@riverbankcms/sdk 0.78.2 → 0.80.0

package/dist/cli/init-docs/content/workflow-editor-workflows.md

@@ -31,6 +31,8 @@ Use `contentType: "page"` for page workflows. Use a content type key, such as `b
 
 Riverbank saves the draft, disables the editor, creates a workflow run, and posts to your endpoint. Verify the raw body with the same HMAC helper used for webhooks:
 
+The `x-riverbank-signature` header is formatted as `sha256=<hex HMAC-SHA256 digest>`.
+
 ```ts
 import { verifyWebhookSignature } from "@riverbankcms/sdk/webhooks";
 

package/dist/cli/init-docs/content/workflow-isr-revalidation.md

@@ -0,0 +1,150 @@
+# Workflow: Production ISR and Revalidation
+
+## Purpose
+
+Configure a Riverbank SDK Next.js App Router site to prerender published routes, serve production pages through ISR, and refresh affected paths when the CMS sends signed publish webhooks.
+
+## Prerequisites
+
+- A Riverbank SDK site using `createCatchAllPage()` in `src/app/[[...slug]]/page.tsx`.
+- A production content API key in `RIVERBANK_API_KEY`.
+- `RIVERBANK_SITE_ID` set to this site's Riverbank site ID.
+- `NEXT_PUBLIC_DASHBOARD_URL` set to the dashboard origin, for example `https://cms.example.com`.
+- `RIVERBANK_WEBHOOK_SECRET` set from the CMS-generated Riverbank webhook secret.
+
+Preview deployments should also set `RIVERBANK_PREVIEW_MODE=true` so draft previews stay dynamic instead of serving stale ISR HTML.
+
+## Configure the Catch-All Route
+
+In `src/app/[[...slug]]/page.tsx`:
+
+```tsx
+import {
+  createCatchAllPage,
+  generateAllStaticParams,
+  getISRConfig,
+} from '@riverbankcms/sdk/next'
+
+import config from '@/riverbank.config'
+import { blockOverrides } from '@/lib/block-overrides'
+import { getRiverbankClient } from '@/lib/riverbank-client'
+
+export const revalidate = getISRConfig().revalidate
+export const dynamicParams = true
+export { generateAllStaticParams as generateStaticParams }
+
+const { Page, generateMetadata } = createCatchAllPage({
+  getClient: getRiverbankClient,
+  config,
+  blockOverrides,
+})
+
+export default Page
+export { generateMetadata }
+```
+
+`generateAllStaticParams()` discovers published pages and routable entries at build time. It reads:
+
+- `RIVERBANK_API_KEY`
+- `RIVERBANK_SITE_ID`
+- `NEXT_PUBLIC_DASHBOARD_URL`
+
+By default, route discovery falls back to the homepage if the CMS is temporarily unavailable. Use strict mode when you want production CI to fail instead:
+
+```tsx
+import { generateAllStaticParams } from '@riverbankcms/sdk/next'
+
+export function generateStaticParams() {
+  return generateAllStaticParams({ failureMode: 'throw' })
+}
+```
+
+If your site already centralizes the SDK client, use the explicit factory:
+
+```tsx
+import { createGenerateStaticParams } from '@riverbankcms/sdk/next'
+
+import config from '@/riverbank.config'
+import { getRiverbankClient } from '@/lib/riverbank-client'
+
+export const generateStaticParams = createGenerateStaticParams({
+  getClient: getRiverbankClient,
+  siteId: config.siteId,
+  failureMode: 'throw',
+})
+```
+
+## Add the Revalidation Route
+
+Create `src/app/api/revalidate/route.ts`:
+
+```ts
+import { createRevalidateHandler } from '@riverbankcms/sdk/next/revalidate'
+
+export const POST = createRevalidateHandler()
+```
+
+The deployed site must have the CMS-generated webhook secret:
+
+```bash
+RIVERBANK_WEBHOOK_SECRET=...
+```
+
+Riverbank signs each request with:
+
+```http
+X-Riverbank-Signature: sha256=<hex HMAC-SHA256 digest>
+```
+
+The digest is computed over the raw JSON body. The SDK handler rejects unsigned requests, plain hex signatures without the `sha256=` prefix, malformed digests, bad signatures, and invalid payloads. Malformed path entries are skipped and reported in the response metadata while valid tags and paths still revalidate.
+
+Riverbank includes a `dispatchId` in signed payloads and sends matching `X-Riverbank-Dispatch-Id` / `X-Riverbank-Correlation-Id` headers. To join CMS delivery logs with this site's deployment logs, use the optional callback metadata:
+
+```ts
+export const POST = createRevalidateHandler({
+  onRevalidate: (_payload, _items, metadata) => {
+    console.info('Riverbank ISR revalidated', metadata)
+  },
+})
+```
+
+## Configure the CMS Webhook Endpoint
+
+Use the SDK CLI to configure or reuse an enabled CMS webhook endpoint whose URL points at the deployed route:
+
+```bash
+riverbankcms webhooks setup \
+  --env=remote \
+  --url=https://www.example.com/api/revalidate \
+  --yes \
+  --vercel
+```
+
+The command keeps the CMS as the source of truth for the webhook secret. It creates or updates the endpoint, ensures the full SDK revalidation event list is subscribed, writes a newly generated one-time secret to `.env.local` when one is returned, and prints hosted-environment and deploy/test steps. Existing endpoint secrets are not returned or changed unless you pass `--rotate-secret`.
+
+The same destination URL can also be configured from the Riverbank dashboard:
+
+```text
+https://www.example.com/api/revalidate
+```
+
+SDK-site revalidation events include page and entry publish, unpublish, delete, and public path changes, along with navigation, theme, and site settings updates. Events send top-level `paths` and `tags`; the SDK handler normalizes and dedupes them before calling `revalidatePath()` and `revalidateTag()`.
+
+Some valid events are tags-only. Global render changes do not include explicit paths, and very large path sets degrade to tags-only delivery so webhook payloads stay bounded. Existing webhook endpoints may need their subscribed event list updated to receive the newer unpublish, delete, and path-change events.
+
+For troubleshooting, inspect the endpoint's delivery logs in Riverbank. Each delivery stores minimized payload diagnostics with `dispatchId`, `siteId`, event, `pathCount`, `tagCount`, status, response time, and a minimized failure body. Secrets, signature headers, cookies, authorization headers, and raw sensitive fields are not written to delivery logs.
+
+## Verify
+
+1. Build the site with production environment variables present.
+2. Confirm a published route is included in the static params output or appears as prerendered in the Next build summary.
+3. Visit a published page.
+4. Publish a change in the CMS.
+5. Confirm the webhook delivery succeeds.
+6. Reload the page and confirm the changed content appears without waiting for the normal ISR interval.
+
+For local SDK development inside the Riverbank monorepo, the smoke check is:
+
+```bash
+pnpm --filter @riverbankcms/sdk test:isr-catch-all-revalidate-smoke
+```

package/dist/client/{accordion-PLYNJIIM.mjs → accordion-QFZMNB7O.mjs}

@@ -1,4 +1,4 @@
-import { defineIslandPropsDecoder } from './chunk-JGXPTEI2.mjs';
+import { defineIslandPropsDecoder } from './chunk-PUOELU4O.mjs';
 import './chunk-AUJ5DBZJ.mjs';
 
 // src/rendering/islands/enhancers/accordion.ts

package/dist/client/{bookingForm-BXAP6AO7.mjs → bookingForm-NCIXFWIG.mjs}

@@ -1,14 +1,14 @@
 "use client";
-import { usePolling } from './chunk-DNRGY432.mjs';
+import { usePolling } from './chunk-VDS5YFLX.mjs';
 import { SpinnerNode } from './chunk-CE7IBGVW.mjs';
 import { useDiscountCodeUi } from './chunk-ZFHRN6W2.mjs';
-import { scrollToBlock, buildCheckoutReturnUrls, DiscountCodeDisclosure, formatPrice } from './chunk-UVQEJJTN.mjs';
+import { scrollToBlock, buildCheckoutReturnUrls, DiscountCodeDisclosure, formatPrice } from './chunk-Y37KDO7P.mjs';
 import { FieldValidationMessage, getFieldValidationControlProps } from './chunk-3DCJ45Z2.mjs';
 import './chunk-3PEDD5KJ.mjs';
 import { isSpamProtectionEnabled, getChallengeUrl, AltchaWidget } from './chunk-YLMKMCSJ.mjs';
 import { BlockApiProvider, useBlockApi, FeedbackMessage } from './chunk-UDNSI5PY.mjs';
 import { mountReactIsland } from './chunk-N7PBWBWQ.mjs';
-import { defineIslandPropsDecoder, resolveBookingSiteId, resolveDefaultBookingServiceId, getBookingRedirectStateFromLocation, deriveBookingFormViewState, logger, getBookingSuccessMessage, resolveAppointmentCheckoutVerificationState, themeButtonClassName, toSelectedCollectionOptionKind, assertNever11, prepareBookingSubmission, formatBookingSubmissionPreparationError, resolveBookingPaymentStep, BOOKING_FORM_DATA_RESERVED_KEYS, clearWorkflowFeedback, reportWorkflowError, reportWorkflowSuccess, okWith2, err2 } from './chunk-JGXPTEI2.mjs';
+import { defineIslandPropsDecoder, resolveBookingSiteId, resolveDefaultBookingServiceId, getBookingRedirectStateFromLocation, deriveBookingFormViewState, logger, getBookingSuccessMessage, resolveAppointmentCheckoutVerificationState, themeButtonClassName, toSelectedCollectionOptionKind, assertNever11, prepareBookingSubmission, formatBookingSubmissionPreparationError, resolveBookingPaymentStep, BOOKING_FORM_DATA_RESERVED_KEYS, clearWorkflowFeedback, reportWorkflowError, reportWorkflowSuccess, okWith2, err2 } from './chunk-PUOELU4O.mjs';
 import { resolveBookingTimeZoneId, DEFAULT_BOOKING_TIME_ZONE, unsafeAsFormId, unsafeAsAppointmentResourceId, unsafeAsCustomerPassId, unsafeAsAppointmentServiceId, formatLocalScheduleDate, addLocalScheduleDays, parseBookingLocalDate, resolveFlexibleBalanceInitialPaymentCents, resolveFlexibleBalanceDueAt, getBookingInstalmentDepositRefundability, unsafeAsPassId, splitAmountWithRemainderInFirst, addIntervalPreservingMonthAnchor, clampConfiguredAmount, getBookingInstalmentPlanIntervalCount, omitZeroAmountFutureRows, formatBookingInstant } from './chunk-AUJ5DBZJ.mjs';
 import React2, { useRef, useState, useMemo, useReducer, useEffect, useCallback, useLayoutEffect } from 'react';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';