@beechcms/core 0.8.1 → 0.9.0

package/dist/rate-limit/token-bucket-rate-limiter.js

@@ -7,27 +7,90 @@ export class TokenBucketRateLimiter {
     refillRatePerSecond;
     clock;
     maxIdleTimeSeconds;
+    maxBuckets;
+    pruneIntervalSeconds;
+    lastPruneTimestamp = 0;
     constructor(options) {
         this.capacity = options?.capacity ?? 17;
         // Default: 1 token every 3.53 seconds (~0.283286 tokens/sec)
         this.refillRatePerSecond = options?.refillRatePerSecond ?? (1 / 3.53);
         this.clock = options?.clock ?? SystemClock;
         this.maxIdleTimeSeconds = options?.maxIdleTimeSeconds ?? 3600; // 1 hour idle TTL
+        this.maxBuckets = options?.maxBuckets ?? 5000; // Prevent unbounded memory growth
+        this.pruneIntervalSeconds = options?.pruneIntervalSeconds ?? 60; // Throttle O(n) scans
     }
+    // Bound the eviction scan so a flood of unique keys (each forcing an eviction attempt)
+    // cannot turn checkLimit into an O(maxBuckets) operation per request. Only the oldest
+    // slice of the map is examined; if nothing there qualifies, admission of the new key is
+    // denied instead of evicting something it shouldn't (see below).
+    static MAX_EVICTION_SCAN = 32;
     pruneExpiredBuckets(now) {
         if (this.buckets.size < 500)
             return;
+        if (now - this.lastPruneTimestamp < this.pruneIntervalSeconds)
+            return;
+        this.lastPruneTimestamp = now;
         for (const [key, state] of this.buckets.entries()) {
             if (now - state.lastRefillTimestamp > this.maxIdleTimeSeconds) {
                 this.buckets.delete(key);
             }
+            else {
+                // Since Map preserves insertion order and checkLimit re-inserts on every access,
+                // entries are monotonically ordered by lastRefillTimestamp. The first non-expired
+                // entry guarantees all subsequent entries are also active, allowing an immediate O(1) exit.
+                break;
+            }
         }
     }
+    // Evicts the oldest bucket ONLY if it has refilled to full capacity, in which case it is
+    // behaviourally equivalent to an absent bucket and dropping it loses no state. A bucket
+    // that hasn't refilled — including one sitting at 0 tokens and actively blocking its key —
+    // is never evicted: doing so would let an attacker flood distinct keys to silently reset a
+    // victim's exhausted bucket and bypass its limit (#458).
+    //
+    // When nothing in the scanned slice is eligible, the caller must not admit a new bucket
+    // anyway (#634) — that would make the map grow without bound under a distinct-key flood.
+    // Instead, report how long until the earliest-refilling scanned bucket would become a
+    // legitimate eviction candidate, so the caller can deny admission with a meaningful
+    // retryAfterSeconds rather than guessing.
+    evictRefilledBucket(now) {
+        let scanned = 0;
+        let minSecondsUntilRefilled = this.maxIdleTimeSeconds;
+        for (const [key, state] of this.buckets.entries()) {
+            if (scanned >= TokenBucketRateLimiter.MAX_EVICTION_SCAN)
+                break;
+            scanned++;
+            const elapsed = Math.max(0, now - state.lastRefillTimestamp);
+            const refilled = Math.min(this.capacity, state.tokens + elapsed * this.refillRatePerSecond);
+            if (refilled >= this.capacity) {
+                this.buckets.delete(key);
+                return { evicted: true, retryAfterSeconds: 0 };
+            }
+            if (this.refillRatePerSecond > 0) {
+                const secondsUntilRefilled = (this.capacity - refilled) / this.refillRatePerSecond;
+                minSecondsUntilRefilled = Math.min(minSecondsUntilRefilled, secondsUntilRefilled);
+            }
+        }
+        return { evicted: false, retryAfterSeconds: Math.max(1, Math.ceil(minSecondsUntilRefilled)) };
+    }
     async checkLimit(key) {
         const now = this.clock.now() / 1000; // fractional seconds for continuous refill
         this.pruneExpiredBuckets(now);
         let bucket = this.buckets.get(key);
         if (!bucket) {
+            if (this.buckets.size >= this.maxBuckets) {
+                const { evicted, retryAfterSeconds } = this.evictRefilledBucket(now);
+                if (!evicted) {
+                    // No safe eviction candidate: admitting a bucket for this never-seen key would
+                    // grow the map past maxBuckets. Deny it instead of allocating state (#634).
+                    return {
+                        isAllowed: false,
+                        retryAfterSeconds,
+                        limit: this.capacity,
+                        remaining: 0,
+                    };
+                }
+            }
             bucket = {
                 tokens: this.capacity,
                 lastRefillTimestamp: now,
@@ -37,6 +100,8 @@ export class TokenBucketRateLimiter {
             const elapsed = Math.max(0, now - bucket.lastRefillTimestamp);
             bucket.tokens = Math.min(this.capacity, bucket.tokens + elapsed * this.refillRatePerSecond);
             bucket.lastRefillTimestamp = now;
+            // Re-insert to maintain LRU access order
+            this.buckets.delete(key);
         }
         if (bucket.tokens >= 1) {
             bucket.tokens -= 1;
@@ -59,5 +124,6 @@ export class TokenBucketRateLimiter {
     }
     reset() {
         this.buckets.clear();
+        this.lastPruneTimestamp = 0;
     }
 }

package/dist/rbac/invitation.repository.d.ts

@@ -1,3 +1,5 @@
+import type { NewUserInput } from '../auth/user.repository.js';
+import type { PageRequest } from './types.js';
 import type { Scope } from './permissions.js';
 /** One invitation row. `tokenHash` is deliberately absent: nothing above the storage
  *  boundary ever needs it, and an administration listing must not carry credential
@@ -10,7 +12,7 @@ export interface InvitationRecord {
     invitedBy: string;
     expiresAt: number;
     createdAt: number;
-    /** Non-null once redeemed. Single-use is enforced by {@link IInvitationRepository.markUsed}. */
+    /** Non-null once redeemed. Single-use is enforced by {@link IInvitationRepository.redeem}. */
     usedAt: number | null;
 }
 export interface NewInvitationInput {
@@ -29,6 +31,15 @@ export interface ValidatedInvitation {
     scope: Scope;
     invitedBy: string;
 }
+/** What {@link IInvitationRepository.redeem} writes in one transaction. */
+export interface InvitationRedemption {
+    invitationId: string;
+    user: NewUserInput;
+    assignmentId: string;
+    roleId: string;
+    scope: Scope;
+    usedAt: number;
+}
 /**
  * Storage contract for onboarding invitations.
  *
@@ -37,9 +48,11 @@ export interface ValidatedInvitation {
  * exactly one shape for it.
  */
 export interface IInvitationRepository {
-    /** Consumes every pending invitation for an email before a new one is issued, so at
-     *  most one live token per address exists at any time. */
-    invalidatePending(email: string, nowTimestamp: number): Promise<void>;
+    /** Deletes every unredeemed invitation for an email before a new one is issued, so at
+     *  most one live token per address exists at any time. They are removed, not marked
+     *  used: `used_at` means "redeemed", and a superseded row must never be reported as
+     *  accepted. */
+    supersedePending(email: string): Promise<void>;
     /** Stores a new invitation. Only the hash is persisted, never the plaintext.
      *  Returns the new invitation id. */
     create(input: NewInvitationInput): Promise<string>;
@@ -47,15 +60,20 @@ export interface IInvitationRepository {
      *  expired, already used and unknown are deliberately indistinguishable. */
     findValidByHash(tokenHash: string, nowTimestamp: number): Promise<ValidatedInvitation | null>;
     /**
-     * Consumes an invitation. Returns TRUE only when THIS call performed the transition
-     * (`used_at IS NULL` at write time), which is what makes redemption single-use under
-     * concurrency. A second concurrent redeem gets false and must be refused.
+     * Redeems an invitation: creates the account, writes its (role, scope) assignment and
+     * consumes the invitation in ONE atomic write. Either all three land or none does, so a
+     * failure can neither burn the invitation nor leave an account without its role.
+     *
+     * Returns TRUE only when THIS call performed the transition (`used_at IS NULL` at write
+     * time), which is what makes redemption single-use under concurrency; FALSE means the
+     * invitation was consumed or revoked meanwhile and nothing was written. Throws when the
+     * email is already registered (UNIQUE), writing nothing.
      */
-    markUsed(invitationId: string, nowTimestamp: number): Promise<boolean>;
+    redeem(input: InvitationRedemption): Promise<boolean>;
     /** One invitation by id, regardless of state. Null when absent. */
     findById(invitationId: string): Promise<InvitationRecord | null>;
-    /** Every invitation, newest first. Administration tables are small by nature. */
-    listAll(): Promise<InvitationRecord[]>;
+    /** One page of invitations, newest first. */
+    list(page: PageRequest): Promise<InvitationRecord[]>;
     /** Replaces the token and expiry of an existing PENDING-or-EXPIRED invitation,
      *  preserving its (role, scope, email) pre-assignment. Returns false when the row is
      *  absent or already used — a consumed invitation is never re-armed. */

package/dist/rbac/invitation.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invitation.repository.d.ts","sourceRoot":"","sources":["../../src/rbac/invitation.repository.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAE7C;;oEAEoE;AACpE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,gGAAgG;IAChG,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC;8DAC0D;IAC1D,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAErE;yCACqC;IACrC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAElD;gFAC4E;IAC5E,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;IAE7F;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAEtE,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IAEhE,iFAAiF;IACjF,OAAO,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IAEtC;;4EAEwE;IACxE,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAExF,iFAAiF;IACjF,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC/C"}
+{"version":3,"file":"invitation.repository.d.ts","sourceRoot":"","sources":["../../src/rbac/invitation.repository.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAE7C;;oEAEoE;AACpE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,8FAA8F;IAC9F,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,YAAY,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;oBAGgB;IAChB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE9C;yCACqC;IACrC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAElD;gFAC4E;IAC5E,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;IAE7F;;;;;;;;;OASG;IACH,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAErD,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IAEhE,6CAA6C;IAC7C,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IAEpD;;4EAEwE;IACxE,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAExF,iFAAiF;IACjF,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC/C"}

package/dist/rbac/types.d.ts

@@ -41,6 +41,22 @@ export interface EffectivePermissions {
     /** Permissions held at a specific seed slug, keyed by that slug. */
     byScope: ReadonlyMap<Scope, ReadonlySet<Permission>>;
 }
+/** One page of an administration listing. `limit` is at most {@link MAX_PAGE_SIZE}. */
+export interface PageRequest {
+    limit: number;
+    offset: number;
+}
+/** Largest page the administration listings serve. Keeps every `IN (...)` fan-out under D1's bound-parameter cap. */
+export declare const MAX_PAGE_SIZE = 100;
+/**
+ * Outcome of a write that must never remove the platform's last active global
+ * administrator. The repository enforces the invariant inside the write itself (one
+ * conditional statement), so two concurrent requests cannot both pass a stale count.
+ * - `applied`: the write happened.
+ * - `not-found`: the target does not exist (or is an immutable system role); nothing changed.
+ * - `last-global-admin`: refused because it would leave no other active global administrator.
+ */
+export type AdminGuardedResult = 'applied' | 'not-found' | 'last-global-admin';
 /** Storage contract for roles and their permission bundles. */
 export interface IRoleRepository {
     /** Retrieves a role with its permissions, or null when it does not exist. */
@@ -54,17 +70,19 @@ export interface IRoleRepository {
     /**
      * Replaces a role's name, description and full permission set atomically.
      *
-     * Returns false — changing NOTHING, permissions included — when the role does not
-     * exist or is a system role. System roles are seeded by migration and are immutable
-     * in both halves of the write, which is the guarantee callers rely on to keep
-     * `SuperAdmin` intact.
+     * `not-found` — changing NOTHING, permissions included — when the role does not exist or
+     * is a system role. System roles are seeded by migration and are immutable in both halves
+     * of the write, which is the guarantee callers rely on to keep `SuperAdmin` intact.
+     * `last-global-admin` when the new set drops `manage_users` from a role that carries the
+     * last active global administrator; nothing is written then either.
      */
-    update(roleId: string, input: NewRoleInput): Promise<boolean>;
+    update(roleId: string, input: NewRoleInput): Promise<AdminGuardedResult>;
     /**
      * Deletes a non-system role and, by cascade, its permissions and assignments.
-     * Returns false when the role does not exist or is a system role.
+     * `not-found` when the role does not exist or is a system role; `last-global-admin` when
+     * the role carries the last active global administrator.
      */
-    delete(roleId: string): Promise<boolean>;
+    delete(roleId: string): Promise<AdminGuardedResult>;
 }
 /** Storage contract for (user, role, scope) assignments. */
 export interface IRoleAssignmentRepository {
@@ -80,39 +98,33 @@ export interface IRoleAssignmentRepository {
     listByRole(roleId: string): Promise<PermissionAssignment[]>;
     /** Creates an assignment. Returns its id; an existing identical triple is a no-op. */
     create(input: NewAssignmentInput): Promise<string>;
-    /** Removes one assignment. Returns false when it did not exist. */
-    delete(assignmentId: string): Promise<boolean>;
     /**
-     * Counts accounts holding `manage_users` at {@link GLOBAL_SCOPE} and still active.
-     * Backs the last-SuperAdmin guardrail consumed by a later sprint.
+     * Removes one assignment. `not-found` when it did not exist; `last-global-admin` when it is
+     * the global `manage_users` assignment of the last active global administrator.
+     */
+    delete(assignmentId: string): Promise<AdminGuardedResult>;
+    /**
+     * Read-only twin of the {@link delete} guard: would removing this assignment leave no
+     * other active global administrator? ADVISORY — it only lets a caller that refuses for
+     * another reason (the Developer account) report the more fundamental one; it is never a
+     * substitute for the guard inside {@link delete}.
      */
-    countActiveGlobalAdmins(): Promise<number>;
+    isLastGlobalAdminAssignment(assignmentId: string): Promise<boolean>;
     /** One assignment by id, decay filter NOT applied. Null when absent. */
     findById(assignmentId: string): Promise<PermissionAssignment | null>;
     /**
-     * Every assignment in the system, decay filter NOT applied.
+     * Every assignment of the given users, decay filter NOT applied, in ONE round trip.
      *
-     * Exists so the account-list endpoint can resolve each account's scopes in ONE round
-     * trip instead of one query per account. Administration tables are small by nature;
-     * content never flows through here.
+     * Exists so the account-list endpoint can resolve the scopes of one page of accounts
+     * without a query per account. Callers pass at most {@link MAX_PAGE_SIZE} ids (D1 caps
+     * bound parameters per statement); an empty list returns an empty list.
      */
-    listAll(): Promise<PermissionAssignment[]>;
+    listForUsers(userIds: readonly string[]): Promise<PermissionAssignment[]>;
     /**
      * Every assignment of one user, decay filter NOT applied — administration screens must
      * see (and be able to remove) a row whose seed is currently deleted, which
      * {@link listActiveForUser} deliberately hides.
      */
     listAllForUser(userId: string): Promise<PermissionAssignment[]>;
-    /**
-     * {@link countActiveGlobalAdmins} ignoring one user. `0` means that user is the last
-     * account able to administer the platform, and any operation revoking their authority
-     * must be refused.
-     */
-    countActiveGlobalAdminsExcludingUser(userId: string): Promise<number>;
-    /**
-     * {@link countActiveGlobalAdmins} ignoring every assignment that goes through one role.
-     * `0` means mutating that role would strip the platform of its last administrator.
-     */
-    countActiveGlobalAdminsExcludingRole(roleId: string): Promise<number>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/rbac/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/rbac/types.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAEzD,sDAAsD;AACtD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,qFAAqF;IACrF,QAAQ,EAAE,OAAO,CAAA;IACjB,4FAA4F;IAC5F,WAAW,EAAE,UAAU,EAAE,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,WAAW,EAAE,SAAS,UAAU,EAAE,CAAA;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;CACb;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,CAAA;IAC/B,oEAAoE;IACpE,OAAO,EAAE,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAA;CACrD;AAED,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IAEpD,gFAAgF;IAChF,SAAS,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IAE5D,gEAAgE;IAChE,OAAO,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IAEhC,kFAAkF;IAClF,MAAM,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAE5C;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAE7D;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACzC;AAED,4DAA4D;AAC5D,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;IAElE,2EAA2E;IAC3E,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;IAE3D,sFAAsF;IACtF,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAElD,mEAAmE;IACnE,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAE9C;;;OAGG;IACH,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IAE1C,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAA;IAEpE;;;;;;OAMG;IACH,OAAO,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;IAE1C;;;;OAIG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;IAE/D;;;;OAIG;IACH,oCAAoC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAErE;;;OAGG;IACH,oCAAoC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACtE"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/rbac/types.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAEzD,sDAAsD;AACtD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,qFAAqF;IACrF,QAAQ,EAAE,OAAO,CAAA;IACjB,4FAA4F;IAC5F,WAAW,EAAE,UAAU,EAAE,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,WAAW,EAAE,SAAS,UAAU,EAAE,CAAA;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;CACb;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,CAAA;IAC/B,oEAAoE;IACpE,OAAO,EAAE,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAA;CACrD;AAED,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACf;AAED,qHAAqH;AACrH,eAAO,MAAM,aAAa,MAAM,CAAA;AAEhC;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,WAAW,GAAG,mBAAmB,CAAA;AAE9E,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IAEpD,gFAAgF;IAChF,SAAS,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IAE5D,gEAAgE;IAChE,OAAO,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IAEhC,kFAAkF;IAClF,MAAM,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAE5C;;;;;;;;OAQG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAExE;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;CACpD;AAED,4DAA4D;AAC5D,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;IAElE,2EAA2E;IAC3E,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;IAE3D,sFAAsF;IACtF,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAElD;;;OAGG;IACH,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAEzD;;;;;OAKG;IACH,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAEnE,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAA;IAEpE;;;;;;OAMG;IACH,YAAY,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;IAEzE;;;;OAIG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAA;CAChE"}

package/dist/rbac/types.js

@@ -1,3 +1,4 @@
 // SPDX-License-Identifier: MIT
 // Copyright (c) 2024–2026 Flavio De Musso
-export {};
+/** Largest page the administration listings serve. Keeps every `IN (...)` fan-out under D1's bound-parameter cap. */
+export const MAX_PAGE_SIZE = 100;

package/dist/schema/manifest-seeds.js

@@ -10,9 +10,9 @@ import { MANIFEST_VERSION } from './manifest.types.js';
  * Fills in ids for branches authored without one, in declaration order.
  *
  * These ids are AUTHORING-LOCAL and non-authoritative — they exist so `validateSeedDefinitions`,
- * which fatals on a missing id, has a complete `Seed` to check. At plan/apply time the stored id
- * wins: `normalizeCandidate()` in the API's MCP slice matches by alias against the stored
- * definition before minting anything. Never persist an id minted here as if it were stable.
+ * which fatals on a missing id, has a complete `Seed` to check. NEVER send this output to plan/apply:
+ * a minted id looks authoritative to the server and shadows the stored one. The CLI sends the raw
+ * manifest seeds instead, so `resolveCandidateIds()` matches stored ids by alias.
  */
 function withBranchIds(branches) {
     const accumulated = [];

package/dist/search/search.repository.d.ts

@@ -30,15 +30,16 @@ export interface ISearchRepository {
      * Executes a UNION ALL full-text search across all FTS-enabled seed tables.
      * Returns at most options.limit + 1 rows so the caller can detect hasMore
      * without a separate count query for the cursor case.
-     * Implementations must propagate the EMPTY_QUERY error thrown by
-     * buildFtsQuery so the route handler can return an empty result set rather
-     * than a 500.
+     * A query with no usable terms (EMPTY_QUERY from buildFtsQuery) must resolve
+     * to an empty array rather than throw, so the route handler never returns a
+     * 500 for it.
      */
     search(options: SearchQueryOptions, seeds: Seed[]): Promise<SearchResultRow[]>;
     /**
      * Runs the count variant of the FTS query to support the `total` field in
      * the search response. Called in parallel with search() by the route handler
-     * with the same filter inputs but without limit/cursor.
+     * with the same filter inputs but without limit/cursor. An EMPTY_QUERY
+     * resolves to `{ total: 0 }` rather than throwing.
      */
     count(options: Omit<SearchQueryOptions, 'limit' | 'cursor'>, seeds: Seed[]): Promise<SearchCountResult>;
 }

package/dist/search/search.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.repository.d.ts","sourceRoot":"","sources":["../../src/search/search.repository.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAE9C,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;OAOG;IACH,MAAM,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAA;IAE9E;;;;OAIG;IACH,KAAK,CACH,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,QAAQ,CAAC,EACrD,KAAK,EAAE,IAAI,EAAE,GACZ,OAAO,CAAC,iBAAiB,CAAC,CAAA;CAC9B"}
+{"version":3,"file":"search.repository.d.ts","sourceRoot":"","sources":["../../src/search/search.repository.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAE9C,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;OAOG;IACH,MAAM,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAA;IAE9E;;;;;OAKG;IACH,KAAK,CACH,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,QAAQ,CAAC,EACrD,KAAK,EAAE,IAAI,EAAE,GACZ,OAAO,CAAC,iBAAiB,CAAC,CAAA;CAC9B"}

package/dist/search/vector-extractor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vector-extractor.d.ts","sourceRoot":"","sources":["../../src/search/vector-extractor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAG9C;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,IAAI,CAc1F"}
+{"version":3,"file":"vector-extractor.d.ts","sourceRoot":"","sources":["../../src/search/vector-extractor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAK9C;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,IAAI,CA4B1F"}

package/dist/search/vector-extractor.js

@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: MIT
 // Copyright (c) 2024–2026 Flavio De Musso
-import { indexableSearchBranches } from '../engine/ddl.js';
+import { indexableSearchBranches } from '../engine/ddl/ddl.js';
+import { isLocaleDictionary, isLocalizedBranch } from '../engine/localization/localization.js';
+import { extractRichtextText } from '../engine/validation/richtext-sanitizer.js';
 /**
  * Extracts and concatenates text from all public indexable text/richtext branches of a seed.
  * Enforces privacy policies by utilizing indexableSearchBranches.
@@ -16,9 +18,28 @@ export function extractIndexableText(seed, entry) {
     const texts = [];
     for (const branch of branches) {
         const val = entry[branch.alias];
-        if (val && typeof val === 'string') {
+        if (isLocalizedBranch(branch) && isLocaleDictionary(val)) {
+            // Every language is indexed, so a query matches regardless of the language it is typed in.
+            for (const localeValue of Object.values(val)) {
+                if (typeof localeValue === 'string' && localeValue) {
+                    texts.push(localeValue);
+                }
+                else if (branch.type === 'richtext') {
+                    const text = extractRichtextText(localeValue);
+                    if (text)
+                        texts.push(text);
+                }
+            }
+        }
+        else if (typeof val === 'string' && val) {
             texts.push(val);
         }
+        else if (branch.type === 'richtext') {
+            // Deserialized richtext is always a TipTap doc object (or v1 envelope), never a string.
+            const text = extractRichtextText(val);
+            if (text)
+                texts.push(text);
+        }
     }
     const combined = texts.join(' ').trim();
     return combined.length > 0 ? combined : null;

package/dist/search/vector.repository.d.ts

@@ -4,10 +4,11 @@ export interface IVectorRepository {
     saveVector(seed: Seed, entryId: string, vector: Float32Array): Promise<void>;
     /** Removes the embedding vector (used when unpublished/deleted) */
     deleteVector(seed: Seed, entryId: string): Promise<void>;
-    /** Retrieves all vectors for a given seed to compile to R2 */
+    /** Retrieves all vectors (with entry title) for a given seed to compile to R2 */
     getAllVectors(seed: Seed): Promise<{
         entryId: string;
         vector: Float32Array;
+        title: string;
     }[]>;
 }
 //# sourceMappingURL=vector.repository.d.ts.map

package/dist/search/vector.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vector.repository.d.ts","sourceRoot":"","sources":["../../src/search/vector.repository.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAE9C,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE5E,mEAAmE;IACnE,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAExD,8DAA8D;IAC9D,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,YAAY,CAAA;KAAE,EAAE,CAAC,CAAA;CAChF"}
+{"version":3,"file":"vector.repository.d.ts","sourceRoot":"","sources":["../../src/search/vector.repository.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAE9C,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE5E,mEAAmE;IACnE,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAExD,iFAAiF;IACjF,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,YAAY,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAA;CAC/F"}

package/dist/security/time-trap-token.repository.d.ts

@@ -1,8 +1,10 @@
 export interface ITimeTrapTokenRepository {
-    /** Checks if a time-trap token hash has already been consumed. */
+    /** Cheap, non-atomic pre-check used only to fail fast before expensive validation. */
     isTokenUsed(tokenHash: string): Promise<boolean>;
-    /** Marks a time-trap token hash as consumed with an expiration timestamp. */
-    markTokenUsed(tokenHash: string, usedAt: number, expiresAt: number): Promise<void>;
+    /** Atomically claims a token hash as consumed. Returns false if it was already claimed. */
+    claimToken(tokenHash: string, usedAt: number, expiresAt: number): Promise<boolean>;
+    /** Releases a previously claimed token hash, allowing retry after a failed content creation. */
+    releaseToken(tokenHash: string): Promise<void>;
     /** Cleans up expired token entries. */
     cleanup(nowSeconds: number): Promise<void>;
 }

package/dist/security/time-trap-token.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"time-trap-token.repository.d.ts","sourceRoot":"","sources":["../../src/security/time-trap-token.repository.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,wBAAwB;IACvC,kEAAkE;IAClE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAChD,6EAA6E;IAC7E,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClF,uCAAuC;IACvC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3C"}
+{"version":3,"file":"time-trap-token.repository.d.ts","sourceRoot":"","sources":["../../src/security/time-trap-token.repository.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,wBAAwB;IACvC,sFAAsF;IACtF,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAChD,2FAA2F;IAC3F,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAClF,gGAAgG;IAChG,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9C,uCAAuC;IACvC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3C"}

package/dist/settings/site-settings.repository.d.ts

@@ -6,6 +6,14 @@ export interface SiteSettings {
     companyName: string | null;
     companyWebsite: string | null;
     companyAbbreviation: string | null;
+    /**
+     * Content locales for field-level localization, in display order. `null` = never configured
+     * (resolveLocaleConfig then falls back to `[defaultLanguage]`). Distinct from `defaultLanguage`,
+     * which is the dashboard UI language.
+     */
+    locales: string[] | null;
+    /** Default content locale. `null` = never configured. */
+    defaultLocale: string | null;
 }
 export interface ISiteSettingsRepository {
     /** Returns all stored settings, applying sensible defaults for missing keys. */

package/dist/settings/site-settings.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"site-settings.repository.d.ts","sourceRoot":"","sources":["../../src/settings/site-settings.repository.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,EAAE,MAAM,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,gFAAgF;IAChF,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC,CAAA;IAC/B,kFAAkF;IAClF,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACtD"}
+{"version":3,"file":"site-settings.repository.d.ts","sourceRoot":"","sources":["../../src/settings/site-settings.repository.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,EAAE,MAAM,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IACxB,yDAAyD;IACzD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,gFAAgF;IAChF,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC,CAAA;IAC/B,kFAAkF;IAClF,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACtD"}

package/dist/transfer/flat-seed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flat-seed.d.ts","sourceRoot":"","sources":["../../src/transfer/flat-seed.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAc,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAqB9E,4FAA4F;AAC5F,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,CAEpD;AAED,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAE9C;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,cAAc,GACrB,mBAAmB,CAWrB"}
+{"version":3,"file":"flat-seed.d.ts","sourceRoot":"","sources":["../../src/transfer/flat-seed.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAc,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAGlE,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAuB9E,4FAA4F;AAC5F,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,CAEpD;AAED,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAE9C;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,cAAc,GACrB,mBAAmB,CAWrB"}

package/dist/transfer/flat-seed.js

@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: MIT
 // Copyright (c) 2024–2026 Flavio De Musso
+import { isAssetListBranch } from '../engine/validation/file-branch.js';
+import { isLocalizedBranch } from '../engine/localization/localization.js';
 /**
  * Branch types whose value is a collection or a nested document, never a scalar cell.
  * A CSV cell cannot carry them without inventing a flattening convention that the
@@ -10,12 +12,15 @@ const NON_FLAT_BRANCH_TYPES = new Set([
     'repeater',
     'tags',
     'json',
+    'richtext',
 ]);
 /** True for a branch that cannot be represented as a single scalar CSV cell. */
 function isNonFlat(branch) {
+    if (isLocalizedBranch(branch))
+        return true;
     // A `file` branch is a single URL string — flat — unless it is an asset list.
     if (branch.type === 'file')
-        return branch.multiple === true;
+        return isAssetListBranch(branch);
     return NON_FLAT_BRANCH_TYPES.has(branch.type);
 }
 /** Every branch of `seed` that makes it non-flat, in declaration order. Empty when flat. */

package/dist/transfer/row-mapping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"row-mapping.d.ts","sourceRoot":"","sources":["../../src/transfer/row-mapping.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEzF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,+DAAgE,CAAA;AAclG;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,CAMlD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAO1F;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,CAgBhF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,aAAa,CAYrE"}
+{"version":3,"file":"row-mapping.d.ts","sourceRoot":"","sources":["../../src/transfer/row-mapping.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEzF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,+DAAgE,CAAA;AAclG;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,CAMlD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAU1F;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,CAiBhF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,aAAa,CAarE"}

package/dist/transfer/row-mapping.js

@@ -44,6 +44,9 @@ export function toCsvCells(record, columns) {
             return null;
         if (typeof value === 'boolean')
             return value ? 'true' : 'false';
+        if (typeof value === 'object') {
+            throw new TypeError(`Cannot serialize non-scalar value for column "${column}" to CSV cell`);
+        }
         return String(value);
     });
 }
@@ -60,8 +63,10 @@ export function fromCsvCells(columns, cells) {
             message: `Expected ${columns.length} columns, received ${cells.length}`,
         };
     }
-    const record = {};
+    const record = Object.create(null);
     for (const [index, column] of columns.entries()) {
+        if (column === '__proto__' || column === 'constructor' || column === 'prototype')
+            continue;
         const cell = cells[index] ?? '';
         if (cell === '')
             continue;
@@ -76,8 +81,10 @@ export function fromCsvCells(columns, cells) {
  * `data` straight to `validateAndSanitizeSeedPayload` without re-filtering.
  */
 export function toImportPayload(record) {
-    const data = {};
+    const data = Object.create(null);
     for (const [key, value] of Object.entries(record)) {
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+            continue;
         if (IMPORT_REJECTED_COLUMNS.has(key))
             continue;
         if (key === 'slug' || key === 'status')

package/package.json

@@ -1,18 +1,23 @@
 {
   "name": "@beechcms/core",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
-    "dist"
+    "dist",
+    "!dist/.tsbuildinfo"
   ],
   "exports": {
     ".": {
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
     },
+    "./schema": {
+      "import": "./dist/schema/index.js",
+      "types": "./dist/schema/index.d.ts"
+    },
     "./richtext-render": {
       "import": "./dist/content/richtext/richtext-render.js",
       "types": "./dist/content/richtext/richtext-render.d.ts"
@@ -40,7 +45,6 @@
     "@tiptap/extension-table": "^3.31.3",
     "@tiptap/extension-text-align": "^3.31.3",
     "@tiptap/extension-text-style": "^3.31.3",
-    "@tiptap/extension-underline": "^3.31.3",
     "@tiptap/html": "^3.31.3",
     "@tiptap/starter-kit": "^3.31.3",
     "katex": "^0.16.11",
@@ -53,6 +57,7 @@
     "lint": "eslint .",
     "type-check": "tsc --noEmit",
     "test": "vitest run",
+    "test:unit": "vitest run",
     "test:coverage": "vitest run --coverage"
   }
 }