@weatherboard/cms 0.0.0-stage → 0.1.0

package/dist/next.cjs

@@ -0,0 +1,2 @@
+"use strict";var R=Object.defineProperty;var j=Object.getOwnPropertyDescriptor;var z=Object.getOwnPropertyNames;var N=Object.prototype.hasOwnProperty;var F=(e,r)=>{for(var t in r)R(e,t,{get:r[t],enumerable:!0})},$=(e,r,t,n)=>{if(r&&typeof r=="object"||typeof r=="function")for(let o of z(r))!N.call(e,o)&&o!==t&&R(e,o,{get:()=>r[o],enumerable:!(n=j(r,o))||n.enumerable});return e};var U=e=>$(R({},"__esModule",{value:!0}),e);var K={};F(K,{createNextCmsReader:()=>O,createRevalidateRoute:()=>D});module.exports=U(K);var de=require("server-only");var L=/^[A-Za-z][A-Za-z0-9_]{0,63}$/,H=/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/,Z=/^[a-z0-9]{6,12}\.[a-z][a-z0-9_-]{0,63}$/;function E(e){if(!e||!Array.isArray(e.types)||e.types.length===0)throw new TypeError("CMS dependencies require document types");let r=[...e.types];for(let n of r)if(typeof n!="string"||!L.test(n))throw new TypeError("Invalid CMS document type");if(e.ids!==void 0&&!Array.isArray(e.ids))throw new TypeError("Invalid CMS document IDs");let t=e.ids===void 0?void 0:[...e.ids];for(let n of t??[])if(typeof n!="string"||!H.test(n)||/^(drafts|versions)\./.test(n))throw new TypeError("Invalid CMS document ID");if(new Set(r).size+new Set(t).size>128)throw new TypeError("Too many CMS tags");return Object.freeze({types:Object.freeze(r),...t===void 0?{}:{ids:Object.freeze(t)}})}function k(e){if(!e||typeof e.name!="string"||!/^[A-Za-z][A-Za-z0-9_.-]{0,127}$/.test(e.name)||typeof e.query!="string"||e.query.trim()===""||typeof e.resolve!="function")throw new TypeError("Invalid CMS query configuration");let r=e.params;if(!r||typeof r!="object"||Object.getPrototypeOf(r)!==Object.prototype&&Object.getPrototypeOf(r)!==null)throw new TypeError("CMS params must be plain JSON scalars");let t={};for(let n of Reflect.ownKeys(r)){let o=Object.getOwnPropertyDescriptor(r,n);if(typeof n!="string"||!o||!Object.hasOwn(o,"value")||!o.enumerable)throw new TypeError("CMS params must be plain JSON scalars");let a=o.value;if(!(a===null||typeof a=="string"||typeof a=="boolean"||typeof a=="number"&&Number.isFinite(a)))throw new TypeError("CMS params must be plain JSON scalars");Object.defineProperty(t,n,{value:a,enumerable:!0})}return Object.freeze({name:e.name,query:e.query,params:Object.freeze(t),dependencies:E(e.dependencies),resolve:e.resolve})}function b(e,r){if(typeof e!="string"||e.length>77||!Z.test(e))throw new TypeError("Invalid CMS scope");let t=E(r),n=[...[...new Set(t.types)].sort().map(o=>`cms:${e}:type:${o}`),...[...new Set(t.ids??[])].sort().map(o=>`cms:${e}:id:${o}`)];return Object.freeze(n)}function A(e){if(!e||!Object.hasOwn(e,"data")||!Array.isArray(e.fallbackFields)||![...e.fallbackFields].every(r=>typeof r=="string"&&(r==="$"||/^[A-Za-z][A-Za-z0-9_.[\]-]{0,127}$/.test(r))))throw new TypeError("Invalid CMS resolution");return{data:e.data,fallbackFields:Object.freeze([...new Set(e.fallbackFields)])}}function S(e){let r=e?.revalidateSeconds??3600;if(!Number.isSafeInteger(r)||r<3600||!e?.adapter||typeof e.adapter.read!="function"||e.onDiagnostic!==void 0&&typeof e.onDiagnostic!="function")throw new TypeError("Invalid CMS reader configuration");let t=e.adapter;b(t.scope,{types:["ScopeValidation"]});let n=o=>{try{e.onDiagnostic?e.onDiagnostic(o):console.warn(JSON.stringify(o))}catch{}};return{async read(o,a){let s,l,d;try{if(s=k(o),d=b(t.scope,s.dependencies),!a||!Object.hasOwn(a,"fallback"))throw new TypeError;l=A(s.resolve(null,a.fallback))}catch{throw new TypeError("Invalid CMS query or fallback configuration")}let m=(f,c)=>(n({event:"cms.fallback",query:s.name,reason:f,fields:["$"],...c===void 0?{}:{status:c}}),{data:l.data,source:"fallback",fallbackFields:["$"],reason:f}),i;try{i=await t.read({name:s.name,query:s.query,params:s.params},{tags:d,revalidateSeconds:r})}catch{return m("network")}if(!i.ok){let c=["configuration","network","timeout","rate-limit","upstream","plan-limit","permission","malformed"].includes(i.reason)?i.reason:"malformed",T=Number.isInteger(i.status)&&(i.status??0)>=100&&(i.status??0)<=599?i.status:void 0;return m(c,T)}if(i.value===null||i.value===void 0)return m("missing");let y;try{y=A(s.resolve(i.value,a.fallback))}catch{return m("malformed")}return y.fallbackFields.includes("$")?m("invalid-field"):y.fallbackFields.length>0?(n({event:"cms.partial-fallback",query:s.name,reason:"invalid-field",fields:y.fallbackFields}),{...y,source:"mixed",reason:"invalid-field"}):{...y,source:"cms"}}}}var O=S;var _=require("next/cache.js");var h="sanity-webhook-signature",Q=/^t=(\d+)[, ]+v1=([^, ]+)$/;var I=new TextEncoder;function V(e){return crypto.subtle.importKey("raw",I.encode(e),{name:"HMAC",hash:"SHA-256"},!1,["sign","verify"])}function B(e){if(!/^[A-Za-z0-9_-]+={0,2}$/.test(e))return null;let r=e.replace(/-/g,"+").replace(/_/g,"/");try{let t=atob(r),n=new Uint8Array(t.length);for(let o=0;o<t.length;o+=1)n[o]=t.charCodeAt(o);return n}catch{return null}}async function x(e){let{secret:r,rawBody:t,headers:n}=e,o=e.now??Date.now(),a=e.toleranceMs??3e5;if(!r||r.length===0)return{ok:!1,reason:"no-secret"};let s=n.get(h);if(!s)return{ok:!1,reason:"no-signature"};let l=Q.exec(s.trim());if(l===null)return{ok:!1,reason:"malformed-signature"};let d=Number(l[1]),m=l[2]??"";if(!Number.isSafeInteger(d))return{ok:!1,reason:"malformed-signature"};if(d<16094592e5)return{ok:!1,reason:"stale-timestamp"};if(Math.abs(o-d)>a)return{ok:!1,reason:"stale-timestamp"};let i=B(m);if(i===null)return{ok:!1,reason:"malformed-signature"};let y=await V(r);return await crypto.subtle.verify("HMAC",y,i,I.encode(`${d}.${t}`))?{ok:!0}:{ok:!1,reason:"bad-signature"}}var q=16*1024,W=1500,Y=new TextEncoder;function u(e,r,t={},n=!1){return new Response(n?null:JSON.stringify(r),{status:e,headers:{"Content-Type":"application/json","Cache-Control":"no-store",...t}})}function J(e,r){if(!r||typeof r!="object"||Array.isArray(r)||Object.keys(r).length===0)throw new TypeError("Invalid CMS invalidation mapping");let t=Object.create(null);for(let n of Reflect.ownKeys(r)){let o=Object.getOwnPropertyDescriptor(r,n);if(typeof n!="string"||!o?.enumerable||!Object.hasOwn(o,"value"))throw new TypeError("Invalid CMS invalidation mapping");let a=o.value;if(!Array.isArray(a)||!a.includes(n))throw new TypeError("Invalid CMS invalidation mapping");b(e,{types:a,ids:["validation"]}),t[n]=Object.freeze([...a])}for(let n of Object.values(t))if(n.some(o=>!Object.hasOwn(t,o)))throw new TypeError("Invalid CMS invalidation mapping");return Object.freeze(t)}function M(e){return typeof e=="string"&&e.trim()!==""&&Y.encode(e).byteLength>=32}var w=class extends Error{constructor(t){super("Invalid CMS webhook body");this.status=t}status};async function G(e){let r=e.body?.getReader();if(!r)return"";let t=new TextDecoder("utf-8",{fatal:!0,ignoreBOM:!0}),n,o=new Promise((a,s)=>{n=setTimeout(()=>s(new w(400)),W)});try{let a=0,s="";for(;;){let{done:l,value:d}=await Promise.race([r.read(),o]);if(l)return s+t.decode();if(a+=d.byteLength,a>q)throw new w(413);s+=t.decode(d,{stream:!0})}}catch(a){throw r.cancel().catch(()=>{}),a}finally{clearTimeout(n),r.releaseLock()}}function D(e){let r=e.scope,t=J(r,e.typeToTags),n=e.secretEnv??"SANITY_REVALIDATE_SECRET",o=e.previousSecretEnv??"SANITY_REVALIDATE_SECRET_PREVIOUS",a=e.env??(()=>process.env),s=e.now??Date.now,l=async d=>{if(d.method!=="POST")return u(405,{error:"Method not allowed"},{Allow:"POST"},d.method==="HEAD");let m,i;try{let p=a(),C=p[n],g=p[o];if(!M(C)||g!==void 0&&!M(g))throw new Error;m=C,i=g}catch{return u(503,{error:"COULD NOT ANSWER: revalidation configuration unavailable"})}let y=d.headers.get(h);if(!y||y.length>512||!/^t=\d+[, ]+v1=[A-Za-z0-9_-]+={0,2}$/.test(y.trim()))return u(401,{error:"Unauthorized"});let f;try{f=await G(d)}catch(p){return p instanceof w&&p.status===413?u(413,{error:"Payload too large"}):u(400,{error:"Invalid body"})}try{let p=s();if(!Number.isFinite(p))throw new Error;if(!(await Promise.all([m,...i===void 0?[]:[i]].map(g=>x({secret:g,rawBody:f,headers:d.headers,now:p})))).some(g=>g.ok))return u(401,{error:"Unauthorized"})}catch{return u(401,{error:"Unauthorized"})}let c;try{c=JSON.parse(f)}catch{return u(400,{error:"Invalid payload"})}if(!c||typeof c!="object"||Array.isArray(c)||Object.keys(c).length!==2||!Object.hasOwn(c,"_type")||!Object.hasOwn(c,"_id"))return u(400,{error:"Invalid payload"});let{_type:T,_id:v}=c;if(typeof T!="string"||!/^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(T)||typeof v!="string"||!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(v))return u(400,{error:"Invalid payload"});if(!Object.hasOwn(t,T)||/^(drafts|versions)\./.test(v))return u(400,{error:"Unsupported document"});let P=b(r,{types:t[T],ids:[v]});try{for(let p of P)(0,_.revalidateTag)(p,{expire:0})}catch{return u(500,{error:"Could not revalidate"})}return u(200,{revalidated:!0})};return Object.freeze({POST:l,GET:l,HEAD:l,PUT:l,PATCH:l,DELETE:l,OPTIONS:l})}0&&(module.exports={createNextCmsReader,createRevalidateRoute});
+//# sourceMappingURL=next.cjs.map

package/dist/next.cjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/next.ts", "../src/contracts/query.ts", "../src/runtime/reader.ts", "../src/adapters/next/reader.ts", "../src/invalidation/route.ts", "../src/portable/webhook.ts"],
+  "sourcesContent": ["import \"server-only\";\nexport { createNextCmsReader } from \"./adapters/next/reader.js\";\nexport { createRevalidateRoute } from \"./invalidation/route.js\";\nexport type {\n  TypeToTags, RevalidateRouteOptions, CmsRouteHandler, CmsRevalidateRoute,\n} from \"./invalidation/route.js\";\n", "/** A-1822 S1 owns this implementation. S0 registers the public signatures. */\nexport type CmsParams = Readonly<Record<string, string | number | boolean | null>>;\nexport type CmsDependencies = {\n  readonly types: readonly string[];\n  readonly ids?: readonly string[];\n};\nexport type CmsResolution<T> = {\n  readonly data: T;\n  readonly fallbackFields: readonly string[];\n};\nexport type CmsQuery<T> = {\n  readonly name: string;\n  readonly query: string;\n  readonly params: CmsParams;\n  readonly dependencies: CmsDependencies;\n  readonly resolve: (raw: unknown, fallback: T) => CmsResolution<T>;\n};\n\nconst TYPE = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;\nconst ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;\nconst SCOPE = /^[a-z0-9]{6,12}\\.[a-z][a-z0-9_-]{0,63}$/;\n\nfunction dependenciesCopy(dependencies: CmsDependencies): CmsDependencies {\n  if (!dependencies || !Array.isArray(dependencies.types) || dependencies.types.length === 0) {\n    throw new TypeError(\"CMS dependencies require document types\");\n  }\n  const types = [...dependencies.types];\n  for (const type of types) {\n    if (typeof type !== \"string\" || !TYPE.test(type)) throw new TypeError(\"Invalid CMS document type\");\n  }\n  if (dependencies.ids !== undefined && !Array.isArray(dependencies.ids)) throw new TypeError(\"Invalid CMS document IDs\");\n  const ids = dependencies.ids === undefined ? undefined : [...dependencies.ids];\n  for (const id of ids ?? []) {\n    if (typeof id !== \"string\" || !ID.test(id) || /^(drafts|versions)\\./.test(id)) {\n      throw new TypeError(\"Invalid CMS document ID\");\n    }\n  }\n  if (new Set(types).size + new Set(ids).size > 128) throw new TypeError(\"Too many CMS tags\");\n  return Object.freeze({ types: Object.freeze(types), ...(ids === undefined ? {} : { ids: Object.freeze(ids) }) });\n}\n\nexport function defineCmsQuery<T>(query: CmsQuery<T>): CmsQuery<T> {\n  if (!query || typeof query.name !== \"string\" || !/^[A-Za-z][A-Za-z0-9_.-]{0,127}$/.test(query.name)\n    || typeof query.query !== \"string\" || query.query.trim() === \"\" || typeof query.resolve !== \"function\") {\n    throw new TypeError(\"Invalid CMS query configuration\");\n  }\n  const params = query.params;\n  if (!params || typeof params !== \"object\" || (Object.getPrototypeOf(params) !== Object.prototype && Object.getPrototypeOf(params) !== null)) {\n    throw new TypeError(\"CMS params must be plain JSON scalars\");\n  }\n  const copied: Record<string, string | number | boolean | null> = {};\n  for (const key of Reflect.ownKeys(params)) {\n    const descriptor = Object.getOwnPropertyDescriptor(params, key);\n    if (typeof key !== \"string\" || !descriptor || !Object.hasOwn(descriptor, \"value\") || !descriptor.enumerable) {\n      throw new TypeError(\"CMS params must be plain JSON scalars\");\n    }\n    const value: unknown = descriptor.value;\n    if (!(value === null || typeof value === \"string\" || typeof value === \"boolean\" || (typeof value === \"number\" && Number.isFinite(value)))) {\n      throw new TypeError(\"CMS params must be plain JSON scalars\");\n    }\n    Object.defineProperty(copied, key, { value, enumerable: true });\n  }\n  return Object.freeze({ name: query.name, query: query.query, params: Object.freeze(copied), dependencies: dependenciesCopy(query.dependencies), resolve: query.resolve });\n}\n\nexport function cmsTags(scope: string, dependencies: CmsDependencies): readonly string[] {\n  if (typeof scope !== \"string\" || scope.length > 77 || !SCOPE.test(scope)) throw new TypeError(\"Invalid CMS scope\");\n  const copied = dependenciesCopy(dependencies);\n  const tags = [\n    ...[...new Set(copied.types)].sort().map((type) => `cms:${scope}:type:${type}`),\n    ...[...new Set(copied.ids ?? [])].sort().map((id) => `cms:${scope}:id:${id}`),\n  ];\n  return Object.freeze(tags);\n}\n", "import { cmsTags, defineCmsQuery, type CmsQuery, type CmsResolution } from \"../contracts/query.js\";\n\nexport type CmsFailure = \"configuration\" | \"network\" | \"timeout\" | \"rate-limit\"\n  | \"upstream\" | \"plan-limit\" | \"permission\" | \"malformed\";\nexport type CmsDiagnostic = {\n  readonly event: \"cms.fallback\" | \"cms.partial-fallback\" | \"cms.refused\";\n  readonly query: string;\n  readonly reason: CmsFailure | \"missing\" | \"invalid-field\";\n  readonly status?: number;\n  readonly fields: readonly string[];\n};\nexport type CmsFetch = (url: string, init: RequestInit & {\n  next?: { revalidate: number; tags: string[] };\n}) => Promise<Response>;\nexport type CmsReadPolicy = {\n  readonly tags: readonly string[];\n  readonly revalidateSeconds: number;\n};\nexport type CmsAdapterResult =\n  | { readonly ok: true; readonly value: unknown }\n  | { readonly ok: false; readonly reason: CmsFailure; readonly status?: number };\nexport type CmsAdapter = {\n  readonly scope: string;\n  read(query: Pick<CmsQuery<unknown>, \"name\" | \"query\" | \"params\">,\n    policy: CmsReadPolicy): Promise<CmsAdapterResult>;\n};\nexport type CmsReadResult<T> = {\n  readonly data: T;\n  readonly source: \"cms\" | \"mixed\" | \"fallback\";\n  readonly fallbackFields: readonly string[];\n  readonly reason?: CmsFailure | \"missing\" | \"invalid-field\";\n};\nexport type CmsReaderOptions = {\n  readonly adapter: CmsAdapter;\n  readonly revalidateSeconds?: number;\n  readonly onDiagnostic?: (event: CmsDiagnostic) => void;\n};\nexport type CmsReader = {\n  read<T>(query: CmsQuery<T>, options: { readonly fallback: T }): Promise<CmsReadResult<T>>;\n};\n\nfunction resolution<T>(value: CmsResolution<T>): CmsResolution<T> {\n  if (!value || !Object.hasOwn(value, \"data\") || !Array.isArray(value.fallbackFields)\n    || ![...value.fallbackFields].every((field: unknown) => typeof field === \"string\"\n      && (field === \"$\" || /^[A-Za-z][A-Za-z0-9_.[\\]-]{0,127}$/.test(field)))) {\n    throw new TypeError(\"Invalid CMS resolution\");\n  }\n  return { data: value.data, fallbackFields: Object.freeze([...new Set(value.fallbackFields)]) };\n}\n\n/** Forwards cache policy; persistence and rendered-output invalidation belong to the host. */\nexport function createCmsReader(options: CmsReaderOptions): CmsReader {\n  const seconds = options?.revalidateSeconds ?? 3600;\n  if (!Number.isSafeInteger(seconds) || seconds < 3600 || !options?.adapter\n    || typeof options.adapter.read !== \"function\"\n    || (options.onDiagnostic !== undefined && typeof options.onDiagnostic !== \"function\")) {\n    throw new TypeError(\"Invalid CMS reader configuration\");\n  }\n  const adapter = options.adapter;\n  // Validate the scope without assuming any particular shared content types.\n  cmsTags(adapter.scope, { types: [\"ScopeValidation\"] });\n  const notify = (event: CmsDiagnostic): void => {\n    try {\n      if (options.onDiagnostic) options.onDiagnostic(event);\n      else console.warn(JSON.stringify(event));\n    } catch { /* Reporting must not break visitor rendering. */ }\n  };\n  return {\n    async read<T>(input: CmsQuery<T>, readOptions: { readonly fallback: T }): Promise<CmsReadResult<T>> {\n      let query: CmsQuery<T>;\n      let local: CmsResolution<T>;\n      let tags: readonly string[];\n      try {\n        query = defineCmsQuery(input);\n        tags = cmsTags(adapter.scope, query.dependencies);\n        if (!readOptions || !Object.hasOwn(readOptions, \"fallback\")) throw new TypeError();\n        // Built-in resolvers validate fallback here, before any I/O.\n        local = resolution(query.resolve(null, readOptions.fallback));\n      } catch {\n        throw new TypeError(\"Invalid CMS query or fallback configuration\");\n      }\n      const fallback = (reason: CmsFailure | \"missing\" | \"invalid-field\", status?: number): CmsReadResult<T> => {\n        notify({ event: \"cms.fallback\", query: query.name, reason, fields: [\"$\"],\n          ...(status === undefined ? {} : { status }) });\n        return { data: local.data, source: \"fallback\", fallbackFields: [\"$\"], reason };\n      };\n      let result: CmsAdapterResult;\n      try {\n        result = await adapter.read({ name: query.name, query: query.query, params: query.params },\n          { tags, revalidateSeconds: seconds });\n      } catch { return fallback(\"network\"); }\n      if (!result.ok) {\n        const reasons: readonly CmsFailure[] = [\"configuration\", \"network\", \"timeout\", \"rate-limit\", \"upstream\", \"plan-limit\", \"permission\", \"malformed\"];\n        const reason = reasons.includes(result.reason) ? result.reason : \"malformed\";\n        const status = Number.isInteger(result.status) && (result.status ?? 0) >= 100 && (result.status ?? 0) <= 599 ? result.status : undefined;\n        return fallback(reason, status);\n      }\n      if (result.value === null || result.value === undefined) return fallback(\"missing\");\n      let resolved: CmsResolution<T>;\n      try { resolved = resolution(query.resolve(result.value, readOptions.fallback)); }\n      catch { return fallback(\"malformed\"); }\n      if (resolved.fallbackFields.includes(\"$\")) return fallback(\"invalid-field\");\n      if (resolved.fallbackFields.length > 0) {\n        notify({ event: \"cms.partial-fallback\", query: query.name, reason: \"invalid-field\", fields: resolved.fallbackFields });\n        return { ...resolved, source: \"mixed\", reason: \"invalid-field\" };\n      }\n      return { ...resolved, source: \"cms\" };\n    },\n  };\n}\n", "import { createCmsReader } from \"../../runtime/reader.js\";\n\n// Keep the adapter's patched global fetch and policy intact. No second cache.\nexport const createNextCmsReader = createCmsReader;\n", "import { revalidateTag } from \"next/cache.js\";\nimport { cmsTags } from \"../contracts/query.js\";\nimport { SANITY_SIGNATURE_HEADER, verifySanityWebhook } from \"../portable/webhook.js\";\n\nexport type TypeToTags = Readonly<Record<string, readonly string[]>>;\nexport type RevalidateRouteOptions = {\n  readonly scope: string;\n  readonly secretEnv?: string;\n  readonly previousSecretEnv?: string;\n  readonly typeToTags: TypeToTags;\n  readonly env?: () => Readonly<Record<string, string | undefined>>;\n  readonly now?: () => number;\n};\nexport type CmsRouteHandler = (request: Request) => Promise<Response>;\nexport type CmsRevalidateRoute = Readonly<Record<\n  \"POST\" | \"GET\" | \"HEAD\" | \"PUT\" | \"PATCH\" | \"DELETE\" | \"OPTIONS\", CmsRouteHandler\n>>;\n\nconst BODY_LIMIT = 16 * 1024;\nconst BODY_DEADLINE_MS = 1500;\nconst encoder = new TextEncoder();\n\nfunction response(status: number, value: unknown, headers: Record<string, string> = {}, head = false): Response {\n  return new Response(head ? null : JSON.stringify(value), {\n    status, headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\", ...headers },\n  });\n}\n\nfunction copyMapping(scope: string, mapping: TypeToTags): TypeToTags {\n  if (!mapping || typeof mapping !== \"object\" || Array.isArray(mapping) || Object.keys(mapping).length === 0) {\n    throw new TypeError(\"Invalid CMS invalidation mapping\");\n  }\n  const copied: Record<string, readonly string[]> = Object.create(null);\n  for (const key of Reflect.ownKeys(mapping)) {\n    const descriptor = Object.getOwnPropertyDescriptor(mapping, key);\n    if (typeof key !== \"string\" || !descriptor?.enumerable || !Object.hasOwn(descriptor, \"value\")) {\n      throw new TypeError(\"Invalid CMS invalidation mapping\");\n    }\n    const types: unknown = descriptor.value;\n    if (!Array.isArray(types) || !types.includes(key)) throw new TypeError(\"Invalid CMS invalidation mapping\");\n    // Reserve the document ID tag as well as validating every local type.\n    cmsTags(scope, { types, ids: [\"validation\"] });\n    copied[key] = Object.freeze([...types] as string[]);\n  }\n  for (const types of Object.values(copied)) {\n    if (types.some((type) => !Object.hasOwn(copied, type))) throw new TypeError(\"Invalid CMS invalidation mapping\");\n  }\n  return Object.freeze(copied);\n}\n\nfunction validSecret(value: unknown): value is string {\n  return typeof value === \"string\" && value.trim() !== \"\" && encoder.encode(value).byteLength >= 32;\n}\n\nclass BodyFailure extends Error {\n  constructor(readonly status: 400 | 413) { super(\"Invalid CMS webhook body\"); }\n}\n\nasync function rawBody(request: Request): Promise<string> {\n  const reader = request.body?.getReader();\n  if (!reader) return \"\";\n  const decoder = new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: true });\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const deadline = new Promise<never>((_resolve, reject) => {\n    timer = setTimeout(() => reject(new BodyFailure(400)), BODY_DEADLINE_MS);\n  });\n  try {\n    let bytes = 0;\n    let text = \"\";\n    while (true) {\n      const { done, value } = await Promise.race([reader.read(), deadline]);\n      if (done) return text + decoder.decode();\n      bytes += value.byteLength;\n      if (bytes > BODY_LIMIT) throw new BodyFailure(413);\n      text += decoder.decode(value, { stream: true });\n    }\n  } catch (error) {\n    // Cancellation must not extend the deadline, including a stalled source.\n    void reader.cancel().catch(() => {});\n    throw error;\n  } finally {\n    clearTimeout(timer);\n    reader.releaseLock();\n  }\n}\n\nexport function createRevalidateRoute(options: RevalidateRouteOptions): CmsRevalidateRoute {\n  const scope = options.scope;\n  const mapping = copyMapping(scope, options.typeToTags);\n  const secretEnv = options.secretEnv ?? \"SANITY_REVALIDATE_SECRET\";\n  const previousSecretEnv = options.previousSecretEnv ?? \"SANITY_REVALIDATE_SECRET_PREVIOUS\";\n  const env = options.env ?? (() => process.env);\n  const now = options.now ?? Date.now;\n\n  const handler: CmsRouteHandler = async (request) => {\n    if (request.method !== \"POST\") {\n      return response(405, { error: \"Method not allowed\" }, { Allow: \"POST\" }, request.method === \"HEAD\");\n    }\n    let active: string;\n    let previous: string | undefined;\n    try {\n      const values = env();\n      const activeValue = values[secretEnv];\n      const previousValue = values[previousSecretEnv];\n      if (!validSecret(activeValue) || (previousValue !== undefined && !validSecret(previousValue))) throw new Error();\n      active = activeValue;\n      previous = previousValue;\n    } catch {\n      return response(503, { error: \"COULD NOT ANSWER: revalidation configuration unavailable\" });\n    }\n    const signature = request.headers.get(SANITY_SIGNATURE_HEADER);\n    if (!signature || signature.length > 512 || !/^t=\\d+[, ]+v1=[A-Za-z0-9_-]+={0,2}$/.test(signature.trim())) {\n      return response(401, { error: \"Unauthorized\" });\n    }\n    let body: string;\n    try { body = await rawBody(request); }\n    catch (error) {\n      return error instanceof BodyFailure && error.status === 413\n        ? response(413, { error: \"Payload too large\" }) : response(400, { error: \"Invalid body\" });\n    }\n    try {\n      const clock = now();\n      if (!Number.isFinite(clock)) throw new Error();\n      const results = await Promise.all([active, ...(previous === undefined ? [] : [previous])].map((secret) =>\n        verifySanityWebhook({ secret, rawBody: body, headers: request.headers, now: clock })));\n      if (!results.some((result) => result.ok)) return response(401, { error: \"Unauthorized\" });\n    } catch { return response(401, { error: \"Unauthorized\" }); }\n\n    let payload: unknown;\n    try { payload = JSON.parse(body); }\n    catch { return response(400, { error: \"Invalid payload\" }); }\n    if (!payload || typeof payload !== \"object\" || Array.isArray(payload)\n      || Object.keys(payload).length !== 2 || !Object.hasOwn(payload, \"_type\") || !Object.hasOwn(payload, \"_id\")) {\n      return response(400, { error: \"Invalid payload\" });\n    }\n    const { _type: type, _id: id } = payload as { _type: unknown; _id: unknown };\n    if (typeof type !== \"string\" || !/^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(type)\n      || typeof id !== \"string\" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(id)) {\n      return response(400, { error: \"Invalid payload\" });\n    }\n    if (!Object.hasOwn(mapping, type) || /^(drafts|versions)\\./.test(id)) {\n      return response(400, { error: \"Unsupported document\" });\n    }\n    const tags = cmsTags(scope, { types: mapping[type]!, ids: [id] });\n    try {\n      for (const tag of tags) revalidateTag(tag, { expire: 0 });\n    } catch { return response(500, { error: \"Could not revalidate\" }); }\n    return response(200, { revalidated: true });\n  };\n  return Object.freeze({ POST: handler, GET: handler, HEAD: handler, PUT: handler, PATCH: handler, DELETE: handler, OPTIONS: handler });\n}\n", "/**\n * Verifying a Sanity webhook (A-590 step 1, A-592's `SANITY_WEBHOOK_SECRET`).\n *\n * -------------------------------------------------------------------------\n * WHY THIS ENDPOINT NEEDS A SIGNATURE AT ALL\n * -------------------------------------------------------------------------\n *\n * `/revalidate` throws away cache entries. A-590: \"An unauthenticated\n * revalidation endpoint is a free cache-purge and rebuild trigger for anyone\n * who finds the URL.\" On a plan whose API request allowance is a HARD cap that\n * returns 402 rather than a bill, an attacker who can empty the cache at will\n * can take a client's site content-offline for the rest of the month. So the\n * signature is not hygiene here; it is the availability control.\n *\n * -------------------------------------------------------------------------\n * THE WIRE FORMAT IS MEASURED, NOT REMEMBERED\n * -------------------------------------------------------------------------\n *\n * Read on 2026-09-16 from Sanity's own toolkit,\n * `https://raw.githubusercontent.com/sanity-io/webhook-toolkit/main/src/signature.ts`:\n *\n *   header            `sanity-webhook-signature`\n *   value             `t=<millis>,v1=<signature>`  (regex `/^t=(\\d+)[, ]+v1=([^, ]+)$/`)\n *   signed payload    `` `${timestamp}.${body}` ``\n *   algorithm         HMAC-SHA256\n *   digest encoding   base64url \u2014 standard base64 with `+`\u2192`-`, `/`\u2192`_`, padding stripped\n *   MINIMUM_TIMESTAMP 1609459200000 (2021-01-01Z), below which a value is nonsense\n *\n * `signature.test.ts` does not take that paragraph's word for it either: it\n * signs a payload with `@sanity/webhook`'s own `encodeSignatureHeader` and\n * asserts this verifier accepts it. If Sanity changes the format, that test\n * goes red rather than production quietly rejecting every webhook.\n *\n * -------------------------------------------------------------------------\n * WHAT THIS ADDS TO THE TOOLKIT, AND WHY IT IS NOT JUST IMPORTED\n * -------------------------------------------------------------------------\n *\n * Two things, both of which are `CLAUDE.md`'s \"take the safer construction\".\n *\n * First, a REPLAY WINDOW. The toolkit enforces only that the timestamp is after\n * 2021; a captured webhook is otherwise replayable forever. A replayed purge is\n * the attack in the first paragraph, executed with a request somebody was\n * legitimately sent. `verifySanityWebhook` takes a symmetric tolerance \u2014 the\n * window is symmetric for A-44's reason, since a far-future timestamp is\n * precisely how you mint a request that stays replayable for a year.\n *\n * Second, a MISSING SECRET IS A REJECTION, never a bypass. A-590 says it in as\n * many words: \"reject on absence rather than skipping the check when the secret\n * is unset.\" The degraded mode of \"no secret configured, so allow it\" is\n * produced by a deploy that forgot `wrangler secret put`, announces itself\n * nowhere, and grants strangers the purge endpoint.\n *\n * The comparison is `crypto.subtle.verify`, which compares raw digests in\n * constant time. A `===` on the base64 strings short-circuits at the first\n * differing character, which turns one 2^256 search into a few dozen sequential\n * 64-way ones against an endpoint that answers in milliseconds.\n *\n * -------------------------------------------------------------------------\n * `encodeSignatureHeader` IS ASYNC. AWAIT IT. (A-651)\n * -------------------------------------------------------------------------\n *\n * `@sanity/webhook@4.0.4` declares\n *\n *   encodeSignatureHeader(payload: string, timestamp: number, secret: string):\n *     Promise<string>\n *\n * and nothing forces you to await it. Drop the `await` and the Promise is\n * stringified into the header as the literal `[object Promise]`, which arrives\n * here, fails `SIGNATURE_VALUE`, and is rejected as `malformed-signature`. The\n * rejection is correct and the message is about the wire format, so it sends\n * you to read Sanity's header spec \u2014 the one place the bug is not. TypeScript\n * does not save you either: the value usually lands in a `Record<string,\n * string>` built by a helper, or inside a template literal, both of which take\n * a Promise without complaint.\n *\n * The rule: every call to `encodeSignatureHeader` is awaited, and the helper\n * that wraps it is `async` rather than returning the Promise for someone else\n * to forget. The content-client compatibility tests and CMS signer tests await every\n * encoder call; this note exists so the next one\n * is too, because the symptom will not tell you.\n */\n\n/** Sanity's header. Lower-cased; `Headers.get` is case-insensitive either way. */\nexport const SANITY_SIGNATURE_HEADER = \"sanity-webhook-signature\";\n\n/** Sanity's own parser, character for character. See the header. */\nconst SIGNATURE_VALUE = /^t=(\\d+)[, ]+v1=([^, ]+)$/;\n\n/** 2021-01-01T00:00:00.000Z. Sanity's `MINIMUM_TIMESTAMP`; anything earlier is not a timestamp. */\nexport const MINIMUM_TIMESTAMP = 1_609_459_200_000;\n\n/**\n * How far from `now` a webhook timestamp may be, in milliseconds.\n *\n * Five minutes rather than A-44's sixty seconds: this one crosses Sanity's\n * delivery queue rather than two NTP-synced clouds, and a retried delivery is a\n * normal event. It is still a window rather than \"forever\", which is the whole\n * difference from the toolkit.\n */\nexport const DEFAULT_TOLERANCE_MS = 300_000;\n\nexport type WebhookRejection =\n  /** `SANITY_WEBHOOK_SECRET` is unset or empty. Fail closed. */\n  | \"no-secret\"\n  /** No `sanity-webhook-signature` header. */\n  | \"no-signature\"\n  /** Header present but not `t=\u2026,v1=\u2026`, or `v1` is not decodable base64url. */\n  | \"malformed-signature\"\n  /** Before 2021, or outside the tolerance in either direction. */\n  | \"stale-timestamp\"\n  /** Well-formed, in window, wrong. */\n  | \"bad-signature\";\n\nexport type WebhookVerification = { ok: true } | { ok: false; reason: WebhookRejection };\n\nconst encoder = new TextEncoder();\n\nfunction hmacKey(secret: string): Promise<CryptoKey> {\n  return crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\", \"verify\"],\n  );\n}\n\n/**\n * base64url \u2192 bytes, without `Buffer`.\n *\n * `atob` rather than `node:crypto` or `Buffer` because this file is imported by\n * the Worker, and workerd has neither by default. Returns null rather than\n * throwing on rubbish, so a malformed header is a 401 and not a 500 \u2014 a\n * verifier that crashes on bad input is a verifier an attacker can use as a\n * denial of service.\n */\nfunction base64UrlToBytes(value: string): Uint8Array<ArrayBuffer> | null {\n  if (!/^[A-Za-z0-9_-]+={0,2}$/.test(value)) return null;\n  const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  try {\n    const binary = atob(padded);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);\n    return bytes;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Verify a Sanity webhook delivery.\n *\n * `rawBody` must be the bytes as received \u2014 `await request.text()`, never\n * `JSON.stringify(await request.json())`. A parse-and-restringify is not a\n * byte-for-byte round trip (key order, number formatting, whitespace) and one\n * byte changes the whole digest, so the symptom is every webhook failing after\n * a refactor that looked like tidying.\n *\n * The `reason` is for our logs and our tests. It is never returned to the\n * caller: \"your signature was fine but your clock is stale\" is the next step in\n * an attack, handed over free.\n */\nexport async function verifySanityWebhook(options: {\n  secret: string | undefined;\n  rawBody: string;\n  headers: { get(name: string): string | null };\n  now?: number;\n  toleranceMs?: number;\n}): Promise<WebhookVerification> {\n  const { secret, rawBody, headers } = options;\n  const now = options.now ?? Date.now();\n  const toleranceMs = options.toleranceMs ?? DEFAULT_TOLERANCE_MS;\n\n  if (!secret || secret.length === 0) return { ok: false, reason: \"no-secret\" };\n\n  const header = headers.get(SANITY_SIGNATURE_HEADER);\n  if (!header) return { ok: false, reason: \"no-signature\" };\n\n  const match = SIGNATURE_VALUE.exec(header.trim());\n  if (match === null) return { ok: false, reason: \"malformed-signature\" };\n\n  const timestamp = Number(match[1]);\n  const provided = match[2] ?? \"\";\n  if (!Number.isSafeInteger(timestamp)) return { ok: false, reason: \"malformed-signature\" };\n  if (timestamp < MINIMUM_TIMESTAMP) return { ok: false, reason: \"stale-timestamp\" };\n  if (Math.abs(now - timestamp) > toleranceMs) return { ok: false, reason: \"stale-timestamp\" };\n\n  const signature = base64UrlToBytes(provided);\n  if (signature === null) return { ok: false, reason: \"malformed-signature\" };\n\n  const key = await hmacKey(secret);\n  const valid = await crypto.subtle.verify(\n    \"HMAC\",\n    key,\n    signature,\n    encoder.encode(`${timestamp}.${rawBody}`),\n  );\n  return valid ? { ok: true } : { ok: false, reason: \"bad-signature\" };\n}\n"],
+  "mappings": "yaAAA,IAAAA,EAAA,GAAAC,EAAAD,EAAA,yBAAAE,EAAA,0BAAAC,IAAA,eAAAC,EAAAJ,GAAA,IAAAK,GAAO,uBCkBP,IAAMC,EAAO,+BACPC,EAAK,qCACLC,EAAQ,0CAEd,SAASC,EAAiBC,EAAgD,CACxE,GAAI,CAACA,GAAgB,CAAC,MAAM,QAAQA,EAAa,KAAK,GAAKA,EAAa,MAAM,SAAW,EACvF,MAAM,IAAI,UAAU,yCAAyC,EAE/D,IAAMC,EAAQ,CAAC,GAAGD,EAAa,KAAK,EACpC,QAAWE,KAAQD,EACjB,GAAI,OAAOC,GAAS,UAAY,CAACN,EAAK,KAAKM,CAAI,EAAG,MAAM,IAAI,UAAU,2BAA2B,EAEnG,GAAIF,EAAa,MAAQ,QAAa,CAAC,MAAM,QAAQA,EAAa,GAAG,EAAG,MAAM,IAAI,UAAU,0BAA0B,EACtH,IAAMG,EAAMH,EAAa,MAAQ,OAAY,OAAY,CAAC,GAAGA,EAAa,GAAG,EAC7E,QAAWI,KAAMD,GAAO,CAAC,EACvB,GAAI,OAAOC,GAAO,UAAY,CAACP,EAAG,KAAKO,CAAE,GAAK,uBAAuB,KAAKA,CAAE,EAC1E,MAAM,IAAI,UAAU,yBAAyB,EAGjD,GAAI,IAAI,IAAIH,CAAK,EAAE,KAAO,IAAI,IAAIE,CAAG,EAAE,KAAO,IAAK,MAAM,IAAI,UAAU,mBAAmB,EAC1F,OAAO,OAAO,OAAO,CAAE,MAAO,OAAO,OAAOF,CAAK,EAAG,GAAIE,IAAQ,OAAY,CAAC,EAAI,CAAE,IAAK,OAAO,OAAOA,CAAG,CAAE,CAAG,CAAC,CACjH,CAEO,SAASE,EAAkBC,EAAiC,CACjE,GAAI,CAACA,GAAS,OAAOA,EAAM,MAAS,UAAY,CAAC,kCAAkC,KAAKA,EAAM,IAAI,GAC7F,OAAOA,EAAM,OAAU,UAAYA,EAAM,MAAM,KAAK,IAAM,IAAM,OAAOA,EAAM,SAAY,WAC5F,MAAM,IAAI,UAAU,iCAAiC,EAEvD,IAAMC,EAASD,EAAM,OACrB,GAAI,CAACC,GAAU,OAAOA,GAAW,UAAa,OAAO,eAAeA,CAAM,IAAM,OAAO,WAAa,OAAO,eAAeA,CAAM,IAAM,KACpI,MAAM,IAAI,UAAU,uCAAuC,EAE7D,IAAMC,EAA2D,CAAC,EAClE,QAAWC,KAAO,QAAQ,QAAQF,CAAM,EAAG,CACzC,IAAMG,EAAa,OAAO,yBAAyBH,EAAQE,CAAG,EAC9D,GAAI,OAAOA,GAAQ,UAAY,CAACC,GAAc,CAAC,OAAO,OAAOA,EAAY,OAAO,GAAK,CAACA,EAAW,WAC/F,MAAM,IAAI,UAAU,uCAAuC,EAE7D,IAAMC,EAAiBD,EAAW,MAClC,GAAI,EAAEC,IAAU,MAAQ,OAAOA,GAAU,UAAY,OAAOA,GAAU,WAAc,OAAOA,GAAU,UAAY,OAAO,SAASA,CAAK,GACpI,MAAM,IAAI,UAAU,uCAAuC,EAE7D,OAAO,eAAeH,EAAQC,EAAK,CAAE,MAAAE,EAAO,WAAY,EAAK,CAAC,CAChE,CACA,OAAO,OAAO,OAAO,CAAE,KAAML,EAAM,KAAM,MAAOA,EAAM,MAAO,OAAQ,OAAO,OAAOE,CAAM,EAAG,aAAcT,EAAiBO,EAAM,YAAY,EAAG,QAASA,EAAM,OAAQ,CAAC,CAC1K,CAEO,SAASM,EAAQC,EAAeb,EAAkD,CACvF,GAAI,OAAOa,GAAU,UAAYA,EAAM,OAAS,IAAM,CAACf,EAAM,KAAKe,CAAK,EAAG,MAAM,IAAI,UAAU,mBAAmB,EACjH,IAAML,EAAST,EAAiBC,CAAY,EACtCc,EAAO,CACX,GAAG,CAAC,GAAG,IAAI,IAAIN,EAAO,KAAK,CAAC,EAAE,KAAK,EAAE,IAAKN,GAAS,OAAOW,CAAK,SAASX,CAAI,EAAE,EAC9E,GAAG,CAAC,GAAG,IAAI,IAAIM,EAAO,KAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAKJ,GAAO,OAAOS,CAAK,OAAOT,CAAE,EAAE,CAC9E,EACA,OAAO,OAAO,OAAOU,CAAI,CAC3B,CChCA,SAASC,EAAcC,EAA2C,CAChE,GAAI,CAACA,GAAS,CAAC,OAAO,OAAOA,EAAO,MAAM,GAAK,CAAC,MAAM,QAAQA,EAAM,cAAc,GAC7E,CAAC,CAAC,GAAGA,EAAM,cAAc,EAAE,MAAOC,GAAmB,OAAOA,GAAU,WACnEA,IAAU,KAAO,qCAAqC,KAAKA,CAAK,EAAE,EACxE,MAAM,IAAI,UAAU,wBAAwB,EAE9C,MAAO,CAAE,KAAMD,EAAM,KAAM,eAAgB,OAAO,OAAO,CAAC,GAAG,IAAI,IAAIA,EAAM,cAAc,CAAC,CAAC,CAAE,CAC/F,CAGO,SAASE,EAAgBC,EAAsC,CACpE,IAAMC,EAAUD,GAAS,mBAAqB,KAC9C,GAAI,CAAC,OAAO,cAAcC,CAAO,GAAKA,EAAU,MAAQ,CAACD,GAAS,SAC7D,OAAOA,EAAQ,QAAQ,MAAS,YAC/BA,EAAQ,eAAiB,QAAa,OAAOA,EAAQ,cAAiB,WAC1E,MAAM,IAAI,UAAU,kCAAkC,EAExD,IAAME,EAAUF,EAAQ,QAExBG,EAAQD,EAAQ,MAAO,CAAE,MAAO,CAAC,iBAAiB,CAAE,CAAC,EACrD,IAAME,EAAUC,GAA+B,CAC7C,GAAI,CACEL,EAAQ,aAAcA,EAAQ,aAAaK,CAAK,EAC/C,QAAQ,KAAK,KAAK,UAAUA,CAAK,CAAC,CACzC,MAAQ,CAAoD,CAC9D,EACA,MAAO,CACL,MAAM,KAAQC,EAAoBC,EAAkE,CAClG,IAAIC,EACAC,EACAC,EACJ,GAAI,CAGF,GAFAF,EAAQG,EAAeL,CAAK,EAC5BI,EAAOP,EAAQD,EAAQ,MAAOM,EAAM,YAAY,EAC5C,CAACD,GAAe,CAAC,OAAO,OAAOA,EAAa,UAAU,EAAG,MAAM,IAAI,UAEvEE,EAAQb,EAAWY,EAAM,QAAQ,KAAMD,EAAY,QAAQ,CAAC,CAC9D,MAAQ,CACN,MAAM,IAAI,UAAU,6CAA6C,CACnE,CACA,IAAMK,EAAW,CAACC,EAAkDC,KAClEV,EAAO,CAAE,MAAO,eAAgB,MAAOI,EAAM,KAAM,OAAAK,EAAQ,OAAQ,CAAC,GAAG,EACrE,GAAIC,IAAW,OAAY,CAAC,EAAI,CAAE,OAAAA,CAAO,CAAG,CAAC,EACxC,CAAE,KAAML,EAAM,KAAM,OAAQ,WAAY,eAAgB,CAAC,GAAG,EAAG,OAAAI,CAAO,GAE3EE,EACJ,GAAI,CACFA,EAAS,MAAMb,EAAQ,KAAK,CAAE,KAAMM,EAAM,KAAM,MAAOA,EAAM,MAAO,OAAQA,EAAM,MAAO,EACvF,CAAE,KAAAE,EAAM,kBAAmBT,CAAQ,CAAC,CACxC,MAAQ,CAAE,OAAOW,EAAS,SAAS,CAAG,CACtC,GAAI,CAACG,EAAO,GAAI,CAEd,IAAMF,EADiC,CAAC,gBAAiB,UAAW,UAAW,aAAc,WAAY,aAAc,aAAc,WAAW,EACzH,SAASE,EAAO,MAAM,EAAIA,EAAO,OAAS,YAC3DD,EAAS,OAAO,UAAUC,EAAO,MAAM,IAAMA,EAAO,QAAU,IAAM,MAAQA,EAAO,QAAU,IAAM,IAAMA,EAAO,OAAS,OAC/H,OAAOH,EAASC,EAAQC,CAAM,CAChC,CACA,GAAIC,EAAO,QAAU,MAAQA,EAAO,QAAU,OAAW,OAAOH,EAAS,SAAS,EAClF,IAAII,EACJ,GAAI,CAAEA,EAAWpB,EAAWY,EAAM,QAAQO,EAAO,MAAOR,EAAY,QAAQ,CAAC,CAAG,MAC1E,CAAE,OAAOK,EAAS,WAAW,CAAG,CACtC,OAAII,EAAS,eAAe,SAAS,GAAG,EAAUJ,EAAS,eAAe,EACtEI,EAAS,eAAe,OAAS,GACnCZ,EAAO,CAAE,MAAO,uBAAwB,MAAOI,EAAM,KAAM,OAAQ,gBAAiB,OAAQQ,EAAS,cAAe,CAAC,EAC9G,CAAE,GAAGA,EAAU,OAAQ,QAAS,OAAQ,eAAgB,GAE1D,CAAE,GAAGA,EAAU,OAAQ,KAAM,CACtC,CACF,CACF,CC1GO,IAAMC,EAAsBC,ECHnC,IAAAC,EAA8B,yBCmFvB,IAAMC,EAA0B,2BAGjCC,EAAkB,4BA6BxB,IAAMC,EAAU,IAAI,YAEpB,SAASC,EAAQC,EAAoC,CACnD,OAAO,OAAO,OAAO,UACnB,MACAF,EAAQ,OAAOE,CAAM,EACrB,CAAE,KAAM,OAAQ,KAAM,SAAU,EAChC,GACA,CAAC,OAAQ,QAAQ,CACnB,CACF,CAWA,SAASC,EAAiBC,EAA+C,CACvE,GAAI,CAAC,yBAAyB,KAAKA,CAAK,EAAG,OAAO,KAClD,IAAMC,EAASD,EAAM,QAAQ,KAAM,GAAG,EAAE,QAAQ,KAAM,GAAG,EACzD,GAAI,CACF,IAAME,EAAS,KAAKD,CAAM,EACpBE,EAAQ,IAAI,WAAWD,EAAO,MAAM,EAC1C,QAASE,EAAI,EAAGA,EAAIF,EAAO,OAAQE,GAAK,EAAGD,EAAMC,CAAC,EAAIF,EAAO,WAAWE,CAAC,EACzE,OAAOD,CACT,MAAQ,CACN,OAAO,IACT,CACF,CAeA,eAAsBE,EAAoBC,EAMT,CAC/B,GAAM,CAAE,OAAAR,EAAQ,QAAAS,EAAS,QAAAC,CAAQ,EAAIF,EAC/BG,EAAMH,EAAQ,KAAO,KAAK,IAAI,EAC9BI,EAAcJ,EAAQ,aAAe,IAE3C,GAAI,CAACR,GAAUA,EAAO,SAAW,EAAG,MAAO,CAAE,GAAI,GAAO,OAAQ,WAAY,EAE5E,IAAMa,EAASH,EAAQ,IAAII,CAAuB,EAClD,GAAI,CAACD,EAAQ,MAAO,CAAE,GAAI,GAAO,OAAQ,cAAe,EAExD,IAAME,EAAQC,EAAgB,KAAKH,EAAO,KAAK,CAAC,EAChD,GAAIE,IAAU,KAAM,MAAO,CAAE,GAAI,GAAO,OAAQ,qBAAsB,EAEtE,IAAME,EAAY,OAAOF,EAAM,CAAC,CAAC,EAC3BG,EAAWH,EAAM,CAAC,GAAK,GAC7B,GAAI,CAAC,OAAO,cAAcE,CAAS,EAAG,MAAO,CAAE,GAAI,GAAO,OAAQ,qBAAsB,EACxF,GAAIA,EAAY,WAAmB,MAAO,CAAE,GAAI,GAAO,OAAQ,iBAAkB,EACjF,GAAI,KAAK,IAAIN,EAAMM,CAAS,EAAIL,EAAa,MAAO,CAAE,GAAI,GAAO,OAAQ,iBAAkB,EAE3F,IAAMO,EAAYlB,EAAiBiB,CAAQ,EAC3C,GAAIC,IAAc,KAAM,MAAO,CAAE,GAAI,GAAO,OAAQ,qBAAsB,EAE1E,IAAMC,EAAM,MAAMrB,EAAQC,CAAM,EAOhC,OANc,MAAM,OAAO,OAAO,OAChC,OACAoB,EACAD,EACArB,EAAQ,OAAO,GAAGmB,CAAS,IAAIR,CAAO,EAAE,CAC1C,EACe,CAAE,GAAI,EAAK,EAAI,CAAE,GAAI,GAAO,OAAQ,eAAgB,CACrE,CDpLA,IAAMY,EAAa,GAAK,KAClBC,EAAmB,KACnBC,EAAU,IAAI,YAEpB,SAASC,EAASC,EAAgBC,EAAgBC,EAAkC,CAAC,EAAGC,EAAO,GAAiB,CAC9G,OAAO,IAAI,SAASA,EAAO,KAAO,KAAK,UAAUF,CAAK,EAAG,CACvD,OAAAD,EAAQ,QAAS,CAAE,eAAgB,mBAAoB,gBAAiB,WAAY,GAAGE,CAAQ,CACjG,CAAC,CACH,CAEA,SAASE,EAAYC,EAAeC,EAAiC,CACnE,GAAI,CAACA,GAAW,OAAOA,GAAY,UAAY,MAAM,QAAQA,CAAO,GAAK,OAAO,KAAKA,CAAO,EAAE,SAAW,EACvG,MAAM,IAAI,UAAU,kCAAkC,EAExD,IAAMC,EAA4C,OAAO,OAAO,IAAI,EACpE,QAAWC,KAAO,QAAQ,QAAQF,CAAO,EAAG,CAC1C,IAAMG,EAAa,OAAO,yBAAyBH,EAASE,CAAG,EAC/D,GAAI,OAAOA,GAAQ,UAAY,CAACC,GAAY,YAAc,CAAC,OAAO,OAAOA,EAAY,OAAO,EAC1F,MAAM,IAAI,UAAU,kCAAkC,EAExD,IAAMC,EAAiBD,EAAW,MAClC,GAAI,CAAC,MAAM,QAAQC,CAAK,GAAK,CAACA,EAAM,SAASF,CAAG,EAAG,MAAM,IAAI,UAAU,kCAAkC,EAEzGG,EAAQN,EAAO,CAAE,MAAAK,EAAO,IAAK,CAAC,YAAY,CAAE,CAAC,EAC7CH,EAAOC,CAAG,EAAI,OAAO,OAAO,CAAC,GAAGE,CAAK,CAAa,CACpD,CACA,QAAWA,KAAS,OAAO,OAAOH,CAAM,EACtC,GAAIG,EAAM,KAAME,GAAS,CAAC,OAAO,OAAOL,EAAQK,CAAI,CAAC,EAAG,MAAM,IAAI,UAAU,kCAAkC,EAEhH,OAAO,OAAO,OAAOL,CAAM,CAC7B,CAEA,SAASM,EAAYZ,EAAiC,CACpD,OAAO,OAAOA,GAAU,UAAYA,EAAM,KAAK,IAAM,IAAMH,EAAQ,OAAOG,CAAK,EAAE,YAAc,EACjG,CAEA,IAAMa,EAAN,cAA0B,KAAM,CAC9B,YAAqBd,EAAmB,CAAE,MAAM,0BAA0B,EAArD,YAAAA,CAAwD,CAAxD,MACvB,EAEA,eAAee,EAAQC,EAAmC,CACxD,IAAMC,EAASD,EAAQ,MAAM,UAAU,EACvC,GAAI,CAACC,EAAQ,MAAO,GACpB,IAAMC,EAAU,IAAI,YAAY,QAAS,CAAE,MAAO,GAAM,UAAW,EAAK,CAAC,EACrEC,EACEC,EAAW,IAAI,QAAe,CAACC,EAAUC,IAAW,CACxDH,EAAQ,WAAW,IAAMG,EAAO,IAAIR,EAAY,GAAG,CAAC,EAAGjB,CAAgB,CACzE,CAAC,EACD,GAAI,CACF,IAAI0B,EAAQ,EACRC,EAAO,GACX,OAAa,CACX,GAAM,CAAE,KAAAC,EAAM,MAAAxB,CAAM,EAAI,MAAM,QAAQ,KAAK,CAACgB,EAAO,KAAK,EAAGG,CAAQ,CAAC,EACpE,GAAIK,EAAM,OAAOD,EAAON,EAAQ,OAAO,EAEvC,GADAK,GAAStB,EAAM,WACXsB,EAAQ3B,EAAY,MAAM,IAAIkB,EAAY,GAAG,EACjDU,GAAQN,EAAQ,OAAOjB,EAAO,CAAE,OAAQ,EAAK,CAAC,CAChD,CACF,OAASyB,EAAO,CAEd,MAAKT,EAAO,OAAO,EAAE,MAAM,IAAM,CAAC,CAAC,EAC7BS,CACR,QAAE,CACA,aAAaP,CAAK,EAClBF,EAAO,YAAY,CACrB,CACF,CAEO,SAASU,EAAsBC,EAAqD,CACzF,IAAMvB,EAAQuB,EAAQ,MAChBtB,EAAUF,EAAYC,EAAOuB,EAAQ,UAAU,EAC/CC,EAAYD,EAAQ,WAAa,2BACjCE,EAAoBF,EAAQ,mBAAqB,oCACjDG,EAAMH,EAAQ,MAAQ,IAAM,QAAQ,KACpCI,EAAMJ,EAAQ,KAAO,KAAK,IAE1BK,EAA2B,MAAOjB,GAAY,CAClD,GAAIA,EAAQ,SAAW,OACrB,OAAOjB,EAAS,IAAK,CAAE,MAAO,oBAAqB,EAAG,CAAE,MAAO,MAAO,EAAGiB,EAAQ,SAAW,MAAM,EAEpG,IAAIkB,EACAC,EACJ,GAAI,CACF,IAAMC,EAASL,EAAI,EACbM,EAAcD,EAAOP,CAAS,EAC9BS,EAAgBF,EAAON,CAAiB,EAC9C,GAAI,CAACjB,EAAYwB,CAAW,GAAMC,IAAkB,QAAa,CAACzB,EAAYyB,CAAa,EAAI,MAAM,IAAI,MACzGJ,EAASG,EACTF,EAAWG,CACb,MAAQ,CACN,OAAOvC,EAAS,IAAK,CAAE,MAAO,0DAA2D,CAAC,CAC5F,CACA,IAAMwC,EAAYvB,EAAQ,QAAQ,IAAIwB,CAAuB,EAC7D,GAAI,CAACD,GAAaA,EAAU,OAAS,KAAO,CAAC,sCAAsC,KAAKA,EAAU,KAAK,CAAC,EACtG,OAAOxC,EAAS,IAAK,CAAE,MAAO,cAAe,CAAC,EAEhD,IAAI0C,EACJ,GAAI,CAAEA,EAAO,MAAM1B,EAAQC,CAAO,CAAG,OAC9BU,EAAO,CACZ,OAAOA,aAAiBZ,GAAeY,EAAM,SAAW,IACpD3B,EAAS,IAAK,CAAE,MAAO,mBAAoB,CAAC,EAAIA,EAAS,IAAK,CAAE,MAAO,cAAe,CAAC,CAC7F,CACA,GAAI,CACF,IAAM2C,EAAQV,EAAI,EAClB,GAAI,CAAC,OAAO,SAASU,CAAK,EAAG,MAAM,IAAI,MAGvC,GAAI,EAFY,MAAM,QAAQ,IAAI,CAACR,EAAQ,GAAIC,IAAa,OAAY,CAAC,EAAI,CAACA,CAAQ,CAAE,EAAE,IAAKQ,GAC7FC,EAAoB,CAAE,OAAAD,EAAQ,QAASF,EAAM,QAASzB,EAAQ,QAAS,IAAK0B,CAAM,CAAC,CAAC,CAAC,GAC1E,KAAMG,GAAWA,EAAO,EAAE,EAAG,OAAO9C,EAAS,IAAK,CAAE,MAAO,cAAe,CAAC,CAC1F,MAAQ,CAAE,OAAOA,EAAS,IAAK,CAAE,MAAO,cAAe,CAAC,CAAG,CAE3D,IAAI+C,EACJ,GAAI,CAAEA,EAAU,KAAK,MAAML,CAAI,CAAG,MAC5B,CAAE,OAAO1C,EAAS,IAAK,CAAE,MAAO,iBAAkB,CAAC,CAAG,CAC5D,GAAI,CAAC+C,GAAW,OAAOA,GAAY,UAAY,MAAM,QAAQA,CAAO,GAC/D,OAAO,KAAKA,CAAO,EAAE,SAAW,GAAK,CAAC,OAAO,OAAOA,EAAS,OAAO,GAAK,CAAC,OAAO,OAAOA,EAAS,KAAK,EACzG,OAAO/C,EAAS,IAAK,CAAE,MAAO,iBAAkB,CAAC,EAEnD,GAAM,CAAE,MAAOa,EAAM,IAAKmC,CAAG,EAAID,EACjC,GAAI,OAAOlC,GAAS,UAAY,CAAC,+BAA+B,KAAKA,CAAI,GACpE,OAAOmC,GAAO,UAAY,CAAC,qCAAqC,KAAKA,CAAE,EAC1E,OAAOhD,EAAS,IAAK,CAAE,MAAO,iBAAkB,CAAC,EAEnD,GAAI,CAAC,OAAO,OAAOO,EAASM,CAAI,GAAK,uBAAuB,KAAKmC,CAAE,EACjE,OAAOhD,EAAS,IAAK,CAAE,MAAO,sBAAuB,CAAC,EAExD,IAAMiD,EAAOrC,EAAQN,EAAO,CAAE,MAAOC,EAAQM,CAAI,EAAI,IAAK,CAACmC,CAAE,CAAE,CAAC,EAChE,GAAI,CACF,QAAWE,KAAOD,KAAM,iBAAcC,EAAK,CAAE,OAAQ,CAAE,CAAC,CAC1D,MAAQ,CAAE,OAAOlD,EAAS,IAAK,CAAE,MAAO,sBAAuB,CAAC,CAAG,CACnE,OAAOA,EAAS,IAAK,CAAE,YAAa,EAAK,CAAC,CAC5C,EACA,OAAO,OAAO,OAAO,CAAE,KAAMkC,EAAS,IAAKA,EAAS,KAAMA,EAAS,IAAKA,EAAS,MAAOA,EAAS,OAAQA,EAAS,QAASA,CAAQ,CAAC,CACtI",
+  "names": ["next_exports", "__export", "createNextCmsReader", "createRevalidateRoute", "__toCommonJS", "import_server_only", "TYPE", "ID", "SCOPE", "dependenciesCopy", "dependencies", "types", "type", "ids", "id", "defineCmsQuery", "query", "params", "copied", "key", "descriptor", "value", "cmsTags", "scope", "tags", "resolution", "value", "field", "createCmsReader", "options", "seconds", "adapter", "cmsTags", "notify", "event", "input", "readOptions", "query", "local", "tags", "defineCmsQuery", "fallback", "reason", "status", "result", "resolved", "createNextCmsReader", "createCmsReader", "import_cache", "SANITY_SIGNATURE_HEADER", "SIGNATURE_VALUE", "encoder", "hmacKey", "secret", "base64UrlToBytes", "value", "padded", "binary", "bytes", "i", "verifySanityWebhook", "options", "rawBody", "headers", "now", "toleranceMs", "header", "SANITY_SIGNATURE_HEADER", "match", "SIGNATURE_VALUE", "timestamp", "provided", "signature", "key", "BODY_LIMIT", "BODY_DEADLINE_MS", "encoder", "response", "status", "value", "headers", "head", "copyMapping", "scope", "mapping", "copied", "key", "descriptor", "types", "cmsTags", "type", "validSecret", "BodyFailure", "rawBody", "request", "reader", "decoder", "timer", "deadline", "_resolve", "reject", "bytes", "text", "done", "error", "createRevalidateRoute", "options", "secretEnv", "previousSecretEnv", "env", "now", "handler", "active", "previous", "values", "activeValue", "previousValue", "signature", "SANITY_SIGNATURE_HEADER", "body", "clock", "secret", "verifySanityWebhook", "result", "payload", "id", "tags", "tag"]
+}

package/dist/next.d.cts

@@ -0,0 +1,4 @@
+import "server-only";
+export { createNextCmsReader } from "./adapters/next/reader.cjs";
+export { createRevalidateRoute } from "./invalidation/route.cjs";
+export type { TypeToTags, RevalidateRouteOptions, CmsRouteHandler, CmsRevalidateRoute, } from "./invalidation/route.cjs";

package/dist/next.d.mts

@@ -0,0 +1,4 @@
+import "server-only";
+export { createNextCmsReader } from "./adapters/next/reader.mjs";
+export { createRevalidateRoute } from "./invalidation/route.mjs";
+export type { TypeToTags, RevalidateRouteOptions, CmsRouteHandler, CmsRevalidateRoute, } from "./invalidation/route.mjs";

package/dist/next.d.ts

@@ -0,0 +1,4 @@
+import "server-only";
+export { createNextCmsReader } from "./adapters/next/reader.js";
+export { createRevalidateRoute } from "./invalidation/route.js";
+export type { TypeToTags, RevalidateRouteOptions, CmsRouteHandler, CmsRevalidateRoute, } from "./invalidation/route.js";

package/dist/next.mjs

@@ -0,0 +1,2 @@
+import"server-only";var M=/^[A-Za-z][A-Za-z0-9_]{0,63}$/,_=/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/,D=/^[a-z0-9]{6,12}\.[a-z][a-z0-9_-]{0,63}$/;function h(e){if(!e||!Array.isArray(e.types)||e.types.length===0)throw new TypeError("CMS dependencies require document types");let r=[...e.types];for(let n of r)if(typeof n!="string"||!M.test(n))throw new TypeError("Invalid CMS document type");if(e.ids!==void 0&&!Array.isArray(e.ids))throw new TypeError("Invalid CMS document IDs");let t=e.ids===void 0?void 0:[...e.ids];for(let n of t??[])if(typeof n!="string"||!_.test(n)||/^(drafts|versions)\./.test(n))throw new TypeError("Invalid CMS document ID");if(new Set(r).size+new Set(t).size>128)throw new TypeError("Too many CMS tags");return Object.freeze({types:Object.freeze(r),...t===void 0?{}:{ids:Object.freeze(t)}})}function E(e){if(!e||typeof e.name!="string"||!/^[A-Za-z][A-Za-z0-9_.-]{0,127}$/.test(e.name)||typeof e.query!="string"||e.query.trim()===""||typeof e.resolve!="function")throw new TypeError("Invalid CMS query configuration");let r=e.params;if(!r||typeof r!="object"||Object.getPrototypeOf(r)!==Object.prototype&&Object.getPrototypeOf(r)!==null)throw new TypeError("CMS params must be plain JSON scalars");let t={};for(let n of Reflect.ownKeys(r)){let o=Object.getOwnPropertyDescriptor(r,n);if(typeof n!="string"||!o||!Object.hasOwn(o,"value")||!o.enumerable)throw new TypeError("CMS params must be plain JSON scalars");let a=o.value;if(!(a===null||typeof a=="string"||typeof a=="boolean"||typeof a=="number"&&Number.isFinite(a)))throw new TypeError("CMS params must be plain JSON scalars");Object.defineProperty(t,n,{value:a,enumerable:!0})}return Object.freeze({name:e.name,query:e.query,params:Object.freeze(t),dependencies:h(e.dependencies),resolve:e.resolve})}function b(e,r){if(typeof e!="string"||e.length>77||!D.test(e))throw new TypeError("Invalid CMS scope");let t=h(r),n=[...[...new Set(t.types)].sort().map(o=>`cms:${e}:type:${o}`),...[...new Set(t.ids??[])].sort().map(o=>`cms:${e}:id:${o}`)];return Object.freeze(n)}function k(e){if(!e||!Object.hasOwn(e,"data")||!Array.isArray(e.fallbackFields)||![...e.fallbackFields].every(r=>typeof r=="string"&&(r==="$"||/^[A-Za-z][A-Za-z0-9_.[\]-]{0,127}$/.test(r))))throw new TypeError("Invalid CMS resolution");return{data:e.data,fallbackFields:Object.freeze([...new Set(e.fallbackFields)])}}function A(e){let r=e?.revalidateSeconds??3600;if(!Number.isSafeInteger(r)||r<3600||!e?.adapter||typeof e.adapter.read!="function"||e.onDiagnostic!==void 0&&typeof e.onDiagnostic!="function")throw new TypeError("Invalid CMS reader configuration");let t=e.adapter;b(t.scope,{types:["ScopeValidation"]});let n=o=>{try{e.onDiagnostic?e.onDiagnostic(o):console.warn(JSON.stringify(o))}catch{}};return{async read(o,a){let s,l,d;try{if(s=E(o),d=b(t.scope,s.dependencies),!a||!Object.hasOwn(a,"fallback"))throw new TypeError;l=k(s.resolve(null,a.fallback))}catch{throw new TypeError("Invalid CMS query or fallback configuration")}let m=(f,c)=>(n({event:"cms.fallback",query:s.name,reason:f,fields:["$"],...c===void 0?{}:{status:c}}),{data:l.data,source:"fallback",fallbackFields:["$"],reason:f}),i;try{i=await t.read({name:s.name,query:s.query,params:s.params},{tags:d,revalidateSeconds:r})}catch{return m("network")}if(!i.ok){let c=["configuration","network","timeout","rate-limit","upstream","plan-limit","permission","malformed"].includes(i.reason)?i.reason:"malformed",T=Number.isInteger(i.status)&&(i.status??0)>=100&&(i.status??0)<=599?i.status:void 0;return m(c,T)}if(i.value===null||i.value===void 0)return m("missing");let y;try{y=k(s.resolve(i.value,a.fallback))}catch{return m("malformed")}return y.fallbackFields.includes("$")?m("invalid-field"):y.fallbackFields.length>0?(n({event:"cms.partial-fallback",query:s.name,reason:"invalid-field",fields:y.fallbackFields}),{...y,source:"mixed",reason:"invalid-field"}):{...y,source:"cms"}}}}var P=A;import{revalidateTag as F}from"next/cache.js";var R="sanity-webhook-signature",j=/^t=(\d+)[, ]+v1=([^, ]+)$/;var S=new TextEncoder;function z(e){return crypto.subtle.importKey("raw",S.encode(e),{name:"HMAC",hash:"SHA-256"},!1,["sign","verify"])}function N(e){if(!/^[A-Za-z0-9_-]+={0,2}$/.test(e))return null;let r=e.replace(/-/g,"+").replace(/_/g,"/");try{let t=atob(r),n=new Uint8Array(t.length);for(let o=0;o<t.length;o+=1)n[o]=t.charCodeAt(o);return n}catch{return null}}async function O(e){let{secret:r,rawBody:t,headers:n}=e,o=e.now??Date.now(),a=e.toleranceMs??3e5;if(!r||r.length===0)return{ok:!1,reason:"no-secret"};let s=n.get(R);if(!s)return{ok:!1,reason:"no-signature"};let l=j.exec(s.trim());if(l===null)return{ok:!1,reason:"malformed-signature"};let d=Number(l[1]),m=l[2]??"";if(!Number.isSafeInteger(d))return{ok:!1,reason:"malformed-signature"};if(d<16094592e5)return{ok:!1,reason:"stale-timestamp"};if(Math.abs(o-d)>a)return{ok:!1,reason:"stale-timestamp"};let i=N(m);if(i===null)return{ok:!1,reason:"malformed-signature"};let y=await z(r);return await crypto.subtle.verify("HMAC",y,i,S.encode(`${d}.${t}`))?{ok:!0}:{ok:!1,reason:"bad-signature"}}var $=16*1024,U=1500,L=new TextEncoder;function u(e,r,t={},n=!1){return new Response(n?null:JSON.stringify(r),{status:e,headers:{"Content-Type":"application/json","Cache-Control":"no-store",...t}})}function H(e,r){if(!r||typeof r!="object"||Array.isArray(r)||Object.keys(r).length===0)throw new TypeError("Invalid CMS invalidation mapping");let t=Object.create(null);for(let n of Reflect.ownKeys(r)){let o=Object.getOwnPropertyDescriptor(r,n);if(typeof n!="string"||!o?.enumerable||!Object.hasOwn(o,"value"))throw new TypeError("Invalid CMS invalidation mapping");let a=o.value;if(!Array.isArray(a)||!a.includes(n))throw new TypeError("Invalid CMS invalidation mapping");b(e,{types:a,ids:["validation"]}),t[n]=Object.freeze([...a])}for(let n of Object.values(t))if(n.some(o=>!Object.hasOwn(t,o)))throw new TypeError("Invalid CMS invalidation mapping");return Object.freeze(t)}function I(e){return typeof e=="string"&&e.trim()!==""&&L.encode(e).byteLength>=32}var w=class extends Error{constructor(t){super("Invalid CMS webhook body");this.status=t}status};async function Z(e){let r=e.body?.getReader();if(!r)return"";let t=new TextDecoder("utf-8",{fatal:!0,ignoreBOM:!0}),n,o=new Promise((a,s)=>{n=setTimeout(()=>s(new w(400)),U)});try{let a=0,s="";for(;;){let{done:l,value:d}=await Promise.race([r.read(),o]);if(l)return s+t.decode();if(a+=d.byteLength,a>$)throw new w(413);s+=t.decode(d,{stream:!0})}}catch(a){throw r.cancel().catch(()=>{}),a}finally{clearTimeout(n),r.releaseLock()}}function Q(e){let r=e.scope,t=H(r,e.typeToTags),n=e.secretEnv??"SANITY_REVALIDATE_SECRET",o=e.previousSecretEnv??"SANITY_REVALIDATE_SECRET_PREVIOUS",a=e.env??(()=>process.env),s=e.now??Date.now,l=async d=>{if(d.method!=="POST")return u(405,{error:"Method not allowed"},{Allow:"POST"},d.method==="HEAD");let m,i;try{let p=a(),C=p[n],g=p[o];if(!I(C)||g!==void 0&&!I(g))throw new Error;m=C,i=g}catch{return u(503,{error:"COULD NOT ANSWER: revalidation configuration unavailable"})}let y=d.headers.get(R);if(!y||y.length>512||!/^t=\d+[, ]+v1=[A-Za-z0-9_-]+={0,2}$/.test(y.trim()))return u(401,{error:"Unauthorized"});let f;try{f=await Z(d)}catch(p){return p instanceof w&&p.status===413?u(413,{error:"Payload too large"}):u(400,{error:"Invalid body"})}try{let p=s();if(!Number.isFinite(p))throw new Error;if(!(await Promise.all([m,...i===void 0?[]:[i]].map(g=>O({secret:g,rawBody:f,headers:d.headers,now:p})))).some(g=>g.ok))return u(401,{error:"Unauthorized"})}catch{return u(401,{error:"Unauthorized"})}let c;try{c=JSON.parse(f)}catch{return u(400,{error:"Invalid payload"})}if(!c||typeof c!="object"||Array.isArray(c)||Object.keys(c).length!==2||!Object.hasOwn(c,"_type")||!Object.hasOwn(c,"_id"))return u(400,{error:"Invalid payload"});let{_type:T,_id:v}=c;if(typeof T!="string"||!/^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(T)||typeof v!="string"||!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(v))return u(400,{error:"Invalid payload"});if(!Object.hasOwn(t,T)||/^(drafts|versions)\./.test(v))return u(400,{error:"Unsupported document"});let x=b(r,{types:t[T],ids:[v]});try{for(let p of x)F(p,{expire:0})}catch{return u(500,{error:"Could not revalidate"})}return u(200,{revalidated:!0})};return Object.freeze({POST:l,GET:l,HEAD:l,PUT:l,PATCH:l,DELETE:l,OPTIONS:l})}export{P as createNextCmsReader,Q as createRevalidateRoute};
+//# sourceMappingURL=next.mjs.map

package/dist/next.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/next.ts", "../src/contracts/query.ts", "../src/runtime/reader.ts", "../src/adapters/next/reader.ts", "../src/invalidation/route.ts", "../src/portable/webhook.ts"],
+  "sourcesContent": ["import \"server-only\";\nexport { createNextCmsReader } from \"./adapters/next/reader.js\";\nexport { createRevalidateRoute } from \"./invalidation/route.js\";\nexport type {\n  TypeToTags, RevalidateRouteOptions, CmsRouteHandler, CmsRevalidateRoute,\n} from \"./invalidation/route.js\";\n", "/** A-1822 S1 owns this implementation. S0 registers the public signatures. */\nexport type CmsParams = Readonly<Record<string, string | number | boolean | null>>;\nexport type CmsDependencies = {\n  readonly types: readonly string[];\n  readonly ids?: readonly string[];\n};\nexport type CmsResolution<T> = {\n  readonly data: T;\n  readonly fallbackFields: readonly string[];\n};\nexport type CmsQuery<T> = {\n  readonly name: string;\n  readonly query: string;\n  readonly params: CmsParams;\n  readonly dependencies: CmsDependencies;\n  readonly resolve: (raw: unknown, fallback: T) => CmsResolution<T>;\n};\n\nconst TYPE = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;\nconst ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;\nconst SCOPE = /^[a-z0-9]{6,12}\\.[a-z][a-z0-9_-]{0,63}$/;\n\nfunction dependenciesCopy(dependencies: CmsDependencies): CmsDependencies {\n  if (!dependencies || !Array.isArray(dependencies.types) || dependencies.types.length === 0) {\n    throw new TypeError(\"CMS dependencies require document types\");\n  }\n  const types = [...dependencies.types];\n  for (const type of types) {\n    if (typeof type !== \"string\" || !TYPE.test(type)) throw new TypeError(\"Invalid CMS document type\");\n  }\n  if (dependencies.ids !== undefined && !Array.isArray(dependencies.ids)) throw new TypeError(\"Invalid CMS document IDs\");\n  const ids = dependencies.ids === undefined ? undefined : [...dependencies.ids];\n  for (const id of ids ?? []) {\n    if (typeof id !== \"string\" || !ID.test(id) || /^(drafts|versions)\\./.test(id)) {\n      throw new TypeError(\"Invalid CMS document ID\");\n    }\n  }\n  if (new Set(types).size + new Set(ids).size > 128) throw new TypeError(\"Too many CMS tags\");\n  return Object.freeze({ types: Object.freeze(types), ...(ids === undefined ? {} : { ids: Object.freeze(ids) }) });\n}\n\nexport function defineCmsQuery<T>(query: CmsQuery<T>): CmsQuery<T> {\n  if (!query || typeof query.name !== \"string\" || !/^[A-Za-z][A-Za-z0-9_.-]{0,127}$/.test(query.name)\n    || typeof query.query !== \"string\" || query.query.trim() === \"\" || typeof query.resolve !== \"function\") {\n    throw new TypeError(\"Invalid CMS query configuration\");\n  }\n  const params = query.params;\n  if (!params || typeof params !== \"object\" || (Object.getPrototypeOf(params) !== Object.prototype && Object.getPrototypeOf(params) !== null)) {\n    throw new TypeError(\"CMS params must be plain JSON scalars\");\n  }\n  const copied: Record<string, string | number | boolean | null> = {};\n  for (const key of Reflect.ownKeys(params)) {\n    const descriptor = Object.getOwnPropertyDescriptor(params, key);\n    if (typeof key !== \"string\" || !descriptor || !Object.hasOwn(descriptor, \"value\") || !descriptor.enumerable) {\n      throw new TypeError(\"CMS params must be plain JSON scalars\");\n    }\n    const value: unknown = descriptor.value;\n    if (!(value === null || typeof value === \"string\" || typeof value === \"boolean\" || (typeof value === \"number\" && Number.isFinite(value)))) {\n      throw new TypeError(\"CMS params must be plain JSON scalars\");\n    }\n    Object.defineProperty(copied, key, { value, enumerable: true });\n  }\n  return Object.freeze({ name: query.name, query: query.query, params: Object.freeze(copied), dependencies: dependenciesCopy(query.dependencies), resolve: query.resolve });\n}\n\nexport function cmsTags(scope: string, dependencies: CmsDependencies): readonly string[] {\n  if (typeof scope !== \"string\" || scope.length > 77 || !SCOPE.test(scope)) throw new TypeError(\"Invalid CMS scope\");\n  const copied = dependenciesCopy(dependencies);\n  const tags = [\n    ...[...new Set(copied.types)].sort().map((type) => `cms:${scope}:type:${type}`),\n    ...[...new Set(copied.ids ?? [])].sort().map((id) => `cms:${scope}:id:${id}`),\n  ];\n  return Object.freeze(tags);\n}\n", "import { cmsTags, defineCmsQuery, type CmsQuery, type CmsResolution } from \"../contracts/query.js\";\n\nexport type CmsFailure = \"configuration\" | \"network\" | \"timeout\" | \"rate-limit\"\n  | \"upstream\" | \"plan-limit\" | \"permission\" | \"malformed\";\nexport type CmsDiagnostic = {\n  readonly event: \"cms.fallback\" | \"cms.partial-fallback\" | \"cms.refused\";\n  readonly query: string;\n  readonly reason: CmsFailure | \"missing\" | \"invalid-field\";\n  readonly status?: number;\n  readonly fields: readonly string[];\n};\nexport type CmsFetch = (url: string, init: RequestInit & {\n  next?: { revalidate: number; tags: string[] };\n}) => Promise<Response>;\nexport type CmsReadPolicy = {\n  readonly tags: readonly string[];\n  readonly revalidateSeconds: number;\n};\nexport type CmsAdapterResult =\n  | { readonly ok: true; readonly value: unknown }\n  | { readonly ok: false; readonly reason: CmsFailure; readonly status?: number };\nexport type CmsAdapter = {\n  readonly scope: string;\n  read(query: Pick<CmsQuery<unknown>, \"name\" | \"query\" | \"params\">,\n    policy: CmsReadPolicy): Promise<CmsAdapterResult>;\n};\nexport type CmsReadResult<T> = {\n  readonly data: T;\n  readonly source: \"cms\" | \"mixed\" | \"fallback\";\n  readonly fallbackFields: readonly string[];\n  readonly reason?: CmsFailure | \"missing\" | \"invalid-field\";\n};\nexport type CmsReaderOptions = {\n  readonly adapter: CmsAdapter;\n  readonly revalidateSeconds?: number;\n  readonly onDiagnostic?: (event: CmsDiagnostic) => void;\n};\nexport type CmsReader = {\n  read<T>(query: CmsQuery<T>, options: { readonly fallback: T }): Promise<CmsReadResult<T>>;\n};\n\nfunction resolution<T>(value: CmsResolution<T>): CmsResolution<T> {\n  if (!value || !Object.hasOwn(value, \"data\") || !Array.isArray(value.fallbackFields)\n    || ![...value.fallbackFields].every((field: unknown) => typeof field === \"string\"\n      && (field === \"$\" || /^[A-Za-z][A-Za-z0-9_.[\\]-]{0,127}$/.test(field)))) {\n    throw new TypeError(\"Invalid CMS resolution\");\n  }\n  return { data: value.data, fallbackFields: Object.freeze([...new Set(value.fallbackFields)]) };\n}\n\n/** Forwards cache policy; persistence and rendered-output invalidation belong to the host. */\nexport function createCmsReader(options: CmsReaderOptions): CmsReader {\n  const seconds = options?.revalidateSeconds ?? 3600;\n  if (!Number.isSafeInteger(seconds) || seconds < 3600 || !options?.adapter\n    || typeof options.adapter.read !== \"function\"\n    || (options.onDiagnostic !== undefined && typeof options.onDiagnostic !== \"function\")) {\n    throw new TypeError(\"Invalid CMS reader configuration\");\n  }\n  const adapter = options.adapter;\n  // Validate the scope without assuming any particular shared content types.\n  cmsTags(adapter.scope, { types: [\"ScopeValidation\"] });\n  const notify = (event: CmsDiagnostic): void => {\n    try {\n      if (options.onDiagnostic) options.onDiagnostic(event);\n      else console.warn(JSON.stringify(event));\n    } catch { /* Reporting must not break visitor rendering. */ }\n  };\n  return {\n    async read<T>(input: CmsQuery<T>, readOptions: { readonly fallback: T }): Promise<CmsReadResult<T>> {\n      let query: CmsQuery<T>;\n      let local: CmsResolution<T>;\n      let tags: readonly string[];\n      try {\n        query = defineCmsQuery(input);\n        tags = cmsTags(adapter.scope, query.dependencies);\n        if (!readOptions || !Object.hasOwn(readOptions, \"fallback\")) throw new TypeError();\n        // Built-in resolvers validate fallback here, before any I/O.\n        local = resolution(query.resolve(null, readOptions.fallback));\n      } catch {\n        throw new TypeError(\"Invalid CMS query or fallback configuration\");\n      }\n      const fallback = (reason: CmsFailure | \"missing\" | \"invalid-field\", status?: number): CmsReadResult<T> => {\n        notify({ event: \"cms.fallback\", query: query.name, reason, fields: [\"$\"],\n          ...(status === undefined ? {} : { status }) });\n        return { data: local.data, source: \"fallback\", fallbackFields: [\"$\"], reason };\n      };\n      let result: CmsAdapterResult;\n      try {\n        result = await adapter.read({ name: query.name, query: query.query, params: query.params },\n          { tags, revalidateSeconds: seconds });\n      } catch { return fallback(\"network\"); }\n      if (!result.ok) {\n        const reasons: readonly CmsFailure[] = [\"configuration\", \"network\", \"timeout\", \"rate-limit\", \"upstream\", \"plan-limit\", \"permission\", \"malformed\"];\n        const reason = reasons.includes(result.reason) ? result.reason : \"malformed\";\n        const status = Number.isInteger(result.status) && (result.status ?? 0) >= 100 && (result.status ?? 0) <= 599 ? result.status : undefined;\n        return fallback(reason, status);\n      }\n      if (result.value === null || result.value === undefined) return fallback(\"missing\");\n      let resolved: CmsResolution<T>;\n      try { resolved = resolution(query.resolve(result.value, readOptions.fallback)); }\n      catch { return fallback(\"malformed\"); }\n      if (resolved.fallbackFields.includes(\"$\")) return fallback(\"invalid-field\");\n      if (resolved.fallbackFields.length > 0) {\n        notify({ event: \"cms.partial-fallback\", query: query.name, reason: \"invalid-field\", fields: resolved.fallbackFields });\n        return { ...resolved, source: \"mixed\", reason: \"invalid-field\" };\n      }\n      return { ...resolved, source: \"cms\" };\n    },\n  };\n}\n", "import { createCmsReader } from \"../../runtime/reader.js\";\n\n// Keep the adapter's patched global fetch and policy intact. No second cache.\nexport const createNextCmsReader = createCmsReader;\n", "import { revalidateTag } from \"next/cache.js\";\nimport { cmsTags } from \"../contracts/query.js\";\nimport { SANITY_SIGNATURE_HEADER, verifySanityWebhook } from \"../portable/webhook.js\";\n\nexport type TypeToTags = Readonly<Record<string, readonly string[]>>;\nexport type RevalidateRouteOptions = {\n  readonly scope: string;\n  readonly secretEnv?: string;\n  readonly previousSecretEnv?: string;\n  readonly typeToTags: TypeToTags;\n  readonly env?: () => Readonly<Record<string, string | undefined>>;\n  readonly now?: () => number;\n};\nexport type CmsRouteHandler = (request: Request) => Promise<Response>;\nexport type CmsRevalidateRoute = Readonly<Record<\n  \"POST\" | \"GET\" | \"HEAD\" | \"PUT\" | \"PATCH\" | \"DELETE\" | \"OPTIONS\", CmsRouteHandler\n>>;\n\nconst BODY_LIMIT = 16 * 1024;\nconst BODY_DEADLINE_MS = 1500;\nconst encoder = new TextEncoder();\n\nfunction response(status: number, value: unknown, headers: Record<string, string> = {}, head = false): Response {\n  return new Response(head ? null : JSON.stringify(value), {\n    status, headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\", ...headers },\n  });\n}\n\nfunction copyMapping(scope: string, mapping: TypeToTags): TypeToTags {\n  if (!mapping || typeof mapping !== \"object\" || Array.isArray(mapping) || Object.keys(mapping).length === 0) {\n    throw new TypeError(\"Invalid CMS invalidation mapping\");\n  }\n  const copied: Record<string, readonly string[]> = Object.create(null);\n  for (const key of Reflect.ownKeys(mapping)) {\n    const descriptor = Object.getOwnPropertyDescriptor(mapping, key);\n    if (typeof key !== \"string\" || !descriptor?.enumerable || !Object.hasOwn(descriptor, \"value\")) {\n      throw new TypeError(\"Invalid CMS invalidation mapping\");\n    }\n    const types: unknown = descriptor.value;\n    if (!Array.isArray(types) || !types.includes(key)) throw new TypeError(\"Invalid CMS invalidation mapping\");\n    // Reserve the document ID tag as well as validating every local type.\n    cmsTags(scope, { types, ids: [\"validation\"] });\n    copied[key] = Object.freeze([...types] as string[]);\n  }\n  for (const types of Object.values(copied)) {\n    if (types.some((type) => !Object.hasOwn(copied, type))) throw new TypeError(\"Invalid CMS invalidation mapping\");\n  }\n  return Object.freeze(copied);\n}\n\nfunction validSecret(value: unknown): value is string {\n  return typeof value === \"string\" && value.trim() !== \"\" && encoder.encode(value).byteLength >= 32;\n}\n\nclass BodyFailure extends Error {\n  constructor(readonly status: 400 | 413) { super(\"Invalid CMS webhook body\"); }\n}\n\nasync function rawBody(request: Request): Promise<string> {\n  const reader = request.body?.getReader();\n  if (!reader) return \"\";\n  const decoder = new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: true });\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const deadline = new Promise<never>((_resolve, reject) => {\n    timer = setTimeout(() => reject(new BodyFailure(400)), BODY_DEADLINE_MS);\n  });\n  try {\n    let bytes = 0;\n    let text = \"\";\n    while (true) {\n      const { done, value } = await Promise.race([reader.read(), deadline]);\n      if (done) return text + decoder.decode();\n      bytes += value.byteLength;\n      if (bytes > BODY_LIMIT) throw new BodyFailure(413);\n      text += decoder.decode(value, { stream: true });\n    }\n  } catch (error) {\n    // Cancellation must not extend the deadline, including a stalled source.\n    void reader.cancel().catch(() => {});\n    throw error;\n  } finally {\n    clearTimeout(timer);\n    reader.releaseLock();\n  }\n}\n\nexport function createRevalidateRoute(options: RevalidateRouteOptions): CmsRevalidateRoute {\n  const scope = options.scope;\n  const mapping = copyMapping(scope, options.typeToTags);\n  const secretEnv = options.secretEnv ?? \"SANITY_REVALIDATE_SECRET\";\n  const previousSecretEnv = options.previousSecretEnv ?? \"SANITY_REVALIDATE_SECRET_PREVIOUS\";\n  const env = options.env ?? (() => process.env);\n  const now = options.now ?? Date.now;\n\n  const handler: CmsRouteHandler = async (request) => {\n    if (request.method !== \"POST\") {\n      return response(405, { error: \"Method not allowed\" }, { Allow: \"POST\" }, request.method === \"HEAD\");\n    }\n    let active: string;\n    let previous: string | undefined;\n    try {\n      const values = env();\n      const activeValue = values[secretEnv];\n      const previousValue = values[previousSecretEnv];\n      if (!validSecret(activeValue) || (previousValue !== undefined && !validSecret(previousValue))) throw new Error();\n      active = activeValue;\n      previous = previousValue;\n    } catch {\n      return response(503, { error: \"COULD NOT ANSWER: revalidation configuration unavailable\" });\n    }\n    const signature = request.headers.get(SANITY_SIGNATURE_HEADER);\n    if (!signature || signature.length > 512 || !/^t=\\d+[, ]+v1=[A-Za-z0-9_-]+={0,2}$/.test(signature.trim())) {\n      return response(401, { error: \"Unauthorized\" });\n    }\n    let body: string;\n    try { body = await rawBody(request); }\n    catch (error) {\n      return error instanceof BodyFailure && error.status === 413\n        ? response(413, { error: \"Payload too large\" }) : response(400, { error: \"Invalid body\" });\n    }\n    try {\n      const clock = now();\n      if (!Number.isFinite(clock)) throw new Error();\n      const results = await Promise.all([active, ...(previous === undefined ? [] : [previous])].map((secret) =>\n        verifySanityWebhook({ secret, rawBody: body, headers: request.headers, now: clock })));\n      if (!results.some((result) => result.ok)) return response(401, { error: \"Unauthorized\" });\n    } catch { return response(401, { error: \"Unauthorized\" }); }\n\n    let payload: unknown;\n    try { payload = JSON.parse(body); }\n    catch { return response(400, { error: \"Invalid payload\" }); }\n    if (!payload || typeof payload !== \"object\" || Array.isArray(payload)\n      || Object.keys(payload).length !== 2 || !Object.hasOwn(payload, \"_type\") || !Object.hasOwn(payload, \"_id\")) {\n      return response(400, { error: \"Invalid payload\" });\n    }\n    const { _type: type, _id: id } = payload as { _type: unknown; _id: unknown };\n    if (typeof type !== \"string\" || !/^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(type)\n      || typeof id !== \"string\" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(id)) {\n      return response(400, { error: \"Invalid payload\" });\n    }\n    if (!Object.hasOwn(mapping, type) || /^(drafts|versions)\\./.test(id)) {\n      return response(400, { error: \"Unsupported document\" });\n    }\n    const tags = cmsTags(scope, { types: mapping[type]!, ids: [id] });\n    try {\n      for (const tag of tags) revalidateTag(tag, { expire: 0 });\n    } catch { return response(500, { error: \"Could not revalidate\" }); }\n    return response(200, { revalidated: true });\n  };\n  return Object.freeze({ POST: handler, GET: handler, HEAD: handler, PUT: handler, PATCH: handler, DELETE: handler, OPTIONS: handler });\n}\n", "/**\n * Verifying a Sanity webhook (A-590 step 1, A-592's `SANITY_WEBHOOK_SECRET`).\n *\n * -------------------------------------------------------------------------\n * WHY THIS ENDPOINT NEEDS A SIGNATURE AT ALL\n * -------------------------------------------------------------------------\n *\n * `/revalidate` throws away cache entries. A-590: \"An unauthenticated\n * revalidation endpoint is a free cache-purge and rebuild trigger for anyone\n * who finds the URL.\" On a plan whose API request allowance is a HARD cap that\n * returns 402 rather than a bill, an attacker who can empty the cache at will\n * can take a client's site content-offline for the rest of the month. So the\n * signature is not hygiene here; it is the availability control.\n *\n * -------------------------------------------------------------------------\n * THE WIRE FORMAT IS MEASURED, NOT REMEMBERED\n * -------------------------------------------------------------------------\n *\n * Read on 2026-09-16 from Sanity's own toolkit,\n * `https://raw.githubusercontent.com/sanity-io/webhook-toolkit/main/src/signature.ts`:\n *\n *   header            `sanity-webhook-signature`\n *   value             `t=<millis>,v1=<signature>`  (regex `/^t=(\\d+)[, ]+v1=([^, ]+)$/`)\n *   signed payload    `` `${timestamp}.${body}` ``\n *   algorithm         HMAC-SHA256\n *   digest encoding   base64url \u2014 standard base64 with `+`\u2192`-`, `/`\u2192`_`, padding stripped\n *   MINIMUM_TIMESTAMP 1609459200000 (2021-01-01Z), below which a value is nonsense\n *\n * `signature.test.ts` does not take that paragraph's word for it either: it\n * signs a payload with `@sanity/webhook`'s own `encodeSignatureHeader` and\n * asserts this verifier accepts it. If Sanity changes the format, that test\n * goes red rather than production quietly rejecting every webhook.\n *\n * -------------------------------------------------------------------------\n * WHAT THIS ADDS TO THE TOOLKIT, AND WHY IT IS NOT JUST IMPORTED\n * -------------------------------------------------------------------------\n *\n * Two things, both of which are `CLAUDE.md`'s \"take the safer construction\".\n *\n * First, a REPLAY WINDOW. The toolkit enforces only that the timestamp is after\n * 2021; a captured webhook is otherwise replayable forever. A replayed purge is\n * the attack in the first paragraph, executed with a request somebody was\n * legitimately sent. `verifySanityWebhook` takes a symmetric tolerance \u2014 the\n * window is symmetric for A-44's reason, since a far-future timestamp is\n * precisely how you mint a request that stays replayable for a year.\n *\n * Second, a MISSING SECRET IS A REJECTION, never a bypass. A-590 says it in as\n * many words: \"reject on absence rather than skipping the check when the secret\n * is unset.\" The degraded mode of \"no secret configured, so allow it\" is\n * produced by a deploy that forgot `wrangler secret put`, announces itself\n * nowhere, and grants strangers the purge endpoint.\n *\n * The comparison is `crypto.subtle.verify`, which compares raw digests in\n * constant time. A `===` on the base64 strings short-circuits at the first\n * differing character, which turns one 2^256 search into a few dozen sequential\n * 64-way ones against an endpoint that answers in milliseconds.\n *\n * -------------------------------------------------------------------------\n * `encodeSignatureHeader` IS ASYNC. AWAIT IT. (A-651)\n * -------------------------------------------------------------------------\n *\n * `@sanity/webhook@4.0.4` declares\n *\n *   encodeSignatureHeader(payload: string, timestamp: number, secret: string):\n *     Promise<string>\n *\n * and nothing forces you to await it. Drop the `await` and the Promise is\n * stringified into the header as the literal `[object Promise]`, which arrives\n * here, fails `SIGNATURE_VALUE`, and is rejected as `malformed-signature`. The\n * rejection is correct and the message is about the wire format, so it sends\n * you to read Sanity's header spec \u2014 the one place the bug is not. TypeScript\n * does not save you either: the value usually lands in a `Record<string,\n * string>` built by a helper, or inside a template literal, both of which take\n * a Promise without complaint.\n *\n * The rule: every call to `encodeSignatureHeader` is awaited, and the helper\n * that wraps it is `async` rather than returning the Promise for someone else\n * to forget. The content-client compatibility tests and CMS signer tests await every\n * encoder call; this note exists so the next one\n * is too, because the symptom will not tell you.\n */\n\n/** Sanity's header. Lower-cased; `Headers.get` is case-insensitive either way. */\nexport const SANITY_SIGNATURE_HEADER = \"sanity-webhook-signature\";\n\n/** Sanity's own parser, character for character. See the header. */\nconst SIGNATURE_VALUE = /^t=(\\d+)[, ]+v1=([^, ]+)$/;\n\n/** 2021-01-01T00:00:00.000Z. Sanity's `MINIMUM_TIMESTAMP`; anything earlier is not a timestamp. */\nexport const MINIMUM_TIMESTAMP = 1_609_459_200_000;\n\n/**\n * How far from `now` a webhook timestamp may be, in milliseconds.\n *\n * Five minutes rather than A-44's sixty seconds: this one crosses Sanity's\n * delivery queue rather than two NTP-synced clouds, and a retried delivery is a\n * normal event. It is still a window rather than \"forever\", which is the whole\n * difference from the toolkit.\n */\nexport const DEFAULT_TOLERANCE_MS = 300_000;\n\nexport type WebhookRejection =\n  /** `SANITY_WEBHOOK_SECRET` is unset or empty. Fail closed. */\n  | \"no-secret\"\n  /** No `sanity-webhook-signature` header. */\n  | \"no-signature\"\n  /** Header present but not `t=\u2026,v1=\u2026`, or `v1` is not decodable base64url. */\n  | \"malformed-signature\"\n  /** Before 2021, or outside the tolerance in either direction. */\n  | \"stale-timestamp\"\n  /** Well-formed, in window, wrong. */\n  | \"bad-signature\";\n\nexport type WebhookVerification = { ok: true } | { ok: false; reason: WebhookRejection };\n\nconst encoder = new TextEncoder();\n\nfunction hmacKey(secret: string): Promise<CryptoKey> {\n  return crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\", \"verify\"],\n  );\n}\n\n/**\n * base64url \u2192 bytes, without `Buffer`.\n *\n * `atob` rather than `node:crypto` or `Buffer` because this file is imported by\n * the Worker, and workerd has neither by default. Returns null rather than\n * throwing on rubbish, so a malformed header is a 401 and not a 500 \u2014 a\n * verifier that crashes on bad input is a verifier an attacker can use as a\n * denial of service.\n */\nfunction base64UrlToBytes(value: string): Uint8Array<ArrayBuffer> | null {\n  if (!/^[A-Za-z0-9_-]+={0,2}$/.test(value)) return null;\n  const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  try {\n    const binary = atob(padded);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);\n    return bytes;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Verify a Sanity webhook delivery.\n *\n * `rawBody` must be the bytes as received \u2014 `await request.text()`, never\n * `JSON.stringify(await request.json())`. A parse-and-restringify is not a\n * byte-for-byte round trip (key order, number formatting, whitespace) and one\n * byte changes the whole digest, so the symptom is every webhook failing after\n * a refactor that looked like tidying.\n *\n * The `reason` is for our logs and our tests. It is never returned to the\n * caller: \"your signature was fine but your clock is stale\" is the next step in\n * an attack, handed over free.\n */\nexport async function verifySanityWebhook(options: {\n  secret: string | undefined;\n  rawBody: string;\n  headers: { get(name: string): string | null };\n  now?: number;\n  toleranceMs?: number;\n}): Promise<WebhookVerification> {\n  const { secret, rawBody, headers } = options;\n  const now = options.now ?? Date.now();\n  const toleranceMs = options.toleranceMs ?? DEFAULT_TOLERANCE_MS;\n\n  if (!secret || secret.length === 0) return { ok: false, reason: \"no-secret\" };\n\n  const header = headers.get(SANITY_SIGNATURE_HEADER);\n  if (!header) return { ok: false, reason: \"no-signature\" };\n\n  const match = SIGNATURE_VALUE.exec(header.trim());\n  if (match === null) return { ok: false, reason: \"malformed-signature\" };\n\n  const timestamp = Number(match[1]);\n  const provided = match[2] ?? \"\";\n  if (!Number.isSafeInteger(timestamp)) return { ok: false, reason: \"malformed-signature\" };\n  if (timestamp < MINIMUM_TIMESTAMP) return { ok: false, reason: \"stale-timestamp\" };\n  if (Math.abs(now - timestamp) > toleranceMs) return { ok: false, reason: \"stale-timestamp\" };\n\n  const signature = base64UrlToBytes(provided);\n  if (signature === null) return { ok: false, reason: \"malformed-signature\" };\n\n  const key = await hmacKey(secret);\n  const valid = await crypto.subtle.verify(\n    \"HMAC\",\n    key,\n    signature,\n    encoder.encode(`${timestamp}.${rawBody}`),\n  );\n  return valid ? { ok: true } : { ok: false, reason: \"bad-signature\" };\n}\n"],
+  "mappings": "AAAA,MAAO,cCkBP,IAAMA,EAAO,+BACPC,EAAK,qCACLC,EAAQ,0CAEd,SAASC,EAAiBC,EAAgD,CACxE,GAAI,CAACA,GAAgB,CAAC,MAAM,QAAQA,EAAa,KAAK,GAAKA,EAAa,MAAM,SAAW,EACvF,MAAM,IAAI,UAAU,yCAAyC,EAE/D,IAAMC,EAAQ,CAAC,GAAGD,EAAa,KAAK,EACpC,QAAWE,KAAQD,EACjB,GAAI,OAAOC,GAAS,UAAY,CAACN,EAAK,KAAKM,CAAI,EAAG,MAAM,IAAI,UAAU,2BAA2B,EAEnG,GAAIF,EAAa,MAAQ,QAAa,CAAC,MAAM,QAAQA,EAAa,GAAG,EAAG,MAAM,IAAI,UAAU,0BAA0B,EACtH,IAAMG,EAAMH,EAAa,MAAQ,OAAY,OAAY,CAAC,GAAGA,EAAa,GAAG,EAC7E,QAAWI,KAAMD,GAAO,CAAC,EACvB,GAAI,OAAOC,GAAO,UAAY,CAACP,EAAG,KAAKO,CAAE,GAAK,uBAAuB,KAAKA,CAAE,EAC1E,MAAM,IAAI,UAAU,yBAAyB,EAGjD,GAAI,IAAI,IAAIH,CAAK,EAAE,KAAO,IAAI,IAAIE,CAAG,EAAE,KAAO,IAAK,MAAM,IAAI,UAAU,mBAAmB,EAC1F,OAAO,OAAO,OAAO,CAAE,MAAO,OAAO,OAAOF,CAAK,EAAG,GAAIE,IAAQ,OAAY,CAAC,EAAI,CAAE,IAAK,OAAO,OAAOA,CAAG,CAAE,CAAG,CAAC,CACjH,CAEO,SAASE,EAAkBC,EAAiC,CACjE,GAAI,CAACA,GAAS,OAAOA,EAAM,MAAS,UAAY,CAAC,kCAAkC,KAAKA,EAAM,IAAI,GAC7F,OAAOA,EAAM,OAAU,UAAYA,EAAM,MAAM,KAAK,IAAM,IAAM,OAAOA,EAAM,SAAY,WAC5F,MAAM,IAAI,UAAU,iCAAiC,EAEvD,IAAMC,EAASD,EAAM,OACrB,GAAI,CAACC,GAAU,OAAOA,GAAW,UAAa,OAAO,eAAeA,CAAM,IAAM,OAAO,WAAa,OAAO,eAAeA,CAAM,IAAM,KACpI,MAAM,IAAI,UAAU,uCAAuC,EAE7D,IAAMC,EAA2D,CAAC,EAClE,QAAWC,KAAO,QAAQ,QAAQF,CAAM,EAAG,CACzC,IAAMG,EAAa,OAAO,yBAAyBH,EAAQE,CAAG,EAC9D,GAAI,OAAOA,GAAQ,UAAY,CAACC,GAAc,CAAC,OAAO,OAAOA,EAAY,OAAO,GAAK,CAACA,EAAW,WAC/F,MAAM,IAAI,UAAU,uCAAuC,EAE7D,IAAMC,EAAiBD,EAAW,MAClC,GAAI,EAAEC,IAAU,MAAQ,OAAOA,GAAU,UAAY,OAAOA,GAAU,WAAc,OAAOA,GAAU,UAAY,OAAO,SAASA,CAAK,GACpI,MAAM,IAAI,UAAU,uCAAuC,EAE7D,OAAO,eAAeH,EAAQC,EAAK,CAAE,MAAAE,EAAO,WAAY,EAAK,CAAC,CAChE,CACA,OAAO,OAAO,OAAO,CAAE,KAAML,EAAM,KAAM,MAAOA,EAAM,MAAO,OAAQ,OAAO,OAAOE,CAAM,EAAG,aAAcT,EAAiBO,EAAM,YAAY,EAAG,QAASA,EAAM,OAAQ,CAAC,CAC1K,CAEO,SAASM,EAAQC,EAAeb,EAAkD,CACvF,GAAI,OAAOa,GAAU,UAAYA,EAAM,OAAS,IAAM,CAACf,EAAM,KAAKe,CAAK,EAAG,MAAM,IAAI,UAAU,mBAAmB,EACjH,IAAML,EAAST,EAAiBC,CAAY,EACtCc,EAAO,CACX,GAAG,CAAC,GAAG,IAAI,IAAIN,EAAO,KAAK,CAAC,EAAE,KAAK,EAAE,IAAKN,GAAS,OAAOW,CAAK,SAASX,CAAI,EAAE,EAC9E,GAAG,CAAC,GAAG,IAAI,IAAIM,EAAO,KAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAKJ,GAAO,OAAOS,CAAK,OAAOT,CAAE,EAAE,CAC9E,EACA,OAAO,OAAO,OAAOU,CAAI,CAC3B,CChCA,SAASC,EAAcC,EAA2C,CAChE,GAAI,CAACA,GAAS,CAAC,OAAO,OAAOA,EAAO,MAAM,GAAK,CAAC,MAAM,QAAQA,EAAM,cAAc,GAC7E,CAAC,CAAC,GAAGA,EAAM,cAAc,EAAE,MAAOC,GAAmB,OAAOA,GAAU,WACnEA,IAAU,KAAO,qCAAqC,KAAKA,CAAK,EAAE,EACxE,MAAM,IAAI,UAAU,wBAAwB,EAE9C,MAAO,CAAE,KAAMD,EAAM,KAAM,eAAgB,OAAO,OAAO,CAAC,GAAG,IAAI,IAAIA,EAAM,cAAc,CAAC,CAAC,CAAE,CAC/F,CAGO,SAASE,EAAgBC,EAAsC,CACpE,IAAMC,EAAUD,GAAS,mBAAqB,KAC9C,GAAI,CAAC,OAAO,cAAcC,CAAO,GAAKA,EAAU,MAAQ,CAACD,GAAS,SAC7D,OAAOA,EAAQ,QAAQ,MAAS,YAC/BA,EAAQ,eAAiB,QAAa,OAAOA,EAAQ,cAAiB,WAC1E,MAAM,IAAI,UAAU,kCAAkC,EAExD,IAAME,EAAUF,EAAQ,QAExBG,EAAQD,EAAQ,MAAO,CAAE,MAAO,CAAC,iBAAiB,CAAE,CAAC,EACrD,IAAME,EAAUC,GAA+B,CAC7C,GAAI,CACEL,EAAQ,aAAcA,EAAQ,aAAaK,CAAK,EAC/C,QAAQ,KAAK,KAAK,UAAUA,CAAK,CAAC,CACzC,MAAQ,CAAoD,CAC9D,EACA,MAAO,CACL,MAAM,KAAQC,EAAoBC,EAAkE,CAClG,IAAIC,EACAC,EACAC,EACJ,GAAI,CAGF,GAFAF,EAAQG,EAAeL,CAAK,EAC5BI,EAAOP,EAAQD,EAAQ,MAAOM,EAAM,YAAY,EAC5C,CAACD,GAAe,CAAC,OAAO,OAAOA,EAAa,UAAU,EAAG,MAAM,IAAI,UAEvEE,EAAQb,EAAWY,EAAM,QAAQ,KAAMD,EAAY,QAAQ,CAAC,CAC9D,MAAQ,CACN,MAAM,IAAI,UAAU,6CAA6C,CACnE,CACA,IAAMK,EAAW,CAACC,EAAkDC,KAClEV,EAAO,CAAE,MAAO,eAAgB,MAAOI,EAAM,KAAM,OAAAK,EAAQ,OAAQ,CAAC,GAAG,EACrE,GAAIC,IAAW,OAAY,CAAC,EAAI,CAAE,OAAAA,CAAO,CAAG,CAAC,EACxC,CAAE,KAAML,EAAM,KAAM,OAAQ,WAAY,eAAgB,CAAC,GAAG,EAAG,OAAAI,CAAO,GAE3EE,EACJ,GAAI,CACFA,EAAS,MAAMb,EAAQ,KAAK,CAAE,KAAMM,EAAM,KAAM,MAAOA,EAAM,MAAO,OAAQA,EAAM,MAAO,EACvF,CAAE,KAAAE,EAAM,kBAAmBT,CAAQ,CAAC,CACxC,MAAQ,CAAE,OAAOW,EAAS,SAAS,CAAG,CACtC,GAAI,CAACG,EAAO,GAAI,CAEd,IAAMF,EADiC,CAAC,gBAAiB,UAAW,UAAW,aAAc,WAAY,aAAc,aAAc,WAAW,EACzH,SAASE,EAAO,MAAM,EAAIA,EAAO,OAAS,YAC3DD,EAAS,OAAO,UAAUC,EAAO,MAAM,IAAMA,EAAO,QAAU,IAAM,MAAQA,EAAO,QAAU,IAAM,IAAMA,EAAO,OAAS,OAC/H,OAAOH,EAASC,EAAQC,CAAM,CAChC,CACA,GAAIC,EAAO,QAAU,MAAQA,EAAO,QAAU,OAAW,OAAOH,EAAS,SAAS,EAClF,IAAII,EACJ,GAAI,CAAEA,EAAWpB,EAAWY,EAAM,QAAQO,EAAO,MAAOR,EAAY,QAAQ,CAAC,CAAG,MAC1E,CAAE,OAAOK,EAAS,WAAW,CAAG,CACtC,OAAII,EAAS,eAAe,SAAS,GAAG,EAAUJ,EAAS,eAAe,EACtEI,EAAS,eAAe,OAAS,GACnCZ,EAAO,CAAE,MAAO,uBAAwB,MAAOI,EAAM,KAAM,OAAQ,gBAAiB,OAAQQ,EAAS,cAAe,CAAC,EAC9G,CAAE,GAAGA,EAAU,OAAQ,QAAS,OAAQ,eAAgB,GAE1D,CAAE,GAAGA,EAAU,OAAQ,KAAM,CACtC,CACF,CACF,CC1GO,IAAMC,EAAsBC,ECHnC,OAAS,iBAAAC,MAAqB,gBCmFvB,IAAMC,EAA0B,2BAGjCC,EAAkB,4BA6BxB,IAAMC,EAAU,IAAI,YAEpB,SAASC,EAAQC,EAAoC,CACnD,OAAO,OAAO,OAAO,UACnB,MACAF,EAAQ,OAAOE,CAAM,EACrB,CAAE,KAAM,OAAQ,KAAM,SAAU,EAChC,GACA,CAAC,OAAQ,QAAQ,CACnB,CACF,CAWA,SAASC,EAAiBC,EAA+C,CACvE,GAAI,CAAC,yBAAyB,KAAKA,CAAK,EAAG,OAAO,KAClD,IAAMC,EAASD,EAAM,QAAQ,KAAM,GAAG,EAAE,QAAQ,KAAM,GAAG,EACzD,GAAI,CACF,IAAME,EAAS,KAAKD,CAAM,EACpBE,EAAQ,IAAI,WAAWD,EAAO,MAAM,EAC1C,QAASE,EAAI,EAAGA,EAAIF,EAAO,OAAQE,GAAK,EAAGD,EAAMC,CAAC,EAAIF,EAAO,WAAWE,CAAC,EACzE,OAAOD,CACT,MAAQ,CACN,OAAO,IACT,CACF,CAeA,eAAsBE,EAAoBC,EAMT,CAC/B,GAAM,CAAE,OAAAR,EAAQ,QAAAS,EAAS,QAAAC,CAAQ,EAAIF,EAC/BG,EAAMH,EAAQ,KAAO,KAAK,IAAI,EAC9BI,EAAcJ,EAAQ,aAAe,IAE3C,GAAI,CAACR,GAAUA,EAAO,SAAW,EAAG,MAAO,CAAE,GAAI,GAAO,OAAQ,WAAY,EAE5E,IAAMa,EAASH,EAAQ,IAAII,CAAuB,EAClD,GAAI,CAACD,EAAQ,MAAO,CAAE,GAAI,GAAO,OAAQ,cAAe,EAExD,IAAME,EAAQC,EAAgB,KAAKH,EAAO,KAAK,CAAC,EAChD,GAAIE,IAAU,KAAM,MAAO,CAAE,GAAI,GAAO,OAAQ,qBAAsB,EAEtE,IAAME,EAAY,OAAOF,EAAM,CAAC,CAAC,EAC3BG,EAAWH,EAAM,CAAC,GAAK,GAC7B,GAAI,CAAC,OAAO,cAAcE,CAAS,EAAG,MAAO,CAAE,GAAI,GAAO,OAAQ,qBAAsB,EACxF,GAAIA,EAAY,WAAmB,MAAO,CAAE,GAAI,GAAO,OAAQ,iBAAkB,EACjF,GAAI,KAAK,IAAIN,EAAMM,CAAS,EAAIL,EAAa,MAAO,CAAE,GAAI,GAAO,OAAQ,iBAAkB,EAE3F,IAAMO,EAAYlB,EAAiBiB,CAAQ,EAC3C,GAAIC,IAAc,KAAM,MAAO,CAAE,GAAI,GAAO,OAAQ,qBAAsB,EAE1E,IAAMC,EAAM,MAAMrB,EAAQC,CAAM,EAOhC,OANc,MAAM,OAAO,OAAO,OAChC,OACAoB,EACAD,EACArB,EAAQ,OAAO,GAAGmB,CAAS,IAAIR,CAAO,EAAE,CAC1C,EACe,CAAE,GAAI,EAAK,EAAI,CAAE,GAAI,GAAO,OAAQ,eAAgB,CACrE,CDpLA,IAAMY,EAAa,GAAK,KAClBC,EAAmB,KACnBC,EAAU,IAAI,YAEpB,SAASC,EAASC,EAAgBC,EAAgBC,EAAkC,CAAC,EAAGC,EAAO,GAAiB,CAC9G,OAAO,IAAI,SAASA,EAAO,KAAO,KAAK,UAAUF,CAAK,EAAG,CACvD,OAAAD,EAAQ,QAAS,CAAE,eAAgB,mBAAoB,gBAAiB,WAAY,GAAGE,CAAQ,CACjG,CAAC,CACH,CAEA,SAASE,EAAYC,EAAeC,EAAiC,CACnE,GAAI,CAACA,GAAW,OAAOA,GAAY,UAAY,MAAM,QAAQA,CAAO,GAAK,OAAO,KAAKA,CAAO,EAAE,SAAW,EACvG,MAAM,IAAI,UAAU,kCAAkC,EAExD,IAAMC,EAA4C,OAAO,OAAO,IAAI,EACpE,QAAWC,KAAO,QAAQ,QAAQF,CAAO,EAAG,CAC1C,IAAMG,EAAa,OAAO,yBAAyBH,EAASE,CAAG,EAC/D,GAAI,OAAOA,GAAQ,UAAY,CAACC,GAAY,YAAc,CAAC,OAAO,OAAOA,EAAY,OAAO,EAC1F,MAAM,IAAI,UAAU,kCAAkC,EAExD,IAAMC,EAAiBD,EAAW,MAClC,GAAI,CAAC,MAAM,QAAQC,CAAK,GAAK,CAACA,EAAM,SAASF,CAAG,EAAG,MAAM,IAAI,UAAU,kCAAkC,EAEzGG,EAAQN,EAAO,CAAE,MAAAK,EAAO,IAAK,CAAC,YAAY,CAAE,CAAC,EAC7CH,EAAOC,CAAG,EAAI,OAAO,OAAO,CAAC,GAAGE,CAAK,CAAa,CACpD,CACA,QAAWA,KAAS,OAAO,OAAOH,CAAM,EACtC,GAAIG,EAAM,KAAME,GAAS,CAAC,OAAO,OAAOL,EAAQK,CAAI,CAAC,EAAG,MAAM,IAAI,UAAU,kCAAkC,EAEhH,OAAO,OAAO,OAAOL,CAAM,CAC7B,CAEA,SAASM,EAAYZ,EAAiC,CACpD,OAAO,OAAOA,GAAU,UAAYA,EAAM,KAAK,IAAM,IAAMH,EAAQ,OAAOG,CAAK,EAAE,YAAc,EACjG,CAEA,IAAMa,EAAN,cAA0B,KAAM,CAC9B,YAAqBd,EAAmB,CAAE,MAAM,0BAA0B,EAArD,YAAAA,CAAwD,CAAxD,MACvB,EAEA,eAAee,EAAQC,EAAmC,CACxD,IAAMC,EAASD,EAAQ,MAAM,UAAU,EACvC,GAAI,CAACC,EAAQ,MAAO,GACpB,IAAMC,EAAU,IAAI,YAAY,QAAS,CAAE,MAAO,GAAM,UAAW,EAAK,CAAC,EACrEC,EACEC,EAAW,IAAI,QAAe,CAACC,EAAUC,IAAW,CACxDH,EAAQ,WAAW,IAAMG,EAAO,IAAIR,EAAY,GAAG,CAAC,EAAGjB,CAAgB,CACzE,CAAC,EACD,GAAI,CACF,IAAI0B,EAAQ,EACRC,EAAO,GACX,OAAa,CACX,GAAM,CAAE,KAAAC,EAAM,MAAAxB,CAAM,EAAI,MAAM,QAAQ,KAAK,CAACgB,EAAO,KAAK,EAAGG,CAAQ,CAAC,EACpE,GAAIK,EAAM,OAAOD,EAAON,EAAQ,OAAO,EAEvC,GADAK,GAAStB,EAAM,WACXsB,EAAQ3B,EAAY,MAAM,IAAIkB,EAAY,GAAG,EACjDU,GAAQN,EAAQ,OAAOjB,EAAO,CAAE,OAAQ,EAAK,CAAC,CAChD,CACF,OAASyB,EAAO,CAEd,MAAKT,EAAO,OAAO,EAAE,MAAM,IAAM,CAAC,CAAC,EAC7BS,CACR,QAAE,CACA,aAAaP,CAAK,EAClBF,EAAO,YAAY,CACrB,CACF,CAEO,SAASU,EAAsBC,EAAqD,CACzF,IAAMvB,EAAQuB,EAAQ,MAChBtB,EAAUF,EAAYC,EAAOuB,EAAQ,UAAU,EAC/CC,EAAYD,EAAQ,WAAa,2BACjCE,EAAoBF,EAAQ,mBAAqB,oCACjDG,EAAMH,EAAQ,MAAQ,IAAM,QAAQ,KACpCI,EAAMJ,EAAQ,KAAO,KAAK,IAE1BK,EAA2B,MAAOjB,GAAY,CAClD,GAAIA,EAAQ,SAAW,OACrB,OAAOjB,EAAS,IAAK,CAAE,MAAO,oBAAqB,EAAG,CAAE,MAAO,MAAO,EAAGiB,EAAQ,SAAW,MAAM,EAEpG,IAAIkB,EACAC,EACJ,GAAI,CACF,IAAMC,EAASL,EAAI,EACbM,EAAcD,EAAOP,CAAS,EAC9BS,EAAgBF,EAAON,CAAiB,EAC9C,GAAI,CAACjB,EAAYwB,CAAW,GAAMC,IAAkB,QAAa,CAACzB,EAAYyB,CAAa,EAAI,MAAM,IAAI,MACzGJ,EAASG,EACTF,EAAWG,CACb,MAAQ,CACN,OAAOvC,EAAS,IAAK,CAAE,MAAO,0DAA2D,CAAC,CAC5F,CACA,IAAMwC,EAAYvB,EAAQ,QAAQ,IAAIwB,CAAuB,EAC7D,GAAI,CAACD,GAAaA,EAAU,OAAS,KAAO,CAAC,sCAAsC,KAAKA,EAAU,KAAK,CAAC,EACtG,OAAOxC,EAAS,IAAK,CAAE,MAAO,cAAe,CAAC,EAEhD,IAAI0C,EACJ,GAAI,CAAEA,EAAO,MAAM1B,EAAQC,CAAO,CAAG,OAC9BU,EAAO,CACZ,OAAOA,aAAiBZ,GAAeY,EAAM,SAAW,IACpD3B,EAAS,IAAK,CAAE,MAAO,mBAAoB,CAAC,EAAIA,EAAS,IAAK,CAAE,MAAO,cAAe,CAAC,CAC7F,CACA,GAAI,CACF,IAAM2C,EAAQV,EAAI,EAClB,GAAI,CAAC,OAAO,SAASU,CAAK,EAAG,MAAM,IAAI,MAGvC,GAAI,EAFY,MAAM,QAAQ,IAAI,CAACR,EAAQ,GAAIC,IAAa,OAAY,CAAC,EAAI,CAACA,CAAQ,CAAE,EAAE,IAAKQ,GAC7FC,EAAoB,CAAE,OAAAD,EAAQ,QAASF,EAAM,QAASzB,EAAQ,QAAS,IAAK0B,CAAM,CAAC,CAAC,CAAC,GAC1E,KAAMG,GAAWA,EAAO,EAAE,EAAG,OAAO9C,EAAS,IAAK,CAAE,MAAO,cAAe,CAAC,CAC1F,MAAQ,CAAE,OAAOA,EAAS,IAAK,CAAE,MAAO,cAAe,CAAC,CAAG,CAE3D,IAAI+C,EACJ,GAAI,CAAEA,EAAU,KAAK,MAAML,CAAI,CAAG,MAC5B,CAAE,OAAO1C,EAAS,IAAK,CAAE,MAAO,iBAAkB,CAAC,CAAG,CAC5D,GAAI,CAAC+C,GAAW,OAAOA,GAAY,UAAY,MAAM,QAAQA,CAAO,GAC/D,OAAO,KAAKA,CAAO,EAAE,SAAW,GAAK,CAAC,OAAO,OAAOA,EAAS,OAAO,GAAK,CAAC,OAAO,OAAOA,EAAS,KAAK,EACzG,OAAO/C,EAAS,IAAK,CAAE,MAAO,iBAAkB,CAAC,EAEnD,GAAM,CAAE,MAAOa,EAAM,IAAKmC,CAAG,EAAID,EACjC,GAAI,OAAOlC,GAAS,UAAY,CAAC,+BAA+B,KAAKA,CAAI,GACpE,OAAOmC,GAAO,UAAY,CAAC,qCAAqC,KAAKA,CAAE,EAC1E,OAAOhD,EAAS,IAAK,CAAE,MAAO,iBAAkB,CAAC,EAEnD,GAAI,CAAC,OAAO,OAAOO,EAASM,CAAI,GAAK,uBAAuB,KAAKmC,CAAE,EACjE,OAAOhD,EAAS,IAAK,CAAE,MAAO,sBAAuB,CAAC,EAExD,IAAMiD,EAAOrC,EAAQN,EAAO,CAAE,MAAOC,EAAQM,CAAI,EAAI,IAAK,CAACmC,CAAE,CAAE,CAAC,EAChE,GAAI,CACF,QAAWE,KAAOD,EAAME,EAAcD,EAAK,CAAE,OAAQ,CAAE,CAAC,CAC1D,MAAQ,CAAE,OAAOlD,EAAS,IAAK,CAAE,MAAO,sBAAuB,CAAC,CAAG,CACnE,OAAOA,EAAS,IAAK,CAAE,YAAa,EAAK,CAAC,CAC5C,EACA,OAAO,OAAO,OAAO,CAAE,KAAMkC,EAAS,IAAKA,EAAS,KAAMA,EAAS,IAAKA,EAAS,MAAOA,EAAS,OAAQA,EAAS,QAASA,CAAQ,CAAC,CACtI",
+  "names": ["TYPE", "ID", "SCOPE", "dependenciesCopy", "dependencies", "types", "type", "ids", "id", "defineCmsQuery", "query", "params", "copied", "key", "descriptor", "value", "cmsTags", "scope", "tags", "resolution", "value", "field", "createCmsReader", "options", "seconds", "adapter", "cmsTags", "notify", "event", "input", "readOptions", "query", "local", "tags", "defineCmsQuery", "fallback", "reason", "status", "result", "resolved", "createNextCmsReader", "createCmsReader", "revalidateTag", "SANITY_SIGNATURE_HEADER", "SIGNATURE_VALUE", "encoder", "hmacKey", "secret", "base64UrlToBytes", "value", "padded", "binary", "bytes", "i", "verifySanityWebhook", "options", "rawBody", "headers", "now", "toleranceMs", "header", "SANITY_SIGNATURE_HEADER", "match", "SIGNATURE_VALUE", "timestamp", "provided", "signature", "key", "BODY_LIMIT", "BODY_DEADLINE_MS", "encoder", "response", "status", "value", "headers", "head", "copyMapping", "scope", "mapping", "copied", "key", "descriptor", "types", "cmsTags", "type", "validSecret", "BodyFailure", "rawBody", "request", "reader", "decoder", "timer", "deadline", "_resolve", "reject", "bytes", "text", "done", "error", "createRevalidateRoute", "options", "secretEnv", "previousSecretEnv", "env", "now", "handler", "active", "previous", "values", "activeValue", "previousValue", "signature", "SANITY_SIGNATURE_HEADER", "body", "clock", "secret", "verifySanityWebhook", "result", "payload", "id", "tags", "tag", "revalidateTag"]
+}

package/dist/portable/array.d.cts

@@ -0,0 +1,2 @@
+/** Content lists must contain an own entry at every index. */
+export declare function isDenseArray(value: unknown): value is unknown[];

package/dist/portable/array.d.mts

@@ -0,0 +1,2 @@
+/** Content lists must contain an own entry at every index. */
+export declare function isDenseArray(value: unknown): value is unknown[];

package/dist/portable/array.d.ts

@@ -0,0 +1,2 @@
+/** Content lists must contain an own entry at every index. */
+export declare function isDenseArray(value: unknown): value is unknown[];

package/dist/portable/fallback.d.cts

@@ -0,0 +1,4 @@
+import { type HomeContent, type PageContent, type SiteSettingsContent } from "./site-content.cjs";
+export declare function validHomeFallback(value: unknown): value is HomeContent | null;
+export declare function validPageFallback(value: unknown): value is PageContent | null;
+export declare function validSettingsFallback(value: unknown): value is SiteSettingsContent | null;

package/dist/portable/fallback.d.mts

@@ -0,0 +1,4 @@
+import { type HomeContent, type PageContent, type SiteSettingsContent } from "./site-content.mjs";
+export declare function validHomeFallback(value: unknown): value is HomeContent | null;
+export declare function validPageFallback(value: unknown): value is PageContent | null;
+export declare function validSettingsFallback(value: unknown): value is SiteSettingsContent | null;

package/dist/portable/fallback.d.ts

@@ -0,0 +1,4 @@
+import { type HomeContent, type PageContent, type SiteSettingsContent } from "./site-content.js";
+export declare function validHomeFallback(value: unknown): value is HomeContent | null;
+export declare function validPageFallback(value: unknown): value is PageContent | null;
+export declare function validSettingsFallback(value: unknown): value is SiteSettingsContent | null;

package/dist/portable/site-content.d.cts

@@ -0,0 +1,220 @@
+/**
+ * A-1713. The site content model, read: the home page, content pages and site
+ * settings, validated on read and returned in the shape a site's page
+ * composition consumes.
+ *
+ * ===========================================================================
+ * READ ONLY, BY CONSTRUCTION
+ * ===========================================================================
+ *
+ * A client site reads its content with a read-only token. All editing goes
+ * through the studio's dashboard, which writes to Sanity; nothing on a client
+ * site writes, and this module has no write path to call. It is handed a
+ * `ContentClient` (a `query` function) and nothing else.
+ *
+ * ===========================================================================
+ * VALIDATED ON READ, BECAUSE SANITY VALIDATION ONLY ADVISES
+ * ===========================================================================
+ *
+ * The schema's rules warn an editor; they do not refuse a publish, and
+ * anything writing over the API skips them entirely. So every document is
+ * checked here again, and a malformed one is refused BY NAME
+ * (`MalformedContentError`, code `malformed-content`) listing every problem
+ * with its path, rather than rendered half-empty. A page that renders with a
+ * missing headline and a page whose content is broken look identical to a
+ * visitor; a build that fails naming `hero.headline` does not.
+ *
+ * Absent is not malformed: `null` from `home()` means nobody has created the
+ * home page yet, and a site decides what to do about that.
+ *
+ * ===========================================================================
+ * THE SHAPE IT RETURNS
+ * ===========================================================================
+ *
+ * The INPUT shape of a site's composition schema (the reference build's
+ * frontmatter): a copy value is a plain string for the client's own words
+ * with no claim about their source, `{ text, copySource: "captured" }` for
+ * words claimed verbatim from the capture (the site checks every such claim
+ * against its capture evidence, so the claim must survive Sanity), and
+ * `{ text, copySource: "proposed" }` for studio-written words awaiting
+ * approval. All three round-trip exactly; a photo is its library slug; every key a block declares is
+ * present, `null` where there is nothing. So a site validates this with the
+ * same schema it validates its Markdown frontmatter with, and its components
+ * never know where the content came from.
+ *
+ * Mapping from the generic model to the composition's names:
+ *
+ *   hero.headline / subline / lead      hero.heading / subline / intro
+ *   hero.photos[0], [1]                 hero.image, hero.inset
+ *   hero.primaryAction / secondary...   hero.cta / secondaryCta
+ *   campaign (when shown)               the FIRST block, kind `campaign`, and
+ *                                       the page body (`# title` + its text)
+ *   featureStoriesBlock                 kind `feature_stories`
+ *   surfaceCardBlock                    kind `cta`
+ *   accentBandBlock                     kind `accent_band`
+ *   locationsBlock                      kind `locations` (jumpLink → anchor)
+ *
+ * Two places the composition cannot carry a proposed marker: a `cta` block's
+ * plain strings, and the campaign's title and body (which travel as Markdown).
+ * There the text is returned plain and the line is still listed in
+ * `proposedCopy`, which is the list a dashboard and a site both read for
+ * approval. Nothing is dropped silently.
+ */
+import { type CmsQuery } from "../contracts/query.cjs";
+export type CopyInput = string | {
+    readonly text: string;
+    readonly copySource: "captured" | "proposed";
+};
+export type ActionInput = {
+    readonly label: CopyInput;
+    readonly href: string;
+};
+export type HeroInput = {
+    readonly heading: CopyInput;
+    readonly subline: CopyInput | null;
+    readonly intro: CopyInput | null;
+    readonly image: string | null;
+    readonly inset: string | null;
+    readonly cta: ActionInput | null;
+    readonly secondaryCta: ActionInput | null;
+};
+export type StoryInput = {
+    readonly heading: CopyInput;
+    readonly body: CopyInput;
+    readonly action: ActionInput;
+    readonly image: string | null;
+    readonly shape: "wide" | "tall" | "round" | "free";
+    readonly card: boolean;
+};
+export type CompositionBlockInput = {
+    readonly kind: "campaign";
+    readonly action: ActionInput | null;
+    readonly images: readonly string[];
+} | {
+    readonly kind: "locations";
+    readonly anchor: string | null;
+    readonly heading: CopyInput;
+    readonly tail: CopyInput | null;
+    readonly image: string | null;
+} | {
+    readonly kind: "feature_stories";
+    readonly heading: CopyInput;
+    readonly tail: CopyInput | null;
+    readonly items: readonly StoryInput[];
+} | {
+    readonly kind: "accent_band";
+    readonly heading: CopyInput;
+    readonly body: CopyInput;
+    readonly action: ActionInput | null;
+    readonly image: string | null;
+} | {
+    readonly kind: "cta";
+    readonly heading: string;
+    readonly body: string | null;
+    readonly link: {
+        readonly label: string;
+        readonly href: string;
+    };
+};
+export type CompositionInput = {
+    readonly intro: string | null;
+    readonly photo: string | null;
+    readonly hero: HeroInput | null;
+    readonly blocks: readonly CompositionBlockInput[];
+};
+/** One line of studio-written copy awaiting approval, and where it is in the document. */
+export type ProposedCopy = {
+    readonly where: string;
+    readonly text: string;
+};
+export type CampaignState = "shown" | "off" | "not-started" | "ended" | "none";
+export type HomeContent = {
+    readonly composition: CompositionInput;
+    /** The page body as Markdown: the campaign's title and text when it is shown, otherwise empty. */
+    readonly body: string;
+    readonly campaign: CampaignState;
+    readonly proposedCopy: readonly ProposedCopy[];
+};
+export type PageContent = {
+    readonly slug: string;
+    readonly title: string;
+    readonly composition: CompositionInput;
+    readonly body: string;
+    readonly migrated: boolean;
+    readonly proposedCopy: readonly ProposedCopy[];
+};
+export type SiteSettingsContent = {
+    readonly name: string;
+    readonly description: string | null;
+    readonly contact: {
+        readonly email: string | null;
+        readonly phone: string | null;
+    };
+    readonly social: readonly {
+        readonly network: string;
+        readonly url: string;
+    }[];
+};
+export declare const MALFORMED_CONTENT = "malformed-content";
+export declare class MalformedContentError extends Error {
+    readonly code = "malformed-content";
+    readonly documentId: string;
+    readonly problems: readonly string[];
+    constructor(documentId: string, problems: readonly string[]);
+}
+export declare const READER_PHOTO_SLUG: RegExp;
+export declare const READER_ACTION_HREF: RegExp;
+export declare const READER_JUMP_LINK: RegExp;
+export declare const READER_STORY_LAYOUTS: readonly ["wide", "tall", "round", "free"];
+export declare const READER_HOME_PAGE_ID = "homePage";
+export declare const READER_SITE_SETTINGS_ID = "siteSettings";
+/**
+ * The narrow Portable Text `portableText` declares, back to Markdown: normal,
+ * h2, h3 and quote blocks, bullet and numbered lists, bold, italic, code and
+ * links. It is the inverse of the seed package's Markdown mapper, and the
+ * round-trip test holds the two to each other.
+ *
+ * An uploaded image inside rich text is REFUSED, not dropped: nothing can
+ * upload one yet (the dashboard slice decides how), so one arriving means
+ * something wrote the document by hand, and a page silently missing a picture
+ * is the failure this reader exists to prevent.
+ */
+export declare function portableTextToMarkdown(value: unknown): string;
+/** Whether a campaign is shown at `now`, and if not, why not. */
+export declare function campaignState(campaign: unknown, now: Date): CampaignState;
+/**
+ * A stored home page document, validated and mapped. Throws
+ * `MalformedContentError` naming every problem. `now` decides whether a
+ * scheduled campaign is shown, and is a parameter so a build, a preview and a
+ * test each say which moment they mean.
+ */
+export declare function parseHomePage(document: unknown, options: {
+    readonly now: Date;
+}): HomeContent;
+export declare function parseContentPage(document: unknown): PageContent;
+export declare function parseSiteSettings(document: unknown): SiteSettingsContent;
+/** By fixed id: a second home page at a random id is never read. */
+export declare const HOME_PAGE_DOCUMENT_QUERY = "*[_id == $id][0]";
+export declare const CONTENT_PAGES_QUERY = "*[_type == \"page\" && defined(slug.current)]|order(slug.current asc)";
+export declare const CONTENT_PAGE_BY_SLUG_QUERY = "*[_type == \"page\" && slug.current == $slug][0]";
+export interface SiteContentReader {
+    /** `null` when no home page document exists yet. */
+    home: (options: {
+        readonly now: Date;
+    }) => Promise<HomeContent | null>;
+    pages: () => Promise<PageContent[]>;
+    /** `null` when no page has that slug. */
+    pageBySlug: (slug: string) => Promise<PageContent | null>;
+    /** `null` before anyone has filled in the site's details. */
+    siteSettings: () => Promise<SiteSettingsContent | null>;
+}
+export declare function createSiteContentReader(client: {
+    query: <T>(groq: string, options?: {
+        params?: Record<string, unknown>;
+        tags?: readonly string[];
+    }) => Promise<T>;
+}): SiteContentReader;
+export declare function homeContentQuery(now: Date): CmsQuery<HomeContent | null>;
+export declare function contentPageQuery(slug: string): CmsQuery<PageContent | null>;
+export declare function contentPagesQuery(): CmsQuery<readonly PageContent[]>;
+export declare function siteSettingsQuery(): CmsQuery<SiteSettingsContent | null>;