@riverbankcms/sdk 0.78.0 → 0.79.0

package/dist/server/index.mjs

@@ -1770,7 +1770,16 @@ var ENDPOINT_DEFINITIONS = {
     revalidate: 60,
     tags: ["site-{siteId}", "content-{siteId}-{type}"],
     auth: "user",
-    responseKind: "json"
+    responseKind: "json",
+    errors: ["validation:invalid_input", "resource:not_found", "resource:conflict", "server:internal_error"]
+  },
+  reorderContentEntries: {
+    path: "/sites/{siteId}/content/{type}/order",
+    method: "POST",
+    tags: ["site-{siteId}", "content-{siteId}-{type}"],
+    auth: "user",
+    responseKind: "json",
+    errors: ["validation:invalid_input", "resource:not_found", "resource:conflict", "server:internal_error"]
   },
   getContentTemplate: {
     path: "/sites/{siteId}/content/types/{type}/template",
@@ -2162,6 +2171,46 @@ var ENDPOINT_DEFINITIONS = {
     auth: "user",
     responseKind: "json"
   },
+  getSiteIconStyleGuide: {
+    path: "/sites/{siteId}/settings/icon-style-guide",
+    method: "GET",
+    revalidate: 120,
+    tags: [TAG_TEMPLATES.site, TAG_TEMPLATES.siteSettings],
+    auth: "user",
+    responseKind: "json",
+    errors: []
+  },
+  updateSiteIconStyleGuide: {
+    path: "/sites/{siteId}/settings/icon-style-guide",
+    method: "POST",
+    tags: [TAG_TEMPLATES.site, TAG_TEMPLATES.siteSettings],
+    auth: "user",
+    responseKind: "json",
+    errors: []
+  },
+  regenerateSiteIconStyleGuide: {
+    path: "/sites/{siteId}/settings/icon-style-guide/regenerate",
+    method: "POST",
+    tags: [TAG_TEMPLATES.site, TAG_TEMPLATES.siteSettings],
+    auth: "user",
+    responseKind: "json",
+    errors: []
+  },
+  generateGeneratedIconSet: {
+    path: "/sites/{siteId}/ai/generated-icons/generate",
+    method: "POST",
+    auth: "user",
+    responseKind: "json",
+    errors: []
+  },
+  applyGeneratedIconSet: {
+    path: "/sites/{siteId}/ai/generated-icons/apply",
+    method: "POST",
+    tags: [TAG_TEMPLATES.site, TAG_TEMPLATES.siteSettings],
+    auth: "user",
+    responseKind: "json",
+    errors: []
+  },
   getSiteAiProfile: {
     path: "/sites/{siteId}/settings/ai-site-profile",
     method: "GET",
@@ -3937,6 +3986,14 @@ var ENDPOINT_DEFINITIONS = {
     auth: "public",
     responseKind: "json"
   },
+  getGeneratedIconRenderAssets: {
+    path: "/public/sites/{siteId}/generated-icon-assets",
+    method: "POST",
+    tags: [TAG_TEMPLATES.siteRoutableContent],
+    auth: "public",
+    responseKind: "json",
+    errors: []
+  },
   // Resolve entry subroute by kind and URL segment
   resolveEntrySubroute: {
     path: "/public/sites/{siteId}/routing/subroutes/resolve",
@@ -5641,6 +5698,13 @@ var ENDPOINT_DEFINITIONS = {
     auth: "service",
     responseKind: "json"
   },
+  sdkDeleteNavigationMenu: {
+    path: "/sdk/{siteId}/navigation/{menuId}",
+    method: "DELETE",
+    auth: "service",
+    responseKind: "json",
+    errors: ["resource:not_found", "server:internal_error"]
+  },
   sdkUpsertTheme: {
     path: "/sdk/{siteId}/theme",
     method: "POST",
@@ -6383,18 +6447,21 @@ function buildEndpointURL(baseURL, endpoint) {
 function isFormDataBody(value) {
   return typeof FormData !== "undefined" && value instanceof FormData;
 }
+function isUnknownArray(value) {
+  return Array.isArray(value);
+}
 function appendQueryParam(queryParams, key, value) {
   if (value === void 0 || value === null) {
     return;
   }
-  if (Array.isArray(value)) {
+  if (isUnknownArray(value)) {
     const stack = [...value].reverse();
     while (stack.length > 0) {
       const item = stack.pop();
       if (item === void 0 || item === null) {
         continue;
       }
-      if (Array.isArray(item)) {
+      if (isUnknownArray(item)) {
         stack.push(...[...item].reverse());
         continue;
       }
@@ -6404,6 +6471,12 @@ function appendQueryParam(queryParams, key, value) {
   }
   queryParams.append(key, String(value));
 }
+function serializePathParam(endpoint, key, value) {
+  if (typeof value === "string") {
+    return value;
+  }
+  throw new Error(`Invalid path param for endpoint ${String(endpoint)}: ${key} must be a string`);
+}
 function invalidateCacheTags(tags, params) {
   const resolved = getRevalidateTag();
   if (typeof window !== "undefined" || !resolved || !tags) return;
@@ -6542,8 +6615,9 @@ function createRawCMSClient(headers = {}, baseUrl) {
         const bracePlaceholder = `{${key}}`;
         const colonPlaceholder = `:${key}`;
         if (originalPath.includes(bracePlaceholder) || originalPath.includes(colonPlaceholder)) {
-          url = url.replace(bracePlaceholder, value);
-          url = url.replace(colonPlaceholder, value);
+          const stringValue = serializePathParam(endpoint, key, value);
+          url = url.replace(bracePlaceholder, stringValue);
+          url = url.replace(colonPlaceholder, stringValue);
         } else {
           unusedParams[key] = value;
         }
@@ -6817,7 +6891,7 @@ var SimpleCache = class {
 };
 
 // src/version.ts
-var SDK_VERSION = "0.78.0";
+var SDK_VERSION = "0.79.0";
 
 // src/client/error.ts
 var RiverbankApiError = class _RiverbankApiError extends Error {
@@ -7236,9 +7310,10 @@ var CircuitOpenError = class extends Error {
 var prebuildModule = null;
 function tryRequire(modulePath) {
   try {
-    const req = Function(
+    const getRequire = new Function(
       'return typeof require === "function" ? require : null'
-    )();
+    );
+    const req = getRequire();
     return req ? req(modulePath) : null;
   } catch {
     return null;
@@ -7751,8 +7826,7 @@ function createRiverbankClient(config) {
       async (sig) => {
         return await apiClient({
           endpoint: "getContentByPath",
-          params: { siteId },
-          body: { path: path3, preview },
+          params: { siteId, path: path3, preview: String(preview) },
           options: { signal: sig }
         });
       },
@@ -7802,6 +7876,8 @@ function createRiverbankClient(config) {
             orderParam = "published_at.asc";
           } else if (order === "title") {
             orderParam = "title.asc";
+          } else if (order === "manual") {
+            orderParam = "manual.asc";
           }
           const apiParams = {
             siteId,
@@ -9002,6 +9078,14 @@ var API_ENDPOINTS2 = Object.freeze({
     auth: "user",
     responseKind: "json"
   },
+  getPublicRoutableContent: {
+    path: "/public/sites/{siteId}/routable-content",
+    method: "GET",
+    revalidate: 60,
+    tags: ["riverbank:site:{siteId}:routable-content"],
+    auth: "public",
+    responseKind: "json"
+  },
   getPublicSitemapRoutes: {
     path: "/public/sites/{siteId}/sitemap",
     method: "GET",

package/dist/server/next/revalidate.mjs

@@ -1,56 +1,156 @@
 // src/next/revalidate.ts
 import { revalidateTag, revalidatePath } from "next/cache";
 
-// src/webhooks/verify.ts
-import crypto from "crypto";
+// ../api/src/webhooks.ts
 import { z } from "zod";
-var WebhookEventSchema = z.enum([
+var RIVERBANK_SIGNATURE_PREFIX = "sha256=";
+var SUPPORTED_WEBHOOK_EVENTS = [
   "page.published",
+  "page.unpublished",
+  "page.deleted",
+  "page.path_changed",
   "entry.published",
+  "entry.unpublished",
+  "entry.deleted",
+  "entry.path_changed",
   "navigation.updated",
   "theme.updated",
   "site.settings_updated"
-]);
+];
+var WebhookEventSchema = z.enum(SUPPORTED_WEBHOOK_EVENTS);
+function asRevalidationPath(path) {
+  return path;
+}
+function parseRevalidationPath(input) {
+  const trimmed = input.trim();
+  if (!trimmed) {
+    return { success: false, error: { tag: "EMPTY_PATH", input } };
+  }
+  if (/^[a-z][a-z\d+.-]*:/i.test(trimmed) || trimmed.startsWith("//") || !trimmed.startsWith("/")) {
+    return { success: false, error: { tag: "ABSOLUTE_OR_PROTOCOL_PATH", input } };
+  }
+  if (/[\u0000-\u001F\u007F]/.test(trimmed) || trimmed.includes("\\") || trimmed.includes("?") || trimmed.includes("#")) {
+    return { success: false, error: { tag: "MALFORMED_PATH", input } };
+  }
+  const collapsed = trimmed.replace(/\/{2,}/g, "/");
+  const normalized = collapsed === "/" ? "/" : collapsed.replace(/\/+$/g, "");
+  return { success: true, path: asRevalidationPath(normalized) };
+}
+function normalizeRevalidationPath(input) {
+  const result = parseRevalidationPath(input);
+  return result.success ? result.path : null;
+}
 var PagePublishedDataSchema = z.object({
   pageId: z.string(),
   path: z.string(),
   slug: z.string().optional()
-});
+}).strict();
+var PageRemovedDataSchema = z.object({
+  pageId: z.string(),
+  path: z.string(),
+  slug: z.string().optional()
+}).strict();
+var PagePathChangedDataSchema = z.object({
+  pageId: z.string(),
+  previousPath: z.string(),
+  path: z.string(),
+  slug: z.string().optional()
+}).strict();
 var EntryPublishedDataSchema = z.object({
   entryId: z.string(),
   path: z.string(),
   contentType: z.string()
-});
+}).strict();
+var EntryRemovedDataSchema = z.object({
+  entryId: z.string(),
+  path: z.string(),
+  contentType: z.string()
+}).strict();
+var EntryPathChangedDataSchema = z.object({
+  entryId: z.string(),
+  previousPath: z.string(),
+  path: z.string(),
+  contentType: z.string()
+}).strict();
 var NavigationUpdatedDataSchema = z.object({
   menuId: z.string().optional()
-});
-var EmptyDataSchema = z.object({});
-var WebhookDataSchema = z.union([
-  PagePublishedDataSchema,
-  EntryPublishedDataSchema,
-  NavigationUpdatedDataSchema,
-  EmptyDataSchema
-]);
-var WebhookPayloadSchema = z.object({
-  /** Event type */
-  event: WebhookEventSchema,
-  /** ISO timestamp of when the event occurred */
+}).strict();
+var EmptyWebhookDataSchema = z.object({}).strict();
+var WebhookPayloadBaseSchema = z.object({
   timestamp: z.string(),
-  /** Site ID that triggered the event */
+  dispatchId: z.string().optional(),
   siteId: z.string(),
-  /** Event-specific data (shape depends on event type) */
-  data: z.record(z.string(), z.unknown()),
-  /** Cache invalidation tags (for tag-based revalidation) */
-  tags: z.array(z.string()).optional()
+  tags: z.array(z.string()).optional(),
+  paths: z.array(z.string()).optional()
 });
+var WebhookPayloadSchema = z.discriminatedUnion("event", [
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("page.published"),
+    data: PagePublishedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("page.unpublished"),
+    data: PageRemovedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("page.deleted"),
+    data: PageRemovedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("page.path_changed"),
+    data: PagePathChangedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("entry.published"),
+    data: EntryPublishedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("entry.unpublished"),
+    data: EntryRemovedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("entry.deleted"),
+    data: EntryRemovedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("entry.path_changed"),
+    data: EntryPathChangedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("navigation.updated"),
+    data: NavigationUpdatedDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("theme.updated"),
+    data: EmptyWebhookDataSchema
+  }),
+  WebhookPayloadBaseSchema.extend({
+    event: z.literal("site.settings_updated"),
+    data: EmptyWebhookDataSchema
+  })
+]);
+
+// src/client/types.ts
+var SDK_CORRELATION_HEADER_NAMES = [
+  "x-request-id",
+  "x-correlation-id",
+  "x-riverbank-monitor-run-id"
+];
+
+// src/webhooks/verify.ts
+import crypto from "crypto";
 function verifyWebhookSignature(payload, signature, secret) {
-  const expectedSignature = crypto.createHmac("sha256", secret).update(payload).digest("hex");
-  if (signature.length !== expectedSignature.length) {
+  if (!signature.startsWith(RIVERBANK_SIGNATURE_PREFIX)) {
+    return false;
+  }
+  const signatureDigest = signature.slice(RIVERBANK_SIGNATURE_PREFIX.length);
+  if (!/^[a-f0-9]{64}$/.test(signatureDigest)) {
     return false;
   }
+  const expectedSignature = crypto.createHmac("sha256", secret).update(payload).digest("hex");
   return crypto.timingSafeEqual(
-    Buffer.from(signature),
-    Buffer.from(expectedSignature)
+    Buffer.from(signatureDigest, "hex"),
+    Buffer.from(expectedSignature, "hex")
   );
 }
 function parseWebhookPayload(body) {
@@ -68,6 +168,65 @@ function parseWebhookPayload(body) {
 }
 
 // src/next/revalidate.ts
+var [
+  SDK_REQUEST_ID_HEADER,
+  SDK_CORRELATION_ID_HEADER,
+  SDK_MONITOR_RUN_ID_HEADER
+] = SDK_CORRELATION_HEADER_NAMES;
+var RIVERBANK_DISPATCH_ID_HEADER = "x-riverbank-dispatch-id";
+var RIVERBANK_CORRELATION_ID_HEADER = "x-riverbank-correlation-id";
+function normalizeRevalidationPath2(path) {
+  return normalizeRevalidationPath(path);
+}
+function normalizeRevalidationPaths(paths = []) {
+  const normalized = [];
+  const invalidPaths = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const path of paths) {
+    const normalizedPath = normalizeRevalidationPath2(path);
+    if (!normalizedPath) {
+      invalidPaths.push(path);
+      continue;
+    }
+    if (!seen.has(normalizedPath)) {
+      seen.add(normalizedPath);
+      normalized.push(normalizedPath);
+    }
+  }
+  return { paths: normalized, invalidPaths };
+}
+function normalizeRevalidationTags(tags = []) {
+  const normalized = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const tag of tags) {
+    const trimmed = tag.trim();
+    if (!trimmed || seen.has(trimmed)) continue;
+    seen.add(trimmed);
+    normalized.push(trimmed);
+  }
+  return normalized;
+}
+function getOptionalHeader(headers, name) {
+  const value = headers.get(name)?.trim();
+  return value ? value : void 0;
+}
+function getRevalidationRequestMetadata(request, payload, counts) {
+  const dispatchId = payload.dispatchId ?? getOptionalHeader(request.headers, RIVERBANK_DISPATCH_ID_HEADER);
+  const requestId = getOptionalHeader(request.headers, "x-vercel-id") ?? getOptionalHeader(request.headers, SDK_REQUEST_ID_HEADER);
+  const correlationId = getOptionalHeader(request.headers, RIVERBANK_CORRELATION_ID_HEADER) ?? getOptionalHeader(request.headers, SDK_CORRELATION_ID_HEADER);
+  const monitorRunId = getOptionalHeader(request.headers, SDK_MONITOR_RUN_ID_HEADER);
+  return {
+    event: payload.event,
+    siteId: payload.siteId,
+    ...dispatchId ? { dispatchId } : {},
+    pathCount: counts.pathCount,
+    tagCount: counts.tagCount,
+    itemCount: counts.itemCount,
+    ...requestId ? { requestId } : {},
+    ...correlationId ? { correlationId } : {},
+    ...monitorRunId ? { monitorRunId } : {}
+  };
+}
 function createRevalidateHandler(options = {}) {
   return async function handleRevalidateRequest(request) {
     const secret = options.secret ?? process.env.RIVERBANK_WEBHOOK_SECRET;
@@ -81,41 +240,77 @@ function createRevalidateHandler(options = {}) {
     const body = await request.text();
     const signature = request.headers.get("x-riverbank-signature");
     if (!signature || !verifyWebhookSignature(body, signature, secret)) {
+      console.warn("[Riverbank] Rejected webhook with invalid signature");
       return Response.json({ error: "Invalid signature" }, { status: 401 });
     }
     const parseResult = parseWebhookPayload(body);
     if (!parseResult.success) {
+      console.warn("[Riverbank] Rejected webhook with invalid payload", {
+        reason: parseResult.error
+      });
       return Response.json({ error: parseResult.error }, { status: 400 });
     }
     const payload = parseResult.payload;
     const revalidated = [];
-    if (payload.tags?.length) {
-      for (const tag of payload.tags) {
+    const normalizedPaths = normalizeRevalidationPaths(payload.paths);
+    if (normalizedPaths.invalidPaths.length > 0) {
+      console.warn(
+        "[Riverbank] Ignored invalid revalidation paths",
+        {
+          event: payload.event,
+          siteId: payload.siteId,
+          invalidPathCount: normalizedPaths.invalidPaths.length
+        }
+      );
+    }
+    const normalizedTags = normalizeRevalidationTags(payload.tags);
+    if (normalizedTags.length) {
+      for (const tag of normalizedTags) {
         revalidateTag(tag, "max");
         revalidated.push(`tag:${tag}`);
       }
     }
-    const path = typeof payload.data?.path === "string" ? payload.data.path : void 0;
-    if (path) {
+    for (const path of normalizedPaths.paths) {
       revalidatePath(path);
       revalidated.push(`path:${path}`);
     }
+    const metadata = getRevalidationRequestMetadata(
+      request,
+      payload,
+      {
+        pathCount: normalizedPaths.paths.length,
+        tagCount: normalizedTags.length,
+        itemCount: revalidated.length
+      }
+    );
     if (revalidated.length > 0) {
       console.log(
-        `[Riverbank] Revalidated: ${revalidated.join(", ")} (event: ${payload.event})`
+        [
+          `[Riverbank] Revalidated ${normalizedPaths.paths.length} path(s)`,
+          `and ${normalizedTags.length} tag(s)`,
+          `(event: ${payload.event}, site: ${payload.siteId})`
+        ].join(" "),
+        metadata
       );
     }
     if (options.onRevalidate) {
-      options.onRevalidate(payload, revalidated);
+      options.onRevalidate(payload, revalidated, metadata);
     }
     return Response.json({
       revalidated: true,
       items: revalidated,
       event: payload.event,
+      dispatchId: metadata.dispatchId,
+      pathCount: normalizedPaths.paths.length,
+      tagCount: normalizedTags.length,
+      invalidPathCount: normalizedPaths.invalidPaths.length,
       timestamp: Date.now()
     });
   };
 }
 export {
-  createRevalidateHandler
+  createRevalidateHandler,
+  normalizeRevalidationPath2 as normalizeRevalidationPath,
+  normalizeRevalidationPaths,
+  normalizeRevalidationTags
 };