@actuate-media/cms-core 0.1.0

package/dist/__tests__/webhooks/webhooks.test.js

@@ -0,0 +1,96 @@
+import { describe, it, expect } from 'vitest';
+import { signPayload, verifySignature } from '../../webhooks/index';
+import { validateWebhookUrl } from '../../security/webhook';
+describe('Webhook signing', () => {
+    const secret = 'test-webhook-secret-key-12345';
+    it('signPayload produces a hex string', async () => {
+        const sig = await signPayload('{"event":"test"}', secret);
+        expect(sig).toMatch(/^[0-9a-f]{64}$/);
+    });
+    it('signPayload is deterministic', async () => {
+        const body = '{"event":"document.created","data":{}}';
+        const sig1 = await signPayload(body, secret);
+        const sig2 = await signPayload(body, secret);
+        expect(sig1).toBe(sig2);
+    });
+    it('different payloads produce different signatures', async () => {
+        const sig1 = await signPayload('payload-a', secret);
+        const sig2 = await signPayload('payload-b', secret);
+        expect(sig1).not.toBe(sig2);
+    });
+    it('different secrets produce different signatures', async () => {
+        const body = 'same-payload';
+        const sig1 = await signPayload(body, 'secret-1');
+        const sig2 = await signPayload(body, 'secret-2');
+        expect(sig1).not.toBe(sig2);
+    });
+    it('verifySignature returns true for valid signature', async () => {
+        const body = '{"event":"test","data":{}}';
+        const sig = await signPayload(body, secret);
+        const valid = await verifySignature(body, sig, secret);
+        expect(valid).toBe(true);
+    });
+    it('verifySignature returns false for tampered payload', async () => {
+        const sig = await signPayload('original', secret);
+        const valid = await verifySignature('tampered', sig, secret);
+        expect(valid).toBe(false);
+    });
+    it('verifySignature returns false for wrong secret', async () => {
+        const body = 'test-payload';
+        const sig = await signPayload(body, secret);
+        const valid = await verifySignature(body, sig, 'wrong-secret');
+        expect(valid).toBe(false);
+    });
+    it('verifySignature returns false for truncated signature', async () => {
+        const body = 'test';
+        const sig = await signPayload(body, secret);
+        const valid = await verifySignature(body, sig.slice(0, 32), secret);
+        expect(valid).toBe(false);
+    });
+});
+describe('Webhook URL SSRF validation', () => {
+    it('allows valid HTTPS URLs', () => {
+        expect(validateWebhookUrl('https://example.com/webhook')).toEqual({ valid: true });
+        expect(validateWebhookUrl('https://hooks.slack.com/services/xxx')).toEqual({ valid: true });
+    });
+    it('allows valid HTTP URLs', () => {
+        expect(validateWebhookUrl('http://example.com/webhook')).toEqual({ valid: true });
+    });
+    it('rejects localhost', () => {
+        const result = validateWebhookUrl('http://localhost:3000/hook');
+        expect(result.valid).toBe(false);
+    });
+    it('rejects 0.0.0.0', () => {
+        const result = validateWebhookUrl('http://0.0.0.0/hook');
+        expect(result.valid).toBe(false);
+    });
+    it('rejects 10.x private range', () => {
+        const result = validateWebhookUrl('http://10.0.0.1/hook');
+        expect(result.valid).toBe(false);
+    });
+    it('rejects 192.168.x private range', () => {
+        const result = validateWebhookUrl('http://192.168.1.1/hook');
+        expect(result.valid).toBe(false);
+    });
+    it('rejects 172.16-31.x private range', () => {
+        expect(validateWebhookUrl('http://172.16.0.1/hook').valid).toBe(false);
+        expect(validateWebhookUrl('http://172.31.255.1/hook').valid).toBe(false);
+    });
+    it('rejects 127.x loopback', () => {
+        const result = validateWebhookUrl('http://127.0.0.1/hook');
+        expect(result.valid).toBe(false);
+    });
+    it('rejects link-local addresses', () => {
+        const result = validateWebhookUrl('http://169.254.1.1/hook');
+        expect(result.valid).toBe(false);
+    });
+    it('rejects non-HTTP protocols', () => {
+        expect(validateWebhookUrl('ftp://example.com/file').valid).toBe(false);
+        expect(validateWebhookUrl('file:///etc/passwd').valid).toBe(false);
+    });
+    it('rejects invalid URLs', () => {
+        expect(validateWebhookUrl('not-a-url').valid).toBe(false);
+        expect(validateWebhookUrl('').valid).toBe(false);
+    });
+});
+//# sourceMappingURL=webhooks.test.js.map

package/dist/__tests__/webhooks/webhooks.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.test.js","sourceRoot":"","sources":["../../../src/__tests__/webhooks/webhooks.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,MAAM,MAAM,GAAG,+BAA+B,CAAC;IAE/C,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,IAAI,GAAG,wCAAwC,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,IAAI,GAAG,cAAc,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,4BAA4B,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,IAAI,GAAG,cAAc,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,IAAI,GAAG,MAAM,CAAC;QACpB,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,kBAAkB,CAAC,sCAAsC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,MAAM,GAAG,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE;QACzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,sBAAsB,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,MAAM,GAAG,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/a11y/index.d.ts

@@ -0,0 +1,25 @@
+export type Severity = "error" | "warning" | "info";
+export interface AuditRule {
+    id: string;
+    name: string;
+    description: string;
+    severity: Severity;
+    check: (html: string) => AuditViolation[];
+}
+export interface AuditViolation {
+    ruleId: string;
+    severity: Severity;
+    message: string;
+    selector?: string;
+    context?: string;
+}
+export interface AuditReport {
+    violations: AuditViolation[];
+    passes: number;
+    timestamp: Date;
+}
+/** Built-in accessibility audit rules for rich text content. */
+export declare const BUILT_IN_RULES: AuditRule[];
+/** Run accessibility audit rules against HTML content. */
+export declare function auditContent(html: string, rules?: AuditRule[]): AuditReport;
+//# sourceMappingURL=index.d.ts.map

package/dist/a11y/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/a11y/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,cAAc,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,gEAAgE;AAChE,eAAO,MAAM,cAAc,EAAE,SAAS,EAqErC,CAAC;AAEF,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,WAAW,CAe3E"}

package/dist/a11y/index.js

@@ -0,0 +1,88 @@
+/** Built-in accessibility audit rules for rich text content. */
+export const BUILT_IN_RULES = [
+    {
+        id: "img-alt",
+        name: "Image alt text",
+        description: "Images must have alt attributes",
+        severity: "error",
+        check(html) {
+            const violations = [];
+            const imgRegex = /<img(?![^>]*alt=)[^>]*>/gi;
+            let match;
+            while ((match = imgRegex.exec(html)) !== null) {
+                violations.push({
+                    ruleId: "img-alt",
+                    severity: "error",
+                    message: "Image is missing alt attribute",
+                    context: match[0].slice(0, 100),
+                });
+            }
+            return violations;
+        },
+    },
+    {
+        id: "heading-order",
+        name: "Heading order",
+        description: "Headings should not skip levels",
+        severity: "warning",
+        check(html) {
+            const violations = [];
+            const headingRegex = /<h([1-6])/gi;
+            let lastLevel = 0;
+            let match;
+            while ((match = headingRegex.exec(html)) !== null) {
+                const level = parseInt(match[1], 10);
+                if (lastLevel > 0 && level > lastLevel + 1) {
+                    violations.push({
+                        ruleId: "heading-order",
+                        severity: "warning",
+                        message: `Heading level skipped from h${lastLevel} to h${level}`,
+                    });
+                }
+                lastLevel = level;
+            }
+            return violations;
+        },
+    },
+    {
+        id: "link-text",
+        name: "Link text",
+        description: "Links should have descriptive text, not 'click here'",
+        severity: "warning",
+        check(html) {
+            const violations = [];
+            const linkRegex = /<a[^>]*>(.*?)<\/a>/gi;
+            const badTexts = new Set(["click here", "here", "read more", "more", "link"]);
+            let match;
+            while ((match = linkRegex.exec(html)) !== null) {
+                const text = match[1]?.replace(/<[^>]*>/g, "").trim().toLowerCase();
+                if (text && badTexts.has(text)) {
+                    violations.push({
+                        ruleId: "link-text",
+                        severity: "warning",
+                        message: `Link has non-descriptive text: "${text}"`,
+                        context: match[0].slice(0, 100),
+                    });
+                }
+            }
+            return violations;
+        },
+    },
+];
+/** Run accessibility audit rules against HTML content. */
+export function auditContent(html, rules) {
+    const activeRules = rules ?? BUILT_IN_RULES;
+    const violations = [];
+    let passes = 0;
+    for (const rule of activeRules) {
+        const found = rule.check(html);
+        if (found.length > 0) {
+            violations.push(...found);
+        }
+        else {
+            passes++;
+        }
+    }
+    return { violations, passes, timestamp: new Date() };
+}
+//# sourceMappingURL=index.js.map

package/dist/a11y/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/a11y/index.ts"],"names":[],"mappings":"AAwBA,gEAAgE;AAChE,MAAM,CAAC,MAAM,cAAc,GAAgB;IACzC;QACE,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,iCAAiC;QAC9C,QAAQ,EAAE,OAAO;QACjB,KAAK,CAAC,IAAI;YACR,MAAM,UAAU,GAAqB,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,2BAA2B,CAAC;YAC7C,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,SAAS;oBACjB,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,gCAAgC;oBACzC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBAChC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;KACF;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,iCAAiC;QAC9C,QAAQ,EAAE,SAAS;QACnB,KAAK,CAAC,IAAI;YACR,MAAM,UAAU,GAAqB,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,aAAa,CAAC;YACnC,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;gBACtC,IAAI,SAAS,GAAG,CAAC,IAAI,KAAK,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;oBAC3C,UAAU,CAAC,IAAI,CAAC;wBACd,MAAM,EAAE,eAAe;wBACvB,QAAQ,EAAE,SAAS;wBACnB,OAAO,EAAE,+BAA+B,SAAS,QAAQ,KAAK,EAAE;qBACjE,CAAC,CAAC;gBACL,CAAC;gBACD,SAAS,GAAG,KAAK,CAAC;YACpB,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;KACF;IACD;QACE,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,sDAAsD;QACnE,QAAQ,EAAE,SAAS;QACnB,KAAK,CAAC,IAAI;YACR,MAAM,UAAU,GAAqB,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,sBAAsB,CAAC;YACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAC9E,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACpE,IAAI,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,UAAU,CAAC,IAAI,CAAC;wBACd,MAAM,EAAE,WAAW;wBACnB,QAAQ,EAAE,SAAS;wBACnB,OAAO,EAAE,mCAAmC,IAAI,GAAG;wBACnD,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;qBAChC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;KACF;CACF,CAAC;AAEF,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAmB;IAC5D,MAAM,WAAW,GAAG,KAAK,IAAI,cAAc,CAAC;IAC5C,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC;QACX,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;AACvD,CAAC"}

package/dist/actions.d.ts

@@ -0,0 +1,42 @@
+export interface ActionContext {
+    userId: string;
+    role: string;
+    locale?: string;
+    /** PrismaClient instance — typed as unknown to avoid hard coupling at config level. */
+    db: unknown;
+}
+export interface ListOptions {
+    collection: string;
+    page?: number;
+    pageSize?: number;
+    sort?: string;
+    order?: "asc" | "desc";
+    filters?: Record<string, unknown>;
+    locale?: string;
+    status?: string;
+    folderId?: string;
+}
+export interface ListResult {
+    docs: Record<string, unknown>[];
+    total: number;
+    page: number;
+    pageSize: number;
+    totalPages: number;
+}
+/** Create a new document in a collection. */
+export declare function createDocument(collection: string, data: Record<string, unknown>, ctx: ActionContext): Promise<Record<string, unknown>>;
+/** Update an existing document. Merges incoming data with existing to prevent field loss. */
+export declare function updateDocument(collection: string, id: string, data: Record<string, unknown>, ctx: ActionContext): Promise<Record<string, unknown>>;
+/** Soft-delete a document. Creates a version snapshot before deletion. */
+export declare function deleteDocument(collection: string, id: string, ctx: ActionContext): Promise<void>;
+/** Retrieve a single document by ID. */
+export declare function getDocument(collection: string, id: string, ctx: ActionContext): Promise<Record<string, unknown> | null>;
+/** List documents with pagination, sorting, and filtering. */
+export declare function listDocuments(options: ListOptions, ctx: ActionContext): Promise<ListResult>;
+/** Duplicate a document, resetting status to DRAFT and appending "(Copy)" to the title. */
+export declare function duplicateDocument(collection: string, sourceId: string, ctx: ActionContext): Promise<Record<string, unknown>>;
+/** Retrieve a global's data. Globals are stored as single-row collections keyed by slug. */
+export declare function getGlobal(slug: string, ctx: ActionContext): Promise<Record<string, unknown> | null>;
+/** Update a global's data. Creates the document if it doesn't exist (upsert). */
+export declare function updateGlobal(slug: string, data: Record<string, unknown>, ctx: ActionContext): Promise<Record<string, unknown>>;
+//# sourceMappingURL=actions.d.ts.map

package/dist/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,EAAE,EAAE,OAAO,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AA8FD,6CAA6C;AAC7C,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA4ClC;AAED,6FAA6F;AAC7F,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA8DlC;AAED,0EAA0E;AAC1E,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED,wCAAwC;AACxC,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAmBzC;AAED,8DAA8D;AAC9D,wBAAsB,aAAa,CACjC,OAAO,EAAE,WAAW,EACpB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,UAAU,CAAC,CAiFrB;AAED,2FAA2F;AAC3F,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsDlC;AAED,4FAA4F;AAC5F,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAMzC;AAED,iFAAiF;AACjF,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAyDlC"}

package/dist/actions.js

@@ -0,0 +1,391 @@
+import { extractPlainText, hashContent } from "./content/index";
+import { applyFieldAccess } from "./security/access";
+import { sanitizeHtml } from "./security/sanitize";
+function prisma(ctx) {
+    return ctx.db;
+}
+async function fireWebhook(event, data) {
+    try {
+        const { dispatch } = await import('./webhooks/index');
+        dispatch(event, data).catch((err) => {
+            console.error(`[actuate] Webhook dispatch failed for ${event}:`, err);
+        });
+    }
+    catch (err) {
+        console.error(`[actuate] Webhook module import failed:`, err);
+    }
+}
+async function firePluginHooks(event, doc, ctx) {
+    try {
+        const config = globalThis.__actuateConfig;
+        const hooks = config?._pluginHooks ?? [];
+        const matching = hooks.filter((h) => h.event === event);
+        for (const hook of matching) {
+            try {
+                await hook.handler(doc);
+            }
+            catch (err) {
+                console.error(`[actuate] Plugin hook "${event}" error:`, err);
+            }
+        }
+        if (doc.data && typeof doc.data === 'object') {
+            const docData = doc.data;
+            const hasAiUpdates = docData._aiScore !== undefined || docData._embedding !== undefined;
+            if (hasAiUpdates && doc.id) {
+                const db = prisma(ctx);
+                await db.document.update({
+                    where: { id: doc.id },
+                    data: { data: docData },
+                }).catch((err) => {
+                    console.error(`[actuate] Failed to persist plugin hook data:`, err);
+                });
+            }
+        }
+    }
+    catch (err) {
+        console.error(`[actuate] Plugin hooks dispatch failed:`, err);
+    }
+}
+function getCollectionFields(collection) {
+    const config = globalThis.__actuateConfig?.collections?.[collection];
+    return config?.fields ?? null;
+}
+async function checkCollectionAccess(collection, operation, ctx, doc) {
+    const collectionConfig = globalThis.__actuateConfig?.collections?.[collection];
+    const accessFn = collectionConfig?.access?.[operation];
+    if (!accessFn)
+        return;
+    const user = ctx.userId ? { id: ctx.userId, role: ctx.role } : null;
+    const allowed = await accessFn({ user, doc });
+    if (!allowed) {
+        throw new Error(`Access denied: cannot ${operation} in collection "${collection}"`);
+    }
+}
+function sanitizeDocumentData(data, collection) {
+    const config = globalThis.__actuateConfig?.collections?.[collection];
+    const fields = config?.fields ?? {};
+    const result = { ...data };
+    for (const [key, value] of Object.entries(result)) {
+        if (typeof value !== 'string')
+            continue;
+        const fieldDef = fields[key];
+        if (fieldDef?.type === 'richText') {
+            result[key] = sanitizeHtml(value);
+        }
+    }
+    return result;
+}
+async function computeTextFields(data) {
+    const serialized = JSON.stringify(data);
+    const plainText = extractPlainText(serialized);
+    const contentHash = await hashContent(serialized);
+    return { plainText, contentHash };
+}
+/** Create a new document in a collection. */
+export async function createDocument(collection, data, ctx) {
+    await checkCollectionAccess(collection, 'create', ctx);
+    const db = prisma(ctx);
+    const user = { id: ctx.userId, role: ctx.role };
+    const fields = getCollectionFields(collection);
+    const accessFiltered = fields
+        ? await applyFieldAccess("write", fields, data, user)
+        : data;
+    const filteredData = sanitizeDocumentData(accessFiltered, collection);
+    const { plainText, contentHash } = await computeTextFields(filteredData);
+    return db.$transaction(async (tx) => {
+        const doc = await tx.document.create({
+            data: {
+                collection,
+                title: typeof filteredData.title === 'string' ? filteredData.title : null,
+                slug: typeof filteredData.slug === 'string' ? filteredData.slug : null,
+                data: filteredData,
+                status: "DRAFT",
+                locale: ctx.locale ?? null,
+                createdById: ctx.userId,
+                updatedById: ctx.userId,
+                plainText,
+                contentHash,
+            },
+        });
+        await tx.version.create({
+            data: {
+                documentId: doc.id,
+                data: filteredData,
+                changedById: ctx.userId,
+                changeType: "CREATE",
+            },
+        });
+        fireWebhook('document.created', { id: doc.id, collection, title: doc.title, slug: doc.slug });
+        firePluginHooks('afterCreate', doc, ctx);
+        return doc;
+    });
+}
+/** Update an existing document. Merges incoming data with existing to prevent field loss. */
+export async function updateDocument(collection, id, data, ctx) {
+    await checkCollectionAccess(collection, 'update', ctx);
+    const db = prisma(ctx);
+    const user = { id: ctx.userId, role: ctx.role };
+    const existing = await db.document.findFirst({
+        where: { id, collection, deletedAt: null },
+    });
+    if (!existing) {
+        throw new Error(`Document "${id}" not found in collection "${collection}"`);
+    }
+    const existingData = (existing.data && typeof existing.data === 'object')
+        ? existing.data
+        : {};
+    const mergedData = { ...existingData, ...data };
+    const fields = getCollectionFields(collection);
+    const accessFiltered = fields
+        ? await applyFieldAccess("write", fields, mergedData, user)
+        : mergedData;
+    const filteredData = sanitizeDocumentData(accessFiltered, collection);
+    const { plainText, contentHash } = await computeTextFields(filteredData);
+    const status = typeof filteredData.status === 'string' ? filteredData.status : undefined;
+    return db.$transaction(async (tx) => {
+        const updated = await tx.document.update({
+            where: { id },
+            data: {
+                title: typeof filteredData.title === 'string' ? filteredData.title : undefined,
+                slug: typeof filteredData.slug === 'string' ? filteredData.slug : undefined,
+                data: filteredData,
+                updatedById: ctx.userId,
+                plainText,
+                contentHash,
+                ...(status ? { status } : {}),
+                ...(status === 'PUBLISHED' ? { publishedAt: new Date() } : {}),
+            },
+        });
+        await tx.version.create({
+            data: {
+                documentId: id,
+                data: filteredData,
+                changedById: ctx.userId,
+                changeType: "UPDATE",
+            },
+        });
+        const webhookEvent = status === 'PUBLISHED' ? 'document.published' : 'document.updated';
+        fireWebhook(webhookEvent, { id, collection, title: updated.title, slug: updated.slug, status: status ?? existing.status });
+        firePluginHooks('afterUpdate', updated, ctx);
+        return updated;
+    });
+}
+/** Soft-delete a document. Creates a version snapshot before deletion. */
+export async function deleteDocument(collection, id, ctx) {
+    await checkCollectionAccess(collection, 'delete', ctx);
+    const db = prisma(ctx);
+    const existing = await db.document.findFirst({
+        where: { id, collection, deletedAt: null },
+    });
+    if (!existing) {
+        throw new Error(`Document "${id}" not found in collection "${collection}"`);
+    }
+    await db.$transaction(async (tx) => {
+        await tx.version.create({
+            data: {
+                documentId: id,
+                data: existing.data ?? {},
+                changedById: ctx.userId,
+                changeType: 'DELETE',
+            },
+        });
+        await tx.document.update({
+            where: { id },
+            data: { deletedAt: new Date() },
+        });
+        fireWebhook('document.deleted', { id, collection, title: existing.title, slug: existing.slug });
+    });
+}
+/** Retrieve a single document by ID. */
+export async function getDocument(collection, id, ctx) {
+    const db = prisma(ctx);
+    const doc = await db.document.findFirst({
+        where: { id, collection, deletedAt: null },
+    });
+    if (!doc)
+        return null;
+    const fields = getCollectionFields(collection);
+    if (fields && doc.data && typeof doc.data === "object") {
+        const user = { id: ctx.userId, role: ctx.role };
+        return {
+            ...doc,
+            data: await applyFieldAccess("read", fields, doc.data, user),
+        };
+    }
+    return doc;
+}
+/** List documents with pagination, sorting, and filtering. */
+export async function listDocuments(options, ctx) {
+    const db = prisma(ctx);
+    const page = options.page ?? 1;
+    const pageSize = options.pageSize ?? 20;
+    const skip = (page - 1) * pageSize;
+    const where = {
+        collection: options.collection,
+        deletedAt: null,
+    };
+    if (options.status) {
+        where.status = options.status;
+    }
+    if (options.locale) {
+        where.locale = options.locale;
+    }
+    if (options.folderId === 'none') {
+        where.folderId = null;
+    }
+    else if (options.folderId) {
+        where.folderId = options.folderId;
+    }
+    const ALLOWED_FILTERS = new Set([
+        'status', 'locale', 'collection', 'siteId', 'templateId', 'folderId',
+    ]);
+    if (options.filters) {
+        for (const [key, value] of Object.entries(options.filters)) {
+            if (ALLOWED_FILTERS.has(key) && typeof value !== 'object') {
+                where[key] = value;
+            }
+        }
+    }
+    const ALLOWED_SORT = new Set([
+        'createdAt', 'updatedAt', 'publishedAt', 'status', 'collection',
+    ]);
+    const orderBy = {};
+    const sortField = ALLOWED_SORT.has(options.sort ?? '') ? options.sort : 'createdAt';
+    orderBy[sortField] = options.order ?? "desc";
+    const [rawDocs, total] = await Promise.all([
+        db.document.findMany({
+            where,
+            skip,
+            take: pageSize,
+            orderBy,
+        }),
+        db.document.count({ where }),
+    ]);
+    const fields = getCollectionFields(options.collection);
+    let docs = rawDocs;
+    if (fields) {
+        const user = { id: ctx.userId, role: ctx.role };
+        docs = await Promise.all(rawDocs.map(async (doc) => {
+            if (doc.data && typeof doc.data === "object") {
+                return {
+                    ...doc,
+                    data: await applyFieldAccess("read", fields, doc.data, user),
+                };
+            }
+            return doc;
+        }));
+    }
+    return {
+        docs,
+        total,
+        page,
+        pageSize,
+        totalPages: Math.ceil(total / pageSize),
+    };
+}
+/** Duplicate a document, resetting status to DRAFT and appending "(Copy)" to the title. */
+export async function duplicateDocument(collection, sourceId, ctx) {
+    const db = prisma(ctx);
+    const source = await db.document.findFirst({
+        where: { id: sourceId, collection, deletedAt: null },
+    });
+    if (!source) {
+        throw new Error(`Source document "${sourceId}" not found in collection "${collection}"`);
+    }
+    const clonedData = { ...source.data };
+    if (typeof clonedData.title === "string") {
+        clonedData.title += " (Copy)";
+    }
+    else if (typeof clonedData.name === "string") {
+        clonedData.name += " (Copy)";
+    }
+    if (typeof clonedData.slug === "string") {
+        clonedData.slug += "-copy";
+    }
+    const { plainText, contentHash } = await computeTextFields(clonedData);
+    return db.$transaction(async (tx) => {
+        const doc = await tx.document.create({
+            data: {
+                collection,
+                data: clonedData,
+                status: "DRAFT",
+                locale: source.locale,
+                createdById: ctx.userId,
+                updatedById: ctx.userId,
+                plainText,
+                contentHash,
+                siteId: source.siteId,
+                templateId: source.templateId,
+            },
+        });
+        await tx.version.create({
+            data: {
+                documentId: doc.id,
+                data: clonedData,
+                changedById: ctx.userId,
+                changeType: "CREATE",
+            },
+        });
+        return doc;
+    });
+}
+/** Retrieve a global's data. Globals are stored as single-row collections keyed by slug. */
+export async function getGlobal(slug, ctx) {
+    const db = prisma(ctx);
+    return db.document.findFirst({
+        where: { collection: slug, deletedAt: null },
+    });
+}
+/** Update a global's data. Creates the document if it doesn't exist (upsert). */
+export async function updateGlobal(slug, data, ctx) {
+    const db = prisma(ctx);
+    const { plainText, contentHash } = await computeTextFields(data);
+    const existing = await db.document.findFirst({
+        where: { collection: slug, deletedAt: null },
+    });
+    if (existing) {
+        return db.$transaction(async (tx) => {
+            const updated = await tx.document.update({
+                where: { id: existing.id },
+                data: {
+                    data,
+                    updatedById: ctx.userId,
+                    plainText,
+                    contentHash,
+                },
+            });
+            await tx.version.create({
+                data: {
+                    documentId: existing.id,
+                    data,
+                    changedById: ctx.userId,
+                    changeType: "UPDATE",
+                },
+            });
+            return updated;
+        });
+    }
+    return db.$transaction(async (tx) => {
+        const created = await tx.document.create({
+            data: {
+                collection: slug,
+                data,
+                status: "DRAFT",
+                createdById: ctx.userId,
+                updatedById: ctx.userId,
+                plainText,
+                contentHash,
+            },
+        });
+        await tx.version.create({
+            data: {
+                documentId: created.id,
+                data,
+                changedById: ctx.userId,
+                changeType: "CREATE",
+            },
+        });
+        return created;
+    });
+}
+//# sourceMappingURL=actions.js.map