent::append($args[0]);
+		}
+
+		return parent::append(...$args);
+	}
+
+	/**
+	 * Find a single element by an attribute and its value
+	 *
+	 * @param mixed $value
+	 * @return mixed|null
+	 */
+	public function findBy(string $attribute, $value)
+	{
+		// $value: cast UUID object to string to allow uses
+		// like `$pages->findBy('related', $page->uuid())`
+		if ($value instanceof Uuid) {
+			$value = $value->toString();
+		}
+
+		return parent::findBy($attribute, $value);
+	}
+
+	/**
+	 * Groups the items by a given field or callback. Returns a collection
+	 * with an item for each group and a collection for each group.
+	 *
+	 * @param string|Closure $field
+	 * @param bool $caseInsensitive Ignore upper/lowercase for group names
+	 * @return \Kirby\Cms\Collection
+	 * @throws \Kirby\Exception\Exception
+	 */
+	public function group($field, bool $caseInsensitive = true)
+	{
+		if (is_string($field) === true) {
+			$groups = new Collection([], $this->parent());
+
+			foreach ($this->data as $key => $item) {
+				$value = $this->getAttribute($item, $field);
+
+				// make sure that there's always a proper value to group by
+				if (!$value) {
+					throw new InvalidArgumentException('Invalid grouping value for key: ' . $key);
+				}
+
+				$value = (string)$value;
+
+				// ignore upper/lowercase for group names
+				if ($caseInsensitive === true) {
+					$value = Str::lower($value);
+				}
+
+				if (isset($groups->data[$value]) === false) {
+					// create a new entry for the group if it does not exist yet
+					$groups->data[$value] = new static([$key => $item]);
+				} else {
+					// add the item to an existing group
+					$groups->data[$value]->set($key, $item);
+				}
+			}
+
+			return $groups;
+		}
+
+		return parent::group($field, $caseInsensitive);
+	}
+
+	/**
+	 * Checks if the given object or id
+	 * is in the collection
+	 *
+	 * @param string|object $key
+	 */
+	public function has($key): bool
+	{
+		if (is_object($key) === true) {
+			$key = $key->id();
+		}
+
+		return parent::has($key);
+	}
+
+	/**
+	 * Correct position detection for objects.
+	 * The method will automatically detect objects
+	 * or ids and then search accordingly.
+	 *
+	 * @param string|object $needle
+	 */
+	public function indexOf($needle): int|false
+	{
+		if (is_string($needle) === true) {
+			return array_search($needle, $this->keys());
+		}
+
+		return array_search($needle->id(), $this->keys());
+	}
+
+	/**
+	 * Returns a Collection without the given element(s)
+	 *
+	 * @param mixed ...$keys any number of keys, passed as individual arguments
+	 * @return \Kirby\Cms\Collection
+	 */
+	public function not(...$keys)
+	{
+		$collection = $this->clone();
+
+		foreach ($keys as $key) {
+			if (is_array($key) === true) {
+				return $this->not(...$key);
+			}
+
+			if ($key instanceof BaseCollection) {
+				$collection = $collection->not(...$key->keys());
+			} elseif (is_object($key) === true) {
+				$key = $key->id();
+			}
+
+			unset($collection->{$key});
+		}
+
+		return $collection;
+	}
+
+	/**
+	 * Add pagination and return a sliced set of data.
+	 *
+	 * @param mixed ...$arguments
+	 * @return $this|static
+	 */
+	public function paginate(...$arguments)
+	{
+		$this->pagination = Pagination::for($this, ...$arguments);
+
+		// slice and clone the collection according to the pagination
+		return $this->slice(
+			$this->pagination->offset(),
+			$this->pagination->limit()
+		);
+	}
+
+	/**
+	 * Get the pagination object
+	 *
+	 * @return \Kirby\Cms\Pagination|null
+	 */
+	public function pagination()
+	{
+		return $this->pagination;
+	}
+
+	/**
+	 * Returns the parent model
+	 */
+	public function parent()
+	{
+		return $this->parent;
+	}
+
+	/**
+	 * Prepends an element to the data array
+	 *
+	 * @param mixed ...$args
+	 * @param mixed $key Optional collection key, will be determined from the item if not given
+	 * @param mixed $item
+	 * @return \Kirby\Cms\Collection
+	 */
+	public function prepend(...$args)
+	{
+		if (count($args) === 1) {
+			// try to determine the key from the provided item
+			if (
+				is_object($args[0]) === true &&
+				is_callable([$args[0], 'id']) === true
+			) {
+				return parent::prepend($args[0]->id(), $args[0]);
+			}
+
+			return parent::prepend($args[0]);
+		}
+
+		return parent::prepend(...$args);
+	}
+
+	/**
+	 * Runs a combination of filter, sort, not,
+	 * offset, limit, search and paginate on the collection.
+	 * Any part of the query is optional.
+	 *
+	 * @return static
+	 */
+	public function query(array $arguments = [])
+	{
+		$paginate = $arguments['paginate'] ?? null;
+		$search   = $arguments['search'] ?? null;
+
+		unset($arguments['paginate']);
+
+		$result = parent::query($arguments);
+
+		if (empty($search) === false) {
+			if (is_array($search) === true) {
+				$result = $result->search($search['query'] ?? null, $search['options'] ?? []);
+			} else {
+				$result = $result->search($search);
+			}
+		}
+
+		if (empty($paginate) === false) {
+			$result = $result->paginate($paginate);
+		}
+
+		return $result;
+	}
+
+	/**
+	 * Removes an object
+	 *
+	 * @param mixed $key the name of the key
+	 */
+	public function remove($key)
+	{
+		if (is_object($key) === true) {
+			$key = $key->id();
+		}
+
+		return parent::remove($key);
+	}
+
+	/**
+	 * Searches the collection
+	 */
+	public function search(
+		string $query = null,
+		string|array $params = []
+	): static {
+		return Search::collection($this, $query, $params);
+	}
+
+	/**
+	 * Converts all objects in the collection
+	 * to an array. This can also take a callback
+	 * function to further modify the array result.
+	 */
+	public function toArray(Closure $map = null): array
+	{
+		return parent::toArray($map ?? fn ($object) => $object->toArray());
+	}
+}

kirby/src/Cms/Collections.php

@@ -0,0 +1,125 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Closure;
+use Kirby\Exception\NotFoundException;
+use Kirby\Filesystem\F;
+use Kirby\Toolkit\Controller;
+
+/**
+ * Manages and loads all collections
+ * in site/collections, which can then
+ * be reused in controllers, templates, etc
+ *
+ * This class is mainly used in the `$kirby->collection()`
+ * method to provide easy access to registered collections
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Collections
+{
+	/**
+	 * Each collection is cached once it
+	 * has been called, to avoid further
+	 * processing on sequential calls to
+	 * the same collection.
+	 */
+	protected array $cache = [];
+
+	/**
+	 * Store of all collections
+	 */
+	protected array $collections = [];
+
+	/**
+	 * Magic caller to enable something like
+	 * `$collections->myCollection()`
+	 *
+	 * @return \Kirby\Toolkit\Collection|null
+	 * @todo 5.0 Add return type declaration
+	 */
+	public function __call(string $name, array $arguments = [])
+	{
+		return $this->get($name, ...$arguments);
+	}
+
+	/**
+	 * Loads a collection by name if registered
+	 *
+	 * @return \Kirby\Toolkit\Collection|null
+	 * @todo 5.0 Add deprecation warning when anything else than a Collection is returned
+	 * @todo 6.0 Add PHP return type declaration for `Toolkit\Collection`
+	 */
+	public function get(string $name, array $data = [])
+	{
+		// if not yet loaded
+		$this->collections[$name] ??= $this->load($name);
+
+		// if not yet cached
+		if (($this->cache[$name]['data'] ?? null) !== $data) {
+			$controller = new Controller($this->collections[$name]);
+
+			$this->cache[$name] = [
+				'result' => $controller->call(null, $data),
+				'data'   => $data
+			];
+		}
+
+		// return cloned object
+		if (is_object($this->cache[$name]['result']) === true) {
+			return clone $this->cache[$name]['result'];
+		}
+
+		return $this->cache[$name]['result'];
+	}
+
+	/**
+	 * Checks if a collection exists
+	 */
+	public function has(string $name): bool
+	{
+		if (isset($this->collections[$name]) === true) {
+			return true;
+		}
+
+		try {
+			$this->load($name);
+			return true;
+		} catch (NotFoundException) {
+			return false;
+		}
+	}
+
+	/**
+	 * Loads collection from php file in a
+	 * given directory or from plugin extension.
+	 *
+	 * @throws \Kirby\Exception\NotFoundException
+	 */
+	public function load(string $name): mixed
+	{
+		$kirby = App::instance();
+
+		// first check for collection file
+		$file = $kirby->root('collections') . '/' . $name . '.php';
+
+		if (is_file($file) === true) {
+			$collection = F::load($file, allowOutput: false);
+
+			if ($collection instanceof Closure) {
+				return $collection;
+			}
+		}
+
+		// fallback to collections from plugins
+		$collections = $kirby->extensions('collections');
+
+		return $collections[$name] ??
+			throw new NotFoundException('The collection cannot be found');
+	}
+}

kirby/src/Cms/ContentLock.php

@@ -0,0 +1,222 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Exception\AuthException;
+use Kirby\Exception\DuplicateException;
+use Kirby\Exception\LogicException;
+
+/**
+ * Takes care of content lock and unlock information
+ *
+ * @package   Kirby Cms
+ * @author    Nico Hoffmann <nico@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class ContentLock
+{
+	protected array $data;
+
+	public function __construct(
+		protected ModelWithContent $model
+	) {
+		$this->data = $this->kirby()->locks()->get($model);
+	}
+
+	/**
+	 * Clears the lock unconditionally
+	 */
+	protected function clearLock(): bool
+	{
+		// if no lock exists, skip
+		if (isset($this->data['lock']) === false) {
+			return true;
+		}
+
+		// remove lock
+		unset($this->data['lock']);
+
+		return $this->kirby()->locks()->set($this->model, $this->data);
+	}
+
+	/**
+	 * Sets lock with the current user
+	 *
+	 * @throws \Kirby\Exception\DuplicateException
+	 */
+	public function create(): bool
+	{
+		// check if model is already locked by another user
+		if (
+			isset($this->data['lock']) === true &&
+			$this->data['lock']['user'] !== $this->user()->id()
+		) {
+			$id = ContentLocks::id($this->model);
+			throw new DuplicateException($id . ' is already locked');
+		}
+
+		$this->data['lock'] = [
+			'user' => $this->user()->id(),
+			'time' => time()
+		];
+
+		return $this->kirby()->locks()->set($this->model, $this->data);
+	}
+
+	/**
+	 * Returns either `false` or array  with `user`, `email`,
+	 * `time` and `unlockable` keys
+	 */
+	public function get(): array|bool
+	{
+		$data = $this->data['lock'] ?? [];
+
+		if (empty($data) === false && $data['user'] !== $this->user()->id()) {
+			if ($user = $this->kirby()->user($data['user'])) {
+				$time = (int)($data['time']);
+
+				return [
+					'user'       => $user->id(),
+					'email'      => $user->email(),
+					'time'       => $time,
+					'unlockable' => ($time + 60) <= time()
+				];
+			}
+
+			// clear lock if user not found
+			$this->clearLock();
+		}
+
+		return false;
+	}
+
+	/**
+	 * Returns if the model is locked by another user
+	 */
+	public function isLocked(): bool
+	{
+		$lock = $this->get();
+
+		if ($lock !== false && $lock['user'] !== $this->user()->id()) {
+			return true;
+		}
+
+		return false;
+	}
+
+	/**
+	 * Returns if the current user's lock has been removed by another user
+	 */
+	public function isUnlocked(): bool
+	{
+		$data = $this->data['unlock'] ?? [];
+
+		return in_array($this->user()->id(), $data) === true;
+	}
+
+	/**
+	 * Returns the app instance
+	 */
+	protected function kirby(): App
+	{
+		return $this->model->kirby();
+	}
+
+	/**
+	 * Removes lock of current user
+	 *
+	 * @throws \Kirby\Exception\LogicException
+	 */
+	public function remove(): bool
+	{
+		// if no lock exists, skip
+		if (isset($this->data['lock']) === false) {
+			return true;
+		}
+
+		// check if lock was set by another user
+		if ($this->data['lock']['user'] !== $this->user()->id()) {
+			throw new LogicException([
+				'fallback' => 'The content lock can only be removed by the user who created it. Use unlock instead.',
+				'httpCode' => 409
+			]);
+		}
+
+		return $this->clearLock();
+	}
+
+	/**
+	 * Removes unlock information for current user
+	 */
+	public function resolve(): bool
+	{
+		// if no unlocks exist, skip
+		if (isset($this->data['unlock']) === false) {
+			return true;
+		}
+
+		// remove user from unlock array
+		$this->data['unlock'] = array_diff(
+			$this->data['unlock'],
+			[$this->user()->id()]
+		);
+
+		return $this->kirby()->locks()->set($this->model, $this->data);
+	}
+
+	/**
+	 * Returns the state for the
+	 * form buttons in the frontend
+	 */
+	public function state(): string|null
+	{
+		return match (true) {
+			$this->isUnlocked() => 'unlock',
+			$this->isLocked()   => 'lock',
+			default => null
+		};
+	}
+
+	/**
+	 * Returns a usable lock array
+	 * for the frontend
+	 */
+	public function toArray(): array
+	{
+		return [
+			'state' => $this->state(),
+			'data'  => $this->get()
+		];
+	}
+
+	/**
+	 * Removes current lock and adds lock user to unlock data
+	 */
+	public function unlock(): bool
+	{
+		// if no lock exists, skip
+		if (isset($this->data['lock']) === false) {
+			return true;
+		}
+
+		// add lock user to unlocked data
+		$this->data['unlock'] ??= [];
+		$this->data['unlock'][] = $this->data['lock']['user'];
+
+		return $this->clearLock();
+	}
+
+	/**
+	 * Returns currently authenticated user;
+	 * throws exception if none is authenticated
+	 *
+	 * @throws \Kirby\Exception\PermissionException
+	 */
+	protected function user(): User
+	{
+		return $this->kirby()->user() ??
+			throw new AuthException('No user authenticated.');
+	}
+}

kirby/src/Cms/ContentLocks.php

@@ -0,0 +1,210 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Data\Data;
+use Kirby\Exception\Exception;
+use Kirby\Filesystem\F;
+
+/**
+ * Manages all content lock files
+ *
+ * @package   Kirby Cms
+ * @author    Nico Hoffmann <nico@getkirby.com>,
+ *            Lukas Bestle <lukas@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class ContentLocks
+{
+	/**
+	 * Data from the `.lock` files
+	 * that have been read so far
+	 * cached by `.lock` file path
+	 */
+	protected array $data = [];
+
+	/**
+	 * PHP file handles for all currently
+	 * open `.lock` files
+	 */
+	protected array $handles = [];
+
+	/**
+	 * Closes the open file handles
+	 *
+	 * @codeCoverageIgnore
+	 */
+	public function __destruct()
+	{
+		foreach ($this->handles as $file => $handle) {
+			$this->closeHandle($file);
+		}
+	}
+
+	/**
+	 * Removes the file lock and closes the file handle
+	 *
+	 * @throws \Kirby\Exception\Exception
+	 */
+	protected function closeHandle(string $file): void
+	{
+		if (isset($this->handles[$file]) === false) {
+			return;
+		}
+
+		$handle = $this->handles[$file];
+		$result = flock($handle, LOCK_UN) && fclose($handle);
+
+		if ($result !== true) {
+			throw new Exception('Unexpected file system error.'); // @codeCoverageIgnore
+		}
+
+		unset($this->handles[$file]);
+	}
+
+	/**
+	 * Returns the path to a model's lock file
+	 */
+	public static function file(ModelWithContent $model): string
+	{
+		$root = $model::CLASS_ALIAS === 'file' ? dirname($model->root()) : $model->root();
+		return $root . '/.lock';
+	}
+
+	/**
+	 * Returns the lock/unlock data for the specified model
+	 */
+	public function get(ModelWithContent $model): array
+	{
+		$file = static::file($model);
+		$id   = static::id($model);
+
+		// return from cache if file was already loaded
+		if (isset($this->data[$file]) === true) {
+			return $this->data[$file][$id] ?? [];
+		}
+
+		// first get a handle to ensure a file system lock
+		$handle = $this->handle($file);
+
+		if (is_resource($handle) === true) {
+			// read data from file
+			clearstatcache();
+			$filesize = filesize($file);
+
+			if ($filesize > 0) {
+				// always read the whole file
+				rewind($handle);
+				$string = fread($handle, $filesize);
+				$data   = Data::decode($string, 'yaml');
+			}
+		}
+
+		$this->data[$file] = $data ?? [];
+
+		return $this->data[$file][$id] ?? [];
+	}
+
+	/**
+	 * Returns the file handle to a `.lock` file
+	 *
+	 * @param bool $create Whether to create the file if it does not exist
+	 * @return resource|null File handle
+	 * @throws \Kirby\Exception\Exception
+	 */
+	protected function handle(string $file, bool $create = false)
+	{
+		// check for an already open handle
+		if (isset($this->handles[$file]) === true) {
+			return $this->handles[$file];
+		}
+
+		// don't create a file if not requested
+		if (is_file($file) !== true && $create !== true) {
+			return null;
+		}
+
+		$handle = @fopen($file, 'c+b');
+		if (is_resource($handle) === false) {
+			throw new Exception('Lock file ' . $file . ' could not be opened.'); // @codeCoverageIgnore
+		}
+
+		// lock the lock file exclusively to prevent changes by other threads
+		$result = flock($handle, LOCK_EX);
+		if ($result !== true) {
+			throw new Exception('Unexpected file system error.'); // @codeCoverageIgnore
+		}
+
+		return $this->handles[$file] = $handle;
+	}
+
+	/**
+	 * Returns model ID used as the key for the data array;
+	 * prepended with a slash because the $site otherwise won't have an ID
+	 */
+	public static function id(ModelWithContent $model): string
+	{
+		return '/' . $model->id();
+	}
+
+	/**
+	 * Sets and writes the lock/unlock data for the specified model
+	 *
+	 * @throws \Kirby\Exception\Exception
+	 */
+	public function set(ModelWithContent $model, array $data): bool
+	{
+		$file   = static::file($model);
+		$id     = static::id($model);
+		$handle = $this->handle($file, true);
+
+		$this->data[$file][$id] = $data;
+
+		// make sure to unset model id entries,
+		// if no lock data for the model exists
+		foreach ($this->data[$file] as $id => $data) {
+			// there is no data for that model whatsoever
+			if (
+				isset($data['lock']) === false &&
+				(isset($data['unlock']) === false ||
+				count($data['unlock']) === 0)
+			) {
+				unset($this->data[$file][$id]);
+
+			// there is empty unlock data, but still lock data
+			} elseif (
+				isset($data['unlock']) === true &&
+				count($data['unlock']) === 0
+			) {
+				unset($this->data[$file][$id]['unlock']);
+			}
+		}
+
+		// there is no data left in the file whatsoever, delete the file
+		if (count($this->data[$file]) === 0) {
+			unset($this->data[$file]);
+
+			// close the file handle, otherwise we can't delete it on Windows
+			$this->closeHandle($file);
+
+			return F::remove($file);
+		}
+
+		$yaml = Data::encode($this->data[$file], 'yaml');
+
+		// delete all file contents first
+		if (rewind($handle) !== true || ftruncate($handle, 0) !== true) {
+			throw new Exception('Could not write lock file ' . $file . '.'); // @codeCoverageIgnore
+		}
+
+		// write the new contents
+		$result = fwrite($handle, $yaml);
+		if (is_int($result) === false || $result === 0) {
+			throw new Exception('Could not write lock file ' . $file . '.'); // @codeCoverageIgnore
+		}
+
+		return true;
+	}
+}

kirby/src/Cms/Core.php

@@ -0,0 +1,459 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Cache\ApcuCache;
+use Kirby\Cache\FileCache;
+use Kirby\Cache\MemCached;
+use Kirby\Cache\MemoryCache;
+use Kirby\Cms\Auth\EmailChallenge;
+use Kirby\Cms\Auth\TotpChallenge;
+use Kirby\Form\Field\BlocksField;
+use Kirby\Form\Field\LayoutField;
+
+/**
+ * The Core class lists all parts of Kirby
+ * that need to be loaded or initalized in order
+ * to make the system work. Most core parts can
+ * be overwritten by plugins.
+ *
+ * You can get such lists as kirbytags, components,
+ * areas, etc. by accessing them through `$kirby->core()`
+ *
+ * I.e. `$kirby->core()->areas()`
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Core
+{
+	/**
+	 * Optional override for the auto-detected index root
+	 */
+	public static string|null $indexRoot = null;
+
+	protected array $cache = [];
+	protected string $root;
+
+	public function __construct(protected App $kirby)
+	{
+		$this->root = dirname(__DIR__, 2) . '/config';
+	}
+
+	/**
+	 * Fetches the definition array of a particular area.
+	 *
+	 * This is a shortcut for `$kirby->core()->load()->area()`
+	 * to give faster access to original area code in plugins.
+	 */
+	public function area(string $name): array|null
+	{
+		return $this->load()->area($name);
+	}
+
+	/**
+	 * Returns a list of all paths to area definition files
+	 *
+	 * They are located in `/kirby/config/areas`
+	 */
+	public function areas(): array
+	{
+		return [
+			'account'      => $this->root . '/areas/account.php',
+			'installation' => $this->root . '/areas/installation.php',
+			'lab'          => $this->root . '/areas/lab.php',
+			'languages'    => $this->root . '/areas/languages.php',
+			'login'        => $this->root . '/areas/login.php',
+			'logout'       => $this->root . '/areas/logout.php',
+			'search'       => $this->root . '/areas/search.php',
+			'site'         => $this->root . '/areas/site.php',
+			'system'       => $this->root . '/areas/system.php',
+			'users'        => $this->root . '/areas/users.php',
+		];
+	}
+
+	/**
+	 * Returns a list of all default auth challenge classes
+	 */
+	public function authChallenges(): array
+	{
+		return [
+			'email' => EmailChallenge::class,
+			'totp'  => TotpChallenge::class,
+		];
+	}
+
+	/**
+	 * Returns a list of all paths to blueprint presets
+	 *
+	 * They are located in `/kirby/config/presets`
+	 */
+	public function blueprintPresets(): array
+	{
+		return [
+			'pages' => $this->root . '/presets/pages.php',
+			'page'  => $this->root . '/presets/page.php',
+			'files' => $this->root . '/presets/files.php',
+		];
+	}
+
+	/**
+	 * Returns a list of paths to core blueprints or
+	 * the blueprint in array form
+	 *
+	 * Block blueprints are located in `/kirby/config/blocks`
+	 */
+	public function blueprints(): array
+	{
+		return [
+			// blocks
+			'blocks/code'     => $this->root . '/blocks/code/code.yml',
+			'blocks/gallery'  => $this->root . '/blocks/gallery/gallery.yml',
+			'blocks/heading'  => $this->root . '/blocks/heading/heading.yml',
+			'blocks/image'    => $this->root . '/blocks/image/image.yml',
+			'blocks/line'     => $this->root . '/blocks/line/line.yml',
+			'blocks/list'     => $this->root . '/blocks/list/list.yml',
+			'blocks/markdown' => $this->root . '/blocks/markdown/markdown.yml',
+			'blocks/quote'    => $this->root . '/blocks/quote/quote.yml',
+			'blocks/table'    => $this->root . '/blocks/table/table.yml',
+			'blocks/text'     => $this->root . '/blocks/text/text.yml',
+			'blocks/video'    => $this->root . '/blocks/video/video.yml',
+
+			// file blueprints
+			'files/default' => ['title' => 'File'],
+
+			// page blueprints
+			'pages/default' => ['title' => 'Page'],
+
+			// site blueprints
+			'site' => [
+				'title' => 'Site',
+				'sections' => [
+					'pages' => [
+						'headline' => ['*' => 'pages'],
+						'type'	   => 'pages'
+					]
+				]
+			]
+		];
+	}
+
+	/**
+	 * Returns a list of all core caches
+	 */
+	public function caches(): array
+	{
+		return [
+			'updates' => true,
+			'uuid'    => true,
+		];
+	}
+
+	/**
+	 * Returns a list of all cache driver classes
+	 */
+	public function cacheTypes(): array
+	{
+		return [
+			'apcu'      => ApcuCache::class,
+			'file'      => FileCache::class,
+			'memcached' => MemCached::class,
+			'memory'    => MemoryCache::class,
+		];
+	}
+
+	/**
+	 * Returns an array of all core component functions
+	 *
+	 * The component functions can be found in
+	 * `/kirby/config/components.php`
+	 */
+	public function components(): array
+	{
+		return $this->cache['components'] ??= include $this->root . '/components.php';
+	}
+
+	/**
+	 * Returns a map of all field method aliases
+	 */
+	public function fieldMethodAliases(): array
+	{
+		return [
+			'bool'    => 'toBool',
+			'esc'     => 'escape',
+			'excerpt' => 'toExcerpt',
+			'float'   => 'toFloat',
+			'h'       => 'html',
+			'int'     => 'toInt',
+			'kt'      => 'kirbytext',
+			'kti'     => 'kirbytextinline',
+			'link'    => 'toLink',
+			'md'      => 'markdown',
+			'sp'      => 'smartypants',
+			'v'       => 'isValid',
+			'x'       => 'xml'
+		];
+	}
+
+	/**
+	 * Returns an array of all field method functions
+	 *
+	 * Field methods are stored in `/kirby/config/methods.php`
+	 */
+	public function fieldMethods(): array
+	{
+		return $this->cache['fieldMethods'] ??= (include $this->root . '/methods.php')($this->kirby);
+	}
+
+	/**
+	 * Returns an array of paths for field mixins
+	 *
+	 * They are located in `/kirby/config/fields/mixins`
+	 */
+	public function fieldMixins(): array
+	{
+		return [
+			'datetime'   => $this->root . '/fields/mixins/datetime.php',
+			'filepicker' => $this->root . '/fields/mixins/filepicker.php',
+			'layout'     => $this->root . '/fields/mixins/layout.php',
+			'min'        => $this->root . '/fields/mixins/min.php',
+			'options'    => $this->root . '/fields/mixins/options.php',
+			'pagepicker' => $this->root . '/fields/mixins/pagepicker.php',
+			'picker'     => $this->root . '/fields/mixins/picker.php',
+			'upload'     => $this->root . '/fields/mixins/upload.php',
+			'userpicker' => $this->root . '/fields/mixins/userpicker.php',
+		];
+	}
+
+	/**
+	 * Returns an array of all paths and class names of panel fields
+	 *
+	 * Traditional panel fields are located in `/kirby/config/fields`
+	 *
+	 * The more complex field classes can be found in
+	 * `/kirby/src/Form/Fields`
+	 */
+	public function fields(): array
+	{
+		return [
+			'blocks'      => BlocksField::class,
+			'checkboxes'  => $this->root . '/fields/checkboxes.php',
+			'color'       => $this->root . '/fields/color.php',
+			'date'        => $this->root . '/fields/date.php',
+			'email'       => $this->root . '/fields/email.php',
+			'files'       => $this->root . '/fields/files.php',
+			'gap'         => $this->root . '/fields/gap.php',
+			'headline'    => $this->root . '/fields/headline.php',
+			'hidden'      => $this->root . '/fields/hidden.php',
+			'info'        => $this->root . '/fields/info.php',
+			'layout'      => LayoutField::class,
+			'line'        => $this->root . '/fields/line.php',
+			'link'        => $this->root . '/fields/link.php',
+			'list'        => $this->root . '/fields/list.php',
+			'multiselect' => $this->root . '/fields/multiselect.php',
+			'number'      => $this->root . '/fields/number.php',
+			'object'      => $this->root . '/fields/object.php',
+			'pages'       => $this->root . '/fields/pages.php',
+			'radio'       => $this->root . '/fields/radio.php',
+			'range'       => $this->root . '/fields/range.php',
+			'select'      => $this->root . '/fields/select.php',
+			'slug'        => $this->root . '/fields/slug.php',
+			'structure'   => $this->root . '/fields/structure.php',
+			'tags'        => $this->root . '/fields/tags.php',
+			'tel'         => $this->root . '/fields/tel.php',
+			'text'        => $this->root . '/fields/text.php',
+			'textarea'    => $this->root . '/fields/textarea.php',
+			'time'        => $this->root . '/fields/time.php',
+			'toggle'      => $this->root . '/fields/toggle.php',
+			'toggles'     => $this->root . '/fields/toggles.php',
+			'url'         => $this->root . '/fields/url.php',
+			'users'       => $this->root . '/fields/users.php',
+			'writer'      => $this->root . '/fields/writer.php'
+		];
+	}
+
+	/**
+	 * Returns a map of all kirbytag aliases
+	 */
+	public function kirbyTagAliases(): array
+	{
+		return [
+			'youtube' => 'video',
+			'vimeo'   => 'video'
+		];
+	}
+
+	/**
+	 * Returns an array of all kirbytag definitions
+	 *
+	 * They are located in `/kirby/config/tags.php`
+	 */
+	public function kirbyTags(): array
+	{
+		return $this->cache['kirbytags'] ??= include $this->root . '/tags.php';
+	}
+
+	/**
+	 * Loads a core part of Kirby
+	 *
+	 * The loader is set to not include plugins.
+	 * This way, you can access original Kirby core code
+	 * through this load method.
+	 */
+	public function load(): Loader
+	{
+		return new Loader($this->kirby, false);
+	}
+
+	/**
+	 * Returns all absolute paths to important directories
+	 *
+	 * Roots are resolved and baked in `\Kirby\Cms\App::bakeRoots()`
+	 */
+	public function roots(): array
+	{
+		return $this->cache['roots'] ??= [
+			'kirby'       => fn (array $roots) => dirname(__DIR__, 2),
+			'i18n'        => fn (array $roots) => $roots['kirby'] . '/i18n',
+			'i18n:translations' => fn (array $roots) => $roots['i18n'] . '/translations',
+			'i18n:rules'  => fn (array $roots) => $roots['i18n'] . '/rules',
+
+			'index'       => fn (array $roots) => static::$indexRoot ?? dirname(__DIR__, 3),
+			'assets'      => fn (array $roots) => $roots['index'] . '/assets',
+			'content'     => fn (array $roots) => $roots['index'] . '/content',
+			'media'       => fn (array $roots) => $roots['index'] . '/media',
+			'panel'       => fn (array $roots) => $roots['kirby'] . '/panel',
+			'site'        => fn (array $roots) => $roots['index'] . '/site',
+			'accounts'    => fn (array $roots) => $roots['site'] . '/accounts',
+			'blueprints'  => fn (array $roots) => $roots['site'] . '/blueprints',
+			'cache'       => fn (array $roots) => $roots['site'] . '/cache',
+			'collections' => fn (array $roots) => $roots['site'] . '/collections',
+			'commands'    => fn (array $roots) => $roots['site'] . '/commands',
+			'config'      => fn (array $roots) => $roots['site'] . '/config',
+			'controllers' => fn (array $roots) => $roots['site'] . '/controllers',
+			'languages'   => fn (array $roots) => $roots['site'] . '/languages',
+			'license'     => fn (array $roots) => $roots['config'] . '/.license',
+			'logs'        => fn (array $roots) => $roots['site'] . '/logs',
+			'models'      => fn (array $roots) => $roots['site'] . '/models',
+			'plugins'     => fn (array $roots) => $roots['site'] . '/plugins',
+			'sessions'    => fn (array $roots) => $roots['site'] . '/sessions',
+			'snippets'    => fn (array $roots) => $roots['site'] . '/snippets',
+			'templates'   => fn (array $roots) => $roots['site'] . '/templates',
+			'roles'       => fn (array $roots) => $roots['blueprints'] . '/users',
+		];
+	}
+
+	/**
+	 * Returns an array of all routes for Kirby’s router
+	 *
+	 * Routes are split into `before` and `after` routes.
+	 *
+	 * Plugin routes will be injected inbetween.
+	 */
+	public function routes(): array
+	{
+		return $this->cache['routes'] ??= (include $this->root . '/routes.php')($this->kirby);
+	}
+
+	/**
+	 * Returns a list of all paths to core block snippets
+	 *
+	 * They are located in `/kirby/config/blocks`
+	 */
+	public function snippets(): array
+	{
+		return [
+			'blocks/code'     => $this->root . '/blocks/code/code.php',
+			'blocks/gallery'  => $this->root . '/blocks/gallery/gallery.php',
+			'blocks/heading'  => $this->root . '/blocks/heading/heading.php',
+			'blocks/image'    => $this->root . '/blocks/image/image.php',
+			'blocks/line'     => $this->root . '/blocks/line/line.php',
+			'blocks/list'     => $this->root . '/blocks/list/list.php',
+			'blocks/markdown' => $this->root . '/blocks/markdown/markdown.php',
+			'blocks/quote'    => $this->root . '/blocks/quote/quote.php',
+			'blocks/table'    => $this->root . '/blocks/table/table.php',
+			'blocks/text'     => $this->root . '/blocks/text/text.php',
+			'blocks/video'    => $this->root . '/blocks/video/video.php',
+		];
+	}
+
+	/**
+	 * Returns a list of paths to section mixins
+	 *
+	 * They are located in `/kirby/config/sections/mixins`
+	 */
+	public function sectionMixins(): array
+	{
+		return [
+			'details'    => $this->root . '/sections/mixins/details.php',
+			'empty'      => $this->root . '/sections/mixins/empty.php',
+			'headline'   => $this->root . '/sections/mixins/headline.php',
+			'help'       => $this->root . '/sections/mixins/help.php',
+			'layout'     => $this->root . '/sections/mixins/layout.php',
+			'max'        => $this->root . '/sections/mixins/max.php',
+			'min'        => $this->root . '/sections/mixins/min.php',
+			'pagination' => $this->root . '/sections/mixins/pagination.php',
+			'parent'     => $this->root . '/sections/mixins/parent.php',
+			'search'     => $this->root . '/sections/mixins/search.php',
+			'sort'        => $this->root . '/sections/mixins/sort.php',
+		];
+	}
+
+	/**
+	 * Returns a list of all section definitions
+	 *
+	 * They are located in `/kirby/config/sections`
+	 */
+	public function sections(): array
+	{
+		return [
+			'fields' => $this->root . '/sections/fields.php',
+			'files'  => $this->root . '/sections/files.php',
+			'info'   => $this->root . '/sections/info.php',
+			'pages'  => $this->root . '/sections/pages.php',
+			'stats'  => $this->root . '/sections/stats.php',
+		];
+	}
+
+	/**
+	 * Returns a list of paths to all system templates
+	 *
+	 * They are located in `/kirby/config/templates`
+	 */
+	public function templates(): array
+	{
+		return [
+			'emails/auth/login'          => $this->root . '/templates/emails/auth/login.php',
+			'emails/auth/password-reset' => $this->root . '/templates/emails/auth/password-reset.php'
+		];
+	}
+
+	/**
+	 * Returns an array with all system URLs
+	 *
+	 * URLs are resolved and baked in `\Kirby\Cms\App::bakeUrls()`
+	 */
+	public function urls(): array
+	{
+		return $this->cache['urls'] ??= [
+			'index'   => fn () => $this->kirby->environment()->baseUrl(),
+			'base'    => fn (array $urls) => rtrim($urls['index'], '/'),
+			'current' => function (array $urls) {
+				$path = trim($this->kirby->path(), '/');
+
+				if (empty($path) === true) {
+					return $urls['index'];
+				}
+
+				return $urls['base'] . '/' . $path;
+			},
+			'assets' => fn (array $urls) => $urls['base'] . '/assets',
+			'api'    => fn (array $urls) => $urls['base'] . '/' . $this->kirby->option('api.slug', 'api'),
+			'media'  => fn (array $urls) => $urls['base'] . '/media',
+			'panel'  => fn (array $urls) => $urls['base'] . '/' . $this->kirby->option('panel.slug', 'panel')
+		];
+	}
+}

kirby/src/Cms/Email.php

@@ -0,0 +1,240 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Exception\NotFoundException;
+use Kirby\Template\Template;
+
+/**
+ * Wrapper around our Email package, which
+ * handles all the magic connections between Kirby
+ * and sending emails, like email templates, file
+ * attachments, etc.
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Email
+{
+	/**
+	 * Options configured through the `email` CMS option
+	 */
+	protected array $options;
+
+	/**
+	 * Props for the email object; will be passed to the
+	 * Kirby\Email\Email class
+	 */
+	protected array $props;
+
+	/**
+	 * Class constructor
+	 *
+	 * @param string|array $preset Preset name from the config or a simple props array
+	 * @param array $props Props array to override the $preset
+	 */
+	public function __construct(string|array $preset = [], array $props = [])
+	{
+		$this->options = App::instance()->option('email', []);
+
+		// build a prop array based on preset and props
+		$preset = $this->preset($preset);
+		$this->props = array_merge($preset, $props);
+
+		// add transport settings
+		$this->props['transport'] ??= $this->options['transport'] ?? [];
+
+		// add predefined beforeSend option
+		$this->props['beforeSend'] ??= $this->options['beforeSend'] ?? null;
+
+		// transform model objects to values
+		$this->transformUserSingle('from', 'fromName');
+		$this->transformUserSingle('replyTo', 'replyToName');
+		$this->transformUserMultiple('to');
+		$this->transformUserMultiple('cc');
+		$this->transformUserMultiple('bcc');
+		$this->transformFile('attachments');
+
+		// load template for body text
+		$this->template();
+	}
+
+	/**
+	 * Grabs a preset from the options; supports fixed
+	 * prop arrays in case a preset is not needed
+	 *
+	 * @param string|array $preset Preset name or simple prop array
+	 * @throws \Kirby\Exception\NotFoundException
+	 */
+	protected function preset(string|array $preset): array
+	{
+		// only passed props, not preset name
+		if (is_array($preset) === true) {
+			return $preset;
+		}
+
+		// preset does not exist
+		if (isset($this->options['presets'][$preset]) !== true) {
+			throw new NotFoundException([
+				'key'  => 'email.preset.notFound',
+				'data' => ['name' => $preset]
+			]);
+		}
+
+		return $this->options['presets'][$preset];
+	}
+
+	/**
+	 * Renders the email template(s) and sets the body props
+	 * to the result
+	 *
+	 * @throws \Kirby\Exception\NotFoundException
+	 */
+	protected function template(): void
+	{
+		if (isset($this->props['template']) === true) {
+			// prepare data to be passed to template
+			$data = $this->props['data'] ?? [];
+
+			// check if html/text templates exist
+			$html = $this->getTemplate($this->props['template'], 'html');
+			$text = $this->getTemplate($this->props['template'], 'text');
+
+			if ($html->exists()) {
+				$this->props['body'] = [
+					'html' => $html->render($data)
+				];
+
+				if ($text->exists()) {
+					$this->props['body']['text'] = $text->render($data);
+				}
+
+			// fallback to single email text template
+			} elseif ($text->exists()) {
+				$this->props['body'] = $text->render($data);
+			} else {
+				throw new NotFoundException('The email template "' . $this->props['template'] . '" cannot be found');
+			}
+		}
+	}
+
+	/**
+	 * Returns an email template by name and type
+	 */
+	protected function getTemplate(string $name, string $type = null): Template
+	{
+		return App::instance()->template('emails/' . $name, $type, 'text');
+	}
+
+	/**
+	 * Returns the prop array
+	 */
+	public function toArray(): array
+	{
+		return $this->props;
+	}
+
+	/**
+	 * Transforms file object(s) to an array of file roots;
+	 * supports simple strings, file objects or collections/arrays of either
+	 *
+	 * @param string $prop Prop to transform
+	 */
+	protected function transformFile(string $prop): void
+	{
+		$this->props[$prop] = $this->transformModel($prop, File::class, 'root');
+	}
+
+	/**
+	 * Transforms Kirby models to a simplified collection
+	 *
+	 * @param string $prop Prop to transform
+	 * @param string $class Fully qualified class name of the supported model
+	 * @param string $contentValue Model method that returns the array value
+	 * @param string|null $contentKey Optional model method that returns the array key;
+	 *                                returns a simple value-only array if not given
+	 * @return array Simple key-value or just value array with the transformed prop data
+	 */
+	protected function transformModel(
+		string $prop,
+		string $class,
+		string $contentValue,
+		string $contentKey = null
+	): array {
+		$value = $this->props[$prop] ?? [];
+
+		// ensure consistent input by making everything an iterable value
+		if (is_iterable($value) !== true) {
+			$value = [$value];
+		}
+
+		$result = [];
+		foreach ($value as $key => $item) {
+			if (is_string($item) === true) {
+				// value is already a string
+				if ($contentKey !== null && is_string($key) === true) {
+					$result[$key] = $item;
+				} else {
+					$result[] = $item;
+				}
+			} elseif ($item instanceof $class) {
+				// value is a model object, get value through content method(s)
+				if ($contentKey !== null) {
+					$result[(string)$item->$contentKey()] = (string)$item->$contentValue();
+				} else {
+					$result[] = (string)$item->$contentValue();
+				}
+			} else {
+				// invalid input
+				throw new InvalidArgumentException('Invalid input for prop "' . $prop . '", expected string or "' . $class . '" object or collection');
+			}
+		}
+
+		return $result;
+	}
+
+	/**
+	 * Transforms an user object to the email address and name;
+	 * supports simple strings, user objects or collections/arrays of either
+	 * (note: only the first item in a collection/array will be used)
+	 *
+	 * @param string $addressProp Prop with the email address
+	 * @param string $nameProp Prop with the name corresponding to the $addressProp
+	 */
+	protected function transformUserSingle(
+		string $addressProp,
+		string $nameProp
+	): void {
+		$result = $this->transformModel($addressProp, User::class, 'name', 'email');
+
+		$address = array_keys($result)[0] ?? null;
+		$name    = $result[$address] ?? null;
+
+		// if the array is non-associative, the value is the address
+		if (is_int($address) === true) {
+			$address = $name;
+			$name    = null;
+		}
+
+		// always use the address as we have transformed that prop above
+		$this->props[$addressProp] = $address;
+
+		// only use the name from the user if no custom name was set
+		$this->props[$nameProp] ??= $name;
+	}
+
+	/**
+	 * Transforms user object(s) to the email address(es) and name(s);
+	 * supports simple strings, user objects or collections/arrays of either
+	 *
+	 * @param string $prop Prop to transform
+	 */
+	protected function transformUserMultiple(string $prop): void
+	{
+		$this->props[$prop] = $this->transformModel($prop, User::class, 'name', 'email');
+	}
+}

kirby/src/Cms/Event.php

@@ -0,0 +1,253 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Closure;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Toolkit\Controller;
+
+/**
+ * The Event object is created whenever the `$kirby->trigger()`
+ * or `$kirby->apply()` methods are called. It collects all
+ * event information and handles calling the individual hooks.
+ * @since 3.4.0
+ *
+ * @package   Kirby Cms
+ * @author    Lukas Bestle <lukas@getkirby.com>,
+ *            Ahmet Bora
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Event
+{
+	/**
+	 * The full event name
+	 * (e.g. `page.create:after`)
+	 */
+	protected string $name;
+
+	/**
+	 * The event type
+	 * (e.g. `page` in `page.create:after`)
+	 */
+	protected string $type;
+
+	/**
+	 * The event action
+	 * (e.g. `create` in `page.create:after`)
+	 */
+	protected string|null $action;
+
+	/**
+	 * The event state
+	 * (e.g. `after` in `page.create:after`)
+	 */
+	protected string|null $state;
+
+	/**
+	 * The event arguments
+	 */
+	protected array $arguments = [];
+
+	/**
+	 * Class constructor
+	 *
+	 * @param string $name Full event name
+	 * @param array $arguments Associative array of named event arguments
+	 */
+	public function __construct(string $name, array $arguments = [])
+	{
+		// split the event name into `$type.$action:$state`
+		// $action and $state are optional;
+		// if there is more than one dot, $type will be greedy
+		$regex = '/^(?<type>.+?)(?:\.(?<action>[^.]*?))?(?:\:(?<state>.*))?$/';
+		preg_match($regex, $name, $matches, PREG_UNMATCHED_AS_NULL);
+
+		$this->name      = $name;
+		$this->type      = $matches['type'];
+		$this->action    = $matches['action'] ?? null;
+		$this->state     = $matches['state'] ?? null;
+		$this->arguments = $arguments;
+	}
+
+	/**
+	 * Magic caller for event arguments
+	 */
+	public function __call(string $method, array $arguments = []): mixed
+	{
+		return $this->argument($method);
+	}
+
+	/**
+	 * Improved `var_dump` output
+	 * @codeCoverageIgnore
+	 */
+	public function __debugInfo(): array
+	{
+		return $this->toArray();
+	}
+
+	/**
+	 * Makes it possible to simply echo
+	 * or stringify the entire object
+	 */
+	public function __toString(): string
+	{
+		return $this->toString();
+	}
+
+	/**
+	 * Returns the action of the event (e.g. `create`)
+	 * or `null` if the event name does not include an action
+	 */
+	public function action(): string|null
+	{
+		return $this->action;
+	}
+
+	/**
+	 * Returns a specific event argument
+	 */
+	public function argument(string $name): mixed
+	{
+		return $this->arguments[$name] ?? null;
+	}
+
+	/**
+	 * Returns the arguments of the event
+	 */
+	public function arguments(): array
+	{
+		return $this->arguments;
+	}
+
+	/**
+	 * Calls a hook with the event data and returns
+	 * the hook's return value
+	 *
+	 * @param object|null $bind Optional object to bind to the hook function
+	 */
+	public function call(object|null $bind, Closure $hook): mixed
+	{
+		// collect the list of possible hook arguments
+		$data = $this->arguments();
+		$data['event'] = $this;
+
+		// magically call the hook with the arguments it requested
+		$hook = new Controller($hook);
+		return $hook->call($bind, $data);
+	}
+
+	/**
+	 * Returns the full name of the event
+	 */
+	public function name(): string
+	{
+		return $this->name;
+	}
+
+	/**
+	 * Returns the full list of possible wildcard
+	 * event names based on the current event name
+	 */
+	public function nameWildcards(): array
+	{
+		// if the event is already a wildcard event,
+		// no further variation is possible
+		if (
+			$this->type === '*' ||
+			$this->action === '*' ||
+			$this->state === '*'
+		) {
+			return [];
+		}
+
+		if ($this->action !== null && $this->state !== null) {
+			// full $type.$action:$state event
+
+			return [
+				$this->type . '.*:' . $this->state,
+				$this->type . '.' . $this->action . ':*',
+				$this->type . '.*:*',
+				'*.' . $this->action . ':' . $this->state,
+				'*.' . $this->action . ':*',
+				'*:' . $this->state,
+				'*'
+			];
+		}
+
+		if ($this->state !== null) {
+			// event without action: $type:$state
+
+			return [
+				$this->type . ':*',
+				'*:' . $this->state,
+				'*'
+			];
+		}
+
+		if ($this->action !== null) {
+			// event without state: $type.$action
+
+			return [
+				$this->type . '.*',
+				'*.' . $this->action,
+				'*'
+			];
+		}
+
+		// event with a simple name
+		return ['*'];
+	}
+
+	/**
+	 * Returns the state of the event (e.g. `after`)
+	 */
+	public function state(): string|null
+	{
+		return $this->state;
+	}
+
+	/**
+	 * Returns the event data as array
+	 */
+	public function toArray(): array
+	{
+		return [
+			'name'      => $this->name,
+			'arguments' => $this->arguments
+		];
+	}
+
+	/**
+	 * Returns the event name as string
+	 */
+	public function toString(): string
+	{
+		return $this->name;
+	}
+
+	/**
+	 * Returns the type of the event (e.g. `page`)
+	 */
+	public function type(): string
+	{
+		return $this->type;
+	}
+
+	/**
+	 * Updates a given argument with a new value
+	 *
+	 * @internal
+	 * @throws \Kirby\Exception\InvalidArgumentException
+	 */
+	public function updateArgument(string $name, $value): void
+	{
+		if (array_key_exists($name, $this->arguments) !== true) {
+			throw new InvalidArgumentException('The argument ' . $name . ' does not exist');
+		}
+
+		$this->arguments[$name] = $value;
+	}
+}

kirby/src/Cms/Fieldset.php

@@ -0,0 +1,230 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Form\Form;
+use Kirby\Toolkit\I18n;
+use Kirby\Toolkit\Str;
+
+/**
+ * Represents a single Fieldset
+ * @since 3.5.0
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Fieldset extends Item
+{
+	public const ITEMS_CLASS = Fieldsets::class;
+
+	protected bool $disabled;
+	protected bool $editable;
+	protected array $fields = [];
+	protected string|null $icon;
+	protected string|null $label;
+	protected string|null $name;
+	protected string|bool|null $preview;
+	protected array $tabs;
+	protected bool $translate;
+	protected string $type;
+	protected bool $unset;
+	protected bool $wysiwyg;
+
+	/**
+	 * Creates a new Fieldset object
+	 */
+	public function __construct(array $params = [])
+	{
+		if (empty($params['type']) === true) {
+			throw new InvalidArgumentException('The fieldset type is missing');
+		}
+
+		$this->type = $params['id'] = $params['type'];
+
+		parent::__construct($params);
+
+		$this->disabled    = $params['disabled'] ?? false;
+		$this->editable    = $params['editable'] ?? true;
+		$this->icon        = $params['icon'] ?? null;
+		$params['title'] ??= $params['name'] ?? Str::ucfirst($this->type);
+		$this->name        = $this->createName($params['title']);
+		$this->label       = $this->createLabel($params['label'] ?? null);
+		$this->preview     = $params['preview'] ?? null;
+		$this->tabs        = $this->createTabs($params);
+		$this->translate   = $params['translate'] ?? true;
+		$this->unset       = $params['unset'] ?? false;
+		$this->wysiwyg     = $params['wysiwyg'] ?? false;
+
+		if (
+			$this->translate === false &&
+			$this->kirby()->multilang() === true &&
+			$this->kirby()->language()->isDefault() === false
+		) {
+			// disable and unset the fieldset if it's not translatable
+			$this->unset    = true;
+			$this->disabled = true;
+		}
+	}
+
+	protected function createFields(array $fields = []): array
+	{
+		$fields = Blueprint::fieldsProps($fields);
+		$fields = $this->form($fields)->fields()->toArray();
+
+		// collect all fields
+		$this->fields = array_merge($this->fields, $fields);
+
+		return $fields;
+	}
+
+	protected function createName(array|string $name): string|null
+	{
+		return I18n::translate($name, $name);
+	}
+
+	protected function createLabel(array|string|null $label = null): string|null
+	{
+		return I18n::translate($label, $label);
+	}
+
+	protected function createTabs(array $params = []): array
+	{
+		$tabs = $params['tabs'] ?? [];
+
+		// return a single tab if there are only fields
+		if (empty($tabs) === true) {
+			return [
+				'content' => [
+					'fields' => $this->createFields($params['fields'] ?? []),
+				]
+			];
+		}
+
+		// normalize tabs props
+		foreach ($tabs as $name => $tab) {
+			// unset/remove tab if its property is false
+			if ($tab === false) {
+				unset($tabs[$name]);
+				continue;
+			}
+
+			$tab = Blueprint::extend($tab);
+
+			$tab['fields']  = $this->createFields($tab['fields'] ?? []);
+			$tab['label'] ??= Str::ucfirst($name);
+			$tab['label']   = $this->createLabel($tab['label']);
+			$tab['name']    = $name;
+
+			$tabs[$name] = $tab;
+		}
+
+		return $tabs;
+	}
+
+	public function disabled(): bool
+	{
+		return $this->disabled;
+	}
+
+	public function editable(): bool
+	{
+		if ($this->editable === false) {
+			return false;
+		}
+
+		if (count($this->fields) === 0) {
+			return false;
+		}
+
+		return true;
+	}
+
+	public function fields(): array
+	{
+		return $this->fields;
+	}
+
+	/**
+	 * Creates a form for the given fields
+	 */
+	public function form(array $fields, array $input = []): Form
+	{
+		return new Form([
+			'fields' => $fields,
+			'model'  => $this->parent,
+			'strict' => true,
+			'values' => $input,
+		]);
+	}
+
+	public function icon(): string|null
+	{
+		return $this->icon;
+	}
+
+	public function label(): string|null
+	{
+		return $this->label;
+	}
+
+	public function model(): ModelWithContent
+	{
+		return $this->parent;
+	}
+
+	public function name(): string
+	{
+		return $this->name;
+	}
+
+	public function preview(): string|bool|null
+	{
+		return $this->preview;
+	}
+
+	public function tabs(): array
+	{
+		return $this->tabs;
+	}
+
+	public function translate(): bool
+	{
+		return $this->translate;
+	}
+
+	public function type(): string
+	{
+		return $this->type;
+	}
+
+	public function toArray(): array
+	{
+		return [
+			'disabled'  => $this->disabled(),
+			'editable'  => $this->editable(),
+			'icon'      => $this->icon(),
+			'label'     => $this->label(),
+			'name'      => $this->name(),
+			'preview'   => $this->preview(),
+			'tabs'      => $this->tabs(),
+			'translate' => $this->translate(),
+			'type'      => $this->type(),
+			'unset'     => $this->unset(),
+			'wysiwyg'   => $this->wysiwyg(),
+		];
+	}
+
+	public function unset(): bool
+	{
+		return $this->unset;
+	}
+
+	public function wysiwyg(): bool
+	{
+		return $this->wysiwyg;
+	}
+}

kirby/src/Cms/Fieldsets.php

@@ -0,0 +1,113 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Closure;
+use Kirby\Toolkit\A;
+use Kirby\Toolkit\I18n;
+use Kirby\Toolkit\Str;
+
+/**
+ * A collection of fieldsets
+ * @since 3.5.0
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Fieldsets extends Items
+{
+	public const ITEM_CLASS = Fieldset::class;
+
+	/**
+	 * All registered fieldsets methods
+	 */
+	public static array $methods = [];
+
+	protected static function createFieldsets(array $params): array
+	{
+		$fieldsets = [];
+		$groups    = [];
+
+		foreach ($params as $type => $fieldset) {
+			if (is_int($type) === true && is_string($fieldset)) {
+				$type     = $fieldset;
+				$fieldset = 'blocks/' . $type;
+			}
+
+			if ($fieldset === false) {
+				continue;
+			}
+
+			if ($fieldset === true) {
+				$fieldset = 'blocks/' . $type;
+			}
+
+			$fieldset = Blueprint::extend($fieldset);
+
+			// make sure the type is always set
+			$fieldset['type'] ??= $type;
+
+			// extract groups
+			if ($fieldset['type'] === 'group') {
+				$result    = static::createFieldsets($fieldset['fieldsets'] ?? []);
+				$fieldsets = array_merge($fieldsets, $result['fieldsets']);
+				$label     = $fieldset['label'] ?? Str::ucfirst($type);
+
+				$groups[$type] = [
+					'label'     => I18n::translate($label, $label),
+					'name'      => $type,
+					'open'      => $fieldset['open'] ?? true,
+					'sets'      => array_column($result['fieldsets'], 'type'),
+				];
+			} else {
+				$fieldsets[$fieldset['type']] = $fieldset;
+			}
+		}
+
+		return [
+			'fieldsets' => $fieldsets,
+			'groups'    => $groups
+		];
+	}
+
+	public static function factory(
+		array $items = null,
+		array $params = []
+	): static {
+		$items ??= App::instance()->option('blocks.fieldsets', [
+			'code'     => 'blocks/code',
+			'gallery'  => 'blocks/gallery',
+			'heading'  => 'blocks/heading',
+			'image'    => 'blocks/image',
+			'line'     => 'blocks/line',
+			'list'     => 'blocks/list',
+			'markdown' => 'blocks/markdown',
+			'quote'    => 'blocks/quote',
+			'text'     => 'blocks/text',
+			'video'    => 'blocks/video',
+		]);
+
+		$result = static::createFieldsets($items);
+
+		return parent::factory(
+			$result['fieldsets'],
+			['groups' => $result['groups']] + $params
+		);
+	}
+
+	public function groups(): array
+	{
+		return $this->options['groups'] ?? [];
+	}
+
+	public function toArray(Closure|null $map = null): array
+	{
+		return A::map(
+			$this->data,
+			$map ?? fn ($fieldset) => $fieldset->toArray()
+		);
+	}
+}

kirby/src/Cms/File.php

@@ -0,0 +1,662 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Exception;
+use IntlDateFormatter;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Filesystem\F;
+use Kirby\Filesystem\IsFile;
+use Kirby\Panel\File as Panel;
+use Kirby\Toolkit\Str;
+
+/**
+ * The `$file` object provides a set
+ * of methods that can be used when
+ * dealing with a single image or
+ * other media file, like getting the
+ * URL or resizing an image. It also
+ * handles file meta data.
+ *
+ * The File class proxies the `Kirby\Filesystem\File`
+ * or `Kirby\Image\Image` class, which
+ * is used to handle all asset file methods.
+ * In addition the File class handles
+ * meta data via `Kirby\Cms\Content`.
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class File extends ModelWithContent
+{
+	use FileActions;
+	use FileModifications;
+	use HasMethods;
+	use HasSiblings;
+	use IsFile;
+
+	public const CLASS_ALIAS = 'file';
+
+	/**
+	 * All registered file methods
+	 * @todo Remove when support for PHP 8.2 is dropped
+	 */
+	public static array $methods = [];
+
+	/**
+	 * Cache for the initialized blueprint object
+	 */
+	protected FileBlueprint|null $blueprint = null;
+
+	protected string $filename;
+
+	protected string $id;
+
+	/**
+	 * The parent object
+	 */
+	protected Page|Site|User|null $parent = null;
+
+	/**
+	 * The absolute path to the file
+	 */
+	protected string|null $root;
+
+	protected string|null $template;
+
+	/**
+	 * The public file Url
+	 */
+	protected string|null $url;
+
+	/**
+	 * Creates a new File object
+	 */
+	public function __construct(array $props)
+	{
+		parent::__construct($props);
+
+		if (isset($props['filename'], $props['parent']) === false) {
+			throw new InvalidArgumentException('The filename and parent are required');
+		}
+
+		$this->filename = $props['filename'];
+		$this->parent   = $props['parent'];
+		$this->template = $props['template'] ?? null;
+		// Always set the root to null, to invoke
+		// auto root detection
+		$this->root     = null;
+		$this->url      = $props['url'] ?? null;
+
+		$this->setBlueprint($props['blueprint'] ?? null);
+	}
+
+	/**
+	 * Magic caller for file methods
+	 * and content fields. (in this order)
+	 */
+	public function __call(string $method, array $arguments = []): mixed
+	{
+		// public property access
+		if (isset($this->$method) === true) {
+			return $this->$method;
+		}
+
+		// asset method proxy
+		if (method_exists($this->asset(), $method)) {
+			return $this->asset()->$method(...$arguments);
+		}
+
+		// file methods
+		if ($this->hasMethod($method)) {
+			return $this->callMethod($method, $arguments);
+		}
+
+		// content fields
+		return $this->content()->get($method);
+	}
+
+	/**
+	 * Improved `var_dump` output
+	 */
+	public function __debugInfo(): array
+	{
+		return array_merge($this->toArray(), [
+			'content'  => $this->content(),
+			'siblings' => $this->siblings(),
+		]);
+	}
+
+	/**
+	 * Returns the url to api endpoint
+	 * @internal
+	 */
+	public function apiUrl(bool $relative = false): string
+	{
+		return $this->parent()->apiUrl($relative) . '/files/' . $this->filename();
+	}
+
+	/**
+	 * Returns the FileBlueprint object for the file
+	 */
+	public function blueprint(): FileBlueprint
+	{
+		return $this->blueprint ??= FileBlueprint::factory(
+			'files/' . $this->template(),
+			'files/default',
+			$this
+		);
+	}
+
+	/**
+	 * Returns an array with all blueprints that are available for the file
+	 * by comparing files sections and files fields of the parent model
+	 */
+	public function blueprints(string $inSection = null): array
+	{
+		// get cached results for the current file model
+		// (except when collecting for a specific section)
+		if ($inSection === null && $this->blueprints !== null) {
+			return $this->blueprints; // @codeCoverageIgnore
+		}
+
+		// always include the current template as option
+		$templates = [
+			$this->template() ?? 'default',
+			...$this->parent()->blueprint()->acceptedFileTemplates($inSection)
+		];
+
+		// make sure every template is only included once
+		$templates = array_unique(array_filter($templates));
+
+		// load the blueprint details for each collected template name
+		$blueprints = [];
+
+		foreach ($templates as $template) {
+			// default template doesn't need to exist as file
+			// to be included in the list
+			if ($template === 'default') {
+				$blueprints[$template] = [
+					'name'  => 'default',
+					'title' => '– (default)',
+				];
+				continue;
+			}
+
+			if ($blueprint = FileBlueprint::factory('files/' . $template, null, $this)) {
+				try {
+					// ensure that file matches `accept` option,
+					// if not remove template from available list
+					$this->match($blueprint->accept());
+
+					$blueprints[$template] = [
+						'name'  => $name = Str::after($blueprint->name(), '/'),
+						'title' => $blueprint->title() . ' (' . $name . ')',
+					];
+				} catch (Exception) {
+					// skip when `accept` doesn't match
+				}
+			}
+		}
+
+		$blueprints = array_values($blueprints);
+
+		// sort blueprints alphabetically while
+		// making sure the default blueprint is on top of list
+		usort($blueprints, fn ($a, $b) => match (true) {
+			$a['name'] === 'default' => -1,
+			$b['name'] === 'default' => 1,
+			default => strnatcmp($a['title'], $b['title'])
+		});
+
+		// no caching for when collecting for specific section
+		if ($inSection !== null) {
+			return $blueprints; // @codeCoverageIgnore
+		}
+
+		return $this->blueprints = $blueprints;
+	}
+
+	/**
+	 * Store the template in addition to the
+	 * other content.
+	 * @internal
+	 */
+	public function contentFileData(
+		array $data,
+		string $languageCode = null
+	): array {
+		// only add the template in, if the $data array
+		// doesn't explicitly unsets it
+		if (
+			array_key_exists('template', $data) === false &&
+			$template = $this->template()
+		) {
+			$data['template'] = $template;
+		}
+
+		return $data;
+	}
+
+	/**
+	 * Returns the directory in which
+	 * the content file is located
+	 * @internal
+	 * @deprecated 4.0.0
+	 * @todo Remove in v5
+	 * @codeCoverageIgnore
+	 */
+	public function contentFileDirectory(): string
+	{
+		Helpers::deprecated('The internal $model->contentFileDirectory() method has been deprecated. Please let us know via a GitHub issue if you need this method and tell us your use case.', 'model-content-file');
+		return dirname($this->root());
+	}
+
+	/**
+	 * Filename for the content file
+	 * @internal
+	 * @deprecated 4.0.0
+	 * @todo Remove in v5
+	 * @codeCoverageIgnore
+	 */
+	public function contentFileName(): string
+	{
+		Helpers::deprecated('The internal $model->contentFileName() method has been deprecated. Please let us know via a GitHub issue if you need this method and tell us your use case.', 'model-content-file');
+		return $this->filename();
+	}
+
+	/**
+	 * Constructs a File object
+	 * @internal
+	 */
+	public static function factory(array $props): static
+	{
+		return new static($props);
+	}
+
+	/**
+	 * Returns the filename with extension
+	 */
+	public function filename(): string
+	{
+		return $this->filename;
+	}
+
+	/**
+	 * Returns the parent Files collection
+	 */
+	public function files(): Files
+	{
+		return $this->siblingsCollection();
+	}
+
+	/**
+	 * Converts the file to html
+	 */
+	public function html(array $attr = []): string
+	{
+		return $this->asset()->html(array_merge(
+			['alt' => $this->alt()],
+			$attr
+		));
+	}
+
+	/**
+	 * Returns the id
+	 */
+	public function id(): string
+	{
+		if (
+			$this->parent() instanceof Page ||
+			$this->parent() instanceof User
+		) {
+			return $this->id ??= $this->parent()->id() . '/' . $this->filename();
+		}
+
+		return $this->id ??= $this->filename();
+	}
+
+	/**
+	 * Compares the current object with the given file object
+	 */
+	public function is(File $file): bool
+	{
+		return $this->id() === $file->id();
+	}
+
+	/**
+	 * Checks if the files is accessible.
+	 * This permission depends on the `read` option until v5
+	 */
+	public function isAccessible(): bool
+	{
+		// TODO: remove this check when `read` option deprecated in v5
+		if ($this->isReadable() === false) {
+			return false;
+		}
+
+		static $accessible = [];
+
+		if ($template = $this->template()) {
+			return $accessible[$template] ??= $this->permissions()->can('access');
+		}
+
+		return $accessible['__none__'] ??= $this->permissions()->can('access');
+	}
+
+	/**
+	 * Check if the file can be listable by the current user
+	 * This permission depends on the `read` option until v5
+	 */
+	public function isListable(): bool
+	{
+		// TODO: remove this check when `read` option deprecated in v5
+		if ($this->isReadable() === false) {
+			return false;
+		}
+
+		// not accessible also means not listable
+		if ($this->isAccessible() === false) {
+			return false;
+		}
+
+		static $listable = [];
+
+		if ($template = $this->template()) {
+			return $listable[$template] ??= $this->permissions()->can('list');
+		}
+
+		return $listable['__none__'] ??= $this->permissions()->can('list');
+	}
+
+	/**
+	 * Check if the file can be read by the current user
+	 *
+	 * @todo Deprecate `read` option in v5 and make the necessary changes for `access` and `list` options.
+	 */
+	public function isReadable(): bool
+	{
+		static $readable = [];
+
+		if ($template = $this->template()) {
+			return $readable[$template] ??= $this->permissions()->can('read');
+		}
+
+		return $readable['__none__'] ??= $this->permissions()->can('read');
+	}
+
+	/**
+	 * Creates a unique media hash
+	 * @internal
+	 */
+	public function mediaHash(): string
+	{
+		return $this->mediaToken() . '-' . $this->modifiedFile();
+	}
+
+	/**
+	 * Returns the absolute path to the file in the public media folder
+	 * @internal
+	 */
+	public function mediaRoot(): string
+	{
+		return $this->parent()->mediaRoot() . '/' . $this->mediaHash() . '/' . $this->filename();
+	}
+
+	/**
+	 * Creates a non-guessable token string for this file
+	 * @internal
+	 */
+	public function mediaToken(): string
+	{
+		$token = $this->kirby()->contentToken($this, $this->id());
+		return substr($token, 0, 10);
+	}
+
+	/**
+	 * Returns the absolute Url to the file in the public media folder
+	 * @internal
+	 */
+	public function mediaUrl(): string
+	{
+		return $this->parent()->mediaUrl() . '/' . $this->mediaHash() . '/' . $this->filename();
+	}
+
+	/**
+	 * Get the file's last modification time.
+	 *
+	 * @param string|null $handler date, intl or strftime
+	 */
+	public function modified(
+		string|IntlDateFormatter|null $format = null,
+		string|null $handler = null,
+		string|null $languageCode = null
+	): string|int|false {
+		$file     = $this->modifiedFile();
+		$content  = $this->modifiedContent($languageCode);
+		$modified = max($file, $content);
+
+		return Str::date($modified, $format, $handler);
+	}
+
+	/**
+	 * Timestamp of the last modification
+	 * of the content file
+	 */
+	protected function modifiedContent(string $languageCode = null): int
+	{
+		return $this->storage()->modified('published', $languageCode) ?? 0;
+	}
+
+	/**
+	 * Timestamp of the last modification
+	 * of the source file
+	 */
+	protected function modifiedFile(): int
+	{
+		return F::modified($this->root());
+	}
+
+	/**
+	 * Returns the parent Page object
+	 */
+	public function page(): Page|null
+	{
+		if ($this->parent() instanceof Page) {
+			return $this->parent();
+		}
+
+		return null;
+	}
+
+	/**
+	 * Returns the panel info object
+	 */
+	public function panel(): Panel
+	{
+		return new Panel($this);
+	}
+
+	/**
+	 * Returns the parent object
+	 */
+	public function parent(): Page|Site|User
+	{
+		return $this->parent ??= $this->kirby()->site();
+	}
+
+	/**
+	 * Returns the parent id if a parent exists
+	 * @internal
+	 */
+	public function parentId(): string
+	{
+		return $this->parent()->id();
+	}
+
+	/**
+	 * Returns a collection of all parent pages
+	 */
+	public function parents(): Pages
+	{
+		if ($this->parent() instanceof Page) {
+			return $this->parent()->parents()->prepend(
+				$this->parent()->id(),
+				$this->parent()
+			);
+		}
+
+		return new Pages();
+	}
+
+	/**
+	 * Return the permanent URL to the file using its UUID
+	 * @since 3.8.0
+	 */
+	public function permalink(): string|null
+	{
+		return $this->uuid()?->url();
+	}
+
+	/**
+	 * Returns the permissions object for this file
+	 */
+	public function permissions(): FilePermissions
+	{
+		return new FilePermissions($this);
+	}
+
+	/**
+	 * Returns the absolute root to the file
+	 */
+	public function root(): string|null
+	{
+		return $this->root ??= $this->parent()->root() . '/' . $this->filename();
+	}
+
+	/**
+	 * Returns the FileRules class to
+	 * validate any important action.
+	 */
+	protected function rules(): FileRules
+	{
+		return new FileRules();
+	}
+
+	/**
+	 * Sets the Blueprint object
+	 *
+	 * @return $this
+	 */
+	protected function setBlueprint(array $blueprint = null): static
+	{
+		if ($blueprint !== null) {
+			$blueprint['model'] = $this;
+			$this->blueprint = new FileBlueprint($blueprint);
+		}
+
+		return $this;
+	}
+
+	/**
+	 * Returns the parent Files collection
+	 * @internal
+	 */
+	protected function siblingsCollection(): Files
+	{
+		return $this->parent()->files();
+	}
+
+	/**
+	 * Returns the parent Site object
+	 */
+	public function site(): Site
+	{
+		if ($this->parent() instanceof Site) {
+			return $this->parent();
+		}
+
+		return $this->kirby()->site();
+	}
+
+	/**
+	 * Returns the final template
+	 */
+	public function template(): string|null
+	{
+		return $this->template ??= $this->content()->get('template')->value();
+	}
+
+	/**
+	 * Returns siblings with the same template
+	 */
+	public function templateSiblings(bool $self = true): Files
+	{
+		return $this->siblings($self)->filter('template', $this->template());
+	}
+
+	/**
+	 * Extended info for the array export
+	 * by injecting the information from
+	 * the asset.
+	 */
+	public function toArray(): array
+	{
+		return array_merge(parent::toArray(), $this->asset()->toArray(), [
+			'id'       => $this->id(),
+			'template' => $this->template(),
+		]);
+	}
+
+	/**
+	 * Returns the Url
+	 */
+	public function url(): string
+	{
+		return $this->url ??= ($this->kirby()->component('file::url'))($this->kirby(), $this);
+	}
+
+	/**
+	 * Simplified File URL that uses the parent
+	 * Page URL and the filename as a more stable
+	 * alternative for the media URLs.
+	 */
+	public function previewUrl(): string
+	{
+		$parent = $this->parent();
+		$url    = Url::to($this->id());
+
+		switch ($parent::CLASS_ALIAS) {
+			case 'page':
+				$preview = $parent->blueprint()->preview();
+
+				// the page has a custom preview setting,
+				// thus the file is only accessible through
+				// the direct media URL
+				if ($preview !== true) {
+					return $this->url();
+				}
+
+				// it's more stable to access files for drafts
+				// through their direct URL to avoid conflicts
+				// with draft token verification
+				if ($parent->isDraft() === true) {
+					return $this->url();
+				}
+
+				// checks `file::url` component is extended
+				if ($this->kirby()->isNativeComponent('file::url') === false) {
+					return $this->url();
+				}
+
+				return $url;
+			case 'user':
+				return $this->url();
+			default:
+				return $url;
+		}
+	}
+}

kirby/src/Cms/FileActions.php

@@ -0,0 +1,453 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Closure;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Exception\LogicException;
+use Kirby\Filesystem\F;
+use Kirby\Form\Form;
+use Kirby\Uuid\Uuid;
+use Kirby\Uuid\Uuids;
+
+/**
+ * FileActions
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+trait FileActions
+{
+	protected function changeExtension(
+		File $file,
+		string|null $extension = null
+	): File {
+		if (
+			$extension === null ||
+			$extension === $file->extension()
+		) {
+			return $file;
+		}
+
+		return $file->changeName($file->name(), false, $extension);
+	}
+
+	/**
+	 * Renames the file (optionally also the extension).
+	 * The store is used to actually execute this.
+	 *
+	 * @throws \Kirby\Exception\LogicException
+	 */
+	public function changeName(
+		string $name,
+		bool $sanitize = true,
+		string|null $extension = null
+	): static {
+		if ($sanitize === true) {
+			// sanitize the basename part only
+			// as the extension isn't included in $name
+			$name = F::safeBasename($name, false);
+		}
+
+		// if no extension is passed, make sure to maintain current one
+		$extension ??= $this->extension();
+
+		// don't rename if not necessary
+		if (
+			$name === $this->name() &&
+			$extension === $this->extension()
+		) {
+			return $this;
+		}
+
+		return $this->commit('changeName', ['file' => $this, 'name' => $name, 'extension' => $extension], function ($oldFile, $name, $extension) {
+			$newFile = $oldFile->clone([
+				'filename' => $name . '.' . $extension,
+			]);
+
+			// remove all public versions, lock and clear UUID cache
+			$oldFile->unpublish();
+
+			if ($oldFile->exists() === false) {
+				return $newFile;
+			}
+
+			if ($newFile->exists() === true) {
+				throw new LogicException('The new file exists and cannot be overwritten');
+			}
+
+			// rename the main file
+			F::move($oldFile->root(), $newFile->root());
+
+			// move the content storage versions
+			foreach ($oldFile->storage()->all() as $version => $lang) {
+				$content = $oldFile->storage()->read($version, $lang);
+				$oldFile->storage()->delete($version, $lang);
+				$newFile->storage()->create($version, $lang, $content);
+			}
+
+			// update collections
+			$newFile->parent()->files()->remove($oldFile->id());
+			$newFile->parent()->files()->set($newFile->id(), $newFile);
+
+			return $newFile;
+		});
+	}
+
+	/**
+	 * Changes the file's sorting number in the meta file
+	 */
+	public function changeSort(int $sort): static
+	{
+		// skip if the sort number stays the same
+		if ($this->sort()->value() === $sort) {
+			return $this;
+		}
+
+		return $this->commit(
+			'changeSort',
+			['file' => $this, 'position' => $sort],
+			fn ($file, $sort) => $file->save(['sort' => $sort])
+		);
+	}
+
+	/**
+	 * @return $this|static
+	 */
+	public function changeTemplate(string|null $template): static
+	{
+		if ($template === $this->template()) {
+			return $this;
+		}
+
+		$arguments = [
+			'file'     => $this,
+			'template' => $template ?? 'default'
+		];
+
+		return $this->commit('changeTemplate', $arguments, function ($oldFile, $template) {
+			// convert to new template/blueprint incl. content
+			$file = $oldFile->convertTo($template);
+
+			// update template, prefer unset over writing `default`
+			if ($template === 'default') {
+				$template = null;
+			}
+
+			$file = $file->update(['template' => $template]);
+
+			// rename and/or resize the file if configured by new blueprint
+			$create = $file->blueprint()->create();
+			$file = $file->manipulate($create);
+			$file = $file->changeExtension($file, $create['format'] ?? null);
+
+			return $file;
+		});
+	}
+
+	/**
+	 * Commits a file action, by following these steps
+	 *
+	 * 1. checks the action rules
+	 * 2. sends the before hook
+	 * 3. commits the store action
+	 * 4. sends the after hook
+	 * 5. returns the result
+	 */
+	protected function commit(
+		string $action,
+		array $arguments,
+		Closure $callback
+	): mixed {
+		$old            = $this->hardcopy();
+		$kirby          = $this->kirby();
+		$argumentValues = array_values($arguments);
+
+		$this->rules()->$action(...$argumentValues);
+		$kirby->trigger('file.' . $action . ':before', $arguments);
+
+		$result = $callback(...$argumentValues);
+
+		$argumentsAfter = match ($action) {
+			'create' => ['file' => $result],
+			'delete' => ['status' => $result, 'file' => $old],
+			default  => ['newFile' => $result, 'oldFile' => $old]
+		};
+
+		$kirby->trigger('file.' . $action . ':after', $argumentsAfter);
+
+		$kirby->cache('pages')->flush();
+		return $result;
+	}
+
+	/**
+	 * Copy the file to the given page
+	 */
+	public function copy(Page $page): static
+	{
+		F::copy($this->root(), $page->root() . '/' . $this->filename());
+		$copy = $page->clone()->file($this->filename());
+
+		foreach ($this->storage()->all() as $version => $lang) {
+			$content = $this->storage()->read($version, $lang);
+			$copy->storage()->create($version, $lang, $content);
+		}
+
+		// ensure the content is re-read after copying it
+		// @todo find a more elegant way
+		$copy = $page->clone()->file($this->filename());
+
+		// overwrite with new UUID (remove old, add new)
+		if (Uuids::enabled() === true) {
+			$copy = $copy->save(['uuid' => Uuid::generate()]);
+		}
+
+		return $copy;
+	}
+
+	/**
+	 * Creates a new file on disk and returns the
+	 * File object. The store is used to handle file
+	 * writing, so it can be replaced by any other
+	 * way of generating files.
+	 *
+	 * @param bool $move If set to `true`, the source will be deleted
+	 * @throws \Kirby\Exception\InvalidArgumentException
+	 * @throws \Kirby\Exception\LogicException
+	 */
+	public static function create(array $props, bool $move = false): File
+	{
+		if (isset($props['source'], $props['parent']) === false) {
+			throw new InvalidArgumentException('Please provide the "source" and "parent" props for the File');
+		}
+
+		// prefer the filename from the props
+		$props['filename'] = F::safeName($props['filename'] ?? basename($props['source']));
+
+		$props['model'] = strtolower($props['template'] ?? 'default');
+
+		// create the basic file and a test upload object
+		$file = static::factory($props);
+		$upload = $file->asset($props['source']);
+
+		// gather content
+		$content = $props['content'] ?? [];
+
+		// make sure that a UUID gets generated
+		// and added to content right away
+		if (
+			Uuids::enabled() === true &&
+			empty($content['uuid']) === true
+		) {
+			// sets the current uuid if it is the exact same file
+			if ($file->exists() === true) {
+				$existing = $file->parent()->file($file->filename());
+
+				if (
+					$file->sha1() === $upload->sha1() &&
+					$file->template() === $existing->template()
+				) {
+					// use existing content data if it is the exact same file
+					$content = $existing->content()->toArray();
+				}
+			}
+
+			$content['uuid'] ??= Uuid::generate();
+		}
+
+		// create a form for the file
+		$form = Form::for($file, ['values' => $content]);
+
+		// inject the content
+		$file = $file->clone(['content' => $form->strings(true)]);
+
+		// if the format is different from the original,
+		// we need to already rename it so that the correct file rules
+		// are applied
+		$create = $file->blueprint()->create();
+
+		// run the hook
+		$arguments = compact('file', 'upload');
+		return $file->commit('create', $arguments, function ($file, $upload) use ($create, $move) {
+			// remove all public versions, lock and clear UUID cache
+			$file->unpublish();
+
+			// only move the original source if intended
+			$method = $move === true ? 'move' : 'copy';
+
+			// overwrite the original
+			if (F::$method($upload->root(), $file->root(), true) !== true) {
+				throw new LogicException('The file could not be created');
+			}
+
+			// resize the file on upload if configured
+			$file = $file->manipulate($create);
+			$file = $file->changeExtension($file, $create['format'] ?? null);
+
+			// store the content if necessary
+			// (always create files in the default language)
+			$file->save(
+				$file->content()->toArray(),
+				$file->kirby()->defaultLanguage()?->code()
+			);
+
+			// add the file to the list of siblings
+			$file->siblings()->append($file->id(), $file);
+
+			// return a fresh clone
+			return $file->clone();
+		});
+	}
+
+	/**
+	 * Deletes the file. The store is used to
+	 * manipulate the filesystem or whatever you prefer.
+	 */
+	public function delete(): bool
+	{
+		return $this->commit('delete', ['file' => $this], function ($file) {
+			// remove all public versions, lock and clear UUID cache
+			$file->unpublish();
+
+			foreach ($file->storage()->all() as $version => $lang) {
+				$file->storage()->delete($version, $lang);
+			}
+
+			F::remove($file->root());
+
+			// remove the file from the sibling collection
+			$file->parent()->files()->remove($file);
+
+			return true;
+		});
+	}
+
+	/**
+	 * Resizes/crops the original file with Kirby's thumb handler
+	 */
+	public function manipulate(array|null $options = []): static
+	{
+		// nothing to process
+		if (empty($options) === true || $this->isResizable() === false) {
+			return $this;
+		}
+
+		// generate image file and overwrite it in place
+		$this->kirby()->thumb($this->root(), $this->root(), $options);
+
+		return $this->clone([]);
+	}
+
+	/**
+	 * Move the file to the public media folder
+	 * if it's not already there.
+	 *
+	 * @return $this
+	 */
+	public function publish(): static
+	{
+		Media::publish($this, $this->mediaRoot());
+		return $this;
+	}
+
+	/**
+	 * Replaces the file. The source must
+	 * be an absolute path to a file or a Url.
+	 * The store handles the replacement so it
+	 * finally decides what it will support as
+	 * source.
+	 *
+	 * @param bool $move If set to `true`, the source will be deleted
+	 * @throws \Kirby\Exception\LogicException
+	 */
+	public function replace(string $source, bool $move = false): static
+	{
+		$file = $this->clone();
+
+		$arguments = [
+			'file' => $file,
+			'upload' => $file->asset($source)
+		];
+
+		return $this->commit('replace', $arguments, function ($file, $upload) use ($move) {
+			// delete all public versions
+			$file->unpublish(true);
+
+			// only move the original source if intended
+			$method = $move === true ? 'move' : 'copy';
+
+			// overwrite the original
+			if (F::$method($upload->root(), $file->root(), true) !== true) {
+				throw new LogicException('The file could not be created');
+			}
+
+			// apply the resizing/crop options from the blueprint
+			$create = $file->blueprint()->create();
+			$file   = $file->manipulate($create);
+			$file   = $file->changeExtension($file, $create['format'] ?? null);
+
+			// return a fresh clone
+			return $file->clone();
+		});
+	}
+
+	/**
+	 * Stores the content on disk
+	 * @internal
+	 */
+	public function save(
+		array $data = null,
+		string $languageCode = null,
+		bool $overwrite = false
+	): static {
+		$file = parent::save($data, $languageCode, $overwrite);
+
+		// update model in siblings collection
+		$file->parent()->files()->set($file->id(), $file);
+
+		return $file;
+	}
+
+	/**
+	 * Remove all public versions of this file
+	 *
+	 * @return $this
+	 */
+	public function unpublish(bool $onlyMedia = false): static
+	{
+		// unpublish media files
+		Media::unpublish($this->parent()->mediaRoot(), $this);
+
+		if ($onlyMedia !== true) {
+			// remove the lock
+			$this->lock()?->remove();
+
+			// clear UUID cache
+			$this->uuid()?->clear();
+		}
+
+		return $this;
+	}
+
+	/**
+	 * Updates the file's data and ensures that
+	 * media files get wiped if `focus` changed
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the input array contains invalid values
+	 */
+	public function update(
+		array $input = null,
+		string $languageCode = null,
+		bool $validate = false
+	): static {
+		// delete all public media versions when focus field gets changed
+		if (($input['focus'] ?? null) !== $this->focus()->value()) {
+			$this->unpublish(true);
+		}
+
+		return parent::update($input, $languageCode, $validate);
+	}
+}

kirby/src/Cms/FileBlueprint.php

@@ -0,0 +1,254 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Filesystem\F;
+use Kirby\Filesystem\Mime;
+use Kirby\Toolkit\Str;
+
+/**
+ * Extension of the basic blueprint class
+ * to handle all blueprints for files.
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class FileBlueprint extends Blueprint
+{
+	/**
+	 * `true` if the default accepted
+	 * types are being used
+	 */
+	protected bool $defaultTypes = false;
+
+	public function __construct(array $props)
+	{
+		parent::__construct($props);
+
+		// normalize all available page options
+		$this->props['options'] = $this->normalizeOptions(
+			$this->props['options'] ?? true,
+			// defaults
+			[
+				'access'         => null,
+				'changeName'     => null,
+				'changeTemplate' => null,
+				'create'     	 => null,
+				'delete'     	 => null,
+				'list'     	     => null,
+				'read'       	 => null,
+				'replace'    	 => null,
+				'update'     	 => null,
+			]
+		);
+
+		// normalize the accept settings
+		$this->props['accept'] = $this->normalizeAccept($this->props['accept'] ?? []);
+	}
+
+	public function accept(): array
+	{
+		return $this->props['accept'];
+	}
+
+	/**
+	 * Returns the list of all accepted MIME types for
+	 * file upload or `*` if all MIME types are allowed
+	 *
+	 * @deprecated 4.2.0 Use `acceptAttribute` instead
+	 * @todo 5.0.0 Remove method
+	 */
+	public function acceptMime(): string
+	{
+		// don't disclose the specific default types
+		if ($this->defaultTypes === true) {
+			return '*';
+		}
+
+		$accept       = $this->accept();
+		$restrictions = [];
+
+		if (is_array($accept['mime']) === true) {
+			$restrictions[] = $accept['mime'];
+		} else {
+			// only fall back to the extension or type if
+			// no explicit MIME types were defined
+			// (allows to set custom MIME types for the frontend
+			// check but still restrict the extension and/or type)
+
+			if (is_array($accept['extension']) === true) {
+				// determine the main MIME type for each extension
+				$restrictions[] = array_map(
+					[Mime::class, 'fromExtension'],
+					$accept['extension']
+				);
+			}
+
+			if (is_array($accept['type']) === true) {
+				// determine the MIME types of each file type
+				$mimes = [];
+				foreach ($accept['type'] as $type) {
+					if ($extensions = F::typeToExtensions($type)) {
+						$mimes[] = array_map(
+							[Mime::class, 'fromExtension'],
+							$extensions
+						);
+					}
+				}
+
+				$restrictions[] = array_merge(...$mimes);
+			}
+		}
+
+		if ($restrictions !== []) {
+			if (count($restrictions) > 1) {
+				// only return the MIME types that are allowed by all restrictions
+				$mimes = array_intersect(...$restrictions);
+			} else {
+				$mimes = $restrictions[0];
+			}
+
+			// filter out empty MIME types and duplicates
+			return implode(', ', array_filter(array_unique($mimes)));
+		}
+
+		// no restrictions, accept everything
+		return '*';
+	}
+
+	/**
+	 * Returns the list of all accepted file extensions
+	 * for file upload or `*` if all extensions are allowed
+	 *
+	 * If a MIME type is specified in the blueprint, the `extension` and `type` options are ignored for the browser.
+	 * Extensions and types, however, are still used to validate an uploaded file on the server.
+	 * This behavior might change in the future to better represent which file extensions are actually allowed.
+	 *
+	 * If no MIME type is specified, the intersection between manually defined extensions and the Kirby "file types" is returned.
+	 * If the intersection is empty, an empty string is returned.
+	 * This behavior might change in the future to instead return the union of `mime`, `extension` and `type`.
+	 *
+	 * @since 4.2.0
+	 */
+	public function acceptAttribute(): string
+	{
+		// don't disclose the specific default types
+		if ($this->defaultTypes === true) {
+			return '*';
+		}
+
+		$accept = $this->accept();
+
+		// get extensions from "mime" option
+		if (is_array($accept['mime']) === true) {
+			// determine the extensions for each MIME type
+			$extensions = array_map(
+				fn ($pattern) => Mime::toExtensions($pattern, true),
+				$accept['mime']
+			);
+
+			$fromMime = array_unique(array_merge(...array_values($extensions)));
+
+			// return early to ignore the other options
+			return implode(',', array_map(fn ($ext) => ".$ext", $fromMime));
+		}
+
+		$restrictions = [];
+
+		// get extensions from "type" option
+		if (is_array($accept['type']) === true) {
+			$extensions = array_map(
+				fn ($type) => F::typeToExtensions($type) ?? [],
+				$accept['type']
+			);
+
+			$fromType = array_merge(...array_values($extensions));
+			$restrictions[] = $fromType;
+		}
+
+		// get extensions from "extension" option
+		if (is_array($accept['extension']) === true) {
+			$restrictions[] = $accept['extension'];
+		}
+
+		// intersect all restrictions
+		$list = match (count($restrictions)) {
+			0 => [],
+			1 => $restrictions[0],
+			default => array_intersect(...$restrictions)
+		};
+
+		$list = array_unique($list);
+
+		// format the list to include a leading dot on each extension
+		return implode(',', array_map(fn ($ext) => ".$ext", $list));
+	}
+
+	protected function normalizeAccept(mixed $accept = null): array
+	{
+		$accept = match (true) {
+			is_string($accept) 		=> ['mime' => $accept],
+			// explicitly no restrictions at all
+			$accept === true 		=> ['mime' => null],
+			// no custom restrictions
+			empty($accept) === true => [],
+			// custom restrictions
+			default 				=> $accept
+		};
+
+		$accept = array_change_key_case($accept);
+
+		$defaults = [
+			'extension'   => null,
+			'mime'        => null,
+			'maxheight'   => null,
+			'maxsize'     => null,
+			'maxwidth'    => null,
+			'minheight'   => null,
+			'minsize'     => null,
+			'minwidth'    => null,
+			'orientation' => null,
+			'type'        => null
+		];
+
+		// default type restriction if none are configured;
+		// this ensures that no unexpected files are uploaded
+		if (
+			array_key_exists('mime', $accept) === false &&
+			array_key_exists('extension', $accept) === false &&
+			array_key_exists('type', $accept) === false
+		) {
+			$defaults['type']   = ['image', 'document', 'archive', 'audio', 'video'];
+			$this->defaultTypes = true;
+		}
+
+		$accept = array_merge($defaults, $accept);
+
+		// normalize the MIME, extension and type from strings into arrays
+		if (is_string($accept['mime']) === true) {
+			$accept['mime'] = array_map(
+				fn ($mime) => $mime['value'],
+				Str::accepted($accept['mime'])
+			);
+		}
+
+		if (is_string($accept['extension']) === true) {
+			$accept['extension'] = array_map(
+				'trim',
+				explode(',', $accept['extension'])
+			);
+		}
+
+		if (is_string($accept['type']) === true) {
+			$accept['type'] = array_map(
+				'trim',
+				explode(',', $accept['type'])
+			);
+		}
+
+		return $accept;
+	}
+}

kirby/src/Cms/FileModifications.php

@@ -0,0 +1,214 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Content\Field;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Filesystem\Asset;
+
+/**
+ * Trait for image resizing, blurring etc.
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+trait FileModifications
+{
+	/**
+	 * Blurs the image by the given amount of pixels
+	 */
+	public function blur(int|bool $pixels = true): FileVersion|File|Asset
+	{
+		return $this->thumb(['blur' => $pixels]);
+	}
+
+	/**
+	 * Converts the image to black and white
+	 */
+	public function bw(): FileVersion|File|Asset
+	{
+		return $this->thumb(['grayscale' => true]);
+	}
+
+	/**
+	 * Crops the image by the given width and height
+	 */
+	public function crop(
+		int $width,
+		int $height = null,
+		$options = null
+	): FileVersion|File|Asset {
+		$quality = null;
+		$crop    = true;
+
+		if (is_int($options) === true) {
+			$quality = $options;
+		} elseif (is_string($options)) {
+			$crop = $options;
+		} elseif ($options instanceof Field) {
+			$crop = $options->value();
+		} elseif (is_array($options)) {
+			$quality = $options['quality'] ?? $quality;
+			$crop    = $options['crop']    ?? $crop;
+		}
+
+		return $this->thumb([
+			'width'   => $width,
+			'height'  => $height,
+			'quality' => $quality,
+			'crop'    => $crop
+		]);
+	}
+
+	/**
+	 * Alias for File::bw()
+	 */
+	public function grayscale(): FileVersion|File|Asset
+	{
+		return $this->thumb(['grayscale' => true]);
+	}
+
+	/**
+	 * Alias for File::bw()
+	 */
+	public function greyscale(): FileVersion|File|Asset
+	{
+		return $this->thumb(['grayscale' => true]);
+	}
+
+	/**
+	 * Sets the JPEG compression quality
+	 */
+	public function quality(int $quality): FileVersion|File|Asset
+	{
+		return $this->thumb(['quality' => $quality]);
+	}
+
+	/**
+	 * Resizes the file with the given width and height
+	 * while keeping the aspect ratio.
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException
+	 */
+	public function resize(
+		int $width = null,
+		int $height = null,
+		int $quality = null
+	): FileVersion|File|Asset {
+		return $this->thumb([
+			'width'   => $width,
+			'height'  => $height,
+			'quality' => $quality
+		]);
+	}
+
+	/**
+	 * Sharpens the image
+	 */
+	public function sharpen(int $amount = 50): FileVersion|File|Asset
+	{
+		return $this->thumb(['sharpen' => $amount]);
+	}
+
+	/**
+	 * Create a srcset definition for the given sizes
+	 * Sizes can be defined as a simple array. They can
+	 * also be set up in the config with the thumbs.srcsets option.
+	 * @since 3.1.0
+	 */
+	public function srcset(array|string|null $sizes = null): string|null
+	{
+		if (empty($sizes) === true) {
+			$sizes = $this->kirby()->option('thumbs.srcsets.default', []);
+		}
+
+		if (is_string($sizes) === true) {
+			$sizes = $this->kirby()->option('thumbs.srcsets.' . $sizes, []);
+		}
+
+		if (is_array($sizes) === false || empty($sizes) === true) {
+			return null;
+		}
+
+		$set = [];
+
+		foreach ($sizes as $key => $value) {
+			if (is_array($value)) {
+				$options = $value;
+				$condition = $key;
+			} elseif (is_string($value) === true) {
+				$options = [
+					'width' => $key
+				];
+				$condition = $value;
+			} else {
+				$options = [
+					'width' => $value
+				];
+				$condition = $value . 'w';
+			}
+
+			$set[] = $this->thumb($options)->url() . ' ' . $condition;
+		}
+
+		return implode(', ', $set);
+	}
+
+	/**
+	 * Creates a modified version of images
+	 * The media manager takes care of generating
+	 * those modified versions and putting them
+	 * in the right place. This is normally the
+	 * `/media` folder of your installation, but
+	 * could potentially also be a CDN or any other
+	 * place.
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException
+	 */
+	public function thumb(
+		array|string|null $options = null
+	): FileVersion|File|Asset {
+		// thumb presets
+		if (empty($options) === true) {
+			$options = $this->kirby()->option('thumbs.presets.default');
+		} elseif (is_string($options) === true) {
+			$options = $this->kirby()->option('thumbs.presets.' . $options);
+		}
+
+		if (empty($options) === true || is_array($options) === false) {
+			return $this;
+		}
+
+		// fallback to content file options
+		if (($options['crop'] ?? false) === true) {
+			if ($this instanceof ModelWithContent === true) {
+				$options['crop'] = $this->focus()->value() ?? 'center';
+			} else {
+				$options['crop'] = 'center';
+			}
+		}
+
+		// fallback to global config options
+		if (isset($options['format']) === false) {
+			if ($format = $this->kirby()->option('thumbs.format')) {
+				$options['format'] = $format;
+			}
+		}
+
+		$component = $this->kirby()->component('file::version');
+		$result    = $component($this->kirby(), $this, $options);
+
+		if (
+			$result instanceof FileVersion === false &&
+			$result instanceof File === false &&
+			$result instanceof Asset === false
+		) {
+			throw new InvalidArgumentException('The file::version component must return a File, FileVersion or Asset object');
+		}
+
+		return $result;
+	}
+}

kirby/src/Cms/FilePermissions.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace Kirby\Cms;
+
+/**
+ * FilePermissions
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class FilePermissions extends ModelPermissions
+{
+	protected string $category = 'files';
+
+	protected function canChangeTemplate(): bool
+	{
+		if (count($this->model->blueprints()) <= 1) {
+			return false;
+		}
+
+		return true;
+	}
+}

kirby/src/Cms/FilePicker.php

@@ -0,0 +1,74 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Exception\InvalidArgumentException;
+
+/**
+ * The FilePicker class helps to
+ * fetch the right files for the API calls
+ * for the file picker component in the panel.
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class FilePicker extends Picker
+{
+	/**
+	 * Extends the basic defaults
+	 */
+	public function defaults(): array
+	{
+		$defaults = parent::defaults();
+		$defaults['text'] = '{{ file.filename }}';
+
+		return $defaults;
+	}
+
+	/**
+	 * Search all files for the picker
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException
+	 */
+	public function items(): Files|null
+	{
+		$model = $this->options['model'];
+
+		// find the right default query
+		$query = match (true) {
+			empty($this->options['query']) === false
+				=> $this->options['query'],
+			$model instanceof File
+				=> 'file.siblings',
+			default
+			=> $model::CLASS_ALIAS . '.files'
+		};
+
+		// fetch all files for the picker
+		$files = $model->query($query);
+
+		// help mitigate some typical query usage issues
+		// by converting site and page objects to proper
+		// pages by returning their children
+		$files = match (true) {
+			$files instanceof Site,
+			$files instanceof Page,
+			$files instanceof User  => $files->files(),
+			$files instanceof Files => $files,
+
+			default => throw new InvalidArgumentException('Your query must return a set of files')
+		};
+
+		// filter protected and hidden pages
+		$files = $files->filter('isListable', true);
+
+		// search
+		$files = $this->search($files);
+
+		// paginate
+		return $this->paginate($files);
+	}
+}

kirby/src/Cms/FileRules.php

@@ -0,0 +1,343 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Exception\DuplicateException;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Exception\LogicException;
+use Kirby\Exception\PermissionException;
+use Kirby\Filesystem\File as BaseFile;
+use Kirby\Toolkit\Str;
+use Kirby\Toolkit\V;
+
+/**
+ * Validators for all file actions
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class FileRules
+{
+	/**
+	 * Validates if the filename can be changed
+	 *
+	 * @throws \Kirby\Exception\DuplicateException If a file with this name exists
+	 * @throws \Kirby\Exception\PermissionException If the user is not allowed to rename the file
+	 */
+	public static function changeName(File $file, string $name): bool
+	{
+		if ($file->permissions()->changeName() !== true) {
+			throw new PermissionException([
+				'key'  => 'file.changeName.permission',
+				'data' => ['filename' => $file->filename()]
+			]);
+		}
+
+		if (Str::length($name) === 0) {
+			throw new InvalidArgumentException([
+				'key' => 'file.changeName.empty'
+			]);
+		}
+
+		$parent    = $file->parent();
+		$duplicate = $parent->files()->not($file)->findBy('filename', $name . '.' . $file->extension());
+
+		if ($duplicate) {
+			throw new DuplicateException([
+				'key'  => 'file.duplicate',
+				'data' => ['filename' => $duplicate->filename()]
+			]);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Validates if the file can be sorted
+	 */
+	public static function changeSort(File $file, int $sort): bool
+	{
+		return true;
+	}
+
+	/**
+	 * Validates if the template of the file can be changed
+	 *
+	 * @throws \Kirby\Exception\LogicException If the template of the page cannot be changed at all
+	 * @throws \Kirby\Exception\PermissionException If the user is not allowed to change the template
+	 */
+	public static function changeTemplate(File $file, string $template): bool
+	{
+		if ($file->permissions()->changeTemplate() !== true) {
+			throw new PermissionException([
+				'key'  => 'file.changeTemplate.permission',
+				'data' => ['id' => $file->id()]
+			]);
+		}
+
+		$blueprints = $file->blueprints();
+
+		// ensure that the $template is a valid blueprint
+		// option for this file
+		if (
+			count($blueprints) <= 1 ||
+			in_array($template, array_column($blueprints, 'name')) === false
+		) {
+			throw new LogicException([
+				'key'  => 'file.changeTemplate.invalid',
+				'data' => [
+					'id' 		 => $file->id(),
+					'template'   => $template,
+					'blueprints' => implode(', ', array_column($blueprints, 'name'))
+				]
+			]);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Validates if the file can be created
+	 *
+	 * @throws \Kirby\Exception\DuplicateException If a file with the same name exists
+	 * @throws \Kirby\Exception\PermissionException If the user is not allowed to create the file
+	 */
+	public static function create(File $file, BaseFile $upload): bool
+	{
+		// We want to ensure that we are not creating duplicate files.
+		// If a file with the same name already exists
+		if ($file->exists() === true) {
+			// $file will be based on the props of the new file,
+			// to compare templates, we need to get the props of
+			// the already existing file from meta content file
+			$existing = $file->parent()->file($file->filename());
+
+			// if the new upload is the exact same file
+			// and uses the same template, we can continue
+			if (
+				$file->sha1() === $upload->sha1() &&
+				$file->template() === $existing->template()
+			) {
+				return true;
+			}
+
+			// otherwise throw an error for duplicate file
+			throw new DuplicateException([
+				'key'  => 'file.duplicate',
+				'data' => [
+					'filename' => $file->filename()
+				]
+			]);
+		}
+
+		if ($file->permissions()->create() !== true) {
+			throw new PermissionException('The file cannot be created');
+		}
+
+		static::validFile($file, $upload->mime());
+
+		$upload->match($file->blueprint()->accept());
+		$upload->validateContents(true);
+
+		return true;
+	}
+
+	/**
+	 * Validates if the file can be deleted
+	 *
+	 * @throws \Kirby\Exception\PermissionException If the user is not allowed to delete the file
+	 */
+	public static function delete(File $file): bool
+	{
+		if ($file->permissions()->delete() !== true) {
+			throw new PermissionException('The file cannot be deleted');
+		}
+
+		return true;
+	}
+
+	/**
+	 * Validates if the file can be replaced
+	 *
+	 * @throws \Kirby\Exception\PermissionException If the user is not allowed to replace the file
+	 * @throws \Kirby\Exception\InvalidArgumentException If the file type of the new file is different
+	 */
+	public static function replace(File $file, BaseFile $upload): bool
+	{
+		if ($file->permissions()->replace() !== true) {
+			throw new PermissionException('The file cannot be replaced');
+		}
+
+		static::validMime($file, $upload->mime());
+
+		if (
+			(string)$upload->mime() !== (string)$file->mime() &&
+			(string)$upload->extension() !== (string)$file->extension()
+		) {
+			throw new InvalidArgumentException([
+				'key'  => 'file.mime.differs',
+				'data' => ['mime' => $file->mime()]
+			]);
+		}
+
+		$upload->match($file->blueprint()->accept());
+		$upload->validateContents(true);
+
+		return true;
+	}
+
+	/**
+	 * Validates if the file can be updated
+	 *
+	 * @throws \Kirby\Exception\PermissionException If the user is not allowed to update the file
+	 */
+	public static function update(File $file, array $content = []): bool
+	{
+		if ($file->permissions()->update() !== true) {
+			throw new PermissionException('The file cannot be updated');
+		}
+
+		return true;
+	}
+
+	/**
+	 * Validates the file extension
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the extension is missing or forbidden
+	 */
+	public static function validExtension(File $file, string $extension): bool
+	{
+		// make it easier to compare the extension
+		$extension = strtolower($extension);
+
+		if (empty($extension) === true) {
+			throw new InvalidArgumentException([
+				'key'  => 'file.extension.missing',
+				'data' => ['filename' => $file->filename()]
+			]);
+		}
+
+		if (
+			Str::contains($extension, 'php') !== false ||
+			Str::contains($extension, 'phar') !== false ||
+			Str::contains($extension, 'pht') !== false
+		) {
+			throw new InvalidArgumentException([
+				'key'  => 'file.type.forbidden',
+				'data' => ['type' => 'PHP']
+			]);
+		}
+
+		if (Str::contains($extension, 'htm') !== false) {
+			throw new InvalidArgumentException([
+				'key'  => 'file.type.forbidden',
+				'data' => ['type' => 'HTML']
+			]);
+		}
+
+		if (V::in($extension, ['exe', App::instance()->contentExtension()]) !== false) {
+			throw new InvalidArgumentException([
+				'key'  => 'file.extension.forbidden',
+				'data' => ['extension' => $extension]
+			]);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Validates the extension, MIME type and filename
+	 *
+	 * @param $mime If not passed, the MIME type is detected from the file,
+	 *              if `false`, the MIME type is not validated for performance reasons
+	 * @throws \Kirby\Exception\InvalidArgumentException If the extension, MIME type or filename is missing or forbidden
+	 */
+	public static function validFile(
+		File $file,
+		string|false|null $mime = null
+	): bool {
+		$validMime = match ($mime) {
+			// request to skip the MIME check for performance reasons
+			false   => true,
+			default => static::validMime($file, $mime ?? $file->mime())
+		};
+
+		return
+			$validMime &&
+			static::validExtension($file, $file->extension()) &&
+			static::validFilename($file, $file->filename());
+	}
+
+	/**
+	 * Validates the filename
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the filename is missing or forbidden
+	 */
+	public static function validFilename(File $file, string $filename): bool
+	{
+		// make it easier to compare the filename
+		$filename = strtolower($filename);
+
+		// check for missing filenames
+		if (empty($filename)) {
+			throw new InvalidArgumentException([
+				'key'  => 'file.name.missing'
+			]);
+		}
+
+		// Block htaccess files
+		if (Str::startsWith($filename, '.ht')) {
+			throw new InvalidArgumentException([
+				'key'  => 'file.type.forbidden',
+				'data' => ['type' => 'Apache config']
+			]);
+		}
+
+		// Block invisible files
+		if (Str::startsWith($filename, '.')) {
+			throw new InvalidArgumentException([
+				'key'  => 'file.type.forbidden',
+				'data' => ['type' => 'invisible']
+			]);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Validates the MIME type
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the MIME type is missing or forbidden
+	 */
+	public static function validMime(File $file, string $mime = null): bool
+	{
+		// make it easier to compare the mime
+		$mime = strtolower($mime);
+
+		if (empty($mime)) {
+			throw new InvalidArgumentException([
+				'key'  => 'file.mime.missing',
+				'data' => ['filename' => $file->filename()]
+			]);
+		}
+
+		if (Str::contains($mime, 'php')) {
+			throw new InvalidArgumentException([
+				'key'  => 'file.type.forbidden',
+				'data' => ['type' => 'PHP']
+			]);
+		}
+
+		if (V::in($mime, ['text/html', 'application/x-msdownload'])) {
+			throw new InvalidArgumentException([
+				'key'  => 'file.mime.forbidden',
+				'data' => ['mime' => $mime]
+			]);
+		}
+
+		return true;
+	}
+}

kirby/src/Cms/FileVersion.php

@@ -0,0 +1,120 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Filesystem\IsFile;
+
+/**
+ * FileVersion
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class FileVersion
+{
+	use IsFile;
+
+	protected array $modifications;
+	protected $original;
+
+	public function __construct(array $props)
+	{
+		$this->root          = $props['root'] ?? null;
+		$this->url           = $props['url'] ?? null;
+		$this->original      = $props['original'];
+		$this->modifications = $props['modifications'] ?? [];
+	}
+
+	/**
+	 * Proxy for public properties, asset methods
+	 * and content field getters
+	 */
+	public function __call(string $method, array $arguments = []): mixed
+	{
+		// public property access
+		if (isset($this->$method) === true) {
+			return $this->$method;
+		}
+
+		// asset method proxy
+		if (method_exists($this->asset(), $method)) {
+			if ($this->exists() === false) {
+				$this->save();
+			}
+
+			return $this->asset()->$method(...$arguments);
+		}
+
+		// content fields
+		if ($this->original() instanceof File) {
+			return $this->original()->content()->get($method);
+		}
+	}
+
+	/**
+	 * Returns the unique ID
+	 */
+	public function id(): string
+	{
+		return dirname($this->original()->id()) . '/' . $this->filename();
+	}
+
+	/**
+	 * Returns the parent Kirby App instance
+	 */
+	public function kirby(): App
+	{
+		return $this->original()->kirby();
+	}
+
+	/**
+	 * Returns an array with all applied modifications
+	 */
+	public function modifications(): array
+	{
+		return $this->modifications;
+	}
+
+	/**
+	 * Returns the instance of the original File object
+	 */
+	public function original(): mixed
+	{
+		return $this->original;
+	}
+
+	/**
+	 * Applies the stored modifications and
+	 * saves the file on disk
+	 *
+	 * @return $this
+	 */
+	public function save(): static
+	{
+		$this->kirby()->thumb(
+			$this->original()->root(),
+			$this->root(),
+			$this->modifications()
+		);
+		return $this;
+	}
+
+
+	/**
+	 * Converts the object to an array
+	 */
+	public function toArray(): array
+	{
+		$array = array_merge(
+			$this->asset()->toArray(),
+			['modifications' => $this->modifications()]
+		);
+
+		ksort($array);
+
+		return $array;
+	}
+}

kirby/src/Cms/Files.php

@@ -0,0 +1,174 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Filesystem\F;
+use Kirby\Uuid\HasUuids;
+
+/**
+ * The `$files` object extends the general
+ * `Collection` class and refers to a
+ * collection of files, i.e. images, documents
+ * etc. Files can be filtered, searched,
+ * converted, modified or evaluated with the
+ * following methods:
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Files extends Collection
+{
+	use HasUuids;
+
+	/**
+	 * All registered files methods
+	 */
+	public static array $methods = [];
+
+	/**
+	 * Adds a single file or
+	 * an entire second collection to the
+	 * current collection
+	 *
+	 * @param \Kirby\Cms\Files|\Kirby\Cms\File|string $object
+	 * @return $this
+	 * @throws \Kirby\Exception\InvalidArgumentException When no `File` or `Files` object or an ID of an existing file is passed
+	 */
+	public function add($object): static
+	{
+		// add a files collection
+		if ($object instanceof self) {
+			$this->data = array_merge($this->data, $object->data);
+
+		// add a file by id
+		} elseif (
+			is_string($object) === true &&
+			$file = App::instance()->file($object)
+		) {
+			$this->__set($file->id(), $file);
+
+		// add a file object
+		} elseif ($object instanceof File) {
+			$this->__set($object->id(), $object);
+
+		// give a useful error message on invalid input;
+		// silently ignore "empty" values for compatibility with existing setups
+		} elseif (in_array($object, [null, false, true], true) !== true) {
+			throw new InvalidArgumentException('You must pass a Files or File object or an ID of an existing file to the Files collection');
+		}
+
+		return $this;
+	}
+
+	/**
+	 * Sort all given files by the
+	 * order in the array
+	 *
+	 * @param array $files List of file ids
+	 * @param int $offset Sorting offset
+	 * @return $this
+	 */
+	public function changeSort(array $files, int $offset = 0): static
+	{
+		foreach ($files as $filename) {
+			if ($file = $this->get($filename)) {
+				$offset++;
+				$file->changeSort($offset);
+			}
+		}
+
+		return $this;
+	}
+
+	/**
+	 * Creates a files collection from an array of props
+	 */
+	public static function factory(array $files, Page|Site|User $parent): static
+	{
+		$collection = new static([], $parent);
+
+		foreach ($files as $props) {
+			$props['collection'] = $collection;
+			$props['parent']     = $parent;
+
+			$file = File::factory($props);
+
+			$collection->data[$file->id()] = $file;
+		}
+
+		return $collection;
+	}
+
+	/**
+	 * Finds a file by its filename
+	 * @internal Use `$files->find()` instead
+	 */
+	public function findByKey(string $key): File|null
+	{
+		if ($file = $this->findByUuid($key, 'file')) {
+			return $file;
+		}
+
+		return $this->get(ltrim($this->parent?->id() . '/' . $key, '/'));
+	}
+
+	/**
+	 * Returns the file size for all
+	 * files in the collection in a
+	 * human-readable format
+	 * @since 3.6.0
+	 *
+	 * @param string|null|false $locale Locale for number formatting,
+	 *                                  `null` for the current locale,
+	 *                                  `false` to disable number formatting
+	 */
+	public function niceSize($locale = null): string
+	{
+		return F::niceSize($this->size(), $locale);
+	}
+
+	/**
+	 * Returns the raw size for all
+	 * files in the collection
+	 * @since 3.6.0
+	 */
+	public function size(): int
+	{
+		return F::size($this->values(fn ($file) => $file->root()));
+	}
+
+	/**
+	 * Returns the collection sorted by
+	 * the sort number and the filename
+	 */
+	public function sorted(): static
+	{
+		return $this->sort('sort', 'asc', 'filename', 'asc');
+	}
+
+	/**
+	 * Filter all files by the given template
+	 *
+	 * @return $this|static
+	 */
+	public function template(string|array|null $template): static
+	{
+		if (empty($template) === true) {
+			return $this;
+		}
+
+		if ($template === 'default') {
+			$template = ['default', ''];
+		}
+
+		return $this->filter(
+			'template',
+			is_array($template) ? 'in' : '==',
+			$template
+		);
+	}
+}

kirby/src/Cms/Find.php

@@ -0,0 +1,175 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Exception\NotFoundException;
+use Kirby\Toolkit\Str;
+
+/**
+ * The Find class is used in the API and
+ * the Panel to find models and parents
+ * based on request paths
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Find
+{
+	/**
+	 * Returns the file object for the given
+	 * parent path and filename
+	 *
+	 * @param string $path Path to file's parent model
+	 * @throws \Kirby\Exception\NotFoundException if the file cannot be found
+	 */
+	public static function file(
+		string $path,
+		string $filename
+	): File|null {
+		$filename = urldecode($filename);
+		$parent   = empty($path) ? null : static::parent($path);
+		$file     = App::instance()->file($filename, $parent);
+
+		if ($file?->isAccessible() === true) {
+			return $file;
+		}
+
+		throw new NotFoundException([
+			'key'  => 'file.notFound',
+			'data' => [
+				'filename' => $filename
+			]
+		]);
+	}
+
+	/**
+	 * Returns the language object for the given code
+	 *
+	 * @param string $code Language code
+	 * @throws \Kirby\Exception\NotFoundException if the language cannot be found
+	 */
+	public static function language(string $code): Language|null
+	{
+		if ($language = App::instance()->language($code)) {
+			return $language;
+		}
+
+		throw new NotFoundException([
+			'key'  => 'language.notFound',
+			'data' => [
+				'code' => $code
+			]
+		]);
+	}
+
+	/**
+	 * Returns the page object for the given id
+	 *
+	 * @param string $id Page's id
+	 * @throws \Kirby\Exception\NotFoundException if the page cannot be found
+	 */
+	public static function page(string $id): Page|null
+	{
+		// decode API ID encoding
+		$id    = str_replace(['+', ' '], '/', $id);
+		$kirby = App::instance();
+		$page  = $kirby->page($id, null, true);
+
+		if ($page?->isAccessible() === true) {
+			return $page;
+		}
+
+		throw new NotFoundException([
+			'key'  => 'page.notFound',
+			'data' => [
+				'slug' => $id
+			]
+		]);
+	}
+
+	/**
+	 * Returns the model's object for the given path
+	 *
+	 * @param string $path Path to parent model
+	 * @throws \Kirby\Exception\InvalidArgumentException if the model type is invalid
+	 * @throws \Kirby\Exception\NotFoundException if the model cannot be found
+	 */
+	public static function parent(string $path): ModelWithContent
+	{
+		$path       = trim($path, '/');
+		$modelType  = in_array($path, ['site', 'account']) ? $path : trim(dirname($path), '/');
+		$modelTypes = [
+			'site'    => 'site',
+			'users'   => 'user',
+			'pages'   => 'page',
+			'account' => 'account'
+		];
+
+		$modelName = $modelTypes[$modelType] ?? null;
+
+		if (Str::endsWith($modelType, '/files') === true) {
+			$modelName = 'file';
+		}
+
+		$kirby = App::instance();
+
+		$model = match ($modelName) {
+			'site'    => $kirby->site(),
+			'account' => static::user(),
+			'page'    => static::page(basename($path)),
+			// regular expression to split the path at the last
+			// occurrence of /files/ which separates parent path
+			// and filename
+			'file'    => static::file(...preg_split('$.*\K(/files/)$', $path)),
+			'user'    => $kirby->user(basename($path)),
+			default   => throw new InvalidArgumentException('Invalid model type: ' . $modelType)
+		};
+
+		return $model ?? throw new NotFoundException([
+			'key' => $modelName . '.undefined'
+		]);
+	}
+
+	/**
+	 * Returns the user object for the given id or
+	 * returns the current authenticated user if no
+	 * id is passed
+	 *
+	 * @param string|null $id User's id
+	 * @throws \Kirby\Exception\NotFoundException if the user for the given id cannot be found
+	 */
+	public static function user(string $id = null): User|null
+	{
+		// account is a reserved word to find the current
+		// user. It's used in various API and area routes.
+		if ($id === 'account') {
+			$id = null;
+		}
+
+		$kirby = App::instance();
+
+		// get the authenticated user
+		if ($id === null) {
+			$user = $kirby->user(
+				null,
+				$kirby->option('api.allowImpersonation', false)
+			);
+
+			return $user ?? throw new NotFoundException([
+				'key' => 'user.undefined'
+			]);
+		}
+
+		// get a specific user by id
+		return $kirby->user($id) ?? throw new NotFoundException([
+			'key'  => 'user.notFound',
+			'data' => [
+				'name' => $id
+			]
+		]);
+	}
+}

kirby/src/Cms/HasChildren.php

@@ -0,0 +1,201 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Filesystem\Dir;
+use Kirby\Toolkit\Str;
+
+/**
+ * HasChildren
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+trait HasChildren
+{
+	/**
+	 * The list of available published children
+	 */
+	public Pages|null $children = null;
+
+	/**
+	 * The list of available draft children
+	 */
+	public Pages|null $drafts = null;
+
+	/**
+	 * The combined list of available published
+	 * and draft children
+	 */
+	public Pages|null $childrenAndDrafts = null;
+
+	/**
+	 * Returns all published children
+	 */
+	public function children(): Pages
+	{
+		return $this->children ??= Pages::factory($this->inventory()['children'], $this);
+	}
+
+	/**
+	 * Returns all published and draft children at the same time
+	 */
+	public function childrenAndDrafts(): Pages
+	{
+		return $this->childrenAndDrafts ??= $this->children()->merge($this->drafts());
+	}
+
+	/**
+	 * Searches for a draft child by ID
+	 */
+	public function draft(string $path): Page|null
+	{
+		$path = str_replace('_drafts/', '', $path);
+
+		if (Str::contains($path, '/') === false) {
+			return $this->drafts()->find($path);
+		}
+
+		$parts  = explode('/', $path);
+		$parent = $this;
+
+		foreach ($parts as $slug) {
+			if ($page = $parent->find($slug)) {
+				$parent = $page;
+				continue;
+			}
+
+			if ($draft = $parent->drafts()->find($slug)) {
+				$parent = $draft;
+				continue;
+			}
+
+			return null;
+		}
+
+		return $parent;
+	}
+
+	/**
+	 * Returns all draft children
+	 */
+	public function drafts(): Pages
+	{
+		if ($this->drafts instanceof Pages) {
+			return $this->drafts;
+		}
+
+		$kirby = $this->kirby();
+
+		// create the inventory for all drafts
+		$inventory = Dir::inventory(
+			$this->root() . '/_drafts',
+			$kirby->contentExtension(),
+			$kirby->contentIgnore(),
+			$kirby->multilang()
+		);
+
+		return $this->drafts = Pages::factory($inventory['children'], $this, true);
+	}
+
+	/**
+	 * Finds one or multiple published children by ID
+	 */
+	public function find(string|array ...$arguments): Page|Pages|null
+	{
+		return $this->children()->find(...$arguments);
+	}
+
+	/**
+	 * Finds a single published or draft child
+	 */
+	public function findPageOrDraft(string $path): Page|null
+	{
+		return $this->children()->find($path) ?? $this->drafts()->find($path);
+	}
+
+	/**
+	 * Returns a collection of all published children of published children
+	 */
+	public function grandChildren(): Pages
+	{
+		return $this->children()->children();
+	}
+
+	/**
+	 * Checks if the model has any published children
+	 */
+	public function hasChildren(): bool
+	{
+		return $this->children()->count() > 0;
+	}
+
+	/**
+	 * Checks if the model has any draft children
+	 */
+	public function hasDrafts(): bool
+	{
+		return $this->drafts()->count() > 0;
+	}
+
+	/**
+	 * Checks if the page has any listed children
+	 */
+	public function hasListedChildren(): bool
+	{
+		return $this->children()->listed()->count() > 0;
+	}
+
+	/**
+	 * Checks if the page has any unlisted children
+	 */
+	public function hasUnlistedChildren(): bool
+	{
+		return $this->children()->unlisted()->count() > 0;
+	}
+
+	/**
+	 * Creates a flat child index
+	 *
+	 * @param bool $drafts If set to `true`, draft children are included
+	 */
+	public function index(bool $drafts = false): Pages
+	{
+		if ($drafts === true) {
+			return $this->childrenAndDrafts()->index($drafts);
+		}
+
+		return $this->children()->index();
+	}
+
+	/**
+	 * Sets the published children collection
+	 *
+	 * @return $this
+	 */
+	protected function setChildren(array $children = null): static
+	{
+		if ($children !== null) {
+			$this->children = Pages::factory($children, $this);
+		}
+
+		return $this;
+	}
+
+	/**
+	 * Sets the draft children collection
+	 *
+	 * @return $this
+	 */
+	protected function setDrafts(array $drafts = null): static
+	{
+		if ($drafts !== null) {
+			$this->drafts = Pages::factory($drafts, $this, true);
+		}
+
+		return $this;
+	}
+}

kirby/src/Cms/HasFiles.php

@@ -0,0 +1,189 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Uuid\Uuid;
+
+/**
+ * HasFiles
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+trait HasFiles
+{
+	/**
+	 * The Files collection
+	 */
+	protected Files|array|null $files = null;
+
+	/**
+	 * Filters the Files collection by type audio
+	 */
+	public function audio(): Files
+	{
+		return $this->files()->filter('type', '==', 'audio');
+	}
+
+	/**
+	 * Filters the Files collection by type code
+	 */
+	public function code(): Files
+	{
+		return $this->files()->filter('type', '==', 'code');
+	}
+
+	/**
+	 * Creates a new file
+	 *
+	 * @param bool $move If set to `true`, the source will be deleted
+	 */
+	public function createFile(array $props, bool $move = false): File
+	{
+		$props = array_merge($props, [
+			'parent' => $this,
+			'url'    => null
+		]);
+
+		return File::create($props, $move);
+	}
+
+	/**
+	 * Filters the Files collection by type documents
+	 */
+	public function documents(): Files
+	{
+		return $this->files()->filter('type', '==', 'document');
+	}
+
+	/**
+	 * Returns a specific file by filename or the first one
+	 */
+	public function file(
+		string $filename = null,
+		string $in = 'files'
+	): File|null {
+		if ($filename === null) {
+			return $this->$in()->first();
+		}
+
+		// find by global UUID
+		if (Uuid::is($filename, 'file') === true) {
+			return Uuid::for($filename, $this->$in())->model();
+		}
+
+		if (strpos($filename, '/') !== false) {
+			$path     = dirname($filename);
+			$filename = basename($filename);
+
+			if ($page = $this->find($path)) {
+				return $page->$in()->find($filename);
+			}
+
+			return null;
+		}
+
+		return $this->$in()->find($filename);
+	}
+
+	/**
+	 * Returns the Files collection
+	 */
+	public function files(): Files
+	{
+		if ($this->files instanceof Files) {
+			return $this->files;
+		}
+
+		return $this->files = Files::factory($this->inventory()['files'], $this);
+	}
+
+	/**
+	 * Checks if the Files collection has any audio files
+	 */
+	public function hasAudio(): bool
+	{
+		return $this->audio()->count() > 0;
+	}
+
+	/**
+	 * Checks if the Files collection has any code files
+	 */
+	public function hasCode(): bool
+	{
+		return $this->code()->count() > 0;
+	}
+
+	/**
+	 * Checks if the Files collection has any document files
+	 */
+	public function hasDocuments(): bool
+	{
+		return $this->documents()->count() > 0;
+	}
+
+	/**
+	 * Checks if the Files collection has any files
+	 */
+	public function hasFiles(): bool
+	{
+		return $this->files()->count() > 0;
+	}
+
+	/**
+	 * Checks if the Files collection has any images
+	 */
+	public function hasImages(): bool
+	{
+		return $this->images()->count() > 0;
+	}
+
+	/**
+	 * Checks if the Files collection has any videos
+	 */
+	public function hasVideos(): bool
+	{
+		return $this->videos()->count() > 0;
+	}
+
+	/**
+	 * Returns a specific image by filename or the first one
+	 */
+	public function image(string $filename = null): File|null
+	{
+		return $this->file($filename, 'images');
+	}
+
+	/**
+	 * Filters the Files collection by type image
+	 */
+	public function images(): Files
+	{
+		return $this->files()->filter('type', '==', 'image');
+	}
+
+	/**
+	 * Sets the Files collection
+	 *
+	 * @return $this
+	 */
+	protected function setFiles(array $files = null): static
+	{
+		if ($files !== null) {
+			$this->files = Files::factory($files, $this);
+		}
+
+		return $this;
+	}
+
+	/**
+	 * Filters the Files collection by type videos
+	 */
+	public function videos(): Files
+	{
+		return $this->files()->filter('type', '==', 'video');
+	}
+}

kirby/src/Cms/HasMethods.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Closure;
+use Kirby\Exception\BadMethodCallException;
+
+/**
+ * HasMethods
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+trait HasMethods
+{
+	/**
+	 * All registered methods
+	 */
+	public static array $methods = [];
+
+	/**
+	 * Calls a registered method class with the
+	 * passed arguments
+	 * @internal
+	 *
+	 * @throws \Kirby\Exception\BadMethodCallException
+	 */
+	public function callMethod(string $method, array $args = []): mixed
+	{
+		$closure = $this->getMethod($method);
+
+		if ($closure === null) {
+			throw new BadMethodCallException('The method ' . $method . ' does not exist');
+		}
+
+		return $closure->call($this, ...$args);
+	}
+
+	/**
+	 * Checks if the object has a registered method
+	 * @internal
+	 */
+	public function hasMethod(string $method): bool
+	{
+		return $this->getMethod($method) !== null;
+	}
+
+	/**
+	 * Returns a registered method by name, either from
+	 * the current class or from a parent class ordered by
+	 * inheritance order (top to bottom)
+	 */
+	protected function getMethod(string $method): Closure|null
+	{
+		if (isset(static::$methods[$method]) === true) {
+			return static::$methods[$method];
+		}
+
+		foreach (class_parents($this) as $parent) {
+			if (isset($parent::$methods[$method]) === true) {
+				return $parent::$methods[$method];
+			}
+		}
+
+		return null;
+	}
+}

kirby/src/Cms/HasSiblings.php

@@ -0,0 +1,153 @@
+<?php
+
+namespace Kirby\Cms;
+
+/**
+ * This trait is used by pages, files and users
+ * to handle navigation through parent collections
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+trait HasSiblings
+{
+	/**
+	 * Returns the position / index in the collection
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 */
+	public function indexOf($collection = null): int|false
+	{
+		$collection ??= $this->siblingsCollection();
+		return $collection->indexOf($this);
+	}
+
+	/**
+	 * Returns the next item in the collection if available
+	 * @todo `static` return type hint is not 100% accurate because of
+	 *       quirks in the `Form` classes; would break if enforced
+	 *       (https://github.com/getkirby/kirby/pull/5175)
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 *
+	 * @return static|null
+	 */
+	public function next($collection = null)
+	{
+		$collection ??= $this->siblingsCollection();
+		return $collection->nth($this->indexOf($collection) + 1);
+	}
+
+	/**
+	 * Returns the end of the collection starting after the current item
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 *
+	 * @return \Kirby\Cms\Collection
+	 */
+	public function nextAll($collection = null)
+	{
+		$collection ??= $this->siblingsCollection();
+		return $collection->slice($this->indexOf($collection) + 1);
+	}
+
+	/**
+	 * Returns the previous item in the collection if available
+	 * @todo `static` return type hint is not 100% accurate because of
+	 *       quirks in the `Form` classes; would break if enforced
+	 *       (https://github.com/getkirby/kirby/pull/5175)
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 *
+	 * @return static|null
+	 */
+	public function prev($collection = null)
+	{
+		$collection ??= $this->siblingsCollection();
+		return $collection->nth($this->indexOf($collection) - 1);
+	}
+
+	/**
+	 * Returns the beginning of the collection before the current item
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 *
+	 * @return \Kirby\Cms\Collection
+	 */
+	public function prevAll($collection = null)
+	{
+		$collection ??= $this->siblingsCollection();
+		return $collection->slice(0, $this->indexOf($collection));
+	}
+
+	/**
+	 * Returns all sibling elements
+	 *
+	 * @return \Kirby\Cms\Collection
+	 */
+	public function siblings(bool $self = true)
+	{
+		$siblings = $this->siblingsCollection();
+
+		if ($self === false) {
+			return $siblings->not($this);
+		}
+
+		return $siblings;
+	}
+
+	/**
+	 * Checks if there's a next item in the collection
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 */
+	public function hasNext($collection = null): bool
+	{
+		return $this->next($collection) !== null;
+	}
+
+	/**
+	 * Checks if there's a previous item in the collection
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 */
+	public function hasPrev($collection = null): bool
+	{
+		return $this->prev($collection) !== null;
+	}
+
+	/**
+	 * Checks if the item is the first in the collection
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 */
+	public function isFirst($collection = null): bool
+	{
+		$collection ??= $this->siblingsCollection();
+		return $collection->first()->is($this);
+	}
+
+	/**
+	 * Checks if the item is the last in the collection
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 */
+	public function isLast($collection = null): bool
+	{
+		$collection ??= $this->siblingsCollection();
+		return $collection->last()->is($this);
+	}
+
+	/**
+	 * Checks if the item is at a certain position
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 */
+	public function isNth(int $n, $collection = null): bool
+	{
+		return $this->indexOf($collection) === $n;
+	}
+}

kirby/src/Cms/Helpers.php

@@ -0,0 +1,194 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Closure;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Toolkit\Str;
+
+/**
+ * The `Helpers` class hosts a few handy helper methods
+ * @since 3.7.0
+ *
+ * @package   Kirby Cms
+ * @author    Nico Hoffmann <nico@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Helpers
+{
+	/**
+	 * Allows to disable specific deprecation warnings
+	 * by setting them to `false`.
+	 * You can do this by putting the following code in
+	 * `site/config/config.php`:
+	 *
+	 * ```php
+	 * Helpers::$deprecations['<deprecation-key>'] = false;
+	 * ```
+	 */
+	public static $deprecations = [
+		// The internal `$model->contentFile*()` methods have been deprecated
+		'model-content-file' => true,
+
+		// Passing an `info` array inside the `extends` array
+		// has been deprecated. Pass the individual entries (e.g. root, version)
+		// directly as named arguments.
+		// TODO: switch to true in v6
+		'plugin-extends-root' => false,
+
+		// Passing a single space as value to `Xml::attr()` has been
+		// deprecated. In a future version, passing a single space won't
+		// render an empty value anymore but a single space.
+		// To render an empty value, please pass an empty string.
+		'xml-attr-single-space' => true,
+	];
+
+	/**
+	 * Triggers a deprecation warning if debug mode is active
+	 * and warning has not been surpressed via `Helpers::$deprecations`
+	 *
+	 * @param string|null $key If given, the key will be checked against the static array
+	 * @return bool Whether the warning was triggered
+	 */
+	public static function deprecated(
+		string $message,
+		string|null $key = null
+	): bool {
+		// only trigger warning in debug mode or when running PHPUnit tests
+		// @codeCoverageIgnoreStart
+		if (
+			App::instance()->option('debug') !== true &&
+			(defined('KIRBY_TESTING') !== true || KIRBY_TESTING !== true)
+		) {
+			return false;
+		}
+		// @codeCoverageIgnoreEnd
+
+		// don't trigger the warning if disabled by default or by the dev
+		if ($key !== null && (static::$deprecations[$key] ?? true) === false) {
+			return false;
+		}
+
+		return trigger_error($message, E_USER_DEPRECATED) === true;
+	}
+
+	/**
+	 * Simple object and variable dumper
+	 * to help with debugging.
+	 */
+	public static function dump(mixed $variable, bool $echo = true): string
+	{
+		$kirby  = App::instance();
+		$output = print_r($variable, true);
+
+		if ($kirby->environment()->cli() === true) {
+			$output .= PHP_EOL;
+		} else {
+			$output = Str::wrap($output, '<pre>', '</pre>');
+		}
+
+		if ($echo === true) {
+			echo $output;
+		}
+
+		return $output;
+	}
+
+	/**
+	 * Performs an action with custom handling
+	 * for all PHP errors and warnings
+	 * @since 3.7.4
+	 *
+	 * @param \Closure $action Any action that may cause an error or warning
+	 * @param \Closure $condition Closure that returns bool to determine if to
+	 *                            suppress an error, receives arguments for
+	 *                            `set_error_handler()`
+	 * @param mixed $fallback Value to return when error is suppressed
+	 * @return mixed Return value of the `$action` closure,
+	 *               possibly overridden by `$fallback`
+	 */
+	public static function handleErrors(
+		Closure $action,
+		Closure $condition,
+		$fallback = null
+	) {
+		$override = null;
+
+		/**
+		 * @psalm-suppress UndefinedVariable
+		 */
+		$handler = set_error_handler(function () use (&$override, &$handler, $condition, $fallback) {
+			// check if suppress condition is met
+			$suppress = $condition(...func_get_args());
+
+			if ($suppress !== true) {
+				// handle other warnings with Whoops if loaded
+				if (is_callable($handler) === true) {
+					return $handler(...func_get_args());
+				}
+
+				// otherwise use the standard error handler
+				return false; // @codeCoverageIgnore
+			}
+
+			// use fallback to override return for suppressed errors
+			$override = $fallback;
+
+			if (is_callable($override) === true) {
+				$override = $override();
+			}
+
+			// no additional error handling
+			return true;
+		});
+
+		try {
+			$result = $action();
+		} finally {
+			// always restore the error handler, even if the
+			// action or the standard error handler threw an
+			// exception; this avoids modifying global state
+			restore_error_handler();
+		}
+
+		return $override ?? $result;
+	}
+
+	/**
+	 * Checks if a helper was overridden by the user
+	 * by setting the `KIRBY_HELPER_*` constant
+	 * @internal
+	 *
+	 * @param string $name Name of the helper
+	 */
+	public static function hasOverride(string $name): bool
+	{
+		$name = 'KIRBY_HELPER_' . strtoupper($name);
+		return defined($name) === true && constant($name) === false;
+	}
+
+	/**
+	 * Determines the size/length of numbers,
+	 * strings, arrays and countable objects
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException
+	 */
+	public static function size(mixed $value): int
+	{
+		if (is_numeric($value)) {
+			return (int)$value;
+		}
+
+		if (is_string($value)) {
+			return Str::length(trim($value));
+		}
+
+		if (is_countable($value)) {
+			return count($value);
+		}
+
+		throw new InvalidArgumentException('Could not determine the size of the given value');
+	}
+}

kirby/src/Cms/Html.php

@@ -0,0 +1,164 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Filesystem\F;
+use Kirby\Toolkit\A;
+
+/**
+ * The `Html` class provides methods for building
+ * common HTML tags and also contains some helper
+ * methods.
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Html extends \Kirby\Toolkit\Html
+{
+	/**
+	 * Creates one or multiple CSS link tags
+	 * @since 3.7.0
+	 *
+	 * @param string|array $url Relative or absolute URLs, an array of URLs or `@auto` for automatic template css loading
+	 * @param string|array|null $options Pass an array of attributes for the link tag or a media attribute string
+	 */
+	public static function css(
+		string|array|Plugin|PluginAssets $url,
+		string|array|null $options = null
+	): string|null {
+		if ($url instanceof Plugin) {
+			$url = $url->assets();
+		}
+
+		if ($url instanceof PluginAssets) {
+			$url = $url->css()->values(fn ($asset) => $asset->url());
+		}
+
+		if (is_array($url) === true) {
+			$links = A::map($url, fn ($url) => static::css($url, $options));
+			return implode(PHP_EOL, $links);
+		}
+
+		if (is_string($options) === true) {
+			$options = ['media' => $options];
+		}
+
+		$kirby = App::instance();
+
+		if ($url === '@auto') {
+			if (!$url = Url::toTemplateAsset('css/templates', 'css')) {
+				return null;
+			}
+		}
+
+		// only valid value for 'rel' is 'alternate stylesheet',
+		// if 'title' is given as well
+		if (
+			($options['rel'] ?? '') !== 'alternate stylesheet' ||
+			($options['title'] ?? '') === ''
+		) {
+			$options['rel'] = 'stylesheet';
+		}
+
+		$url  = ($kirby->component('css'))($kirby, $url, $options);
+		$url  = Url::to($url);
+		$attr = array_merge((array)$options, [
+			'href' => $url
+		]);
+
+		return '<link ' . static::attr($attr) . '>';
+	}
+
+	/**
+	 * Generates an `a` tag with an absolute Url
+	 *
+	 * @param string|null $href Relative or absolute Url
+	 * @param string|array|null $text If `null`, the link will be used as link text. If an array is passed, each element will be added unencoded
+	 * @param array $attr Additional attributes for the a tag.
+	 */
+	public static function link(
+		string|null $href = null,
+		string|array $text = null,
+		array $attr = []
+	): string {
+		return parent::link(Url::to($href), $text, $attr);
+	}
+
+	/**
+	 * Creates a script tag to load a javascript file
+	 * @since 3.7.0
+	 */
+	public static function js(
+		string|array|Plugin|PluginAssets $url,
+		string|array|bool|null $options = null
+	): string|null {
+		if ($url instanceof Plugin) {
+			$url = $url->assets();
+		}
+
+		if ($url instanceof PluginAssets) {
+			$url = $url->js()->values(fn ($asset) => $asset->url());
+		}
+
+		if (is_array($url) === true) {
+			$scripts = A::map($url, fn ($url) => static::js($url, $options));
+			return implode(PHP_EOL, $scripts);
+		}
+
+		if (is_bool($options) === true) {
+			$options = ['async' => $options];
+		}
+
+		$kirby = App::instance();
+
+		if ($url === '@auto') {
+			if (!$url = Url::toTemplateAsset('js/templates', 'js')) {
+				return null;
+			}
+		}
+
+		$url  = ($kirby->component('js'))($kirby, $url, $options);
+		$url  = Url::to($url);
+		$attr = array_merge((array)$options, ['src' => $url]);
+
+		return '<script ' . static::attr($attr) . '></script>';
+	}
+
+	/**
+	 * Includes an SVG file by absolute or
+	 * relative file path.
+	 * @since 3.7.0
+	 */
+	public static function svg(string|File $file): string|false
+	{
+		// support for Kirby's file objects
+		if (
+			$file instanceof File &&
+			$file->extension() === 'svg'
+		) {
+			return $file->read();
+		}
+
+		if (is_string($file) === false) {
+			return false;
+		}
+
+		$extension = F::extension($file);
+
+		// check for valid svg files
+		if ($extension !== 'svg') {
+			return false;
+		}
+
+		// try to convert relative paths to absolute
+		if (file_exists($file) === false) {
+			$root = App::instance()->root();
+			$file = realpath($root . '/' . $file);
+		}
+
+		return F::read($file);
+	}
+}

kirby/src/Cms/Ingredients.php

@@ -0,0 +1,82 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Closure;
+
+/**
+ * The Ingredients class is the foundation for
+ * `$kirby->urls()` and `$kirby->roots()` objects.
+ * Those are configured in `kirby/config/urls.php`
+ * and `kirby/config/roots.php`
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Ingredients
+{
+	/**
+	 * @var array
+	 */
+	protected $ingredients = [];
+
+	/**
+	 * Creates a new ingredient collection
+	 */
+	public function __construct(array $ingredients)
+	{
+		$this->ingredients = $ingredients;
+	}
+
+	/**
+	 * Magic getter for single ingredients
+	 */
+	public function __call(string $method, array $args = null): mixed
+	{
+		return $this->ingredients[$method] ?? null;
+	}
+
+	/**
+	 * Improved `var_dump` output
+	 * @codeCoverageIgnore
+	 */
+	public function __debugInfo(): array
+	{
+		return $this->ingredients;
+	}
+
+	/**
+	 * Get a single ingredient by key
+	 */
+	public function __get(string $key)
+	{
+		return $this->ingredients[$key] ?? null;
+	}
+
+	/**
+	 * Resolves all ingredient callbacks
+	 * and creates a plain array
+	 * @internal
+	 */
+	public static function bake(array $ingredients): static
+	{
+		foreach ($ingredients as $name => $ingredient) {
+			if ($ingredient instanceof Closure) {
+				$ingredients[$name] = $ingredient($ingredients);
+			}
+		}
+
+		return new static($ingredients);
+	}
+
+	/**
+	 * Returns all ingredients as plain array
+	 */
+	public function toArray(): array
+	{
+		return $this->ingredients;
+	}
+}

kirby/src/Cms/Item.php

@@ -0,0 +1,118 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Content\Field;
+use Kirby\Toolkit\Str;
+
+/**
+ * The Item class is the foundation
+ * for every object in context with
+ * other objects. I.e.
+ *
+ * - a Block in a collection of Blocks
+ * - a Layout in a collection of Layouts
+ * - a Column in a collection of Columns
+ * @since 3.5.0
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Item
+{
+	use HasSiblings;
+
+	public const ITEMS_CLASS = Items::class;
+
+	protected Field|null $field;
+
+	protected string $id;
+	protected array $params;
+	protected ModelWithContent $parent;
+	protected Items $siblings;
+
+	/**
+	 * Creates a new item
+	 */
+	public function __construct(array $params = [])
+	{
+		$class          = static::ITEMS_CLASS;
+		$this->id       = $params['id']       ?? Str::uuid();
+		$this->params   = $params;
+		$this->field    = $params['field']    ?? null;
+		$this->parent   = $params['parent']   ?? App::instance()->site();
+		$this->siblings = $params['siblings'] ?? new $class();
+	}
+
+	/**
+	 * Static Item factory
+	 */
+	public static function factory(array $params): static
+	{
+		return new static($params);
+	}
+
+	/**
+	 * Returns the parent field if known
+	 */
+	public function field(): Field|null
+	{
+		return $this->field;
+	}
+
+	/**
+	 * Returns the unique item id (UUID v4)
+	 */
+	public function id(): string
+	{
+		return $this->id;
+	}
+
+	/**
+	 * Compares the item to another one
+	 */
+	public function is(Item $item): bool
+	{
+		return $this->id() === $item->id();
+	}
+
+	/**
+	 * Returns the Kirby instance
+	 */
+	public function kirby(): App
+	{
+		return $this->parent()->kirby();
+	}
+
+	/**
+	 * Returns the parent model
+	 */
+	public function parent(): ModelWithContent
+	{
+		return $this->parent;
+	}
+
+	/**
+	 * Returns the sibling collection
+	 * This is required by the HasSiblings trait
+	 *
+	 * @psalm-return self::ITEMS_CLASS
+	 */
+	protected function siblingsCollection(): Items
+	{
+		return $this->siblings;
+	}
+
+	/**
+	 * Converts the item to an array
+	 */
+	public function toArray(): array
+	{
+		return [
+			'id' => $this->id(),
+		];
+	}
+}

kirby/src/Cms/Items.php

@@ -0,0 +1,100 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Closure;
+use Kirby\Content\Field;
+use Kirby\Exception\InvalidArgumentException;
+
+/**
+ * A collection of items
+ * @since 3.5.0
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Items extends Collection
+{
+	public const ITEM_CLASS = Item::class;
+
+	protected Field|null $field;
+
+	/**
+	 * All registered items methods
+	 */
+	public static array $methods = [];
+
+	protected array $options;
+
+	/**
+	 * @var \Kirby\Cms\ModelWithContent
+	 */
+	protected $parent;
+
+	public function __construct($objects = [], array $options = [])
+	{
+		$this->options = $options;
+		$this->parent  = $options['parent'] ?? App::instance()->site();
+		$this->field   = $options['field']  ?? null;
+
+		parent::__construct($objects, $this->parent);
+	}
+
+	/**
+	 * Creates a new item collection from a
+	 * an array of item props
+	 */
+	public static function factory(
+		array $items = null,
+		array $params = []
+	): static {
+		if (empty($items) === true || is_array($items) === false) {
+			return new static();
+		}
+
+		if (is_array($params) === false) {
+			throw new InvalidArgumentException('Invalid item options');
+		}
+
+		// create a new collection of blocks
+		$collection = new static([], $params);
+
+		foreach ($items as $item) {
+			if (is_array($item) === false) {
+				throw new InvalidArgumentException('Invalid data for ' . static::ITEM_CLASS);
+			}
+
+			// inject properties from the parent
+			$item['field']    = $collection->field();
+			$item['options']  = $params['options'] ?? [];
+			$item['parent']   = $collection->parent();
+			$item['siblings'] = $collection;
+			$item['params']   = $item;
+
+			$class = static::ITEM_CLASS;
+			$item  = $class::factory($item);
+			$collection->append($item->id(), $item);
+		}
+
+		return $collection;
+	}
+
+	/**
+	 * Returns the parent field if known
+	 */
+	public function field(): Field|null
+	{
+		return $this->field;
+	}
+
+	/**
+	 * Convert the items to an array
+	 */
+	public function toArray(Closure $map = null): array
+	{
+		return array_values(parent::toArray($map));
+	}
+}

kirby/src/Cms/Language.php

@@ -0,0 +1,599 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Data\Data;
+use Kirby\Exception\Exception;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Exception\LogicException;
+use Kirby\Exception\PermissionException;
+use Kirby\Filesystem\F;
+use Kirby\Toolkit\Locale;
+use Kirby\Toolkit\Str;
+use Throwable;
+
+/**
+ * The `$language` object represents
+ * a single language in a multi-language
+ * Kirby setup. You can, for example,
+ * use the methods of this class to get
+ * the name or locale of a language,
+ * check for the default language,
+ * get translation strings and many
+ * more things.
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Language
+{
+	use HasSiblings;
+
+	/**
+	 * The parent Kirby instance
+	 */
+	public static App|null $kirby;
+
+	protected string $code;
+	protected bool $default;
+	protected string $direction;
+	protected array $locale;
+	protected string $name;
+	protected array $slugs;
+	protected array $smartypants;
+	protected array $translations;
+	protected string|null $url;
+
+	/**
+	 * Creates a new language object
+	 */
+	public function __construct(array $props)
+	{
+		if (isset($props['code']) === false) {
+			throw new InvalidArgumentException('The property "code" is required');
+		}
+
+		static::$kirby      = $props['kirby'] ?? null;
+		$this->code         = trim($props['code']);
+		$this->default      = ($props['default'] ?? false) === true;
+		$this->direction    = ($props['direction'] ?? null) === 'rtl' ? 'rtl' : 'ltr';
+		$this->name         = trim($props['name'] ?? $this->code);
+		$this->slugs        = $props['slugs'] ?? [];
+		$this->smartypants  = $props['smartypants'] ?? [];
+		$this->translations = $props['translations'] ?? [];
+		$this->url          = $props['url'] ?? null;
+
+		if ($locale = $props['locale'] ?? null) {
+			$this->locale = Locale::normalize($locale);
+		} else {
+			$this->locale = [LC_ALL => $this->code];
+		}
+	}
+
+	/**
+	 * Improved `var_dump` output
+	 * @codeCoverageIgnore
+	 */
+	public function __debugInfo(): array
+	{
+		return $this->toArray();
+	}
+
+	/**
+	 * Returns the language code
+	 * when the language is converted to a string
+	 */
+	public function __toString(): string
+	{
+		return $this->code();
+	}
+
+	/**
+	 * Returns the base Url for the language
+	 * without the path or other cruft
+	 */
+	public function baseUrl(): string
+	{
+		$kirbyUrl    = $this->kirby()->url();
+		$languageUrl = $this->url();
+
+		if (empty($this->url)) {
+			return $kirbyUrl;
+		}
+
+		if (Str::startsWith($languageUrl, $kirbyUrl) === true) {
+			return $kirbyUrl;
+		}
+
+		return Url::base($languageUrl) ?? $kirbyUrl;
+	}
+
+	/**
+	 * Creates an instance with the same
+	 * initial properties.
+	 */
+	public function clone(array $props = []): static
+	{
+		return new static(array_replace_recursive([
+			'code'         => $this->code,
+			'default'      => $this->default,
+			'direction'    => $this->direction,
+			'locale'       => $this->locale,
+			'name'         => $this->name,
+			'slugs'        => $this->slugs,
+			'smartypants'  => $this->smartypants,
+			'translations' => $this->translations,
+			'url'          => $this->url,
+		], $props));
+	}
+
+	/**
+	 * Returns the language code/id.
+	 * The language code is used in
+	 * text file names as appendix.
+	 */
+	public function code(): string
+	{
+		return $this->code;
+	}
+
+	/**
+	 * Creates a new language object
+	 * @internal
+	 */
+	public static function create(array $props): static
+	{
+		$kirby = App::instance();
+		$user  = $kirby->user();
+
+		if (
+			$user === null ||
+			$user->role()->permissions()->for('languages', 'create') === false
+		) {
+			throw new PermissionException(['key' => 'language.create.permission']);
+		}
+
+		$props['code'] = Str::slug($props['code'] ?? null);
+		$languages     = $kirby->languages();
+
+		// make the first language the default language
+		if ($languages->count() === 0) {
+			$props['default'] = true;
+		}
+
+		$language = new static($props);
+
+		// trigger before hook
+		$kirby->trigger(
+			'language.create:before',
+			[
+				'input'    => $props,
+				'language' => $language
+			]
+		);
+
+		// validate the new language
+		LanguageRules::create($language);
+
+		$language->save();
+
+		if ($languages->count() === 0) {
+			foreach ($kirby->models() as $model) {
+				$model->storage()->convertLanguage(
+					'default',
+					$language->code()
+				);
+			}
+		}
+
+		// update the main languages collection in the app instance
+		$kirby->languages(false)->append($language->code(), $language);
+
+		// trigger after hook
+		$kirby->trigger(
+			'language.create:after',
+			[
+				'input'    => $props,
+				'language' => $language
+			]
+		);
+
+		return $language;
+	}
+
+	/**
+	 * Delete the current language and
+	 * all its translation files
+	 * @internal
+	 *
+	 * @throws \Kirby\Exception\Exception
+	 */
+	public function delete(): bool
+	{
+		$kirby = App::instance();
+		$user  = $kirby->user();
+		$code  = $this->code();
+
+		if (
+			$user === null ||
+			$user->role()->permissions()->for('languages', 'delete') === false
+		) {
+			throw new PermissionException(['key' => 'language.delete.permission']);
+		}
+
+		if ($this->isDeletable() === false) {
+			throw new Exception('The language cannot be deleted');
+		}
+
+		// trigger before hook
+		$kirby->trigger('language.delete:before', [
+			'language' => $this
+		]);
+
+		if (F::remove($this->root()) !== true) {
+			throw new Exception('The language could not be deleted');
+		}
+
+		foreach ($kirby->models() as $model) {
+			if ($this->isLast() === true) {
+				$model->storage()->convertLanguage($code, 'default');
+			} else {
+				$model->storage()->deleteLanguage($code);
+			}
+		}
+
+		// get the original language collection and remove the current language
+		$kirby->languages(false)->remove($code);
+
+		// trigger after hook
+		$kirby->trigger('language.delete:after', [
+			'language' => $this
+		]);
+
+		return true;
+	}
+
+	/**
+	 * Reading direction of this language
+	 */
+	public function direction(): string
+	{
+		return $this->direction;
+	}
+
+	/**
+	 * Check if the language file exists
+	 */
+	public function exists(): bool
+	{
+		return file_exists($this->root());
+	}
+
+	/**
+	 * Checks if this is the default language
+	 * for the site.
+	 */
+	public function isDefault(): bool
+	{
+		return $this->default;
+	}
+
+	/**
+	 * Checks if the language can be deleted
+	 */
+	public function isDeletable(): bool
+	{
+		// the default language can only be deleted if it's the last
+		if ($this->isDefault() === true && $this->isLast() === false) {
+			return false;
+		}
+
+		return true;
+	}
+
+	/**
+	 * Checks if this is the last language
+	 */
+	public function isLast(): bool
+	{
+		return App::instance()->languages()->count() === 1;
+	}
+
+	/**
+	 * The id is required for collections
+	 * to work properly. The code is used as id
+	 */
+	public function id(): string
+	{
+		return $this->code;
+	}
+
+	/**
+	 * Returns the parent Kirby instance
+	 */
+	public function kirby(): App
+	{
+		return static::$kirby ??= App::instance();
+	}
+
+	/**
+	 * Loads the language rules for provided locale code
+	 */
+	public static function loadRules(string $code): array
+	{
+		$kirby = App::instance();
+		$code  = Str::contains($code, '.') ? Str::before($code, '.') : $code;
+		$file  = $kirby->root('i18n:rules') . '/' . $code . '.json';
+
+		if (F::exists($file) === false) {
+			$file = $kirby->root('i18n:rules') . '/' . Str::before($code, '_') . '.json';
+		}
+
+		try {
+			return Data::read($file);
+		} catch (\Exception) {
+			return [];
+		}
+	}
+
+	/**
+	 * Returns the PHP locale setting array
+	 *
+	 * @param int $category If passed, returns the locale for the specified category (e.g. LC_ALL) as string
+	 */
+	public function locale(int $category = null): array|string|null
+	{
+		if ($category !== null) {
+			return $this->locale[$category] ?? $this->locale[LC_ALL] ?? null;
+		}
+
+		return $this->locale;
+	}
+
+	/**
+	 * Returns the human-readable name
+	 * of the language
+	 */
+	public function name(): string
+	{
+		return $this->name;
+	}
+
+	/**
+	 * Returns the URL path for the language
+	 */
+	public function path(): string
+	{
+		if ($this->url === null) {
+			return $this->code;
+		}
+
+		return Url::path($this->url);
+	}
+
+	/**
+	 * Returns the routing pattern for the language
+	 */
+	public function pattern(): string
+	{
+		$path = $this->path();
+
+		if (empty($path) === true) {
+			return '(:all)';
+		}
+
+		return $path . '/(:all?)';
+	}
+
+	/**
+	 * Returns the absolute path to the language file
+	 */
+	public function root(): string
+	{
+		return App::instance()->root('languages') . '/' . $this->code() . '.php';
+	}
+
+	/**
+	 * Returns the LanguageRouter instance
+	 * which is used to handle language specific
+	 * routes.
+	 */
+	public function router(): LanguageRouter
+	{
+		return new LanguageRouter($this);
+	}
+
+	/**
+	 * Get slug rules for language
+	 * @internal
+	 */
+	public function rules(): array
+	{
+		$code = $this->locale(LC_CTYPE);
+		$data = static::loadRules($code);
+		return array_merge($data, $this->slugs());
+	}
+
+	/**
+	 * Saves the language settings in the languages folder
+	 * @internal
+	 *
+	 * @return $this
+	 */
+	public function save(): static
+	{
+		try {
+			$existingData = Data::read($this->root());
+		} catch (Throwable) {
+			$existingData = [];
+		}
+
+		$props = [
+			'code'         => $this->code(),
+			'default'      => $this->isDefault(),
+			'direction'    => $this->direction(),
+			'locale'       => Locale::export($this->locale()),
+			'name'         => $this->name(),
+			'translations' => $this->translations(),
+			'url'          => $this->url,
+		];
+
+		$data = array_merge($existingData, $props);
+
+		ksort($data);
+
+		Data::write($this->root(), $data);
+
+		return $this;
+	}
+
+	/**
+	 * Private siblings collector
+	 */
+	protected function siblingsCollection(): Collection
+	{
+		return App::instance()->languages();
+	}
+
+	/**
+	 * Returns the custom slug rules for this language
+	 */
+	public function slugs(): array
+	{
+		return $this->slugs;
+	}
+
+	/**
+	 * Returns the custom SmartyPants options for this language
+	 */
+	public function smartypants(): array
+	{
+		return $this->smartypants;
+	}
+
+	/**
+	 * Returns the most important
+	 * properties as array
+	 */
+	public function toArray(): array
+	{
+		return [
+			'code'      => $this->code(),
+			'default'   => $this->isDefault(),
+			'direction' => $this->direction(),
+			'locale'    => $this->locale(),
+			'name'      => $this->name(),
+			'rules'     => $this->rules(),
+			'url'       => $this->url()
+		];
+	}
+
+	/**
+	 * Returns the translation strings for this language
+	 */
+	public function translations(): array
+	{
+		return $this->translations;
+	}
+
+	/**
+	 * Returns the absolute Url for the language
+	 */
+	public function url(): string
+	{
+		$url   = $this->url;
+		$url ??= '/' . $this->code;
+		return Url::makeAbsolute($url, $this->kirby()->url());
+	}
+
+	/**
+	 * Update language properties and save them
+	 * @internal
+	 */
+	public function update(array $props = null): static
+	{
+		$kirby = App::instance();
+		$user  = $kirby->user();
+
+		if (
+			$user === null ||
+			$user->role()->permissions()->for('languages', 'update') === false
+		) {
+			throw new PermissionException(['key' => 'language.update.permission']);
+		}
+
+		// don't change the language code
+		unset($props['code']);
+
+		// make sure the slug is nice and clean
+		$props['slug'] = Str::slug($props['slug'] ?? null);
+
+		$updated = $this->clone($props);
+
+		if (isset($props['translations']) === true) {
+			$updated->translations = $props['translations'];
+		}
+
+		// validate the updated language
+		LanguageRules::update($updated);
+
+		// trigger before hook
+		$kirby->trigger('language.update:before', [
+			'language' => $this,
+			'input' => $props
+		]);
+
+		// if language just got promoted to be the new default language…
+		if ($this->isDefault() === false && $updated->isDefault() === true) {
+			// convert the current default to a non-default language
+			$previous = $kirby->defaultLanguage()?->clone(['default' => false])->save();
+			$kirby->languages(false)->set($previous->code(), $previous);
+
+			foreach ($kirby->models() as $model) {
+				$model->storage()->touchLanguage($this);
+			}
+		}
+
+		// if language was the default language and got demoted…
+		if (
+			$this->isDefault() === true &&
+			$updated->isDefault() === false &&
+			$kirby->defaultLanguage()->code() === $this->code()
+		) {
+			// ensure another language has already been set as default
+			throw new LogicException('Please select another language to be the primary language');
+		}
+
+		$language = $updated->save();
+
+		// make sure the language is also updated in the languages collection
+		$kirby->languages(false)->set($language->code(), $language);
+
+		// trigger after hook
+		$kirby->trigger('language.update:after', [
+			'newLanguage' => $language,
+			'oldLanguage' => $this,
+			'input' => $props
+		]);
+
+		return $language;
+	}
+
+	/**
+	 * Returns a language variable object
+	 * for the key in the translations array
+	 */
+	public function variable(string $key, bool $decode = false): LanguageVariable
+	{
+		// allows decoding if base64-url encoded url is sent
+		// for compatibility of different environments
+		if ($decode === true) {
+			$key = rawurldecode(base64_decode($key));
+		}
+
+		return new LanguageVariable($this, $key);
+	}
+}

kirby/src/Cms/LanguageRouter.php

@@ -0,0 +1,125 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Exception;
+use Kirby\Exception\NotFoundException;
+use Kirby\Http\Router;
+use Kirby\Toolkit\A;
+use Kirby\Toolkit\Str;
+
+/**
+ * The language router is used internally
+ * to handle language-specific (scoped) routes
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class LanguageRouter
+{
+	protected Router $router;
+
+	/**
+	 * Creates a new language router instance
+	 * for the given language
+	 */
+	public function __construct(
+		protected Language $language
+	) {
+	}
+
+	/**
+	 * Fetches all scoped routes for the
+	 * current language from the Kirby instance
+	 *
+	 * @throws \Kirby\Exception\NotFoundException
+	 */
+	public function routes(): array
+	{
+		$language = $this->language;
+		$kirby    = $language->kirby();
+		$routes   = $kirby->routes();
+
+		// only keep the scoped language routes
+		$routes = array_values(array_filter($routes, function ($route) use ($language) {
+			// no language scope
+			if (empty($route['language']) === true) {
+				return false;
+			}
+
+			// wildcard
+			if ($route['language'] === '*') {
+				return true;
+			}
+
+			// get all applicable languages
+			$languages = Str::split(strtolower($route['language']), '|');
+
+			// validate the language
+			return in_array($language->code(), $languages) === true;
+		}));
+
+		// add the page-scope if necessary
+		foreach ($routes as $index => $route) {
+			if ($pageId = ($route['page'] ?? null)) {
+				if ($page = $kirby->page($pageId)) {
+					// convert string patterns to arrays
+					$patterns = A::wrap($route['pattern']);
+
+					// prefix all patterns with the page slug
+					$patterns = A::map(
+						$patterns,
+						fn ($pattern) => $page->uri($language) . '/' . $pattern
+					);
+
+					// re-inject the pattern and the full page object
+					$routes[$index]['pattern'] = $patterns;
+					$routes[$index]['page']    = $page;
+				} else {
+					throw new NotFoundException('The page "' . $pageId . '" does not exist');
+				}
+			}
+		}
+
+		return $routes;
+	}
+
+	/**
+	 * Wrapper around the Router::call method
+	 * that injects the Language instance and
+	 * if needed also the Page as arguments.
+	 */
+	public function call(string|null $path = null): mixed
+	{
+		$language       = $this->language;
+		$kirby          = $language->kirby();
+		$this->router ??= new Router($this->routes());
+
+		try {
+			return $this->router->call($path, $kirby->request()->method(), function ($route) use ($kirby, $language) {
+				$kirby->setCurrentTranslation($language);
+				$kirby->setCurrentLanguage($language);
+
+				if ($page = $route->page()) {
+					return $route->action()->call(
+						$route,
+						$language,
+						$page,
+						...$route->arguments()
+					);
+				}
+
+				return $route->action()->call(
+					$route,
+					$language,
+					...$route->arguments()
+				);
+			});
+		} catch (Exception) {
+			return $kirby->resolve($path, $language->code());
+		}
+	}
+}

kirby/src/Cms/LanguageRoutes.php

@@ -0,0 +1,156 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Filesystem\F;
+
+class LanguageRoutes
+{
+	/**
+	 * Creates all multi-language routes
+	 */
+	public static function create(App $kirby): array
+	{
+		$routes = [];
+
+		// add the route for the home page
+		$routes[] = static::home($kirby);
+
+		// Kirby's base url
+		$baseurl = $kirby->url();
+
+		foreach ($kirby->languages() as $language) {
+			// ignore languages with a different base url
+			if ($language->baseurl() !== $baseurl) {
+				continue;
+			}
+
+			$routes[] = [
+				'pattern' => $language->pattern(),
+				'method'  => 'ALL',
+				'env'     => 'site',
+				'action'  => function ($path = null) use ($language) {
+					$result = $language->router()->call($path);
+
+					// explicitly test for null as $result can
+					// contain falsy values that should still be returned
+					if ($result !== null) {
+						return $result;
+					}
+
+					// jump through to the fallback if nothing
+					// can be found for this language
+					/** @var \Kirby\Http\Route $this */
+					$this->next();
+				}
+			];
+		}
+
+		$routes[] = static::fallback($kirby);
+
+		return $routes;
+	}
+
+
+	/**
+	 * Create the fallback route
+	 * for unprefixed default language URLs.
+	 */
+	public static function fallback(App $kirby): array
+	{
+		return [
+			'pattern' => '(:all)',
+			'method'  => 'ALL',
+			'env'     => 'site',
+			'action'  => function (string $path) use ($kirby) {
+				// check for content representations or files
+				$extension = F::extension($path);
+
+				// try to redirect prefixed pages
+				if (
+					empty($extension) === true &&
+					$page = $kirby->page($path)
+				) {
+					$url = $kirby->request()->url([
+						'query'    => null,
+						'params'   => null,
+						'fragment' => null
+					]);
+
+					if ($url->toString() !== $page->url()) {
+						// redirect to translated page directly if translation
+						// is exists and languages detect is enabled
+						$lang = $kirby->detectedLanguage()->code();
+
+						if (
+							$kirby->option('languages.detect') === true &&
+							$page->translation($lang)->exists() === true
+						) {
+							return $kirby
+								->response()
+								->redirect($page->url($lang));
+						}
+
+						return $kirby
+							->response()
+							->redirect($page->url());
+					}
+				}
+
+				return $kirby->language()->router()->call($path);
+			}
+		];
+	}
+
+	/**
+	 * Create the multi-language home page route
+	 */
+	public static function home(App $kirby): array
+	{
+		// Multi-language home
+		return [
+			'pattern' => '',
+			'method'  => 'ALL',
+			'env'     => 'site',
+			'action'  => function () use ($kirby) {
+				// find all languages with the same base url as the current installation
+				$languages = $kirby->languages()->filter(
+					'baseurl',
+					$kirby->url()
+				);
+
+				// if there's no language with a matching base url,
+				// redirect to the default language
+				if ($languages->count() === 0) {
+					return $kirby
+						->response()
+						->redirect($kirby->defaultLanguage()->url());
+				}
+
+				// if there's just one language,
+				// we take that to render the home page
+				if ($languages->count() === 1) {
+					$currentLanguage = $languages->first();
+				} else {
+					$currentLanguage = $kirby->defaultLanguage();
+				}
+
+				// language detection on the home page with / as URL
+				if ($kirby->url() !== $currentLanguage->url()) {
+					if ($kirby->option('languages.detect') === true) {
+						return $kirby
+							->response()
+							->redirect($kirby->detectedLanguage()->url());
+					}
+
+					return $kirby
+						->response()
+						->redirect($currentLanguage->url());
+				}
+
+				// render the home page of the current language
+				return $currentLanguage->router()->call();
+			}
+		];
+	}
+}

kirby/src/Cms/LanguageRules.php

@@ -0,0 +1,90 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Exception\DuplicateException;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Toolkit\Str;
+
+/**
+ * Validators for all language actions
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class LanguageRules
+{
+	/**
+	 * Validates if the language can be created
+	 *
+	 * @throws \Kirby\Exception\DuplicateException If the language already exists
+	 */
+	public static function create(Language $language): bool
+	{
+		static::validLanguageCode($language);
+		static::validLanguageName($language);
+
+		if ($language->exists() === true) {
+			throw new DuplicateException([
+				'key'  => 'language.duplicate',
+				'data' => [
+					'code' => $language->code()
+				]
+			]);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Validates if the language can be updated
+	 */
+	public static function update(Language $language): void
+	{
+		static::validLanguageCode($language);
+		static::validLanguageName($language);
+	}
+
+	/**
+	 * Validates if the language code is formatted correctly
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the language code is not valid
+	 */
+	public static function validLanguageCode(Language $language): bool
+	{
+		if (Str::length($language->code()) < 2) {
+			throw new InvalidArgumentException([
+				'key'  => 'language.code',
+				'data' => [
+					'code' => $language->code(),
+					'name' => $language->name()
+				]
+			]);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Validates if the language name is formatted correctly
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the language name is invalid
+	 */
+	public static function validLanguageName(Language $language): bool
+	{
+		if (Str::length($language->name()) < 1) {
+			throw new InvalidArgumentException([
+				'key'  => 'language.name',
+				'data' => [
+					'code' => $language->code(),
+					'name' => $language->name()
+				]
+			]);
+		}
+
+		return true;
+	}
+}

kirby/src/Cms/LanguageVariable.php

@@ -0,0 +1,122 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Exception\DuplicateException;
+use Kirby\Exception\InvalidArgumentException;
+
+/**
+ * A language variable is a custom translation string
+ * Those are stored in /site/languages/$code.php in the
+ * translations array
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class LanguageVariable
+{
+	protected App $kirby;
+
+	public function __construct(
+		protected Language $language,
+		protected string $key
+	) {
+		$this->kirby = App::instance();
+	}
+
+	/**
+	 * Creates a new language variable. This will
+	 * be added to the default language first and
+	 * can then be translated in other languages.
+	 */
+	public static function create(
+		string $key,
+		string|null $value = null
+	): static {
+		if (is_numeric($key) === true) {
+			throw new InvalidArgumentException('The variable key must not be numeric');
+		}
+
+		if (empty($key) === true) {
+			throw new InvalidArgumentException('The variable needs a valid key');
+		}
+
+		$kirby        = App::instance();
+		$language     = $kirby->defaultLanguage();
+		$translations = $language->translations();
+
+		if ($kirby->translation()->get($key) !== null) {
+			if (isset($translations[$key]) === true) {
+				throw new DuplicateException('The variable already exists');
+			}
+
+			throw new DuplicateException('The variable is part of the core translation and cannot be overwritten');
+		}
+
+		$translations[$key] = trim($value ?? '');
+
+		$language->update(['translations' => $translations]);
+
+		return $language->variable($key);
+	}
+
+	/**
+	 * Deletes a language variable from the translations array.
+	 * This will go through all language files and delete the
+	 * key from all translation arrays to keep them clean.
+	 */
+	public function delete(): bool
+	{
+		// go through all languages and remove the variable
+		foreach ($this->kirby->languages() as $language) {
+			$variables = $language->translations();
+
+			unset($variables[$this->key]);
+
+			$language->update(['translations' => $variables]);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Checks if a language variable exists in the default language
+	 */
+	public function exists(): bool
+	{
+		$language = $this->kirby->defaultLanguage();
+		return isset($language->translations()[$this->key]) === true;
+	}
+
+	/**
+	 * Returns the unique key for the variable
+	 */
+	public function key(): string
+	{
+		return $this->key;
+	}
+
+	/**
+	 * Sets a new value for the language variable
+	 */
+	public function update(string $value): static
+	{
+		$translations = $this->language->translations();
+		$translations[$this->key] = $value;
+
+		$language = $this->language->update(['translations' => $translations]);
+
+		return $language->variable($this->key);
+	}
+
+	/**
+	 * Returns the value if the variable has been translated.
+	 */
+	public function value(): string|null
+	{
+		return $this->language->translations()[$this->key] ?? null;
+	}
+}

kirby/src/Cms/Languages.php

@@ -0,0 +1,94 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Exception\DuplicateException;
+use Kirby\Filesystem\F;
+
+/**
+ * A collection of all defined site languages
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Languages extends Collection
+{
+	/**
+	 * All registered languages methods
+	 */
+	public static array $methods = [];
+
+	/**
+	 * Creates a new collection with the given language objects
+	 *
+	 * @param null $parent
+	 * @throws \Kirby\Exception\DuplicateException
+	 */
+	public function __construct(
+		array $objects = [],
+		$parent = null
+	) {
+		$defaults = array_filter(
+			$objects,
+			fn ($language) => $language->isDefault() === true
+		);
+
+		if (count($defaults) > 1) {
+			throw new DuplicateException('You cannot have multiple default languages. Please check your language config files.');
+		}
+
+		parent::__construct($objects, null);
+	}
+
+	/**
+	 * Returns all language codes as array
+	 */
+	public function codes(): array
+	{
+		return App::instance()->multilang() ? $this->keys() : ['default'];
+	}
+
+	/**
+	 * Creates a new language with the given props
+	 * @internal
+	 */
+	public function create(array $props): Language
+	{
+		return Language::create($props);
+	}
+
+	/**
+	 * Returns the default language
+	 */
+	public function default(): Language|null
+	{
+		return $this->findBy('isDefault', true) ?? $this->first();
+	}
+
+	/**
+	 * Convert all defined languages to a collection
+	 * @internal
+	 */
+	public static function load(): static
+	{
+		$languages = [];
+		$files     = glob(App::instance()->root('languages') . '/*.php');
+
+		foreach ($files as $file) {
+			$props = F::load($file, allowOutput: false);
+
+			if (is_array($props) === true) {
+				// inject the language code from the filename
+				// if it does not exist
+				$props['code'] ??= F::name($file);
+
+				$languages[] = new Language($props);
+			}
+		}
+
+		return new static($languages);
+	}
+}

kirby/src/Cms/Layout.php

@@ -0,0 +1,105 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Content\Content;
+
+/**
+ * Represents a single Layout with
+ * multiple columns
+ * @since 3.5.0
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Layout extends Item
+{
+	use HasMethods;
+
+	public const ITEMS_CLASS = Layouts::class;
+
+	protected Content $attrs;
+	protected LayoutColumns $columns;
+
+	/**
+	 * Proxy for attrs
+	 */
+	public function __call(string $method, array $args = []): mixed
+	{
+		// layout methods
+		if ($this->hasMethod($method) === true) {
+			return $this->callMethod($method, $args);
+		}
+
+		return $this->attrs()->get($method);
+	}
+
+	/**
+	 * Creates a new Layout object
+	 */
+	public function __construct(array $params = [])
+	{
+		parent::__construct($params);
+
+		$this->columns = LayoutColumns::factory($params['columns'] ?? [], [
+			'field'  => $this->field,
+			'parent' => $this->parent
+		]);
+
+		// create the attrs object
+		$this->attrs = new Content($params['attrs'] ?? [], $this->parent);
+	}
+
+	/**
+	 * Returns the attrs object
+	 */
+	public function attrs(): Content
+	{
+		return $this->attrs;
+	}
+
+	/**
+	 * Returns the columns in this layout
+	 */
+	public function columns(): LayoutColumns
+	{
+		return $this->columns;
+	}
+
+	/**
+	 * Checks if the layout is empty
+	 * @since 3.5.2
+	 */
+	public function isEmpty(): bool
+	{
+		return $this
+			->columns()
+			->filter('isEmpty', false)
+			->count() === 0;
+	}
+
+	/**
+	 * Checks if the layout is not empty
+	 * @since 3.5.2
+	 */
+	public function isNotEmpty(): bool
+	{
+		return $this->isEmpty() === false;
+	}
+
+	/**
+	 * The result is being sent to the editor
+	 * via the API in the panel
+	 */
+	public function toArray(): array
+	{
+		return [
+			'attrs'   => $this->attrs()->toArray(),
+			'columns' => $this->columns()->toArray(),
+			'id'      => $this->id(),
+		];
+	}
+}

kirby/src/Cms/LayoutColumn.php

@@ -0,0 +1,120 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Toolkit\Str;
+
+/**
+ * Represents a single layout column with
+ * multiple blocks
+ * @since 3.5.0
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class LayoutColumn extends Item
+{
+	use HasMethods;
+
+	public const ITEMS_CLASS = LayoutColumns::class;
+
+	protected Blocks $blocks;
+	protected string $width;
+
+	/**
+	 * Creates a new LayoutColumn object
+	 */
+	public function __construct(array $params = [])
+	{
+		parent::__construct($params);
+
+		$this->blocks = Blocks::factory($params['blocks'] ?? [], [
+			'field'  => $this->field,
+			'parent' => $this->parent
+		]);
+
+		$this->width = $params['width'] ?? '1/1';
+	}
+
+	/**
+	 * Magic getter function
+	 */
+	public function __call(string $method, mixed $args): mixed
+	{
+		// layout column methods
+		if ($this->hasMethod($method) === true) {
+			return $this->callMethod($method, $args);
+		}
+	}
+
+	/**
+	 * Returns the blocks collection
+	 *
+	 * @param bool $includeHidden Sets whether to include hidden blocks
+	 */
+	public function blocks(bool $includeHidden = false): Blocks
+	{
+		if ($includeHidden === false) {
+			return $this->blocks->filter('isHidden', false);
+		}
+
+		return $this->blocks;
+	}
+
+	/**
+	 * Checks if the column is empty
+	 * @since 3.5.2
+	 */
+	public function isEmpty(): bool
+	{
+		return $this
+			->blocks()
+			->filter('isHidden', false)
+			->count() === 0;
+	}
+
+	/**
+	 * Checks if the column is not empty
+	 * @since 3.5.2
+	 */
+	public function isNotEmpty(): bool
+	{
+		return $this->isEmpty() === false;
+	}
+
+	/**
+	 * Returns the number of columns this column spans
+	 */
+	public function span(int $columns = 12): int
+	{
+		$fraction = Str::split($this->width, '/');
+		$a = $fraction[0] ?? 1;
+		$b = $fraction[1] ?? 1;
+
+		return $columns * $a / $b;
+	}
+
+	/**
+	 * The result is being sent to the editor
+	 * via the API in the panel
+	 */
+	public function toArray(): array
+	{
+		return [
+			'blocks' => $this->blocks(true)->toArray(),
+			'id'     => $this->id(),
+			'width'  => $this->width(),
+		];
+	}
+
+	/**
+	 * Returns the width of the column
+	 */
+	public function width(): string
+	{
+		return $this->width;
+	}
+}

kirby/src/Cms/LayoutColumns.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace Kirby\Cms;
+
+/**
+ * A collection of layout columns
+ * @since 3.5.0
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class LayoutColumns extends Items
+{
+	public const ITEM_CLASS = LayoutColumn::class;
+
+	/**
+	 * All registered layout columns methods
+	 */
+	public static array $methods = [];
+}

kirby/src/Cms/Layouts.php

@@ -0,0 +1,120 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Data\Json;
+use Kirby\Toolkit\Str;
+use Throwable;
+
+/**
+ * A collection of layouts
+ * @since 3.5.0
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Layouts extends Items
+{
+	public const ITEM_CLASS = Layout::class;
+
+	/**
+	 * All registered layouts methods
+	 */
+	public static array $methods = [];
+
+	public static function factory(
+		array $items = null,
+		array $params = []
+	): static {
+		// convert single layout to layouts array
+		if (
+			isset($items['columns']) === true ||
+			isset($items['id']) === true
+		) {
+			$items = [$items];
+		}
+
+		$first = $items[0] ?? [];
+
+		// if there are no wrapping layouts for blocks yet …
+		if (
+			isset($first['content']) === true ||
+			isset($first['type']) === true
+		) {
+			$items = [
+				[
+					'id'      => Str::uuid(),
+					'columns' => [
+						[
+							'width'  => '1/1',
+							'blocks' => $items
+						]
+					]
+				]
+			];
+		}
+
+		return parent::factory($items, $params);
+	}
+
+	/**
+	 * Checks if a given block type exists in the layouts collection
+	 * @since 3.6.0
+	 */
+	public function hasBlockType(string $type): bool
+	{
+		return $this->toBlocks()->hasType($type);
+	}
+
+	/**
+	 * Parse layouts data
+	 */
+	public static function parse(array|string|null $input): array
+	{
+		if (
+			empty($input) === false &&
+			is_array($input) === false
+		) {
+			try {
+				$input = Json::decode((string)$input);
+			} catch (Throwable) {
+				return [];
+			}
+		}
+
+		if (empty($input) === true) {
+			return [];
+		}
+
+		return $input;
+	}
+
+	/**
+	 * Converts layouts to blocks
+	 * @since 3.6.0
+	 *
+	 * @param bool $includeHidden Sets whether to include hidden blocks
+	 */
+	public function toBlocks(bool $includeHidden = false): Blocks
+	{
+		$blocks = [];
+
+		if ($this->isNotEmpty() === true) {
+			foreach ($this->data() as $layout) {
+				foreach ($layout->columns() as $column) {
+					foreach ($column->blocks($includeHidden) as $block) {
+						$blocks[] = $block->toArray();
+					}
+				}
+			}
+		}
+
+		return Blocks::factory($blocks, [
+			'field'  => $this->field,
+			'parent' => $this->parent
+		]);
+	}
+}

kirby/src/Cms/License.php

@@ -0,0 +1,529 @@
+<?php
+
+namespace Kirby\Cms;
+
+use IntlDateFormatter;
+use Kirby\Data\Json;
+use Kirby\Exception\Exception;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Exception\LogicException;
+use Kirby\Filesystem\F;
+use Kirby\Http\Remote;
+use Kirby\Toolkit\Str;
+use Kirby\Toolkit\V;
+use Throwable;
+
+/**
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class License
+{
+	protected const HISTORY = [
+		'3' => '2019-02-05',
+		'4' => '2023-11-28'
+	];
+
+	protected const SALT = 'kwAHMLyLPBnHEskzH9pPbJsBxQhKXZnX';
+
+	// cache
+	protected LicenseStatus $status;
+	protected LicenseType $type;
+
+	public function __construct(
+		protected string|null $activation = null,
+		protected string|null $code = null,
+		protected string|null $domain = null,
+		protected string|null $email = null,
+		protected string|null $order = null,
+		protected string|null $date = null,
+		protected string|null $signature = null,
+	) {
+		// normalize the email address
+		$this->email = $this->email === null ? null : $this->normalizeEmail($this->email);
+	}
+
+	/**
+	 * Returns the activation date if available
+	 */
+	public function activation(
+		string|IntlDateFormatter|null $format = null,
+		string|null $handler = null
+	): int|string|null {
+		return $this->activation !== null ? Str::date(strtotime($this->activation), $format, $handler) : null;
+	}
+
+	/**
+	 * Returns the license code if available
+	 */
+	public function code(bool $obfuscated = false): string|null
+	{
+		if ($this->code !== null && $obfuscated === true) {
+			return Str::substr($this->code, 0, 10) . str_repeat('X', 22);
+		}
+
+		return $this->code;
+	}
+
+	/**
+	 * Content for the license file
+	 */
+	public function content(): array
+	{
+		return [
+			'activation' => $this->activation,
+			'code'       => $this->code,
+			'date'       => $this->date,
+			'domain'     => $this->domain,
+			'email'      => $this->email,
+			'order'      => $this->order,
+			'signature'  => $this->signature,
+		];
+	}
+
+	/**
+	 * Returns the purchase date if available
+	 */
+	public function date(
+		string|IntlDateFormatter|null $format = null,
+		string|null $handler = null
+	): int|string|null {
+		return $this->date !== null ? Str::date(strtotime($this->date), $format, $handler) : null;
+	}
+
+	/**
+	 * Returns the activation domain if available
+	 */
+	public function domain(): string|null
+	{
+		return $this->domain;
+	}
+
+	/**
+	 * Returns the activation email if available
+	 */
+	public function email(): string|null
+	{
+		return $this->email;
+	}
+
+	/**
+	 * Validates the email address of the license
+	 */
+	public function hasValidEmailAddress(): bool
+	{
+		return V::email($this->email) === true;
+	}
+
+	/**
+	 * Hub address
+	 */
+	public static function hub(): string
+	{
+		return App::instance()->option('hub', 'https://hub.getkirby.com');
+	}
+
+	/**
+	 * Checks for all required components of a valid license
+	 */
+	public function isComplete(): bool
+	{
+		if (
+			$this->code !== null &&
+			$this->date !== null &&
+			$this->domain !== null &&
+			$this->email !== null &&
+			$this->order !== null &&
+			$this->signature !== null &&
+			$this->hasValidEmailAddress() === true &&
+			$this->type() !== LicenseType::Invalid
+		) {
+			return true;
+		}
+
+		return false;
+	}
+
+	/**
+	 * The license is still valid for the currently
+	 * installed version, but it passed the 3 year period.
+	 */
+	public function isInactive(): bool
+	{
+		return $this->renewal() < time();
+	}
+
+	/**
+	 * Checks for licenses beyond their 3 year period
+	 */
+	public function isLegacy(): bool
+	{
+		if ($this->type() === LicenseType::Legacy) {
+			return true;
+		}
+
+		// without an activation date, the license
+		// renewal cannot be evaluated and the license
+		// has to be marked as expired
+		if ($this->activation === null) {
+			return true;
+		}
+
+		// get release date of current major version
+		$major   = Str::before(App::instance()->version(), '.');
+		$release = strtotime(static::HISTORY[$major] ?? '');
+
+		// if there's no matching version in the history
+		// rather throw an exception to avoid further issues
+		// @codeCoverageIgnoreStart
+		if ($release === false) {
+			throw new InvalidArgumentException('The version for your license could not be found');
+		}
+		// @codeCoverageIgnoreEnd
+
+		// If the renewal date is older than the version launch
+		// date, the license is expired
+		return $this->renewal() < $release;
+	}
+
+	/**
+	 * Runs multiple checks to find out if the license is
+	 * installed and verifiable
+	 */
+	public function isMissing(): bool
+	{
+		return
+			$this->isComplete() === false ||
+			$this->isOnCorrectDomain() === false ||
+			$this->isSigned() === false;
+	}
+
+	/**
+	 * Checks if the license is on the correct domain
+	 */
+	public function isOnCorrectDomain(): bool
+	{
+		if ($this->domain === null) {
+			return false;
+		}
+
+		// compare domains
+		if ($this->normalizeDomain(App::instance()->system()->indexUrl()) !== $this->normalizeDomain($this->domain)) {
+			return false;
+		}
+
+		return true;
+	}
+
+	/**
+	 * Compares the signature with all ingredients
+	 */
+	public function isSigned(): bool
+	{
+		if ($this->signature === null) {
+			return false;
+		}
+
+		// get the public key
+		$pubKey = F::read(App::instance()->root('kirby') . '/kirby.pub');
+
+		// verify the license signature
+		$data      = json_encode($this->signatureData());
+		$signature = hex2bin($this->signature);
+
+		return openssl_verify($data, $signature, $pubKey, 'RSA-SHA256') === 1;
+	}
+
+	/**
+	 * Returns a reliable label for the license type
+	 */
+	public function label(): string
+	{
+		if ($this->status() === LicenseStatus::Missing) {
+			return LicenseType::Invalid->label();
+		}
+
+		return $this->type()->label();
+	}
+
+	/**
+	 * Prepares the email address to be make sure it
+	 * does not have trailing spaces and is lowercase.
+	 */
+	protected function normalizeEmail(string $email): string
+	{
+		return Str::lower(trim($email));
+	}
+
+	/**
+	 * Prepares the domain to be comparable
+	 */
+	protected function normalizeDomain(string $domain): string
+	{
+		// remove common "testing" subdomains as well as www.
+		// to ensure that installations of the same site have
+		// the same license URL; only for installations at /,
+		// subdirectory installations are difficult to normalize
+		if (Str::contains($domain, '/') === false) {
+			if (Str::startsWith($domain, 'www.')) {
+				return substr($domain, 4);
+			}
+
+			if (Str::startsWith($domain, 'dev.')) {
+				return substr($domain, 4);
+			}
+
+			if (Str::startsWith($domain, 'test.')) {
+				return substr($domain, 5);
+			}
+
+			if (Str::startsWith($domain, 'staging.')) {
+				return substr($domain, 8);
+			}
+		}
+
+		return $domain;
+	}
+
+	/**
+	 * Returns the order id if available
+	 */
+	public function order(): string|null
+	{
+		return $this->order;
+	}
+
+	/**
+	 * Support the old license file dataset
+	 * from older licenses
+	 */
+	public static function polyfill(array $license): array
+	{
+		return [
+			'activation' => $license['activation'] ?? null,
+			'code'       => $license['code']       ?? $license['license'] ?? null,
+			'date'       => $license['date']  	   ?? null,
+			'domain'     => $license['domain']     ?? null,
+			'email'      => $license['email']      ?? null,
+			'order'      => $license['order']      ?? null,
+			'signature'  => $license['signature']  ?? null,
+		];
+	}
+
+	/**
+	 * Reads the license file in the config folder
+	 * and creates a new license instance for it.
+	 */
+	public static function read(): static
+	{
+		try {
+			$license = Json::read(App::instance()->root('license'));
+		} catch (Throwable) {
+			return new static();
+		}
+
+		return new static(...static::polyfill($license));
+	}
+
+	/**
+	 * Sends a request to the hub to register the license
+	 */
+	public function register(): static
+	{
+		if ($this->type() === LicenseType::Invalid) {
+			throw new InvalidArgumentException(['key' => 'license.format']);
+		}
+
+		if ($this->hasValidEmailAddress() === false) {
+			throw new InvalidArgumentException(['key' => 'license.email']);
+		}
+
+		if ($this->domain === null) {
+			throw new InvalidArgumentException(['key' => 'license.domain']);
+		}
+
+		// @codeCoverageIgnoreStart
+		$response = $this->request('register', [
+			'license' => $this->code,
+			'email'   => $this->email,
+			'domain'  => $this->domain
+		]);
+
+		return $this->update($response);
+		// @codeCoverageIgnoreEnd
+	}
+
+	/**
+	 * Returns the renewal date
+	 */
+	public function renewal(
+		string|IntlDateFormatter|null $format = null,
+		string|null $handler = null
+	): int|string|null {
+		if ($this->activation === null) {
+			return null;
+		}
+
+		$time = strtotime('+3 years', $this->activation());
+		return Str::date($time, $format, $handler);
+	}
+
+	/**
+	 * Sends a hub request
+	 */
+	public function request(string $path, array $data): array
+	{
+		// @codeCoverageIgnoreStart
+		$response = Remote::get(static::hub() . '/' . $path, [
+			'data' => $data
+		]);
+
+		// handle request errors
+		if ($response->code() !== 200) {
+			$message = $response->json()['message'] ?? 'The request failed';
+
+			throw new LogicException($message, $response->code());
+		}
+
+		return $response->json();
+		// @codeCoverageIgnoreEnd
+	}
+
+	/**
+	 * Saves the license in the config folder
+	 */
+	public function save(): bool
+	{
+		if ($this->status()->activatable() !== true) {
+			throw new InvalidArgumentException([
+				'key' => 'license.verification'
+			]);
+		}
+
+		// where to store the license file
+		$file = App::instance()->root('license');
+
+		// save the license information
+		return Json::write($file, $this->content());
+	}
+
+	/**
+	 * Returns the signature if available
+	 */
+	public function signature(): string|null
+	{
+		return $this->signature;
+	}
+
+	/**
+	 * Creates the signature data array to compare
+	 * with the signature in ::isSigned
+	 */
+	public function signatureData(): array
+	{
+		if ($this->type() === LicenseType::Legacy) {
+			return [
+				'license'    => $this->code,
+				'order'      => $this->order,
+				'email'      => hash('sha256', $this->email . static::SALT),
+				'domain'     => $this->domain,
+				'date'       => $this->date,
+			];
+		}
+
+		return [
+			'activation' => $this->activation,
+			'code'       => $this->code,
+			'date'       => $this->date,
+			'domain'     => $this->domain,
+			'email'      => hash('sha256', $this->email . static::SALT),
+			'order'      => $this->order,
+		];
+	}
+
+	/**
+	 * Returns the license status as string
+	 * This is used to build the proper UI elements
+	 * for the license activation
+	 */
+	public function status(): LicenseStatus
+	{
+		return $this->status ??= match (true) {
+			$this->isMissing()  === true => LicenseStatus::Missing,
+			$this->isLegacy()   === true => LicenseStatus::Legacy,
+			$this->isInactive() === true => LicenseStatus::Inactive,
+			default                      => LicenseStatus::Active
+		};
+	}
+
+	/**
+	 * Detects the license type if the license key is available
+	 */
+	public function type(): LicenseType
+	{
+		return $this->type ??= LicenseType::detect($this->code);
+	}
+
+	/**
+	 * Updates the license file
+	 */
+	public function update(array $data): static
+	{
+		// decode the response
+		$data = static::polyfill($data);
+
+		$this->activation = $data['activation'];
+		$this->code       = $data['code'];
+		$this->date       = $data['date'];
+		$this->order      = $data['order'];
+		$this->signature  = $data['signature'];
+
+		// clear the caches
+		unset($this->status, $this->type);
+
+		// save the new state of the license
+		$this->save();
+
+		return $this;
+	}
+
+	/**
+	 * Sends an upgrade request to the hub in order
+	 * to either redirect to the upgrade form or
+	 * sync the new license state
+	 *
+	 * @codeCoverageIgnore
+	 */
+	public function upgrade(): array
+	{
+		$response = $this->request('upgrade', [
+			'domain'  => $this->domain,
+			'email'   => $this->email,
+			'license' => $this->code,
+		]);
+
+		// the license still needs an upgrade
+		if (empty($response['url']) === false) {
+			// validate the redirect URL
+			if (Str::startsWith($response['url'], static::hub()) === false) {
+				throw new Exception('We couldn’t redirect you to the Hub');
+			}
+
+			return [
+				'status' => 'upgrade',
+				'url'    => $response['url']
+			];
+		}
+
+		// the license has already been upgraded
+		// and can now be replaced
+		$this->update($response);
+
+		return [
+			'status' => 'complete',
+		];
+	}
+}

kirby/src/Cms/LicenseStatus.php

@@ -0,0 +1,144 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Toolkit\I18n;
+
+/**
+ * @package   Kirby Cms
+ * @author    Nico Hoffmann <nico@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ *
+ * @codeCoverageIgnore
+ */
+enum LicenseStatus: string
+{
+	/**
+	 * The license is valid and active
+	 */
+	case Active = 'active';
+
+	/**
+	 * Only used for the demo instance
+	 */
+	case Demo = 'demo';
+
+	/**
+	 * The included updates period of
+	 * the license is over.
+	 */
+	case Inactive = 'inactive';
+
+	/**
+	 * The installation has an old
+	 * license (v1, v2, v3)
+	 */
+	case Legacy = 'legacy';
+
+	/**
+	 * The installation has no license or
+	 * the license cannot be validated
+	 */
+	case Missing = 'missing';
+
+	/**
+	 * Checks if the license can be saved when it
+	 * was entered in the activation dialog;
+	 * renewable licenses are accepted as well
+	 * to allow renewal from the Panel
+	 */
+	public function activatable(): bool
+	{
+		return match ($this) {
+			static::Active,
+			static::Inactive,
+			static::Legacy    => true,
+			default           => false
+		};
+	}
+
+	/**
+	 * Returns the dialog according to the status
+	 */
+	public function dialog(): string|null
+	{
+		return match ($this) {
+			static::Missing => 'registration',
+			static::Demo    => null,
+			default         => 'license'
+		};
+	}
+
+	/**
+	 * Returns the icon according to the status.
+	 * The icon is used for the system view and
+	 * in the license dialog.
+	 */
+	public function icon(): string
+	{
+		return match ($this) {
+			static::Missing  => 'key',
+			static::Legacy   => 'alert',
+			static::Inactive => 'clock',
+			static::Active   => 'check',
+			static::Demo     => 'preview',
+		};
+	}
+
+	/**
+	 * The info text is shown in the license dialog
+	 * in the status row.
+	 */
+	public function info(string|null $end = null): string
+	{
+		return I18n::template('license.status.' . $this->value . '.info', ['date' => $end]);
+	}
+
+	/**
+	 * Label for the system view
+	 */
+	public function label(): string
+	{
+		return I18n::translate('license.status.' . $this->value . '.label');
+	}
+
+	/**
+	 * Checks if the license can be renewed
+	 * The license dialog will show the renew
+	 * button in this case and redirect to the hub
+	 */
+	public function renewable(): bool
+	{
+		return match ($this) {
+			static::Demo,
+			static::Active => false,
+			default        => true
+		};
+	}
+
+	/**
+	 * Returns the theme according to the status
+	 * The theme is used for the label in the system
+	 * view and the status icon in the license dialog.
+	 */
+	public function theme(): string
+	{
+		return match ($this) {
+			static::Missing  => 'love',
+			static::Legacy   => 'negative',
+			static::Inactive => 'notice',
+			static::Active   => 'positive',
+			static::Demo     => 'notice',
+		};
+	}
+
+	/**
+	 * Returns the status as string value
+	 */
+	public function value(): string
+	{
+		return $this->value;
+	}
+}

kirby/src/Cms/LicenseType.php

@@ -0,0 +1,111 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Toolkit\I18n;
+use Kirby\Toolkit\Str;
+
+/**
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ *
+ * @codeCoverageIgnore
+ */
+enum LicenseType: string
+{
+	/**
+	 * New basic licenses
+	 */
+	case Basic = 'basic';
+
+	/**
+	 * New enterprise licenses
+	 */
+	case Enterprise = 'enterprise';
+
+	/**
+	 * Invalid license codes
+	 */
+	case Invalid = 'invalid';
+
+	/**
+	 * Old Kirby 3 licenses
+	 */
+	case Legacy = 'legacy';
+
+	/**
+	 * Detects the correct LicenseType based on the code
+	 */
+	public static function detect(string|null $code): static
+	{
+		return match (true) {
+			static::Basic->isValidCode($code)      => static::Basic,
+			static::Enterprise->isValidCode($code) => static::Enterprise,
+			static::Legacy->isValidCode($code)     => static::Legacy,
+			default                                => static::Invalid
+		};
+	}
+
+	/**
+	 * Checks for a valid license code
+	 * by prefix and length. This is just a
+	 * rough validation.
+	 */
+	public function isValidCode(string|null $code): bool
+	{
+		return
+			$code !== null &&
+			Str::length($code) === $this->length() &&
+			Str::startsWith($code, $this->prefix()) === true;
+	}
+
+	/**
+	 * The expected lengths of the license code
+	 */
+	public function length(): int
+	{
+		return match ($this) {
+			static::Basic      => 38,
+			static::Enterprise => 38,
+			static::Legacy     => 39,
+			static::Invalid    => 0,
+		};
+	}
+
+	/**
+	 * A human-readable license type label
+	 */
+	public function label(): string
+	{
+		return match ($this) {
+			static::Basic      => 'Kirby Basic',
+			static::Enterprise => 'Kirby Enterprise',
+			static::Legacy     => 'Kirby 3',
+			static::Invalid    => I18n::translate('license.unregistered.label'),
+		};
+	}
+
+	/**
+	 * The expected prefix for the license code
+	 */
+	public function prefix(): string|null
+	{
+		return match ($this) {
+			static::Basic      => 'K-BAS-',
+			static::Enterprise => 'K-ENT-',
+			static::Legacy     => 'K3-PRO-',
+			static::Invalid    => null,
+		};
+	}
+
+	/**
+	 * Returns the enum value
+	 */
+	public function value(): string
+	{
+		return $this->value;
+	}
+}

kirby/src/Cms/Loader.php

@@ -0,0 +1,217 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Closure;
+use Kirby\Data\Data;
+use Kirby\Filesystem\F;
+
+/**
+ * The Loader class is an internal loader for
+ * core parts, like areas, components, sections, etc.
+ *
+ * It's exposed in the `$kirby->load()` and the
+ * `$kirby->core()->load()` methods.
+ *
+ * With `$kirby->load()` you get access to core parts
+ * that might be overwritten by plugins.
+ *
+ * With `$kirby->core()->load()` you get access to
+ * untouched core parts. This is useful if you want to
+ * reuse or fall back to core features in your plugins.
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Loader
+{
+	/**
+	 * @var \Kirby\Cms\App
+	 */
+	protected $kirby;
+
+	/**
+	 * @var bool
+	 */
+	protected $withPlugins;
+
+	/**
+	 * @param \Kirby\Cms\App $kirby
+	 * @param bool $withPlugins
+	 */
+	public function __construct(App $kirby, bool $withPlugins = true)
+	{
+		$this->kirby       = $kirby;
+		$this->withPlugins = $withPlugins;
+	}
+
+	/**
+	 * Loads the area definition
+	 */
+	public function area(string $name): array|null
+	{
+		return $this->areas()[$name] ?? null;
+	}
+
+	/**
+	 * Loads all areas and makes sure that plugins
+	 * are injected properly
+	 */
+	public function areas(): array
+	{
+		$areas      = [];
+		$extensions = $this->withPlugins === true ? $this->kirby->extensions('areas') : [];
+
+		// load core areas and extend them with elements
+		// from plugins if they exist
+		foreach ($this->kirby->core()->areas() as $id => $area) {
+			$area = $this->resolveArea($area);
+
+			if (isset($extensions[$id]) === true) {
+				foreach ($extensions[$id] as $areaExtension) {
+					$extension = $this->resolveArea($areaExtension);
+					$area      = array_replace_recursive($area, $extension);
+				}
+
+				unset($extensions[$id]);
+			}
+
+			$areas[$id] = $area;
+		}
+
+		// add additional areas from plugins
+		foreach ($extensions as $id => $areaExtensions) {
+			foreach ($areaExtensions as $areaExtension) {
+				$areas[$id] = $this->resolve($areaExtension);
+			}
+		}
+
+		return $areas;
+	}
+
+	/**
+	 * Loads a core component closure
+	 */
+	public function component(string $name): Closure|null
+	{
+		return $this->extension('components', $name);
+	}
+
+	/**
+	 * Loads all core component closures
+	 */
+	public function components(): array
+	{
+		return $this->extensions('components');
+	}
+
+	/**
+	 * Loads a particular extension
+	 */
+	public function extension(string $type, string $name): mixed
+	{
+		return $this->extensions($type)[$name] ?? null;
+	}
+
+	/**
+	 * Loads all defined extensions
+	 */
+	public function extensions(string $type): array
+	{
+		return $this->withPlugins === false ? $this->kirby->core()->$type() : $this->kirby->extensions($type);
+	}
+
+	/**
+	 * The resolver takes a string, array or closure.
+	 *
+	 * 1.) a string is supposed to be a path to an existing file.
+	 * The file will either be included when it's a PHP file and
+	 * the array contents will be read. Or it will be parsed with
+	 * the Data class to read yml or json data into an array
+	 *
+	 * 2.) arrays are untouched and returned
+	 *
+	 * 3.) closures will be called and the Kirby instance will be
+	 * passed as first argument
+	 */
+	public function resolve(mixed $item): mixed
+	{
+		if (is_string($item) === true) {
+			$item = match (F::extension($item)) {
+				'php'   => F::load($item, allowOutput: false),
+				default => Data::read($item)
+			};
+		}
+
+		if (is_callable($item) === true) {
+			$item = $item($this->kirby);
+		}
+
+		return $item;
+	}
+
+	/**
+	 * Calls `static::resolve()` on all items
+	 * in the given array
+	 */
+	public function resolveAll(array $items): array
+	{
+		$result = [];
+
+		foreach ($items as $key => $value) {
+			$result[$key] = $this->resolve($value);
+		}
+
+		return $result;
+	}
+
+	/**
+	 * Areas need a bit of special treatment
+	 * when they are being loaded
+	 */
+	public function resolveArea(string|array|Closure $area): array
+	{
+		$area      = $this->resolve($area);
+		$dropdowns = $area['dropdowns'] ?? [];
+
+		// convert closure dropdowns to an array definition
+		// otherwise they cannot be merged properly later
+		foreach ($dropdowns as $key => $dropdown) {
+			if ($dropdown instanceof Closure) {
+				$area['dropdowns'][$key] = [
+					'options' => $dropdown
+				];
+			}
+		}
+
+		return $area;
+	}
+
+	/**
+	 * Loads a particular section definition
+	 */
+	public function section(string $name): array|null
+	{
+		return $this->resolve($this->extension('sections', $name));
+	}
+
+	/**
+	 * Loads all section defintions
+	 */
+	public function sections(): array
+	{
+		return $this->resolveAll($this->extensions('sections'));
+	}
+
+	/**
+	 * Returns the status flag, which shows
+	 * if plugins are loaded as well.
+	 */
+	public function withPlugins(): bool
+	{
+		return $this->withPlugins;
+	}
+}

kirby/src/Cms/Media.php

@@ -0,0 +1,180 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Data\Data;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Exception\NotFoundException;
+use Kirby\Filesystem\Dir;
+use Kirby\Filesystem\F;
+use Kirby\Toolkit\Str;
+use Throwable;
+
+/**
+ * Handles all tasks to get the Media API
+ * up and running and link files correctly
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Media
+{
+	/**
+	 * Tries to find a file by model and filename
+	 * and to copy it to the media folder.
+	 */
+	public static function link(
+		Page|Site|User $model = null,
+		string $hash,
+		string $filename
+	): Response|false {
+		if ($model === null) {
+			return false;
+		}
+
+		// fix issues with spaces in filenames
+		$filename = urldecode($filename);
+
+		// try to find a file by model and filename
+		// this should work for all original files
+		if ($file = $model->file($filename)) {
+			// check if the request contained an outdated media hash
+			if ($file->mediaHash() !== $hash) {
+				// if at least the token was correct, redirect
+				if (Str::startsWith($hash, $file->mediaToken() . '-') === true) {
+					return Response::redirect($file->mediaUrl(), 307);
+				}
+
+				// don't leak the correct token, render the error page
+				return false;
+			}
+
+			// send the file to the browser
+			return Response::file($file->publish()->mediaRoot());
+		}
+
+		// try to generate a thumb for the file
+		try {
+			return static::thumb($model, $hash, $filename);
+		} catch (NotFoundException) {
+			// render the error page if there is no job for this filename
+			return false;
+		}
+	}
+
+	/**
+	 * Copy the file to the final media folder location
+	 */
+	public static function publish(File $file, string $dest): bool
+	{
+		// never publish risky files (e.g. HTML, PHP or Apache config files)
+		FileRules::validFile($file, false);
+
+		$src       = $file->root();
+		$version   = dirname($dest);
+		$directory = dirname($version);
+
+		// unpublish all files except stuff in the version folder
+		Media::unpublish($directory, $file, $version);
+
+		// copy/overwrite the file to the dest folder
+		return F::copy($src, $dest, true);
+	}
+
+	/**
+	 * Tries to find a job file for the
+	 * given filename and then calls the thumb
+	 * component to create a thumbnail accordingly
+	 */
+	public static function thumb(
+		File|Page|Site|User|string $model,
+		string $hash,
+		string $filename
+	): Response|false {
+		$kirby = App::instance();
+
+		$root = match (true) {
+			// assets
+			is_string($model)
+				=> $kirby->root('media') . '/assets/' . $model . '/' . $hash,
+			// parent files for file model that already included hash
+			$model instanceof File
+				=> dirname($model->mediaRoot()),
+			// model files
+			default
+			=> $model->mediaRoot() . '/' . $hash
+		};
+
+		$thumb = $root . '/' . $filename;
+		$job   = $root . '/.jobs/' . $filename . '.json';
+
+		try {
+			$options = Data::read($job);
+		} catch (Throwable) {
+			// send a customized error message to make clearer what happened here
+			throw new NotFoundException('The thumbnail configuration could not be found');
+		}
+
+		if (empty($options['filename']) === true) {
+			throw new InvalidArgumentException('Incomplete thumbnail configuration');
+		}
+
+		try {
+			// find the correct source file depending on the model
+			// this adds support for custom assets
+			$source = match (true) {
+				is_string($model) === true
+					=> $kirby->root('index') . '/' . $model . '/' . $options['filename'],
+				default
+				=> $model->file($options['filename'])->root()
+			};
+
+			// generate the thumbnail and save it in the media folder
+			$kirby->thumb($source, $thumb, $options);
+
+			// remove the job file once the thumbnail has been created
+			F::remove($job);
+
+			// read the file and send it to the browser
+			return Response::file($thumb);
+		} catch (Throwable $e) {
+			// remove potentially broken thumbnails
+			F::remove($thumb);
+			throw $e;
+		}
+	}
+
+	/**
+	 * Deletes all versions of the given file
+	 * within the parent directory
+	 */
+	public static function unpublish(
+		string $directory,
+		File $file,
+		string|null $ignore = null
+	): bool {
+		if (is_dir($directory) === false) {
+			return true;
+		}
+
+		// get both old and new versions (pre and post Kirby 3.4.0)
+		$versions = array_merge(
+			glob($directory . '/' . crc32($file->filename()) . '-*', GLOB_ONLYDIR),
+			glob($directory . '/' . $file->mediaToken() . '-*', GLOB_ONLYDIR)
+		);
+
+		// delete all versions of the file
+		foreach ($versions as $version) {
+			if ($version === $ignore) {
+				continue;
+			}
+
+			Dir::remove($version);
+		}
+
+		return true;
+	}
+}

kirby/src/Cms/Model.php

@@ -0,0 +1,117 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Toolkit\Properties;
+
+/**
+ * @deprecated 4.0.0 will be removed in Kirby 5.0
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+abstract class Model
+{
+	use Properties;
+
+	/**
+	 * Each model must define a CLASS_ALIAS
+	 * which will be used in template queries.
+	 * The CLASS_ALIAS is a short human-readable
+	 * version of the class name. I.e. page.
+	 */
+	public const CLASS_ALIAS = null;
+
+	/**
+	 * The parent Kirby instance
+	 *
+	 * @var \Kirby\Cms\App
+	 */
+	public static $kirby;
+
+	/**
+	 * The parent site instance
+	 *
+	 * @var \Kirby\Cms\Site
+	 */
+	protected $site;
+
+	/**
+	 * Makes it possible to convert the entire model
+	 * to a string. Mostly useful for debugging
+	 *
+	 * @return string
+	 */
+	public function __toString(): string
+	{
+		return $this->id();
+	}
+
+	/**
+	 * Each model must return a unique id
+	 *
+	 * @return string|null
+	 */
+	public function id()
+	{
+		return null;
+	}
+
+	/**
+	 * Returns the parent Kirby instance
+	 *
+	 * @return \Kirby\Cms\App
+	 */
+	public function kirby()
+	{
+		return static::$kirby ??= App::instance();
+	}
+
+	/**
+	 * Returns the parent Site instance
+	 *
+	 * @return \Kirby\Cms\Site
+	 */
+	public function site()
+	{
+		return $this->site ??= $this->kirby()->site();
+	}
+
+	/**
+	 * Setter for the parent Kirby object
+	 *
+	 * @param \Kirby\Cms\App|null $kirby
+	 * @return $this
+	 */
+	protected function setKirby(App $kirby = null)
+	{
+		static::$kirby = $kirby;
+		return $this;
+	}
+
+	/**
+	 * Setter for the parent site object
+	 *
+	 * @internal
+	 * @param \Kirby\Cms\Site|null $site
+	 * @return $this
+	 */
+	public function setSite(Site $site = null)
+	{
+		$this->site = $site;
+		return $this;
+	}
+
+	/**
+	 * Convert the model to a simple array
+	 *
+	 * @return array
+	 */
+	public function toArray(): array
+	{
+		return $this->propertiesToArray();
+	}
+}

kirby/src/Cms/ModelPermissions.php

@@ -0,0 +1,116 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Toolkit\A;
+
+/**
+ * ModelPermissions
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+abstract class ModelPermissions
+{
+	protected string $category;
+	protected ModelWithContent $model;
+	protected array $options;
+	protected Permissions $permissions;
+	protected User $user;
+
+	public function __construct(ModelWithContent $model)
+	{
+		$this->model       = $model;
+		$this->options     = $model->blueprint()->options();
+		$this->user        = $model->kirby()->user() ?? User::nobody();
+		$this->permissions = $this->user->role()->permissions();
+	}
+
+	public function __call(string $method, array $arguments = []): bool
+	{
+		return $this->can($method);
+	}
+
+	/**
+	 * Improved `var_dump` output
+	 * @codeCoverageIgnore
+	 */
+	public function __debugInfo(): array
+	{
+		return $this->toArray();
+	}
+
+	public function can(string $action): bool
+	{
+		$user = $this->user->id();
+		$role = $this->user->role()->id();
+
+		// users with the `nobody` role can do nothing
+		// that needs a permission check
+		if ($role === 'nobody') {
+			return false;
+		}
+
+		// check for a custom `can` method
+		// which would take priority over any other
+		// role-based permission rules
+		if (
+			method_exists($this, 'can' . $action) === true &&
+			$this->{'can' . $action}() === false
+		) {
+			return false;
+		}
+
+		// the almighty `kirby` user can do anything
+		if ($user === 'kirby' && $role === 'admin') {
+			return true;
+		}
+
+		// evaluate the blueprint options block
+		if (isset($this->options[$action]) === true) {
+			$options = $this->options[$action];
+
+			if ($options === false) {
+				return false;
+			}
+
+			if ($options === true) {
+				return true;
+			}
+
+			if (
+				is_array($options) === true &&
+				A::isAssociative($options) === true
+			) {
+				if (isset($options[$role]) === true) {
+					return $options[$role];
+				}
+
+				if (isset($options['*']) === true) {
+					return $options['*'];
+				}
+			}
+		}
+
+		return $this->permissions->for($this->category, $action);
+	}
+
+	public function cannot(string $action): bool
+	{
+		return $this->can($action) === false;
+	}
+
+	public function toArray(): array
+	{
+		$array = [];
+
+		foreach ($this->options as $key => $value) {
+			$array[$key] = $this->can($key);
+		}
+
+		return $array;
+	}
+}

kirby/src/Cms/ModelWithContent.php

@@ -0,0 +1,829 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Closure;
+use Kirby\Content\Content;
+use Kirby\Content\ContentStorage;
+use Kirby\Content\ContentTranslation;
+use Kirby\Content\PlainTextContentStorageHandler;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Exception\NotFoundException;
+use Kirby\Form\Form;
+use Kirby\Panel\Model;
+use Kirby\Toolkit\Str;
+use Kirby\Uuid\Identifiable;
+use Kirby\Uuid\Uuid;
+use Kirby\Uuid\Uuids;
+use Throwable;
+
+/**
+ * ModelWithContent
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+abstract class ModelWithContent implements Identifiable
+{
+	/**
+	 * Each model must define a CLASS_ALIAS
+	 * which will be used in template queries.
+	 * The CLASS_ALIAS is a short human-readable
+	 * version of the class name, i.e. page.
+	 */
+	public const CLASS_ALIAS = null;
+
+	/**
+	 * Cached array of valid blueprints
+	 * that could be used for the model
+	 */
+	public array|null $blueprints = null;
+
+	public Content|null $content;
+	public static App $kirby;
+	protected Site|null $site;
+	protected ContentStorage $storage;
+	public Collection|null $translations = null;
+
+	/**
+	 * Store values used to initilaize object
+	 */
+	protected array $propertyData = [];
+
+	public function __construct(array $props = [])
+	{
+		$this->site = $props['site'] ?? null;
+
+		$this->setContent($props['content'] ?? null);
+		$this->setTranslations($props['translations'] ?? null);
+
+		$this->propertyData = $props;
+	}
+
+	/**
+	 * Returns the blueprint of the model
+	 */
+	abstract public function blueprint(): Blueprint;
+
+	/**
+	 * Returns an array with all blueprints that are available
+	 */
+	public function blueprints(string $inSection = null): array
+	{
+		// helper function
+		$toBlueprints = function (array $sections): array {
+			$blueprints = [];
+
+			foreach ($sections as $section) {
+				if ($section === null) {
+					continue;
+				}
+
+				foreach ((array)$section->blueprints() as $blueprint) {
+					$blueprints[$blueprint['name']] = $blueprint;
+				}
+			}
+
+			return array_values($blueprints);
+		};
+
+		$blueprint = $this->blueprint();
+
+		// no caching for when collecting for specific section
+		if ($inSection !== null) {
+			return $toBlueprints([$blueprint->section($inSection)]);
+		}
+
+		return $this->blueprints ??= $toBlueprints($blueprint->sections());
+	}
+
+	/**
+	 * Creates a new instance with the same
+	 * initial properties
+	 *
+	 * @todo eventually refactor without need of propertyData
+	 */
+	public function clone(array $props = []): static
+	{
+		return new static(array_replace_recursive($this->propertyData, $props));
+	}
+
+	/**
+	 * Executes any given model action
+	 */
+	abstract protected function commit(
+		string $action,
+		array $arguments,
+		Closure $callback
+	): mixed;
+
+	/**
+	 * Returns the content
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the language for the given code does not exist
+	 */
+	public function content(string|null $languageCode = null): Content
+	{
+		// single language support
+		if ($this->kirby()->multilang() === false) {
+			if ($this->content instanceof Content) {
+				return $this->content;
+			}
+
+			// don't normalize field keys (already handled by the `Data` class)
+			return $this->content = new Content($this->readContent(), $this, false);
+		}
+
+		// get the targeted language
+		$language = $this->kirby()->language($languageCode);
+
+		// stop if the language does not exist
+		if ($language === null) {
+			throw new InvalidArgumentException('Invalid language: ' . $languageCode);
+		}
+
+		// only fetch from cache for the current language
+		if ($languageCode === null && $this->content instanceof Content) {
+			return $this->content;
+		}
+
+		// get the translation by code
+		$translation = $this->translation($language->code());
+
+		// don't normalize field keys (already handled by the `ContentTranslation` class)
+		$content = new Content($translation->content(), $this, false);
+
+		// only store the content for the current language
+		if ($languageCode === null) {
+			$this->content = $content;
+		}
+
+		return $content;
+	}
+
+	/**
+	 * Returns the absolute path to the content file;
+	 * NOTE: only supports the published content file
+	 * (use `$model->storage()->contentFile()` for other versions)
+	 * @internal
+	 * @deprecated 4.0.0
+	 * @todo Remove in v5
+	 * @codeCoverageIgnore
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the language for the given code does not exist
+	 */
+	public function contentFile(
+		string $languageCode = null,
+		bool $force = false
+	): string {
+		Helpers::deprecated('The internal $model->contentFile() method has been deprecated. You can use $model->storage()->contentFile() instead, however please note that this method is also internal and may be removed in the future.', 'model-content-file');
+
+		return $this->storage()->contentFile(
+			$this->storage()->defaultVersion(),
+			$languageCode,
+			$force
+		);
+	}
+
+	/**
+	 * Returns an array with all content files;
+	 * NOTE: only supports the published content file
+	 * (use `$model->storage()->contentFiles()` for other versions)
+	 * @deprecated 4.0.0
+	 * @todo Remove in v5
+	 * @codeCoverageIgnore
+	 */
+	public function contentFiles(): array
+	{
+		Helpers::deprecated('The internal $model->contentFiles() method has been deprecated. You can use $model->storage()->contentFiles() instead, however please note that this method is also internal and may be removed in the future.', 'model-content-file');
+
+		return $this->storage()->contentFiles(
+			$this->storage()->defaultVersion()
+		);
+	}
+
+	/**
+	 * Prepares the content that should be written
+	 * to the text file
+	 * @internal
+	 */
+	public function contentFileData(
+		array $data,
+		string $languageCode = null
+	): array {
+		return $data;
+	}
+
+	/**
+	 * Returns the absolute path to the
+	 * folder in which the content file is
+	 * located
+	 * @internal
+	 * @deprecated 4.0.0
+	 * @todo Remove in v5
+	 * @codeCoverageIgnore
+	 */
+	public function contentFileDirectory(): string|null
+	{
+		Helpers::deprecated('The internal $model->contentFileDirectory() method has been deprecated. Please let us know via a GitHub issue if you need this method and tell us your use case.', 'model-content-file');
+		return $this->root();
+	}
+
+	/**
+	 * Returns the extension of the content file
+	 * @internal
+	 * @deprecated 4.0.0
+	 * @todo Remove in v5
+	 * @codeCoverageIgnore
+	 */
+	public function contentFileExtension(): string
+	{
+		Helpers::deprecated('The internal $model->contentFileName() method has been deprecated. Please let us know via a GitHub issue if you need this method and tell us your use case.', 'model-content-file');
+		return $this->kirby()->contentExtension();
+	}
+
+	/**
+	 * Needs to be declared by the final model
+	 * @internal
+	 * @deprecated 4.0.0
+	 * @todo Remove in v5
+	 * @codeCoverageIgnore
+	 */
+	abstract public function contentFileName(): string;
+
+	/**
+	 * Converts model to new blueprint
+	 * incl. its content for all translations
+	 */
+	protected function convertTo(string $blueprint): static
+	{
+		// first close object with new blueprint as template
+		$new = $this->clone(['template' => $blueprint]);
+
+		// temporary compatibility change (TODO: also convert changes)
+		$identifier = $this->storage()->defaultVersion();
+
+		// for multilang, we go through all translations and
+		// covnert the content for each of them, remove the content file
+		// to rewrite it with converted content afterwards
+		if ($this->kirby()->multilang() === true) {
+			$translations = [];
+
+			foreach ($this->kirby()->languages()->codes() as $code) {
+				if ($this->translation($code)?->exists() === true) {
+					$content = $this->content($code)->convertTo($blueprint);
+
+					// delete the old text file
+					$this->storage()->delete(
+						$identifier,
+						$code
+					);
+
+					// save to re-create the translation content file
+					// with the converted/updated content
+					$new->save($content, $code);
+				}
+
+				$translations[] = [
+					'code'    => $code,
+					'content' => $content ?? null
+				];
+			}
+
+			// cloning the object with the new translations content ensures
+			// that `propertyData` prop does not hold any old translations
+			// content that could surface on subsequent cloning
+			return $new->clone(['translations' => $translations]);
+		}
+
+		// for single language setups, we do the same,
+		// just once for the main content
+		$content = $this->content()->convertTo($blueprint);
+
+		// delete the old text file
+		$this->storage()->delete($identifier, 'default');
+
+		return $new->save($content);
+	}
+
+	/**
+	 * Decrement a given field value
+	 */
+	public function decrement(
+		string $field,
+		int $by = 1,
+		int $min = 0
+	): static {
+		$value = (int)$this->content()->get($field)->value() - $by;
+
+		if ($value < $min) {
+			$value = $min;
+		}
+
+		return $this->update([$field => $value]);
+	}
+
+	/**
+	 * Returns all content validation errors
+	 */
+	public function errors(): array
+	{
+		$errors = [];
+
+		foreach ($this->blueprint()->sections() as $section) {
+			$errors = array_merge($errors, $section->errors());
+		}
+
+		return $errors;
+	}
+
+	/**
+	 * Creates a clone and fetches all
+	 * lazy-loaded getters to get a full copy
+	 */
+	public function hardcopy(): static
+	{
+		$clone = $this->clone();
+
+		foreach (get_object_vars($clone) as $name => $default) {
+			if (method_exists($clone, $name) === true) {
+				$clone->$name();
+			}
+		}
+
+		return $clone;
+	}
+
+	/**
+	 * Each model must return a unique id
+	 */
+	public function id(): string|null
+	{
+		return null;
+	}
+
+	/**
+	 * Increment a given field value
+	 */
+	public function increment(
+		string $field,
+		int $by = 1,
+		int $max = null
+	): static {
+		$value = (int)$this->content()->get($field)->value() + $by;
+
+		if ($max && $value > $max) {
+			$value = $max;
+		}
+
+		return $this->update([$field => $value]);
+	}
+
+	/**
+	 * Checks if the model is locked for the current user
+	 */
+	public function isLocked(): bool
+	{
+		$lock = $this->lock();
+		return $lock && $lock->isLocked() === true;
+	}
+
+	/**
+	 * Checks if the data has any errors
+	 */
+	public function isValid(): bool
+	{
+		return Form::for($this)->isValid() === true;
+	}
+
+	/**
+	 * Returns the parent Kirby instance
+	 */
+	public function kirby(): App
+	{
+		return static::$kirby ??= App::instance();
+	}
+
+	/**
+	 * Returns the lock object for this model
+	 *
+	 * Only if a content directory exists,
+	 * virtual pages will need to overwrite this method
+	 */
+	public function lock(): ContentLock|null
+	{
+		$dir = $this->root();
+
+		if ($this::CLASS_ALIAS === 'file') {
+			$dir = dirname($dir);
+		}
+
+		if (
+			$this->kirby()->option('content.locking', true) &&
+			is_string($dir) === true &&
+			file_exists($dir) === true
+		) {
+			return new ContentLock($this);
+		}
+
+		return null;
+	}
+
+	/**
+	 * Returns the panel info of the model
+	 * @since 3.6.0
+	 */
+	abstract public function panel(): Model;
+
+	/**
+	 * Must return the permissions object for the model
+	 */
+	abstract public function permissions(): ModelPermissions;
+
+	/**
+	 * Clean internal caches
+	 *
+	 * @return $this
+	 */
+	public function purge(): static
+	{
+		$this->blueprints   = null;
+		$this->content      = null;
+		$this->translations = null;
+
+		return $this;
+	}
+
+	/**
+	 * Creates a string query, starting from the model
+	 * @internal
+	 */
+	public function query(
+		string $query = null,
+		string $expect = null
+	): mixed {
+		if ($query === null) {
+			return null;
+		}
+
+		try {
+			$result = Str::query($query, [
+				'kirby'             => $this->kirby(),
+				'site'              => $this instanceof Site ? $this : $this->site(),
+				'model'             => $this,
+				static::CLASS_ALIAS => $this
+			]);
+		} catch (Throwable) {
+			return null;
+		}
+
+		if ($expect !== null && $result instanceof $expect === false) {
+			return null;
+		}
+
+		return $result;
+	}
+
+	/**
+	 * Read the content from the content file
+	 * @internal
+	 */
+	public function readContent(string $languageCode = null): array
+	{
+		try {
+			return $this->storage()->read(
+				$this->storage()->defaultVersion(),
+				$languageCode
+			);
+		} catch (NotFoundException) {
+			// only if the content file really does not exist, it's ok
+			// to return empty content. Otherwise this could lead to
+			// content loss in case of file reading issues
+			return [];
+		}
+	}
+
+	/**
+	 * Returns the absolute path to the model
+	 */
+	abstract public function root(): string|null;
+
+	/**
+	 * Stores the content on disk
+	 * @internal
+	 */
+	public function save(
+		array|null $data = null,
+		string|null $languageCode = null,
+		bool $overwrite = false
+	): static {
+		if ($this->kirby()->multilang() === true) {
+			return $this->saveTranslation($data, $languageCode, $overwrite);
+		}
+
+		return $this->saveContent($data, $overwrite);
+	}
+
+	/**
+	 * Save the single language content
+	 */
+	protected function saveContent(
+		array $data = null,
+		bool $overwrite = false
+	): static {
+		// create a clone to avoid modifying the original
+		$clone = $this->clone();
+
+		// merge the new data with the existing content
+		$clone->content()->update($data, $overwrite);
+
+		// send the full content array to the writer
+		$clone->writeContent($clone->content()->toArray());
+
+		return $clone;
+	}
+
+	/**
+	 * Save a translation
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the language for the given code does not exist
+	 */
+	protected function saveTranslation(
+		array $data = null,
+		string $languageCode = null,
+		bool $overwrite = false
+	): static {
+		// create a clone to not touch the original
+		$clone = $this->clone();
+
+		// fetch the matching translation and update all the strings
+		$translation = $clone->translation($languageCode);
+
+		if ($translation === null) {
+			throw new InvalidArgumentException('Invalid language: ' . $languageCode);
+		}
+
+		// get the content to store
+		$content      = $translation->update($data, $overwrite)->content();
+		$kirby        = $this->kirby();
+		$languageCode = $kirby->languageCode($languageCode);
+
+		// remove all untranslatable fields
+		if ($languageCode !== $kirby->defaultLanguage()->code()) {
+			foreach ($this->blueprint()->fields() as $field) {
+				if (($field['translate'] ?? true) === false) {
+					$content[strtolower($field['name'])] = null;
+				}
+			}
+
+			// remove UUID for non-default languages
+			if (Uuids::enabled() === true && isset($content['uuid']) === true) {
+				$content['uuid'] = null;
+			}
+
+			// merge the translation with the new data
+			$translation->update($content, true);
+		}
+
+		// send the full translation array to the writer
+		$clone->writeContent($translation->content(), $languageCode);
+
+		// reset the content object
+		$clone->content = null;
+
+		// return the updated model
+		return $clone;
+	}
+
+	/**
+	 * Sets the Content object
+	 *
+	 * @return $this
+	 */
+	protected function setContent(array $content = null): static
+	{
+		if ($content !== null) {
+			$content = new Content($content, $this);
+		}
+
+		$this->content = $content;
+		return $this;
+	}
+
+	/**
+	 * Create the translations collection from an array
+	 *
+	 * @return $this
+	 */
+	protected function setTranslations(array $translations = null): static
+	{
+		if ($translations !== null) {
+			$this->translations = new Collection();
+
+			foreach ($translations as $props) {
+				$props['parent'] = $this;
+				$translation = new ContentTranslation($props);
+				$this->translations->data[$translation->code()] = $translation;
+			}
+		} else {
+			$this->translations = null;
+		}
+
+		return $this;
+	}
+
+	/**
+	 * Returns the parent Site instance
+	 */
+	public function site(): Site
+	{
+		return $this->site ??= $this->kirby()->site();
+	}
+
+	/**
+	 * Returns the content storage handler
+	 * @internal
+	 */
+	public function storage(): ContentStorage
+	{
+		return $this->storage ??= new ContentStorage(
+			model:   $this,
+			handler: PlainTextContentStorageHandler::class
+		);
+	}
+
+	/**
+	 * Convert the model to a simple array
+	 */
+	public function toArray(): array
+	{
+		return [
+			'content'      => $this->content()->toArray(),
+			'translations' => $this->translations()->toArray()
+		];
+	}
+
+	/**
+	 * String template builder with automatic HTML escaping
+	 * @since 3.6.0
+	 *
+	 * @param string|null $template Template string or `null` to use the model ID
+	 * @param string|null $fallback Fallback for tokens in the template that cannot be replaced
+	 *                              (`null` to keep the original token)
+	 */
+	public function toSafeString(
+		string $template = null,
+		array $data = [],
+		string|null $fallback = ''
+	): string {
+		return $this->toString($template, $data, $fallback, 'safeTemplate');
+	}
+
+	/**
+	 * String template builder
+	 *
+	 * @param string|null $template Template string or `null` to use the model ID
+	 * @param string|null $fallback Fallback for tokens in the template that cannot be replaced
+	 *                              (`null` to keep the original token)
+	 * @param string $handler For internal use
+	 */
+	public function toString(
+		string $template = null,
+		array $data = [],
+		string|null $fallback = '',
+		string $handler = 'template'
+	): string {
+		if ($template === null) {
+			return $this->id() ?? '';
+		}
+
+		if ($handler !== 'template' && $handler !== 'safeTemplate') {
+			throw new InvalidArgumentException('Invalid toString handler'); // @codeCoverageIgnore
+		}
+
+		$result = Str::$handler($template, array_replace([
+			'kirby'             => $this->kirby(),
+			'site'              => $this instanceof Site ? $this : $this->site(),
+			'model'             => $this,
+			static::CLASS_ALIAS => $this,
+		], $data), ['fallback' => $fallback]);
+
+		return $result;
+	}
+
+	/**
+	 * Makes it possible to convert the entire model
+	 * to a string. Mostly useful for debugging
+	 */
+	public function __toString(): string
+	{
+		return $this->id();
+	}
+
+	/**
+	 * Returns a single translation by language code
+	 * If no code is specified the current translation is returned
+	 */
+	public function translation(
+		string $languageCode = null
+	): ContentTranslation|null {
+		if ($language = $this->kirby()->language($languageCode)) {
+			return $this->translations()->find($language->code());
+		}
+
+		return null;
+	}
+
+	/**
+	 * Returns the translations collection
+	 */
+	public function translations(): Collection
+	{
+		if ($this->translations !== null) {
+			return $this->translations;
+		}
+
+		$this->translations = new Collection();
+
+		foreach ($this->kirby()->languages() as $language) {
+			$translation = new ContentTranslation([
+				'parent' => $this,
+				'code'   => $language->code(),
+			]);
+
+			$this->translations->data[$translation->code()] = $translation;
+		}
+
+		return $this->translations;
+	}
+
+	/**
+	 * Updates the model data
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the input array contains invalid values
+	 */
+	public function update(
+		array $input = null,
+		string $languageCode = null,
+		bool $validate = false
+	): static {
+		$form = Form::for($this, [
+			'ignoreDisabled' => $validate === false,
+			'input'          => $input,
+			'language'       => $languageCode,
+		]);
+
+		// validate the input
+		if ($validate === true && $form->isInvalid() === true) {
+			throw new InvalidArgumentException([
+				'fallback' => 'Invalid form with errors',
+				'details'  => $form->errors()
+			]);
+		}
+
+		return $this->commit(
+			'update',
+			[
+				static::CLASS_ALIAS => $this,
+				'values'            => $form->data(),
+				'strings'           => $form->strings(),
+				'languageCode'      => $languageCode
+			],
+			fn ($model, $values, $strings, $languageCode) =>
+				$model->save($strings, $languageCode, true)
+		);
+	}
+
+	/**
+	 * Returns the model's UUID
+	 * @since 3.8.0
+	 */
+	public function uuid(): Uuid|null
+	{
+		return Uuid::for($this);
+	}
+
+	/**
+	 * Low level data writer method
+	 * to store the given data on disk or anywhere else
+	 * @internal
+	 */
+	public function writeContent(array $data, string $languageCode = null): bool
+	{
+		$data = $this->contentFileData($data, $languageCode);
+		$id   = $this->storage()->defaultVersion();
+
+		try {
+			// we can only update if the version already exists
+			$this->storage()->update($id, $languageCode, $data);
+		} catch (NotFoundException) {
+			// otherwise create a new version
+			$this->storage()->create($id, $languageCode, $data);
+		}
+
+		return true;
+	}
+}

kirby/src/Cms/Nest.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Content\Field;
+
+/**
+ * The Nest class converts any array type
+ * into a Kirby style collection/object. This
+ * can be used make any type of array compatible
+ * with Kirby queries.
+ *
+ * REFACTOR: move this to the toolkit
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Nest
+{
+	public static function create(
+		$data,
+		object|null $parent = null
+	): NestCollection|NestObject|Field {
+		if (is_scalar($data) === true) {
+			return new Field($parent, $data, $data);
+		}
+
+		$result = [];
+
+		foreach ($data as $key => $value) {
+			if (is_array($value) === true) {
+				$result[$key] = static::create($value, $parent);
+			} elseif (is_scalar($value) === true) {
+				$result[$key] = new Field($parent, $key, $value);
+			}
+		}
+
+		$key = key($data);
+
+		if ($key === null || is_int($key) === true) {
+			return new NestCollection($result);
+		}
+
+		return new NestObject($result);
+	}
+}

kirby/src/Cms/NestCollection.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Closure;
+use Kirby\Toolkit\Collection as BaseCollection;
+
+/**
+ * NestCollection
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class NestCollection extends BaseCollection
+{
+	/**
+	 * Converts all objects in the collection
+	 * to an array. This can also take a callback
+	 * function to further modify the array result.
+	 */
+	public function toArray(Closure $map = null): array
+	{
+		return parent::toArray($map ?? fn ($object) => $object->toArray());
+	}
+}

kirby/src/Cms/NestObject.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Content\Field;
+use Kirby\Toolkit\Obj;
+
+/**
+ * NestObject
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class NestObject extends Obj
+{
+	/**
+	 * Converts the object to an array
+	 */
+	public function toArray(): array
+	{
+		$result = [];
+
+		foreach ((array)$this as $key => $value) {
+			if ($value instanceof Field) {
+				$result[$key] = $value->value();
+				continue;
+			}
+
+			if (
+				is_object($value) === true &&
+				method_exists($value, 'toArray')
+			) {
+				$result[$key] = $value->toArray();
+				continue;
+			}
+
+			$result[$key] = $value;
+		}
+
+		return $result;
+	}
+}

kirby/src/Cms/PageBlueprint.php

@@ -0,0 +1,193 @@
+<?php
+
+namespace Kirby\Cms;
+
+/**
+ * PageBlueprint
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class PageBlueprint extends Blueprint
+{
+	/**
+	 * Creates a new page blueprint object
+	 * with the given props
+	 */
+	public function __construct(array $props)
+	{
+		parent::__construct($props);
+
+		// normalize all available page options
+		$this->props['options'] = $this->normalizeOptions(
+			$this->props['options'] ?? true,
+			// defaults
+			[
+				'access'     	 => null,
+				'changeSlug'     => null,
+				'changeStatus'   => null,
+				'changeTemplate' => null,
+				'changeTitle'    => null,
+				'create'         => null,
+				'delete'         => null,
+				'duplicate'      => null,
+				'list'           => null,
+				'move'           => null,
+				'preview'        => null,
+				'read'           => null,
+				'sort'           => null,
+				'update'         => null,
+			],
+			// aliases (from v2)
+			[
+				'status'   => 'changeStatus',
+				'template' => 'changeTemplate',
+				'title'    => 'changeTitle',
+				'url'      => 'changeSlug',
+			]
+		);
+
+		// normalize the ordering number
+		$this->props['num'] = $this->normalizeNum($this->props['num'] ?? 'default');
+
+		// normalize the available status array
+		$this->props['status'] = $this->normalizeStatus($this->props['status'] ?? null);
+	}
+
+	/**
+	 * Returns the page numbering mode
+	 */
+	public function num(): string
+	{
+		return $this->props['num'];
+	}
+
+	/**
+	 * Normalizes the ordering number
+	 *
+	 * @param mixed $num
+	 */
+	protected function normalizeNum($num): string
+	{
+		$aliases = [
+			'0'    => 'zero',
+			'sort' => 'default',
+		];
+
+		return $aliases[$num] ?? $num;
+	}
+
+	/**
+	 * Normalizes the available status options for the page
+	 *
+	 * @param mixed $status
+	 */
+	protected function normalizeStatus($status): array
+	{
+		$defaults = [
+			'draft'    => [
+				'label' => $this->i18n('page.status.draft'),
+				'text'  => $this->i18n('page.status.draft.description'),
+			],
+			'unlisted' => [
+				'label' => $this->i18n('page.status.unlisted'),
+				'text'  => $this->i18n('page.status.unlisted.description'),
+			],
+			'listed' => [
+				'label' => $this->i18n('page.status.listed'),
+				'text'  => $this->i18n('page.status.listed.description'),
+			]
+		];
+
+		// use the defaults, when the status is not defined
+		if (empty($status) === true) {
+			$status = $defaults;
+		}
+
+		// extend the status definition
+		$status = $this->extend($status);
+
+		// clean up and translate each status
+		foreach ($status as $key => $options) {
+			// skip invalid status definitions
+			if (in_array($key, ['draft', 'listed', 'unlisted']) === false || $options === false) {
+				unset($status[$key]);
+				continue;
+			}
+
+			if ($options === true) {
+				$status[$key] = $defaults[$key];
+				continue;
+			}
+
+			// convert everything to a simple array
+			if (is_array($options) === false) {
+				$status[$key] = [
+					'label' => $options,
+					'text'  => null
+				];
+			}
+
+			// always make sure to have a proper label
+			if (empty($status[$key]['label']) === true) {
+				$status[$key]['label'] = $defaults[$key]['label'];
+			}
+
+			// also make sure to have the text field set
+			$status[$key]['text'] ??= null;
+
+			// translate text and label if necessary
+			$status[$key]['label'] = $this->i18n($status[$key]['label'], $status[$key]['label']);
+			$status[$key]['text']  = $this->i18n($status[$key]['text'], $status[$key]['text']);
+		}
+
+		// the draft status is required
+		if (isset($status['draft']) === false) {
+			$status = ['draft' => $defaults['draft']] + $status;
+		}
+
+		// remove the draft status for the home and error pages
+		if ($this->model->isHomeOrErrorPage() === true) {
+			unset($status['draft']);
+		}
+
+		return $status;
+	}
+
+	/**
+	 * Returns the options object
+	 * that handles page options and permissions
+	 */
+	public function options(): array
+	{
+		return $this->props['options'];
+	}
+
+	/**
+	 * Returns the preview settings
+	 * The preview setting controls the "Open"
+	 * button in the panel and redirects it to a
+	 * different URL if necessary.
+	 */
+	public function preview(): string|bool
+	{
+		$preview = $this->props['options']['preview'] ?? true;
+
+		if (is_string($preview) === true) {
+			return $this->model->toString($preview);
+		}
+
+		return $preview;
+	}
+
+	/**
+	 * Returns the status array
+	 */
+	public function status(): array
+	{
+		return $this->props['status'];
+	}
+}

kirby/src/Cms/PagePermissions.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace Kirby\Cms;
+
+/**
+ * PagePermissions
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class PagePermissions extends ModelPermissions
+{
+	protected string $category = 'pages';
+
+	protected function canChangeSlug(): bool
+	{
+		return $this->model->isHomeOrErrorPage() !== true;
+	}
+
+	protected function canChangeStatus(): bool
+	{
+		return $this->model->isErrorPage() !== true;
+	}
+
+	protected function canChangeTemplate(): bool
+	{
+		if ($this->model->isErrorPage() === true) {
+			return false;
+		}
+
+		if (count($this->model->blueprints()) <= 1) {
+			return false;
+		}
+
+		return true;
+	}
+
+	protected function canDelete(): bool
+	{
+		return $this->model->isHomeOrErrorPage() !== true;
+	}
+
+	protected function canMove(): bool
+	{
+		return $this->model->isHomeOrErrorPage() !== true;
+	}
+
+	protected function canSort(): bool
+	{
+		if ($this->model->isErrorPage() === true) {
+			return false;
+		}
+
+		if ($this->model->isListed() !== true) {
+			return false;
+		}
+
+		if ($this->model->blueprint()->num() !== 'default') {
+			return false;
+		}
+
+		return true;
+	}
+}

kirby/src/Cms/PagePicker.php

@@ -0,0 +1,224 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Exception\InvalidArgumentException;
+
+/**
+ * The PagePicker class helps to
+ * fetch the right pages and the parent
+ * model for the API calls for the
+ * page picker component in the panel.
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class PagePicker extends Picker
+{
+	// TODO: null only due to our Properties setters,
+	// remove once our implementation is better
+	protected Pages|null $items = null;
+	protected Pages|null $itemsForQuery = null;
+	protected Page|Site|null $parent = null;
+
+	/**
+	 * Extends the basic defaults
+	 */
+	public function defaults(): array
+	{
+		return array_merge(parent::defaults(), [
+			// Page ID of the selected parent. Used to navigate
+			'parent' => null,
+			// enable/disable subpage navigation
+			'subpages' => true,
+		]);
+	}
+
+	/**
+	 * Returns the parent model object that
+	 * is currently selected in the page picker.
+	 * It normally starts at the site, but can
+	 * also be any subpage. When a query is given
+	 * and subpage navigation is deactivated,
+	 * there will be no model available at all.
+	 */
+	public function model(): Page|Site|null
+	{
+		// no subpages navigation = no model
+		if ($this->options['subpages'] === false) {
+			return null;
+		}
+
+		// the model for queries is a bit more tricky to find
+		if (empty($this->options['query']) === false) {
+			return $this->modelForQuery();
+		}
+
+		return $this->parent();
+	}
+
+	/**
+	 * Returns a model object for the given
+	 * query, depending on the parent and subpages
+	 * options.
+	 */
+	public function modelForQuery(): Page|Site|null
+	{
+		if ($this->options['subpages'] === true && empty($this->options['parent']) === false) {
+			return $this->parent();
+		}
+
+		return $this->items()?->parent();
+	}
+
+	/**
+	 * Returns basic information about the
+	 * parent model that is currently selected
+	 * in the page picker.
+	 */
+	public function modelToArray(Page|Site $model = null): array|null
+	{
+		if ($model === null) {
+			return null;
+		}
+
+		// the selected model is the site. there's nothing above
+		if ($model instanceof Site) {
+			return [
+				'id'     => null,
+				'parent' => null,
+				'title'  => $model->title()->value()
+			];
+		}
+
+		// the top-most page has been reached
+		// the missing id indicates that there's nothing above
+		if ($model->id() === $this->start()->id()) {
+			return [
+				'id'     => null,
+				'parent' => null,
+				'title'  => $model->title()->value()
+			];
+		}
+
+		// the model is a regular page
+		return [
+			'id'     => $model->id(),
+			'parent' => $model->parentModel()->id(),
+			'title'  => $model->title()->value()
+		];
+	}
+
+	/**
+	 * Search all pages for the picker
+	 */
+	public function items(): Pages|null
+	{
+		// cache
+		if ($this->items !== null) {
+			return $this->items;
+		}
+
+		// no query? simple parent-based search for pages
+		if (empty($this->options['query']) === true) {
+			$items = $this->itemsForParent();
+
+		// when subpage navigation is enabled, a parent
+		// might be passed in addition to the query.
+		// The parent then takes priority.
+		} elseif ($this->options['subpages'] === true && empty($this->options['parent']) === false) {
+			$items = $this->itemsForParent();
+
+		// search by query
+		} else {
+			$items = $this->itemsForQuery();
+		}
+
+		// filter protected and hidden pages
+		$items = $items->filter('isListable', true);
+
+		// search
+		$items = $this->search($items);
+
+		// paginate the result
+		return $this->items = $this->paginate($items);
+	}
+
+	/**
+	 * Search for pages by parent
+	 */
+	public function itemsForParent(): Pages
+	{
+		return $this->parent()->children();
+	}
+
+	/**
+	 * Search for pages by query string
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException
+	 */
+	public function itemsForQuery(): Pages
+	{
+		// cache
+		if ($this->itemsForQuery !== null) {
+			return $this->itemsForQuery;
+		}
+
+		$model = $this->options['model'];
+		$items = $model->query($this->options['query']);
+
+		// help mitigate some typical query usage issues
+		// by converting site and page objects to proper
+		// pages by returning their children
+		$items = match (true) {
+			$items instanceof Site,
+			$items instanceof Page  => $items->children(),
+			$items instanceof Pages => $items,
+
+			default => throw new InvalidArgumentException('Your query must return a set of pages')
+		};
+
+		return $this->itemsForQuery = $items;
+	}
+
+	/**
+	 * Returns the parent model.
+	 * The model will be used to fetch
+	 * subpages unless there's a specific
+	 * query to find pages instead.
+	 */
+	public function parent(): Page|Site
+	{
+		return $this->parent ??= $this->kirby->page($this->options['parent']) ?? $this->site;
+	}
+
+	/**
+	 * Calculates the top-most model (page or site)
+	 * that can be accessed when navigating
+	 * through pages.
+	 */
+	public function start(): Page|Site
+	{
+		if (empty($this->options['query']) === false) {
+			return $this->itemsForQuery()?->parent() ?? $this->site;
+		}
+
+		return $this->site;
+	}
+
+	/**
+	 * Returns an associative array
+	 * with all information for the picker.
+	 * This will be passed directly to the API.
+	 */
+	public function toArray(): array
+	{
+		$array = parent::toArray();
+		$array['model'] = $this->modelToArray($this->model());
+
+		return $array;
+	}
+}

kirby/src/Cms/PageRules.php

@@ -0,0 +1,518 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Exception\DuplicateException;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Exception\LogicException;
+use Kirby\Exception\PermissionException;
+use Kirby\Toolkit\A;
+use Kirby\Toolkit\Str;
+
+/**
+ * Validators for all page actions
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class PageRules
+{
+	/**
+	 * Validates if the sorting number of the page can be changed
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the given number is invalid
+	 */
+	public static function changeNum(Page $page, int $num = null): bool
+	{
+		if ($num !== null && $num < 0) {
+			throw new InvalidArgumentException(['key' => 'page.num.invalid']);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Validates if the slug for the page can be changed
+	 *
+	 * @throws \Kirby\Exception\DuplicateException If a page with this slug already exists
+	 * @throws \Kirby\Exception\PermissionException If the user is not allowed to change the slug
+	 */
+	public static function changeSlug(Page $page, string $slug): bool
+	{
+		if ($page->permissions()->changeSlug() !== true) {
+			throw new PermissionException([
+				'key'  => 'page.changeSlug.permission',
+				'data' => [
+					'slug' => $page->slug()
+				]
+			]);
+		}
+
+		self::validateSlugLength($slug);
+		self::validateSlugProtectedPaths($page, $slug);
+
+		$siblings = $page->parentModel()->children();
+		$drafts   = $page->parentModel()->drafts();
+
+		if ($siblings->find($slug)?->is($page) === false) {
+			throw new DuplicateException([
+				'key'  => 'page.duplicate',
+				'data' => [
+					'slug' => $slug
+				]
+			]);
+		}
+
+		if ($drafts->find($slug)?->is($page) === false) {
+			throw new DuplicateException([
+				'key'  => 'page.draft.duplicate',
+				'data' => [
+					'slug' => $slug
+				]
+			]);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Validates if the status for the page can be changed
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the given status is invalid
+	 */
+	public static function changeStatus(
+		Page $page,
+		string $status,
+		int $position = null
+	): bool {
+		if (isset($page->blueprint()->status()[$status]) === false) {
+			throw new InvalidArgumentException(['key' => 'page.status.invalid']);
+		}
+
+		return match ($status) {
+			'draft'     => static::changeStatusToDraft($page),
+			'listed'    => static::changeStatusToListed($page, $position),
+			'unlisted'  => static::changeStatusToUnlisted($page),
+			default     => throw new InvalidArgumentException(['key' => 'page.status.invalid'])
+		};
+	}
+
+	/**
+	 * Validates if a page can be converted to a draft
+	 *
+	 * @throws \Kirby\Exception\PermissionException If the user is not allowed to change the status or the page cannot be converted to a draft
+	 */
+	public static function changeStatusToDraft(Page $page): bool
+	{
+		if ($page->permissions()->changeStatus() !== true) {
+			throw new PermissionException([
+				'key'  => 'page.changeStatus.permission',
+				'data' => [
+					'slug' => $page->slug()
+				]
+			]);
+		}
+
+		if ($page->isHomeOrErrorPage() === true) {
+			throw new PermissionException([
+				'key'  => 'page.changeStatus.toDraft.invalid',
+				'data' => [
+					'slug' => $page->slug()
+				]
+			]);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Validates if the status of a page can be changed to listed
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the given position is invalid
+	 * @throws \Kirby\Exception\PermissionException If the user is not allowed to change the status or the status for the page cannot be changed by any user
+	 */
+	public static function changeStatusToListed(Page $page, int $position): bool
+	{
+		// no need to check for status changing permissions,
+		// instead we need to check for sorting permissions
+		if ($page->isListed() === true) {
+			if ($page->isSortable() !== true) {
+				throw new PermissionException([
+					'key'  => 'page.sort.permission',
+					'data' => [
+						'slug' => $page->slug()
+					]
+				]);
+			}
+
+			return true;
+		}
+
+		static::publish($page);
+
+		if ($position !== null && $position < 0) {
+			throw new InvalidArgumentException(['key' => 'page.num.invalid']);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Validates if the status of a page can be changed to unlisted
+	 *
+	 * @throws \Kirby\Exception\PermissionException If the user is not allowed to change the status
+	 */
+	public static function changeStatusToUnlisted(Page $page)
+	{
+		static::publish($page);
+
+		return true;
+	}
+
+	/**
+	 * Validates if the template of the page can be changed
+	 *
+	 * @throws \Kirby\Exception\LogicException If the template of the page cannot be changed at all
+	 * @throws \Kirby\Exception\PermissionException If the user is not allowed to change the template
+	 */
+	public static function changeTemplate(Page $page, string $template): bool
+	{
+		if ($page->permissions()->changeTemplate() !== true) {
+			throw new PermissionException([
+				'key'  => 'page.changeTemplate.permission',
+				'data' => [
+					'slug' => $page->slug()
+				]
+			]);
+		}
+
+		$blueprints = $page->blueprints();
+
+		if (
+			count($blueprints) <= 1 ||
+			in_array($template, array_column($blueprints, 'name')) === false
+		) {
+			throw new LogicException([
+				'key'  => 'page.changeTemplate.invalid',
+				'data' => ['slug' => $page->slug()]
+			]);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Validates if the title of the page can be changed
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the new title is empty
+	 * @throws \Kirby\Exception\PermissionException If the user is not allowed to change the title
+	 */
+	public static function changeTitle(Page $page, string $title): bool
+	{
+		if ($page->permissions()->changeTitle() !== true) {
+			throw new PermissionException([
+				'key'  => 'page.changeTitle.permission',
+				'data' => [
+					'slug' => $page->slug()
+				]
+			]);
+		}
+
+		static::validateTitleLength($title);
+
+		return true;
+	}
+
+	/**
+	 * Validates if the page can be created
+	 *
+	 * @throws \Kirby\Exception\DuplicateException If the same page or a draft already exists
+	 * @throws \Kirby\Exception\InvalidArgumentException If the slug is invalid
+	 * @throws \Kirby\Exception\PermissionException If the user is not allowed to create this page
+	 */
+	public static function create(Page $page): bool
+	{
+		if ($page->permissions()->create() !== true) {
+			throw new PermissionException([
+				'key' => 'page.create.permission',
+				'data' => [
+					'slug' => $page->slug()
+				]
+			]);
+		}
+
+		self::validateSlugLength($page->slug());
+		self::validateSlugProtectedPaths($page, $page->slug());
+
+		if ($page->exists() === true) {
+			throw new DuplicateException([
+				'key'  => 'page.draft.duplicate',
+				'data' => [
+					'slug' => $page->slug()
+				]
+			]);
+		}
+
+		$siblings = $page->parentModel()->children();
+		$drafts   = $page->parentModel()->drafts();
+		$slug     = $page->slug();
+
+		if ($siblings->find($slug)) {
+			throw new DuplicateException([
+				'key'  => 'page.duplicate',
+				'data' => ['slug' => $slug]
+			]);
+		}
+
+		if ($drafts->find($slug)) {
+			throw new DuplicateException([
+				'key'  => 'page.draft.duplicate',
+				'data' => ['slug' => $slug]
+			]);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Validates if the page can be deleted
+	 *
+	 * @throws \Kirby\Exception\LogicException If the page has children and should not be force-deleted
+	 * @throws \Kirby\Exception\PermissionException If the user is not allowed to delete the page
+	 */
+	public static function delete(Page $page, bool $force = false): bool
+	{
+		if ($page->permissions()->delete() !== true) {
+			throw new PermissionException([
+				'key' => 'page.delete.permission',
+				'data' => [
+					'slug' => $page->slug()
+				]
+			]);
+		}
+
+		if (($page->hasChildren() === true || $page->hasDrafts() === true) && $force === false) {
+			throw new LogicException(['key' => 'page.delete.hasChildren']);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Validates if the page can be duplicated
+	 *
+	 * @throws \Kirby\Exception\PermissionException If the user is not allowed to duplicate the page
+	 */
+	public static function duplicate(
+		Page $page,
+		string $slug,
+		array $options = []
+	): bool {
+		if ($page->permissions()->duplicate() !== true) {
+			throw new PermissionException([
+				'key' => 'page.duplicate.permission',
+				'data' => [
+					'slug' => $page->slug()
+				]
+			]);
+		}
+
+		self::validateSlugLength($slug);
+
+		return true;
+	}
+
+	/**
+	 * Check if the page can be moved
+	 * to the given parent
+	 */
+	public static function move(Page $page, Site|Page $parent): bool
+	{
+		// if nothing changes, there's no need for checks
+		if ($parent->is($page->parent()) === true) {
+			return true;
+		}
+
+		if ($page->permissions()->move() !== true) {
+			throw new PermissionException([
+				'key' => 'page.move.permission',
+				'data' => [
+					'slug' => $page->slug()
+				]
+			]);
+		}
+
+		// the page cannot be moved into itself
+		if ($parent instanceof Page && ($page->is($parent) === true || $page->isAncestorOf($parent) === true)) {
+			throw new LogicException([
+				'key' => 'page.move.ancestor',
+			]);
+		}
+
+		// check for duplicates
+		if ($parent->childrenAndDrafts()->find($page->slug())) {
+			throw new DuplicateException([
+				'key'  => 'page.move.duplicate',
+				'data' => [
+					'slug' => $page->slug(),
+				]
+			]);
+		}
+
+		$allowed = [];
+
+		// collect all allowed subpage templates
+		foreach ($parent->blueprint()->sections() as $section) {
+			// only take pages sections into consideration
+			if ($section->type() !== 'pages') {
+				continue;
+			}
+
+			// only consider page sections that list pages
+			// of the targeted new parent page
+			if ($section->parent() !== $parent) {
+				continue;
+			}
+
+			// go through all allowed blueprints and
+			// add the name to the allow list
+			foreach ($section->blueprints() as $blueprint) {
+				$allowed[] = $blueprint['name'];
+			}
+		}
+
+		// check if the template of this page is allowed as subpage type
+		if (in_array($page->intendedTemplate()->name(), $allowed) === false) {
+			throw new PermissionException([
+				'key'  => 'page.move.template',
+				'data' => [
+					'template' => $page->intendedTemplate()->name(),
+					'parent'   => $parent->id() ?? '/',
+				]
+			]);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Check if the page can be published
+	 * (status change from draft to listed or unlisted)
+	 */
+	public static function publish(Page $page): bool
+	{
+		if ($page->permissions()->changeStatus() !== true) {
+			throw new PermissionException([
+				'key'  => 'page.changeStatus.permission',
+				'data' => [
+					'slug' => $page->slug()
+				]
+			]);
+		}
+
+		if ($page->isDraft() === true && empty($page->errors()) === false) {
+			throw new PermissionException([
+				'key'     => 'page.changeStatus.incomplete',
+				'details' => $page->errors()
+			]);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Validates if the page can be updated
+	 *
+	 * @throws \Kirby\Exception\PermissionException If the user is not allowed to update the page
+	 */
+	public static function update(Page $page, array $content = []): bool
+	{
+		if ($page->permissions()->update() !== true) {
+			throw new PermissionException([
+				'key'  => 'page.update.permission',
+				'data' => [
+					'slug' => $page->slug()
+				]
+			]);
+		}
+
+		return true;
+	}
+
+	/**
+	 * Ensures that the slug is not empty and doesn't exceed the maximum length
+	 * to make sure that the directory name will be accepted by the filesystem
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the slug is empty or too long
+	 */
+	public static function validateSlugLength(string $slug): void
+	{
+		$slugLength = Str::length($slug);
+
+		if ($slugLength === 0) {
+			throw new InvalidArgumentException([
+				'key' => 'page.slug.invalid',
+			]);
+		}
+
+		if ($slugsMaxlength = App::instance()->option('slugs.maxlength', 255)) {
+			$maxlength = (int)$slugsMaxlength;
+
+			if ($slugLength > $maxlength) {
+				throw new InvalidArgumentException([
+					'key'  => 'page.slug.maxlength',
+					'data' => [
+						'length' => $maxlength
+					]
+				]);
+			}
+		}
+	}
+
+
+	/**
+	 * Ensure that a top-level page path does not start with one of
+	 * the reserved URL paths, e.g. for API or the Panel
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the page ID starts as one of the disallowed paths
+	 */
+	protected static function validateSlugProtectedPaths(
+		Page $page,
+		string $slug
+	): void {
+		if ($page->parent() === null) {
+			$paths = A::map(
+				['api', 'assets', 'media', 'panel'],
+				fn ($url) => $page->kirby()->url($url, true)->path()->toString()
+			);
+
+			$index = array_search($slug, $paths);
+
+			if ($index !== false) {
+				throw new InvalidArgumentException([
+					'key'  => 'page.changeSlug.reserved',
+					'data' => [
+						'path' => $paths[$index]
+					]
+				]);
+			}
+		}
+	}
+
+	/**
+	 * Ensures that the page title is not empty
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the title is empty
+	 */
+	public static function validateTitleLength(string $title): void
+	{
+		if (Str::length($title) === 0) {
+			throw new InvalidArgumentException([
+				'key' => 'page.changeTitle.empty',
+			]);
+		}
+	}
+}

kirby/src/Cms/PageSiblings.php

@@ -0,0 +1,131 @@
+<?php
+
+namespace Kirby\Cms;
+
+/**
+ * PageSiblings
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+trait PageSiblings
+{
+	/**
+	 * Checks if there's a next listed
+	 * page in the siblings collection
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 */
+	public function hasNextListed($collection = null): bool
+	{
+		return $this->nextListed($collection) !== null;
+	}
+
+	/**
+	 * Checks if there's a next unlisted
+	 * page in the siblings collection
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 */
+	public function hasNextUnlisted($collection = null): bool
+	{
+		return $this->nextUnlisted($collection) !== null;
+	}
+
+	/**
+	 * Checks if there's a previous listed
+	 * page in the siblings collection
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 */
+	public function hasPrevListed($collection = null): bool
+	{
+		return $this->prevListed($collection) !== null;
+	}
+
+	/**
+	 * Checks if there's a previous unlisted
+	 * page in the siblings collection
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 */
+	public function hasPrevUnlisted($collection = null): bool
+	{
+		return $this->prevUnlisted($collection) !== null;
+	}
+
+	/**
+	 * Returns the next listed page if it exists
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 *
+	 * @return \Kirby\Cms\Page|null
+	 */
+	public function nextListed($collection = null)
+	{
+		return $this->nextAll($collection)->listed()->first();
+	}
+
+	/**
+	 * Returns the next unlisted page if it exists
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 *
+	 * @return \Kirby\Cms\Page|null
+	 */
+	public function nextUnlisted($collection = null)
+	{
+		return $this->nextAll($collection)->unlisted()->first();
+	}
+
+	/**
+	 * Returns the previous listed page
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 *
+	 * @return \Kirby\Cms\Page|null
+	 */
+	public function prevListed($collection = null)
+	{
+		return $this->prevAll($collection)->listed()->last();
+	}
+
+	/**
+	 * Returns the previous unlisted page
+	 *
+	 * @param \Kirby\Cms\Collection|null $collection
+	 *
+	 * @return \Kirby\Cms\Page|null
+	 */
+	public function prevUnlisted($collection = null)
+	{
+		return $this->prevAll($collection)->unlisted()->last();
+	}
+
+	/**
+	 * Private siblings collector
+	 *
+	 * @return \Kirby\Cms\Collection
+	 */
+	protected function siblingsCollection()
+	{
+		if ($this->isDraft() === true) {
+			return $this->parentModel()->drafts();
+		}
+
+		return $this->parentModel()->children();
+	}
+
+	/**
+	 * Returns siblings with the same template
+	 *
+	 * @return \Kirby\Cms\Pages
+	 */
+	public function templateSiblings(bool $self = true)
+	{
+		return $this->siblings($self)->filter('intendedTemplate', $this->intendedTemplate()->name());
+	}
+}

kirby/src/Cms/Pages.php

@@ -0,0 +1,495 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Uuid\HasUuids;
+
+/**
+ * The `$pages` object refers to a
+ * collection of pages. The pages in this
+ * collection can have the same or different
+ * parents, they can actually exist as
+ * subfolders in the content folder or be
+ * virtual pages created from a database,
+ * an Excel sheet, any API or any other
+ * source.
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Pages extends Collection
+{
+	use HasUuids;
+
+	/**
+	 * Cache for the index only listed and unlisted pages
+	 *
+	 * @var \Kirby\Cms\Pages|null
+	 */
+	protected $index = null;
+
+	/**
+	 * Cache for the index all statuses also including drafts
+	 *
+	 * @var \Kirby\Cms\Pages|null
+	 */
+	protected $indexWithDrafts = null;
+
+	/**
+	 * All registered pages methods
+	 */
+	public static array $methods = [];
+
+	/**
+	 * Adds a single page or
+	 * an entire second collection to the
+	 * current collection
+	 *
+	 * @param \Kirby\Cms\Pages|\Kirby\Cms\Page|string $object
+	 * @return $this
+	 * @throws \Kirby\Exception\InvalidArgumentException When no `Page` or `Pages` object or an ID of an existing page is passed
+	 */
+	public function add($object): static
+	{
+		$site = App::instance()->site();
+
+		// add a pages collection
+		if ($object instanceof self) {
+			$this->data = array_merge($this->data, $object->data);
+
+		// add a page by id
+		} elseif (
+			is_string($object) === true &&
+			$page = $site->find($object)
+		) {
+			$this->__set($page->id(), $page);
+
+		// add a page object
+		} elseif ($object instanceof Page) {
+			$this->__set($object->id(), $object);
+
+		// give a useful error message on invalid input;
+		// silently ignore "empty" values for compatibility with existing setups
+		} elseif (in_array($object, [null, false, true], true) !== true) {
+			throw new InvalidArgumentException('You must pass a Pages or Page object or an ID of an existing page to the Pages collection');
+		}
+
+		return $this;
+	}
+
+	/**
+	 * Returns all audio files of all children
+	 */
+	public function audio(): Files
+	{
+		return $this->files()->filter('type', 'audio');
+	}
+
+	/**
+	 * Returns all children for each page in the array
+	 */
+	public function children(): Pages
+	{
+		$children = new Pages([]);
+
+		foreach ($this->data as $page) {
+			foreach ($page->children() as $childKey => $child) {
+				$children->data[$childKey] = $child;
+			}
+		}
+
+		return $children;
+	}
+
+	/**
+	 * Returns all code files of all children
+	 */
+	public function code(): Files
+	{
+		return $this->files()->filter('type', 'code');
+	}
+
+	/**
+	 * Returns all documents of all children
+	 */
+	public function documents(): Files
+	{
+		return $this->files()->filter('type', 'document');
+	}
+
+	/**
+	 * Fetch all drafts for all pages in the collection
+	 */
+	public function drafts(): Pages
+	{
+		$drafts = new Pages([]);
+
+		foreach ($this->data as $page) {
+			foreach ($page->drafts() as $draftKey => $draft) {
+				$drafts->data[$draftKey] = $draft;
+			}
+		}
+
+		return $drafts;
+	}
+
+	/**
+	 * Creates a pages collection from an array of props
+	 */
+	public static function factory(
+		array $pages,
+		Page|Site $model = null,
+		bool $draft = null
+	): static {
+		$model  ??= App::instance()->site();
+		$children = new static([], $model);
+
+		if ($model instanceof Page) {
+			$parent = $model;
+			$site   = $model->site();
+		} else {
+			$parent = null;
+			$site   = $model;
+		}
+
+		foreach ($pages as $props) {
+			$props['parent']  = $parent;
+			$props['site']    = $site;
+			$props['isDraft'] = $draft ?? $props['isDraft'] ?? $props['draft'] ?? false;
+
+			$page = Page::factory($props);
+
+			$children->data[$page->id()] = $page;
+		}
+
+		return $children;
+	}
+
+	/**
+	 * Returns all files of all children
+	 */
+	public function files(): Files
+	{
+		$files = new Files([], $this->parent);
+
+		foreach ($this->data as $page) {
+			foreach ($page->files() as $fileKey => $file) {
+				$files->data[$fileKey] = $file;
+			}
+		}
+
+		return $files;
+	}
+
+	/**
+	 * Finds a page by its ID or URI
+	 * @internal Use `$pages->find()` instead
+	 */
+	public function findByKey(string|null $key = null): Page|null
+	{
+		if ($key === null) {
+			return null;
+		}
+
+		if ($page = $this->findByUuid($key, 'page')) {
+			return $page;
+		}
+
+		// remove trailing or leading slashes
+		$key = trim($key, '/');
+
+		// strip extensions from the id
+		if (strpos($key, '.') !== false) {
+			$info = pathinfo($key);
+
+			if ($info['dirname'] !== '.') {
+				$key = $info['dirname'] . '/' . $info['filename'];
+			} else {
+				$key = $info['filename'];
+			}
+		}
+
+		// try the obvious way
+		if ($page = $this->get($key)) {
+			return $page;
+		}
+
+		$kirby     = App::instance();
+		$multiLang = $kirby->multilang();
+
+		// try to find the page by its (translated) URI
+		// by stepping through the page tree
+		$start = $this->parent instanceof Page ? $this->parent->id() : '';
+		if ($page = $this->findByKeyRecursive($key, $start, $multiLang)) {
+			return $page;
+		}
+
+		// for secondary languages, try the full translated URI
+		// (for collections without parent that won't have a result above)
+		if (
+			$multiLang === true &&
+			$kirby->language()->isDefault() === false &&
+			$page = $this->findBy('uri', $key)
+		) {
+			return $page;
+		}
+
+		return null;
+	}
+
+	/**
+	 * Finds a child or child of a child recursively
+	 *
+	 * @return mixed
+	 */
+	protected function findByKeyRecursive(
+		string $id,
+		string $startAt = null,
+		bool $multiLang = false
+	) {
+		$path       = explode('/', $id);
+		$item       = null;
+		$query      = $startAt;
+
+		foreach ($path as $key) {
+			$collection = $item?->children() ?? $this;
+			$query      = ltrim($query . '/' . $key, '/');
+			$item       = $collection->get($query) ?? null;
+
+			if (
+				$item === null &&
+				$multiLang === true &&
+				App::instance()->language()->isDefault() === false
+			) {
+				if (count($path) > 1 || $collection->parent()) {
+					// either the desired path is definitely not a slug,
+					// or collection is the children of another collection
+					$item = $collection->findBy('slug', $key);
+				} else {
+					// desired path _could_ be a slug or a "top level" uri
+					$item = $collection->findBy('uri', $key);
+				}
+			}
+
+			if ($item === null) {
+				return null;
+			}
+		}
+
+		return $item;
+	}
+
+	/**
+	 * Finds the currently open page
+	 */
+	public function findOpen(): Page|null
+	{
+		return $this->findBy('isOpen', true);
+	}
+
+	/**
+	 * Custom getter that is able to find
+	 * extension pages
+	 *
+	 * @param string $key
+	 * @param mixed $default
+	 * @return \Kirby\Cms\Page|null
+	 */
+	public function get($key, $default = null)
+	{
+		if ($key === null) {
+			return null;
+		}
+
+		if ($item = parent::get($key)) {
+			return $item;
+		}
+
+		return App::instance()->extension('pages', $key);
+	}
+
+	/**
+	 * Returns all images of all children
+	 */
+	public function images(): Files
+	{
+		return $this->files()->filter('type', 'image');
+	}
+
+	/**
+	 * Create a recursive flat index of all
+	 * pages and subpages, etc.
+	 *
+	 * @return \Kirby\Cms\Pages
+	 */
+	public function index(bool $drafts = false)
+	{
+		// get object property by cache mode
+		$index = $drafts === true ? $this->indexWithDrafts : $this->index;
+
+		if ($index instanceof self) {
+			return $index;
+		}
+
+		$index = new Pages([]);
+
+		foreach ($this->data as $pageKey => $page) {
+			$index->data[$pageKey] = $page;
+			$pageIndex = $page->index($drafts);
+
+			if ($pageIndex) {
+				foreach ($pageIndex as $childKey => $child) {
+					$index->data[$childKey] = $child;
+				}
+			}
+		}
+
+		if ($drafts === true) {
+			return $this->indexWithDrafts = $index;
+		}
+
+		return $this->index = $index;
+	}
+
+	/**
+	 * Returns all listed pages in the collection
+	 */
+	public function listed(): static
+	{
+		return $this->filter('isListed', '==', true);
+	}
+
+	/**
+	 * Returns all unlisted pages in the collection
+	 */
+	public function unlisted(): static
+	{
+		return $this->filter('isUnlisted', '==', true);
+	}
+
+	/**
+	 * Include all given items in the collection
+	 *
+	 * @param mixed ...$args
+	 * @return $this|static
+	 */
+	public function merge(...$args)
+	{
+		// merge multiple arguments at once
+		if (count($args) > 1) {
+			$collection = clone $this;
+			foreach ($args as $arg) {
+				$collection = $collection->merge($arg);
+			}
+			return $collection;
+		}
+
+		// merge all parent drafts
+		if ($args[0] === 'drafts') {
+			if ($parent = $this->parent()) {
+				return $this->merge($parent->drafts());
+			}
+
+			return $this;
+		}
+
+		// merge an entire collection
+		if ($args[0] instanceof self) {
+			$collection = clone $this;
+			$collection->data = array_merge($collection->data, $args[0]->data);
+			return $collection;
+		}
+
+		// append a single page
+		if ($args[0] instanceof Page) {
+			$collection = clone $this;
+			return $collection->set($args[0]->id(), $args[0]);
+		}
+
+		// merge an array
+		if (is_array($args[0]) === true) {
+			$collection = clone $this;
+			foreach ($args[0] as $arg) {
+				$collection = $collection->merge($arg);
+			}
+			return $collection;
+		}
+
+		if (is_string($args[0]) === true) {
+			return $this->merge(App::instance()->site()->find($args[0]));
+		}
+
+		return $this;
+	}
+
+	/**
+	 * Filter all pages by excluding the given template
+	 * @since 3.3.0
+	 *
+	 * @param string|array $templates
+	 * @return \Kirby\Cms\Pages
+	 */
+	public function notTemplate($templates)
+	{
+		if (empty($templates) === true) {
+			return $this;
+		}
+
+		if (is_array($templates) === false) {
+			$templates = [$templates];
+		}
+
+		return $this->filter(
+			fn ($page) =>
+				!in_array($page->intendedTemplate()->name(), $templates)
+		);
+	}
+
+	/**
+	 * Returns an array with all page numbers
+	 */
+	public function nums(): array
+	{
+		return $this->pluck('num');
+	}
+
+	// Returns all listed and unlisted pages in the collection
+	public function published(): static
+	{
+		return $this->filter('isDraft', '==', false);
+	}
+
+	/**
+	 * Filter all pages by the given template
+	 *
+	 * @param string|array $templates
+	 * @return \Kirby\Cms\Pages
+	 */
+	public function template($templates)
+	{
+		if (empty($templates) === true) {
+			return $this;
+		}
+
+		if (is_array($templates) === false) {
+			$templates = [$templates];
+		}
+
+		return $this->filter(
+			fn ($page) =>
+				in_array($page->intendedTemplate()->name(), $templates)
+		);
+	}
+
+	/**
+	 * Returns all video files of all children
+	 */
+	public function videos(): Files
+	{
+		return $this->files()->filter('type', 'video');
+	}
+}

kirby/src/Cms/Pagination.php

@@ -0,0 +1,166 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Http\Uri;
+use Kirby\Toolkit\Pagination as BasePagination;
+
+/**
+ * The `$pagination` object divides
+ * a collection of pages, files etc.
+ * into discrete pages consisting of
+ * the number of defined items. The
+ * pagination object can then be used
+ * to navigate between these pages,
+ * create a navigation etc.
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Pagination extends BasePagination
+{
+	/**
+	 * Pagination method (param, query, none)
+	 *
+	 * @var string
+	 */
+	protected $method;
+
+	/**
+	 * The base URL
+	 *
+	 * @var string
+	 */
+	protected $url;
+
+	/**
+	 * Variable name for query strings
+	 *
+	 * @var string
+	 */
+	protected $variable;
+
+	/**
+	 * Creates the pagination object. As a new
+	 * property you can now pass the base Url.
+	 * That Url must be the Url of the first
+	 * page of the collection without additional
+	 * pagination information/query parameters in it.
+	 *
+	 * ```php
+	 * $pagination = new Pagination([
+	 *     'page'     => 1,
+	 *     'limit'    => 10,
+	 *     'total'    => 120,
+	 *     'method'   => 'query',
+	 *     'variable' => 'p',
+	 *     'url'      => new Uri('https://getkirby.com/blog')
+	 * ]);
+	 * ```
+	 */
+	public function __construct(array $params = [])
+	{
+		$kirby   = App::instance();
+		$config  = $kirby->option('pagination', []);
+		$request = $kirby->request();
+
+		$params['limit']    ??= $config['limit']    ?? 20;
+		$params['method']   ??= $config['method']   ?? 'param';
+		$params['variable'] ??= $config['variable'] ?? 'page';
+
+		if (empty($params['url']) === true) {
+			$params['url'] = new Uri($kirby->url('current'), [
+				'params' => $request->params(),
+				'query'  => $request->query()->toArray(),
+			]);
+		}
+
+		if ($params['method'] === 'query') {
+			$params['page'] ??= $params['url']->query()->get($params['variable']);
+		} elseif ($params['method'] === 'param') {
+			$params['page'] ??= $params['url']->params()->get($params['variable']);
+		}
+
+		parent::__construct($params);
+
+		$this->method   = $params['method'];
+		$this->url      = $params['url'];
+		$this->variable = $params['variable'];
+	}
+
+	/**
+	 * Returns the Url for the first page
+	 */
+	public function firstPageUrl(): string|null
+	{
+		return $this->pageUrl(1);
+	}
+
+	/**
+	 * Returns the Url for the last page
+	 */
+	public function lastPageUrl(): string|null
+	{
+		return $this->pageUrl($this->lastPage());
+	}
+
+	/**
+	 * Returns the Url for the next page.
+	 * Returns null if there's no next page.
+	 */
+	public function nextPageUrl(): string|null
+	{
+		if ($page = $this->nextPage()) {
+			return $this->pageUrl($page);
+		}
+
+		return null;
+	}
+
+	/**
+	 * Returns the URL of the current page.
+	 * If the `$page` variable is set, the URL
+	 * for that page will be returned.
+	 */
+	public function pageUrl(int $page = null): string|null
+	{
+		if ($page === null) {
+			return $this->pageUrl($this->page());
+		}
+
+		$url      = clone $this->url;
+		$variable = $this->variable;
+
+		if ($this->hasPage($page) === false) {
+			return null;
+		}
+
+		$pageValue = $page === 1 ? null : $page;
+
+		if ($this->method === 'query') {
+			$url->query->$variable = $pageValue;
+		} elseif ($this->method === 'param') {
+			$url->params->$variable = $pageValue;
+		} else {
+			return null;
+		}
+
+		return $url->toString();
+	}
+
+	/**
+	 * Returns the Url for the previous page.
+	 * Returns null if there's no previous page.
+	 */
+	public function prevPageUrl(): string|null
+	{
+		if ($page = $this->prevPage()) {
+			return $this->pageUrl($page);
+		}
+
+		return null;
+	}
+}

kirby/src/Cms/Permissions.php

@@ -0,0 +1,213 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Exception\InvalidArgumentException;
+
+/**
+ * Handles permission definition in each user
+ * blueprint and wraps a couple useful methods
+ * around it to check for available permissions.
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Permissions
+{
+	public static array $extendedActions = [];
+
+	protected array $actions = [
+		'access' => [
+			'account'   => true,
+			'languages' => true,
+			'panel'     => true,
+			'site'      => true,
+			'system'    => true,
+			'users'     => true,
+		],
+		'files' => [
+			'access'     	 => true,
+			'changeName'     => true,
+			'changeTemplate' => true,
+			'create'         => true,
+			'delete'         => true,
+			'list'           => true,
+			'read'           => true,
+			'replace'        => true,
+			'update'         => true
+		],
+		'languages' => [
+			'create' => true,
+			'delete' => true,
+			'update' => true
+		],
+		'pages' => [
+			'access'     	 => true,
+			'changeSlug'     => true,
+			'changeStatus'   => true,
+			'changeTemplate' => true,
+			'changeTitle'    => true,
+			'create'         => true,
+			'delete'         => true,
+			'duplicate'      => true,
+			'list'           => true,
+			'move'           => true,
+			'preview'        => true,
+			'read'           => true,
+			'sort'           => true,
+			'update'         => true
+		],
+		'site' => [
+			'changeTitle' => true,
+			'update'      => true
+		],
+		'users' => [
+			'changeEmail'    => true,
+			'changeLanguage' => true,
+			'changeName'     => true,
+			'changePassword' => true,
+			'changeRole'     => true,
+			'create'         => true,
+			'delete'         => true,
+			'update'         => true
+		],
+		'user' => [
+			'changeEmail'    => true,
+			'changeLanguage' => true,
+			'changeName'     => true,
+			'changePassword' => true,
+			'changeRole'     => true,
+			'delete'         => true,
+			'update'         => true
+		]
+	];
+
+	/**
+	 * Permissions constructor
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException
+	 */
+	public function __construct(array|bool|null $settings = [])
+	{
+		// dynamically register the extended actions
+		foreach (static::$extendedActions as $key => $actions) {
+			if (isset($this->actions[$key]) === true) {
+				throw new InvalidArgumentException('The action ' . $key . ' is already a core action');
+			}
+
+			$this->actions[$key] = $actions;
+		}
+
+		if (is_array($settings) === true) {
+			return $this->setCategories($settings);
+		}
+
+		if (is_bool($settings) === true) {
+			return $this->setAll($settings);
+		}
+	}
+
+	public function for(string $category = null, string $action = null): bool
+	{
+		if ($action === null) {
+			if ($this->hasCategory($category) === false) {
+				return false;
+			}
+
+			return $this->actions[$category];
+		}
+
+		if ($this->hasAction($category, $action) === false) {
+			return false;
+		}
+
+		return $this->actions[$category][$action];
+	}
+
+	protected function hasAction(string $category, string $action): bool
+	{
+		return
+			$this->hasCategory($category) === true &&
+			array_key_exists($action, $this->actions[$category]) === true;
+	}
+
+	protected function hasCategory(string $category): bool
+	{
+		return array_key_exists($category, $this->actions) === true;
+	}
+
+	/**
+	 * @return $this
+	 */
+	protected function setAction(
+		string $category,
+		string $action,
+		$setting
+	): static {
+		// wildcard to overwrite the entire category
+		if ($action === '*') {
+			return $this->setCategory($category, $setting);
+		}
+
+		$this->actions[$category][$action] = $setting;
+
+		return $this;
+	}
+
+	/**
+	 * @return $this
+	 */
+	protected function setAll(bool $setting): static
+	{
+		foreach ($this->actions as $categoryName => $actions) {
+			$this->setCategory($categoryName, $setting);
+		}
+
+		return $this;
+	}
+
+	/**
+	 * @return $this
+	 */
+	protected function setCategories(array $settings): static
+	{
+		foreach ($settings as $categoryName => $categoryActions) {
+			if (is_bool($categoryActions) === true) {
+				$this->setCategory($categoryName, $categoryActions);
+			}
+
+			if (is_array($categoryActions) === true) {
+				foreach ($categoryActions as $actionName => $actionSetting) {
+					$this->setAction($categoryName, $actionName, $actionSetting);
+				}
+			}
+		}
+
+		return $this;
+	}
+
+	/**
+	 * @return $this
+	 * @throws \Kirby\Exception\InvalidArgumentException
+	 */
+	protected function setCategory(string $category, bool $setting): static
+	{
+		if ($this->hasCategory($category) === false) {
+			throw new InvalidArgumentException('Invalid permissions category');
+		}
+
+		foreach ($this->actions[$category] as $actionName => $actionSetting) {
+			$this->actions[$category][$actionName] = $setting;
+		}
+
+		return $this;
+	}
+
+	public function toArray(): array
+	{
+		return $this->actions;
+	}
+}

kirby/src/Cms/Picker.php

@@ -0,0 +1,148 @@
+<?php
+
+namespace Kirby\Cms;
+
+/**
+ * The Picker abstract is the foundation
+ * for the UserPicker, PagePicker and FilePicker
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+abstract class Picker
+{
+	protected App $kirby;
+	protected array $options;
+	protected Site $site;
+
+	/**
+	 * Creates a new Picker instance
+	 */
+	public function __construct(array $params = [])
+	{
+		$this->options = array_merge($this->defaults(), $params);
+		$this->kirby   = $this->options['model']->kirby();
+		$this->site    = $this->kirby->site();
+	}
+
+	/**
+	 * Return the array of default values
+	 */
+	protected function defaults(): array
+	{
+		// default params
+		return [
+			// image settings (ratio, cover, etc.)
+			'image' => [],
+			// query template for the info field
+			'info' => false,
+			// listing style: list, cards, cardlets
+			'layout' => 'list',
+			// number of users displayed per pagination page
+			'limit' => 20,
+			// optional mapping function for the result array
+			'map' => null,
+			// the reference model
+			'model' => App::instance()->site(),
+			// current page when paginating
+			'page' => 1,
+			// a query string to fetch specific items
+			'query' => null,
+			// search query
+			'search' => null,
+			// query template for the text field
+			'text' =>  null
+		];
+	}
+
+	/**
+	 * Fetches all items for the picker
+	 */
+	abstract public function items(): Collection|null;
+
+	/**
+	 * Converts all given items to an associative
+	 * array that is already optimized for the
+	 * panel picker component.
+	 */
+	public function itemsToArray(Collection $items = null): array
+	{
+		if ($items === null) {
+			return [];
+		}
+
+		$result = [];
+
+		foreach ($items as $index => $item) {
+			if (empty($this->options['map']) === false) {
+				$result[] = $this->options['map']($item);
+			} else {
+				$result[] = $item->panel()->pickerData([
+					'image'  => $this->options['image'],
+					'info'   => $this->options['info'],
+					'layout' => $this->options['layout'],
+					'model'  => $this->options['model'],
+					'text'   => $this->options['text'],
+				]);
+			}
+		}
+
+		return $result;
+	}
+
+	/**
+	 * Apply pagination to the collection
+	 * of items according to the options.
+	 */
+	public function paginate(Collection $items): Collection
+	{
+		return $items->paginate([
+			'limit' => $this->options['limit'],
+			'page'  => $this->options['page']
+		]);
+	}
+
+	/**
+	 * Return the most relevant pagination
+	 * info as array
+	 */
+	public function paginationToArray(Pagination $pagination): array
+	{
+		return [
+			'limit' => $pagination->limit(),
+			'page'  => $pagination->page(),
+			'total' => $pagination->total()
+		];
+	}
+
+	/**
+	 * Search through the collection of items
+	 * if not deactivate in the options
+	 */
+	public function search(Collection $items): Collection
+	{
+		if (empty($this->options['search']) === false) {
+			return $items->search($this->options['search']);
+		}
+
+		return $items;
+	}
+
+	/**
+	 * Returns an associative array
+	 * with all information for the picker.
+	 * This will be passed directly to the API.
+	 */
+	public function toArray(): array
+	{
+		$items = $this->items();
+
+		return [
+			'data'       => $this->itemsToArray($items),
+			'pagination' => $this->paginationToArray($items->pagination()),
+		];
+	}
+}

kirby/src/Cms/Plugin.php

@@ -0,0 +1,341 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Composer\InstalledVersions;
+use Exception;
+use Kirby\Cms\System\UpdateStatus;
+use Kirby\Data\Data;
+use Kirby\Exception\InvalidArgumentException;
+use Kirby\Toolkit\A;
+use Kirby\Toolkit\Str;
+use Kirby\Toolkit\V;
+use Throwable;
+
+/**
+ * Represents a Plugin and handles parsing of
+ * the composer.json. It also creates the prefix
+ * and media url for the plugin.
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class Plugin
+{
+	protected PluginAssets $assets;
+	protected UpdateStatus|null $updateStatus = null;
+
+	/**
+	 * @param string $name Plugin name within Kirby (`vendor/plugin`)
+	 * @param array $extends Associative array of plugin extensions
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException If the plugin name has an invalid format
+	 */
+	public function __construct(
+		protected string $name,
+		protected array $extends = [],
+		protected array $info = [],
+		protected string|null $root = null,
+		protected string|null $version = null,
+	) {
+		static::validateName($name);
+
+		// TODO: Remove in v7
+		if ($root = $extends['root'] ?? null) {
+			Helpers::deprecated('Plugin "' . $name . '": Passing the `root` inside the `extends` array has been deprecated. Pass it directly as named argument `root`.', 'plugin-extends-root');
+			$this->root ??= $root;
+			unset($this->extends['root']);
+		}
+
+		$this->root ??= dirname(debug_backtrace()[0]['file']);
+
+		// TODO: Remove in v7
+		if ($info = $extends['info'] ?? null) {
+			Helpers::deprecated('Plugin "' . $name . '": Passing an `info` array inside the `extends` array has been deprecated. Pass the individual entries directly as named `info` argument.', 'plugin-extends-root');
+
+			if (empty($info) === false && is_array($info) === true) {
+				$this->info = [...$info, ...$this->info];
+			}
+
+			unset($this->extends['info']);
+		}
+
+		// read composer.json and use as info fallback
+		try {
+			$info = Data::read($this->manifest());
+		} catch (Exception) {
+			// there is no manifest file or it is invalid
+			$info = [];
+		}
+
+		$this->info = [...$info, ...$this->info];
+	}
+
+	/**
+	 * Allows access to any composer.json field by method call
+	 */
+	public function __call(string $key, array $arguments = null): mixed
+	{
+		return $this->info()[$key] ?? null;
+	}
+
+	/**
+	 * Returns the plugin asset object for a specific asset
+	 */
+	public function asset(string $path): PluginAsset|null
+	{
+		return $this->assets()->get($path);
+	}
+
+	/**
+	 * Returns the plugin assets collection
+	 */
+	public function assets(): PluginAssets
+	{
+		return $this->assets ??= PluginAssets::factory($this);
+	}
+
+	/**
+	 * Returns the array with author information
+	 * from the composer.json file
+	 */
+	public function authors(): array
+	{
+		return $this->info()['authors'] ?? [];
+	}
+
+	/**
+	 * Returns a comma-separated list with all author names
+	 */
+	public function authorsNames(): string
+	{
+		$names = [];
+
+		foreach ($this->authors() as $author) {
+			$names[] = $author['name'] ?? null;
+		}
+
+		return implode(', ', array_filter($names));
+	}
+
+	/**
+	 * Returns the associative array of extensions the plugin bundles
+	 */
+	public function extends(): array
+	{
+		return $this->extends;
+	}
+
+	/**
+	 * Returns the unique ID for the plugin
+	 * (alias for the plugin name)
+	 */
+	public function id(): string
+	{
+		return $this->name();
+	}
+
+	/**
+	 * Returns the info data (from composer.json)
+	 */
+	public function info(): array
+	{
+		return $this->info;
+	}
+
+	/**
+	 * Current $kirby instance
+	 */
+	public function kirby(): App
+	{
+		return App::instance();
+	}
+
+	/**
+	 * Returns the link to the plugin homepage
+	 */
+	public function link(): string|null
+	{
+		$info     = $this->info();
+		$homepage = $info['homepage'] ?? null;
+		$docs     = $info['support']['docs'] ?? null;
+		$source   = $info['support']['source'] ?? null;
+
+		$link = $homepage ?? $docs ?? $source;
+
+		return V::url($link) ? $link : null;
+	}
+
+	/**
+	 * Returns the path to the plugin's composer.json
+	 */
+	public function manifest(): string
+	{
+		return $this->root() . '/composer.json';
+	}
+
+	/**
+	 * Returns the root where plugin assets are copied to
+	 */
+	public function mediaRoot(): string
+	{
+		return App::instance()->root('media') . '/plugins/' . $this->name();
+	}
+
+	/**
+	 * Returns the base URL for plugin assets
+	 */
+	public function mediaUrl(): string
+	{
+		return App::instance()->url('media') . '/plugins/' . $this->name();
+	}
+
+	/**
+	 * Returns the plugin name (`vendor/plugin`)
+	 */
+	public function name(): string
+	{
+		return $this->name;
+	}
+
+	/**
+	 * Returns a Kirby option value for this plugin
+	 */
+	public function option(string $key)
+	{
+		return $this->kirby()->option($this->prefix() . '.' . $key);
+	}
+
+	/**
+	 * Returns the option prefix (`vendor.plugin`)
+	 */
+	public function prefix(): string
+	{
+		return str_replace('/', '.', $this->name());
+	}
+
+	/**
+	 * Returns the root where the plugin files are stored
+	 */
+	public function root(): string
+	{
+		return $this->root;
+	}
+
+	/**
+	 * Returns all available plugin metadata
+	 */
+	public function toArray(): array
+	{
+		return [
+			'authors'     => $this->authors(),
+			'description' => $this->description(),
+			'name'        => $this->name(),
+			'license'     => $this->license(),
+			'link'        => $this->link(),
+			'root'        => $this->root(),
+			'version'     => $this->version()
+		];
+	}
+
+	/**
+	 * Returns the update status object unless the
+	 * update check has been disabled for the plugin
+	 * @since 3.8.0
+	 *
+	 * @param array|null $data Custom override for the getkirby.com update data
+	 */
+	public function updateStatus(array|null $data = null): UpdateStatus|null
+	{
+		if ($this->updateStatus !== null) {
+			return $this->updateStatus;
+		}
+
+		$kirby  = $this->kirby();
+		$option = $kirby->option('updates.plugins');
+
+		// specific configuration per plugin
+		if (is_array($option) === true) {
+			// filter all option values by glob match
+			$option = A::filter(
+				$option,
+				fn ($value, $key) => fnmatch($key, $this->name()) === true
+			);
+
+			// sort the matches by key length (with longest key first)
+			$keys = array_map('strlen', array_keys($option));
+			array_multisort($keys, SORT_DESC, $option);
+
+			if (count($option) > 0) {
+				// use the first and therefore longest key (= most specific match)
+				$option = reset($option);
+			} else {
+				// fallback to the default option value
+				$option = true;
+			}
+		}
+
+		$option ??= $kirby->option('updates') ?? true;
+
+		if ($option !== true) {
+			return null;
+		}
+
+		return $this->updateStatus = new UpdateStatus($this, false, $data);
+	}
+
+	/**
+	 * Checks if the name follows the required pattern
+	 * and throws an exception if not
+	 *
+	 * @throws \Kirby\Exception\InvalidArgumentException
+	 */
+	public static function validateName(string $name): void
+	{
+		if (preg_match('!^[a-z0-9-]+\/[a-z0-9-]+$!i', $name) !== 1) {
+			throw new InvalidArgumentException('The plugin name must follow the format "a-z0-9-/a-z0-9-"');
+		}
+	}
+
+	/**
+	 * Returns the normalized version number
+	 * from the composer.json file
+	 */
+	public function version(): string|null
+	{
+		$name = $this->info()['name'] ?? null;
+
+		try {
+			// try to get version from "vendor/composer/installed.php",
+			// this is the most reliable source for the version
+			$version = InstalledVersions::getPrettyVersion($name);
+		} catch (Throwable) {
+			$version = null;
+		}
+
+		// fallback to the version provided in the plugin's index.php: as named
+		// argument, entry in the info array or from the composer.json file
+		$version ??= $this->version ?? $this->info()['version'] ?? null;
+
+		if (
+			is_string($version) !== true ||
+			$version === '' ||
+			Str::endsWith($version, '+no-version-set')
+		) {
+			return null;
+		}
+
+		// normalize the version number to be without leading `v`
+		$version = ltrim($version, 'vV');
+
+		// ensure that the version number now starts with a digit
+		if (preg_match('/^[0-9]/', $version) !== 1) {
+			return null;
+		}
+
+		return $version;
+	}
+}

kirby/src/Cms/PluginAsset.php

@@ -0,0 +1,120 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Filesystem\F;
+
+/**
+ * Representing a plugin asset with methods
+ * to manage the asset file between the plugin
+ * and media folder
+ *
+ * @package   Kirby Cms
+ * @author    Nico Hoffmann <nico@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class PluginAsset
+{
+	public function __construct(
+		protected string $path,
+		protected string $root,
+		protected Plugin $plugin
+	) {
+	}
+
+	public function extension(): string
+	{
+		return F::extension($this->path());
+	}
+
+	public function filename(): string
+	{
+		return F::filename($this->path());
+	}
+
+	/**
+	 * Create a unique media hash
+	 */
+	public function mediaHash(): string
+	{
+		return crc32($this->filename()) . '-' . $this->modified();
+	}
+
+	/**
+	 * Absolute path to the asset file in the media folder
+	 */
+	public function mediaRoot(): string
+	{
+		return $this->plugin()->mediaRoot() . '/' . $this->mediaHash() . '/' . $this->path();
+	}
+
+	/**
+	 * Public accessible url path for the asset
+	 */
+	public function mediaUrl(): string
+	{
+		return $this->plugin()->mediaUrl() . '/' . $this->mediaHash() . '/' . $this->path();
+	}
+
+	/**
+	 * Timestamp when asset file was last modified
+	 */
+	public function modified(): int|false
+	{
+		return F::modified($this->root());
+	}
+
+	public function path(): string
+	{
+		return $this->path;
+	}
+
+	public function plugin(): Plugin
+	{
+		return $this->plugin;
+	}
+
+	/**
+	 * Publishes the asset file to the plugin's media folder
+	 * by creating a symlink
+	 */
+	public function publish(): void
+	{
+		F::link($this->root(), $this->mediaRoot(), 'symlink');
+	}
+
+	/**
+	 * @internal
+	 * @since 4.0.0
+	 * @deprecated 4.0.0
+	 * @codeCoverageIgnore
+	 */
+	public function publishAt(string $path): void
+	{
+		$media = $this->plugin()->mediaRoot() . '/' . $path;
+		F::link($this->root(), $media, 'symlink');
+	}
+
+	public function root(): string
+	{
+		return $this->root;
+	}
+
+	/**
+	 * @see ::mediaUrl
+	 */
+	public function url(): string
+	{
+		return $this->mediaUrl();
+	}
+
+	/**
+	 * @see ::url
+	 */
+	public function __toString(): string
+	{
+		return $this->url();
+	}
+}

kirby/src/Cms/PluginAssets.php

@@ -0,0 +1,184 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Closure;
+use Kirby\Filesystem\Dir;
+use Kirby\Filesystem\F;
+use Kirby\Http\Response;
+use Kirby\Toolkit\Str;
+
+/**
+ * Plugin assets are automatically copied/linked
+ * to the media folder, to make them publicly
+ * available. This class handles the magic around that.
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @author    Nico Hoffmann <nico@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class PluginAssets extends Collection
+{
+	/**
+	 * Clean old/deprecated assets on every resolve
+	 */
+	public static function clean(string $pluginName): void
+	{
+		if ($plugin = App::instance()->plugin($pluginName)) {
+			$media  = $plugin->mediaRoot();
+			$assets = $plugin->assets();
+
+			// get all media files
+			$files = Dir::index($media, true);
+
+			// get all active assets' paths from the plugin
+			$active = $assets->values(
+				function ($asset) {
+					$path  = $asset->mediaHash() . '/' . $asset->path();
+					$paths = [];
+					$parts = explode('/', $path);
+
+					// collect all path segments
+					// (e.g. foo/, foo/bar/, foo/bar/baz.css) for the asset
+					for ($i = 1, $max = count($parts); $i <= $max; $i++) {
+						$paths[] = implode('/', array_slice($parts, 0, $i));
+
+						// TODO: remove when media hash is enforced as mandatory
+						$paths[] = implode('/', array_slice($parts, 1, $i));
+					}
+
+					return $paths;
+				}
+			);
+
+			// flatten the array and remove duplicates
+			$active = array_unique(array_merge(...array_values($active)));
+
+			// get outdated media files by comparing all
+			// files in the media folder against the set of asset paths
+			$stale  = array_diff($files, $active);
+
+			foreach ($stale as $file) {
+				$root = $media . '/' . $file;
+
+				if (is_file($root) === true) {
+					F::remove($root);
+				} else {
+					Dir::remove($root);
+				}
+			}
+		}
+	}
+
+	/**
+	 * Filters assets collection by CSS files
+	 */
+	public function css(): static
+	{
+		return $this->filter(fn ($asset) => $asset->extension() === 'css');
+	}
+
+	/**
+	 * Creates a new collection for the plugin's assets
+	 * by considering the plugin's `asset` extension
+	 * (and `assets` directory as fallback)
+	 */
+	public static function factory(Plugin $plugin): static
+	{
+		// get assets defined in the plugin extension
+		if ($assets = $plugin->extends()['assets'] ?? null) {
+			if ($assets instanceof Closure) {
+				$assets = $assets();
+			}
+
+			// normalize array: use relative path as
+			// key when no key is defined
+			foreach ($assets as $key => $root) {
+				if (is_int($key) === true) {
+					unset($assets[$key]);
+					$path = Str::after($root, $plugin->root() . '/');
+					$assets[$path] = $root;
+				}
+			}
+		}
+
+		// fallback: if no assets are defined in the plugin extension,
+		// use all files in the plugin's `assets` directory
+		if ($assets === null) {
+			$assets = [];
+			$root   = $plugin->root() . '/assets';
+
+			foreach (Dir::index($root, true) as $path) {
+				if (is_file($root . '/' . $path) === true) {
+					$assets[$path] = $root . '/' . $path;
+				}
+			}
+		}
+
+		$collection = new static([], $plugin);
+
+		foreach ($assets as $path => $root) {
+			$collection->data[$path] = new PluginAsset($path, $root, $plugin);
+		}
+
+		return $collection;
+	}
+
+	/**
+	 * Filters assets collection by JavaScript files
+	 */
+	public function js(): static
+	{
+		return $this->filter(fn ($asset) => $asset->extension() === 'js');
+	}
+
+	public function plugin(): Plugin
+	{
+		return $this->parent;
+	}
+
+	/**
+	 * Create a symlink for a plugin asset and
+	 * return the public URL
+	 */
+	public static function resolve(
+		string $pluginName,
+		string $hash,
+		string $path
+	): Response|null {
+		if ($plugin = App::instance()->plugin($pluginName)) {
+			// do some spring cleaning for older files
+			static::clean($pluginName);
+
+			// @codeCoverageIgnoreStart
+			// TODO: deprecated media URL without hash
+			if (empty($hash) === true) {
+				$asset = $plugin->asset($path);
+				$asset->publishAt($path);
+				return Response::file($asset->root());
+			}
+
+			// TODO: deprecated media URL with hash (but path)
+			if ($asset = $plugin->asset($hash . '/' . $path)) {
+				$asset->publishAt($hash . '/' . $path);
+				return Response::file($asset->root());
+			}
+			// @codeCoverageIgnoreEnd
+
+			if ($asset = $plugin->asset($path)) {
+				if ($asset->mediaHash() === $hash) {
+					// create a symlink if possible
+					$asset->publish();
+
+					// return the file response
+					return Response::file($asset->root());
+				}
+			}
+		}
+
+		return null;
+	}
+}

kirby/src/Cms/R.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace Kirby\Cms;
+
+use Kirby\Http\Request;
+use Kirby\Toolkit\Facade;
+
+/**
+ * Shortcut to the request object
+ *
+ * @package   Kirby Cms
+ * @author    Bastian Allgeier <bastian@getkirby.com>
+ * @link      https://getkirby.com
+ * @copyright Bastian Allgeier
+ * @license   https://getkirby.com/license
+ */
+class R extends Facade
+{
+	public static function instance(): Request
+	{
+		return App::instance()->request();
+	}
+}