@easy-cms/core 1.10.0 → 1.12.0

package/dist/{chunk-54UFTH6S.js → chunk-244WCY6S.js}

@@ -59,6 +59,7 @@ var JOB_RUNS = "job-runs";
 var ROLES = "user-roles";
 var USER_IDENTITIES = "user-identities";
 var AUDIT_LOGS = "audit-logs";
+var OUTBOX = "outbox";
 var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SESSIONS,
   LOGIN_ATTEMPTS,
@@ -70,7 +71,8 @@ var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   JOB_RUNS,
   ROLES,
   USER_IDENTITIES,
-  AUDIT_LOGS
+  AUDIT_LOGS,
+  OUTBOX
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
 var CREATED_BY_FIELD = {
@@ -519,6 +521,31 @@ var jobRunsCollection = {
     { name: "changedAt", type: "text" }
   ]
 };
+var outboxCollection = {
+  slug: OUTBOX,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    // create | update | draft | delete, as the webhook event.
+    { name: "event", type: "text", required: true },
+    // The collection's or the global's slug.
+    { name: "target", type: "text", required: true },
+    { name: "global", type: "boolean" },
+    { name: "docId", type: "text" },
+    // The stored status before the save, for publish and unpublish events.
+    { name: "before", type: "text" },
+    // JSON: the document as saved (as deleted), the one before, and the user who saved.
+    { name: "doc", type: "textarea", required: true },
+    { name: "previousDoc", type: "textarea" },
+    { name: "user", type: "textarea" },
+    // Steps already done (hooks, webhooks, purge), so a retry runs only the rest.
+    { name: "done", type: "text" },
+    { name: "attempts", type: "number", required: true },
+    { name: "nextAttemptAt", type: "text", required: true, index: true },
+    // pending | running | failed
+    { name: "state", type: "text", required: true, index: true },
+    { name: "error", type: "text" }
+  ]
+};
 var emailDeliveriesCollection = {
   slug: EMAIL_DELIVERIES,
   access: { read: nobody, create: nobody, update: nobody, delete: nobody },
@@ -572,8 +599,8 @@ function cut(value) {
   if (typeof value === "string")
     return value.length > MAX_VALUE ? `${value.slice(0, MAX_VALUE)}\u2026` : value;
   if (value !== null && typeof value === "object") {
-    const json = JSON.stringify(value);
-    return json.length > MAX_VALUE ? "\u2026" : value;
+    const json2 = JSON.stringify(value);
+    return json2.length > MAX_VALUE ? "\u2026" : value;
   }
   return value;
 }
@@ -3797,7 +3824,8 @@ var VersionStore = class {
         snapshot: args.snapshot,
         createdAt: now,
         updatedAt: now
-      }
+      },
+      outbox: args.outbox
     });
     await this.prune(parent, doc, args.max);
     return toSummary(created);
@@ -3874,7 +3902,7 @@ var VersionStore = class {
 };
 
 // src/local-api.ts
-import { createHash as createHash4, createHmac as createHmac6, randomBytes as randomBytes6, randomUUID as randomUUID3, timingSafeEqual as timingSafeEqual5 } from "crypto";
+import { createHash as createHash5, createHmac as createHmac6, randomBytes as randomBytes6, randomUUID as randomUUID3, timingSafeEqual as timingSafeEqual5 } from "crypto";
 
 // src/auth/common-passwords.ts
 var LIST = `
@@ -4187,6 +4215,189 @@ function localizeSort(fields, sort, locale, locales = []) {
   );
 }
 
+// src/outbox.ts
+var DELAYS = [6e4, 5 * 6e4, 30 * 6e4, 2 * 36e5, 12 * 36e5];
+var LEASE = 5 * 6e4;
+var BATCH2 = 50;
+var later2 = (from, ms) => new Date(from.getTime() + ms).toISOString();
+var json = (value) => value === void 0 ? null : JSON.stringify(value);
+var parse2 = (value) => typeof value === "string" ? JSON.parse(value) : void 0;
+function withoutHash(value) {
+  if (!value || !("passwordHash" in value)) return value;
+  const { passwordHash: _, ...rest } = value;
+  return rest;
+}
+var Outbox = class {
+  constructor(db, logger, runner) {
+    this.db = db;
+    this.logger = logger;
+    this.runner = runner;
+  }
+  db;
+  logger;
+  runner;
+  draining;
+  again = false;
+  /** The row a save writes. For a create, `doc` has no id yet: it gets the written one. */
+  row(entry) {
+    return {
+      collection: OUTBOX,
+      data: (id) => {
+        const docId = entry.global ? null : String(entry.docId ?? id);
+        const doc = entry.event === "create" ? { ...entry.doc, id } : entry.doc;
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        return {
+          event: entry.event,
+          target: entry.target,
+          global: entry.global,
+          docId,
+          before: entry.before,
+          doc: JSON.stringify(withoutHash(doc)),
+          previousDoc: json(withoutHash(entry.previousDoc)),
+          user: json(withoutHash(entry.user)),
+          done: null,
+          attempts: 0,
+          nextAttemptAt: now,
+          state: "pending",
+          error: null,
+          createdAt: now,
+          updatedAt: now
+        };
+      }
+    };
+  }
+  /** Runs what is due in the background, e.g. right after a save commits. */
+  kick() {
+    if (this.draining) {
+      this.again = true;
+      return;
+    }
+    this.draining = (async () => {
+      do {
+        this.again = false;
+        await this.run();
+      } while (this.again);
+    })().catch((error) => this.logger.error(`Outbox: ${error.message}`, { error })).finally(() => {
+      this.draining = void 0;
+    });
+  }
+  /** Waits until the background run started by `kick` is over. */
+  async flush() {
+    while (this.draining) await this.draining;
+  }
+  /**
+   * Runs entries that are due: new ones, retries whose time came, and those a stopped worker
+   * left claimed. Runs with scheduled jobs too, which catches what `kick` missed.
+   */
+  async run(now = /* @__PURE__ */ new Date()) {
+    let ran = 0;
+    let failed = 0;
+    for (; ; ) {
+      const { docs } = await this.db.find({
+        collection: OUTBOX,
+        where: {
+          and: [
+            { state: { in: ["pending", "running"] } },
+            { nextAttemptAt: { lte: now.toISOString() } }
+          ]
+        },
+        sort: ["nextAttemptAt", "id"],
+        limit: BATCH2,
+        page: 1
+      });
+      let claimed = 0;
+      for (const row of docs) {
+        const result = await this.runRow(row, now);
+        if (result === void 0) continue;
+        claimed++;
+        if (result) ran++;
+        else failed++;
+      }
+      if (docs.length < BATCH2 || claimed === 0) return { ran, failed };
+    }
+  }
+  /** Puts a failed entry back in line, e.g. from the admin. */
+  async retry(id) {
+    const row = await this.db.findById({ collection: OUTBOX, id });
+    if (!row || row.state !== "failed") return false;
+    const { id: _, ...data } = row;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const updated = await this.db.update({
+      collection: OUTBOX,
+      id,
+      data: { ...data, state: "pending", attempts: 0, nextAttemptAt: now, updatedAt: now },
+      where: { state: { equals: "failed" } }
+    });
+    if (updated) this.kick();
+    return updated !== null;
+  }
+  /** `true` when it ran, `false` when it failed, `undefined` when another worker has it. */
+  async runRow(row, now) {
+    const { id, ...data } = row;
+    const attempts = Number(data.attempts ?? 0) + 1;
+    let current = {
+      ...data,
+      state: "running",
+      attempts,
+      nextAttemptAt: later2(now, LEASE),
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    const claimed = await this.db.update({
+      collection: OUTBOX,
+      id,
+      data: current,
+      where: {
+        and: [{ state: { equals: data.state } }, { nextAttemptAt: { equals: data.nextAttemptAt } }]
+      }
+    });
+    if (!claimed) return void 0;
+    const done = new Set(
+      String(data.done ?? "").split(",").filter(Boolean)
+    );
+    const mark = async (step) => {
+      done.add(step);
+      current = { ...current, done: [...done].join(","), updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+      await this.db.update({ collection: OUTBOX, id, data: current });
+    };
+    try {
+      await this.runner(entryOf(data), done, mark);
+      await this.db.delete({ collection: OUTBOX, id });
+      return true;
+    } catch (error) {
+      const message2 = error instanceof Error ? error.message : String(error);
+      const delay = DELAYS[attempts - 1];
+      await this.db.update({
+        collection: OUTBOX,
+        id,
+        data: {
+          ...current,
+          state: delay === void 0 ? "failed" : "pending",
+          nextAttemptAt: later2(now, delay ?? 0),
+          error: message2,
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      });
+      const what = `${data.event} of ${data.global ? "global " : ""}"${data.target}"`;
+      if (delay === void 0)
+        this.logger.error(`Outbox gave up on ${what} after ${attempts} attempts: ${message2}`);
+      else this.logger.warn(`Outbox: ${what} failed (${message2}); will retry`);
+      return false;
+    }
+  }
+};
+function entryOf(row) {
+  return {
+    event: row.event,
+    target: String(row.target),
+    global: row.global === true,
+    docId: typeof row.docId === "string" ? row.docId : null,
+    before: typeof row.before === "string" ? row.before : null,
+    doc: parse2(row.doc) ?? {},
+    previousDoc: parse2(row.previousDoc),
+    user: parse2(row.user) ?? null
+  };
+}
+
 // src/remote-file.ts
 import { lookup as dnsLookup } from "dns";
 import { request as httpRequest } from "http";
@@ -4426,7 +4637,7 @@ function read(response, maxBytes, deadline) {
 var keys = (list) => new Set(list.split(/\s+/).filter(Boolean));
 var CONFIG = keys(`secret db serverURL cors cronSecret timeZone webhooks events jobs localization routes admin
   upload auth collections globals endpoints cliCommands onRequest fieldTypes apiKeys email backups
-  audit logs countCacheSeconds maxPage plugins`);
+  audit logs countCacheSeconds maxPage httpCache outbox plugins`);
 var ADMIN = keys("path locale brand siteURL nav commands modules pages dashboard switcher");
 var AUTH = keys(`roles rbac tokenExpiration maxLoginAttempts lockWindow trustedOrigins
   resetPasswordExpiration inviteExpiration providers providerSignUp password setupCode members emails`);
@@ -4436,8 +4647,10 @@ var BACKUPS = keys("frequency at keep dir storage sqlite encryptionKey");
 var AUDIT = keys("keepDays values failedLogins scope");
 var LOGS = keys("format requests");
 var COLLECTION = keys(`slug labels fields useAsTitle drafts versions schedule preview access hooks
-  admin`);
-var GLOBAL = keys("slug label fields drafts versions schedule preview access hooks scope admin");
+  admin httpCache`);
+var GLOBAL = keys(
+  "slug label fields drafts versions schedule preview access hooks scope admin httpCache"
+);
 var CONTAINER_ADMIN = keys("icon order sidebar layout group");
 var COLLECTION_ADMIN = keys(
   "icon order sidebar layout group editIn badge count empty list ownerField confirmDelete"
@@ -4692,6 +4905,23 @@ var Webhooks = class {
       this.track(this.deliver(hook, payload));
     }
   }
+  /**
+   * `emit` for the outbox: resolves once each delivery is saved in the queue (sent, without a
+   * queue), so the event can count as done. Throws when saving fails; nothing is sent then.
+   */
+  async emitSaved(event, target, doc) {
+    const payload = { event, ...target, doc, timestamp: (/* @__PURE__ */ new Date()).toISOString() };
+    for (const hook of this.hooks) {
+      if (!matches(hook, payload)) continue;
+      if (!this.queue) {
+        await this.deliver(hook, payload);
+        continue;
+      }
+      await new Promise(
+        (saved, failed) => this.track(this.deliver(hook, payload, { saved: () => saved(), failed }))
+      );
+    }
+  }
   /** Waits for deliveries in progress, e.g. before a serverless function returns. */
   async flush() {
     while (this.pending.size > 0) await Promise.allSettled([...this.pending]);
@@ -4715,7 +4945,7 @@ var Webhooks = class {
       const claimed = await this.queue.claim(id, queued, {
         ...queued,
         attempts,
-        nextAttemptAt: later2(now, CLAIM2)
+        nextAttemptAt: later3(now, CLAIM2)
       });
       if (!claimed) continue;
       const result = await this.attempt(hook, queued.event, queued.body, queued.delivery);
@@ -4729,7 +4959,7 @@ var Webhooks = class {
       await this.queue.update(id, {
         ...queued,
         attempts,
-        nextAttemptAt: later2(now, delay ?? 0),
+        nextAttemptAt: later3(now, delay ?? 0),
         state: delay === void 0 ? "failed" : "pending",
         error: result.error
       });
@@ -4752,7 +4982,7 @@ var Webhooks = class {
     ).finally(() => this.pending.delete(tracked));
     this.pending.add(tracked);
   }
-  async deliver(hook, payload) {
+  async deliver(hook, payload, saving) {
     const delivery = randomUUID2();
     const body = JSON.stringify(payload);
     const { event } = payload;
@@ -4767,13 +4997,15 @@ var Webhooks = class {
       error
     });
     const { queue } = this;
-    const saved = queue ? this.saving.then(() => queue.add(entry(0, later2(/* @__PURE__ */ new Date(), CLAIM2), null))) : Promise.resolve(void 0);
+    const saved = queue ? this.saving.then(() => queue.add(entry(0, later3(/* @__PURE__ */ new Date(), CLAIM2), null))) : Promise.resolve(void 0);
     this.saving = saved.catch(() => {
     });
     let queued;
     try {
       queued = await saved;
+      saving?.saved();
     } catch (error) {
+      if (saving) return saving.failed(error);
       this.logger.error(`Could not save webhook delivery: ${error.message}`, { error });
     }
     for (let attempt = 0; ; attempt++) {
@@ -4786,7 +5018,7 @@ var Webhooks = class {
       if (delay === void 0) {
         if (queued === void 0 || !this.queue)
           return this.giveUp(hook, event, result.error, attempt + 1);
-        const next = later2(/* @__PURE__ */ new Date(), QUEUE_DELAYS2[0]);
+        const next = later3(/* @__PURE__ */ new Date(), QUEUE_DELAYS2[0]);
         await this.queue.update(queued, entry(attempt + 1, next, result.error));
         this.logger.warn(
           `Webhook ${hook.url} failed for ${event} (${result.error}); will retry later`
@@ -4831,7 +5063,7 @@ var Webhooks = class {
     );
   }
 };
-var later2 = (from, ms) => new Date(from.getTime() + ms).toISOString();
+var later3 = (from, ms) => new Date(from.getTime() + ms).toISOString();
 var isContentEvent = (event) => WEBHOOK_EVENTS.includes(event);
 function matches(hook, payload) {
   if (!isContentEvent(payload.event)) return hook.events?.includes(payload.event) === true;
@@ -4859,6 +5091,7 @@ var RESERVED_SLUGS = /* @__PURE__ */ new Set([
   "audit-logs",
   "api-keys",
   "jobs",
+  "outbox",
   "auth",
   "migrations",
   "access",
@@ -4890,7 +5123,9 @@ function validateConfig(config) {
   validateAudit(config, add);
   validateLogs(config, add);
   validateCountCache(config, add);
+  validateOutbox(config, add);
   validateMaxPage(config, add);
+  validateHttpCache(config, add);
   validateAuth(config, add);
   validateCors(config.cors, add);
   validateLocalization(config, add);
@@ -5513,11 +5748,35 @@ function validateUpload(config, add) {
 var FOLDER_KEY = /^[a-z0-9][a-z0-9_-]{0,59}$/;
 var MIME_PATTERN = /^([\w.+-]+\/(\*|[\w.+-]+)|documents|office|archives)$/i;
 var HOST_PATTERN = /^(\*|(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*)$/i;
+function validateHttpCache(config, add) {
+  const times = (value, path, purge) => {
+    if (value === void 0) return;
+    if (value === false && !purge) return;
+    if (typeof value !== "object" || value === null) {
+      add(path, purge ? "must be an object" : "must be false or an object");
+      return;
+    }
+    const v = value;
+    for (const key of ["sMaxAge", "staleWhileRevalidate"])
+      if (v[key] !== void 0 && !(Number.isInteger(v[key]) && v[key] >= 0))
+        add(`${path}.${key}`, "must be a whole number of seconds, 0 or more");
+    if (purge && v.purge !== void 0 && typeof v.purge !== "function")
+      add(`${path}.purge`, "must be a function");
+  };
+  times(config.httpCache, "httpCache", true);
+  for (const c of config.collections ?? [])
+    times(c?.httpCache, `collections.${c?.slug}.httpCache`, false);
+  for (const g of config.globals ?? []) times(g?.httpCache, `globals.${g?.slug}.httpCache`, false);
+}
 function validateMaxPage(config, add) {
   const max = config.maxPage;
   if (max !== void 0 && !(Number.isInteger(max) && max >= 1))
     add("maxPage", "must be a whole number, 1 or more");
 }
+function validateOutbox(config, add) {
+  if (config.outbox !== void 0 && typeof config.outbox !== "boolean")
+    add("outbox", "must be true or false");
+}
 function validateCountCache(config, add) {
   const seconds = config.countCacheSeconds;
   if (seconds !== void 0 && !(typeof seconds === "number" && Number.isFinite(seconds) && seconds >= 0))
@@ -6379,6 +6638,7 @@ async function resolveConfig(input) {
       ...config.apiKeys ? [apiKeysCollection] : [],
       ...config.email ? [emailDeliveriesCollection] : [],
       ...(config.jobs?.length ?? 0) > 0 ? [jobRunsCollection] : [],
+      ...config.outbox ? [outboxCollection] : [],
       databaseBackupsCollection,
       ...config.auth?.rbac ? [rolesCollection] : [],
       ...(config.auth?.providers?.length ?? 0) > 0 ? [userIdentitiesCollection] : [],
@@ -6413,6 +6673,41 @@ function resolveAudit(audit) {
   };
 }
 
+// src/rest/http-cache.ts
+import { createHash as createHash4 } from "crypto";
+var cacheTags = {
+  collection: (slug2) => ["ecms", `ecms:${slug2}`],
+  document: (slug2, id) => ["ecms", `ecms:${slug2}`, `ecms:${slug2}:${id}`],
+  global: (slug2) => ["ecms", `ecms:global:${slug2}`]
+};
+function cacheTimes(config, container) {
+  const own = container.httpCache;
+  if (own === false || own === void 0 && config.httpCache === void 0) return null;
+  return {
+    sMaxAge: own?.sMaxAge ?? config.httpCache?.sMaxAge ?? 60,
+    staleWhileRevalidate: own?.staleWhileRevalidate ?? config.httpCache?.staleWhileRevalidate ?? 300
+  };
+}
+function matches2(header, etag) {
+  if (!header) return false;
+  if (header.trim() === "*") return true;
+  const bare = (tag) => tag.trim().replace(/^W\//, "");
+  return header.split(",").some((tag) => bare(tag) === bare(etag));
+}
+function cacheableResponse(request, body, status, headers, times, tags) {
+  headers.set(
+    "cache-control",
+    `public, max-age=0, s-maxage=${times.sMaxAge}, stale-while-revalidate=${times.staleWhileRevalidate}`
+  );
+  headers.set("cache-tag", tags.join(","));
+  headers.set("surrogate-key", tags.join(" "));
+  const etag = `W/"${createHash4("sha1").update(body).digest("base64url")}"`;
+  headers.set("etag", etag);
+  if (matches2(request.headers.get("if-none-match"), etag))
+    return new Response(null, { status: 304, headers });
+  return new Response(request.method.toUpperCase() === "HEAD" ? null : body, { status, headers });
+}
+
 // src/local-api.ts
 async function createEasyCMS(config, options = {}) {
   const resolved3 = await resolveConfig(config);
@@ -6432,8 +6727,18 @@ async function createEasyCMS(config, options = {}) {
     logger,
     interactive: options.interactive ?? false
   });
+  if (resolved3.outbox && db.outbox !== true) {
+    await db.destroy();
+    throw new ConfigError([
+      {
+        path: "outbox",
+        message: `needs a database adapter that writes outbox rows; "${resolved3.db.name}" doesn't`,
+        hint: "use @easy-cms/db-sqlite or @easy-cms/db-postgres 1.12 or later"
+      }
+    ]);
+  }
   const cms = new EasyCMS(resolved3, db, logger, storage, cwd);
-  const scheduling = [...resolved3.collections, ...resolved3.globals].some((c) => c.schedule) || (resolved3.webhooks?.length ?? 0) > 0 || resolved3.email !== void 0 || resolved3.jobs.length > 0;
+  const scheduling = [...resolved3.collections, ...resolved3.globals].some((c) => c.schedule) || (resolved3.webhooks?.length ?? 0) > 0 || resolved3.email !== void 0 || resolved3.jobs.length > 0 || resolved3.outbox === true;
   if (scheduling && options.scheduler !== false) cms.startScheduler();
   if (process.env.NODE_ENV === "production" && !resolved3.auth.setupCode && await cms.auth.hasUsers().catch(() => true) === false)
     logger.warn(
@@ -6473,6 +6778,8 @@ var EasyCMS = class {
   versions;
   webhooks;
   mailer;
+  /** With `outbox: true`: runs after hooks and events from rows saves write. */
+  outbox;
   /** @internal */
   constructor(config, db, logger = consoleLogger, storage = diskStorage({ dir: config.upload.dir }), cwd = process.cwd(), privateStorage) {
     this.config = config;
@@ -6500,6 +6807,7 @@ var EasyCMS = class {
       logger,
       config.collections.some((c) => c.slug === EMAIL_DELIVERIES) ? this.emailQueue() : void 0
     );
+    this.outbox = config.collections.some((c) => c.slug === OUTBOX) ? new Outbox(db, logger, (entry, done, mark) => this.runOutbox(entry, done, mark)) : void 0;
     this.auth = new Auth(this);
   }
   /**
@@ -7369,14 +7677,21 @@ var EasyCMS = class {
         ]);
       }
       const draft = { ...prepared, id: parsed, createdAt: existing.createdAt, updatedAt: now };
-      await this.saveVersion(config, collectionParent(collection2), parsed, draft, guard);
-      await this.notify(config.hooks?.afterChange, "afterChange", config.slug, {
-        ...base,
-        doc: draft,
-        previousDoc: current,
-        operation: "update"
+      const outbox2 = this.outboxRow(config, "draft", guard, draft, {
+        docId: parsed,
+        previousDoc: current
       });
-      this.emitChange(config, "draft", draft);
+      await this.saveVersion(config, collectionParent(collection2), parsed, draft, guard, outbox2);
+      if (outbox2) this.outbox?.kick();
+      else {
+        await this.notify(config.hooks?.afterChange, "afterChange", config.slug, {
+          ...base,
+          doc: draft,
+          previousDoc: current,
+          operation: "update"
+        });
+        this.emitChange(config, "draft", draft);
+      }
       await this.audited(config, "draft", draft, current, guard, mode);
       const [out2] = await this.output(config, [draft], guard, {
         ...options,
@@ -7405,7 +7720,18 @@ var EasyCMS = class {
       }
     }
     const data = { ...prepared, createdAt: existing.createdAt, updatedAt: now };
-    const doc = options.where ? await this.db.update({ collection: collection2, id: parsed, data, where: options.where }) : await this.db.update({ collection: collection2, id: parsed, data });
+    const outbox = this.outboxRow(
+      config,
+      "update",
+      guard,
+      { ...data, id: parsed },
+      {
+        docId: parsed,
+        previousDoc: current,
+        before: existing.status
+      }
+    );
+    const doc = options.where ? await this.db.update({ collection: collection2, id: parsed, data, where: options.where, outbox }) : await this.db.update({ collection: collection2, id: parsed, data, outbox });
     if (!doc) return null;
     if (moved) await moved.cleanUp();
     if (collection2 === MEDIA_FOLDERS) {
@@ -7415,13 +7741,16 @@ var EasyCMS = class {
     }
     if (!live) await this.saveVersion(config, collectionParent(collection2), parsed, doc, guard);
     if (password !== void 0) await this.auth.revokeSessions(parsed);
-    await this.notify(config.hooks?.afterChange, "afterChange", config.slug, {
-      ...base,
-      doc,
-      previousDoc: current,
-      operation: "update"
-    });
-    this.emitChange(config, "update", doc, existing.status);
+    if (outbox) this.outbox?.kick();
+    else {
+      await this.notify(config.hooks?.afterChange, "afterChange", config.slug, {
+        ...base,
+        doc,
+        previousDoc: current,
+        operation: "update"
+      });
+      this.emitChange(config, "update", doc, existing.status);
+    }
     await this.audited(config, "update", doc, current, guard, mode);
     const [out] = await this.output(config, [doc], guard, { ...options, draft: true });
     return out;
@@ -7459,7 +7788,8 @@ var EasyCMS = class {
       await this.checkMoveLimit(await this.folders.privacyAfter(parsed, { private: false }));
       await this.folders.release(existing);
     }
-    await this.db.delete({ collection: collection2, id: parsed });
+    const outbox = this.outboxRow(config, "delete", guard, existing, { docId: parsed });
+    await this.db.delete({ collection: collection2, id: parsed, outbox });
     if (collection2 === MEDIA_FOLDERS) {
       this.folders.invalidate();
       const parent = existing.parent ?? null;
@@ -7471,12 +7801,15 @@ var EasyCMS = class {
       for (const job of await this.pendingJobs(collection2, parsed))
         await this.db.delete({ collection: SCHEDULED_JOBS, id: job.id });
     }
-    await this.notify(config.hooks?.afterDelete, "afterDelete", config.slug, {
-      ...base,
-      id: parsed,
-      doc: existing
-    });
-    this.emitChange(config, "delete", existing);
+    if (outbox) this.outbox?.kick();
+    else {
+      await this.notify(config.hooks?.afterDelete, "afterDelete", config.slug, {
+        ...base,
+        id: parsed,
+        doc: existing
+      });
+      this.emitChange(config, "delete", existing);
+    }
     await this.audited(config, "delete", existing, existing, guard);
     const [out] = await this.output(config, [existing], guard, { depth: 0, draft: true });
     return out;
@@ -7633,26 +7966,38 @@ var EasyCMS = class {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     if (mode !== "unpublish" && this.separateDrafts(config) && existing.status === "published" && prepared.status === "draft") {
       const draft = { ...prepared, updatedAt: now };
-      await this.saveVersion(config, globalParent(key), 0, draft, guard);
+      const outbox2 = this.outboxRow(config, "draft", guard, draft, { previousDoc: current });
+      await this.saveVersion(config, globalParent(key), 0, draft, guard, outbox2);
+      if (outbox2) this.outbox?.kick();
+      else {
+        await this.notify(config.hooks?.afterChange, "afterChange", slug2, {
+          ...base,
+          doc: draft,
+          previousDoc: current,
+          operation: "update"
+        });
+        this.emitChange(config, "draft", draft);
+      }
+      await this.audited(config, "draft", draft, current, guard, mode);
+      return this.readGlobal(config, key, guard, { ...options, draft: true });
+    }
+    const data = { ...prepared, updatedAt: now };
+    const outbox = this.outboxRow(config, "update", guard, data, {
+      previousDoc: current,
+      before: existing.status
+    });
+    const doc = await this.db.updateGlobal({ slug: key, data, outbox });
+    await this.saveVersion(config, globalParent(key), 0, doc, guard);
+    if (outbox) this.outbox?.kick();
+    else {
       await this.notify(config.hooks?.afterChange, "afterChange", slug2, {
         ...base,
-        doc: draft,
+        doc,
         previousDoc: current,
         operation: "update"
       });
-      this.emitChange(config, "draft", draft);
-      await this.audited(config, "draft", draft, current, guard, mode);
-      return this.readGlobal(config, key, guard, { ...options, draft: true });
+      this.emitChange(config, "update", doc, existing.status);
     }
-    const doc = await this.db.updateGlobal({ slug: key, data: { ...prepared, updatedAt: now } });
-    await this.saveVersion(config, globalParent(key), 0, doc, guard);
-    await this.notify(config.hooks?.afterChange, "afterChange", slug2, {
-      ...base,
-      doc,
-      previousDoc: current,
-      operation: "update"
-    });
-    this.emitChange(config, "update", doc, existing.status);
     await this.audited(config, "update", doc, current, guard, mode);
     return this.readGlobal(config, key, guard, { ...options, draft: true });
   }
@@ -7766,9 +8111,21 @@ var EasyCMS = class {
       }
     };
   }
+  /**
+   * Waits until the outbox (`outbox: true`) ran what saves left so far, e.g. before a serverless
+   * function returns. What fails stays queued for its retry.
+   */
+  flushOutbox() {
+    return this.outbox?.flush() ?? Promise.resolve();
+  }
+  /** @internal Puts a failed outbox entry back in line (Settings → Jobs). */
+  retryOutbox(id) {
+    return this.outbox?.retry(id) ?? Promise.resolve(false);
+  }
   async destroy() {
     if (this.schedulerTimer) clearInterval(this.schedulerTimer);
     await this.running;
+    await this.outbox?.flush();
     await this.webhooks.flush();
     await this.mailer.flush();
     await this.db.destroy();
@@ -7815,7 +8172,8 @@ var EasyCMS = class {
         scheduled,
         webhooks: await this.retryWebhooks(now),
         emails: await this.mailer.retry(now),
-        jobs: await this.runConfigJobs(now)
+        jobs: await this.runConfigJobs(now),
+        outbox: await this.outbox?.run(now) ?? { ran: 0, failed: 0 }
       };
       const ranAt = (/* @__PURE__ */ new Date()).toISOString();
       await this.db.updateGlobal({ slug: JOBS_RAN, data: { at: ranAt, updatedAt: ranAt } }).catch((error) => this.logger.error(`Jobs: ${error.message}`, { error }));
@@ -8391,11 +8749,11 @@ var EasyCMS = class {
     const access = allowed2 === false ? false : andWhere(own === true ? void 0 : own, allowed2) ?? true;
     if (access === true) return;
     if (access !== false) {
-      const matches2 = await this.db.count({
+      const matches3 = await this.db.count({
         collection: config.slug,
         where: andWhere(access, { id: { equals: id } })
       });
-      if (matches2 > 0) return;
+      if (matches3 > 0) return;
     }
     throw deny(guard.user);
   }
@@ -8449,11 +8807,11 @@ var EasyCMS = class {
     await this.hidingDenied(collection2, guard, id, async () => {
       const own = await this.checkGrant(guard, { collection: collection2 }, operation);
       if (own === true) return;
-      const matches2 = await this.db.count({
+      const matches3 = await this.db.count({
         collection: collection2,
         where: andWhere(own, { id: { equals: id } })
       });
-      if (matches2 === 0) throw deny(guard.user);
+      if (matches3 === 0) throw deny(guard.user);
     });
   }
   /** Runs afterRead hooks, populates relationships and removes what the caller may not see. */
@@ -8547,18 +8905,20 @@ var EasyCMS = class {
     if (password !== void 0) prepared.passwordHash = await hashPassword(password);
     if (collection2 === MEDIA_FOLDERS) await this.validateFolder(prepared, void 0);
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const doc = await this.db.create({
-      collection: collection2,
-      data: { ...prepared, createdAt: now, updatedAt: now }
-    });
+    const row = { ...prepared, createdAt: now, updatedAt: now };
+    const outbox = this.outboxRow(config, "create", hookGuard ?? guard, row);
+    const doc = await this.db.create({ collection: collection2, data: row, outbox });
     if (collection2 === MEDIA_FOLDERS) this.folders.invalidate();
     await this.saveVersion(config, collectionParent(collection2), doc.id, doc, guard);
-    await this.notify(config.hooks?.afterChange, "afterChange", collection2, {
-      ...base,
-      doc,
-      operation: "create"
-    });
-    this.emitChange(config, "create", doc);
+    if (outbox) this.outbox?.kick();
+    else {
+      await this.notify(config.hooks?.afterChange, "afterChange", collection2, {
+        ...base,
+        doc,
+        operation: "create"
+      });
+      this.emitChange(config, "create", doc);
+    }
     await this.audited(config, "create", doc, void 0, hookGuard ?? guard);
     const [out] = await this.output(config, [doc], hookGuard ?? guard, { ...options, draft: true });
     return out;
@@ -8615,10 +8975,22 @@ var EasyCMS = class {
       return version && doc.status === "published" && version.status === "draft" ? draftOf(doc, version) : doc;
     });
   }
-  /** Sends webhook events for a change; `before` is the stored status before it, if any. */
-  emitChange(config, event, doc, before) {
-    const isGlobal = !this.config.collections.includes(config);
-    if (!isGlobal && INTERNAL_COLLECTIONS.has(config.slug)) return;
+  /**
+   * The tags `httpCache.purge` gets for a change: what readers see changed (anything, without
+   * drafts; with drafts, a published document saved, published, unpublished or deleted).
+   */
+  purgeTags(config, event, doc, before) {
+    if (!this.config.httpCache?.purge || config.httpCache === false || event === "draft") return;
+    if (config.drafts && doc.status !== "published" && before !== "published") return;
+    return this.isGlobal(config) ? cacheTags.global(config.slug) : cacheTags.document(config.slug, doc.id);
+  }
+  isGlobal(config) {
+    return !this.config.collections.includes(config);
+  }
+  /** The webhook events of a change; `before` is the stored status before it, if any. */
+  changeEvents(config, event, doc, before) {
+    const isGlobal = this.isGlobal(config);
+    if (!isGlobal && INTERNAL_COLLECTIONS.has(config.slug)) return [];
     const body = isGlobal ? { ...snapshotOf(config.fields, doc), updatedAt: doc.updatedAt } : {
       id: doc.id,
       ...snapshotOf(config.fields, doc),
@@ -8626,12 +8998,77 @@ var EasyCMS = class {
       updatedAt: doc.updatedAt
     };
     const target = isGlobal ? { global: config.slug } : { collection: config.slug, id: doc.id };
-    this.webhooks.emit(event, target, body);
-    if (event === "draft" || event === "delete" || !config.drafts) return;
+    const events = [{ event, target, body }];
+    if (event === "draft" || event === "delete" || !config.drafts) return events;
     const after = doc.status;
-    if (after === "published" && before !== "published") this.webhooks.emit("publish", target, body);
+    if (after === "published" && before !== "published")
+      events.push({ event: "publish", target, body });
     if (after !== "published" && before === "published")
-      this.webhooks.emit("unpublish", target, body);
+      events.push({ event: "unpublish", target, body });
+    return events;
+  }
+  /**
+   * Sends webhook events for a change and purges the HTTP cache. Not awaited; purge failures
+   * are logged.
+   */
+  emitChange(config, event, doc, before) {
+    for (const change of this.changeEvents(config, event, doc, before))
+      this.webhooks.emit(change.event, change.target, change.body);
+    const purge = this.config.httpCache?.purge;
+    const tags = this.purgeTags(config, event, doc, before);
+    if (!purge || !tags) return;
+    void Promise.resolve().then(() => purge(tags)).catch(
+      (error) => this.logger.error(`httpCache.purge failed: ${error.message}`, { error })
+    );
+  }
+  /**
+   * The outbox row of a save (`outbox: true`): written in its transaction, then run by the outbox
+   * in place of its after hooks and events. `undefined` without the outbox, or with nothing to run.
+   */
+  outboxRow(config, event, guard, doc, extra = {}) {
+    if (!this.outbox) return void 0;
+    const hooks = event === "delete" ? config.hooks?.afterDelete : config.hooks?.afterChange;
+    const isGlobal = this.isGlobal(config);
+    const effects = (isGlobal || !INTERNAL_COLLECTIONS.has(config.slug)) && ((this.config.webhooks?.length ?? 0) > 0 || this.config.httpCache?.purge !== void 0);
+    if (!hooks?.length && !effects) return void 0;
+    return this.outbox.row({
+      event,
+      target: config.slug,
+      global: isGlobal,
+      docId: extra.docId,
+      before: typeof extra.before === "string" ? extra.before : null,
+      doc,
+      previousDoc: extra.previousDoc,
+      user: guard.user
+    });
+  }
+  /** Runs an outbox entry: what its save would have run right after it, without the outbox. */
+  async runOutbox(entry, done, mark) {
+    const config = entry.global ? this.config.globals.find((g) => g.slug === entry.target) : this.config.collections.find((c) => c.slug === entry.target);
+    if (!config) return;
+    const { doc, event } = entry;
+    if (!done.has("hooks")) {
+      const base = this.hookArgs(config, { enforce: false, user: entry.user, context: {} });
+      const hooks = event === "delete" ? config.hooks?.afterDelete : config.hooks?.afterChange;
+      const args = event === "delete" ? { ...base, id: parseId(entry.docId ?? void 0), doc } : {
+        ...base,
+        doc,
+        ...entry.previousDoc ? { previousDoc: entry.previousDoc } : {},
+        operation: event === "create" ? "create" : "update"
+      };
+      for (const hook of hooks ?? [])
+        await hook(args);
+      if (hooks?.length) await mark("hooks");
+    }
+    if (!done.has("webhooks")) {
+      const changes = this.changeEvents(config, event, doc, entry.before);
+      for (const change of changes)
+        await this.webhooks.emitSaved(change.event, change.target, change.body);
+      if (changes.length > 0 && (this.config.webhooks?.length ?? 0) > 0) await mark("webhooks");
+    }
+    const purge = this.config.httpCache?.purge;
+    const tags = this.purgeTags(config, event, doc, entry.before);
+    if (purge && tags) await purge(tags);
   }
   /**
    * Writes the audit log entry for a change (`audit`): publishing, unpublishing and restoring
@@ -8662,7 +9099,7 @@ var EasyCMS = class {
     );
   }
   /** Records a version after a save, when the collection or global keeps versions. */
-  async saveVersion(config, parent, id, doc, guard) {
+  async saveVersion(config, parent, id, doc, guard, outbox) {
     const max = versionLimit(config);
     if (max === void 0) return;
     await this.versions.save({
@@ -8671,7 +9108,8 @@ var EasyCMS = class {
       status: config.drafts ? doc.status ?? "draft" : null,
       snapshot: snapshotOf(config.fields, doc),
       author: guard.user?.id ?? null,
-      max
+      max,
+      outbox
     });
   }
   hookArgs(config, guard) {
@@ -9076,7 +9514,7 @@ function durationSeconds(value) {
 }
 function cursorQuery(collection2, where, sort, locale, draft) {
   const key = JSON.stringify([collection2, where ?? null, sort, locale ?? null, draft]);
-  return createHash4("sha256").update(key).digest("base64url").slice(0, 16);
+  return createHash5("sha256").update(key).digest("base64url").slice(0, 16);
 }
 function writeCursor(keys2, query) {
   return Buffer.from(JSON.stringify({ k: keys2, q: query })).toString("base64url");
@@ -9100,7 +9538,7 @@ function readCursor(cursor, query) {
 // src/rest/admin-jobs.ts
 var has = (config, slug2) => config.collections.some((c) => c.slug === slug2);
 function hasJobsPage(config) {
-  return config.jobs.length > 0 || has(config, SCHEDULED_JOBS);
+  return config.jobs.length > 0 || has(config, SCHEDULED_JOBS) || has(config, OUTBOX);
 }
 var text2 = (value) => typeof value === "string" && value !== "" ? value : null;
 async function adminJobs(cms, user) {
@@ -9133,6 +9571,7 @@ async function adminJobs(cms, user) {
     ...has(config, SCHEDULED_JOBS) ? ["scheduled"] : [],
     ...has(config, WEBHOOK_DELIVERIES) ? ["webhooks"] : [],
     ...has(config, EMAIL_DELIVERIES) ? ["emails"] : [],
+    ...has(config, OUTBOX) ? ["outbox"] : [],
     ...config.backups?.frequency ? ["backups"] : [],
     ...config.audit ? ["audit"] : []
   ];
@@ -9141,7 +9580,8 @@ async function adminJobs(cms, user) {
     lastRanAt: await cms.jobsLastRan(),
     builtIn,
     timeZone: config.timeZone ?? null,
-    canChange: isSystemAdmin(user)
+    canChange: isSystemAdmin(user),
+    outbox: has(config, OUTBOX) ? await adminOutbox(cms) : null
   };
   if (!has(config, SCHEDULED_JOBS)) return { ...head, scheduled: null };
   const { docs } = await cms.db.find({
@@ -9166,6 +9606,38 @@ async function adminJobs(cms, user) {
   });
   return { ...head, scheduled };
 }
+async function adminOutbox(cms) {
+  const count = (state) => cms.db.count({ collection: OUTBOX, where: { state: { in: state } } });
+  const { docs } = await cms.db.find({
+    collection: OUTBOX,
+    where: { attempts: { gt: 0 } },
+    sort: ["-updatedAt"],
+    limit: 100,
+    page: 1
+  });
+  return {
+    waiting: await count(["pending", "running"]),
+    failed: await count(["failed"]),
+    entries: docs.filter((row) => text2(row.error) !== null).map((row) => ({
+      id: row.id,
+      event: row.event,
+      ...row.global === true ? { global: String(row.target) } : { collection: String(row.target) },
+      doc: text2(row.docId),
+      attempts: Number(row.attempts ?? 0),
+      state: row.state === "failed" || row.state === "running" ? row.state : "pending",
+      error: text2(row.error),
+      nextAttemptAt: String(row.nextAttemptAt)
+    }))
+  };
+}
+async function retryOutbox(cms, user, id) {
+  if (!isSystemAdmin(user)) throw new ForbiddenError();
+  if (!has(cms.config, OUTBOX)) throw new NotFoundError(OUTBOX, id);
+  const row = await cms.db.findById({ collection: OUTBOX, id: parseId(id) ?? 0 });
+  if (!row) throw new NotFoundError(OUTBOX, id);
+  if (!await cms.retryOutbox(row.id))
+    throw new EasyCMSError("Only failed entries can be retried", 409);
+}
 var TIME_OF_DAY2 = /^([01]\d|2[0-3]):[0-5]\d$/;
 async function updateJob(cms, user, name, body) {
   if (!isSystemAdmin(user)) throw new ForbiddenError();
@@ -9827,7 +10299,7 @@ function rank(role, config) {
 }
 
 // src/rest/admin-modules.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { readFile as readFile3 } from "fs/promises";
 import { createRequire } from "module";
 import { join as join3 } from "path";
@@ -9868,11 +10340,11 @@ async function readAdminModule(cms, index) {
   if (!file) return void 0;
   const body = await readFile3(file, "utf8").catch(() => void 0);
   if (body === void 0) return void 0;
-  return { body, etag: `"${createHash5("sha1").update(body).digest("base64url")}"` };
+  return { body, etag: `"${createHash6("sha1").update(body).digest("base64url")}"` };
 }
 
 // src/version.ts
-var VERSION = true ? "1.10.0" : "0.0.0-dev";
+var VERSION = true ? "1.12.0" : "0.0.0-dev";
 
 // src/rest/handler.ts
 import { randomUUID as randomUUID4 } from "crypto";
@@ -9882,7 +10354,7 @@ var PER_PAGE = 50;
 var collectionOf = (kind) => kind === "webhook" ? WEBHOOK_DELIVERIES : EMAIL_DELIVERIES;
 var exists = (cms, kind) => cms.config.collections.some((c) => c.slug === collectionOf(kind));
 var isDeliveryKind = (value) => value === "webhook" || value === "email";
-function parse2(text3) {
+function parse3(text3) {
   try {
     const value = JSON.parse(String(text3 ?? ""));
     return typeof value === "object" && value !== null ? value : {};
@@ -9901,7 +10373,7 @@ function toAdmin2(kind, row) {
     nextAttemptAt: String(row.nextAttemptAt ?? "")
   };
   if (kind === "webhook") {
-    const payload = parse2(row.body);
+    const payload = parse3(row.body);
     return {
       ...base,
       kind,
@@ -9913,7 +10385,7 @@ function toAdmin2(kind, row) {
       body: String(row.body ?? "")
     };
   }
-  const message2 = parse2(row.message);
+  const message2 = parse3(row.message);
   const to = message2.to;
   return {
     ...base,
@@ -10917,7 +11389,18 @@ async function respondNow(cms, request, url, path, root, options, production, re
     );
     if (!result) throw new HttpError("Not found", 404);
     if (result.body instanceof Response) return result.body;
-    return new Response(JSON.stringify(result.body), { status: result.status ?? 200, headers });
+    const body = JSON.stringify(result.body);
+    const times = result.cache && !user && !ctx.via && !ctx.token && !url.searchParams.has("draft") ? cacheTimes(cms.config, result.cache.container) : null;
+    if (times && result.cache)
+      return cacheableResponse(
+        request,
+        body,
+        result.status ?? 200,
+        headers,
+        times,
+        result.cache.tags
+      );
+    return new Response(body, { status: result.status ?? 200, headers });
   } catch (error) {
     return errorResponse(cms, error, headers, production);
   }
@@ -11419,6 +11902,13 @@ async function route(cms, ctx, method, path, options) {
       await cms.audit.record({ action: "jobs.run", target: "jobs", detail: result });
       return { body: result };
     }
+    if (third === "outbox" && segments.length === 4) {
+      if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+      const id2 = segments[3];
+      await retryOutbox(cms, ctx.user, id2);
+      await cms.audit.record({ action: "jobs.outbox.retry", target: "jobs", detail: { id: id2 } });
+      return { body: await adminJobs(cms, ctx.user) };
+    }
     if (third !== void 0 && segments.length === 3) {
       if (method !== "PATCH") throw methodNotAllowed(ctx, "PATCH");
       const { action, detail } = await updateJob(
@@ -11501,7 +11991,11 @@ async function route(cms, ctx, method, path, options) {
           })
         };
       }
-      return { body: await cms.findGlobal(second, { ...access, ...parseDepth(ctx.url), draft }) };
+      const global2 = cms.config.globals.find((g) => g.slug === second);
+      return {
+        body: await cms.findGlobal(second, { ...access, ...parseDepth(ctx.url), draft }),
+        cache: { container: global2, tags: cacheTags.global(second) }
+      };
     }
     if (method === "PATCH" || method === "POST") {
       if (method === "POST")
@@ -11598,7 +12092,8 @@ async function route(cms, ctx, method, path, options) {
         body: await cms.find(
           collection2,
           query.cursor === void 0 ? { ...options2, page } : options2
-        )
+        ),
+        cache: { container: cms.collection(collection2), tags: cacheTags.collection(collection2) }
       };
     }
     if (method === "POST") {
@@ -11625,7 +12120,13 @@ async function route(cms, ctx, method, path, options) {
   if (method === "GET") {
     const doc = await cms.findById(collection2, id, { ...access, ...parseDepth(ctx.url), draft });
     if (!doc) throw new NotFoundError(collection2, id);
-    return { body: doc };
+    return {
+      body: doc,
+      cache: {
+        container: cms.collection(collection2),
+        tags: cacheTags.document(collection2, doc.id)
+      }
+    };
   }
   if (method === "PATCH") {
     const body = await readJson(ctx.request);
@@ -11784,8 +12285,8 @@ function withPreviewToken(url, token) {
 }
 async function requirePreview(cms, ctx, target) {
   const opened = cms.verifyPreviewToken(ctx.url.searchParams.get("preview"));
-  const matches2 = opened !== null && ("global" in target ? "global" in opened && opened.global === target.global : "collection" in opened && opened.collection === target.collection && opened.id === target.id);
-  if (!matches2) throw new UnauthorizedError("Invalid or expired preview token");
+  const matches3 = opened !== null && ("global" in target ? "global" in opened && opened.global === target.global : "collection" in opened && opened.collection === target.collection && opened.id === target.id);
+  if (!matches3) throw new UnauthorizedError("Invalid or expired preview token");
   if (opened.user === void 0) return {};
   const id = parseId(opened.user);
   const issuer = id === void 0 ? null : await cms.auth.activeUser(id);
@@ -12293,6 +12794,7 @@ export {
   DEFAULT_TOKEN_EXPIRATION,
   applyPlugins,
   resolveConfig,
+  cacheTags,
   createEasyCMS,
   EasyCMS,
   resolveAdminModule,