@easy-cms/core 1.16.0 → 1.17.0

package/dist/{chunk-WGECYA3K.js → chunk-LPIABPBA.js}

@@ -1079,10 +1079,10 @@ async function verifyTurnstile(secretKey, response, ip, fetcher = fetch) {
 // src/auth/cookie.ts
 var SESSION_COOKIE = "ecms-session";
 var hostCookie = (name) => `__Host-${name}`;
-function cookieValue(header, name) {
-  if (!header) return void 0;
+function cookieValue(header2, name) {
+  if (!header2) return void 0;
   let plain;
-  for (const part of header.split(";")) {
+  for (const part of header2.split(";")) {
     const eq = part.indexOf("=");
     if (eq <= 0) continue;
     const key = part.slice(0, eq).trim();
@@ -3911,7 +3911,7 @@ var VersionStore = class {
 };
 
 // src/local-api.ts
-import { createHash as createHash5, createHmac as createHmac6, randomBytes as randomBytes6, randomUUID as randomUUID3, timingSafeEqual as timingSafeEqual5 } from "crypto";
+import { createHash as createHash5, createHmac as createHmac7, randomBytes as randomBytes6, randomUUID as randomUUID3, timingSafeEqual as timingSafeEqual6 } from "crypto";
 
 // src/auth/common-passwords.ts
 var LIST = `
@@ -5138,7 +5138,41 @@ var SearchIndex = class {
 };
 
 // src/webhooks.ts
-import { createHmac as createHmac5, randomUUID as randomUUID2 } from "crypto";
+import { createHmac as createHmac6, randomUUID as randomUUID2 } from "crypto";
+
+// src/webhook-signature.ts
+import { createHmac as createHmac5, timingSafeEqual as timingSafeEqual5 } from "crypto";
+var TOLERANCE_SECONDS = 5 * 60;
+function signWebhook(secret, delivery, timestamp, body) {
+  return `v1=${createHmac5("sha256", secret).update(`${delivery}.${timestamp}.${body}`).digest("hex")}`;
+}
+function header(headers, name) {
+  if (headers instanceof Headers) return headers.get(name) ?? void 0;
+  const value = Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1];
+  return Array.isArray(value) ? value[0] : value;
+}
+function equal(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual5(left, right);
+}
+function verifyWebhook(body, headers, secret, options = {}) {
+  const delivery = header(headers, "x-easy-cms-delivery");
+  const timestamp = header(headers, "x-easy-cms-timestamp");
+  const signatures2 = header(headers, "x-easy-cms-signature-v2");
+  if (!delivery || !timestamp || !signatures2)
+    throw new UnauthorizedError("Webhook signature missing");
+  const seconds = Number(timestamp);
+  const now = (options.now ?? /* @__PURE__ */ new Date()).getTime() / 1e3;
+  if (!/^\d+$/.test(timestamp) || Math.abs(now - seconds) > (options.toleranceSeconds ?? TOLERANCE_SECONDS))
+    throw new UnauthorizedError("Webhook timestamp too old or in the future");
+  const sent = signatures2.split(/[\s,]+/).filter((s) => s.startsWith("v1="));
+  const valid = [secret].flat().some((s) => sent.some((given) => equal(given, signWebhook(s, delivery, seconds, body))));
+  if (!valid) throw new UnauthorizedError("Webhook signature does not match");
+  return JSON.parse(body);
+}
+
+// src/webhooks.ts
 var WEBHOOK_EVENTS = [
   "create",
   "update",
@@ -5308,7 +5342,10 @@ var Webhooks = class {
       ...hook.headers
     };
     if (hook.secret) {
-      headers["x-easy-cms-signature"] = `sha256=${createHmac5("sha256", hook.secret).update(body).digest("hex")}`;
+      const timestamp = Math.floor(Date.now() / 1e3);
+      headers["x-easy-cms-timestamp"] = String(timestamp);
+      headers["x-easy-cms-signature-v2"] = signWebhook(hook.secret, delivery, timestamp, body);
+      headers["x-easy-cms-signature"] = `sha256=${createHmac6("sha256", hook.secret).update(body).digest("hex")}`;
     }
     try {
       const response = await this.fetcher(hook.url, {
@@ -7025,11 +7062,11 @@ function cacheTimes(config, container) {
     staleWhileRevalidate: own?.staleWhileRevalidate ?? config.httpCache?.staleWhileRevalidate ?? 300
   };
 }
-function matches2(header, etag) {
-  if (!header) return false;
-  if (header.trim() === "*") return true;
+function matches2(header2, etag) {
+  if (!header2) return false;
+  if (header2.trim() === "*") return true;
   const bare = (tag) => tag.trim().replace(/^W\//, "");
-  return header.split(",").some((tag) => bare(tag) === bare(etag));
+  return header2.split(",").some((tag) => bare(tag) === bare(etag));
 }
 function cacheableResponse(request, body, status, headers, times, tags) {
   headers.set(
@@ -7046,7 +7083,7 @@ function cacheableResponse(request, body, status, headers, times, tags) {
 }
 
 // src/version.ts
-var VERSION = true ? "1.16.0" : "0.0.0-dev";
+var VERSION = true ? "1.17.0" : "0.0.0-dev";
 
 // src/telemetry.ts
 var DB_CALLS = /* @__PURE__ */ new Set([
@@ -7710,7 +7747,7 @@ var EasyCMS = class {
   /** A value with its HMAC (`secret`), for `purpose` only: `<base64url JSON>.<signature>`. */
   sign(purpose, value) {
     const payload = Buffer.from(JSON.stringify(value)).toString("base64url");
-    const mac = createHmac6("sha256", this.config.secret).update(`${purpose}:${payload}`);
+    const mac = createHmac7("sha256", this.config.secret).update(`${purpose}:${payload}`);
     return `${payload}.${mac.digest("base64url")}`;
   }
   /** The value of a token made by `sign`, or `undefined` when it isn't genuine. */
@@ -7718,10 +7755,10 @@ var EasyCMS = class {
     const [payload, signature] = String(token).split(".");
     if (!payload || !signature) return void 0;
     const expected = Buffer.from(
-      createHmac6("sha256", this.config.secret).update(`${purpose}:${payload}`).digest("base64url")
+      createHmac7("sha256", this.config.secret).update(`${purpose}:${payload}`).digest("base64url")
     );
     const given = Buffer.from(signature);
-    if (expected.length !== given.length || !timingSafeEqual5(expected, given)) return void 0;
+    if (expected.length !== given.length || !timingSafeEqual6(expected, given)) return void 0;
     try {
       return JSON.parse(Buffer.from(payload, "base64url").toString());
     } catch {
@@ -7840,10 +7877,10 @@ var EasyCMS = class {
     if (!signature || !Number.isInteger(at) || at < Date.now() / 1e3) return false;
     const expected = Buffer.from(this.mediaSignature(key, at));
     const given = Buffer.from(signature);
-    return expected.length === given.length && timingSafeEqual5(expected, given);
+    return expected.length === given.length && timingSafeEqual6(expected, given);
   }
   mediaSignature(key, expires) {
-    return createHmac6("sha256", this.config.secret).update(`media:${key}:${expires}`).digest("base64url");
+    return createHmac7("sha256", this.config.secret).update(`media:${key}:${expires}`).digest("base64url");
   }
   /**
    * How many documents use any of these files in a top-level upload field (rich text and fields
@@ -12424,8 +12461,8 @@ async function route(cms, ctx, method, path, options) {
   if (first === "jobs" && second === "run" && third === void 0) {
     if (method !== "GET" && method !== "POST") throw methodNotAllowed(ctx, "GET, POST");
     const secret = cms.config.cronSecret ?? process.env.CRON_SECRET;
-    const header = ctx.request.headers.get("authorization") ?? "";
-    const byCron = !!secret && safeEqual(header, `Bearer ${secret}`);
+    const header2 = ctx.request.headers.get("authorization") ?? "";
+    const byCron = !!secret && safeEqual(header2, `Bearer ${secret}`);
     if (!byCron && !isSystemAdmin(ctx.user)) {
       throw ctx.user ? new HttpError("Forbidden", 403) : new UnauthorizedError();
     }
@@ -13553,6 +13590,8 @@ export {
   checkRenamedOptions,
   BUILTIN_NAV,
   memorySearch,
+  signWebhook,
+  verifyWebhook,
   WEBHOOK_EVENTS,
   MIN_SECRET_LENGTH,
   BUILTIN_COLLECTIONS,

package/dist/{config-BODu0yjp.d.ts → config-CWTw3zFm.d.ts}

@@ -2779,7 +2779,12 @@ interface WebhookConfig {
     readonly collections?: readonly string[];
     /** Globals to send events for. Default: all; `[]` for none. */
     readonly globals?: readonly string[];
-    /** Signs each body: `x-easy-cms-signature: sha256=<hex HMAC-SHA256 of the body>`. */
+    /**
+     * Signs each attempt: `x-easy-cms-timestamp` and `x-easy-cms-signature-v2` (`v1=<hex HMAC-SHA256
+     * of "<delivery>.<timestamp>.<body>">`, checked by `verifyWebhook()`). Also, until 2.0, the
+     * deprecated `x-easy-cms-signature: sha256=<hex HMAC-SHA256 of the body>`, which a captured
+     * request can be replayed with.
+     */
     readonly secret?: string;
     /** Extra request headers, e.g. a token the receiver checks. */
     readonly headers?: Readonly<Record<string, string>>;
@@ -3682,5 +3687,5 @@ interface ResolvedConfig extends Omit<Config, 'cors' | 'localization' | 'routes'
  */
 declare function defineConfig<const TConfig extends Config>(config: TConfig): TConfig;
 
-export { ADAPTER_API_VERSION as A, AuditLog as J, Auth as M, ADMIN_ICONS as a, ForbiddenError as a$, FIELD_TYPES as aE, ConfigError as ad, EasyCMS as aw, EasyCMSError as ax, PayloadTooLargeError as bE, QueryError as bK, ROLE_OPERATIONS as bL, Roles as bW, SchemaError as bZ, NotFoundError as bt, PLUGIN_API_VERSION as bz, API_KEYS as c$, WEBHOOK_EVENTS as cB, anyone as cH, consoleEmail as cI, consoleLogger as cJ, createEasyCMS as cK, defineConfig as cL, defineFieldType as cM, definePlugin as cN, diskStorage as cO, hasRows as cP, isAdmin as cQ, isHasMany as cR, isSignedIn as cS, isStaff as cT, isSystemAdmin as cU, jsonLogger as cV, memorySearch as cW, mimeAllowedBy as cX, rowFields as cY, silentLogger as cZ, uniqueWithinOf as c_, SingleSignOn as cc, TRIGRAM_LIKE_MIN as cj, TooManyRequestsError as cn, UnauthorizedError as cp, ValidationError as cx, API_KEY_GLOBAL_OPERATIONS as d0, API_KEY_OPERATIONS as d1, DEFAULT_MAX_VERSIONS as d2, DEFAULT_PASSWORD_EMAILS as d3, FIELD_TYPE_BASES as d4, FOLDER_LEVELS as d5, MediaFolders as d6, SSO_COOKIE as d7, codeOfStatus as d8, isJsonLogger as d9, keyAllows as da, logFormat as db };
-export type { BuiltinMediaCollection as $, ApiKeyOperation as B, ApiKeyPermissions as C, ArrayField as D, EmailSetting as E, AuditChange as F, AuditConfig as G, AuditEntry as H, ID as I, AuditPage as K, AuditVerification as L, AuthConfig as N, AuthProvider as O, PaginatedDocs as P, AuthProviderProfile as Q, AuthProviderRequest as R, AuthUser as S, BackupsConfig as T, BeforeChangeHook as U, BeforeDeleteHook as V, BeforeValidateHook as W, Block as X, BlocksField as Y, BooleanField as Z, BuiltinApiKeysCollection as _, BuiltinMediaFoldersCollection as a0, BuiltinUsersCollection as a1, BundleHints as a2, CliCommand as a3, CollectionAccess as a4, CollectionAdmin as a5, CollectionConfig as a6, CollectionDocument as a7, CollectionHooks as a8, CollectionListAdmin as a9, EmailMessage as aA, Endpoint as aB, EndpointRequest as aC, ErrorCode as aD, Field as aF, FieldAccess as aG, FieldAccessFn as aH, FieldAdmin as aI, FieldError as aJ, FieldRule as aK, FieldType as aL, FieldTypeBase as aM, FieldTypeDefinition as aN, FieldTypeValidateContext as aO, FieldValidate as aP, FieldValidateContext as aQ, FieldValue as aR, FieldsInput as aS, FieldsValue as aT, FilterOptions as aU, FilterOptionsArgs as aV, FindAfterArgs as aW, FindArgs as aX, FindOptions as aY, FolderLevel as aZ, FolderPermissions as a_, CollectionSearch as aa, CollectionSlug as ab, Config as ac, ConfigIssue as ae, ContainerAdmin as af, CreateEasyCMSOptions as ag, CreateInput as ah, CreateMigrationResult as ai, CursorDocs as aj, CustomField as ak, CustomFieldTypes as al, DashboardWidget as am, Database as an, DatabaseAdapter as ao, DatabaseInitArgs as ap, DatabaseTransfer as aq, DateField as ar, DepthOptions as as, DirectUpload as at, DiskStorageOptions as au, DocumentOf as av, EmailAdapter as ay, EmailField as az, Access as b, SearchAdapter as b$, GlobalAccess as b0, GlobalConfig as b1, GlobalDocument as b2, GlobalHooks as b3, GlobalInput as b4, GlobalSlug as b5, GroupField as b6, ImageSize as b7, IncrementOptions as b8, InferCollection as b9, PasswordEmail as bA, PasswordEmailArgs as bB, PasswordEmailFn as bC, PasswordLinkOptions as bD, Plugin as bF, PluginInfo as bG, PluginTypes as bH, PreviewTarget as bI, PreviewURL as bJ, RawDocument as bM, ReadOptions as bN, RelationshipField as bO, RequestContext as bP, ResolvedConfig as bQ, RichTextDocument as bR, RichTextField as bS, Role as bT, RoleOperation as bU, RolePermissions as bV, RoutesConfig as bX, ScheduledPublish as bY, SchemaMode as b_, InferGlobal as ba, JobConfig as bb, JsonField as bc, KeysetPage as bd, Label as be, LayoutNode as bf, LivePreview as bg, LocaleOf as bh, LocalizationConfig as bi, LogDetails as bj, Logger as bk, LoginArgs as bl, LogsConfig as bm, MediaDocument as bn, MediaSize as bo, MembersConfig as bp, MembersSignup as bq, MigrationInfo as br, NavGroup as bs, NumberField as bu, OnRequest as bv, OnRequestArgs as bw, Operation as bx, OutboxRow as by, AccessArgs as c, SearchEntry as c0, SearchHits as c1, SearchOptions as c2, SearchQuery as c3, SearchResults as c4, SearchSetting as c5, SelectField as c6, SelectOption as c7, Session as c8, SidebarPanel as c9, VersionsConfig as cA, WebhookConfig as cC, WebhookEvent as cD, WebhookPayload as cE, Where as cF, WhereOperators as cG, SignupArgs as ca, SignupResult as cb, SlugField as cd, SlugOf as ce, SsoOutcome as cf, SsoProviderRef as cg, StorageAdapter as ch, StoredFile as ci, TelemetryConfig as ck, TextField as cl, TextareaField as cm, TypedPlugin as co, UncountedDocs as cq, UpdateInput as cr, UpdateOptions as cs, UploadConfig as ct, UploadField as cu, UploadFromURLConfig as cv, UserIdentity as cw, Version as cy, VersionSummary as cz, AccessOptions as d, AdminBrand as e, AdminCommand as f, AdminComponent as g, AdminConfig as h, AdminFieldArgs as i, AdminIcon as j, AdminLocale as k, AdminPage as l, AdminRole as m, AdminRoleChange as n, AdminRoleField as o, AdminRoleTarget as p, AdminRoleView as q, AdminRoles as r, AdminSso as s, AdminSwitcher as t, AdminViewAccess as u, AfterChangeHook as v, AfterDeleteHook as w, AfterReadHook as x, ApiKeyContext as y, ApiKeyGlobalOperation as z };
+export { ADAPTER_API_VERSION as A, EasyCMS as E, AuditLog as S, Auth as V, EasyCMSError as aD, FIELD_TYPES as aK, ConfigError as al, ForbiddenError as b2, PLUGIN_API_VERSION as bB, PayloadTooLargeError as bG, QueryError as bM, ROLE_OPERATIONS as bN, Roles as bX, SchemaError as b_, NotFoundError as bv, API_KEYS as c$, WEBHOOK_EVENTS as cC, anyone as cH, consoleEmail as cI, consoleLogger as cJ, createEasyCMS as cK, defineConfig as cL, defineFieldType as cM, definePlugin as cN, diskStorage as cO, hasRows as cP, isAdmin as cQ, isHasMany as cR, isSignedIn as cS, isStaff as cT, isSystemAdmin as cU, jsonLogger as cV, memorySearch as cW, mimeAllowedBy as cX, rowFields as cY, silentLogger as cZ, uniqueWithinOf as c_, SingleSignOn as cd, TRIGRAM_LIKE_MIN as ck, TooManyRequestsError as co, UnauthorizedError as cq, ValidationError as cy, API_KEY_GLOBAL_OPERATIONS as d0, API_KEY_OPERATIONS as d1, DEFAULT_MAX_VERSIONS as d2, DEFAULT_PASSWORD_EMAILS as d3, FIELD_TYPE_BASES as d4, FOLDER_LEVELS as d5, MediaFolders as d6, SSO_COOKIE as d7, codeOfStatus as d8, isJsonLogger as d9, keyAllows as da, logFormat as db, ADMIN_ICONS as e };
+export type { AuthUser as $, AfterDeleteHook as B, Config as C, AfterReadHook as D, Field as F, ApiKeyContext as G, ApiKeyGlobalOperation as H, ID as I, ApiKeyOperation as J, ApiKeyPermissions as K, LocalizationConfig as L, ArrayField as M, AuditChange as N, AuditConfig as O, PaginatedDocs as P, AuditEntry as Q, ResolvedConfig as R, AuditPage as T, AuditVerification as U, WebhookPayload as W, AuthConfig as X, AuthProvider as Y, AuthProviderProfile as Z, AuthProviderRequest as _, FieldError as a, FindOptions as a$, BackupsConfig as a0, BeforeChangeHook as a1, BeforeDeleteHook as a2, BeforeValidateHook as a3, Block as a4, BlocksField as a5, BooleanField as a6, BuiltinApiKeysCollection as a7, BuiltinMediaCollection as a8, BuiltinMediaFoldersCollection as a9, DirectUpload as aA, DiskStorageOptions as aB, DocumentOf as aC, EmailAdapter as aE, EmailField as aF, EmailMessage as aG, Endpoint as aH, EndpointRequest as aI, ErrorCode as aJ, FieldAccess as aL, FieldAccessFn as aM, FieldAdmin as aN, FieldRule as aO, FieldType as aP, FieldTypeBase as aQ, FieldTypeDefinition as aR, FieldTypeValidateContext as aS, FieldValidate as aT, FieldValidateContext as aU, FieldValue as aV, FieldsInput as aW, FieldsValue as aX, FilterOptionsArgs as aY, FindAfterArgs as aZ, FindArgs as a_, BuiltinUsersCollection as aa, BundleHints as ab, CliCommand as ac, CollectionAccess as ad, CollectionAdmin as ae, CollectionConfig as af, CollectionDocument as ag, CollectionHooks as ah, CollectionListAdmin as ai, CollectionSearch as aj, CollectionSlug as ak, ConfigIssue as am, ContainerAdmin as an, CreateInput as ao, CreateMigrationResult as ap, CursorDocs as aq, CustomField as ar, CustomFieldTypes as as, DashboardWidget as at, Database as au, DatabaseAdapter as av, DatabaseInitArgs as aw, DatabaseTransfer as ax, DateField as ay, DepthOptions as az, FilterOptions as b, SchemaMode as b$, FolderLevel as b0, FolderPermissions as b1, GlobalAccess as b3, GlobalConfig as b4, GlobalDocument as b5, GlobalHooks as b6, GlobalInput as b7, GlobalSlug as b8, GroupField as b9, OutboxRow as bA, PasswordEmail as bC, PasswordEmailArgs as bD, PasswordEmailFn as bE, PasswordLinkOptions as bF, Plugin as bH, PluginInfo as bI, PluginTypes as bJ, PreviewTarget as bK, PreviewURL as bL, RawDocument as bO, ReadOptions as bP, RelationshipField as bQ, RequestContext as bR, RichTextDocument as bS, RichTextField as bT, Role as bU, RoleOperation as bV, RolePermissions as bW, RoutesConfig as bY, ScheduledPublish as bZ, ImageSize as ba, IncrementOptions as bb, InferCollection as bc, InferGlobal as bd, JobConfig as be, JsonField as bf, KeysetPage as bg, Label as bh, LayoutNode as bi, LivePreview as bj, LocaleOf as bk, LogDetails as bl, Logger as bm, LoginArgs as bn, LogsConfig as bo, MediaDocument as bp, MediaSize as bq, MembersConfig as br, MembersSignup as bs, MigrationInfo as bt, NavGroup as bu, NumberField as bw, OnRequest as bx, OnRequestArgs as by, Operation as bz, CreateEasyCMSOptions as c, SearchAdapter as c0, SearchEntry as c1, SearchHits as c2, SearchOptions as c3, SearchQuery as c4, SearchResults as c5, SearchSetting as c6, SelectField as c7, SelectOption as c8, Session as c9, VersionSummary as cA, VersionsConfig as cB, WebhookConfig as cD, WebhookEvent as cE, Where as cF, WhereOperators as cG, SidebarPanel as ca, SignupArgs as cb, SignupResult as cc, SlugField as ce, SlugOf as cf, SsoOutcome as cg, SsoProviderRef as ch, StorageAdapter as ci, StoredFile as cj, TelemetryConfig as cl, TextField as cm, TextareaField as cn, TypedPlugin as cp, UncountedDocs as cr, UpdateInput as cs, UpdateOptions as ct, UploadConfig as cu, UploadField as cv, UploadFromURLConfig as cw, UserIdentity as cx, Version as cz, EmailSetting as d, Access as f, AccessArgs as g, AccessOptions as h, AdminBrand as i, AdminCommand as j, AdminComponent as k, AdminConfig as l, AdminFieldArgs as m, AdminIcon as n, AdminLocale as o, AdminPage as p, AdminRole as q, AdminRoleChange as r, AdminRoleField as s, AdminRoleTarget as t, AdminRoleView as u, AdminRoles as v, AdminSso as w, AdminSwitcher as x, AdminViewAccess as y, AfterChangeHook as z };

package/dist/{handler-DOMtk2Vi.d.ts → handler-DzAqr9gY.d.ts}

@@ -1,4 +1,4 @@
-import { I as ID, ac as Config, aw as EasyCMS, bi as LocalizationConfig, aF as Field, aJ as FieldError, aU as FilterOptions, ag as CreateEasyCMSOptions, bQ as ResolvedConfig } from './config-BODu0yjp.js';
+import { I as ID, C as Config, E as EasyCMS, L as LocalizationConfig, F as Field, a as FieldError, b as FilterOptions, c as CreateEasyCMSOptions, R as ResolvedConfig } from './config-CWTw3zFm.js';
 
 /** Decrypts a file from `encryptBackup`; throws for another key or a changed file. */
 declare function decryptBackup(data: Uint8Array, encryptionKey: string): Uint8Array;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { P as PaginatedDocs, I as ID, E as EmailSetting } from './config-BODu0yjp.js';
-export { A as ADAPTER_API_VERSION, a as ADMIN_ICONS, b as Access, c as AccessArgs, d as AccessOptions, e as AdminBrand, f as AdminCommand, g as AdminComponent, h as AdminConfig, i as AdminFieldArgs, j as AdminIcon, k as AdminLocale, l as AdminPage, m as AdminRole, n as AdminRoleChange, o as AdminRoleField, p as AdminRoleTarget, q as AdminRoleView, r as AdminRoles, s as AdminSso, t as AdminSwitcher, u as AdminViewAccess, v as AfterChangeHook, w as AfterDeleteHook, x as AfterReadHook, y as ApiKeyContext, z as ApiKeyGlobalOperation, B as ApiKeyOperation, C as ApiKeyPermissions, D as ArrayField, F as AuditChange, G as AuditConfig, H as AuditEntry, J as AuditLog, K as AuditPage, L as AuditVerification, M as Auth, N as AuthConfig, O as AuthProvider, Q as AuthProviderProfile, R as AuthProviderRequest, S as AuthUser, T as BackupsConfig, U as BeforeChangeHook, V as BeforeDeleteHook, W as BeforeValidateHook, X as Block, Y as BlocksField, Z as BooleanField, _ as BuiltinApiKeysCollection, $ as BuiltinMediaCollection, a0 as BuiltinMediaFoldersCollection, a1 as BuiltinUsersCollection, a2 as BundleHints, a3 as CliCommand, a4 as CollectionAccess, a5 as CollectionAdmin, a6 as CollectionConfig, a7 as CollectionDocument, a8 as CollectionHooks, a9 as CollectionListAdmin, aa as CollectionSearch, ab as CollectionSlug, ac as Config, ad as ConfigError, ae as ConfigIssue, af as ContainerAdmin, ag as CreateEasyCMSOptions, ah as CreateInput, ai as CreateMigrationResult, aj as CursorDocs, ak as CustomField, al as CustomFieldTypes, am as DashboardWidget, an as Database, ao as DatabaseAdapter, ap as DatabaseInitArgs, aq as DatabaseTransfer, ar as DateField, as as DepthOptions, at as DirectUpload, au as DiskStorageOptions, av as DocumentOf, aw as EasyCMS, ax as EasyCMSError, ay as EmailAdapter, az as EmailField, aA as EmailMessage, aB as Endpoint, aC as EndpointRequest, aD as ErrorCode, aE as FIELD_TYPES, aF as Field, aG as FieldAccess, aH as FieldAccessFn, aI as FieldAdmin, aJ as FieldError, aK as FieldRule, aL as FieldType, aM as FieldTypeBase, aN as FieldTypeDefinition, aO as FieldTypeValidateContext, aP as FieldValidate, aQ as FieldValidateContext, aR as FieldValue, aS as FieldsInput, aT as FieldsValue, aU as FilterOptions, aV as FilterOptionsArgs, aW as FindAfterArgs, aX as FindArgs, aY as FindOptions, aZ as FolderLevel, a_ as FolderPermissions, a$ as ForbiddenError, b0 as GlobalAccess, b1 as GlobalConfig, b2 as GlobalDocument, b3 as GlobalHooks, b4 as GlobalInput, b5 as GlobalSlug, b6 as GroupField, b7 as ImageSize, b8 as IncrementOptions, b9 as InferCollection, ba as InferGlobal, bb as JobConfig, bc as JsonField, bd as KeysetPage, be as Label, bf as LayoutNode, bg as LivePreview, bh as LocaleOf, bi as LocalizationConfig, bj as LogDetails, bk as Logger, bl as LoginArgs, bm as LogsConfig, bn as MediaDocument, bo as MediaSize, bp as MembersConfig, bq as MembersSignup, br as MigrationInfo, bs as NavGroup, bt as NotFoundError, bu as NumberField, bv as OnRequest, bw as OnRequestArgs, bx as Operation, by as OutboxRow, bz as PLUGIN_API_VERSION, bA as PasswordEmail, bB as PasswordEmailArgs, bC as PasswordEmailFn, bD as PasswordLinkOptions, bE as PayloadTooLargeError, bF as Plugin, bG as PluginInfo, bH as PluginTypes, bI as PreviewTarget, bJ as PreviewURL, bK as QueryError, bL as ROLE_OPERATIONS, bM as RawDocument, bN as ReadOptions, bO as RelationshipField, bP as RequestContext, bQ as ResolvedConfig, bR as RichTextDocument, bS as RichTextField, bT as Role, bU as RoleOperation, bV as RolePermissions, bW as Roles, bX as RoutesConfig, bY as ScheduledPublish, bZ as SchemaError, b_ as SchemaMode, b$ as SearchAdapter, c0 as SearchEntry, c1 as SearchHits, c2 as SearchOptions, c3 as SearchQuery, c4 as SearchResults, c5 as SearchSetting, c6 as SelectField, c7 as SelectOption, c8 as Session, c9 as SidebarPanel, ca as SignupArgs, cb as SignupResult, cc as SingleSignOn, cd as SlugField, ce as SlugOf, cf as SsoOutcome, cg as SsoProviderRef, ch as StorageAdapter, ci as StoredFile, cj as TRIGRAM_LIKE_MIN, ck as TelemetryConfig, cl as TextField, cm as TextareaField, cn as TooManyRequestsError, co as TypedPlugin, cp as UnauthorizedError, cq as UncountedDocs, cr as UpdateInput, cs as UpdateOptions, ct as UploadConfig, cu as UploadField, cv as UploadFromURLConfig, cw as UserIdentity, cx as ValidationError, cy as Version, cz as VersionSummary, cA as VersionsConfig, cB as WEBHOOK_EVENTS, cC as WebhookConfig, cD as WebhookEvent, cE as WebhookPayload, cF as Where, cG as WhereOperators, cH as anyone, cI as consoleEmail, cJ as consoleLogger, cK as createEasyCMS, cL as defineConfig, cM as defineFieldType, cN as definePlugin, cO as diskStorage, cP as hasRows, cQ as isAdmin, cR as isHasMany, cS as isSignedIn, cT as isStaff, cU as isSystemAdmin, cV as jsonLogger, cW as memorySearch, cX as mimeAllowedBy, cY as rowFields, cZ as silentLogger, c_ as uniqueWithinOf } from './config-BODu0yjp.js';
-export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-PyUqbeK2.js';
-export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-DOMtk2Vi.js';
+import { P as PaginatedDocs, I as ID, d as EmailSetting, W as WebhookPayload } from './config-CWTw3zFm.js';
+export { A as ADAPTER_API_VERSION, e as ADMIN_ICONS, f as Access, g as AccessArgs, h as AccessOptions, i as AdminBrand, j as AdminCommand, k as AdminComponent, l as AdminConfig, m as AdminFieldArgs, n as AdminIcon, o as AdminLocale, p as AdminPage, q as AdminRole, r as AdminRoleChange, s as AdminRoleField, t as AdminRoleTarget, u as AdminRoleView, v as AdminRoles, w as AdminSso, x as AdminSwitcher, y as AdminViewAccess, z as AfterChangeHook, B as AfterDeleteHook, D as AfterReadHook, G as ApiKeyContext, H as ApiKeyGlobalOperation, J as ApiKeyOperation, K as ApiKeyPermissions, M as ArrayField, N as AuditChange, O as AuditConfig, Q as AuditEntry, S as AuditLog, T as AuditPage, U as AuditVerification, V as Auth, X as AuthConfig, Y as AuthProvider, Z as AuthProviderProfile, _ as AuthProviderRequest, $ as AuthUser, a0 as BackupsConfig, a1 as BeforeChangeHook, a2 as BeforeDeleteHook, a3 as BeforeValidateHook, a4 as Block, a5 as BlocksField, a6 as BooleanField, a7 as BuiltinApiKeysCollection, a8 as BuiltinMediaCollection, a9 as BuiltinMediaFoldersCollection, aa as BuiltinUsersCollection, ab as BundleHints, ac as CliCommand, ad as CollectionAccess, ae as CollectionAdmin, af as CollectionConfig, ag as CollectionDocument, ah as CollectionHooks, ai as CollectionListAdmin, aj as CollectionSearch, ak as CollectionSlug, C as Config, al as ConfigError, am as ConfigIssue, an as ContainerAdmin, c as CreateEasyCMSOptions, ao as CreateInput, ap as CreateMigrationResult, aq as CursorDocs, ar as CustomField, as as CustomFieldTypes, at as DashboardWidget, au as Database, av as DatabaseAdapter, aw as DatabaseInitArgs, ax as DatabaseTransfer, ay as DateField, az as DepthOptions, aA as DirectUpload, aB as DiskStorageOptions, aC as DocumentOf, E as EasyCMS, aD as EasyCMSError, aE as EmailAdapter, aF as EmailField, aG as EmailMessage, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, aK as FIELD_TYPES, F as Field, aL as FieldAccess, aM as FieldAccessFn, aN as FieldAdmin, a as FieldError, aO as FieldRule, aP as FieldType, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, aT as FieldValidate, aU as FieldValidateContext, aV as FieldValue, aW as FieldsInput, aX as FieldsValue, b as FilterOptions, aY as FilterOptionsArgs, aZ as FindAfterArgs, a_ as FindArgs, a$ as FindOptions, b0 as FolderLevel, b1 as FolderPermissions, b2 as ForbiddenError, b3 as GlobalAccess, b4 as GlobalConfig, b5 as GlobalDocument, b6 as GlobalHooks, b7 as GlobalInput, b8 as GlobalSlug, b9 as GroupField, ba as ImageSize, bb as IncrementOptions, bc as InferCollection, bd as InferGlobal, be as JobConfig, bf as JsonField, bg as KeysetPage, bh as Label, bi as LayoutNode, bj as LivePreview, bk as LocaleOf, L as LocalizationConfig, bl as LogDetails, bm as Logger, bn as LoginArgs, bo as LogsConfig, bp as MediaDocument, bq as MediaSize, br as MembersConfig, bs as MembersSignup, bt as MigrationInfo, bu as NavGroup, bv as NotFoundError, bw as NumberField, bx as OnRequest, by as OnRequestArgs, bz as Operation, bA as OutboxRow, bB as PLUGIN_API_VERSION, bC as PasswordEmail, bD as PasswordEmailArgs, bE as PasswordEmailFn, bF as PasswordLinkOptions, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bK as PreviewTarget, bL as PreviewURL, bM as QueryError, bN as ROLE_OPERATIONS, bO as RawDocument, bP as ReadOptions, bQ as RelationshipField, bR as RequestContext, R as ResolvedConfig, bS as RichTextDocument, bT as RichTextField, bU as Role, bV as RoleOperation, bW as RolePermissions, bX as Roles, bY as RoutesConfig, bZ as ScheduledPublish, b_ as SchemaError, b$ as SchemaMode, c0 as SearchAdapter, c1 as SearchEntry, c2 as SearchHits, c3 as SearchOptions, c4 as SearchQuery, c5 as SearchResults, c6 as SearchSetting, c7 as SelectField, c8 as SelectOption, c9 as Session, ca as SidebarPanel, cb as SignupArgs, cc as SignupResult, cd as SingleSignOn, ce as SlugField, cf as SlugOf, cg as SsoOutcome, ch as SsoProviderRef, ci as StorageAdapter, cj as StoredFile, ck as TRIGRAM_LIKE_MIN, cl as TelemetryConfig, cm as TextField, cn as TextareaField, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cr as UncountedDocs, cs as UpdateInput, ct as UpdateOptions, cu as UploadConfig, cv as UploadField, cw as UploadFromURLConfig, cx as UserIdentity, cy as ValidationError, cz as Version, cA as VersionSummary, cB as VersionsConfig, cC as WEBHOOK_EVENTS, cD as WebhookConfig, cE as WebhookEvent, cF as Where, cG as WhereOperators, cH as anyone, cI as consoleEmail, cJ as consoleLogger, cK as createEasyCMS, cL as defineConfig, cM as defineFieldType, cN as definePlugin, cO as diskStorage, cP as hasRows, cQ as isAdmin, cR as isHasMany, cS as isSignedIn, cT as isStaff, cU as isSystemAdmin, cV as jsonLogger, cW as memorySearch, cX as mimeAllowedBy, cY as rowFields, cZ as silentLogger, c_ as uniqueWithinOf } from './config-CWTw3zFm.js';
+export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-BYaJUVpz.js';
+export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-DzAqr9gY.js';
 export { FieldCondition, matchesCondition } from './conditions.js';
 
 type DeliveryKind = 'webhook' | 'email';
@@ -259,5 +259,27 @@ declare const cacheTags: {
 /** The version of `@easy-cms/core`, set when the package is built. */
 declare const VERSION: string;
 
-export { EmailSetting, ID, PaginatedDocs, VERSION, cacheTags };
-export type { AdminAttention, AdminDeliveries, AdminDelivery, AdminEmail, AdminEmailDelivery, AdminJob, AdminJobs, AdminOutbox, AdminOutboxEntry, AdminScheduledJob, AdminStatus, AdminWebhookDelivery, BuiltInJob, DeliveryKind, DeliveryState, EmailCheck, SearchHit };
+/**
+ * `x-easy-cms-signature-v2` of one attempt: `v1=<hex HMAC-SHA256 of "<delivery>.<timestamp>.<body>">`.
+ * The timestamp (`x-easy-cms-timestamp`, Unix seconds) is the attempt's, so a captured request
+ * can't be replayed later, and the delivery id can't be paired with another body.
+ */
+declare function signWebhook(secret: string, delivery: string, timestamp: number, body: string): string;
+interface VerifyWebhookOptions {
+    /** How far the timestamp may be from now, in seconds. Default 300. */
+    readonly toleranceSeconds?: number;
+    /** Now, for tests. */
+    readonly now?: Date;
+}
+type HeaderSource = Headers | Readonly<Record<string, string | readonly string[] | undefined>>;
+/**
+ * Checks a webhook from Easy CMS and returns its payload: the signature (with `secret`, or any of
+ * several while one is replaced) over the delivery id, the timestamp and the raw body, and a
+ * timestamp within `toleranceSeconds` of now. Throws `UnauthorizedError` otherwise. Pass the body
+ * exactly as received, before parsing it. Also skip deliveries already handled
+ * (`x-easy-cms-delivery`): a replay within the tolerance has a valid signature.
+ */
+declare function verifyWebhook(body: string, headers: HeaderSource, secret: string | readonly string[], options?: VerifyWebhookOptions): WebhookPayload;
+
+export { EmailSetting, ID, PaginatedDocs, VERSION, WebhookPayload, cacheTags, signWebhook, verifyWebhook };
+export type { AdminAttention, AdminDeliveries, AdminDelivery, AdminEmail, AdminEmailDelivery, AdminJob, AdminJobs, AdminOutbox, AdminOutboxEntry, AdminScheduledJob, AdminStatus, AdminWebhookDelivery, BuiltInJob, DeliveryKind, DeliveryState, EmailCheck, SearchHit, VerifyWebhookOptions };

package/dist/index.js

@@ -24,9 +24,11 @@ import {
   memorySearch,
   resolveConfig,
   sharedEasyCMS,
+  signWebhook,
   silentLogger,
-  slugify
-} from "./chunk-WGECYA3K.js";
+  slugify,
+  verifyWebhook
+} from "./chunk-LPIABPBA.js";
 import {
   matchesCondition
 } from "./chunk-U266LV4M.js";
@@ -96,7 +98,9 @@ export {
   memorySearch,
   resolveConfig,
   sharedEasyCMS,
+  signWebhook,
   silentLogger,
   slugify,
+  verifyWebhook,
   warnDeprecated
 };

package/dist/internal.d.ts

@@ -1,6 +1,6 @@
 import { Config, Database, EasyCMS, NavGroup, CollectionConfig, ID, RawDocument, Field, ResolvedConfig, ConfigIssue } from './index.js';
-export { c$ as API_KEYS, d0 as API_KEY_GLOBAL_OPERATIONS, d1 as API_KEY_OPERATIONS, d2 as DEFAULT_MAX_VERSIONS, d3 as DEFAULT_PASSWORD_EMAILS, d4 as FIELD_TYPE_BASES, d5 as FOLDER_LEVELS, d6 as MediaFolders, d7 as SSO_COOKIE, cj as TRIGRAM_LIKE_MIN, d8 as codeOfStatus, cP as hasRows, cR as isHasMany, d9 as isJsonLogger, da as keyAllows, db as logFormat, cX as mimeAllowedBy, cY as rowFields, c_ as uniqueWithinOf } from './config-BODu0yjp.js';
-export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as isEmail, y as mergeForUpdate, z as parseId, E as platformClientIp, F as readCookie, G as validateFields, H as writeBackupFile } from './handler-DOMtk2Vi.js';
+export { c$ as API_KEYS, d0 as API_KEY_GLOBAL_OPERATIONS, d1 as API_KEY_OPERATIONS, d2 as DEFAULT_MAX_VERSIONS, d3 as DEFAULT_PASSWORD_EMAILS, d4 as FIELD_TYPE_BASES, d5 as FOLDER_LEVELS, d6 as MediaFolders, d7 as SSO_COOKIE, ck as TRIGRAM_LIKE_MIN, d8 as codeOfStatus, cP as hasRows, cR as isHasMany, d9 as isJsonLogger, da as keyAllows, db as logFormat, cX as mimeAllowedBy, cY as rowFields, c_ as uniqueWithinOf } from './config-CWTw3zFm.js';
+export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as isEmail, y as mergeForUpdate, z as parseId, E as platformClientIp, F as readCookie, G as validateFields, H as writeBackupFile } from './handler-DzAqr9gY.js';
 export { conditionIssues } from './conditions.js';
 
 /** The session cookie the REST API sets at login. */

package/dist/internal.js

@@ -57,7 +57,7 @@ import {
   verifyPassword,
   verifyTurnstile,
   writeBackupFile
-} from "./chunk-WGECYA3K.js";
+} from "./chunk-LPIABPBA.js";
 import {
   conditionIssues
 } from "./chunk-U266LV4M.js";

package/dist/{plugin-PyUqbeK2.d.ts → plugin-BYaJUVpz.d.ts}

@@ -1,4 +1,4 @@
-import { be as Label, aF as Field, I as ID, k as AdminLocale, t as AdminSwitcher, cg as SsoProviderRef } from './config-BODu0yjp.js';
+import { bh as Label, F as Field, I as ID, o as AdminLocale, x as AdminSwitcher, ch as SsoProviderRef } from './config-CWTw3zFm.js';
 import { FieldCondition } from './conditions.js';
 
 /** A Web Component from an admin module, with its `props` (plain JSON). */

package/dist/plugin.d.ts

@@ -1,3 +1,3 @@
-export { a as ADMIN_ICONS, g as AdminComponent, j as AdminIcon, S as AuthUser, a3 as CliCommand, a4 as CollectionAccess, a6 as CollectionConfig, ac as Config, ad as ConfigError, am as DashboardWidget, ax as EasyCMSError, aB as Endpoint, aC as EndpointRequest, aD as ErrorCode, aF as Field, aG as FieldAccess, aJ as FieldError, aM as FieldTypeBase, aN as FieldTypeDefinition, aO as FieldTypeValidateContext, a$ as ForbiddenError, b1 as GlobalConfig, I as ID, bb as JobConfig, be as Label, bs as NavGroup, bt as NotFoundError, bv as OnRequest, bw as OnRequestArgs, bz as PLUGIN_API_VERSION, bE as PayloadTooLargeError, bF as Plugin, bG as PluginInfo, bH as PluginTypes, bK as QueryError, bP as RequestContext, cn as TooManyRequestsError, co as TypedPlugin, cp as UnauthorizedError, cx as ValidationError, cF as Where, cM as defineFieldType, cN as definePlugin } from './config-BODu0yjp.js';
-export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-PyUqbeK2.js';
+export { e as ADMIN_ICONS, k as AdminComponent, n as AdminIcon, $ as AuthUser, ac as CliCommand, ad as CollectionAccess, af as CollectionConfig, C as Config, al as ConfigError, at as DashboardWidget, aD as EasyCMSError, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, F as Field, aL as FieldAccess, a as FieldError, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, b2 as ForbiddenError, b4 as GlobalConfig, I as ID, be as JobConfig, bh as Label, bu as NavGroup, bv as NotFoundError, bx as OnRequest, by as OnRequestArgs, bB as PLUGIN_API_VERSION, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bM as QueryError, bR as RequestContext, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cy as ValidationError, cF as Where, cM as defineFieldType, cN as definePlugin } from './config-CWTw3zFm.js';
+export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-BYaJUVpz.js';
 import './conditions.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "1.16.0",
+  "version": "1.17.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",