@elytracms/next 0.0.88 → 0.0.90

package/dist/index.js

@@ -5,16 +5,16 @@ import { isValidElement } from 'react';
 import { isBlockSequenceValueShape } from '@elytracms/core/rich-text';
 import { jsx, Fragment } from 'react/jsx-runtime';
 import { cacheTags, isDocumentHistory, resolvedAsset, createContentClient, createContentContext } from '@elytracms/core/content';
-import { documentKey, splitLocalePath, hierarchyMount, composePath, localeUrlPath, mergeRouteRecords, fallbackHomeRoutes, presentationBodyFields, splitPath, documentSchema, redirectRecordSchema } from '@elytracms/core/cms-core';
-export { documentSchema, fallbackHomeRoutes, localeConfigSchema, localeUrlPath, mergeRouteRecords, redirectRecordSchema, resolveLocale, routeRecordSchema, splitLocalePath, textDirection } from '@elytracms/core/cms-core';
+import { parseLocaleConfig, documentKey, splitLocalePath, hierarchyMount, composePath, localeUrlPath, mergeRouteRecords, fallbackHomeRoutes, presentationBodyFields, splitPath, documentSchema, redirectRecordSchema } from '@elytracms/core/cms-core';
+export { documentSchema, fallbackHomeRoutes, localeConfigSchema, localeUrlPath, mergeRouteRecords, parseLocaleConfig, redirectRecordSchema, resolveLocale, routeRecordSchema, splitLocalePath, textDirection } from '@elytracms/core/cms-core';
 import { revalidateTag, unstable_cache } from 'next/cache';
 import { draftMode } from 'next/headers';
 import { redirect, notFound, permanentRedirect } from 'next/navigation';
 import { COMPOSITE_KEY_SEPARATOR } from '@elytracms/core/project-graph';
-import { createHmac, timingSafeEqual } from 'crypto';
-import { z } from 'zod';
-export { z } from 'zod';
+import { verifyRevalidationSignature, readRevalidationBody, REVALIDATE_SIGNATURE_HEADER } from '@elytracms/core/revalidation';
+export { REVALIDATE_SIGNATURE_HEADER, revalidationEventSchema, signRevalidationBody, signedRevalidationRequest } from '@elytracms/core/revalidation';
 import NextImage from 'next/image';
+export { z } from 'zod';
 
 // src/components.ts
 function defineHostComponents(components = [], options = {}) {
@@ -134,7 +134,7 @@ function mergeCacheTags(first, ...rest) {
   });
 }
 function createStaticContentSource(data) {
-  const locales = data.locales;
+  const locales = parseLocaleConfig(data.locales);
   const routes = data.routes ?? [];
   const redirects = data.redirects ?? [];
   const assetUrl = data.assetUrl ?? ((asset) => `asset://unresolved/${asset.storageKey}`);
@@ -414,6 +414,27 @@ function nextCacheTags(tags, scope) {
   for (const assetId of tags.assets) all.add(assetCacheTag(assetId, scope));
   return [...all].sort();
 }
+function revalidationTags(event, project) {
+  const { scope } = project;
+  const tags = /* @__PURE__ */ new Set();
+  switch (event.kind) {
+    case "publish":
+    case "unpublish":
+    case "delete":
+      tags.add(docCacheTag(`${event.collection}:${event.id}`, scope));
+      for (const locale of project.locales) tags.add(collectionCacheTag(event.collection, locale, scope));
+      tags.add(projectSweepTag(scope));
+      break;
+    case "redirects":
+      tags.add(projectSweepTag(scope));
+      break;
+    case "asset":
+      tags.add(assetCacheTag(event.id, scope));
+      tags.add(projectSweepTag(scope));
+      break;
+  }
+  return [...tags].sort();
+}
 function canvasCacheKey({ scope, mode, url }) {
   return ["elytra-route", scope ?? "", mode ?? "", url];
 }
@@ -585,7 +606,7 @@ function createCanvasRoute(options) {
     return options.metadata ? options.metadata(outcome.result, { url, perspective }) : defaultMetadata(outcome.result, outcome.assets);
   };
   const generateMetadata = async (props, parent) => {
-    const [page, resolvedParent] = await Promise.all([pageMetadata(props), parent ?? null]);
+    const [page, resolvedParent] = await Promise.all([pageMetadata(props), parent]);
     return mergeMetadataOverParent(resolvedParent, page);
   };
   return { Page, generateMetadata };
@@ -719,71 +740,33 @@ function createCanvasSitemap(options) {
     return canvasSitemapEntries(source, options).entries;
   };
 }
-var REVALIDATE_SIGNATURE_HEADER = "x-elytra-signature";
-var revalidatePayloadSchema = z.object({
-  projectId: z.string().min(1),
-  /** The operation that fired, e.g. `documents.setState`, `publishing.publish`. */
-  event: z.string().min(1),
-  /** Fully-formatted Next tag strings (already scoped) — revalidated verbatim. */
-  tags: z.array(z.string().min(1)),
-  /** ISO timestamp of emission. Informational in v1 (no replay window). */
-  timestamp: z.string().min(1)
-});
-function signRevalidateBody(rawBody, secret) {
-  return `sha256=${createHmac("sha256", secret).update(rawBody, "utf8").digest("hex")}`;
-}
-var SIGNATURE_PREFIX = "sha256=";
-var HEX_PATTERN = /^[0-9a-f]+$/;
-function evaluateRevalidateRequest(rawBody, signature, secret) {
+async function evaluateRevalidateRequest(rawBody, signature, secret) {
   if (secret === void 0 || secret.length === 0) {
     return { ok: false, status: 401, message: "Revalidation webhook is not configured." };
   }
-  if (signature === null || signature === void 0 || !signature.startsWith(SIGNATURE_PREFIX)) {
+  if (typeof signature !== "string" || signature.length === 0) {
     return { ok: false, status: 401, message: "Missing or malformed webhook signature." };
   }
-  const providedHex = signature.slice(SIGNATURE_PREFIX.length).toLowerCase();
-  const expectedHex = createHmac("sha256", secret).update(rawBody, "utf8").digest("hex");
-  if (providedHex.length !== expectedHex.length || !HEX_PATTERN.test(providedHex) || !timingSafeEqual(Buffer.from(providedHex, "hex"), Buffer.from(expectedHex, "hex"))) {
+  if (!await verifyRevalidationSignature(rawBody, signature, secret)) {
     return { ok: false, status: 401, message: "Invalid webhook signature." };
   }
-  let parsed;
-  try {
-    parsed = JSON.parse(rawBody);
-  } catch {
-    return { ok: false, status: 400, message: "Webhook body is not valid JSON." };
-  }
-  const payload = revalidatePayloadSchema.safeParse(parsed);
-  if (!payload.success) {
-    return { ok: false, status: 400, message: "Webhook payload has an invalid shape." };
-  }
-  return { ok: true, payload: payload.data };
-}
-function corsHeaders(allowOrigin) {
-  if (allowOrigin === void 0 || allowOrigin.length === 0) return {};
-  return {
-    "access-control-allow-origin": allowOrigin,
-    "access-control-allow-methods": "POST, OPTIONS",
-    "access-control-allow-headers": `content-type, ${REVALIDATE_SIGNATURE_HEADER}`
-  };
+  const read = readRevalidationBody(rawBody);
+  if (!read.ok) return { ok: false, status: 400, message: read.message };
+  return { ok: true, event: read.event };
 }
 function createRevalidateRoute(options) {
-  const cors = corsHeaders(options.allowOrigin);
+  const project = { scope: options.scope, locales: [...options.locales] };
   return {
     async POST(request) {
       const rawBody = await request.text();
       const signature = request.headers.get(REVALIDATE_SIGNATURE_HEADER);
-      const evaluation = evaluateRevalidateRequest(rawBody, signature, options.secret);
+      const evaluation = await evaluateRevalidateRequest(rawBody, signature, options.secret);
       if (!evaluation.ok) {
-        return Response.json(
-          { error: evaluation.message },
-          { status: evaluation.status, headers: cors }
-        );
+        return Response.json({ error: evaluation.message }, { status: evaluation.status });
       }
-      for (const tag of evaluation.payload.tags) revalidateTag(tag, { expire: 0 });
-      return Response.json({ revalidated: evaluation.payload.tags }, { headers: cors });
-    },
-    async OPTIONS() {
-      return new Response(null, { status: 204, headers: cors });
+      const tags = revalidationTags(evaluation.event, project);
+      for (const tag of tags) revalidateTag(tag, { expire: 0 });
+      return Response.json({ revalidated: tags });
     }
   };
 }
@@ -894,8 +877,7 @@ var ELYTRA_HOST_ENV_KEYS = {
   convexUrl: "ELYTRA_CONVEX_URL",
   projectId: "ELYTRA_PROJECT_ID",
   draftToken: "DRAFT_PREVIEW_TOKEN",
-  revalidateSecret: "REVALIDATE_SECRET",
-  studioOrigin: "STUDIO_ORIGIN"
+  revalidateSecret: "REVALIDATE_SECRET"
 };
 function cleaned(value) {
   const trimmed = value?.trim();
@@ -1241,11 +1223,10 @@ function createElytraHost(options) {
     return createCanvasRoute({
       loadContent,
       components,
-      // Tag scope = the project id the studio publishes under, so its webhook
-      // tags match this site's cached entries.
-      // EC-543: the mode is in the entry key so no world ever reads another's
-      // entries; an explicit override may replace the scope, not drop the mode.
-      ...cache === false ? {} : { cache: { mode: contentMode, ...cache ?? { scope: contentScope } } },
+      // Tag scope = `contentScope`, the SAME value `revalidateRoute` derives its
+      // invalidation tags with (EC-579) — one scope, so they cannot disagree.
+      // EC-543: the mode is in the entry key so no world ever reads another's entries.
+      ...cache === false ? {} : { cache: { mode: contentMode, scope: contentScope } },
       ...rest
     });
   };
@@ -1253,7 +1234,11 @@ function createElytraHost(options) {
     // An unset secret keeps the endpoint CLOSED (401) — the kit never ships a
     // default secret (an auth-shaped no-op is worse than an explicit gap).
     secret: "secret" in overrides ? overrides.secret : env.revalidateSecret,
-    ...overrides.allowOrigin !== void 0 ? { allowOrigin: overrides.allowOrigin } : env.studioOrigin !== void 0 ? { allowOrigin: env.studioOrigin } : {}
+    // EC-579: the receiver's OWN project — the scope its cache entries are written
+    // under (`canvasRoute` above) and every locale it serves. The emitter sends only
+    // the event, so this is the one place the scope and locales are read for it.
+    scope: contentScope,
+    locales: options.locales.locales
   });
   const previewRoute = () => createPreviewRoute({ token: env.draftToken });
   const previewDisableRoute = () => createPreviewDisableRoute();
@@ -1284,6 +1269,6 @@ function createElytraHost(options) {
 }
 var PACKAGE = "@elytracms/next";
 
-export { CanvasRenderer, ELYTRA_HOST_ENV_KEYS, ElytraImage, PACKAGE, REVALIDATE_SIGNATURE_HEADER, assembleLiveSource, bodyItemsOf, canvasPageMetadata, canvasSitemapEntries, collectionCacheTag, createAssetImageLoader, createCanvasRoute, createCanvasSitemap, createContentSnapshot, createElytraHost, createPreviewDisableRoute, createPreviewRoute, createRevalidateRoute, createStaticContentSource, defineHostComponents, docCacheTag, elytraHostImage, evaluatePreviewRequest, evaluateRevalidateRequest, firstBlockFullBleed, loadCachedEntry, loadLiveContent, mergeCacheTags, mergeMetadataOverParent, nextCacheTags, nextImagePrimitive, openGraphLocale, pathFromSlug, projectSweepTag, resolveCanvasPage, resolveGlobals, resolveHostEnv, revalidatePayloadSchema, routeCacheTag, safeRedirectTarget, scopeCacheTag, signRevalidateBody };
+export { CanvasRenderer, ELYTRA_HOST_ENV_KEYS, ElytraImage, PACKAGE, assembleLiveSource, bodyItemsOf, canvasPageMetadata, canvasSitemapEntries, collectionCacheTag, createAssetImageLoader, createCanvasRoute, createCanvasSitemap, createContentSnapshot, createElytraHost, createPreviewDisableRoute, createPreviewRoute, createRevalidateRoute, createStaticContentSource, defineHostComponents, docCacheTag, elytraHostImage, evaluatePreviewRequest, evaluateRevalidateRequest, firstBlockFullBleed, loadCachedEntry, loadLiveContent, mergeCacheTags, mergeMetadataOverParent, nextCacheTags, nextImagePrimitive, openGraphLocale, pathFromSlug, projectSweepTag, resolveCanvasPage, resolveGlobals, resolveHostEnv, revalidationTags, routeCacheTag, safeRedirectTarget, scopeCacheTag };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map