@beechcms/core 0.9.3 → 0.9.5

package/dist/engine/serialize.js

@@ -0,0 +1,160 @@
+/**
+ * Checks if a branch represents a multiple asset list field.
+ *
+ * @param branch The branch definition.
+ * @returns True if it's an asset list, false otherwise.
+ */
+function isAssetListBranch(branch) {
+    return branch.type === 'file' && (branch.multiple === true || branch.format === 'asset-list');
+}
+/**
+ * Normalizes an unknown value to a valid HTTP URL string, or null.
+ *
+ * @param value The value to normalize.
+ * @returns The normalized URL string, or null if invalid.
+ */
+function normalizeHttpUrl(value) {
+    if (typeof value !== 'string')
+        return null;
+    const cleaned = value.trim();
+    if (!cleaned)
+        return null;
+    try {
+        const parsed = new URL(cleaned);
+        return parsed.protocol.startsWith('http') ? cleaned : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Safely parses a JSON string, falling back to the raw string on error.
+ *
+ * @param value The string to parse.
+ * @returns The parsed object, or the original string.
+ */
+function parseJsonSafe(value) {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return value;
+    }
+}
+/**
+ * Normalizes raw asset list values to a flat list of valid URL strings.
+ *
+ * @param rawValue The raw value (string, array, or object) to normalize.
+ * @returns An array of unique normalized URL strings.
+ */
+function normalizeAssetListValue(rawValue) {
+    const input = typeof rawValue === 'string' ? parseJsonSafe(rawValue) : rawValue;
+    const values = Array.isArray(input) ? input : [input];
+    const normalized = [];
+    for (const item of values) {
+        if (item == null)
+            continue;
+        const direct = normalizeHttpUrl(item);
+        if (direct) {
+            normalized.push(direct);
+            continue;
+        }
+        if (typeof item === 'object' && !Array.isArray(item)) {
+            const fromObj = normalizeHttpUrl(item.url);
+            if (fromObj)
+                normalized.push(fromObj);
+        }
+    }
+    return [...new Set(normalized)];
+}
+/**
+ * Serializes a value for writing to the DB.
+ * boolean → 0/1 | date → Unix timestamp | json/tags/richtext/repeater → JSON string
+ *
+ * @param branch The branch definition.
+ * @param value The value to serialize.
+ * @returns The serialized DB value (string, number, or null).
+ */
+export function serializeForDb(branch, value) {
+    if (value === null || value === undefined)
+        return null;
+    switch (branch.type) {
+        case 'boolean':
+            return value ? 1 : 0;
+        case 'json':
+        case 'tags':
+        case 'richtext':
+            return typeof value === 'string' ? value : JSON.stringify(value);
+        case 'date': {
+            if (typeof value === 'number')
+                return value;
+            if (typeof value === 'string') {
+                const d = new Date(value);
+                if (Number.isNaN(d.getTime()))
+                    return null;
+                if (branch.format === 'date') {
+                    const midnight = Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate());
+                    return Math.floor(midnight / 1000);
+                }
+                return Math.floor(d.getTime() / 1000);
+            }
+            return null;
+        }
+        case 'file':
+            if (isAssetListBranch(branch)) {
+                return Array.isArray(value) ? JSON.stringify(value) : typeof value === 'string' ? value : null;
+            }
+            return typeof value === 'string' ? value : null;
+        case 'repeater':
+            return JSON.stringify(Array.isArray(value) ? value : []);
+        default:
+            return typeof value === 'string' ? value : typeof value === 'number' ? value : null;
+    }
+}
+/**
+ * Deserializes a value read from the DB to its API/JS representation.
+ * 0/1 → boolean | Unix timestamp → ISO 8601 | JSON string → object/array
+ *
+ * @param branch The branch definition.
+ * @param value The raw database value.
+ * @returns The deserialized value.
+ */
+export function deserializeFromDb(branch, value) {
+    if (branch.type === 'repeater') {
+        if (typeof value !== 'string' || value.length === 0)
+            return [];
+        const parsed = parseJsonSafe(value);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    if (value === null || value === undefined)
+        return null;
+    switch (branch.type) {
+        case 'boolean':
+            return value === 1 || value === true;
+        case 'json':
+        case 'tags':
+        case 'richtext': {
+            if (typeof value === 'string') {
+                try {
+                    return JSON.parse(value);
+                }
+                catch {
+                    return value;
+                }
+            }
+            return value;
+        }
+        case 'date': {
+            if (typeof value !== 'number')
+                return null;
+            const d = new Date(value * 1000);
+            return branch.format === 'date' ? d.toISOString().slice(0, 10) : d.toISOString();
+        }
+        case 'file':
+            if (isAssetListBranch(branch))
+                return normalizeAssetListValue(value);
+            return typeof value === 'string' ? value : null;
+        default:
+            return value;
+    }
+}

package/dist/seed-types-generator.d.ts

@@ -0,0 +1,10 @@
+import type { Seed, Branch } from './engine/types.js';
+/** slug/alias → PascalCase identifier. 'blog-posts' → 'BlogPosts'. */
+export declare function pascalCase(input: string): string;
+/** Maps a single Branch to its TypeScript type expression (no optional marker). */
+export declare function tsTypeForBranch(branch: Branch): string;
+/** Emits one exported interface for a single Seed. */
+export declare function interfaceForSeed(seed: Seed): string;
+/** Pure entry point. Deterministic: sorts seeds by slug for stable diffs. */
+export declare function generateSeedTypes(seeds: Seed[]): string;
+//# sourceMappingURL=seed-types-generator.d.ts.map

package/dist/seed-types-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed-types-generator.d.ts","sourceRoot":"","sources":["../src/seed-types-generator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAerD,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMhD;AAMD,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAoCtD;AAWD,sDAAsD;AACtD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAYnD;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CASvD"}

package/dist/seed-types-generator.js

@@ -0,0 +1,86 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) 2024–2026 Flavio De Musso
+const HEADER = '// Questo file è generato automaticamente da BeechCMS CLI. Non modificarlo direttamente.\n';
+/** System columns emitted by generateCreateTable — always present, never optional. */
+const SYSTEM_FIELDS = `  id: string\n` +
+    `  slug: string\n` +
+    `  status: 'draft' | 'review' | 'published' | 'archived'\n`;
+const SYSTEM_TIMESTAMPS = `  created_at: number\n` +
+    `  updated_at: number\n`;
+/** slug/alias → PascalCase identifier. 'blog-posts' → 'BlogPosts'. */
+export function pascalCase(input) {
+    return input
+        .split(/[^A-Za-z0-9]+/)
+        .filter(Boolean)
+        .map(w => w.charAt(0).toUpperCase() + w.slice(1))
+        .join('');
+}
+function literalUnion(options) {
+    return options.map(o => `'${o.replace(/'/g, "\\'")}'`).join(' | ');
+}
+/** Maps a single Branch to its TypeScript type expression (no optional marker). */
+export function tsTypeForBranch(branch) {
+    switch (branch.type) {
+        case 'number':
+        case 'date':
+            return 'number';
+        case 'boolean':
+            return 'boolean';
+        case 'json':
+            return 'unknown';
+        case 'text':
+        case 'richtext':
+        case 'file': {
+            const base = branch.type === 'text' && branch.options?.length
+                ? literalUnion(branch.options)
+                : 'string';
+            return branch.type === 'file' && branch.multiple ? `${base}[]` : base;
+        }
+        case 'tags': {
+            const base = branch.options?.length ? `(${literalUnion(branch.options)})` : 'string';
+            return `${base}[]`;
+        }
+        case 'relation':
+            return branch.multiple ? 'string[]' : 'string';
+        case 'repeater': {
+            const inner = (branch.fields ?? [])
+                .map(f => `${propName(f)}${optional(f)}: ${tsTypeForBranch(f)}`)
+                .join('; ');
+            return `Array<{ ${inner} }>`;
+        }
+        default: {
+            // Exhaustiveness guard — fails the build if BranchType gains a member.
+            const _never = branch.type;
+            return _never;
+        }
+    }
+}
+function optional(branch) {
+    return branch.requiredOnCreate ? '' : '?';
+}
+function propName(branch) {
+    // alias is a valid SQL column; quote only if not a plain identifier.
+    return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(branch.alias) ? branch.alias : `'${branch.alias}'`;
+}
+/** Emits one exported interface for a single Seed. */
+export function interfaceForSeed(seed) {
+    const name = pascalCase(seed.slug);
+    const props = seed.branches
+        .map(b => `  ${propName(b)}${optional(b)}: ${tsTypeForBranch(b)}`)
+        .join('\n');
+    return (`export interface ${name} {\n` +
+        SYSTEM_FIELDS +
+        (props ? props + '\n' : '') +
+        SYSTEM_TIMESTAMPS +
+        `}\n`);
+}
+/** Pure entry point. Deterministic: sorts seeds by slug for stable diffs. */
+export function generateSeedTypes(seeds) {
+    const sorted = [...seeds].sort((a, b) => a.slug.localeCompare(b.slug));
+    const interfaces = sorted.map(interfaceForSeed).join('\n');
+    const registry = `export interface SeedRegistryTypes {\n` +
+        sorted.map(s => `  ${propName({ alias: s.slug })}: ${pascalCase(s.slug)}`).join('\n') +
+        (sorted.length ? '\n' : '') +
+        `}\n`;
+    return `${HEADER}\n${interfaces}\n${registry}`;
+}

package/dist/webhooks/webhook-validation.d.ts

@@ -1,3 +1,7 @@
-export declare const PRIVATE_HOST_REGEX: RegExp;
+/**
+ * Whether a webhook target host is loopback, link-local, private or otherwise internal.
+ * Expects `URL.hostname`, which the WHATWG parser already normalises: IPv6 literals stay bracketed
+ * and IPv4-mapped tails are rewritten to hex, so the address is parsed, never string-matched.
+ */
 export declare function isPrivateHost(hostname: string): boolean;
 //# sourceMappingURL=webhook-validation.d.ts.map

package/dist/webhooks/webhook-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-validation.d.ts","sourceRoot":"","sources":["../../src/webhooks/webhook-validation.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,kBAAkB,QAC0H,CAAA;AAEzJ,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEvD"}
+{"version":3,"file":"webhook-validation.d.ts","sourceRoot":"","sources":["../../src/webhooks/webhook-validation.ts"],"names":[],"mappings":"AA4EA;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAYvD"}

package/dist/webhooks/webhook-validation.js

@@ -1,6 +1,88 @@
 // SPDX-License-Identifier: MIT
 // Copyright (c) 2024–2026 Flavio De Musso
-export const PRIVATE_HOST_REGEX = /^(localhost|127\.\d+\.\d+\.\d+|::1|10\.\d+\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+|169\.254\.\d+\.\d+|fc00:|fe80:|0\.0\.0\.0)/i;
+const IPV4_PATTERN = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+const HEXTET_PATTERN = /^[0-9a-f]{1,4}$/;
+function parseIPv4(text) {
+    const match = IPV4_PATTERN.exec(text);
+    if (!match)
+        return null;
+    const octets = match.slice(1).map(Number);
+    return octets.every((octet) => octet <= 255) ? octets : null;
+}
+// Expands an IPv6 literal (no brackets) into its eight 16-bit groups, or null when malformed.
+function parseIPv6(text) {
+    let literal = text;
+    const lastColon = literal.lastIndexOf(':');
+    if (literal.includes('.')) {
+        const v4 = parseIPv4(literal.slice(lastColon + 1));
+        if (!v4)
+            return null;
+        const high = ((v4[0] << 8) | v4[1]).toString(16);
+        const low = ((v4[2] << 8) | v4[3]).toString(16);
+        literal = `${literal.slice(0, lastColon + 1)}${high}:${low}`;
+    }
+    const halves = literal.split('::');
+    if (halves.length > 2)
+        return null;
+    const split = (half) => (half === '' ? [] : half.split(':'));
+    const head = split(halves[0]);
+    const tail = halves.length === 2 ? split(halves[1]) : [];
+    const compressed = halves.length === 2;
+    if (compressed ? head.length + tail.length > 7 : head.length !== 8)
+        return null;
+    const groups = compressed
+        ? [...head, ...Array(8 - head.length - tail.length).fill('0'), ...tail]
+        : head;
+    if (!groups.every((group) => HEXTET_PATTERN.test(group)))
+        return null;
+    return groups.map((group) => Number.parseInt(group, 16));
+}
+function isPrivateIPv4([a, b]) {
+    return (a === 0 ||
+        a === 10 ||
+        (a === 100 && b >= 64 && b <= 127) ||
+        a === 127 ||
+        (a === 169 && b === 254) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && b === 168));
+}
+// Groups g6 and g7 carry the embedded IPv4 address of the mapped, NAT64 and 6to4 forms.
+function embeddedIPv4(high, low) {
+    return [high >> 8, high & 0xff, low >> 8, low & 0xff];
+}
+function isPrivateIPv6(groups) {
+    const [g0, g1, g2, g3, g4, g5, g6, g7] = groups;
+    const leadingZeros = (count) => groups.slice(0, count).every((group) => group === 0);
+    // ::/96 covers the unspecified address, loopback and the deprecated IPv4-compatible form.
+    if (leadingZeros(6))
+        return true;
+    // ::ffff:0:0/96 (IPv4-mapped) is the same host as the IPv4 address it wraps.
+    if (leadingZeros(5) && g5 === 0xffff)
+        return isPrivateIPv4(embeddedIPv4(g6, g7));
+    // 64:ff9b::/96 (NAT64) translates to the embedded IPv4 address.
+    if (g0 === 0x64 && g1 === 0xff9b && g2 === 0 && g3 === 0 && g4 === 0 && g5 === 0) {
+        return isPrivateIPv4(embeddedIPv4(g6, g7));
+    }
+    // 2002::/16 (6to4) embeds the IPv4 address in the next 32 bits.
+    if (g0 === 0x2002)
+        return isPrivateIPv4(embeddedIPv4(g1, g2));
+    // fc00::/7 unique local, fe80::/10 link-local.
+    return (g0 & 0xfe00) === 0xfc00 || (g0 & 0xffc0) === 0xfe80;
+}
+/**
+ * Whether a webhook target host is loopback, link-local, private or otherwise internal.
+ * Expects `URL.hostname`, which the WHATWG parser already normalises: IPv6 literals stay bracketed
+ * and IPv4-mapped tails are rewritten to hex, so the address is parsed, never string-matched.
+ */
 export function isPrivateHost(hostname) {
-    return PRIVATE_HOST_REGEX.test(hostname);
+    const host = hostname.toLowerCase().replace(/\.$/, '');
+    if (host === 'localhost' || host.endsWith('.localhost'))
+        return true;
+    if (host.startsWith('[') && host.endsWith(']')) {
+        const groups = parseIPv6(host.slice(1, -1));
+        // An unparseable literal is rejected rather than trusted.
+        return groups === null || isPrivateIPv6(groups);
+    }
+    const octets = parseIPv4(host);
+    return octets !== null && isPrivateIPv4(octets);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beechcms/core",
-  "version": "0.9.3",
+  "version": "0.9.5",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -30,7 +30,7 @@
   "devDependencies": {
     "@types/node": "^26.5.1",
     "@vitest/coverage-v8": "^5.0.0",
-    "vitest": "^5.0.0"
+    "vitest": "^5.0.5"
   },
   "dependencies": {
     "@tiptap/core": "^3.31.3",