@beechcms/core 0.7.0 → 0.8.0

package/dist/search/vector-extractor.js

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+import { indexableSearchBranches } from '../engine/ddl.js';
+/**
+ * Extracts and concatenates text from all public indexable text/richtext branches of a seed.
+ * Enforces privacy policies by utilizing indexableSearchBranches.
+ *
+ * @param seed The seed definition.
+ * @param entry The content entry record.
+ * @returns The combined text, or null if no indexable text exists.
+ */
+export function extractIndexableText(seed, entry) {
+    const branches = indexableSearchBranches(seed);
+    if (branches.length === 0)
+        return null;
+    const texts = [];
+    for (const branch of branches) {
+        const val = entry[branch.alias];
+        if (val && typeof val === 'string') {
+            texts.push(val);
+        }
+    }
+    const combined = texts.join(' ').trim();
+    return combined.length > 0 ? combined : null;
+}

package/dist/search/vector.repository.d.ts

@@ -0,0 +1,13 @@
+import type { Seed } from '../engine/types.js';
+export interface IVectorRepository {
+    /** Saves or updates the embedding vector for an entry */
+    saveVector(seed: Seed, entryId: string, vector: Float32Array): Promise<void>;
+    /** Removes the embedding vector (used when unpublished/deleted) */
+    deleteVector(seed: Seed, entryId: string): Promise<void>;
+    /** Retrieves all vectors for a given seed to compile to R2 */
+    getAllVectors(seed: Seed): Promise<{
+        entryId: string;
+        vector: Float32Array;
+    }[]>;
+}
+//# sourceMappingURL=vector.repository.d.ts.map

package/dist/search/vector.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vector.repository.d.ts","sourceRoot":"","sources":["../../src/search/vector.repository.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAE9C,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE5E,mEAAmE;IACnE,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAExD,8DAA8D;IAC9D,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,YAAY,CAAA;KAAE,EAAE,CAAC,CAAA;CAChF"}

package/dist/search/vector.repository.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+export {};

package/dist/security/time-trap-token.repository.d.ts

@@ -0,0 +1,9 @@
+export interface ITimeTrapTokenRepository {
+    /** Checks if a time-trap token hash has already been consumed. */
+    isTokenUsed(tokenHash: string): Promise<boolean>;
+    /** Marks a time-trap token hash as consumed with an expiration timestamp. */
+    markTokenUsed(tokenHash: string, usedAt: number, expiresAt: number): Promise<void>;
+    /** Cleans up expired token entries. */
+    cleanup(nowSeconds: number): Promise<void>;
+}
+//# sourceMappingURL=time-trap-token.repository.d.ts.map

package/dist/security/time-trap-token.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"time-trap-token.repository.d.ts","sourceRoot":"","sources":["../../src/security/time-trap-token.repository.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,wBAAwB;IACvC,kEAAkE;IAClE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAChD,6EAA6E;IAC7E,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClF,uCAAuC;IACvC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3C"}

package/dist/security/time-trap-token.repository.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+export {};

package/dist/security/time-trap.d.ts

@@ -0,0 +1,7 @@
+export declare function generateTimeTrapToken(secret: string, timestampSeconds?: number): Promise<string>;
+export declare function verifyTimeTrapToken(token: string, secret: string, minDeltaSeconds?: number, maxAgeSeconds?: number): Promise<{
+    valid: boolean;
+    reason?: string;
+    elapsedSeconds?: number;
+}>;
+//# sourceMappingURL=time-trap.d.ts.map

package/dist/security/time-trap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"time-trap.d.ts","sourceRoot":"","sources":["../../src/security/time-trap.ts"],"names":[],"mappings":"AAaA,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOtG;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,eAAe,GAAE,MAAY,EAC7B,aAAa,GAAE,MAAa,GAC3B,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAyCvE"}

package/dist/security/time-trap.js

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+async function getHmacKey(secret) {
+    return crypto.subtle.importKey('raw', new TextEncoder().encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign', 'verify']);
+}
+export async function generateTimeTrapToken(secret, timestampSeconds) {
+    const t0 = timestampSeconds ?? Math.floor(Date.now() / 1000);
+    const payload = `t0_${t0}`;
+    const key = await getHmacKey(secret);
+    const signature = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(payload));
+    const sigHex = Array.from(new Uint8Array(signature)).map(b => b.toString(16).padStart(2, '0')).join('');
+    return `${payload}.${sigHex}`;
+}
+export async function verifyTimeTrapToken(token, secret, minDeltaSeconds = 1.5, maxAgeSeconds = 3600) {
+    if (!token || typeof token !== 'string') {
+        return { valid: false, reason: 'Missing or invalid token format' };
+    }
+    const parts = token.split('.');
+    if (parts.length !== 2) {
+        return { valid: false, reason: 'Malformed token structure' };
+    }
+    const [payload, sigHex] = parts;
+    if (!payload.startsWith('t0_')) {
+        return { valid: false, reason: 'Invalid token prefix' };
+    }
+    const t0 = Number.parseInt(payload.slice(3), 10);
+    if (!Number.isFinite(t0)) {
+        return { valid: false, reason: 'Invalid timestamp value' };
+    }
+    const hexMatches = sigHex.match(/.{1,2}/g);
+    if (!hexMatches || hexMatches.length !== 32) {
+        return { valid: false, reason: 'Invalid signature encoding' };
+    }
+    const key = await getHmacKey(secret);
+    const sigBytes = new Uint8Array(hexMatches.map(byte => parseInt(byte, 16)));
+    const isValidSig = await crypto.subtle.verify('HMAC', key, sigBytes, new TextEncoder().encode(payload));
+    if (!isValidSig) {
+        return { valid: false, reason: 'Cryptographic signature mismatch' };
+    }
+    const now = Date.now() / 1000;
+    const elapsed = now - t0;
+    if (elapsed < minDeltaSeconds) {
+        return { valid: false, reason: `Submission too fast (${elapsed.toFixed(2)}s < ${minDeltaSeconds}s)`, elapsedSeconds: elapsed };
+    }
+    if (elapsed > maxAgeSeconds) {
+        return { valid: false, reason: `Token expired (${elapsed.toFixed(0)}s > ${maxAgeSeconds}s)`, elapsedSeconds: elapsed };
+    }
+    return { valid: true, elapsedSeconds: elapsed };
+}

package/dist/webhook-crypto.d.ts

@@ -1,5 +1,7 @@
 /** Signs a raw request body. Returns `sha256=<hex>`. */
 export declare function signWebhookBody(body: string, secret: string): Promise<string>;
+/** Constant-time comparison of two equal-or-unequal-length strings. */
+export declare function timingSafeEqual(a: string, b: string): boolean;
 /**
  * Verifies an inbound signature against the recomputed HMAC.
  * Accepts the `sha256=` prefix on the provided signature (optional).

package/dist/webhook-crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-crypto.d.ts","sourceRoot":"","sources":["../src/webhook-crypto.ts"],"names":[],"mappings":"AAqBA,wDAAwD;AACxD,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAInF;AAUD;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAKlB"}
+{"version":3,"file":"webhook-crypto.d.ts","sourceRoot":"","sources":["../src/webhook-crypto.ts"],"names":[],"mappings":"AAqBA,wDAAwD;AACxD,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAInF;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAK7D;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAKlB"}

package/dist/webhook-crypto.js

@@ -15,8 +15,8 @@ export async function signWebhookBody(body, secret) {
     const sig = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(body));
     return SIG_PREFIX + toHex(sig);
 }
-/** Constant-time comparison of two equal-or-unequal-length hex strings. */
-function timingSafeEqual(a, b) {
+/** Constant-time comparison of two equal-or-unequal-length strings. */
+export function timingSafeEqual(a, b) {
     if (a.length !== b.length)
         return false;
     let mismatch = 0;

package/dist/webhooks/webhook-crypto.d.ts

@@ -1,5 +1,7 @@
 /** Signs a raw request body. Returns `sha256=<hex>`. */
 export declare function signWebhookBody(body: string, secret: string): Promise<string>;
+/** Constant-time comparison of two equal-or-unequal-length strings. */
+export declare function timingSafeEqual(a: string, b: string): boolean;
 /**
  * Verifies an inbound signature against the recomputed HMAC.
  * Accepts the `sha256=` prefix on the provided signature (optional).

package/dist/webhooks/webhook-crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-crypto.d.ts","sourceRoot":"","sources":["../../src/webhooks/webhook-crypto.ts"],"names":[],"mappings":"AAqBA,wDAAwD;AACxD,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAInF;AAUD;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAKlB"}
+{"version":3,"file":"webhook-crypto.d.ts","sourceRoot":"","sources":["../../src/webhooks/webhook-crypto.ts"],"names":[],"mappings":"AAqBA,wDAAwD;AACxD,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAInF;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAK7D;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAKlB"}

package/dist/webhooks/webhook-crypto.js

@@ -15,8 +15,8 @@ export async function signWebhookBody(body, secret) {
     const sig = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(body));
     return SIG_PREFIX + toHex(sig);
 }
-/** Constant-time comparison of two equal-or-unequal-length hex strings. */
-function timingSafeEqual(a, b) {
+/** Constant-time comparison of two equal-or-unequal-length strings. */
+export function timingSafeEqual(a, b) {
     if (a.length !== b.length)
         return false;
     let mismatch = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beechcms/core",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -13,6 +13,10 @@
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
     },
+    "./richtext-render": {
+      "import": "./dist/content/richtext/richtext-render.js",
+      "types": "./dist/content/richtext/richtext-render.d.ts"
+    },
     "./webhook-crypto": {
       "import": "./dist/webhooks/webhook-crypto.js",
       "types": "./dist/webhooks/webhook-crypto.d.ts"
@@ -24,17 +28,21 @@
     "vitest": "^4.1.0"
   },
   "dependencies": {
-    "@tiptap/core": "^3.22.3",
-    "@tiptap/extension-highlight": "^3.22.3",
-    "@tiptap/extension-image": "^3.22.3",
-    "@tiptap/extension-link": "^3.22.3",
-    "@tiptap/extension-mathematics": "^3.22.3",
-    "@tiptap/extension-subscript": "^3.22.3",
-    "@tiptap/extension-superscript": "^3.22.3",
-    "@tiptap/extension-table": "^3.22.3",
-    "@tiptap/extension-text-align": "^3.22.3",
-    "@tiptap/html": "^3.22.3",
-    "@tiptap/starter-kit": "^3.22.3",
+    "@tiptap/core": "^3.31.3",
+    "@tiptap/extension-color": "^3.31.3",
+    "@tiptap/extension-highlight": "^3.31.3",
+    "@tiptap/extension-image": "^3.31.3",
+    "@tiptap/extension-link": "^3.31.3",
+    "@tiptap/extension-list": "^3.31.3",
+    "@tiptap/extension-mathematics": "^3.31.3",
+    "@tiptap/extension-subscript": "^3.31.3",
+    "@tiptap/extension-superscript": "^3.31.3",
+    "@tiptap/extension-table": "^3.31.3",
+    "@tiptap/extension-text-align": "^3.31.3",
+    "@tiptap/extension-text-style": "^3.31.3",
+    "@tiptap/extension-underline": "^3.31.3",
+    "@tiptap/html": "^3.31.3",
+    "@tiptap/starter-kit": "^3.31.3",
     "katex": "^0.16.11",
     "zod": "^4.3.6"
   },