@cmssy/core 11.5.1 → 11.7.0

package/dist/{content-client-CJQ-nafm.d.cts → content-client-BPpRfq0h.d.cts}

@@ -1,48 +1,20 @@
 import { CmssyClientConfig, CmssyLayoutGroup, CmssyPageData, CmssyPageMeta, CmssyPageSummary } from '@cmssy/types';
 
-/** HTTP-level failure from the cmssy API, with a machine-readable status. */
 declare class CmssyRequestError extends Error {
     readonly status: number;
-    /**
-     * How long the server asked us to wait, in ms, when it said so. Present on a
-     * 429 that carried `Retry-After`; a caller can serve stale content for that
-     * long instead of guessing.
-     */
     readonly retryAfterMs?: number;
     constructor(message: string, status: number, retryAfterMs?: number);
 }
 interface RetryPolicy {
-    /** Additional attempts after the first request (default 3). */
     maxRetries?: number;
-    /** Exponential backoff base in ms: base * 2^attempt (default 300). */
     baseDelayMs?: number;
-    /** Upper bound for a guessed backoff wait (default 3000). */
     maxDelayMs?: number;
-    /**
-     * Upper bound for a wait the server asked for by `Retry-After` (default
-     * 10000). Beyond it there is nothing to gain from holding a render open, so
-     * the request fails immediately and carries `retryAfterMs` - the caller is in
-     * a better position to decide between stale content and an error page.
-     */
     maxRetryAfterMs?: number;
-    /** HTTP statuses that trigger a retry (default [429, 503]). */
     retryStatuses?: number[];
 }
 
-/**
- * The cmssy cloud GraphQL delivery endpoint. It is the same for every workspace,
- * so consumers never need to set it - `apiUrl` defaults to this. Self-hosted /
- * staging deployments override it via config.
- */
 declare const DEFAULT_CMSSY_API_URL = "https://api.cmssy.io/graphql";
 declare function resolveApiUrl(apiUrl: string | undefined): string;
-/**
- * Public delivery endpoint for a workspace: the org-scoped path
- * `{base}/public/{orgSlug}/{workspaceSlug}/graphql`. `apiUrl` is the GraphQL
- * base (its trailing `/graphql` is stripped); the org path is what tells the
- * backend which workspace to serve, so slugs only need to be unique per org.
- */
-declare function resolvePublicUrl(config: CmssyClientConfig): string;
 interface FetchLikeResponse {
     ok: boolean;
     status: number;
@@ -66,11 +38,10 @@ interface FetchPageOptions {
     signal?: AbortSignal;
     retry?: RetryPolicy | false;
 }
-declare function normalizeSlug(path: string | string[] | undefined): string;
 declare function fetchPage(config: CmssyClientConfig, path: string | string[] | undefined, options?: FetchPageOptions): Promise<CmssyPageData | null>;
 declare function fetchPageById(config: CmssyClientConfig, pageId: string, options?: Pick<FetchPageOptions, "fetch" | "signal" | "retry">): Promise<CmssyPageData | null>;
 declare function fetchPages(config: CmssyClientConfig, options?: Pick<FetchPageOptions, "fetch" | "signal" | "retry">): Promise<CmssyPageSummary[]>;
 declare function fetchPageMeta(config: CmssyClientConfig, path: string | string[] | undefined, options?: Pick<FetchPageOptions, "fetch" | "signal" | "retry">): Promise<CmssyPageMeta | null>;
 declare function fetchLayouts(config: CmssyClientConfig, path: string | string[] | undefined, options?: FetchPageOptions): Promise<CmssyLayoutGroup[]>;
 
-export { CmssyRequestError as C, DEFAULT_CMSSY_API_URL as D, type FetchLike as F, type RetryPolicy as R, type FetchLikeResponse as a, type FetchPageOptions as b, fetchPage as c, fetchPageById as d, fetchPageMeta as e, fetchLayouts as f, fetchPages as g, resolvePublicUrl as h, normalizeSlug as n, resolveApiUrl as r };
+export { CmssyRequestError as C, DEFAULT_CMSSY_API_URL as D, type FetchLike as F, type RetryPolicy as R, type FetchLikeResponse as a, type FetchPageOptions as b, fetchPage as c, fetchPageById as d, fetchPageMeta as e, fetchLayouts as f, fetchPages as g, resolveApiUrl as r };

package/dist/{content-client-CJQ-nafm.d.ts → content-client-BPpRfq0h.d.ts}

@@ -1,48 +1,20 @@
 import { CmssyClientConfig, CmssyLayoutGroup, CmssyPageData, CmssyPageMeta, CmssyPageSummary } from '@cmssy/types';
 
-/** HTTP-level failure from the cmssy API, with a machine-readable status. */
 declare class CmssyRequestError extends Error {
     readonly status: number;
-    /**
-     * How long the server asked us to wait, in ms, when it said so. Present on a
-     * 429 that carried `Retry-After`; a caller can serve stale content for that
-     * long instead of guessing.
-     */
     readonly retryAfterMs?: number;
     constructor(message: string, status: number, retryAfterMs?: number);
 }
 interface RetryPolicy {
-    /** Additional attempts after the first request (default 3). */
     maxRetries?: number;
-    /** Exponential backoff base in ms: base * 2^attempt (default 300). */
     baseDelayMs?: number;
-    /** Upper bound for a guessed backoff wait (default 3000). */
     maxDelayMs?: number;
-    /**
-     * Upper bound for a wait the server asked for by `Retry-After` (default
-     * 10000). Beyond it there is nothing to gain from holding a render open, so
-     * the request fails immediately and carries `retryAfterMs` - the caller is in
-     * a better position to decide between stale content and an error page.
-     */
     maxRetryAfterMs?: number;
-    /** HTTP statuses that trigger a retry (default [429, 503]). */
     retryStatuses?: number[];
 }
 
-/**
- * The cmssy cloud GraphQL delivery endpoint. It is the same for every workspace,
- * so consumers never need to set it - `apiUrl` defaults to this. Self-hosted /
- * staging deployments override it via config.
- */
 declare const DEFAULT_CMSSY_API_URL = "https://api.cmssy.io/graphql";
 declare function resolveApiUrl(apiUrl: string | undefined): string;
-/**
- * Public delivery endpoint for a workspace: the org-scoped path
- * `{base}/public/{orgSlug}/{workspaceSlug}/graphql`. `apiUrl` is the GraphQL
- * base (its trailing `/graphql` is stripped); the org path is what tells the
- * backend which workspace to serve, so slugs only need to be unique per org.
- */
-declare function resolvePublicUrl(config: CmssyClientConfig): string;
 interface FetchLikeResponse {
     ok: boolean;
     status: number;
@@ -66,11 +38,10 @@ interface FetchPageOptions {
     signal?: AbortSignal;
     retry?: RetryPolicy | false;
 }
-declare function normalizeSlug(path: string | string[] | undefined): string;
 declare function fetchPage(config: CmssyClientConfig, path: string | string[] | undefined, options?: FetchPageOptions): Promise<CmssyPageData | null>;
 declare function fetchPageById(config: CmssyClientConfig, pageId: string, options?: Pick<FetchPageOptions, "fetch" | "signal" | "retry">): Promise<CmssyPageData | null>;
 declare function fetchPages(config: CmssyClientConfig, options?: Pick<FetchPageOptions, "fetch" | "signal" | "retry">): Promise<CmssyPageSummary[]>;
 declare function fetchPageMeta(config: CmssyClientConfig, path: string | string[] | undefined, options?: Pick<FetchPageOptions, "fetch" | "signal" | "retry">): Promise<CmssyPageMeta | null>;
 declare function fetchLayouts(config: CmssyClientConfig, path: string | string[] | undefined, options?: FetchPageOptions): Promise<CmssyLayoutGroup[]>;
 
-export { CmssyRequestError as C, DEFAULT_CMSSY_API_URL as D, type FetchLike as F, type RetryPolicy as R, type FetchLikeResponse as a, type FetchPageOptions as b, fetchPage as c, fetchPageById as d, fetchPageMeta as e, fetchLayouts as f, fetchPages as g, resolvePublicUrl as h, normalizeSlug as n, resolveApiUrl as r };
+export { CmssyRequestError as C, DEFAULT_CMSSY_API_URL as D, type FetchLike as F, type RetryPolicy as R, type FetchLikeResponse as a, type FetchPageOptions as b, fetchPage as c, fetchPageById as d, fetchPageMeta as e, fetchLayouts as f, fetchPages as g, resolveApiUrl as r };

package/dist/{csp-CpiqfM03.d.ts → csp-DjFT5SmH.d.ts}

@@ -1,82 +1,26 @@
 import { CmssyClientConfig, BlockRect, BlockSchema, BlockMeta } from '@cmssy/types';
-import { G as GraphqlRequestOptions } from './locale-Clouq4s4.js';
+import { G as GraphqlRequestOptions } from './locale-DQZ80cew.js';
 
 declare const DEFAULT_CMSSY_EDITOR_ORIGINS: string[];
 declare function isDevelopment(): boolean;
 declare function resolveEditorOrigin(editorOrigin: string | string[] | undefined): string | string[];
 interface CmssyConfig {
-    /**
-     * Full GraphQL delivery endpoint. Defaults to the cmssy cloud endpoint
-     * (`https://api.cmssy.io/graphql`); set it only for self-hosted / staging.
-     */
     apiUrl?: string;
-    /** Organization slug - part of the org-scoped delivery path. */
     org: string;
     workspaceSlug: string;
     draftSecret: string;
-    /**
-     * A cmssy API token (`cs_…`) that opts this app into the editor-controlled dev
-     * preview. In development only, the SDK sends it on every page fetch so the
-     * backend can resolve the token's user and honour that user's dev-preview flag
-     * (toggled from the editor's dev-mode switch): flag on + a saved dev draft ⇒
-     * the draft overlay renders, otherwise published content. Server-only (never
-     * reaches the client); ignored outside development. See the Quickstart
-     * "Dev preview" section.
-     */
     devToken?: string;
-    /**
-     * Origin(s) allowed to frame your app in the editor: one origin, a list, or
-     * the comma-separated string an env var carries - all three are accepted, so
-     * `process.env.CMSSY_EDITOR_ORIGIN` can be passed through as-is. Defaults to
-     * {@link DEFAULT_CMSSY_EDITOR_ORIGINS}; set it only for self-hosted admins.
-     */
     editorOrigin?: string | string[];
-    /**
-     * Canonical absolute site URL (e.g. https://cmssy.com), used by
-     * createCmssyRobots / createCmssySitemap. When omitted the helpers derive the
-     * origin from the request `host` header at render time (multi-domain safe).
-     */
     siteUrl?: string;
-    /**
-     * Fallback locale resolver for a site whose URLs carry no language (e.g. a
-     * cookie or Accept-Language strategy). The workspace site config remains the
-     * source of truth for the default and enabled languages.
-     */
     resolveLocale?: () => string | Promise<string>;
 }
-/**
- * Env-shaped input for {@link defineCmssyConfig}: the required string fields are
- * widened to `string | undefined` so a config can pass `process.env.*` straight
- * through without a `?? ""` fallback (which would mask a missing value as an
- * empty string) or a cast.
- */
 type CmssyEnvConfig = Omit<CmssyConfig, "org" | "workspaceSlug" | "draftSecret"> & {
     org?: string;
     workspaceSlug?: string;
     draftSecret?: string;
 };
-/**
- * Validates an env-sourced config and returns a strictly-typed
- * {@link CmssyConfig}. Pass raw `process.env.*` values; this throws a clear,
- * actionable error listing any missing required variables (rendered by the
- * Next.js error overlay / boundary), so the app fails fast instead of running
- * with silently-empty config.
- */
 declare function defineCmssyConfig(config: CmssyEnvConfig): CmssyConfig;
 
-/**
- * Accepting a *typed* document, not a string, is what makes a query's variables
- * and its result checked together. graphql-codegen emits one of three shapes,
- * and the SDK takes all of them so an app never has to care which mode its
- * codegen runs in - or add `graphql` to its runtime dependencies to print an
- * AST it already has.
- */
-/**
- * A document that carries its result and variable types. Structurally
- * compatible with `TypedDocumentNode` (`@graphql-typed-document-node/core`) and
- * with graphql-codegen's `TypedDocumentString`, both of which declare the same
- * phantom `__apiType`.
- */
 interface CmssyTypedDocument<Result, Variables> {
     __apiType?: (variables: Variables) => Result;
 }
@@ -86,15 +30,8 @@ interface QueryScopedOptions extends GraphqlRequestOptions {
 }
 interface CmssyClient {
     readonly config: CmssyClientConfig;
-    /**
-     * Hand it a document that carries its types (what graphql-codegen emits, in
-     * either mode) and the variables are checked and the result inferred; hand it
-     * a query string and it behaves exactly as before. Same method, no second
-     * way to do the same thing.
-     */
     query<Result, Variables>(document: CmssyTypedDocument<Result, Variables>, variables: Variables, options?: GraphqlRequestOptions): Promise<Result>;
     query<T = unknown>(document: string, variables?: Record<string, unknown>, options?: GraphqlRequestOptions): Promise<T>;
-    /** {@link CmssyClient.query} with the workspace id resolved and injected. */
     queryScoped<Result, Variables>(document: CmssyTypedDocument<Result, Variables>, variables: Omit<Variables, "workspaceId">, options?: QueryScopedOptions): Promise<Result>;
     queryScoped<T = unknown>(document: string, variables?: Record<string, unknown>, options?: QueryScopedOptions): Promise<T>;
     resolveWorkspaceId(options?: GraphqlRequestOptions): Promise<string>;
@@ -200,7 +137,6 @@ declare function resolveInitialTarget(editorOrigin: string | string[]): string;
 declare function parseEditorMessage(data: unknown, origin: string, expectedOrigin: string | string[]): EditorToAppMessage | null;
 
 interface CmssyCspOptions {
-    /** Defaults to the cmssy cloud admin origin when unset. */
     editorOrigin?: string | string[];
 }
 interface MutableHeaders {

package/dist/{csp-0D9pcuDp.d.cts → csp-ZchQ-sC7.d.cts}

@@ -1,82 +1,26 @@
 import { CmssyClientConfig, BlockRect, BlockSchema, BlockMeta } from '@cmssy/types';
-import { G as GraphqlRequestOptions } from './locale-XMylB_kz.cjs';
+import { G as GraphqlRequestOptions } from './locale-BS61R-fF.cjs';
 
 declare const DEFAULT_CMSSY_EDITOR_ORIGINS: string[];
 declare function isDevelopment(): boolean;
 declare function resolveEditorOrigin(editorOrigin: string | string[] | undefined): string | string[];
 interface CmssyConfig {
-    /**
-     * Full GraphQL delivery endpoint. Defaults to the cmssy cloud endpoint
-     * (`https://api.cmssy.io/graphql`); set it only for self-hosted / staging.
-     */
     apiUrl?: string;
-    /** Organization slug - part of the org-scoped delivery path. */
     org: string;
     workspaceSlug: string;
     draftSecret: string;
-    /**
-     * A cmssy API token (`cs_…`) that opts this app into the editor-controlled dev
-     * preview. In development only, the SDK sends it on every page fetch so the
-     * backend can resolve the token's user and honour that user's dev-preview flag
-     * (toggled from the editor's dev-mode switch): flag on + a saved dev draft ⇒
-     * the draft overlay renders, otherwise published content. Server-only (never
-     * reaches the client); ignored outside development. See the Quickstart
-     * "Dev preview" section.
-     */
     devToken?: string;
-    /**
-     * Origin(s) allowed to frame your app in the editor: one origin, a list, or
-     * the comma-separated string an env var carries - all three are accepted, so
-     * `process.env.CMSSY_EDITOR_ORIGIN` can be passed through as-is. Defaults to
-     * {@link DEFAULT_CMSSY_EDITOR_ORIGINS}; set it only for self-hosted admins.
-     */
     editorOrigin?: string | string[];
-    /**
-     * Canonical absolute site URL (e.g. https://cmssy.com), used by
-     * createCmssyRobots / createCmssySitemap. When omitted the helpers derive the
-     * origin from the request `host` header at render time (multi-domain safe).
-     */
     siteUrl?: string;
-    /**
-     * Fallback locale resolver for a site whose URLs carry no language (e.g. a
-     * cookie or Accept-Language strategy). The workspace site config remains the
-     * source of truth for the default and enabled languages.
-     */
     resolveLocale?: () => string | Promise<string>;
 }
-/**
- * Env-shaped input for {@link defineCmssyConfig}: the required string fields are
- * widened to `string | undefined` so a config can pass `process.env.*` straight
- * through without a `?? ""` fallback (which would mask a missing value as an
- * empty string) or a cast.
- */
 type CmssyEnvConfig = Omit<CmssyConfig, "org" | "workspaceSlug" | "draftSecret"> & {
     org?: string;
     workspaceSlug?: string;
     draftSecret?: string;
 };
-/**
- * Validates an env-sourced config and returns a strictly-typed
- * {@link CmssyConfig}. Pass raw `process.env.*` values; this throws a clear,
- * actionable error listing any missing required variables (rendered by the
- * Next.js error overlay / boundary), so the app fails fast instead of running
- * with silently-empty config.
- */
 declare function defineCmssyConfig(config: CmssyEnvConfig): CmssyConfig;
 
-/**
- * Accepting a *typed* document, not a string, is what makes a query's variables
- * and its result checked together. graphql-codegen emits one of three shapes,
- * and the SDK takes all of them so an app never has to care which mode its
- * codegen runs in - or add `graphql` to its runtime dependencies to print an
- * AST it already has.
- */
-/**
- * A document that carries its result and variable types. Structurally
- * compatible with `TypedDocumentNode` (`@graphql-typed-document-node/core`) and
- * with graphql-codegen's `TypedDocumentString`, both of which declare the same
- * phantom `__apiType`.
- */
 interface CmssyTypedDocument<Result, Variables> {
     __apiType?: (variables: Variables) => Result;
 }
@@ -86,15 +30,8 @@ interface QueryScopedOptions extends GraphqlRequestOptions {
 }
 interface CmssyClient {
     readonly config: CmssyClientConfig;
-    /**
-     * Hand it a document that carries its types (what graphql-codegen emits, in
-     * either mode) and the variables are checked and the result inferred; hand it
-     * a query string and it behaves exactly as before. Same method, no second
-     * way to do the same thing.
-     */
     query<Result, Variables>(document: CmssyTypedDocument<Result, Variables>, variables: Variables, options?: GraphqlRequestOptions): Promise<Result>;
     query<T = unknown>(document: string, variables?: Record<string, unknown>, options?: GraphqlRequestOptions): Promise<T>;
-    /** {@link CmssyClient.query} with the workspace id resolved and injected. */
     queryScoped<Result, Variables>(document: CmssyTypedDocument<Result, Variables>, variables: Omit<Variables, "workspaceId">, options?: QueryScopedOptions): Promise<Result>;
     queryScoped<T = unknown>(document: string, variables?: Record<string, unknown>, options?: QueryScopedOptions): Promise<T>;
     resolveWorkspaceId(options?: GraphqlRequestOptions): Promise<string>;
@@ -200,7 +137,6 @@ declare function resolveInitialTarget(editorOrigin: string | string[]): string;
 declare function parseEditorMessage(data: unknown, origin: string, expectedOrigin: string | string[]): EditorToAppMessage | null;
 
 interface CmssyCspOptions {
-    /** Defaults to the cmssy cloud admin origin when unset. */
     editorOrigin?: string | string[];
 }
 interface MutableHeaders {

package/dist/index.cjs

@@ -76,11 +76,6 @@ Set the listed environment variables (e.g. in .env.local) and restart the dev se
 // src/data/http.ts
 var CmssyRequestError = class extends Error {
   status;
-  /**
-   * How long the server asked us to wait, in ms, when it said so. Present on a
-   * 429 that carried `Retry-After`; a caller can serve stale content for that
-   * long instead of guessing.
-   */
   retryAfterMs;
   constructor(message, status, retryAfterMs2) {
     super(message);
@@ -451,8 +446,6 @@ function createCmssyClient(input) {
   const client = {
     config,
     resolveWorkspaceId: resolveWorkspaceId2,
-    // One implementation behind both overloads: a string passes through
-    // documentText untouched, a typed document gives up its query text.
     query: ((document2, variables = {}, options) => query(documentText(document2), variables, options)),
     queryScoped: ((document2, variables = {}, options = {}) => queryScoped(
       documentText(document2),
@@ -764,21 +757,24 @@ var CmssyWebhookError = class extends Error {
   }
 };
 var DEFAULT_TOLERANCE_SECONDS = 300;
+var MAX_SIGNATURES = 8;
 function parseSignatureHeader(header) {
   let timestamp = null;
-  let signature = null;
+  const signatures = [];
   for (const part of header.split(",")) {
     const idx = part.indexOf("=");
     if (idx === -1) continue;
     const key = part.slice(0, idx).trim();
     const value = part.slice(idx + 1).trim();
     if (key === "t") timestamp = Number(value);
-    else if (key === "v1") signature = value;
+    else if (key === "v1" && value && signatures.length < MAX_SIGNATURES) {
+      signatures.push(value);
+    }
   }
-  if (timestamp === null || !Number.isFinite(timestamp) || !signature) {
+  if (timestamp === null || !Number.isFinite(timestamp) || !signatures.length) {
     throw new CmssyWebhookError("Malformed X-Cmssy-Signature header");
   }
-  return { timestamp, signature };
+  return { timestamp, signatures };
 }
 function hexToBytes(hex) {
   if (hex.length % 2 !== 0 || /[^0-9a-fA-F]/.test(hex)) return null;
@@ -792,9 +788,10 @@ function bytesToHex(bytes) {
   return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 function timingSafeHexEqual(expectedHex, providedHex) {
+  if (expectedHex.length !== providedHex.length) return false;
   const expected = hexToBytes(expectedHex);
   const provided = hexToBytes(providedHex);
-  if (!expected || !provided || expected.length !== provided.length) {
+  if (!expected || !provided) {
     return false;
   }
   let diff = 0;
@@ -824,17 +821,28 @@ async function verifyCmssyWebhook(options) {
   if (!signatureHeader) {
     throw new CmssyWebhookError("Missing X-Cmssy-Signature header");
   }
-  if (!secret) {
+  const candidates = typeof secret === "string" ? [secret] : Array.isArray(secret) ? secret : [];
+  if (candidates.some((value) => typeof value !== "string")) {
+    throw new CmssyWebhookError("Webhook secret must be a string");
+  }
+  const secrets = candidates.filter(Boolean);
+  if (!secrets.length) {
     throw new CmssyWebhookError("Missing webhook secret");
   }
-  const { timestamp, signature } = parseSignatureHeader(signatureHeader);
+  const { timestamp, signatures } = parseSignatureHeader(signatureHeader);
   const toleranceMs = (options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS) * 1e3;
   const now = options.now ?? Date.now();
   if (Math.abs(now - timestamp) > toleranceMs) {
     throw new CmssyWebhookError("Webhook timestamp outside tolerance");
   }
-  const expected = await hmacSha256Hex(secret, `${timestamp}.${body}`);
-  if (!timingSafeHexEqual(expected, signature)) {
+  let matched = false;
+  for (const candidate of secrets) {
+    const expected = await hmacSha256Hex(candidate, `${timestamp}.${body}`);
+    for (const signature of signatures) {
+      if (timingSafeHexEqual(expected, signature)) matched = true;
+    }
+  }
+  if (!matched) {
     throw new CmssyWebhookError("Webhook signature mismatch");
   }
   let parsed;

package/dist/index.d.cts

@@ -1,6 +1,6 @@
-export { A as AppToEditorMessage, B as BoundsMessage, C as ClickMessage, a as CmssyClient, b as CmssyConfig, c as CmssyCspOptions, d as CmssyEnvConfig, e as CmssyTypedDocument, D as DEFAULT_CMSSY_EDITOR_ORIGINS, E as EditorToAppMessage, P as PROTOCOL_VERSION, f as ParentReadyMessage, g as PatchMessage, h as PostTarget, Q as QueryScopedOptions, R as ReadyMessage, S as SelectMessage, i as applyCmssyCsp, j as createCmssyClient, k as defineCmssyConfig, l as isProtocolCompatible, n as normalizeOrigin, p as parseEditorMessage, m as postToEditor, r as resolveEditorOrigin } from './csp-0D9pcuDp.cjs';
-export { C as CMSSY_LOCALE_HEADER, G as GraphqlRequestOptions, g as graphqlRequest, l as localizeHref, r as resolveCmssyLocale } from './locale-XMylB_kz.cjs';
-export { C as CmssyRequestError, D as DEFAULT_CMSSY_API_URL, F as FetchLike, a as FetchLikeResponse, b as FetchPageOptions, R as RetryPolicy } from './content-client-CJQ-nafm.cjs';
+export { A as AppToEditorMessage, B as BoundsMessage, C as ClickMessage, a as CmssyClient, b as CmssyConfig, c as CmssyCspOptions, d as CmssyEnvConfig, e as CmssyTypedDocument, D as DEFAULT_CMSSY_EDITOR_ORIGINS, E as EditorToAppMessage, P as PROTOCOL_VERSION, f as ParentReadyMessage, g as PatchMessage, h as PostTarget, Q as QueryScopedOptions, R as ReadyMessage, S as SelectMessage, i as applyCmssyCsp, j as createCmssyClient, k as defineCmssyConfig, l as isProtocolCompatible, n as normalizeOrigin, p as parseEditorMessage, m as postToEditor, r as resolveEditorOrigin } from './csp-ZchQ-sC7.cjs';
+export { C as CMSSY_LOCALE_HEADER, G as GraphqlRequestOptions, g as graphqlRequest, l as localizeHref, r as resolveCmssyLocale } from './locale-BS61R-fF.cjs';
+export { C as CmssyRequestError, D as DEFAULT_CMSSY_API_URL, F as FetchLike, a as FetchLikeResponse, b as FetchPageOptions, R as RetryPolicy } from './content-client-BPpRfq0h.cjs';
 import * as _cmssy_types from '@cmssy/types';
 import { FieldOptions, TypedField, BlockPropsSchema, InferBlockContent, RelationMode, CmssyModelRecord, VerifyCmssyWebhookOptions, CmssyWebhookEvent } from '@cmssy/types';
 export { BlockMeta, BlockPropsSchema, BlockRect, BlockSchema, BuildBlockContextExtra, CmssyBlockAuthContext, CmssyBlockContext, CmssyBlockMember, CmssyBlockPage, CmssyBlockWorkspace, CmssyBranding, CmssyClientConfig, CmssyFormDefinition, CmssyFormField, CmssyFormSettings, CmssyFormSubmitResponse, CmssyLayoutGroup, CmssyLayoutSettings, CmssyLocaleContext, CmssyLocalizedValue, CmssyModelDefinition, CmssyModelRecord, CmssyPageData, CmssyPageMeta, CmssyPageSummary, CmssyRecordList, CmssySiteConfig, CmssyWebhookEvent, CmssyWebhookOrder, FieldCondition, FieldConditionGroup, FieldConditionLogic, FieldControl, FieldDefinition, FieldOptions, FieldType, InferBlockContent, LayoutPosition, RawBlock, RawLayoutBlock, SubmitFormInput, TypedField, VerifyCmssyWebhookOptions, evaluateFieldConditionGroup, layoutPositionValues } from '@cmssy/types';
@@ -17,25 +17,13 @@ type MediaValue<O> = O extends {
 type RepeaterValue<O> = O extends {
     itemSchema: infer Schema extends BlockPropsSchema;
 } ? InferBlockContent<Schema>[] : Record<string, unknown>[];
-/**
- * The value a relation field holds AFTER server-side resolution: the SDK
- * replaces the stored record id(s) with the records themselves before the
- * component renders. `mode: "all"` and `multiple: true` yield a list; the
- * default is a single record - `undefined` when the reference dangles, which
- * no `required` flag can rule out.
- */
 type RelationValue<O> = O extends {
     mode: "all";
 } | {
     multiple: true;
 } ? CmssyModelRecord[] : CmssyModelRecord | undefined;
 interface RelationFieldOptions extends Omit<FieldOptions, "options" | "itemSchema"> {
-    /** Slug of the model the field points at. */
     model: string;
-    /**
-     * "all" binds the field to every record of the model (no editor picking;
-     * `sort`/`limit` shape the list). Omit it for editor-picked record id(s).
-     */
     mode?: RelationMode;
     multiple?: boolean;
     sort?: string;
@@ -79,26 +67,9 @@ declare function isVerifiedEditUrl(url: {
     draftSecret: string;
 }): Promise<boolean>;
 
-/**
- * Verify + parse an inbound cmssy webhook (CMS-693 / CMS-694).
- *
- * cmssy signs each delivery with HMAC-SHA256 over `${timestamp}.${body}`
- * and sends the result in the `X-Cmssy-Signature: t=<ms>,v1=<hex>`
- * header, plus a unique `X-Cmssy-Webhook-Id`. This helper recomputes the
- * signature (timing-safe compare), rejects stale timestamps to bound
- * replay, and returns the typed event.
- *
- * IMPORTANT: pass the RAW request body string (e.g. `await req.text()`),
- * never a re-serialized object - the signed bytes must match exactly.
- */
 declare class CmssyWebhookError extends Error {
     constructor(message: string);
 }
-/**
- * Verify the signature + freshness and return the parsed event. Throws
- * `CmssyWebhookError` on any failure (missing/malformed header, bad
- * signature, stale timestamp, invalid JSON) - catch it and respond 400.
- */
 declare function verifyCmssyWebhook(options: VerifyCmssyWebhookOptions): Promise<CmssyWebhookEvent>;
 
 export { CMSSY_EDIT_HEADER, CMSSY_EDIT_QUERY_PARAM, CMSSY_SECRET_QUERY_PARAM, CmssyWebhookError, fields, isVerifiedEditUrl, verifyCmssyWebhook };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-export { A as AppToEditorMessage, B as BoundsMessage, C as ClickMessage, a as CmssyClient, b as CmssyConfig, c as CmssyCspOptions, d as CmssyEnvConfig, e as CmssyTypedDocument, D as DEFAULT_CMSSY_EDITOR_ORIGINS, E as EditorToAppMessage, P as PROTOCOL_VERSION, f as ParentReadyMessage, g as PatchMessage, h as PostTarget, Q as QueryScopedOptions, R as ReadyMessage, S as SelectMessage, i as applyCmssyCsp, j as createCmssyClient, k as defineCmssyConfig, l as isProtocolCompatible, n as normalizeOrigin, p as parseEditorMessage, m as postToEditor, r as resolveEditorOrigin } from './csp-CpiqfM03.js';
-export { C as CMSSY_LOCALE_HEADER, G as GraphqlRequestOptions, g as graphqlRequest, l as localizeHref, r as resolveCmssyLocale } from './locale-Clouq4s4.js';
-export { C as CmssyRequestError, D as DEFAULT_CMSSY_API_URL, F as FetchLike, a as FetchLikeResponse, b as FetchPageOptions, R as RetryPolicy } from './content-client-CJQ-nafm.js';
+export { A as AppToEditorMessage, B as BoundsMessage, C as ClickMessage, a as CmssyClient, b as CmssyConfig, c as CmssyCspOptions, d as CmssyEnvConfig, e as CmssyTypedDocument, D as DEFAULT_CMSSY_EDITOR_ORIGINS, E as EditorToAppMessage, P as PROTOCOL_VERSION, f as ParentReadyMessage, g as PatchMessage, h as PostTarget, Q as QueryScopedOptions, R as ReadyMessage, S as SelectMessage, i as applyCmssyCsp, j as createCmssyClient, k as defineCmssyConfig, l as isProtocolCompatible, n as normalizeOrigin, p as parseEditorMessage, m as postToEditor, r as resolveEditorOrigin } from './csp-DjFT5SmH.js';
+export { C as CMSSY_LOCALE_HEADER, G as GraphqlRequestOptions, g as graphqlRequest, l as localizeHref, r as resolveCmssyLocale } from './locale-DQZ80cew.js';
+export { C as CmssyRequestError, D as DEFAULT_CMSSY_API_URL, F as FetchLike, a as FetchLikeResponse, b as FetchPageOptions, R as RetryPolicy } from './content-client-BPpRfq0h.js';
 import * as _cmssy_types from '@cmssy/types';
 import { FieldOptions, TypedField, BlockPropsSchema, InferBlockContent, RelationMode, CmssyModelRecord, VerifyCmssyWebhookOptions, CmssyWebhookEvent } from '@cmssy/types';
 export { BlockMeta, BlockPropsSchema, BlockRect, BlockSchema, BuildBlockContextExtra, CmssyBlockAuthContext, CmssyBlockContext, CmssyBlockMember, CmssyBlockPage, CmssyBlockWorkspace, CmssyBranding, CmssyClientConfig, CmssyFormDefinition, CmssyFormField, CmssyFormSettings, CmssyFormSubmitResponse, CmssyLayoutGroup, CmssyLayoutSettings, CmssyLocaleContext, CmssyLocalizedValue, CmssyModelDefinition, CmssyModelRecord, CmssyPageData, CmssyPageMeta, CmssyPageSummary, CmssyRecordList, CmssySiteConfig, CmssyWebhookEvent, CmssyWebhookOrder, FieldCondition, FieldConditionGroup, FieldConditionLogic, FieldControl, FieldDefinition, FieldOptions, FieldType, InferBlockContent, LayoutPosition, RawBlock, RawLayoutBlock, SubmitFormInput, TypedField, VerifyCmssyWebhookOptions, evaluateFieldConditionGroup, layoutPositionValues } from '@cmssy/types';
@@ -17,25 +17,13 @@ type MediaValue<O> = O extends {
 type RepeaterValue<O> = O extends {
     itemSchema: infer Schema extends BlockPropsSchema;
 } ? InferBlockContent<Schema>[] : Record<string, unknown>[];
-/**
- * The value a relation field holds AFTER server-side resolution: the SDK
- * replaces the stored record id(s) with the records themselves before the
- * component renders. `mode: "all"` and `multiple: true` yield a list; the
- * default is a single record - `undefined` when the reference dangles, which
- * no `required` flag can rule out.
- */
 type RelationValue<O> = O extends {
     mode: "all";
 } | {
     multiple: true;
 } ? CmssyModelRecord[] : CmssyModelRecord | undefined;
 interface RelationFieldOptions extends Omit<FieldOptions, "options" | "itemSchema"> {
-    /** Slug of the model the field points at. */
     model: string;
-    /**
-     * "all" binds the field to every record of the model (no editor picking;
-     * `sort`/`limit` shape the list). Omit it for editor-picked record id(s).
-     */
     mode?: RelationMode;
     multiple?: boolean;
     sort?: string;
@@ -79,26 +67,9 @@ declare function isVerifiedEditUrl(url: {
     draftSecret: string;
 }): Promise<boolean>;
 
-/**
- * Verify + parse an inbound cmssy webhook (CMS-693 / CMS-694).
- *
- * cmssy signs each delivery with HMAC-SHA256 over `${timestamp}.${body}`
- * and sends the result in the `X-Cmssy-Signature: t=<ms>,v1=<hex>`
- * header, plus a unique `X-Cmssy-Webhook-Id`. This helper recomputes the
- * signature (timing-safe compare), rejects stale timestamps to bound
- * replay, and returns the typed event.
- *
- * IMPORTANT: pass the RAW request body string (e.g. `await req.text()`),
- * never a re-serialized object - the signed bytes must match exactly.
- */
 declare class CmssyWebhookError extends Error {
     constructor(message: string);
 }
-/**
- * Verify the signature + freshness and return the parsed event. Throws
- * `CmssyWebhookError` on any failure (missing/malformed header, bad
- * signature, stale timestamp, invalid JSON) - catch it and respond 400.
- */
 declare function verifyCmssyWebhook(options: VerifyCmssyWebhookOptions): Promise<CmssyWebhookEvent>;
 
 export { CMSSY_EDIT_HEADER, CMSSY_EDIT_QUERY_PARAM, CMSSY_SECRET_QUERY_PARAM, CmssyWebhookError, fields, isVerifiedEditUrl, verifyCmssyWebhook };

package/dist/index.js

@@ -74,11 +74,6 @@ Set the listed environment variables (e.g. in .env.local) and restart the dev se
 // src/data/http.ts
 var CmssyRequestError = class extends Error {
   status;
-  /**
-   * How long the server asked us to wait, in ms, when it said so. Present on a
-   * 429 that carried `Retry-After`; a caller can serve stale content for that
-   * long instead of guessing.
-   */
   retryAfterMs;
   constructor(message, status, retryAfterMs2) {
     super(message);
@@ -449,8 +444,6 @@ function createCmssyClient(input) {
   const client = {
     config,
     resolveWorkspaceId: resolveWorkspaceId2,
-    // One implementation behind both overloads: a string passes through
-    // documentText untouched, a typed document gives up its query text.
     query: ((document2, variables = {}, options) => query(documentText(document2), variables, options)),
     queryScoped: ((document2, variables = {}, options = {}) => queryScoped(
       documentText(document2),
@@ -762,21 +755,24 @@ var CmssyWebhookError = class extends Error {
   }
 };
 var DEFAULT_TOLERANCE_SECONDS = 300;
+var MAX_SIGNATURES = 8;
 function parseSignatureHeader(header) {
   let timestamp = null;
-  let signature = null;
+  const signatures = [];
   for (const part of header.split(",")) {
     const idx = part.indexOf("=");
     if (idx === -1) continue;
     const key = part.slice(0, idx).trim();
     const value = part.slice(idx + 1).trim();
     if (key === "t") timestamp = Number(value);
-    else if (key === "v1") signature = value;
+    else if (key === "v1" && value && signatures.length < MAX_SIGNATURES) {
+      signatures.push(value);
+    }
   }
-  if (timestamp === null || !Number.isFinite(timestamp) || !signature) {
+  if (timestamp === null || !Number.isFinite(timestamp) || !signatures.length) {
     throw new CmssyWebhookError("Malformed X-Cmssy-Signature header");
   }
-  return { timestamp, signature };
+  return { timestamp, signatures };
 }
 function hexToBytes(hex) {
   if (hex.length % 2 !== 0 || /[^0-9a-fA-F]/.test(hex)) return null;
@@ -790,9 +786,10 @@ function bytesToHex(bytes) {
   return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 function timingSafeHexEqual(expectedHex, providedHex) {
+  if (expectedHex.length !== providedHex.length) return false;
   const expected = hexToBytes(expectedHex);
   const provided = hexToBytes(providedHex);
-  if (!expected || !provided || expected.length !== provided.length) {
+  if (!expected || !provided) {
     return false;
   }
   let diff = 0;
@@ -822,17 +819,28 @@ async function verifyCmssyWebhook(options) {
   if (!signatureHeader) {
     throw new CmssyWebhookError("Missing X-Cmssy-Signature header");
   }
-  if (!secret) {
+  const candidates = typeof secret === "string" ? [secret] : Array.isArray(secret) ? secret : [];
+  if (candidates.some((value) => typeof value !== "string")) {
+    throw new CmssyWebhookError("Webhook secret must be a string");
+  }
+  const secrets = candidates.filter(Boolean);
+  if (!secrets.length) {
     throw new CmssyWebhookError("Missing webhook secret");
   }
-  const { timestamp, signature } = parseSignatureHeader(signatureHeader);
+  const { timestamp, signatures } = parseSignatureHeader(signatureHeader);
   const toleranceMs = (options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS) * 1e3;
   const now = options.now ?? Date.now();
   if (Math.abs(now - timestamp) > toleranceMs) {
     throw new CmssyWebhookError("Webhook timestamp outside tolerance");
   }
-  const expected = await hmacSha256Hex(secret, `${timestamp}.${body}`);
-  if (!timingSafeHexEqual(expected, signature)) {
+  let matched = false;
+  for (const candidate of secrets) {
+    const expected = await hmacSha256Hex(candidate, `${timestamp}.${body}`);
+    for (const signature of signatures) {
+      if (timingSafeHexEqual(expected, signature)) matched = true;
+    }
+  }
+  if (!matched) {
     throw new CmssyWebhookError("Webhook signature mismatch");
   }
   let parsed;