@easy-cms/core 1.15.1 → 1.17.0

package/dist/{chunk-Q3QLUBFK.js → chunk-LPIABPBA.js}

@@ -14,6 +14,7 @@ import {
   PRIVATE_KEY,
   PayloadTooLargeError,
   QueryError,
+  TRIGRAM_LIKE_MIN,
   TooManyRequestsError,
   UnauthorizedError,
   ValidationError,
@@ -35,7 +36,7 @@ import {
   warnDeprecated,
   withCharset,
   withPrivacy
-} from "./chunk-SKGKGKUN.js";
+} from "./chunk-RJGKAYUU.js";
 
 // src/access.ts
 var isSystemAdmin = (user) => user?.role === "admin" && !user.apiKey && user.scoped !== true;
@@ -1078,10 +1079,10 @@ async function verifyTurnstile(secretKey, response, ip, fetcher = fetch) {
 // src/auth/cookie.ts
 var SESSION_COOKIE = "ecms-session";
 var hostCookie = (name) => `__Host-${name}`;
-function cookieValue(header, name) {
-  if (!header) return void 0;
+function cookieValue(header2, name) {
+  if (!header2) return void 0;
   let plain;
-  for (const part of header.split(";")) {
+  for (const part of header2.split(";")) {
     const eq = part.indexOf("=");
     if (eq <= 0) continue;
     const key = part.slice(0, eq).trim();
@@ -3910,7 +3911,7 @@ var VersionStore = class {
 };
 
 // src/local-api.ts
-import { createHash as createHash5, createHmac as createHmac6, randomBytes as randomBytes6, randomUUID as randomUUID3, timingSafeEqual as timingSafeEqual5 } from "crypto";
+import { createHash as createHash5, createHmac as createHmac7, randomBytes as randomBytes6, randomUUID as randomUUID3, timingSafeEqual as timingSafeEqual6 } from "crypto";
 
 // src/auth/common-passwords.ts
 var LIST = `
@@ -5137,7 +5138,41 @@ var SearchIndex = class {
 };
 
 // src/webhooks.ts
-import { createHmac as createHmac5, randomUUID as randomUUID2 } from "crypto";
+import { createHmac as createHmac6, randomUUID as randomUUID2 } from "crypto";
+
+// src/webhook-signature.ts
+import { createHmac as createHmac5, timingSafeEqual as timingSafeEqual5 } from "crypto";
+var TOLERANCE_SECONDS = 5 * 60;
+function signWebhook(secret, delivery, timestamp, body) {
+  return `v1=${createHmac5("sha256", secret).update(`${delivery}.${timestamp}.${body}`).digest("hex")}`;
+}
+function header(headers, name) {
+  if (headers instanceof Headers) return headers.get(name) ?? void 0;
+  const value = Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1];
+  return Array.isArray(value) ? value[0] : value;
+}
+function equal(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual5(left, right);
+}
+function verifyWebhook(body, headers, secret, options = {}) {
+  const delivery = header(headers, "x-easy-cms-delivery");
+  const timestamp = header(headers, "x-easy-cms-timestamp");
+  const signatures2 = header(headers, "x-easy-cms-signature-v2");
+  if (!delivery || !timestamp || !signatures2)
+    throw new UnauthorizedError("Webhook signature missing");
+  const seconds = Number(timestamp);
+  const now = (options.now ?? /* @__PURE__ */ new Date()).getTime() / 1e3;
+  if (!/^\d+$/.test(timestamp) || Math.abs(now - seconds) > (options.toleranceSeconds ?? TOLERANCE_SECONDS))
+    throw new UnauthorizedError("Webhook timestamp too old or in the future");
+  const sent = signatures2.split(/[\s,]+/).filter((s) => s.startsWith("v1="));
+  const valid = [secret].flat().some((s) => sent.some((given) => equal(given, signWebhook(s, delivery, seconds, body))));
+  if (!valid) throw new UnauthorizedError("Webhook signature does not match");
+  return JSON.parse(body);
+}
+
+// src/webhooks.ts
 var WEBHOOK_EVENTS = [
   "create",
   "update",
@@ -5307,7 +5342,10 @@ var Webhooks = class {
       ...hook.headers
     };
     if (hook.secret) {
-      headers["x-easy-cms-signature"] = `sha256=${createHmac5("sha256", hook.secret).update(body).digest("hex")}`;
+      const timestamp = Math.floor(Date.now() / 1e3);
+      headers["x-easy-cms-timestamp"] = String(timestamp);
+      headers["x-easy-cms-signature-v2"] = signWebhook(hook.secret, delivery, timestamp, body);
+      headers["x-easy-cms-signature"] = `sha256=${createHmac6("sha256", hook.secret).update(body).digest("hex")}`;
     }
     try {
       const response = await this.fetcher(hook.url, {
@@ -7024,11 +7062,11 @@ function cacheTimes(config, container) {
     staleWhileRevalidate: own?.staleWhileRevalidate ?? config.httpCache?.staleWhileRevalidate ?? 300
   };
 }
-function matches2(header, etag) {
-  if (!header) return false;
-  if (header.trim() === "*") return true;
+function matches2(header2, etag) {
+  if (!header2) return false;
+  if (header2.trim() === "*") return true;
   const bare = (tag) => tag.trim().replace(/^W\//, "");
-  return header.split(",").some((tag) => bare(tag) === bare(etag));
+  return header2.split(",").some((tag) => bare(tag) === bare(etag));
 }
 function cacheableResponse(request, body, status, headers, times, tags) {
   headers.set(
@@ -7045,7 +7083,7 @@ function cacheableResponse(request, body, status, headers, times, tags) {
 }
 
 // src/version.ts
-var VERSION = true ? "1.15.1" : "0.0.0-dev";
+var VERSION = true ? "1.17.0" : "0.0.0-dev";
 
 // src/telemetry.ts
 var DB_CALLS = /* @__PURE__ */ new Set([
@@ -7709,7 +7747,7 @@ var EasyCMS = class {
   /** A value with its HMAC (`secret`), for `purpose` only: `<base64url JSON>.<signature>`. */
   sign(purpose, value) {
     const payload = Buffer.from(JSON.stringify(value)).toString("base64url");
-    const mac = createHmac6("sha256", this.config.secret).update(`${purpose}:${payload}`);
+    const mac = createHmac7("sha256", this.config.secret).update(`${purpose}:${payload}`);
     return `${payload}.${mac.digest("base64url")}`;
   }
   /** The value of a token made by `sign`, or `undefined` when it isn't genuine. */
@@ -7717,10 +7755,10 @@ var EasyCMS = class {
     const [payload, signature] = String(token).split(".");
     if (!payload || !signature) return void 0;
     const expected = Buffer.from(
-      createHmac6("sha256", this.config.secret).update(`${purpose}:${payload}`).digest("base64url")
+      createHmac7("sha256", this.config.secret).update(`${purpose}:${payload}`).digest("base64url")
     );
     const given = Buffer.from(signature);
-    if (expected.length !== given.length || !timingSafeEqual5(expected, given)) return void 0;
+    if (expected.length !== given.length || !timingSafeEqual6(expected, given)) return void 0;
     try {
       return JSON.parse(Buffer.from(payload, "base64url").toString());
     } catch {
@@ -7839,10 +7877,10 @@ var EasyCMS = class {
     if (!signature || !Number.isInteger(at) || at < Date.now() / 1e3) return false;
     const expected = Buffer.from(this.mediaSignature(key, at));
     const given = Buffer.from(signature);
-    return expected.length === given.length && timingSafeEqual5(expected, given);
+    return expected.length === given.length && timingSafeEqual6(expected, given);
   }
   mediaSignature(key, expires) {
-    return createHmac6("sha256", this.config.secret).update(`media:${key}:${expires}`).digest("base64url");
+    return createHmac7("sha256", this.config.secret).update(`media:${key}:${expires}`).digest("base64url");
   }
   /**
    * How many documents use any of these files in a top-level upload field (rich text and fields
@@ -8789,8 +8827,13 @@ var EasyCMS = class {
       if (!found.hasNextPage) return;
     }
   }
-  /** A Local API call in a span (`easy-cms <operation> <collection>`) with `telemetry`. */
-  traced(operation, target, fn) {
+  /**
+   * A Local API call in a span (`easy-cms <operation> <collection>`) with `telemetry`; writes on
+   * the database's connections for writes, when it has some.
+   */
+  traced(operation, target, task) {
+    const writing = WRITES.has(operation) ? this.db.writing?.bind(this.db) : void 0;
+    const fn = writing ? () => writing(task) : task;
     if (!this.telemetry) return fn();
     return this.telemetry.span(
       `easy-cms ${operation}${target ? ` ${target}` : ""}`,
@@ -8902,7 +8945,7 @@ var EasyCMS = class {
       };
       let claimed;
       if (row) {
-        if (!due(row.lastRunAt)) continue;
+        if (row.lastRunAt === stamp || !due(row.lastRunAt)) continue;
         claimed = await this.claim(
           JOB_RUNS,
           row,
@@ -10160,6 +10203,7 @@ function wherePaths(where) {
   return out;
 }
 var NO_CONTEXT = Object.freeze({});
+var WRITES = /* @__PURE__ */ new Set(["create", "update", "delete", "updateGlobal"]);
 function withoutContext(permissions) {
   const { context: _context, ...rest } = permissions ?? {};
   return rest;
@@ -11426,6 +11470,9 @@ async function collection(cms, config, user, localized, roles, context) {
   };
   if (config.labels) result.labels = config.labels;
   if (config.useAsTitle) result.useAsTitle = config.useAsTitle;
+  const titleField = config.useAsTitle ?? "title";
+  if (config.fields.some((f) => f.name === titleField && f.index === "trigram"))
+    result.searchMin = TRIGRAM_LIKE_MIN;
   if (config.admin?.icon) result.icon = config.admin.icon;
   if (config.admin?.sidebar?.length) result.sidebar = config.admin.sidebar.map(panelRef);
   if (config.admin?.layout?.length) result.layout = layoutOf(config.admin.layout, fields);
@@ -11731,7 +11778,8 @@ async function adminSearch(cms, who, q, perCollection = 5) {
     listed(cms).map(async (c) => {
       const title = c.useAsTitle ?? (c.fields.some((f) => f.name === "title") ? "title" : void 0);
       const conditions = [];
-      if (title) conditions.push({ [title]: { like: query } });
+      const short = c.fields.find((f) => f.name === title)?.index === "trigram" && [...query].length < TRIGRAM_LIKE_MIN;
+      if (title && !short) conditions.push({ [title]: { like: query } });
       if (/^\d+$/.test(query)) conditions.push({ id: { equals: Number(query) } });
       const indexed = cms.config.search !== void 0 && c.search !== void 0;
       if (conditions.length === 0 && !indexed || !await readable(cms, c, who)) return [];
@@ -12413,8 +12461,8 @@ async function route(cms, ctx, method, path, options) {
   if (first === "jobs" && second === "run" && third === void 0) {
     if (method !== "GET" && method !== "POST") throw methodNotAllowed(ctx, "GET, POST");
     const secret = cms.config.cronSecret ?? process.env.CRON_SECRET;
-    const header = ctx.request.headers.get("authorization") ?? "";
-    const byCron = !!secret && safeEqual(header, `Bearer ${secret}`);
+    const header2 = ctx.request.headers.get("authorization") ?? "";
+    const byCron = !!secret && safeEqual(header2, `Bearer ${secret}`);
     if (!byCron && !isSystemAdmin(ctx.user)) {
       throw ctx.user ? new HttpError("Forbidden", 403) : new UnauthorizedError();
     }
@@ -13542,6 +13590,8 @@ export {
   checkRenamedOptions,
   BUILTIN_NAV,
   memorySearch,
+  signWebhook,
+  verifyWebhook,
   WEBHOOK_EVENTS,
   MIN_SECRET_LENGTH,
   BUILTIN_COLLECTIONS,

package/dist/{chunk-SKGKGKUN.js → chunk-RJGKAYUU.js}

@@ -313,6 +313,7 @@ function rowFields(field, row) {
   const type = row && typeof row === "object" ? row.blockType : void 0;
   return field.blocks.find((block) => block.slug === type)?.fields;
 }
+var TRIGRAM_LIKE_MIN = 3;
 var FIELD_TYPES = [
   "text",
   "textarea",
@@ -564,6 +565,7 @@ export {
   mimeAllowedBy,
   hasRows,
   rowFields,
+  TRIGRAM_LIKE_MIN,
   FIELD_TYPES,
   ADMIN_ICONS,
   PLUGIN_API_VERSION,

package/dist/{config-BLxN8qcy.d.ts → config-CWTw3zFm.d.ts}

@@ -294,6 +294,12 @@ interface Database {
      * the same transaction. Required by `outbox: true` in the config.
      */
     readonly outbox?: boolean | undefined;
+    /**
+     * Runs `fn`, a create, update or delete with every read it makes, on connections kept for
+     * writes, when the adapter has some (`writeConnections` of `postgres()`): saves then don't wait
+     * behind slow reads that hold the others.
+     */
+    writing?<T>(fn: () => Promise<T>): Promise<T>;
     /** Writes a migration file for the difference between the config and the latest migration. `null` when nothing changed. */
     createMigration(args: {
         name: string;
@@ -813,7 +819,8 @@ interface BaseField<TType extends string, TValue> {
     /**
      * `true` for a database index (filters and sorts on this field). `'trigram'`, on text, textarea
      * and email fields: an index for `like`, which finds any part of the text, in Thai as in other
-     * languages. Postgres only (pg_trgm); nothing on SQLite.
+     * languages. Postgres only (pg_trgm); nothing on SQLite. There, `like` needs at least three
+     * characters, and the admin's searches wait for them.
      */
     readonly index?: boolean | 'trigram';
     readonly defaultValue?: TValue;
@@ -960,6 +967,11 @@ declare const hasRows: (field: Field) => field is ArrayField | BlocksField;
 declare function rowFields(field: ArrayField | BlocksField, row: unknown): readonly Field[] | undefined;
 type Field = CustomField | TextField | TextareaField | NumberField | BooleanField | DateField | EmailField | JsonField | SelectField | SlugField | RichTextField | UploadField | RelationshipField | ArrayField | GroupField | BlocksField;
 type FieldType = Field['type'];
+/**
+ * The shortest `like` on a field with `index: 'trigram'`: trigrams are three characters, so a
+ * shorter search can't use the index and would read every row.
+ */
+declare const TRIGRAM_LIKE_MIN = 3;
 declare const FIELD_TYPES: readonly ["text", "textarea", "number", "boolean", "date", "email", "json", "select", "slug", "richText", "upload", "relationship", "array", "group", "blocks"];
 
 type Simplify<T> = {
@@ -2108,7 +2120,10 @@ declare class EasyCMS<C extends Config = Config> {
     }[]>;
     /** Published documents of a collection in a locale, a page at a time, for the search index. */
     private publishedPages;
-    /** A Local API call in a span (`easy-cms <operation> <collection>`) with `telemetry`. */
+    /**
+     * A Local API call in a span (`easy-cms <operation> <collection>`) with `telemetry`; writes on
+     * the database's connections for writes, when it has some.
+     */
     private traced;
     destroy(): Promise<void>;
     private schedulerTimer;
@@ -2764,7 +2779,12 @@ interface WebhookConfig {
     readonly collections?: readonly string[];
     /** Globals to send events for. Default: all; `[]` for none. */
     readonly globals?: readonly string[];
-    /** Signs each body: `x-easy-cms-signature: sha256=<hex HMAC-SHA256 of the body>`. */
+    /**
+     * Signs each attempt: `x-easy-cms-timestamp` and `x-easy-cms-signature-v2` (`v1=<hex HMAC-SHA256
+     * of "<delivery>.<timestamp>.<body>">`, checked by `verifyWebhook()`). Also, until 2.0, the
+     * deprecated `x-easy-cms-signature: sha256=<hex HMAC-SHA256 of the body>`, which a captured
+     * request can be replayed with.
+     */
     readonly secret?: string;
     /** Extra request headers, e.g. a token the receiver checks. */
     readonly headers?: Readonly<Record<string, string>>;
@@ -3667,5 +3687,5 @@ interface ResolvedConfig extends Omit<Config, 'cors' | 'localization' | 'routes'
  */
 declare function defineConfig<const TConfig extends Config>(config: TConfig): TConfig;
 
-export { ADAPTER_API_VERSION as A, AuditLog as J, Auth as M, ADMIN_ICONS as a, ForbiddenError as a$, FIELD_TYPES as aE, ConfigError as ad, EasyCMS as aw, EasyCMSError as ax, PayloadTooLargeError as bE, QueryError as bK, ROLE_OPERATIONS as bL, Roles as bW, SchemaError as bZ, NotFoundError as bt, PLUGIN_API_VERSION as bz, API_KEY_GLOBAL_OPERATIONS as c$, WEBHOOK_EVENTS as cA, anyone as cG, consoleEmail as cH, consoleLogger as cI, createEasyCMS as cJ, defineConfig as cK, defineFieldType as cL, definePlugin as cM, diskStorage as cN, hasRows as cO, isAdmin as cP, isHasMany as cQ, isSignedIn as cR, isStaff as cS, isSystemAdmin as cT, jsonLogger as cU, memorySearch as cV, mimeAllowedBy as cW, rowFields as cX, silentLogger as cY, uniqueWithinOf as cZ, API_KEYS as c_, SingleSignOn as cc, TooManyRequestsError as cm, UnauthorizedError as co, ValidationError as cw, API_KEY_OPERATIONS as d0, DEFAULT_MAX_VERSIONS as d1, DEFAULT_PASSWORD_EMAILS as d2, FIELD_TYPE_BASES as d3, FOLDER_LEVELS as d4, MediaFolders as d5, SSO_COOKIE as d6, codeOfStatus as d7, isJsonLogger as d8, keyAllows as d9, logFormat as da };
-export type { BuiltinMediaCollection as $, ApiKeyOperation as B, ApiKeyPermissions as C, ArrayField as D, EmailSetting as E, AuditChange as F, AuditConfig as G, AuditEntry as H, ID as I, AuditPage as K, AuditVerification as L, AuthConfig as N, AuthProvider as O, PaginatedDocs as P, AuthProviderProfile as Q, AuthProviderRequest as R, AuthUser as S, BackupsConfig as T, BeforeChangeHook as U, BeforeDeleteHook as V, BeforeValidateHook as W, Block as X, BlocksField as Y, BooleanField as Z, BuiltinApiKeysCollection as _, BuiltinMediaFoldersCollection as a0, BuiltinUsersCollection as a1, BundleHints as a2, CliCommand as a3, CollectionAccess as a4, CollectionAdmin as a5, CollectionConfig as a6, CollectionDocument as a7, CollectionHooks as a8, CollectionListAdmin as a9, EmailMessage as aA, Endpoint as aB, EndpointRequest as aC, ErrorCode as aD, Field as aF, FieldAccess as aG, FieldAccessFn as aH, FieldAdmin as aI, FieldError as aJ, FieldRule as aK, FieldType as aL, FieldTypeBase as aM, FieldTypeDefinition as aN, FieldTypeValidateContext as aO, FieldValidate as aP, FieldValidateContext as aQ, FieldValue as aR, FieldsInput as aS, FieldsValue as aT, FilterOptions as aU, FilterOptionsArgs as aV, FindAfterArgs as aW, FindArgs as aX, FindOptions as aY, FolderLevel as aZ, FolderPermissions as a_, CollectionSearch as aa, CollectionSlug as ab, Config as ac, ConfigIssue as ae, ContainerAdmin as af, CreateEasyCMSOptions as ag, CreateInput as ah, CreateMigrationResult as ai, CursorDocs as aj, CustomField as ak, CustomFieldTypes as al, DashboardWidget as am, Database as an, DatabaseAdapter as ao, DatabaseInitArgs as ap, DatabaseTransfer as aq, DateField as ar, DepthOptions as as, DirectUpload as at, DiskStorageOptions as au, DocumentOf as av, EmailAdapter as ay, EmailField as az, Access as b, SearchAdapter as b$, GlobalAccess as b0, GlobalConfig as b1, GlobalDocument as b2, GlobalHooks as b3, GlobalInput as b4, GlobalSlug as b5, GroupField as b6, ImageSize as b7, IncrementOptions as b8, InferCollection as b9, PasswordEmail as bA, PasswordEmailArgs as bB, PasswordEmailFn as bC, PasswordLinkOptions as bD, Plugin as bF, PluginInfo as bG, PluginTypes as bH, PreviewTarget as bI, PreviewURL as bJ, RawDocument as bM, ReadOptions as bN, RelationshipField as bO, RequestContext as bP, ResolvedConfig as bQ, RichTextDocument as bR, RichTextField as bS, Role as bT, RoleOperation as bU, RolePermissions as bV, RoutesConfig as bX, ScheduledPublish as bY, SchemaMode as b_, InferGlobal as ba, JobConfig as bb, JsonField as bc, KeysetPage as bd, Label as be, LayoutNode as bf, LivePreview as bg, LocaleOf as bh, LocalizationConfig as bi, LogDetails as bj, Logger as bk, LoginArgs as bl, LogsConfig as bm, MediaDocument as bn, MediaSize as bo, MembersConfig as bp, MembersSignup as bq, MigrationInfo as br, NavGroup as bs, NumberField as bu, OnRequest as bv, OnRequestArgs as bw, Operation as bx, OutboxRow as by, AccessArgs as c, SearchEntry as c0, SearchHits as c1, SearchOptions as c2, SearchQuery as c3, SearchResults as c4, SearchSetting as c5, SelectField as c6, SelectOption as c7, Session as c8, SidebarPanel as c9, WebhookConfig as cB, WebhookEvent as cC, WebhookPayload as cD, Where as cE, WhereOperators as cF, SignupArgs as ca, SignupResult as cb, SlugField as cd, SlugOf as ce, SsoOutcome as cf, SsoProviderRef as cg, StorageAdapter as ch, StoredFile as ci, TelemetryConfig as cj, TextField as ck, TextareaField as cl, TypedPlugin as cn, UncountedDocs as cp, UpdateInput as cq, UpdateOptions as cr, UploadConfig as cs, UploadField as ct, UploadFromURLConfig as cu, UserIdentity as cv, Version as cx, VersionSummary as cy, VersionsConfig as cz, AccessOptions as d, AdminBrand as e, AdminCommand as f, AdminComponent as g, AdminConfig as h, AdminFieldArgs as i, AdminIcon as j, AdminLocale as k, AdminPage as l, AdminRole as m, AdminRoleChange as n, AdminRoleField as o, AdminRoleTarget as p, AdminRoleView as q, AdminRoles as r, AdminSso as s, AdminSwitcher as t, AdminViewAccess as u, AfterChangeHook as v, AfterDeleteHook as w, AfterReadHook as x, ApiKeyContext as y, ApiKeyGlobalOperation as z };
+export { ADAPTER_API_VERSION as A, EasyCMS as E, AuditLog as S, Auth as V, EasyCMSError as aD, FIELD_TYPES as aK, ConfigError as al, ForbiddenError as b2, PLUGIN_API_VERSION as bB, PayloadTooLargeError as bG, QueryError as bM, ROLE_OPERATIONS as bN, Roles as bX, SchemaError as b_, NotFoundError as bv, API_KEYS as c$, WEBHOOK_EVENTS as cC, anyone as cH, consoleEmail as cI, consoleLogger as cJ, createEasyCMS as cK, defineConfig as cL, defineFieldType as cM, definePlugin as cN, diskStorage as cO, hasRows as cP, isAdmin as cQ, isHasMany as cR, isSignedIn as cS, isStaff as cT, isSystemAdmin as cU, jsonLogger as cV, memorySearch as cW, mimeAllowedBy as cX, rowFields as cY, silentLogger as cZ, uniqueWithinOf as c_, SingleSignOn as cd, TRIGRAM_LIKE_MIN as ck, TooManyRequestsError as co, UnauthorizedError as cq, ValidationError as cy, API_KEY_GLOBAL_OPERATIONS as d0, API_KEY_OPERATIONS as d1, DEFAULT_MAX_VERSIONS as d2, DEFAULT_PASSWORD_EMAILS as d3, FIELD_TYPE_BASES as d4, FOLDER_LEVELS as d5, MediaFolders as d6, SSO_COOKIE as d7, codeOfStatus as d8, isJsonLogger as d9, keyAllows as da, logFormat as db, ADMIN_ICONS as e };
+export type { AuthUser as $, AfterDeleteHook as B, Config as C, AfterReadHook as D, Field as F, ApiKeyContext as G, ApiKeyGlobalOperation as H, ID as I, ApiKeyOperation as J, ApiKeyPermissions as K, LocalizationConfig as L, ArrayField as M, AuditChange as N, AuditConfig as O, PaginatedDocs as P, AuditEntry as Q, ResolvedConfig as R, AuditPage as T, AuditVerification as U, WebhookPayload as W, AuthConfig as X, AuthProvider as Y, AuthProviderProfile as Z, AuthProviderRequest as _, FieldError as a, FindOptions as a$, BackupsConfig as a0, BeforeChangeHook as a1, BeforeDeleteHook as a2, BeforeValidateHook as a3, Block as a4, BlocksField as a5, BooleanField as a6, BuiltinApiKeysCollection as a7, BuiltinMediaCollection as a8, BuiltinMediaFoldersCollection as a9, DirectUpload as aA, DiskStorageOptions as aB, DocumentOf as aC, EmailAdapter as aE, EmailField as aF, EmailMessage as aG, Endpoint as aH, EndpointRequest as aI, ErrorCode as aJ, FieldAccess as aL, FieldAccessFn as aM, FieldAdmin as aN, FieldRule as aO, FieldType as aP, FieldTypeBase as aQ, FieldTypeDefinition as aR, FieldTypeValidateContext as aS, FieldValidate as aT, FieldValidateContext as aU, FieldValue as aV, FieldsInput as aW, FieldsValue as aX, FilterOptionsArgs as aY, FindAfterArgs as aZ, FindArgs as a_, BuiltinUsersCollection as aa, BundleHints as ab, CliCommand as ac, CollectionAccess as ad, CollectionAdmin as ae, CollectionConfig as af, CollectionDocument as ag, CollectionHooks as ah, CollectionListAdmin as ai, CollectionSearch as aj, CollectionSlug as ak, ConfigIssue as am, ContainerAdmin as an, CreateInput as ao, CreateMigrationResult as ap, CursorDocs as aq, CustomField as ar, CustomFieldTypes as as, DashboardWidget as at, Database as au, DatabaseAdapter as av, DatabaseInitArgs as aw, DatabaseTransfer as ax, DateField as ay, DepthOptions as az, FilterOptions as b, SchemaMode as b$, FolderLevel as b0, FolderPermissions as b1, GlobalAccess as b3, GlobalConfig as b4, GlobalDocument as b5, GlobalHooks as b6, GlobalInput as b7, GlobalSlug as b8, GroupField as b9, OutboxRow as bA, PasswordEmail as bC, PasswordEmailArgs as bD, PasswordEmailFn as bE, PasswordLinkOptions as bF, Plugin as bH, PluginInfo as bI, PluginTypes as bJ, PreviewTarget as bK, PreviewURL as bL, RawDocument as bO, ReadOptions as bP, RelationshipField as bQ, RequestContext as bR, RichTextDocument as bS, RichTextField as bT, Role as bU, RoleOperation as bV, RolePermissions as bW, RoutesConfig as bY, ScheduledPublish as bZ, ImageSize as ba, IncrementOptions as bb, InferCollection as bc, InferGlobal as bd, JobConfig as be, JsonField as bf, KeysetPage as bg, Label as bh, LayoutNode as bi, LivePreview as bj, LocaleOf as bk, LogDetails as bl, Logger as bm, LoginArgs as bn, LogsConfig as bo, MediaDocument as bp, MediaSize as bq, MembersConfig as br, MembersSignup as bs, MigrationInfo as bt, NavGroup as bu, NumberField as bw, OnRequest as bx, OnRequestArgs as by, Operation as bz, CreateEasyCMSOptions as c, SearchAdapter as c0, SearchEntry as c1, SearchHits as c2, SearchOptions as c3, SearchQuery as c4, SearchResults as c5, SearchSetting as c6, SelectField as c7, SelectOption as c8, Session as c9, VersionSummary as cA, VersionsConfig as cB, WebhookConfig as cD, WebhookEvent as cE, Where as cF, WhereOperators as cG, SidebarPanel as ca, SignupArgs as cb, SignupResult as cc, SlugField as ce, SlugOf as cf, SsoOutcome as cg, SsoProviderRef as ch, StorageAdapter as ci, StoredFile as cj, TelemetryConfig as cl, TextField as cm, TextareaField as cn, TypedPlugin as cp, UncountedDocs as cr, UpdateInput as cs, UpdateOptions as ct, UploadConfig as cu, UploadField as cv, UploadFromURLConfig as cw, UserIdentity as cx, Version as cz, EmailSetting as d, Access as f, AccessArgs as g, AccessOptions as h, AdminBrand as i, AdminCommand as j, AdminComponent as k, AdminConfig as l, AdminFieldArgs as m, AdminIcon as n, AdminLocale as o, AdminPage as p, AdminRole as q, AdminRoleChange as r, AdminRoleField as s, AdminRoleTarget as t, AdminRoleView as u, AdminRoles as v, AdminSso as w, AdminSwitcher as x, AdminViewAccess as y, AfterChangeHook as z };

package/dist/{handler-Ccc-CwBq.d.ts → handler-DzAqr9gY.d.ts}

@@ -1,4 +1,4 @@
-import { I as ID, ac as Config, aw as EasyCMS, bi as LocalizationConfig, aF as Field, aJ as FieldError, aU as FilterOptions, ag as CreateEasyCMSOptions, bQ as ResolvedConfig } from './config-BLxN8qcy.js';
+import { I as ID, C as Config, E as EasyCMS, L as LocalizationConfig, F as Field, a as FieldError, b as FilterOptions, c as CreateEasyCMSOptions, R as ResolvedConfig } from './config-CWTw3zFm.js';
 
 /** Decrypts a file from `encryptBackup`; throws for another key or a changed file. */
 declare function decryptBackup(data: Uint8Array, encryptionKey: string): Uint8Array;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { P as PaginatedDocs, I as ID, E as EmailSetting } from './config-BLxN8qcy.js';
-export { A as ADAPTER_API_VERSION, a as ADMIN_ICONS, b as Access, c as AccessArgs, d as AccessOptions, e as AdminBrand, f as AdminCommand, g as AdminComponent, h as AdminConfig, i as AdminFieldArgs, j as AdminIcon, k as AdminLocale, l as AdminPage, m as AdminRole, n as AdminRoleChange, o as AdminRoleField, p as AdminRoleTarget, q as AdminRoleView, r as AdminRoles, s as AdminSso, t as AdminSwitcher, u as AdminViewAccess, v as AfterChangeHook, w as AfterDeleteHook, x as AfterReadHook, y as ApiKeyContext, z as ApiKeyGlobalOperation, B as ApiKeyOperation, C as ApiKeyPermissions, D as ArrayField, F as AuditChange, G as AuditConfig, H as AuditEntry, J as AuditLog, K as AuditPage, L as AuditVerification, M as Auth, N as AuthConfig, O as AuthProvider, Q as AuthProviderProfile, R as AuthProviderRequest, S as AuthUser, T as BackupsConfig, U as BeforeChangeHook, V as BeforeDeleteHook, W as BeforeValidateHook, X as Block, Y as BlocksField, Z as BooleanField, _ as BuiltinApiKeysCollection, $ as BuiltinMediaCollection, a0 as BuiltinMediaFoldersCollection, a1 as BuiltinUsersCollection, a2 as BundleHints, a3 as CliCommand, a4 as CollectionAccess, a5 as CollectionAdmin, a6 as CollectionConfig, a7 as CollectionDocument, a8 as CollectionHooks, a9 as CollectionListAdmin, aa as CollectionSearch, ab as CollectionSlug, ac as Config, ad as ConfigError, ae as ConfigIssue, af as ContainerAdmin, ag as CreateEasyCMSOptions, ah as CreateInput, ai as CreateMigrationResult, aj as CursorDocs, ak as CustomField, al as CustomFieldTypes, am as DashboardWidget, an as Database, ao as DatabaseAdapter, ap as DatabaseInitArgs, aq as DatabaseTransfer, ar as DateField, as as DepthOptions, at as DirectUpload, au as DiskStorageOptions, av as DocumentOf, aw as EasyCMS, ax as EasyCMSError, ay as EmailAdapter, az as EmailField, aA as EmailMessage, aB as Endpoint, aC as EndpointRequest, aD as ErrorCode, aE as FIELD_TYPES, aF as Field, aG as FieldAccess, aH as FieldAccessFn, aI as FieldAdmin, aJ as FieldError, aK as FieldRule, aL as FieldType, aM as FieldTypeBase, aN as FieldTypeDefinition, aO as FieldTypeValidateContext, aP as FieldValidate, aQ as FieldValidateContext, aR as FieldValue, aS as FieldsInput, aT as FieldsValue, aU as FilterOptions, aV as FilterOptionsArgs, aW as FindAfterArgs, aX as FindArgs, aY as FindOptions, aZ as FolderLevel, a_ as FolderPermissions, a$ as ForbiddenError, b0 as GlobalAccess, b1 as GlobalConfig, b2 as GlobalDocument, b3 as GlobalHooks, b4 as GlobalInput, b5 as GlobalSlug, b6 as GroupField, b7 as ImageSize, b8 as IncrementOptions, b9 as InferCollection, ba as InferGlobal, bb as JobConfig, bc as JsonField, bd as KeysetPage, be as Label, bf as LayoutNode, bg as LivePreview, bh as LocaleOf, bi as LocalizationConfig, bj as LogDetails, bk as Logger, bl as LoginArgs, bm as LogsConfig, bn as MediaDocument, bo as MediaSize, bp as MembersConfig, bq as MembersSignup, br as MigrationInfo, bs as NavGroup, bt as NotFoundError, bu as NumberField, bv as OnRequest, bw as OnRequestArgs, bx as Operation, by as OutboxRow, bz as PLUGIN_API_VERSION, bA as PasswordEmail, bB as PasswordEmailArgs, bC as PasswordEmailFn, bD as PasswordLinkOptions, bE as PayloadTooLargeError, bF as Plugin, bG as PluginInfo, bH as PluginTypes, bI as PreviewTarget, bJ as PreviewURL, bK as QueryError, bL as ROLE_OPERATIONS, bM as RawDocument, bN as ReadOptions, bO as RelationshipField, bP as RequestContext, bQ as ResolvedConfig, bR as RichTextDocument, bS as RichTextField, bT as Role, bU as RoleOperation, bV as RolePermissions, bW as Roles, bX as RoutesConfig, bY as ScheduledPublish, bZ as SchemaError, b_ as SchemaMode, b$ as SearchAdapter, c0 as SearchEntry, c1 as SearchHits, c2 as SearchOptions, c3 as SearchQuery, c4 as SearchResults, c5 as SearchSetting, c6 as SelectField, c7 as SelectOption, c8 as Session, c9 as SidebarPanel, ca as SignupArgs, cb as SignupResult, cc as SingleSignOn, cd as SlugField, ce as SlugOf, cf as SsoOutcome, cg as SsoProviderRef, ch as StorageAdapter, ci as StoredFile, cj as TelemetryConfig, ck as TextField, cl as TextareaField, cm as TooManyRequestsError, cn as TypedPlugin, co as UnauthorizedError, cp as UncountedDocs, cq as UpdateInput, cr as UpdateOptions, cs as UploadConfig, ct as UploadField, cu as UploadFromURLConfig, cv as UserIdentity, cw as ValidationError, cx as Version, cy as VersionSummary, cz as VersionsConfig, cA as WEBHOOK_EVENTS, cB as WebhookConfig, cC as WebhookEvent, cD as WebhookPayload, cE as Where, cF as WhereOperators, cG as anyone, cH as consoleEmail, cI as consoleLogger, cJ as createEasyCMS, cK as defineConfig, cL as defineFieldType, cM as definePlugin, cN as diskStorage, cO as hasRows, cP as isAdmin, cQ as isHasMany, cR as isSignedIn, cS as isStaff, cT as isSystemAdmin, cU as jsonLogger, cV as memorySearch, cW as mimeAllowedBy, cX as rowFields, cY as silentLogger, cZ as uniqueWithinOf } from './config-BLxN8qcy.js';
-export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-JIb70PKm.js';
-export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-Ccc-CwBq.js';
+import { P as PaginatedDocs, I as ID, d as EmailSetting, W as WebhookPayload } from './config-CWTw3zFm.js';
+export { A as ADAPTER_API_VERSION, e as ADMIN_ICONS, f as Access, g as AccessArgs, h as AccessOptions, i as AdminBrand, j as AdminCommand, k as AdminComponent, l as AdminConfig, m as AdminFieldArgs, n as AdminIcon, o as AdminLocale, p as AdminPage, q as AdminRole, r as AdminRoleChange, s as AdminRoleField, t as AdminRoleTarget, u as AdminRoleView, v as AdminRoles, w as AdminSso, x as AdminSwitcher, y as AdminViewAccess, z as AfterChangeHook, B as AfterDeleteHook, D as AfterReadHook, G as ApiKeyContext, H as ApiKeyGlobalOperation, J as ApiKeyOperation, K as ApiKeyPermissions, M as ArrayField, N as AuditChange, O as AuditConfig, Q as AuditEntry, S as AuditLog, T as AuditPage, U as AuditVerification, V as Auth, X as AuthConfig, Y as AuthProvider, Z as AuthProviderProfile, _ as AuthProviderRequest, $ as AuthUser, a0 as BackupsConfig, a1 as BeforeChangeHook, a2 as BeforeDeleteHook, a3 as BeforeValidateHook, a4 as Block, a5 as BlocksField, a6 as BooleanField, a7 as BuiltinApiKeysCollection, a8 as BuiltinMediaCollection, a9 as BuiltinMediaFoldersCollection, aa as BuiltinUsersCollection, ab as BundleHints, ac as CliCommand, ad as CollectionAccess, ae as CollectionAdmin, af as CollectionConfig, ag as CollectionDocument, ah as CollectionHooks, ai as CollectionListAdmin, aj as CollectionSearch, ak as CollectionSlug, C as Config, al as ConfigError, am as ConfigIssue, an as ContainerAdmin, c as CreateEasyCMSOptions, ao as CreateInput, ap as CreateMigrationResult, aq as CursorDocs, ar as CustomField, as as CustomFieldTypes, at as DashboardWidget, au as Database, av as DatabaseAdapter, aw as DatabaseInitArgs, ax as DatabaseTransfer, ay as DateField, az as DepthOptions, aA as DirectUpload, aB as DiskStorageOptions, aC as DocumentOf, E as EasyCMS, aD as EasyCMSError, aE as EmailAdapter, aF as EmailField, aG as EmailMessage, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, aK as FIELD_TYPES, F as Field, aL as FieldAccess, aM as FieldAccessFn, aN as FieldAdmin, a as FieldError, aO as FieldRule, aP as FieldType, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, aT as FieldValidate, aU as FieldValidateContext, aV as FieldValue, aW as FieldsInput, aX as FieldsValue, b as FilterOptions, aY as FilterOptionsArgs, aZ as FindAfterArgs, a_ as FindArgs, a$ as FindOptions, b0 as FolderLevel, b1 as FolderPermissions, b2 as ForbiddenError, b3 as GlobalAccess, b4 as GlobalConfig, b5 as GlobalDocument, b6 as GlobalHooks, b7 as GlobalInput, b8 as GlobalSlug, b9 as GroupField, ba as ImageSize, bb as IncrementOptions, bc as InferCollection, bd as InferGlobal, be as JobConfig, bf as JsonField, bg as KeysetPage, bh as Label, bi as LayoutNode, bj as LivePreview, bk as LocaleOf, L as LocalizationConfig, bl as LogDetails, bm as Logger, bn as LoginArgs, bo as LogsConfig, bp as MediaDocument, bq as MediaSize, br as MembersConfig, bs as MembersSignup, bt as MigrationInfo, bu as NavGroup, bv as NotFoundError, bw as NumberField, bx as OnRequest, by as OnRequestArgs, bz as Operation, bA as OutboxRow, bB as PLUGIN_API_VERSION, bC as PasswordEmail, bD as PasswordEmailArgs, bE as PasswordEmailFn, bF as PasswordLinkOptions, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bK as PreviewTarget, bL as PreviewURL, bM as QueryError, bN as ROLE_OPERATIONS, bO as RawDocument, bP as ReadOptions, bQ as RelationshipField, bR as RequestContext, R as ResolvedConfig, bS as RichTextDocument, bT as RichTextField, bU as Role, bV as RoleOperation, bW as RolePermissions, bX as Roles, bY as RoutesConfig, bZ as ScheduledPublish, b_ as SchemaError, b$ as SchemaMode, c0 as SearchAdapter, c1 as SearchEntry, c2 as SearchHits, c3 as SearchOptions, c4 as SearchQuery, c5 as SearchResults, c6 as SearchSetting, c7 as SelectField, c8 as SelectOption, c9 as Session, ca as SidebarPanel, cb as SignupArgs, cc as SignupResult, cd as SingleSignOn, ce as SlugField, cf as SlugOf, cg as SsoOutcome, ch as SsoProviderRef, ci as StorageAdapter, cj as StoredFile, ck as TRIGRAM_LIKE_MIN, cl as TelemetryConfig, cm as TextField, cn as TextareaField, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cr as UncountedDocs, cs as UpdateInput, ct as UpdateOptions, cu as UploadConfig, cv as UploadField, cw as UploadFromURLConfig, cx as UserIdentity, cy as ValidationError, cz as Version, cA as VersionSummary, cB as VersionsConfig, cC as WEBHOOK_EVENTS, cD as WebhookConfig, cE as WebhookEvent, cF as Where, cG as WhereOperators, cH as anyone, cI as consoleEmail, cJ as consoleLogger, cK as createEasyCMS, cL as defineConfig, cM as defineFieldType, cN as definePlugin, cO as diskStorage, cP as hasRows, cQ as isAdmin, cR as isHasMany, cS as isSignedIn, cT as isStaff, cU as isSystemAdmin, cV as jsonLogger, cW as memorySearch, cX as mimeAllowedBy, cY as rowFields, cZ as silentLogger, c_ as uniqueWithinOf } from './config-CWTw3zFm.js';
+export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-BYaJUVpz.js';
+export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-DzAqr9gY.js';
 export { FieldCondition, matchesCondition } from './conditions.js';
 
 type DeliveryKind = 'webhook' | 'email';
@@ -259,5 +259,27 @@ declare const cacheTags: {
 /** The version of `@easy-cms/core`, set when the package is built. */
 declare const VERSION: string;
 
-export { EmailSetting, ID, PaginatedDocs, VERSION, cacheTags };
-export type { AdminAttention, AdminDeliveries, AdminDelivery, AdminEmail, AdminEmailDelivery, AdminJob, AdminJobs, AdminOutbox, AdminOutboxEntry, AdminScheduledJob, AdminStatus, AdminWebhookDelivery, BuiltInJob, DeliveryKind, DeliveryState, EmailCheck, SearchHit };
+/**
+ * `x-easy-cms-signature-v2` of one attempt: `v1=<hex HMAC-SHA256 of "<delivery>.<timestamp>.<body>">`.
+ * The timestamp (`x-easy-cms-timestamp`, Unix seconds) is the attempt's, so a captured request
+ * can't be replayed later, and the delivery id can't be paired with another body.
+ */
+declare function signWebhook(secret: string, delivery: string, timestamp: number, body: string): string;
+interface VerifyWebhookOptions {
+    /** How far the timestamp may be from now, in seconds. Default 300. */
+    readonly toleranceSeconds?: number;
+    /** Now, for tests. */
+    readonly now?: Date;
+}
+type HeaderSource = Headers | Readonly<Record<string, string | readonly string[] | undefined>>;
+/**
+ * Checks a webhook from Easy CMS and returns its payload: the signature (with `secret`, or any of
+ * several while one is replaced) over the delivery id, the timestamp and the raw body, and a
+ * timestamp within `toleranceSeconds` of now. Throws `UnauthorizedError` otherwise. Pass the body
+ * exactly as received, before parsing it. Also skip deliveries already handled
+ * (`x-easy-cms-delivery`): a replay within the tolerance has a valid signature.
+ */
+declare function verifyWebhook(body: string, headers: HeaderSource, secret: string | readonly string[], options?: VerifyWebhookOptions): WebhookPayload;
+
+export { EmailSetting, ID, PaginatedDocs, VERSION, WebhookPayload, cacheTags, signWebhook, verifyWebhook };
+export type { AdminAttention, AdminDeliveries, AdminDelivery, AdminEmail, AdminEmailDelivery, AdminJob, AdminJobs, AdminOutbox, AdminOutboxEntry, AdminScheduledJob, AdminStatus, AdminWebhookDelivery, BuiltInJob, DeliveryKind, DeliveryState, EmailCheck, SearchHit, VerifyWebhookOptions };

package/dist/index.js

@@ -24,9 +24,11 @@ import {
   memorySearch,
   resolveConfig,
   sharedEasyCMS,
+  signWebhook,
   silentLogger,
-  slugify
-} from "./chunk-Q3QLUBFK.js";
+  slugify,
+  verifyWebhook
+} from "./chunk-LPIABPBA.js";
 import {
   matchesCondition
 } from "./chunk-U266LV4M.js";
@@ -51,7 +53,7 @@ import {
   defineFieldType,
   definePlugin,
   warnDeprecated
-} from "./chunk-SKGKGKUN.js";
+} from "./chunk-RJGKAYUU.js";
 export {
   ADAPTER_API_VERSION,
   ADMIN_API_VERSION,
@@ -96,7 +98,9 @@ export {
   memorySearch,
   resolveConfig,
   sharedEasyCMS,
+  signWebhook,
   silentLogger,
   slugify,
+  verifyWebhook,
   warnDeprecated
 };

package/dist/internal.d.ts

@@ -1,6 +1,6 @@
 import { Config, Database, EasyCMS, NavGroup, CollectionConfig, ID, RawDocument, Field, ResolvedConfig, ConfigIssue } from './index.js';
-export { c_ as API_KEYS, c$ as API_KEY_GLOBAL_OPERATIONS, d0 as API_KEY_OPERATIONS, d1 as DEFAULT_MAX_VERSIONS, d2 as DEFAULT_PASSWORD_EMAILS, d3 as FIELD_TYPE_BASES, d4 as FOLDER_LEVELS, d5 as MediaFolders, d6 as SSO_COOKIE, d7 as codeOfStatus, cO as hasRows, cQ as isHasMany, d8 as isJsonLogger, d9 as keyAllows, da as logFormat, cW as mimeAllowedBy, cX as rowFields, cZ as uniqueWithinOf } from './config-BLxN8qcy.js';
-export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as isEmail, y as mergeForUpdate, z as parseId, E as platformClientIp, F as readCookie, G as validateFields, H as writeBackupFile } from './handler-Ccc-CwBq.js';
+export { c$ as API_KEYS, d0 as API_KEY_GLOBAL_OPERATIONS, d1 as API_KEY_OPERATIONS, d2 as DEFAULT_MAX_VERSIONS, d3 as DEFAULT_PASSWORD_EMAILS, d4 as FIELD_TYPE_BASES, d5 as FOLDER_LEVELS, d6 as MediaFolders, d7 as SSO_COOKIE, ck as TRIGRAM_LIKE_MIN, d8 as codeOfStatus, cP as hasRows, cR as isHasMany, d9 as isJsonLogger, da as keyAllows, db as logFormat, cX as mimeAllowedBy, cY as rowFields, c_ as uniqueWithinOf } from './config-CWTw3zFm.js';
+export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as isEmail, y as mergeForUpdate, z as parseId, E as platformClientIp, F as readCookie, G as validateFields, H as writeBackupFile } from './handler-DzAqr9gY.js';
 export { conditionIssues } from './conditions.js';
 
 /** The session cookie the REST API sets at login. */

package/dist/internal.js

@@ -57,7 +57,7 @@ import {
   verifyPassword,
   verifyTurnstile,
   writeBackupFile
-} from "./chunk-Q3QLUBFK.js";
+} from "./chunk-LPIABPBA.js";
 import {
   conditionIssues
 } from "./chunk-U266LV4M.js";
@@ -65,6 +65,7 @@ import {
   EXTENSIONS,
   FIELD_TYPE_BASES,
   MIME_GROUPS,
+  TRIGRAM_LIKE_MIN,
   codeOfStatus,
   expandMimeTypes,
   hasRows,
@@ -75,7 +76,7 @@ import {
   rowFields,
   sniffMimeType,
   uniqueWithinOf
-} from "./chunk-SKGKGKUN.js";
+} from "./chunk-RJGKAYUU.js";
 
 // src/typegen.ts
 var pascal = (name) => name.split(/[^A-Za-z0-9]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
@@ -271,6 +272,7 @@ export {
   MediaFolders,
   SESSION_COOKIE,
   SSO_COOKIE,
+  TRIGRAM_LIKE_MIN,
   applyDefaults,
   applyPlugins,
   checkFormToken,

package/dist/{plugin-JIb70PKm.d.ts → plugin-BYaJUVpz.d.ts}

@@ -1,4 +1,4 @@
-import { be as Label, aF as Field, I as ID, k as AdminLocale, t as AdminSwitcher, cg as SsoProviderRef } from './config-BLxN8qcy.js';
+import { bh as Label, F as Field, I as ID, o as AdminLocale, x as AdminSwitcher, ch as SsoProviderRef } from './config-CWTw3zFm.js';
 import { FieldCondition } from './conditions.js';
 
 /** A Web Component from an admin module, with its `props` (plain JSON). */
@@ -123,6 +123,8 @@ interface AdminCollection {
     };
     icon?: string;
     useAsTitle?: string;
+    /** Searches by title wait for this many characters (a title with `index: 'trigram'`). */
+    searchMin?: number;
     /** Documents open in a panel over the list. */
     editIn?: 'drawer';
     drafts: boolean;

package/dist/plugin.d.ts

@@ -1,3 +1,3 @@
-export { a as ADMIN_ICONS, g as AdminComponent, j as AdminIcon, S as AuthUser, a3 as CliCommand, a4 as CollectionAccess, a6 as CollectionConfig, ac as Config, ad as ConfigError, am as DashboardWidget, ax as EasyCMSError, aB as Endpoint, aC as EndpointRequest, aD as ErrorCode, aF as Field, aG as FieldAccess, aJ as FieldError, aM as FieldTypeBase, aN as FieldTypeDefinition, aO as FieldTypeValidateContext, a$ as ForbiddenError, b1 as GlobalConfig, I as ID, bb as JobConfig, be as Label, bs as NavGroup, bt as NotFoundError, bv as OnRequest, bw as OnRequestArgs, bz as PLUGIN_API_VERSION, bE as PayloadTooLargeError, bF as Plugin, bG as PluginInfo, bH as PluginTypes, bK as QueryError, bP as RequestContext, cm as TooManyRequestsError, cn as TypedPlugin, co as UnauthorizedError, cw as ValidationError, cE as Where, cL as defineFieldType, cM as definePlugin } from './config-BLxN8qcy.js';
-export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-JIb70PKm.js';
+export { e as ADMIN_ICONS, k as AdminComponent, n as AdminIcon, $ as AuthUser, ac as CliCommand, ad as CollectionAccess, af as CollectionConfig, C as Config, al as ConfigError, at as DashboardWidget, aD as EasyCMSError, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, F as Field, aL as FieldAccess, a as FieldError, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, b2 as ForbiddenError, b4 as GlobalConfig, I as ID, be as JobConfig, bh as Label, bu as NavGroup, bv as NotFoundError, bx as OnRequest, by as OnRequestArgs, bB as PLUGIN_API_VERSION, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bM as QueryError, bR as RequestContext, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cy as ValidationError, cF as Where, cM as defineFieldType, cN as definePlugin } from './config-CWTw3zFm.js';
+export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-BYaJUVpz.js';
 import './conditions.js';

package/dist/plugin.js

@@ -16,7 +16,7 @@ import {
   defineFieldType,
   definePlugin,
   warnDeprecated
-} from "./chunk-SKGKGKUN.js";
+} from "./chunk-RJGKAYUU.js";
 export {
   ADMIN_API_VERSION,
   ADMIN_ICONS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "1.15.1",
+  "version": "1.17.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",