@easy-cms/core 1.16.0 → 1.18.0

package/dist/{chunk-WGECYA3K.js → chunk-NTAFZ4M6.js}

@@ -45,6 +45,99 @@ var isStaff = ({ user }) => user !== null && user.member !== true;
 var isSignedIn = ({ user }) => user !== null;
 var isAdmin = ({ user }) => user?.role === "admin" && user.scoped !== true;
 
+// src/auth/tokens.ts
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
+function newToken() {
+  return randomBytes(32).toString("base64url");
+}
+function hashToken(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+function hmac(secret, value) {
+  return createHmac("sha256", secret).update(value).digest("base64url");
+}
+function secretsOf(config) {
+  return [config.secret, ...config.previousSecrets ?? []];
+}
+function signedWith(secrets, value, signature) {
+  return [secrets].flat().some((secret) => safeEqual(signature, hmac(secret, value)));
+}
+function signToken(secret, token) {
+  return `${token}.${hmac(secret, `session:${token}`)}`;
+}
+function unsignToken(secrets, value) {
+  const dot = value.lastIndexOf(".");
+  if (dot <= 0) return void 0;
+  const token = value.slice(0, dot);
+  return signedWith(secrets, `session:${token}`, value.slice(dot + 1)) ? token : void 0;
+}
+function csrfToken(secret, token) {
+  return hmac(secret, `csrf:${token}`);
+}
+function csrfMatches(secrets, token, given) {
+  return signedWith(secrets, `csrf:${token}`, given);
+}
+function safeEqual(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+function signPreviewToken(secret, target, expiresAt, user) {
+  const payload = Buffer.from(
+    JSON.stringify({
+      ..."global" in target ? { g: target.global } : { c: target.collection, i: target.id },
+      e: expiresAt,
+      ...user !== void 0 ? { u: user } : {}
+    })
+  ).toString("base64url");
+  return `${payload}.${hmac(secret, `preview:${payload}`)}`;
+}
+function verifyPreviewToken(secrets, token, now = Date.now()) {
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0) return null;
+  const payload = token.slice(0, dot);
+  if (!signedWith(secrets, `preview:${payload}`, token.slice(dot + 1))) return null;
+  try {
+    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (typeof data.e !== "number" || data.e <= now) return null;
+    const user = typeof data.u === "string" ? { user: data.u } : {};
+    if (typeof data.g === "string") return { global: data.g, expiresAt: data.e, ...user };
+    if (typeof data.c === "string" && typeof data.i === "string")
+      return { collection: data.c, id: data.i, expiresAt: data.e, ...user };
+    return null;
+  } catch {
+    return null;
+  }
+}
+function passwordFingerprint(passwordHash) {
+  return createHash("sha256").update(typeof passwordHash === "string" ? passwordHash : "no-password").digest("base64url").slice(0, 22);
+}
+function signPasswordToken(secret, args) {
+  const payload = Buffer.from(
+    JSON.stringify({ u: args.userId, p: args.purpose, e: args.expiresAt })
+  ).toString("base64url");
+  return `${payload}.${hmac(secret, `password:${payload}:${args.fingerprint}`)}`;
+}
+function readPasswordToken(token) {
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0) return null;
+  const payload = token.slice(0, dot);
+  try {
+    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (typeof data.u !== "string" || typeof data.e !== "number") return null;
+    if (data.p !== "reset" && data.p !== "invite" && data.p !== "verify") return null;
+    return { userId: data.u, purpose: data.p, expiresAt: data.e, payload };
+  } catch {
+    return null;
+  }
+}
+function passwordTokenMatches(secrets, token, fingerprint) {
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0) return false;
+  const payload = token.slice(0, dot);
+  return signedWith(secrets, `password:${payload}:${fingerprint}`, token.slice(dot + 1));
+}
+
 // src/builtins.ts
 var USERS = "users";
 var MEDIA = "media";
@@ -563,7 +656,7 @@ var emailDeliveriesCollection = {
 
 // src/audit.ts
 import { AsyncLocalStorage } from "async_hooks";
-import { createHmac } from "crypto";
+import { createHmac as createHmac2 } from "crypto";
 var DEFAULT_AUDIT_KEEP = 365;
 var DEFAULT_FAILED_LOGINS = 20;
 var MAX_VALUE = 500;
@@ -778,7 +871,7 @@ var AuditLog = class {
       });
       for (const row of result.docs) {
         checked++;
-        if (row.signature !== this.sign(row)) invalid.push(row.id);
+        if (!this.signer(row)) invalid.push(row.id);
         const id = Number(row.id);
         if (previous !== void 0 && Number.isInteger(id) && id > previous + 1)
           gaps += id - previous - 1;
@@ -797,6 +890,49 @@ var AuditLog = class {
     );
     return verification;
   }
+  /** The secret an entry was signed with: the current one, a previous one, or none (changed). */
+  signer(row) {
+    return secretsOf(this.cms.config).find((secret) => row.signature === this.sign(row, secret));
+  }
+  /**
+   * After `secret` changed: signs again, with the current secret, the entries signed with one of
+   * `previousSecrets`, so they still verify once it is removed. Entries no secret verifies were
+   * changed: they are left as they are, and reported. Records `audit.resign`.
+   */
+  async resign() {
+    const invalid = [];
+    let checked = 0;
+    let resigned = 0;
+    for (let page = 1; ; page++) {
+      const result = await this.cms.db.find({
+        collection: AUDIT_LOGS,
+        sort: ["id"],
+        limit: 500,
+        page
+      });
+      for (const row of result.docs) {
+        checked++;
+        const secret = this.signer(row);
+        if (secret === void 0) invalid.push(row.id);
+        else if (secret !== this.cms.config.secret) {
+          const { id, ...data } = row;
+          await this.cms.db.update({
+            collection: AUDIT_LOGS,
+            id,
+            data: { ...data, signature: this.sign(row) }
+          });
+          resigned++;
+        }
+      }
+      if (page >= result.totalPages) break;
+    }
+    await this.record({
+      action: "audit.resign",
+      target: "audit",
+      detail: { checked, resigned, invalid: invalid.length }
+    });
+    return { checked, resigned, invalid };
+  }
   /**
    * Daily upkeep from `runJobs`: deletes entries older than `keep` days, then verifies the log.
    * Runs when the last check is more than a day old.
@@ -847,11 +983,11 @@ var AuditLog = class {
     const scope = this.settings.scope;
     return (scope && context ? scope({ context, user }) : null) ?? null;
   }
-  sign(row) {
+  sign(row, secret = this.cms.config.secret) {
     const values = SIGNED.map((key) => row[key] ?? null);
     if (typeof row.scope === "string" && row.scope) values.push(row.scope);
     const payload = stable(values);
-    return createHmac("sha256", this.cms.config.secret).update(`audit:${payload}`).digest("base64url");
+    return createHmac2("sha256", secret).update(`audit:${payload}`).digest("base64url");
   }
   async lastVerification() {
     const { docs } = await this.cms.db.find({
@@ -903,7 +1039,7 @@ function toEntry(row) {
 }
 
 // src/api-keys.ts
-import { createHash, randomBytes, timingSafeEqual } from "crypto";
+import { createHash as createHash2, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var API_KEYS = "api-keys";
 var API_KEY_OPERATIONS = ["read", "create", "update", "delete", "publish"];
 var API_KEY_GLOBAL_OPERATIONS = ["read", "update", "publish"];
@@ -913,12 +1049,12 @@ function isApiKey(token) {
   return token.startsWith("ecms_");
 }
 function newApiKey() {
-  const prefix = randomBytes(4).toString("hex");
-  const secret = randomBytes(32).toString("base64url");
+  const prefix = randomBytes2(4).toString("hex");
+  const secret = randomBytes2(32).toString("base64url");
   return { key: `ecms_${prefix}_${secret}`, prefix, hash: hashSecret(secret) };
 }
 function hashSecret(secret) {
-  return createHash("sha256").update(secret).digest("hex");
+  return createHash2("sha256").update(secret).digest("hex");
 }
 function parseApiKey(token) {
   const match = KEY_PATTERN.exec(token);
@@ -928,7 +1064,7 @@ function secretMatches(secret, hash) {
   if (typeof hash !== "string") return false;
   const a = Buffer.from(hashSecret(secret), "hex");
   const b = Buffer.from(hash, "hex");
-  return a.length === b.length && timingSafeEqual(a, b);
+  return a.length === b.length && timingSafeEqual2(a, b);
 }
 function keyAllows(user, target, operation) {
   const key = user?.apiKey;
@@ -1035,20 +1171,23 @@ function cleanPermissions(value, known) {
 }
 
 // src/spam.ts
-import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual3 } from "crypto";
 var MAX_AGE = 24 * 36e5;
-var sign = (secret, value) => createHmac2("sha256", secret).update(value).digest("base64url");
+var sign = (secret, value) => createHmac3("sha256", secret).update(value).digest("base64url");
 function formToken(secret, purpose, now = Date.now()) {
   return `${now}.${sign(secret, `${purpose}:${now}`)}`;
 }
-function checkFormToken(secret, purpose, token, minTime, now = Date.now()) {
+function checkFormToken(secrets, purpose, token, minTime, now = Date.now()) {
   if (typeof token !== "string") return "invalid";
   const [time, signature] = token.split(".");
   const issued = Number(time);
   if (!Number.isFinite(issued) || !signature) return "invalid";
-  const expected = Buffer.from(sign(secret, `${purpose}:${issued}`));
   const given = Buffer.from(signature);
-  if (expected.length !== given.length || !timingSafeEqual2(expected, given)) return "invalid";
+  const genuine = [secrets].flat().some((secret) => {
+    const expected = Buffer.from(sign(secret, `${purpose}:${issued}`));
+    return expected.length === given.length && timingSafeEqual3(expected, given);
+  });
+  if (!genuine) return "invalid";
   if (now - issued < minTime) return "too-fast";
   if (now - issued > MAX_AGE) return "expired";
   return "ok";
@@ -1079,10 +1218,10 @@ async function verifyTurnstile(secretKey, response, ip, fetcher = fetch) {
 // src/auth/cookie.ts
 var SESSION_COOKIE = "ecms-session";
 var hostCookie = (name) => `__Host-${name}`;
-function cookieValue(header, name) {
-  if (!header) return void 0;
+function cookieValue(header2, name) {
+  if (!header2) return void 0;
   let plain;
-  for (const part of header.split(";")) {
+  for (const part of header2.split(";")) {
     const eq = part.indexOf("=");
     if (eq <= 0) continue;
     const key = part.slice(0, eq).trim();
@@ -1172,7 +1311,7 @@ var DEFAULT_PASSWORD_EMAILS = {
 };
 
 // src/auth/password.ts
-import { randomBytes as randomBytes2, scrypt, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { randomBytes as randomBytes3, scrypt, timingSafeEqual as timingSafeEqual4 } from "crypto";
 var MIN_PASSWORD_LENGTH = 8;
 var N = 2 ** 17;
 var R = 8;
@@ -1191,7 +1330,7 @@ function derive(password, salt, n, r, p, length) {
   });
 }
 async function hashPassword(password) {
-  const salt = randomBytes2(16);
+  const salt = randomBytes3(16);
   const key = await derive(password, salt, N, R, P, KEY_LENGTH);
   return ["scrypt", N, R, P, salt.toString("base64url"), key.toString("base64url")].join("$");
 }
@@ -1207,7 +1346,7 @@ async function verifyPassword(password, stored) {
     Number(p),
     expected.length
   );
-  return key.length === expected.length && timingSafeEqual3(key, expected);
+  return key.length === expected.length && timingSafeEqual4(key, expected);
 }
 var dummyHash;
 async function fakeVerify(password) {
@@ -1218,92 +1357,6 @@ async function fakeVerify(password) {
 
 // src/auth/sso.ts
 import { createHmac as createHmac4, randomBytes as randomBytes4 } from "crypto";
-
-// src/auth/tokens.ts
-import { createHash as createHash2, createHmac as createHmac3, randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual4 } from "crypto";
-function newToken() {
-  return randomBytes3(32).toString("base64url");
-}
-function hashToken(token) {
-  return createHash2("sha256").update(token).digest("hex");
-}
-function hmac(secret, value) {
-  return createHmac3("sha256", secret).update(value).digest("base64url");
-}
-function signToken(secret, token) {
-  return `${token}.${hmac(secret, `session:${token}`)}`;
-}
-function unsignToken(secret, value) {
-  const dot = value.lastIndexOf(".");
-  if (dot <= 0) return void 0;
-  const token = value.slice(0, dot);
-  return safeEqual(value.slice(dot + 1), hmac(secret, `session:${token}`)) ? token : void 0;
-}
-function csrfToken(secret, token) {
-  return hmac(secret, `csrf:${token}`);
-}
-function safeEqual(a, b) {
-  const left = Buffer.from(a);
-  const right = Buffer.from(b);
-  return left.length === right.length && timingSafeEqual4(left, right);
-}
-function signPreviewToken(secret, target, expiresAt, user) {
-  const payload = Buffer.from(
-    JSON.stringify({
-      ..."global" in target ? { g: target.global } : { c: target.collection, i: target.id },
-      e: expiresAt,
-      ...user !== void 0 ? { u: user } : {}
-    })
-  ).toString("base64url");
-  return `${payload}.${hmac(secret, `preview:${payload}`)}`;
-}
-function verifyPreviewToken(secret, token, now = Date.now()) {
-  const dot = token.lastIndexOf(".");
-  if (dot <= 0) return null;
-  const payload = token.slice(0, dot);
-  if (!safeEqual(token.slice(dot + 1), hmac(secret, `preview:${payload}`))) return null;
-  try {
-    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (typeof data.e !== "number" || data.e <= now) return null;
-    const user = typeof data.u === "string" ? { user: data.u } : {};
-    if (typeof data.g === "string") return { global: data.g, expiresAt: data.e, ...user };
-    if (typeof data.c === "string" && typeof data.i === "string")
-      return { collection: data.c, id: data.i, expiresAt: data.e, ...user };
-    return null;
-  } catch {
-    return null;
-  }
-}
-function passwordFingerprint(passwordHash) {
-  return createHash2("sha256").update(typeof passwordHash === "string" ? passwordHash : "no-password").digest("base64url").slice(0, 22);
-}
-function signPasswordToken(secret, args) {
-  const payload = Buffer.from(
-    JSON.stringify({ u: args.userId, p: args.purpose, e: args.expiresAt })
-  ).toString("base64url");
-  return `${payload}.${hmac(secret, `password:${payload}:${args.fingerprint}`)}`;
-}
-function readPasswordToken(token) {
-  const dot = token.lastIndexOf(".");
-  if (dot <= 0) return null;
-  const payload = token.slice(0, dot);
-  try {
-    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (typeof data.u !== "string" || typeof data.e !== "number") return null;
-    if (data.p !== "reset" && data.p !== "invite" && data.p !== "verify") return null;
-    return { userId: data.u, purpose: data.p, expiresAt: data.e, payload };
-  } catch {
-    return null;
-  }
-}
-function passwordTokenMatches(secret, token, fingerprint) {
-  const dot = token.lastIndexOf(".");
-  if (dot <= 0) return false;
-  const payload = token.slice(0, dot);
-  return safeEqual(token.slice(dot + 1), hmac(secret, `password:${payload}:${fingerprint}`));
-}
-
-// src/auth/sso.ts
 var SSO_COOKIE = "ecms-sso";
 var PENDING_TTL = 10 * 6e4;
 var random = () => randomBytes4(32).toString("base64url");
@@ -1314,12 +1367,13 @@ function seal(secret, pending) {
   const payload = Buffer.from(JSON.stringify(pending)).toString("base64url");
   return `${payload}.${sign2(secret, payload)}`;
 }
-function unseal(secret, value) {
+function unseal(secrets, value) {
   if (!value) return null;
   const dot = value.lastIndexOf(".");
   if (dot <= 0) return null;
   const payload = value.slice(0, dot);
-  if (!safeEqual(value.slice(dot + 1), sign2(secret, payload))) return null;
+  const signature = value.slice(dot + 1);
+  if (![secrets].flat().some((secret) => safeEqual(signature, sign2(secret, payload)))) return null;
   try {
     const pending = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
     return typeof pending.e === "number" && pending.e > Date.now() ? pending : null;
@@ -1387,7 +1441,7 @@ var SingleSignOn = class {
    */
   async finish(providerId, options) {
     const admin = this.config.admin.path.replace(/\/+$/, "");
-    const pending = unseal(this.config.secret, options.cookie);
+    const pending = unseal(secretsOf(this.config), options.cookie);
     let email2 = null;
     const back = async (page2, outcome) => {
       await this.cms.audit.record({
@@ -1839,7 +1893,7 @@ var Auth = class {
       await this.recordFailure(key);
       throw refuse("form", "could not be sent");
     }
-    const checked = checkFormToken(this.config.secret, SIGNUP_FORM, args.token, SIGNUP_MIN_TIME);
+    const checked = checkFormToken(this.secrets, SIGNUP_FORM, args.token, SIGNUP_MIN_TIME);
     if (checked !== "ok")
       throw refuse(
         "form",
@@ -1899,7 +1953,7 @@ var Auth = class {
     const id = claims && (/^\d+$/.test(claims.userId) ? Number(claims.userId) : claims.userId);
     const user = claims && claims.purpose === "verify" && claims.expiresAt > Date.now() && id !== null ? await this.db.findById({ collection: USERS, id }) : null;
     if (!user || user.active === false || // A link confirms once: it doesn't sign in again afterwards.
-    user.emailVerified !== false || !passwordTokenMatches(this.config.secret, token, passwordFingerprint(user.passwordHash))) {
+    user.emailVerified !== false || !passwordTokenMatches(this.secrets, token, passwordFingerprint(user.passwordHash))) {
       await this.recordFailure(key);
       throw new ValidationError(USERS, [
         { field: "token", message: "This link has expired or is not valid" }
@@ -1969,7 +2023,7 @@ var Auth = class {
   }
   /** Ends the session for a signed token. Unknown tokens are ignored. */
   async logout(signedToken) {
-    const token = unsignToken(this.config.secret, signedToken);
+    const token = unsignToken(this.secrets, signedToken);
     if (!token) return;
     const session = await this.findSession(token);
     if (!session) return;
@@ -1999,7 +2053,7 @@ var Auth = class {
   async verify(signedToken) {
     if (!signedToken) return null;
     if (isApiKey(signedToken)) return this.verifyApiKey(signedToken);
-    const token = unsignToken(this.config.secret, signedToken);
+    const token = unsignToken(this.secrets, signedToken);
     if (!token) return null;
     const session = await this.findSession(token);
     if (!session) return null;
@@ -2019,9 +2073,21 @@ var Auth = class {
   }
   /** The CSRF token clients must echo for a signed session token. @internal */
   csrfFor(signedToken) {
-    const token = unsignToken(this.config.secret, signedToken);
+    const token = unsignToken(this.secrets, signedToken);
     return token ? csrfToken(this.config.secret, token) : void 0;
   }
+  /**
+   * Whether `given` is the session's CSRF token, made with the current secret or a previous one
+   * (a client that fetched it before the secret changed). @internal
+   */
+  csrfMatches(signedToken, given) {
+    const token = unsignToken(this.secrets, signedToken);
+    return token !== void 0 && csrfMatches(this.secrets, token, given);
+  }
+  /** The current secret and `previousSecrets`, which still verify. */
+  get secrets() {
+    return secretsOf(this.config);
+  }
   /** Starts a new session for a user, e.g. after they changed their own password. */
   async createSession(userId) {
     const user = await this.db.findById({ collection: USERS, id: userId });
@@ -2144,7 +2210,7 @@ var Auth = class {
     const user = await this.db.findById({ collection: USERS, id });
     if (!user || user.active === false || !this.sso.passwordAllowed(user)) return null;
     const fingerprint = passwordFingerprint(user.passwordHash);
-    if (!passwordTokenMatches(this.config.secret, token, fingerprint)) return null;
+    if (!passwordTokenMatches(this.secrets, token, fingerprint)) return null;
     return { user, purpose: claims.purpose };
   }
   async mailPasswordLink(user, purpose, options) {
@@ -3911,7 +3977,7 @@ var VersionStore = class {
 };
 
 // src/local-api.ts
-import { createHash as createHash5, createHmac as createHmac6, randomBytes as randomBytes6, randomUUID as randomUUID3, timingSafeEqual as timingSafeEqual5 } from "crypto";
+import { createHash as createHash5, createHmac as createHmac7, randomBytes as randomBytes6, randomUUID as randomUUID3 } from "crypto";
 
 // src/auth/common-passwords.ts
 var LIST = `
@@ -4647,7 +4713,7 @@ function read(response, maxBytes, deadline) {
 
 // src/config-keys.ts
 var keys = (list) => new Set(list.split(/\s+/).filter(Boolean));
-var CONFIG = keys(`secret db serverURL cors cronSecret timeZone webhooks events jobs localization routes admin
+var CONFIG = keys(`secret previousSecrets db serverURL cors cronSecret timeZone webhooks events jobs localization routes admin
   upload auth collections globals endpoints cliCommands onRequest fieldTypes apiKeys email backups
   audit logs countCacheSeconds maxPage httpCache outbox search telemetry plugins`);
 var ADMIN = keys("path locale brand siteURL nav commands modules pages dashboard switcher");
@@ -5138,7 +5204,41 @@ var SearchIndex = class {
 };
 
 // src/webhooks.ts
-import { createHmac as createHmac5, randomUUID as randomUUID2 } from "crypto";
+import { createHmac as createHmac6, randomUUID as randomUUID2 } from "crypto";
+
+// src/webhook-signature.ts
+import { createHmac as createHmac5, timingSafeEqual as timingSafeEqual5 } from "crypto";
+var TOLERANCE_SECONDS = 5 * 60;
+function signWebhook(secret, delivery, timestamp, body) {
+  return `v1=${createHmac5("sha256", secret).update(`${delivery}.${timestamp}.${body}`).digest("hex")}`;
+}
+function header(headers, name) {
+  if (headers instanceof Headers) return headers.get(name) ?? void 0;
+  const value = Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1];
+  return Array.isArray(value) ? value[0] : value;
+}
+function equal(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual5(left, right);
+}
+function verifyWebhook(body, headers, secret, options = {}) {
+  const delivery = header(headers, "x-easy-cms-delivery");
+  const timestamp = header(headers, "x-easy-cms-timestamp");
+  const signatures2 = header(headers, "x-easy-cms-signature-v2");
+  if (!delivery || !timestamp || !signatures2)
+    throw new UnauthorizedError("Webhook signature missing");
+  const seconds = Number(timestamp);
+  const now = (options.now ?? /* @__PURE__ */ new Date()).getTime() / 1e3;
+  if (!/^\d+$/.test(timestamp) || Math.abs(now - seconds) > (options.toleranceSeconds ?? TOLERANCE_SECONDS))
+    throw new UnauthorizedError("Webhook timestamp too old or in the future");
+  const sent = signatures2.split(/[\s,]+/).filter((s) => s.startsWith("v1="));
+  const valid = [secret].flat().some((s) => sent.some((given) => equal(given, signWebhook(s, delivery, seconds, body))));
+  if (!valid) throw new UnauthorizedError("Webhook signature does not match");
+  return JSON.parse(body);
+}
+
+// src/webhooks.ts
 var WEBHOOK_EVENTS = [
   "create",
   "update",
@@ -5308,7 +5408,10 @@ var Webhooks = class {
       ...hook.headers
     };
     if (hook.secret) {
-      headers["x-easy-cms-signature"] = `sha256=${createHmac5("sha256", hook.secret).update(body).digest("hex")}`;
+      const timestamp = Math.floor(Date.now() / 1e3);
+      headers["x-easy-cms-timestamp"] = String(timestamp);
+      headers["x-easy-cms-signature-v2"] = signWebhook(hook.secret, delivery, timestamp, body);
+      headers["x-easy-cms-signature"] = `sha256=${createHmac6("sha256", hook.secret).update(body).digest("hex")}`;
     }
     try {
       const response = await this.fetcher(hook.url, {
@@ -5380,6 +5483,7 @@ function validateConfig(config) {
     return issues;
   }
   validateSecret(config.secret, add);
+  validatePreviousSecrets(config.previousSecrets, config.secret, add);
   validateCronSecret(config.cronSecret, (issue) => issues.push(issue));
   checkConfigKeys(config, (issue) => issues.push(issue));
   validateAdapterVersions(config, add);
@@ -5465,6 +5569,22 @@ function validateSecret(secret, add) {
     add("secret", "looks like an example or a repeated pattern, not a random string", hint);
   }
 }
+function validatePreviousSecrets(value, secret, add) {
+  if (value === void 0) return;
+  if (!Array.isArray(value)) {
+    add("previousSecrets", "must be an array of strings", "e.g. previousSecrets: [oldSecret]");
+    return;
+  }
+  for (const [i, previous] of value.entries()) {
+    if (typeof previous !== "string" || previous.length < MIN_SECRET_LENGTH)
+      add(
+        `previousSecrets[${i}]`,
+        `must be a string of at least ${MIN_SECRET_LENGTH} characters, like secret`
+      );
+    else if (previous === secret)
+      add(`previousSecrets[${i}]`, "is the same as secret", "list only secrets used before it");
+  }
+}
 function validateCronSecret(value, push) {
   const hint = `use a random string of at least ${MIN_SECRET_LENGTH} characters, e.g. \`openssl rand -hex 32\``;
   if (value !== void 0) {
@@ -7025,11 +7145,11 @@ function cacheTimes(config, container) {
     staleWhileRevalidate: own?.staleWhileRevalidate ?? config.httpCache?.staleWhileRevalidate ?? 300
   };
 }
-function matches2(header, etag) {
-  if (!header) return false;
-  if (header.trim() === "*") return true;
+function matches2(header2, etag) {
+  if (!header2) return false;
+  if (header2.trim() === "*") return true;
   const bare = (tag) => tag.trim().replace(/^W\//, "");
-  return header.split(",").some((tag) => bare(tag) === bare(etag));
+  return header2.split(",").some((tag) => bare(tag) === bare(etag));
 }
 function cacheableResponse(request, body, status, headers, times, tags) {
   headers.set(
@@ -7046,7 +7166,7 @@ function cacheableResponse(request, body, status, headers, times, tags) {
 }
 
 // src/version.ts
-var VERSION = true ? "1.16.0" : "0.0.0-dev";
+var VERSION = true ? "1.18.0" : "0.0.0-dev";
 
 // src/telemetry.ts
 var DB_CALLS = /* @__PURE__ */ new Set([
@@ -7710,18 +7830,14 @@ var EasyCMS = class {
   /** A value with its HMAC (`secret`), for `purpose` only: `<base64url JSON>.<signature>`. */
   sign(purpose, value) {
     const payload = Buffer.from(JSON.stringify(value)).toString("base64url");
-    const mac = createHmac6("sha256", this.config.secret).update(`${purpose}:${payload}`);
+    const mac = createHmac7("sha256", this.config.secret).update(`${purpose}:${payload}`);
     return `${payload}.${mac.digest("base64url")}`;
   }
   /** The value of a token made by `sign`, or `undefined` when it isn't genuine. */
   verify(purpose, token) {
     const [payload, signature] = String(token).split(".");
     if (!payload || !signature) return void 0;
-    const expected = Buffer.from(
-      createHmac6("sha256", this.config.secret).update(`${purpose}:${payload}`).digest("base64url")
-    );
-    const given = Buffer.from(signature);
-    if (expected.length !== given.length || !timingSafeEqual5(expected, given)) return void 0;
+    if (!signedWith(secretsOf(this.config), `${purpose}:${payload}`, signature)) return void 0;
     try {
       return JSON.parse(Buffer.from(payload, "base64url").toString());
     } catch {
@@ -7838,12 +7954,10 @@ var EasyCMS = class {
   verifyMediaSignature(key, expires, signature) {
     const at = Number(expires);
     if (!signature || !Number.isInteger(at) || at < Date.now() / 1e3) return false;
-    const expected = Buffer.from(this.mediaSignature(key, at));
-    const given = Buffer.from(signature);
-    return expected.length === given.length && timingSafeEqual5(expected, given);
+    return signedWith(secretsOf(this.config), `media:${key}:${at}`, signature);
   }
   mediaSignature(key, expires) {
-    return createHmac6("sha256", this.config.secret).update(`media:${key}:${expires}`).digest("base64url");
+    return createHmac7("sha256", this.config.secret).update(`media:${key}:${expires}`).digest("base64url");
   }
   /**
    * How many documents use any of these files in a top-level upload field (rich text and fields
@@ -8133,7 +8247,7 @@ var EasyCMS = class {
   }
   /** What a preview token opens, or `null` when it is invalid or expired. */
   verifyPreviewToken(token) {
-    return token ? verifyPreviewToken(this.config.secret, token) : null;
+    return token ? verifyPreviewToken(secretsOf(this.config), token) : null;
   }
   /** Live preview of a global. See `preview`. */
   async previewGlobal(slug2, data, options = {}) {
@@ -12424,8 +12538,8 @@ async function route(cms, ctx, method, path, options) {
   if (first === "jobs" && second === "run" && third === void 0) {
     if (method !== "GET" && method !== "POST") throw methodNotAllowed(ctx, "GET, POST");
     const secret = cms.config.cronSecret ?? process.env.CRON_SECRET;
-    const header = ctx.request.headers.get("authorization") ?? "";
-    const byCron = !!secret && safeEqual(header, `Bearer ${secret}`);
+    const header2 = ctx.request.headers.get("authorization") ?? "";
+    const byCron = !!secret && safeEqual(header2, `Bearer ${secret}`);
     if (!byCron && !isSystemAdmin(ctx.user)) {
       throw ctx.user ? new HttpError("Forbidden", 403) : new UnauthorizedError();
     }
@@ -13099,9 +13213,8 @@ function checkCsrf(cms, ctx) {
   if (origin === null && fetchSite === "cross-site")
     throw new ForbiddenError("CSRF check failed: cross-site request");
   if (ctx.via === "cookie" && ctx.token) {
-    const expected = cms.auth.csrfFor(ctx.token);
     const given = ctx.request.headers.get(CSRF_HEADER);
-    if (!expected || !given || !safeEqual(given, expected)) {
+    if (!given || !cms.auth.csrfMatches(ctx.token, given)) {
       throw new ForbiddenError(
         `CSRF check failed: send the ${CSRF_HEADER} header from GET /auth/me`
       );
@@ -13501,6 +13614,7 @@ export {
   isStaff,
   isSignedIn,
   isAdmin,
+  secretsOf,
   MEDIA,
   MEDIA_FOLDERS,
   INTERNAL_COLLECTIONS,
@@ -13553,6 +13667,8 @@ export {
   checkRenamedOptions,
   BUILTIN_NAV,
   memorySearch,
+  signWebhook,
+  verifyWebhook,
   WEBHOOK_EVENTS,
   MIN_SECRET_LENGTH,
   BUILTIN_COLLECTIONS,

package/dist/{config-BODu0yjp.d.ts → config-CpeC7EvC.d.ts}

@@ -356,6 +356,16 @@ interface BundleHints {
     readonly traceInclude: readonly string[];
 }
 
+/**
+ * Secrets that verify: the current one first, then `previousSecrets` while one is replaced. New
+ * values are always signed with the current one.
+ */
+type Secrets = string | readonly string[];
+/** The secrets of a config, the current one first. */
+declare function secretsOf(config: {
+    readonly secret: string;
+    readonly previousSecrets?: readonly string[] | undefined;
+}): readonly string[];
 /** What a preview token opens: one document of a collection, or one global. */
 type PreviewTarget = {
     readonly collection: string;
@@ -613,6 +623,8 @@ declare class Auth {
      * on the user), or `null` if it is invalid or expired.
      */
     verify(signedToken: string | undefined | null): Promise<AuthUser | null>;
+    /** The current secret and `previousSecrets`, which still verify. */
+    private get secrets();
     /** Starts a new session for a user, e.g. after they changed their own password. */
     createSession(userId: ID): Promise<Session>;
     /** Signs a user out everywhere. */
@@ -2460,6 +2472,18 @@ declare class AuditLog {
     csv(filter: AuditFilter): Promise<string>;
     /** Checks every entry's signature, and that no ids are missing. */
     verify(): Promise<AuditVerification>;
+    /** The secret an entry was signed with: the current one, a previous one, or none (changed). */
+    private signer;
+    /**
+     * After `secret` changed: signs again, with the current secret, the entries signed with one of
+     * `previousSecrets`, so they still verify once it is removed. Entries no secret verifies were
+     * changed: they are left as they are, and reported. Records `audit.resign`.
+     */
+    resign(): Promise<{
+        checked: number;
+        resigned: number;
+        invalid: ID[];
+    }>;
     /** What the dashboard warns about: many failed logins, entries not written, a failed check. */
     attention(now?: Date): Promise<({
         id: 'failed-logins';
@@ -2779,7 +2803,12 @@ interface WebhookConfig {
     readonly collections?: readonly string[];
     /** Globals to send events for. Default: all; `[]` for none. */
     readonly globals?: readonly string[];
-    /** Signs each body: `x-easy-cms-signature: sha256=<hex HMAC-SHA256 of the body>`. */
+    /**
+     * Signs each attempt: `x-easy-cms-timestamp` and `x-easy-cms-signature-v2` (`v1=<hex HMAC-SHA256
+     * of "<delivery>.<timestamp>.<body>">`, checked by `verifyWebhook()`). Also, until 2.0, the
+     * deprecated `x-easy-cms-signature: sha256=<hex HMAC-SHA256 of the body>`, which a captured
+     * request can be replayed with.
+     */
     readonly secret?: string;
     /** Extra request headers, e.g. a token the receiver checks. */
     readonly headers?: Readonly<Record<string, string>>;
@@ -3526,6 +3555,13 @@ interface BackupsConfig {
 interface Config {
     /** Signs sessions. At least 32 characters; read it from `process.env.EASY_CMS_SECRET`. */
     readonly secret: string;
+    /**
+     * Secrets used before `secret`, while it is replaced: what they signed (sessions, links,
+     * tokens, the audit log) still verifies; new values are signed with `secret` only. Keep one
+     * until sessions and links made with it have expired (7 days by default), and run
+     * `easy-cms audit:resign` before removing it. At least 32 characters each, like `secret`.
+     */
+    readonly previousSecrets?: readonly string[];
     readonly db: DatabaseAdapter;
     /**
      * Public origin of the app, e.g. `https://example.com`. When set, media URLs are absolute
@@ -3682,5 +3718,5 @@ interface ResolvedConfig extends Omit<Config, 'cors' | 'localization' | 'routes'
  */
 declare function defineConfig<const TConfig extends Config>(config: TConfig): TConfig;
 
-export { ADAPTER_API_VERSION as A, AuditLog as J, Auth as M, ADMIN_ICONS as a, ForbiddenError as a$, FIELD_TYPES as aE, ConfigError as ad, EasyCMS as aw, EasyCMSError as ax, PayloadTooLargeError as bE, QueryError as bK, ROLE_OPERATIONS as bL, Roles as bW, SchemaError as bZ, NotFoundError as bt, PLUGIN_API_VERSION as bz, API_KEYS as c$, WEBHOOK_EVENTS as cB, anyone as cH, consoleEmail as cI, consoleLogger as cJ, createEasyCMS as cK, defineConfig as cL, defineFieldType as cM, definePlugin as cN, diskStorage as cO, hasRows as cP, isAdmin as cQ, isHasMany as cR, isSignedIn as cS, isStaff as cT, isSystemAdmin as cU, jsonLogger as cV, memorySearch as cW, mimeAllowedBy as cX, rowFields as cY, silentLogger as cZ, uniqueWithinOf as c_, SingleSignOn as cc, TRIGRAM_LIKE_MIN as cj, TooManyRequestsError as cn, UnauthorizedError as cp, ValidationError as cx, API_KEY_GLOBAL_OPERATIONS as d0, API_KEY_OPERATIONS as d1, DEFAULT_MAX_VERSIONS as d2, DEFAULT_PASSWORD_EMAILS as d3, FIELD_TYPE_BASES as d4, FOLDER_LEVELS as d5, MediaFolders as d6, SSO_COOKIE as d7, codeOfStatus as d8, isJsonLogger as d9, keyAllows as da, logFormat as db };
-export type { BuiltinMediaCollection as $, ApiKeyOperation as B, ApiKeyPermissions as C, ArrayField as D, EmailSetting as E, AuditChange as F, AuditConfig as G, AuditEntry as H, ID as I, AuditPage as K, AuditVerification as L, AuthConfig as N, AuthProvider as O, PaginatedDocs as P, AuthProviderProfile as Q, AuthProviderRequest as R, AuthUser as S, BackupsConfig as T, BeforeChangeHook as U, BeforeDeleteHook as V, BeforeValidateHook as W, Block as X, BlocksField as Y, BooleanField as Z, BuiltinApiKeysCollection as _, BuiltinMediaFoldersCollection as a0, BuiltinUsersCollection as a1, BundleHints as a2, CliCommand as a3, CollectionAccess as a4, CollectionAdmin as a5, CollectionConfig as a6, CollectionDocument as a7, CollectionHooks as a8, CollectionListAdmin as a9, EmailMessage as aA, Endpoint as aB, EndpointRequest as aC, ErrorCode as aD, Field as aF, FieldAccess as aG, FieldAccessFn as aH, FieldAdmin as aI, FieldError as aJ, FieldRule as aK, FieldType as aL, FieldTypeBase as aM, FieldTypeDefinition as aN, FieldTypeValidateContext as aO, FieldValidate as aP, FieldValidateContext as aQ, FieldValue as aR, FieldsInput as aS, FieldsValue as aT, FilterOptions as aU, FilterOptionsArgs as aV, FindAfterArgs as aW, FindArgs as aX, FindOptions as aY, FolderLevel as aZ, FolderPermissions as a_, CollectionSearch as aa, CollectionSlug as ab, Config as ac, ConfigIssue as ae, ContainerAdmin as af, CreateEasyCMSOptions as ag, CreateInput as ah, CreateMigrationResult as ai, CursorDocs as aj, CustomField as ak, CustomFieldTypes as al, DashboardWidget as am, Database as an, DatabaseAdapter as ao, DatabaseInitArgs as ap, DatabaseTransfer as aq, DateField as ar, DepthOptions as as, DirectUpload as at, DiskStorageOptions as au, DocumentOf as av, EmailAdapter as ay, EmailField as az, Access as b, SearchAdapter as b$, GlobalAccess as b0, GlobalConfig as b1, GlobalDocument as b2, GlobalHooks as b3, GlobalInput as b4, GlobalSlug as b5, GroupField as b6, ImageSize as b7, IncrementOptions as b8, InferCollection as b9, PasswordEmail as bA, PasswordEmailArgs as bB, PasswordEmailFn as bC, PasswordLinkOptions as bD, Plugin as bF, PluginInfo as bG, PluginTypes as bH, PreviewTarget as bI, PreviewURL as bJ, RawDocument as bM, ReadOptions as bN, RelationshipField as bO, RequestContext as bP, ResolvedConfig as bQ, RichTextDocument as bR, RichTextField as bS, Role as bT, RoleOperation as bU, RolePermissions as bV, RoutesConfig as bX, ScheduledPublish as bY, SchemaMode as b_, InferGlobal as ba, JobConfig as bb, JsonField as bc, KeysetPage as bd, Label as be, LayoutNode as bf, LivePreview as bg, LocaleOf as bh, LocalizationConfig as bi, LogDetails as bj, Logger as bk, LoginArgs as bl, LogsConfig as bm, MediaDocument as bn, MediaSize as bo, MembersConfig as bp, MembersSignup as bq, MigrationInfo as br, NavGroup as bs, NumberField as bu, OnRequest as bv, OnRequestArgs as bw, Operation as bx, OutboxRow as by, AccessArgs as c, SearchEntry as c0, SearchHits as c1, SearchOptions as c2, SearchQuery as c3, SearchResults as c4, SearchSetting as c5, SelectField as c6, SelectOption as c7, Session as c8, SidebarPanel as c9, VersionsConfig as cA, WebhookConfig as cC, WebhookEvent as cD, WebhookPayload as cE, Where as cF, WhereOperators as cG, SignupArgs as ca, SignupResult as cb, SlugField as cd, SlugOf as ce, SsoOutcome as cf, SsoProviderRef as cg, StorageAdapter as ch, StoredFile as ci, TelemetryConfig as ck, TextField as cl, TextareaField as cm, TypedPlugin as co, UncountedDocs as cq, UpdateInput as cr, UpdateOptions as cs, UploadConfig as ct, UploadField as cu, UploadFromURLConfig as cv, UserIdentity as cw, Version as cy, VersionSummary as cz, AccessOptions as d, AdminBrand as e, AdminCommand as f, AdminComponent as g, AdminConfig as h, AdminFieldArgs as i, AdminIcon as j, AdminLocale as k, AdminPage as l, AdminRole as m, AdminRoleChange as n, AdminRoleField as o, AdminRoleTarget as p, AdminRoleView as q, AdminRoles as r, AdminSso as s, AdminSwitcher as t, AdminViewAccess as u, AfterChangeHook as v, AfterDeleteHook as w, AfterReadHook as x, ApiKeyContext as y, ApiKeyGlobalOperation as z };
+export { ADAPTER_API_VERSION as A, EasyCMS as E, AuditLog as S, Auth as V, EasyCMSError as aD, FIELD_TYPES as aK, ConfigError as al, ForbiddenError as b2, PLUGIN_API_VERSION as bB, PayloadTooLargeError as bG, QueryError as bM, ROLE_OPERATIONS as bN, Roles as bX, SchemaError as b_, NotFoundError as bv, API_KEYS as c$, WEBHOOK_EVENTS as cC, anyone as cH, consoleEmail as cI, consoleLogger as cJ, createEasyCMS as cK, defineConfig as cL, defineFieldType as cM, definePlugin as cN, diskStorage as cO, hasRows as cP, isAdmin as cQ, isHasMany as cR, isSignedIn as cS, isStaff as cT, isSystemAdmin as cU, jsonLogger as cV, memorySearch as cW, mimeAllowedBy as cX, rowFields as cY, silentLogger as cZ, uniqueWithinOf as c_, SingleSignOn as cd, TRIGRAM_LIKE_MIN as ck, TooManyRequestsError as co, UnauthorizedError as cq, ValidationError as cy, API_KEY_GLOBAL_OPERATIONS as d0, API_KEY_OPERATIONS as d1, DEFAULT_MAX_VERSIONS as d2, DEFAULT_PASSWORD_EMAILS as d3, FIELD_TYPE_BASES as d4, FOLDER_LEVELS as d5, MediaFolders as d6, SSO_COOKIE as d7, codeOfStatus as d9, isJsonLogger as da, keyAllows as db, logFormat as dc, secretsOf as dd, ADMIN_ICONS as e };
+export type { AuthUser as $, AfterDeleteHook as B, Config as C, AfterReadHook as D, Field as F, ApiKeyContext as G, ApiKeyGlobalOperation as H, ID as I, ApiKeyOperation as J, ApiKeyPermissions as K, LocalizationConfig as L, ArrayField as M, AuditChange as N, AuditConfig as O, PaginatedDocs as P, AuditEntry as Q, ResolvedConfig as R, AuditPage as T, AuditVerification as U, WebhookPayload as W, AuthConfig as X, AuthProvider as Y, AuthProviderProfile as Z, AuthProviderRequest as _, FieldError as a, FindOptions as a$, BackupsConfig as a0, BeforeChangeHook as a1, BeforeDeleteHook as a2, BeforeValidateHook as a3, Block as a4, BlocksField as a5, BooleanField as a6, BuiltinApiKeysCollection as a7, BuiltinMediaCollection as a8, BuiltinMediaFoldersCollection as a9, DirectUpload as aA, DiskStorageOptions as aB, DocumentOf as aC, EmailAdapter as aE, EmailField as aF, EmailMessage as aG, Endpoint as aH, EndpointRequest as aI, ErrorCode as aJ, FieldAccess as aL, FieldAccessFn as aM, FieldAdmin as aN, FieldRule as aO, FieldType as aP, FieldTypeBase as aQ, FieldTypeDefinition as aR, FieldTypeValidateContext as aS, FieldValidate as aT, FieldValidateContext as aU, FieldValue as aV, FieldsInput as aW, FieldsValue as aX, FilterOptionsArgs as aY, FindAfterArgs as aZ, FindArgs as a_, BuiltinUsersCollection as aa, BundleHints as ab, CliCommand as ac, CollectionAccess as ad, CollectionAdmin as ae, CollectionConfig as af, CollectionDocument as ag, CollectionHooks as ah, CollectionListAdmin as ai, CollectionSearch as aj, CollectionSlug as ak, ConfigIssue as am, ContainerAdmin as an, CreateInput as ao, CreateMigrationResult as ap, CursorDocs as aq, CustomField as ar, CustomFieldTypes as as, DashboardWidget as at, Database as au, DatabaseAdapter as av, DatabaseInitArgs as aw, DatabaseTransfer as ax, DateField as ay, DepthOptions as az, FilterOptions as b, SchemaMode as b$, FolderLevel as b0, FolderPermissions as b1, GlobalAccess as b3, GlobalConfig as b4, GlobalDocument as b5, GlobalHooks as b6, GlobalInput as b7, GlobalSlug as b8, GroupField as b9, OutboxRow as bA, PasswordEmail as bC, PasswordEmailArgs as bD, PasswordEmailFn as bE, PasswordLinkOptions as bF, Plugin as bH, PluginInfo as bI, PluginTypes as bJ, PreviewTarget as bK, PreviewURL as bL, RawDocument as bO, ReadOptions as bP, RelationshipField as bQ, RequestContext as bR, RichTextDocument as bS, RichTextField as bT, Role as bU, RoleOperation as bV, RolePermissions as bW, RoutesConfig as bY, ScheduledPublish as bZ, ImageSize as ba, IncrementOptions as bb, InferCollection as bc, InferGlobal as bd, JobConfig as be, JsonField as bf, KeysetPage as bg, Label as bh, LayoutNode as bi, LivePreview as bj, LocaleOf as bk, LogDetails as bl, Logger as bm, LoginArgs as bn, LogsConfig as bo, MediaDocument as bp, MediaSize as bq, MembersConfig as br, MembersSignup as bs, MigrationInfo as bt, NavGroup as bu, NumberField as bw, OnRequest as bx, OnRequestArgs as by, Operation as bz, CreateEasyCMSOptions as c, SearchAdapter as c0, SearchEntry as c1, SearchHits as c2, SearchOptions as c3, SearchQuery as c4, SearchResults as c5, SearchSetting as c6, SelectField as c7, SelectOption as c8, Session as c9, VersionSummary as cA, VersionsConfig as cB, WebhookConfig as cD, WebhookEvent as cE, Where as cF, WhereOperators as cG, SidebarPanel as ca, SignupArgs as cb, SignupResult as cc, SlugField as ce, SlugOf as cf, SsoOutcome as cg, SsoProviderRef as ch, StorageAdapter as ci, StoredFile as cj, TelemetryConfig as cl, TextField as cm, TextareaField as cn, TypedPlugin as cp, UncountedDocs as cr, UpdateInput as cs, UpdateOptions as ct, UploadConfig as cu, UploadField as cv, UploadFromURLConfig as cw, UserIdentity as cx, Version as cz, EmailSetting as d, Secrets as d8, Access as f, AccessArgs as g, AccessOptions as h, AdminBrand as i, AdminCommand as j, AdminComponent as k, AdminConfig as l, AdminFieldArgs as m, AdminIcon as n, AdminLocale as o, AdminPage as p, AdminRole as q, AdminRoleChange as r, AdminRoleField as s, AdminRoleTarget as t, AdminRoleView as u, AdminRoles as v, AdminSso as w, AdminSwitcher as x, AdminViewAccess as y, AfterChangeHook as z };

package/dist/{handler-DOMtk2Vi.d.ts → handler-BpKo6gh0.d.ts}

@@ -1,4 +1,4 @@
-import { I as ID, ac as Config, aw as EasyCMS, bi as LocalizationConfig, aF as Field, aJ as FieldError, aU as FilterOptions, ag as CreateEasyCMSOptions, bQ as ResolvedConfig } from './config-BODu0yjp.js';
+import { I as ID, C as Config, E as EasyCMS, L as LocalizationConfig, F as Field, a as FieldError, b as FilterOptions, c as CreateEasyCMSOptions, R as ResolvedConfig } from './config-CpeC7EvC.js';
 
 /** Decrypts a file from `encryptBackup`; throws for another key or a changed file. */
 declare function decryptBackup(data: Uint8Array, encryptionKey: string): Uint8Array;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { P as PaginatedDocs, I as ID, E as EmailSetting } from './config-BODu0yjp.js';
-export { A as ADAPTER_API_VERSION, a as ADMIN_ICONS, b as Access, c as AccessArgs, d as AccessOptions, e as AdminBrand, f as AdminCommand, g as AdminComponent, h as AdminConfig, i as AdminFieldArgs, j as AdminIcon, k as AdminLocale, l as AdminPage, m as AdminRole, n as AdminRoleChange, o as AdminRoleField, p as AdminRoleTarget, q as AdminRoleView, r as AdminRoles, s as AdminSso, t as AdminSwitcher, u as AdminViewAccess, v as AfterChangeHook, w as AfterDeleteHook, x as AfterReadHook, y as ApiKeyContext, z as ApiKeyGlobalOperation, B as ApiKeyOperation, C as ApiKeyPermissions, D as ArrayField, F as AuditChange, G as AuditConfig, H as AuditEntry, J as AuditLog, K as AuditPage, L as AuditVerification, M as Auth, N as AuthConfig, O as AuthProvider, Q as AuthProviderProfile, R as AuthProviderRequest, S as AuthUser, T as BackupsConfig, U as BeforeChangeHook, V as BeforeDeleteHook, W as BeforeValidateHook, X as Block, Y as BlocksField, Z as BooleanField, _ as BuiltinApiKeysCollection, $ as BuiltinMediaCollection, a0 as BuiltinMediaFoldersCollection, a1 as BuiltinUsersCollection, a2 as BundleHints, a3 as CliCommand, a4 as CollectionAccess, a5 as CollectionAdmin, a6 as CollectionConfig, a7 as CollectionDocument, a8 as CollectionHooks, a9 as CollectionListAdmin, aa as CollectionSearch, ab as CollectionSlug, ac as Config, ad as ConfigError, ae as ConfigIssue, af as ContainerAdmin, ag as CreateEasyCMSOptions, ah as CreateInput, ai as CreateMigrationResult, aj as CursorDocs, ak as CustomField, al as CustomFieldTypes, am as DashboardWidget, an as Database, ao as DatabaseAdapter, ap as DatabaseInitArgs, aq as DatabaseTransfer, ar as DateField, as as DepthOptions, at as DirectUpload, au as DiskStorageOptions, av as DocumentOf, aw as EasyCMS, ax as EasyCMSError, ay as EmailAdapter, az as EmailField, aA as EmailMessage, aB as Endpoint, aC as EndpointRequest, aD as ErrorCode, aE as FIELD_TYPES, aF as Field, aG as FieldAccess, aH as FieldAccessFn, aI as FieldAdmin, aJ as FieldError, aK as FieldRule, aL as FieldType, aM as FieldTypeBase, aN as FieldTypeDefinition, aO as FieldTypeValidateContext, aP as FieldValidate, aQ as FieldValidateContext, aR as FieldValue, aS as FieldsInput, aT as FieldsValue, aU as FilterOptions, aV as FilterOptionsArgs, aW as FindAfterArgs, aX as FindArgs, aY as FindOptions, aZ as FolderLevel, a_ as FolderPermissions, a$ as ForbiddenError, b0 as GlobalAccess, b1 as GlobalConfig, b2 as GlobalDocument, b3 as GlobalHooks, b4 as GlobalInput, b5 as GlobalSlug, b6 as GroupField, b7 as ImageSize, b8 as IncrementOptions, b9 as InferCollection, ba as InferGlobal, bb as JobConfig, bc as JsonField, bd as KeysetPage, be as Label, bf as LayoutNode, bg as LivePreview, bh as LocaleOf, bi as LocalizationConfig, bj as LogDetails, bk as Logger, bl as LoginArgs, bm as LogsConfig, bn as MediaDocument, bo as MediaSize, bp as MembersConfig, bq as MembersSignup, br as MigrationInfo, bs as NavGroup, bt as NotFoundError, bu as NumberField, bv as OnRequest, bw as OnRequestArgs, bx as Operation, by as OutboxRow, bz as PLUGIN_API_VERSION, bA as PasswordEmail, bB as PasswordEmailArgs, bC as PasswordEmailFn, bD as PasswordLinkOptions, bE as PayloadTooLargeError, bF as Plugin, bG as PluginInfo, bH as PluginTypes, bI as PreviewTarget, bJ as PreviewURL, bK as QueryError, bL as ROLE_OPERATIONS, bM as RawDocument, bN as ReadOptions, bO as RelationshipField, bP as RequestContext, bQ as ResolvedConfig, bR as RichTextDocument, bS as RichTextField, bT as Role, bU as RoleOperation, bV as RolePermissions, bW as Roles, bX as RoutesConfig, bY as ScheduledPublish, bZ as SchemaError, b_ as SchemaMode, b$ as SearchAdapter, c0 as SearchEntry, c1 as SearchHits, c2 as SearchOptions, c3 as SearchQuery, c4 as SearchResults, c5 as SearchSetting, c6 as SelectField, c7 as SelectOption, c8 as Session, c9 as SidebarPanel, ca as SignupArgs, cb as SignupResult, cc as SingleSignOn, cd as SlugField, ce as SlugOf, cf as SsoOutcome, cg as SsoProviderRef, ch as StorageAdapter, ci as StoredFile, cj as TRIGRAM_LIKE_MIN, ck as TelemetryConfig, cl as TextField, cm as TextareaField, cn as TooManyRequestsError, co as TypedPlugin, cp as UnauthorizedError, cq as UncountedDocs, cr as UpdateInput, cs as UpdateOptions, ct as UploadConfig, cu as UploadField, cv as UploadFromURLConfig, cw as UserIdentity, cx as ValidationError, cy as Version, cz as VersionSummary, cA as VersionsConfig, cB as WEBHOOK_EVENTS, cC as WebhookConfig, cD as WebhookEvent, cE as WebhookPayload, cF as Where, cG as WhereOperators, cH as anyone, cI as consoleEmail, cJ as consoleLogger, cK as createEasyCMS, cL as defineConfig, cM as defineFieldType, cN as definePlugin, cO as diskStorage, cP as hasRows, cQ as isAdmin, cR as isHasMany, cS as isSignedIn, cT as isStaff, cU as isSystemAdmin, cV as jsonLogger, cW as memorySearch, cX as mimeAllowedBy, cY as rowFields, cZ as silentLogger, c_ as uniqueWithinOf } from './config-BODu0yjp.js';
-export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-PyUqbeK2.js';
-export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-DOMtk2Vi.js';
+import { P as PaginatedDocs, I as ID, d as EmailSetting, W as WebhookPayload } from './config-CpeC7EvC.js';
+export { A as ADAPTER_API_VERSION, e as ADMIN_ICONS, f as Access, g as AccessArgs, h as AccessOptions, i as AdminBrand, j as AdminCommand, k as AdminComponent, l as AdminConfig, m as AdminFieldArgs, n as AdminIcon, o as AdminLocale, p as AdminPage, q as AdminRole, r as AdminRoleChange, s as AdminRoleField, t as AdminRoleTarget, u as AdminRoleView, v as AdminRoles, w as AdminSso, x as AdminSwitcher, y as AdminViewAccess, z as AfterChangeHook, B as AfterDeleteHook, D as AfterReadHook, G as ApiKeyContext, H as ApiKeyGlobalOperation, J as ApiKeyOperation, K as ApiKeyPermissions, M as ArrayField, N as AuditChange, O as AuditConfig, Q as AuditEntry, S as AuditLog, T as AuditPage, U as AuditVerification, V as Auth, X as AuthConfig, Y as AuthProvider, Z as AuthProviderProfile, _ as AuthProviderRequest, $ as AuthUser, a0 as BackupsConfig, a1 as BeforeChangeHook, a2 as BeforeDeleteHook, a3 as BeforeValidateHook, a4 as Block, a5 as BlocksField, a6 as BooleanField, a7 as BuiltinApiKeysCollection, a8 as BuiltinMediaCollection, a9 as BuiltinMediaFoldersCollection, aa as BuiltinUsersCollection, ab as BundleHints, ac as CliCommand, ad as CollectionAccess, ae as CollectionAdmin, af as CollectionConfig, ag as CollectionDocument, ah as CollectionHooks, ai as CollectionListAdmin, aj as CollectionSearch, ak as CollectionSlug, C as Config, al as ConfigError, am as ConfigIssue, an as ContainerAdmin, c as CreateEasyCMSOptions, ao as CreateInput, ap as CreateMigrationResult, aq as CursorDocs, ar as CustomField, as as CustomFieldTypes, at as DashboardWidget, au as Database, av as DatabaseAdapter, aw as DatabaseInitArgs, ax as DatabaseTransfer, ay as DateField, az as DepthOptions, aA as DirectUpload, aB as DiskStorageOptions, aC as DocumentOf, E as EasyCMS, aD as EasyCMSError, aE as EmailAdapter, aF as EmailField, aG as EmailMessage, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, aK as FIELD_TYPES, F as Field, aL as FieldAccess, aM as FieldAccessFn, aN as FieldAdmin, a as FieldError, aO as FieldRule, aP as FieldType, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, aT as FieldValidate, aU as FieldValidateContext, aV as FieldValue, aW as FieldsInput, aX as FieldsValue, b as FilterOptions, aY as FilterOptionsArgs, aZ as FindAfterArgs, a_ as FindArgs, a$ as FindOptions, b0 as FolderLevel, b1 as FolderPermissions, b2 as ForbiddenError, b3 as GlobalAccess, b4 as GlobalConfig, b5 as GlobalDocument, b6 as GlobalHooks, b7 as GlobalInput, b8 as GlobalSlug, b9 as GroupField, ba as ImageSize, bb as IncrementOptions, bc as InferCollection, bd as InferGlobal, be as JobConfig, bf as JsonField, bg as KeysetPage, bh as Label, bi as LayoutNode, bj as LivePreview, bk as LocaleOf, L as LocalizationConfig, bl as LogDetails, bm as Logger, bn as LoginArgs, bo as LogsConfig, bp as MediaDocument, bq as MediaSize, br as MembersConfig, bs as MembersSignup, bt as MigrationInfo, bu as NavGroup, bv as NotFoundError, bw as NumberField, bx as OnRequest, by as OnRequestArgs, bz as Operation, bA as OutboxRow, bB as PLUGIN_API_VERSION, bC as PasswordEmail, bD as PasswordEmailArgs, bE as PasswordEmailFn, bF as PasswordLinkOptions, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bK as PreviewTarget, bL as PreviewURL, bM as QueryError, bN as ROLE_OPERATIONS, bO as RawDocument, bP as ReadOptions, bQ as RelationshipField, bR as RequestContext, R as ResolvedConfig, bS as RichTextDocument, bT as RichTextField, bU as Role, bV as RoleOperation, bW as RolePermissions, bX as Roles, bY as RoutesConfig, bZ as ScheduledPublish, b_ as SchemaError, b$ as SchemaMode, c0 as SearchAdapter, c1 as SearchEntry, c2 as SearchHits, c3 as SearchOptions, c4 as SearchQuery, c5 as SearchResults, c6 as SearchSetting, c7 as SelectField, c8 as SelectOption, c9 as Session, ca as SidebarPanel, cb as SignupArgs, cc as SignupResult, cd as SingleSignOn, ce as SlugField, cf as SlugOf, cg as SsoOutcome, ch as SsoProviderRef, ci as StorageAdapter, cj as StoredFile, ck as TRIGRAM_LIKE_MIN, cl as TelemetryConfig, cm as TextField, cn as TextareaField, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cr as UncountedDocs, cs as UpdateInput, ct as UpdateOptions, cu as UploadConfig, cv as UploadField, cw as UploadFromURLConfig, cx as UserIdentity, cy as ValidationError, cz as Version, cA as VersionSummary, cB as VersionsConfig, cC as WEBHOOK_EVENTS, cD as WebhookConfig, cE as WebhookEvent, cF as Where, cG as WhereOperators, cH as anyone, cI as consoleEmail, cJ as consoleLogger, cK as createEasyCMS, cL as defineConfig, cM as defineFieldType, cN as definePlugin, cO as diskStorage, cP as hasRows, cQ as isAdmin, cR as isHasMany, cS as isSignedIn, cT as isStaff, cU as isSystemAdmin, cV as jsonLogger, cW as memorySearch, cX as mimeAllowedBy, cY as rowFields, cZ as silentLogger, c_ as uniqueWithinOf } from './config-CpeC7EvC.js';
+export { A as ADMIN_API_VERSION, a as AdminCollection, b as AdminComponentRef, c as AdminElementProps, d as AdminField, e as AdminGlobal, f as AdminLayoutNode, g as AdminNavGroup, h as AdminNavItem, i as AdminNavNode, j as AdminPageRef, k as AdminPageRoute, l as AdminSchema, m as AdminWidgetRef, S as SetFieldDetail, w as warnDeprecated } from './plugin-_XG-lqA5.js';
+export { A as AdminBackup, a as AdminBackups, b as ApiHandlerOptions, B as BackupState, L as LoadConfigOptions, R as RestHandler, c as RestHandlerOptions, d as createApiHandler, e as createRestHandler, l as loadConfig, r as resolveConfig, s as sharedEasyCMS, f as slugify } from './handler-BpKo6gh0.js';
 export { FieldCondition, matchesCondition } from './conditions.js';
 
 type DeliveryKind = 'webhook' | 'email';
@@ -259,5 +259,27 @@ declare const cacheTags: {
 /** The version of `@easy-cms/core`, set when the package is built. */
 declare const VERSION: string;
 
-export { EmailSetting, ID, PaginatedDocs, VERSION, cacheTags };
-export type { AdminAttention, AdminDeliveries, AdminDelivery, AdminEmail, AdminEmailDelivery, AdminJob, AdminJobs, AdminOutbox, AdminOutboxEntry, AdminScheduledJob, AdminStatus, AdminWebhookDelivery, BuiltInJob, DeliveryKind, DeliveryState, EmailCheck, SearchHit };
+/**
+ * `x-easy-cms-signature-v2` of one attempt: `v1=<hex HMAC-SHA256 of "<delivery>.<timestamp>.<body>">`.
+ * The timestamp (`x-easy-cms-timestamp`, Unix seconds) is the attempt's, so a captured request
+ * can't be replayed later, and the delivery id can't be paired with another body.
+ */
+declare function signWebhook(secret: string, delivery: string, timestamp: number, body: string): string;
+interface VerifyWebhookOptions {
+    /** How far the timestamp may be from now, in seconds. Default 300. */
+    readonly toleranceSeconds?: number;
+    /** Now, for tests. */
+    readonly now?: Date;
+}
+type HeaderSource = Headers | Readonly<Record<string, string | readonly string[] | undefined>>;
+/**
+ * Checks a webhook from Easy CMS and returns its payload: the signature (with `secret`, or any of
+ * several while one is replaced) over the delivery id, the timestamp and the raw body, and a
+ * timestamp within `toleranceSeconds` of now. Throws `UnauthorizedError` otherwise. Pass the body
+ * exactly as received, before parsing it. Also skip deliveries already handled
+ * (`x-easy-cms-delivery`): a replay within the tolerance has a valid signature.
+ */
+declare function verifyWebhook(body: string, headers: HeaderSource, secret: string | readonly string[], options?: VerifyWebhookOptions): WebhookPayload;
+
+export { EmailSetting, ID, PaginatedDocs, VERSION, WebhookPayload, cacheTags, signWebhook, verifyWebhook };
+export type { AdminAttention, AdminDeliveries, AdminDelivery, AdminEmail, AdminEmailDelivery, AdminJob, AdminJobs, AdminOutbox, AdminOutboxEntry, AdminScheduledJob, AdminStatus, AdminWebhookDelivery, BuiltInJob, DeliveryKind, DeliveryState, EmailCheck, SearchHit, VerifyWebhookOptions };

package/dist/index.js

@@ -24,9 +24,11 @@ import {
   memorySearch,
   resolveConfig,
   sharedEasyCMS,
+  signWebhook,
   silentLogger,
-  slugify
-} from "./chunk-WGECYA3K.js";
+  slugify,
+  verifyWebhook
+} from "./chunk-NTAFZ4M6.js";
 import {
   matchesCondition
 } from "./chunk-U266LV4M.js";
@@ -96,7 +98,9 @@ export {
   memorySearch,
   resolveConfig,
   sharedEasyCMS,
+  signWebhook,
   silentLogger,
   slugify,
+  verifyWebhook,
   warnDeprecated
 };

package/dist/internal.d.ts

@@ -1,6 +1,6 @@
 import { Config, Database, EasyCMS, NavGroup, CollectionConfig, ID, RawDocument, Field, ResolvedConfig, ConfigIssue } from './index.js';
-export { c$ as API_KEYS, d0 as API_KEY_GLOBAL_OPERATIONS, d1 as API_KEY_OPERATIONS, d2 as DEFAULT_MAX_VERSIONS, d3 as DEFAULT_PASSWORD_EMAILS, d4 as FIELD_TYPE_BASES, d5 as FOLDER_LEVELS, d6 as MediaFolders, d7 as SSO_COOKIE, cj as TRIGRAM_LIKE_MIN, d8 as codeOfStatus, cP as hasRows, cR as isHasMany, d9 as isJsonLogger, da as keyAllows, db as logFormat, cX as mimeAllowedBy, cY as rowFields, c_ as uniqueWithinOf } from './config-BODu0yjp.js';
-export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as isEmail, y as mergeForUpdate, z as parseId, E as platformClientIp, F as readCookie, G as validateFields, H as writeBackupFile } from './handler-DOMtk2Vi.js';
+export { c$ as API_KEYS, d0 as API_KEY_GLOBAL_OPERATIONS, d1 as API_KEY_OPERATIONS, d2 as DEFAULT_MAX_VERSIONS, d3 as DEFAULT_PASSWORD_EMAILS, d4 as FIELD_TYPE_BASES, d5 as FOLDER_LEVELS, d6 as MediaFolders, d7 as SSO_COOKIE, d8 as Secrets, ck as TRIGRAM_LIKE_MIN, d9 as codeOfStatus, cP as hasRows, cR as isHasMany, da as isJsonLogger, db as keyAllows, dc as logFormat, cX as mimeAllowedBy, cY as rowFields, dd as secretsOf, c_ as uniqueWithinOf } from './config-CpeC7EvC.js';
+export { C as CONFIG_FILE_NAMES, g as CSRF_COOKIE, h as CSRF_HEADER, D as DEFAULT_ADMIN_PATH, i as DEFAULT_API_PATH, j as DEFAULT_MAX_FILE_SIZE, k as DEFAULT_TOKEN_EXPIRATION, m as applyDefaults, n as applyPlugins, o as createRootEndpointHandler, p as decryptBackup, q as fillMissing, t as findConfigFile, u as forwardedClientIp, v as generateSlugs, w as importConfig, x as isEmail, y as mergeForUpdate, z as parseId, E as platformClientIp, F as readCookie, G as validateFields, H as writeBackupFile } from './handler-BpKo6gh0.js';
 export { conditionIssues } from './conditions.js';
 
 /** The session cookie the REST API sets at login. */
@@ -112,7 +112,7 @@ declare function formToken(secret: string, purpose: string, now?: number): strin
  * Checks a token: `ok` when the form was loaded at least `minTime` ms ago (people take a few
  * seconds; bots don't) and less than a day ago.
  */
-declare function checkFormToken(secret: string, purpose: string, token: unknown, minTime: number, now?: number): 'ok' | 'invalid' | 'too-fast' | 'expired';
+declare function checkFormToken(secrets: string | readonly string[], purpose: string, token: unknown, minTime: number, now?: number): 'ok' | 'invalid' | 'too-fast' | 'expired';
 /**
  * Rate-limit keys for `subject` (e.g. an IP and a form) in the current and previous window of
  * `window` seconds. A hash with the window in it: no IP is kept, and keys from different

package/dist/internal.js

@@ -52,12 +52,13 @@ import {
   rateKeys,
   readCookie,
   resolveAdminModule,
+  secretsOf,
   validateConfig,
   validateFields,
   verifyPassword,
   verifyTurnstile,
   writeBackupFile
-} from "./chunk-WGECYA3K.js";
+} from "./chunk-NTAFZ4M6.js";
 import {
   conditionIssues
 } from "./chunk-U266LV4M.js";
@@ -311,6 +312,7 @@ export {
   readCookie,
   resolveAdminModule,
   rowFields,
+  secretsOf,
   singularize,
   sniffMimeType,
   uniqueWithinOf,

package/dist/{plugin-PyUqbeK2.d.ts → plugin-_XG-lqA5.d.ts}

@@ -1,4 +1,4 @@
-import { be as Label, aF as Field, I as ID, k as AdminLocale, t as AdminSwitcher, cg as SsoProviderRef } from './config-BODu0yjp.js';
+import { bh as Label, F as Field, I as ID, o as AdminLocale, x as AdminSwitcher, ch as SsoProviderRef } from './config-CpeC7EvC.js';
 import { FieldCondition } from './conditions.js';
 
 /** A Web Component from an admin module, with its `props` (plain JSON). */

package/dist/plugin.d.ts

@@ -1,3 +1,3 @@
-export { a as ADMIN_ICONS, g as AdminComponent, j as AdminIcon, S as AuthUser, a3 as CliCommand, a4 as CollectionAccess, a6 as CollectionConfig, ac as Config, ad as ConfigError, am as DashboardWidget, ax as EasyCMSError, aB as Endpoint, aC as EndpointRequest, aD as ErrorCode, aF as Field, aG as FieldAccess, aJ as FieldError, aM as FieldTypeBase, aN as FieldTypeDefinition, aO as FieldTypeValidateContext, a$ as ForbiddenError, b1 as GlobalConfig, I as ID, bb as JobConfig, be as Label, bs as NavGroup, bt as NotFoundError, bv as OnRequest, bw as OnRequestArgs, bz as PLUGIN_API_VERSION, bE as PayloadTooLargeError, bF as Plugin, bG as PluginInfo, bH as PluginTypes, bK as QueryError, bP as RequestContext, cn as TooManyRequestsError, co as TypedPlugin, cp as UnauthorizedError, cx as ValidationError, cF as Where, cM as defineFieldType, cN as definePlugin } from './config-BODu0yjp.js';
-export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-PyUqbeK2.js';
+export { e as ADMIN_ICONS, k as AdminComponent, n as AdminIcon, $ as AuthUser, ac as CliCommand, ad as CollectionAccess, af as CollectionConfig, C as Config, al as ConfigError, at as DashboardWidget, aD as EasyCMSError, aH as Endpoint, aI as EndpointRequest, aJ as ErrorCode, F as Field, aL as FieldAccess, a as FieldError, aQ as FieldTypeBase, aR as FieldTypeDefinition, aS as FieldTypeValidateContext, b2 as ForbiddenError, b4 as GlobalConfig, I as ID, be as JobConfig, bh as Label, bu as NavGroup, bv as NotFoundError, bx as OnRequest, by as OnRequestArgs, bB as PLUGIN_API_VERSION, bG as PayloadTooLargeError, bH as Plugin, bI as PluginInfo, bJ as PluginTypes, bM as QueryError, bR as RequestContext, co as TooManyRequestsError, cp as TypedPlugin, cq as UnauthorizedError, cy as ValidationError, cF as Where, cM as defineFieldType, cN as definePlugin } from './config-CpeC7EvC.js';
+export { A as ADMIN_API_VERSION, c as AdminElementProps, k as AdminPageRoute, S as SetFieldDetail, w as warnDeprecated } from './plugin-_XG-lqA5.js';
 import './conditions.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "1.16.0",
+  "version": "1.18.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",