@crombolo/server 0.11.0 → 0.13.1

package/src/form-types.ts

@@ -0,0 +1,187 @@
+/**
+ * The public contract for a form field type or workflow type a server bundle
+ * adds (story 095, `docs/forms.md`, "Types from a bundle"). A bundle exports
+ * definitions; `collectFormTypes` turns the wired bundles' into the registry
+ * the parser, validator, renderer and runner are handed.
+ */
+import {
+  BUILT_IN_FORM_TYPES,
+  type FormSettingDeclaration,
+  type FormSettingValue,
+  type FormTypes,
+  formTypesWith,
+} from '@crombolo/core'
+import type { FormFieldRenderer } from '@crombolo/render'
+import type { EmailMessage, EmailResult } from './email.ts'
+
+export type { FormFieldRenderer, FormFieldRenderProps } from '@crombolo/render'
+export type { FormSettingDeclaration, FormSettingValue }
+
+/** A field type: what its settings are, how its value is checked, and how it draws. */
+export interface FormFieldTypeDefinition {
+  /** camelCase, unique across the built-ins and every wired bundle. */
+  type: string
+  /** What the designer's type list calls it. */
+  label: string
+  /**
+   * Which built-in kind it stores as, which decides coercion and the entry: a
+   * value is always a list of strings, so entries, exports and workflows read it
+   * as they read any other field. `none` collects nothing, as a heading does.
+   */
+  stores: 'string' | 'strings' | 'number' | 'boolean' | 'none'
+  /** Whether it takes a choice list (`values` or a `source`). */
+  choices?: boolean
+  /** Edited in the designer from these, and held to them in the file. */
+  settings?: readonly FormSettingDeclaration[]
+  /** After the kind's own checks: a message when the value is wrong. */
+  validate?(
+    values: readonly string[],
+    settings: Readonly<Record<string, FormSettingValue>>,
+  ): string | undefined
+  /** The control, in the form's markup. The label, help and error are drawn around it. */
+  render: FormFieldRenderer
+}
+
+/** What a bundle's workflow handler is given: the submission and narrow capabilities, no database. */
+export interface FormWorkflowRunContext {
+  form: { key: string; alias: string; name: string }
+  /** Each stored field's values, by alias; with labels where a field's choices have them. */
+  values: Readonly<Record<string, readonly string[]>>
+  labels: Readonly<Record<string, readonly string[]>>
+  entryId: string | null
+  settings: Readonly<Record<string, unknown>>
+  /** Which attempt this is, from 1; the queue makes up to five. */
+  attempt: number
+  /** Aborted with `signal` unless the call passes its own. */
+  fetch(input: string | URL | Request, init?: RequestInit): Promise<Response>
+  /** Answers `ok: false` when the site has no e-mail configured. */
+  sendEmail(message: EmailMessage): Promise<EmailResult>
+  log: {
+    info(message: string, properties?: Record<string, unknown>): void
+    warn(message: string, properties?: Record<string, unknown>): void
+    error(message: string, properties?: Record<string, unknown>): void
+  }
+  /** Aborted when the run has taken too long. */
+  signal: AbortSignal
+}
+
+/**
+ * Done, or failed: `retry` true tries again on the built-ins' backoff (1, 5, 15
+ * and 60 minutes, five attempts in all), false gives up at once. A throw counts
+ * as a failure worth retrying.
+ */
+export type FormWorkflowRunResult =
+  | { ok: true; detail?: string }
+  | { ok: false; error: string; retry: boolean }
+
+export interface FormWorkflowTypeDefinition {
+  type: string
+  label: string
+  settings?: readonly FormSettingDeclaration[]
+  /** Across its settings, after the declarations pass: a message when they are wrong. */
+  validate?(settings: Readonly<Record<string, unknown>>): string | undefined
+  run(context: FormWorkflowRunContext): FormWorkflowRunResult | Promise<FormWorkflowRunResult>
+}
+
+/** What a server bundle's `forms` adds. */
+export interface BundleForms {
+  fields?: readonly FormFieldTypeDefinition[]
+  workflows?: readonly FormWorkflowTypeDefinition[]
+}
+
+export interface CollectedFormTypes {
+  types: FormTypes
+  renderers: ReadonlyMap<string, FormFieldRenderer>
+  workflows: ReadonlyMap<string, FormWorkflowTypeDefinition>
+  problems: string[]
+}
+
+const STORES = new Set(['string', 'strings', 'number', 'boolean', 'none'])
+
+/** Every wired bundle's form types, merged over the built-ins, or why they cannot be. Pure. */
+export function collectFormTypes(
+  bundles: readonly { id: string; forms?: BundleForms }[],
+): CollectedFormTypes {
+  let types = BUILT_IN_FORM_TYPES
+  const renderers = new Map<string, FormFieldRenderer>()
+  const workflows = new Map<string, FormWorkflowTypeDefinition>()
+  const problems: string[] = []
+  for (const bundle of bundles) {
+    const forms = bundle.forms
+    if (!forms) continue
+    const fields = (forms.fields ?? []).filter((field) => {
+      if (STORES.has(field.stores) && typeof field.render === 'function') return true
+      problems.push(
+        `The bundle "${bundle.id}"'s field type "${field.type}" needs a render function and stores of string, strings, number, boolean or none.`,
+      )
+      return false
+    })
+    const added = formTypesWith(types, bundle.id, {
+      fields: fields.map((field) => ({
+        type: field.type,
+        label: field.label,
+        stores: field.stores,
+        choices: field.choices ?? false,
+        presentational: field.stores === 'none',
+        declared: field.settings ?? [],
+        validate: field.validate,
+      })),
+      workflows: (forms.workflows ?? []).map((workflow) => ({
+        type: workflow.type,
+        label: workflow.label,
+        declared: workflow.settings ?? [],
+        validate: workflow.validate,
+      })),
+    })
+    problems.push(...added.problems)
+    types = added.types
+    for (const field of fields)
+      if (types.fields.get(field.type)?.bundle === bundle.id)
+        renderers.set(field.type, field.render)
+    for (const workflow of forms.workflows ?? [])
+      if (types.workflows.get(workflow.type)?.bundle === bundle.id)
+        workflows.set(workflow.type, workflow)
+  }
+  return { types, renderers, workflows, problems }
+}
+
+const collected = new WeakMap<readonly unknown[], CollectedFormTypes>()
+const NONE: readonly { id: string; forms?: BundleForms }[] = []
+
+/** The form types a site's wired bundles add, worked out once per bundle list. */
+export function formTypesOf(config: {
+  bundles?: readonly { id: string; forms?: BundleForms }[]
+}): CollectedFormTypes {
+  const bundles = config.bundles ?? NONE
+  const known = collected.get(bundles)
+  if (known) return known
+  const result = collectFormTypes(bundles)
+  collected.set(bundles, result)
+  return result
+}
+
+/** As `formTypesOf`, the registry alone: what schema loading and validation take. */
+export const formTypesFor = (config: {
+  bundles?: readonly { id: string; forms?: BundleForms }[]
+}): FormTypes => formTypesOf(config).types
+
+/** The types as the designer reads them: what each is called, stores, and which settings it edits. */
+export function describeFormTypes(types: FormTypes) {
+  return {
+    fields: [...types.fields.values()].map((info) => ({
+      type: info.type,
+      label: info.label,
+      stores: info.stores,
+      choices: info.choices,
+      presentational: info.presentational,
+      settings: info.declared,
+      builtIn: info.bundle === undefined,
+    })),
+    workflows: [...types.workflows.values()].map((info) => ({
+      type: info.type,
+      label: info.label,
+      settings: info.declared,
+      builtIn: info.bundle === undefined,
+    })),
+  }
+}

package/src/form-workflows.ts

@@ -26,6 +26,7 @@ import {
   type NodeSchemaState,
 } from '@crombolo/data'
 import type { EmailAttachment, EmailPort } from './email.ts'
+import type { FormWorkflowTypeDefinition } from './form-types.ts'
 import { logger } from './logging.ts'
 import type { MediaFileStore } from './media-files.ts'
 
@@ -40,8 +41,13 @@ export interface WorkflowContext {
   form: SchemaForm
   values: readonly FormValueToStore[]
   entryId: string | null
+  /** Which attempt this is, from 1. */
+  attempt?: number
 }
 
+/** How long a bundle's workflow may run before its signal aborts. */
+const BUNDLE_WORKFLOW_TIMEOUT_MS = 60_000
+
 export interface WorkflowDeps {
   db: Db
   /** Absent when the site has no e-mail; a `sendEmail` workflow then says so. */
@@ -52,6 +58,8 @@ export interface WorkflowDeps {
   nodeId?: string
   /** Told when a workflow published something, so the cache is dropped. */
   onContentChanged?: () => void
+  /** The workflow types wired bundles add, by type. */
+  bundleWorkflows?: ReadonlyMap<string, FormWorkflowTypeDefinition>
 }
 
 export type WorkflowResult =
@@ -61,10 +69,13 @@ export type WorkflowResult =
 
 // ------------------------------------------------------------------ substitution
 
-const firstValue = (values: readonly FormValueToStore[], alias: string): string =>
-  values
-    .find((value) => value.fieldAlias.toLowerCase() === alias.toLowerCase())
-    ?.values.join(', ') ?? ''
+/** What a person reads for a value: the label a visitor chose, for a choice from a source. */
+const shown = (value: FormValueToStore): string[] => value.labels ?? value.values
+
+const firstValue = (values: readonly FormValueToStore[], alias: string): string => {
+  const found = values.find((value) => value.fieldAlias.toLowerCase() === alias.toLowerCase())
+  return found ? shown(found).join(', ') : ''
+}
 
 /**
  * `{fieldAlias}` in a workflow setting becomes what was submitted for it.
@@ -79,7 +90,7 @@ export function substitute(text: string, values: readonly FormValueToStore[]): s
     const found = values.find((value) => value.fieldAlias.toLowerCase() === alias.toLowerCase())
     // An unknown alias is left as it was written, so a stray brace in a subject
     // line reads as itself rather than vanishing.
-    return found ? found.values.join(', ') : whole
+    return found ? shown(found).join(', ') : whole
   })
 }
 
@@ -102,7 +113,7 @@ export function plainSummary(context: WorkflowContext): string {
   const lines = context.values.map(
     (value) =>
       `${captions.get(value.fieldAlias) ?? value.fieldAlias}: ${
-        value.values.length > 0 ? value.values.join(', ') : '(not answered)'
+        value.values.length > 0 ? shown(value).join(', ') : '(not answered)'
       }`,
   )
   return [`${context.form.name}`, '', ...lines].join('\n')
@@ -298,6 +309,54 @@ export async function runWorkflow(
     case 'sendToUrl':
       return sendToUrl(workflow, context, deps)
   }
+  const bundled = deps.bundleWorkflows?.get(workflow.type)
+  if (!bundled)
+    return {
+      ok: false,
+      retry: false,
+      error: `No wired bundle provides the workflow type "${workflow.type}".`,
+    }
+  return runBundleWorkflow(bundled, workflow, context, deps)
+}
+
+/** A bundle's handler, given the submission and narrow capabilities rather than the deps. */
+async function runBundleWorkflow(
+  definition: FormWorkflowTypeDefinition,
+  workflow: SchemaFormWorkflow,
+  context: WorkflowContext,
+  deps: WorkflowDeps,
+): Promise<WorkflowResult> {
+  const values: Record<string, readonly string[]> = {}
+  const labels: Record<string, readonly string[]> = {}
+  for (const value of context.values) {
+    values[value.fieldAlias] = value.values
+    if (value.labels) labels[value.fieldAlias] = value.labels
+  }
+  const named = logger('forms', workflow.type)
+  const signal = AbortSignal.timeout(BUNDLE_WORKFLOW_TIMEOUT_MS)
+  return definition.run({
+    form: {
+      key: context.form.key ?? context.form.alias,
+      alias: context.form.alias,
+      name: context.form.name,
+    },
+    values,
+    labels,
+    entryId: context.entryId,
+    settings: workflow.settings,
+    attempt: context.attempt ?? 1,
+    fetch: (input, init) => (deps.fetch ?? fetch)(input, { signal, ...init }),
+    sendEmail: async (message) =>
+      deps.email
+        ? deps.email.send(message)
+        : { ok: false, error: 'This site has no e-mail set up.' },
+    log: {
+      info: (message, properties) => named.info(message, properties),
+      warn: (message, properties) => named.warn(message, properties),
+      error: (message, properties) => named.error(message, properties),
+    },
+    signal,
+  })
 }
 
 export interface WorkflowRunReport {
@@ -344,6 +403,7 @@ export function createWorkflowRunner(
       form,
       values: run.payload,
       entryId: run.entryId,
+      attempt: run.attempts,
     }
     let result: WorkflowResult
     try {

package/src/forms.ts

@@ -10,6 +10,7 @@
  * what a render would use.
  */
 
+import type { FormTypes } from '@crombolo/core'
 import type { FormEntryState } from '@crombolo/data'
 import { allFormFields, type SchemaForm, storingFormFields } from '@crombolo/schema'
 
@@ -26,14 +27,14 @@ export interface FormSummary {
   workflowCount: number
 }
 
-export function formSummary(form: SchemaForm): FormSummary {
+export function formSummary(form: SchemaForm, types?: FormTypes): FormSummary {
   return {
     // A form with no key in its file still has to be addressable, and its alias
     // is unique within the set, so it stands in until a key is written.
     key: form.key ?? form.alias,
     alias: form.alias,
     name: form.name,
-    fieldCount: storingFormFields(form).length,
+    fieldCount: storingFormFields(form, types).length,
     pageCount: form.pages.length,
     storeEntries: form.storeEntries,
     requiresApproval: form.requiresApproval,
@@ -59,6 +60,7 @@ export function formDetail(form: SchemaForm): Record<string, unknown> {
       mandatory: field.mandatory,
       sensitive: field.sensitive,
       values: field.values,
+      source: field.source ?? null,
     })),
     workflows: form.workflows.map((workflow) => ({
       type: workflow.type,
@@ -82,10 +84,10 @@ export function formsByKey(forms: readonly SchemaForm[]): Map<string, SchemaForm
  * not allowed them, so the redaction is on the way out of the server.
  */
 export function redactSensitive(
-  entry: { values: { fieldAlias: string; values: string[] }[] },
+  entry: { values: { fieldAlias: string; values: string[]; labels?: string[] }[] },
   form: SchemaForm | undefined,
   maySeeSensitive: boolean,
-): { fieldAlias: string; values: string[]; redacted: boolean }[] {
+): { fieldAlias: string; values: string[]; labels?: string[]; redacted: boolean }[] {
   const sensitive = new Set(
     (form ? allFormFields(form) : [])
       .filter((field) => field.sensitive)
@@ -96,6 +98,7 @@ export function redactSensitive(
     return {
       fieldAlias: value.fieldAlias,
       values: hide ? [] : value.values,
+      ...(value.labels && !hide ? { labels: value.labels } : {}),
       redacted: hide,
     }
   })
@@ -117,6 +120,8 @@ function csvCell(value: string): string {
 }
 
 export interface EntriesCsvOptions {
+  /** The field types in play, so a bundle's type that collects nothing gets no column. */
+  types?: FormTypes
   /** Without it, a sensitive column is refused rather than silently blank. */
   includeSensitive: boolean
 }
@@ -138,11 +143,11 @@ export function entriesCsv(
     createDate: Date
     state: string
     spam: boolean
-    values: { fieldAlias: string; values: string[] }[]
+    values: { fieldAlias: string; values: string[]; labels?: string[] }[]
   }[],
   options: EntriesCsvOptions,
 ): EntriesCsvResult {
-  const fields = storingFormFields(form)
+  const fields = storingFormFields(form, options.types)
   const sensitive = fields.filter((field) => field.sensitive)
   if (sensitive.length > 0 && !options.includeSensitive)
     return {
@@ -158,7 +163,10 @@ export function entriesCsv(
     entry.state,
     String(entry.spam),
     ...fields.map((field) =>
-      (entry.values.find((value) => value.fieldAlias === field.alias)?.values ?? []).join('; '),
+      (() => {
+        const value = entry.values.find((candidate) => candidate.fieldAlias === field.alias)
+        return (value?.labels ?? value?.values ?? []).join('; ')
+      })(),
     ),
   ])
   return {

package/src/index.ts

@@ -4,6 +4,7 @@ export * from './adapters/bundles.ts'
 export * from './adapters/content.ts'
 export * from './adapters/documents.ts'
 export * from './adapters/elements.ts'
+export * from './adapters/health.ts'
 export * from './adapters/media.ts'
 export * from './adapters/member-groups.ts'
 export * from './adapters/members.ts'
@@ -12,10 +13,12 @@ export * from './adapters/redirects.ts'
 export * from './adapters/references.ts'
 export * from './adapters/template-files.ts'
 export * from './backup.ts'
+export * from './boot-failure.ts'
 export * from './bundle-install.ts'
 export * from './bundle-sections.ts'
 export * from './bundle-tables.ts'
 export * from './bundles.ts'
+export * from './busy.ts'
 export * from './components.ts'
 export * from './config.ts'
 export * from './content-type-udt.ts'
@@ -34,6 +37,7 @@ export * from './extensions-notice.ts'
 export * from './file-intake.ts'
 export * from './form-files.ts'
 export * from './form-submit.ts'
+export * from './form-types.ts'
 export * from './form-workflows.ts'
 export * from './forms.ts'
 export * from './git.ts'
@@ -58,9 +62,16 @@ export * from './ports.ts'
 export * from './redirects.ts'
 export * from './schema.ts'
 export * from './schema-store.ts'
+export * from './secrets.ts'
 export * from './seo.ts'
 export * from './server.ts'
 export * from './server-events.ts'
+export * from './setup.ts'
 export * from './status.ts'
+export * from './transfer-dashboard.ts'
 export * from './udt.ts'
+export * from './upgrade-summary.ts'
+export * from './url-settings.ts'
 export * from './view-runtime.ts'
+export * from './webhook-files.ts'
+export * from './webhooks.ts'

package/src/jobs.ts

@@ -19,6 +19,7 @@ import { auditRetainedSince, recordAudit } from './adapters/audit.ts'
 import type { WorkflowRunner, WorkflowRunReport } from './form-workflows.ts'
 import { logger } from './logging.ts'
 import type { MediaFileStore } from './media-files.ts'
+import type { WebhookService } from './webhooks.ts'
 
 export interface JobsOptions {
   db: Db
@@ -41,6 +42,9 @@ export interface JobsOptions {
    */
   formWorkflows?: WorkflowRunner
   formWorkflowsMs?: number
+  /** Raises the publishes scheduled publishing makes, and drains the delivery queue. */
+  webhooks?: Pick<WebhookService, 'raise' | 'runDue'>
+  webhooksMs?: number
   /** How often the search indexer looks for queued items; a write here also starts it at once. */
   searchIndexingMs?: number
   /** Days the audit log keeps an entry; 0 or absent keeps them forever. */
@@ -57,6 +61,8 @@ export interface BackgroundJobs {
   runScheduledPublishing(now?: Date): Promise<ScheduledRun>
   /** Runs the form workflows that are due; a no-op when none are configured. */
   runFormWorkflows(now?: Date): Promise<WorkflowRunReport>
+  /** Delivers the webhook and bundle events that are due. */
+  runWebhooks(now?: Date): Promise<WorkflowRunReport>
   /** Indexes every queued item, and returns how many. docs/search.md. */
   runSearchIndexing(): Promise<number>
   /** Something was queued here: index it shortly, rather than at the next tick. */
@@ -109,6 +115,10 @@ export function createBackgroundJobs(options: JobsOptions): BackgroundJobs {
       }
     }
     if (run.published.length + run.unpublished.length > 0) options.cache.invalidate()
+    for (const key of run.published)
+      await options.webhooks?.raise({ alias: 'Umbraco.ContentPublish', key })
+    for (const key of run.unpublished)
+      await options.webhooks?.raise({ alias: 'Umbraco.ContentUnpublish', key })
     return run
   }
 
@@ -121,6 +131,10 @@ export function createBackgroundJobs(options: JobsOptions): BackgroundJobs {
     return documents.cleanupVersions(now, options.versionCleanup)
   }
 
+  async function runWebhooks(now = new Date()): Promise<WorkflowRunReport> {
+    return (await options.webhooks?.runDue(now)) ?? { claimed: 0, done: 0, retrying: 0, failed: 0 }
+  }
+
   async function runFormWorkflows(now = new Date()): Promise<WorkflowRunReport> {
     return (
       (await options.formWorkflows?.runDue(now)) ?? {
@@ -169,6 +183,7 @@ export function createBackgroundJobs(options: JobsOptions): BackgroundJobs {
     runVersionCleanup,
     runAuditRetention,
     runFormWorkflows,
+    runWebhooks,
     runSearchIndexing,
     kickSearchIndexing() {
       if (timers.length === 0 || kicked) return
@@ -187,6 +202,8 @@ export function createBackgroundJobs(options: JobsOptions): BackgroundJobs {
       // More often than the other jobs: somebody waiting on a form notification
       // notices a minute, and a queue row is cheap to look for.
       if (options.formWorkflows) every(options.formWorkflowsMs ?? 15_000, runFormWorkflows)
+      // As often, for the same reason: a receiver that is waiting notices a minute.
+      if (options.webhooks) every(options.webhooksMs ?? 15_000, runWebhooks)
       if (options.versionCleanup.enabled) every(60 * 60_000, runVersionCleanup)
       if (options.auditRetentionDays) every(60 * 60_000, runAuditRetention)
       const files = options.mediaFiles

package/src/marketplace.ts

@@ -88,6 +88,11 @@ export interface MarketplaceOptions {
   applyContent?: (packageName: string) => Promise<ContentOutcome>
   /** The site's `applyBundleContentOnInstall`. */
   applyContentOnInstall?: boolean
+  /**
+   * False refuses installing and removing here: the dependency belongs in
+   * `package.json` and a deploy, so every node has it and it outlives a restart.
+   */
+  installs?: boolean
 }
 
 export interface InstallOutcome {
@@ -308,6 +313,7 @@ export function createMarketplace(options: MarketplaceOptions): Marketplace {
     },
 
     async install(name, version, request = {}) {
+      if (options.installs === false) return refusedHere(name, 'add')
       if (!isValidPackageName(name))
         return { ok: false, message: `'${name}' is not a package name npm would accept.` }
       if (version !== undefined && !isValidVersion(version))
@@ -365,6 +371,7 @@ export function createMarketplace(options: MarketplaceOptions): Marketplace {
     },
 
     async uninstall(name) {
+      if (options.installs === false) return refusedHere(name, 'remove')
       if (!isValidPackageName(name))
         return { ok: false, message: `'${name}' is not a package name npm would accept.` }
       const result = await install('remove', name, options.siteDir)
@@ -379,4 +386,15 @@ export function createMarketplace(options: MarketplaceOptions): Marketplace {
   }
 }
 
+/** What a site that does not install at runtime says instead, with what to do. */
+function refusedHere(name: string, verb: 'add' | 'remove'): InstallOutcome {
+  return {
+    ok: false,
+    message:
+      verb === 'add'
+        ? `Packages are not installed from the backoffice on this site. Add ${name} to the site's package.json (bun add ${name}) and deploy, so every server has it.`
+        : `Packages are not removed from the backoffice on this site. Remove ${name} from the site's package.json (bun remove ${name}) and deploy.`,
+  }
+}
+
 export { EXTENSION_KEYWORD }

package/src/media-files.ts

@@ -262,12 +262,14 @@ export async function readBlobs(
 export async function placeBlobs(
   store: MediaStore,
   blobs: ReadonlyMap<string, string>,
+  /** Turns a carried file's bytes into the media file's: opens a sealed one. */
+  open: (key: string, bytes: Uint8Array) => Uint8Array = (_key, bytes) => bytes,
 ): Promise<{ placed: number; bytes: number }> {
   let placed = 0
   let bytes = 0
   for (const [key, path] of blobs) {
     const file = Bun.file(path)
-    const content = new Uint8Array(await file.arrayBuffer())
+    const content = open(key, new Uint8Array(await file.arrayBuffer()))
     await store.put(key, content, { contentType: contentTypeFor(key) })
     placed += 1
     bytes += content.length

package/src/member-auth.ts

@@ -22,6 +22,7 @@
 import {
   expireCookie,
   hashPassword,
+  isNativeHash,
   memberCookieName,
   passwordConfigJson,
   readCookie,
@@ -69,6 +70,8 @@ export interface MemberAuth {
   decide(content: PublishedContent, member: RequestMember | undefined): Promise<AccessDecision>
   /** Handles the member endpoints, or undefined when the path is not one. */
   handle(request: Request, pathname: string): Promise<Response | undefined>
+  /** The `Set-Cookie` value that ends a member's site session. */
+  signOutCookie(): string
 }
 
 const isFormPost = (request: Request) =>
@@ -249,10 +252,22 @@ export function createMemberAuth(
       await verifyPassword(input.password ?? '', await hashPassword(crypto.randomUUID()))
       return failed()
     }
-    if (!(await verifyPassword(input.password ?? '', member.passwordHash))) {
+    if (
+      !(await verifyPassword(input.password ?? '', member.passwordHash, {
+        passwordConfig: member.passwordConfig,
+        forMember: true,
+      }))
+    ) {
       await members.recordFailedLogin(member.key, config.maxFailedPasswordAttempts)
       return failed()
     }
+    // An imported Umbraco hash is replaced now the password is known to match it.
+    if (!isNativeHash(member.passwordHash))
+      await members.rehashPassword(
+        member.key,
+        await hashPassword(input.password ?? ''),
+        passwordConfigJson(),
+      )
     await members.recordLogin(member.key)
     return answer(
       request,
@@ -359,6 +374,7 @@ export function createMemberAuth(
   return {
     resolve,
     decide,
+    signOutCookie: () => expireCookie(cookie, config.secureCookies),
     async handle(request, pathname) {
       if (!pathname.startsWith(`${MEMBER_ROUTE_PREFIX}/`)) return undefined
       const action = pathname.slice(MEMBER_ROUTE_PREFIX.length + 1)