@cmssy/core 5.1.0 → 6.0.1

package/dist/index.cjs

@@ -2,7 +2,6 @@
 
 var jose = require('jose');
 var types = require('@cmssy/types');
-var crypto$1 = require('crypto');
 
 // src/session.ts
 var CMSSY_SESSION_COOKIE = "cmssy_session";
@@ -1639,6 +1638,8 @@ function formatPrice(minor, currency) {
     return `${amount.toFixed(fractionDigits(code))} ${code}`;
   }
 }
+
+// src/verify-webhook.ts
 var CmssyWebhookError = class extends Error {
   constructor(message) {
     super(message);
@@ -1662,13 +1663,46 @@ function parseSignatureHeader(header) {
   }
   return { timestamp, signature };
 }
+function hexToBytes(hex) {
+  if (hex.length % 2 !== 0 || /[^0-9a-fA-F]/.test(hex)) return null;
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < bytes.length; i += 1) {
+    bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+function bytesToHex(bytes) {
+  return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
 function timingSafeHexEqual(expectedHex, providedHex) {
-  const expected = Buffer.from(expectedHex, "hex");
-  const provided = Buffer.from(providedHex, "hex");
-  if (expected.length !== provided.length) return false;
-  return crypto$1.timingSafeEqual(expected, provided);
+  const expected = hexToBytes(expectedHex);
+  const provided = hexToBytes(providedHex);
+  if (!expected || !provided || expected.length !== provided.length) {
+    return false;
+  }
+  let diff = 0;
+  for (let i = 0; i < expected.length; i += 1) {
+    diff |= (expected[i] ?? 0) ^ (provided[i] ?? 0);
+  }
+  return diff === 0;
+}
+async function hmacSha256Hex(secret, message) {
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign(
+    "HMAC",
+    key,
+    encoder.encode(message)
+  );
+  return bytesToHex(new Uint8Array(signature));
 }
-function verifyCmssyWebhook(options) {
+async function verifyCmssyWebhook(options) {
   const { body, signatureHeader, secret } = options;
   if (!signatureHeader) {
     throw new CmssyWebhookError("Missing X-Cmssy-Signature header");
@@ -1682,7 +1716,7 @@ function verifyCmssyWebhook(options) {
   if (Math.abs(now - timestamp) > toleranceMs) {
     throw new CmssyWebhookError("Webhook timestamp outside tolerance");
   }
-  const expected = crypto$1.createHmac("sha256", secret).update(`${timestamp}.${body}`).digest("hex");
+  const expected = await hmacSha256Hex(secret, `${timestamp}.${body}`);
   if (!timingSafeHexEqual(expected, signature)) {
     throw new CmssyWebhookError("Webhook signature mismatch");
   }

package/dist/index.d.cts

@@ -491,6 +491,6 @@ declare class CmssyWebhookError extends Error {
  * `CmssyWebhookError` on any failure (missing/malformed header, bad
  * signature, stale timestamp, invalid JSON) - catch it and respond 400.
  */
-declare function verifyCmssyWebhook(options: VerifyCmssyWebhookOptions): CmssyWebhookEvent;
+declare function verifyCmssyWebhook(options: VerifyCmssyWebhookOptions): Promise<CmssyWebhookEvent>;
 
 export { type AppToEditorMessage, type AuthMutationResult, type AuthTokenResult, type BoundsMessage, CMSSY_EDIT_HEADER, CMSSY_EDIT_QUERY_PARAM, CMSSY_LOCALE_HEADER, CMSSY_SECRET_QUERY_PARAM, CMSSY_SESSION_COOKIE, type CartRequestContext, type CheckoutInput, type ClickMessage, type CmssyClient, type CmssyConfig, type CmssyCspOptions, type CmssyEnvConfig, CmssyRequestError, CmssyWebhookError, DEFAULT_CMSSY_API_URL, DEFAULT_CMSSY_EDITOR_ORIGINS, type EditorToAppMessage, FORM_QUERY, type FetchLike, type FetchLikeResponse, type FetchPageOptions, type GraphqlRequestOptions, MIN_SESSION_SECRET_LENGTH, MODEL_DEFINITIONS_QUERY, MODEL_RECORDS_QUERY, PRODUCTS_QUERY, PROTOCOL_VERSION, type ParentReadyMessage, type PatchMessage, type PostTarget, type QueryScopedOptions, type ReadyMessage, type RetryPolicy, SESSION_MAX_AGE_SECONDS, SITE_CONFIG_QUERY, SUBMIT_FORM_MUTATION, type SelectMessage, applyCmssyCsp, asBucket, assertAuthConfig, backendAddToCart, backendApplyDiscount, backendCheckout, backendClearCart, backendForgotPassword, backendGetCart, backendMergeCart, backendMyOrder, backendMyOrders, backendOrderByToken, backendProduct, backendRefresh, backendRegister, backendRemoveDiscount, backendRemoveItem, backendResetPassword, backendSetShippingMethod, backendSignIn, backendSignOut, backendSignOutEverywhere, backendUpdateItem, backendVerifyEmail, buildBlockContext, buildLocaleSwitchHref, cachedWorkspaceId, clearWorkspaceIdCache, cmssyCspHeaders, cmssySecretsMatch, collectFormIds, createCmssyClient, decodeAccessClaims, defineCmssyConfig, fetchLayouts, fetchOrderByToken, fetchPage, fetchPageById, fetchPageMeta, fetchPages, fetchProduct, fetchProducts, fetchSiteConfig, fields, formatPrice, fractionDigits, fromMinorUnits, getBlockContentForLanguage, graphqlRequest, isAccessExpired, isDevelopment, isProtocolCompatible, isVerifiedEditUrl, localeForPath, localeForPathname, localizeHref, localizeHtmlLinks, localizedPath, normalizeOrigin, normalizeSlug, openSession, parseEditorMessage, postToEditor, resolveApiUrl, resolveEditorOrigin, resolveForms, resolveInitialTarget, resolvePublicUrl, resolveSeoLocales, resolveSiteLocales, resolveWorkspaceId, sealSession, sessionCookieOptions, splitCmssyLocale, splitLocaleFromPath, toCspOrigin, toMinorUnits, toSessionPayload, verifyCmssyWebhook };

package/dist/index.d.ts

@@ -491,6 +491,6 @@ declare class CmssyWebhookError extends Error {
  * `CmssyWebhookError` on any failure (missing/malformed header, bad
  * signature, stale timestamp, invalid JSON) - catch it and respond 400.
  */
-declare function verifyCmssyWebhook(options: VerifyCmssyWebhookOptions): CmssyWebhookEvent;
+declare function verifyCmssyWebhook(options: VerifyCmssyWebhookOptions): Promise<CmssyWebhookEvent>;
 
 export { type AppToEditorMessage, type AuthMutationResult, type AuthTokenResult, type BoundsMessage, CMSSY_EDIT_HEADER, CMSSY_EDIT_QUERY_PARAM, CMSSY_LOCALE_HEADER, CMSSY_SECRET_QUERY_PARAM, CMSSY_SESSION_COOKIE, type CartRequestContext, type CheckoutInput, type ClickMessage, type CmssyClient, type CmssyConfig, type CmssyCspOptions, type CmssyEnvConfig, CmssyRequestError, CmssyWebhookError, DEFAULT_CMSSY_API_URL, DEFAULT_CMSSY_EDITOR_ORIGINS, type EditorToAppMessage, FORM_QUERY, type FetchLike, type FetchLikeResponse, type FetchPageOptions, type GraphqlRequestOptions, MIN_SESSION_SECRET_LENGTH, MODEL_DEFINITIONS_QUERY, MODEL_RECORDS_QUERY, PRODUCTS_QUERY, PROTOCOL_VERSION, type ParentReadyMessage, type PatchMessage, type PostTarget, type QueryScopedOptions, type ReadyMessage, type RetryPolicy, SESSION_MAX_AGE_SECONDS, SITE_CONFIG_QUERY, SUBMIT_FORM_MUTATION, type SelectMessage, applyCmssyCsp, asBucket, assertAuthConfig, backendAddToCart, backendApplyDiscount, backendCheckout, backendClearCart, backendForgotPassword, backendGetCart, backendMergeCart, backendMyOrder, backendMyOrders, backendOrderByToken, backendProduct, backendRefresh, backendRegister, backendRemoveDiscount, backendRemoveItem, backendResetPassword, backendSetShippingMethod, backendSignIn, backendSignOut, backendSignOutEverywhere, backendUpdateItem, backendVerifyEmail, buildBlockContext, buildLocaleSwitchHref, cachedWorkspaceId, clearWorkspaceIdCache, cmssyCspHeaders, cmssySecretsMatch, collectFormIds, createCmssyClient, decodeAccessClaims, defineCmssyConfig, fetchLayouts, fetchOrderByToken, fetchPage, fetchPageById, fetchPageMeta, fetchPages, fetchProduct, fetchProducts, fetchSiteConfig, fields, formatPrice, fractionDigits, fromMinorUnits, getBlockContentForLanguage, graphqlRequest, isAccessExpired, isDevelopment, isProtocolCompatible, isVerifiedEditUrl, localeForPath, localeForPathname, localizeHref, localizeHtmlLinks, localizedPath, normalizeOrigin, normalizeSlug, openSession, parseEditorMessage, postToEditor, resolveApiUrl, resolveEditorOrigin, resolveForms, resolveInitialTarget, resolvePublicUrl, resolveSeoLocales, resolveSiteLocales, resolveWorkspaceId, sealSession, sessionCookieOptions, splitCmssyLocale, splitLocaleFromPath, toCspOrigin, toMinorUnits, toSessionPayload, verifyCmssyWebhook };

package/dist/index.js

@@ -1,6 +1,5 @@
 import { EncryptJWT, jwtDecrypt } from 'jose';
 export { evaluateFieldConditionGroup } from '@cmssy/types';
-import { createHmac, timingSafeEqual } from 'crypto';
 
 // src/session.ts
 var CMSSY_SESSION_COOKIE = "cmssy_session";
@@ -1637,6 +1636,8 @@ function formatPrice(minor, currency) {
     return `${amount.toFixed(fractionDigits(code))} ${code}`;
   }
 }
+
+// src/verify-webhook.ts
 var CmssyWebhookError = class extends Error {
   constructor(message) {
     super(message);
@@ -1660,13 +1661,46 @@ function parseSignatureHeader(header) {
   }
   return { timestamp, signature };
 }
+function hexToBytes(hex) {
+  if (hex.length % 2 !== 0 || /[^0-9a-fA-F]/.test(hex)) return null;
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < bytes.length; i += 1) {
+    bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+function bytesToHex(bytes) {
+  return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
 function timingSafeHexEqual(expectedHex, providedHex) {
-  const expected = Buffer.from(expectedHex, "hex");
-  const provided = Buffer.from(providedHex, "hex");
-  if (expected.length !== provided.length) return false;
-  return timingSafeEqual(expected, provided);
+  const expected = hexToBytes(expectedHex);
+  const provided = hexToBytes(providedHex);
+  if (!expected || !provided || expected.length !== provided.length) {
+    return false;
+  }
+  let diff = 0;
+  for (let i = 0; i < expected.length; i += 1) {
+    diff |= (expected[i] ?? 0) ^ (provided[i] ?? 0);
+  }
+  return diff === 0;
+}
+async function hmacSha256Hex(secret, message) {
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign(
+    "HMAC",
+    key,
+    encoder.encode(message)
+  );
+  return bytesToHex(new Uint8Array(signature));
 }
-function verifyCmssyWebhook(options) {
+async function verifyCmssyWebhook(options) {
   const { body, signatureHeader, secret } = options;
   if (!signatureHeader) {
     throw new CmssyWebhookError("Missing X-Cmssy-Signature header");
@@ -1680,7 +1714,7 @@ function verifyCmssyWebhook(options) {
   if (Math.abs(now - timestamp) > toleranceMs) {
     throw new CmssyWebhookError("Webhook timestamp outside tolerance");
   }
-  const expected = createHmac("sha256", secret).update(`${timestamp}.${body}`).digest("hex");
+  const expected = await hmacSha256Hex(secret, `${timestamp}.${body}`);
   if (!timingSafeHexEqual(expected, signature)) {
     throw new CmssyWebhookError("Webhook signature mismatch");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmssy/core",
-  "version": "5.1.0",
+  "version": "6.0.1",
   "description": "Framework-agnostic cmssy client: content, commerce, config, editor protocol. No React, no Next.",
   "keywords": [
     "cmssy",